[PULL 0/9] aspeed queue

[PULL 0/9] aspeed queue

[Cédric Le Goater]

The following changes since commit 5e61afe211e82a9af15a8794a0bd29bb574e953b:

  Merge tag 'ui-pull-request' of https://gitlab.com/marcandre.lureau/qemu into staging (2026-05-11 10:49:53 -0400)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-aspeed-20260512

for you to fetch changes up to 04d249d1efbbecc74eb82d26558c78d5a3b43630:

  hw/i3c/dw-i3c: Fix BCR/DCR extraction and PID assembly during ENTDAA (2026-05-12 09:36:23 +0200)

----------------------------------------------------------------
aspeed queue:

* Security fixes for HACE hash engine and SBC OTP controller
* Bug fix of the I3C controller
* Removal of BMC machines (fby35, fp5280g2-bmc, qcom-*, sonorapass-bmc)
  deprecated in QEMU 10.2

----------------------------------------------------------------
Ashish Anand (1):
      hw/i3c/dw-i3c: Fix BCR/DCR extraction and PID assembly during ENTDAA

Cédric Le Goater (6):
      aspeed/hace: Fix out-of-bounds read in has_padding()
      aspeed/hace: Prevent total_req_len overflow
      hw/arm: Remove sonorapass-bmc machine
      hw/arm: Remove qcom-dc-scm-v1-bmc and qcom-firework-bmc machines
      hw/arm: Remove fp5280g2-bmc machine
      hw/arm: Remove fby35 machine

Kane Chen (2):
      hw/misc/aspeed_sbc: Add bounds checking for OTP write operations
      aspeed/hace: Fix mapped address may not be unmapped issue

 MAINTAINERS                            |   2 -
 docs/about/deprecated.rst              |  37 ------
 docs/about/removed-features.rst        |  38 +++++-
 docs/system/arm/aspeed.rst             |   8 +-
 docs/system/arm/fby35.rst              |  52 ---------
 docs/system/target-arm.rst             |   1 -
 include/hw/i3c/i3c.h                   |   7 ++
 hw/arm/aspeed_ast2500_fp5280g2.c       |  88 --------------
 hw/arm/aspeed_ast2500_sonorapass.c     | 102 -----------------
 hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c |  55 ---------
 hw/arm/aspeed_ast2600_qcom-firework.c  |  91 ---------------
 hw/arm/fby35.c                         | 203 ---------------------------------
 hw/i3c/dw-i3c.c                        |  16 ++-
 hw/misc/aspeed_hace.c                  |  90 ++++++++++++---
 hw/misc/aspeed_sbc.c                   |  12 +-
 hw/nvram/aspeed_otp.c                  |  13 +--
 hw/arm/meson.build                     |   7 +-
 17 files changed, 141 insertions(+), 681 deletions(-)
 delete mode 100644 docs/system/arm/fby35.rst
 delete mode 100644 hw/arm/aspeed_ast2500_fp5280g2.c
 delete mode 100644 hw/arm/aspeed_ast2500_sonorapass.c
 delete mode 100644 hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c
 delete mode 100644 hw/arm/aspeed_ast2600_qcom-firework.c
 delete mode 100644 hw/arm/fby35.c

[PULL 1/9] hw/misc/aspeed_sbc: Add bounds checking for OTP write operations

[Cédric Le Goater]

From: Kane Chen <kane_chen@aspeedtech.com>

There is a mismatch between the Aspeed OTP model and the Aspeed SBC
model in how the guest-provided address is handled.
aspeed_sbc_otp_prog() passes a word-indexed address directly
to address_space_write() without converting it to a byte offset,
whereas aspeed_otp_write() expects a byte offset and applies an
additional shift (otp_addr << 2). This double-shift confusion means
that an out-of-range word address can lead to a write beyond the
allocated storage.

Fix this by adding bounds checking on the word offset before
converting to byte offset and passing to address_space_write().
This matches the existing bounds check in aspeed_sbc_otp_read().

Cc: Kane-Chen-AS <kane_chen@aspeedtech.com>
Cc: qemu-stable@nongnu.org
Fixes: 1a00754ccf15 ("hw/misc: Add Aspeed Secure Boot Controller model")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3436
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260428055254.76581-2-kane_chen@aspeedtech.com
[ clg: Kept otp_addr in event logged in aspeed_sbc_otp_prog() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_sbc.c  | 12 ++++++++++--
 hw/nvram/aspeed_otp.c | 13 ++++++-------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 065e822e70d9..e5dab1c7bb7c 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -159,9 +159,17 @@ static bool aspeed_sbc_otp_prog(AspeedSBCState *s,
     MemTxResult ret;
     AspeedOTPState *otp = &s->otp;
     uint32_t value = s->regs[R_CAMP1];
+    uint32_t otp_offset = otp_addr << 2;
 
-    ret = address_space_write(&otp->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
-                        &value, sizeof(value));
+    if (otp_addr >= OTP_TOTAL_DWORD_COUNT) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Invalid OTP addr 0x%x\n",
+                      otp_addr);
+        return false;
+    }
+
+    ret = address_space_write(&otp->as, otp_offset, MEMTXATTRS_UNSPECIFIED,
+                              &value, sizeof(value));
     if (ret != MEMTX_OK) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "Failed to write OTP memory, addr = %x\n",
diff --git a/hw/nvram/aspeed_otp.c b/hw/nvram/aspeed_otp.c
index a60289000c37..1a9d3841b8d6 100644
--- a/hw/nvram/aspeed_otp.c
+++ b/hw/nvram/aspeed_otp.c
@@ -57,12 +57,12 @@ static bool valid_program_data(uint32_t otp_addr,
     return has_programmable_bits != 0;
 }
 
-static bool program_otpmem_data(void *opaque, uint32_t otp_addr,
+static bool program_otpmem_data(void *opaque, hwaddr otp_offset,
                              uint32_t prog_bit, uint32_t *value)
 {
     AspeedOTPState *s = opaque;
+    uint32_t otp_addr = otp_offset >> 2;
     bool is_odd = otp_addr & 1;
-    uint32_t otp_offset = otp_addr << 2;
 
     memcpy(value, s->storage + otp_offset, sizeof(uint32_t));
 
@@ -79,26 +79,25 @@ static bool program_otpmem_data(void *opaque, uint32_t otp_addr,
     return true;
 }
 
-static void aspeed_otp_write(void *opaque, hwaddr otp_addr,
+static void aspeed_otp_write(void *opaque, hwaddr otp_offset,
                                 uint64_t val, unsigned size)
 {
     AspeedOTPState *s = opaque;
-    uint32_t otp_offset, value;
+    uint32_t value;
 
-    if (!program_otpmem_data(s, otp_addr, val, &value)) {
+    if (!program_otpmem_data(s, otp_offset, val, &value)) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: Failed to program data, value = %x, bit = %"PRIx64"\n",
                       __func__, value, val);
         return;
     }
 
-    otp_offset = otp_addr << 2;
     memcpy(s->storage + otp_offset, &value, size);
 
     if (s->blk) {
         if (blk_pwrite(s->blk, otp_offset, size, &value, 0) < 0) {
             qemu_log_mask(LOG_GUEST_ERROR,
-                          "%s: Failed to write %x to %x\n",
+                          "%s: Failed to write %x to %"HWADDR_PRIx"\n",
                           __func__, value, otp_offset);
 
             return;
-- 
2.54.0

[PULL 2/9] aspeed/hace: Fix out-of-bounds read in has_padding()

[Cédric Le Goater]

The has_padding() function reads the last 8 bytes of a DMA buffer
without validating req_len. req_len is guest-controlled (via
R_HASH_SRC_LEN register or scatter-gather entries) and values less
than 8 cause integer underflow. This can result in an out-of-bounds
read of QEMU process memory.

Add a check to ensure req_len >= 8 before accessing the buffer.

Reported-by: Katherine Leaver <katherine.j.leaver@gmail.com>
Cc: qemu-stable@nongnu.org
Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
Link: https://lore.kernel.org/qemu-devel/20260504213421.710035-2-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 23e8030cd966..ef698b3ecb72 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -154,6 +154,14 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
                         hwaddr req_len, uint32_t *total_msg_len,
                         uint32_t *pad_offset)
 {
+    /* Need at least 8 bytes to read the total message length field */
+    if (req_len < 8) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid request length=0x%" HWADDR_PRIx "\n",
+                      __func__, req_len);
+        return false;
+    }
+
     *total_msg_len = (uint32_t)(ldq_be_p(iov->iov_base + req_len - 8) / 8);
     /*
      * SG_LIST_LEN_LAST asserted in the request length doesn't mean it is the
-- 
2.54.0

[PULL 3/9] aspeed/hace: Prevent total_req_len overflow

[Cédric Le Goater]

In accumulate mode, total_req_len is incremented with plen (hwaddr)
for each hash request. Repeated additions can overflow total_req_len
(uint32_t) and potentially bypass validation checks in has_padding().

Add a helper function to detect overflow before incrementing
total_req_len and reject the request if overflow would occur.

Reported-by: Katherine Leaver <katherine.j.leaver@gmail.com>
Cc: qemu-stable@nongnu.org
Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
Link: https://lore.kernel.org/qemu-devel/20260504213421.710035-3-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index ef698b3ecb72..0504d61cbf0a 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -205,6 +205,19 @@ static uint64_t hash_get_source_addr(AspeedHACEState *s)
     return src_addr;
 }
 
+static bool hash_accumulate_len(AspeedHACEState *s, hwaddr plen)
+{
+    if (plen > UINT32_MAX - s->total_req_len) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: total_req_len overflow, current=0x%x, adding=0x%"
+                      HWADDR_PRIx "\n", __func__, s->total_req_len, plen);
+        return false;
+    }
+
+    s->total_req_len += plen;
+    return true;
+}
+
 static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov,
                                    bool acc_mode, bool *acc_final_request)
 {
@@ -232,7 +245,9 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov,
     iov_idx = 1;
 
     if (acc_mode) {
-        s->total_req_len += plen;
+        if (!hash_accumulate_len(s, plen)) {
+            return -1;
+        }
 
         if (has_padding(s, &iov[0], plen, &total_msg_len,
                         &pad_offset)) {
@@ -299,7 +314,9 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
 
         iov[iov_idx].iov_base = haddr;
         if (acc_mode) {
-            s->total_req_len += plen;
+            if (!hash_accumulate_len(s, plen)) {
+                return -1;
+            }
 
             if (has_padding(s, &iov[iov_idx], plen, &total_msg_len,
                             &pad_offset)) {
-- 
2.54.0

[PULL 4/9] aspeed/hace: Fix mapped address may not be unmapped issue

[Cédric Le Goater]

From: Kane Chen <kane_chen@aspeedtech.com>

In the do_hash_operation, the code may be returned earlier because
hash_prepare_sg_iov or hash_prepare_direct_iov may return a failure.
When this condition is happened, current code flow doesn't go through
later code segments. Finally, it causes the mapped address isn't
unmapped properly.

This change unmaps any mapped addresses when an error occurs,
preventing a resource leak.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20260512065002.1516704-2-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 63 ++++++++++++++++++++++++++++++-------------
 1 file changed, 45 insertions(+), 18 deletions(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 0504d61cbf0a..a322905cb37b 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -218,8 +218,19 @@ static bool hash_accumulate_len(AspeedHACEState *s, hwaddr plen)
     return true;
 }
 
+static void hash_iov_unmap(AspeedHACEState *s, struct iovec *iov,
+                           hwaddr *mapped_lens, int iov_count)
+{
+    for (; iov_count > 0; iov_count--) {
+        address_space_unmap(&s->dram_as, iov[iov_count - 1].iov_base,
+                            mapped_lens[iov_count - 1], false,
+                            mapped_lens[iov_count - 1]);
+    }
+}
+
 static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov,
-                                   bool acc_mode, bool *acc_final_request)
+                                   bool acc_mode, bool *acc_final_request,
+                                   hwaddr *mapped_lens)
 {
     uint32_t total_msg_len;
     uint32_t pad_offset;
@@ -243,9 +254,11 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov,
 
     iov[0].iov_base = haddr;
     iov_idx = 1;
+    mapped_lens[0] = plen;
 
     if (acc_mode) {
         if (!hash_accumulate_len(s, plen)) {
+            hash_iov_unmap(s, iov, mapped_lens, 1);
             return -1;
         }
 
@@ -265,7 +278,8 @@ static int hash_prepare_direct_iov(AspeedHACEState *s, struct iovec *iov,
 }
 
 static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
-                               bool acc_mode, bool *acc_final_request)
+                               bool acc_mode, bool *acc_final_request,
+                               hwaddr *mapped_lens)
 {
     uint32_t total_msg_len;
     uint32_t pad_offset;
@@ -275,6 +289,7 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
     int iov_idx;
     hwaddr plen;
     void *haddr;
+    int iov_mapped = 0;
 
     src = hash_get_source_addr(s);
     for (iov_idx = 0; !(len & SG_LIST_LEN_LAST); iov_idx++) {
@@ -282,7 +297,7 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
             qemu_log_mask(LOG_GUEST_ERROR,
                           "%s: Failed to set end of sg list marker\n",
                           __func__);
-            return -1;
+            goto fail;
         }
 
         len = address_space_ldl_le(&s->dram_as, src,
@@ -307,15 +322,17 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
                           "%s: Unable to map address, sg_addr=0x%x, "
                           "plen=0x%" HWADDR_PRIx "\n",
                           __func__, sg_addr, plen);
-            return -1;
+            goto fail;
         }
 
         src += SG_LIST_ENTRY_SIZE;
 
         iov[iov_idx].iov_base = haddr;
+        iov_mapped = iov_idx + 1;
+        mapped_lens[iov_idx] = plen;
         if (acc_mode) {
             if (!hash_accumulate_len(s, plen)) {
-                return -1;
+                goto fail;
             }
 
             if (has_padding(s, &iov[iov_idx], plen, &total_msg_len,
@@ -332,6 +349,10 @@ static int hash_prepare_sg_iov(AspeedHACEState *s, struct iovec *iov,
     }
 
     return iov_idx;
+
+fail:
+    hash_iov_unmap(s, iov, mapped_lens, iov_mapped);
+    return -1;
 }
 
 static uint64_t hash_get_digest_addr(AspeedHACEState *s)
@@ -350,6 +371,7 @@ static uint64_t hash_get_digest_addr(AspeedHACEState *s)
 static void hash_write_digest_and_unmap_iov(AspeedHACEState *s,
                                             struct iovec *iov,
                                             int iov_idx,
+                                            hwaddr *mapped_lens,
                                             uint8_t *digest_buf,
                                             size_t digest_len)
 {
@@ -369,15 +391,12 @@ static void hash_write_digest_and_unmap_iov(AspeedHACEState *s,
         hace_hexdump("digest", (char *)digest_buf, digest_len);
     }
 
-    for (; iov_idx > 0; iov_idx--) {
-        address_space_unmap(&s->dram_as, iov[iov_idx - 1].iov_base,
-                            iov[iov_idx - 1].iov_len, false,
-                            iov[iov_idx - 1].iov_len);
-    }
+    hash_iov_unmap(s, iov, mapped_lens, iov_idx);
 }
 
 static void hash_execute_non_acc_mode(AspeedHACEState *s, int algo,
-                                      struct iovec *iov, int iov_idx)
+                                      struct iovec *iov, int iov_idx,
+                                      hwaddr *mapped_lens)
 {
     g_autofree uint8_t *digest_buf = NULL;
     Error *local_err = NULL;
@@ -389,15 +408,17 @@ static void hash_execute_non_acc_mode(AspeedHACEState *s, int algo,
                       "%s: qcrypto hash bytesv failed : %s",
                       __func__, error_get_pretty(local_err));
         error_free(local_err);
+        hash_iov_unmap(s, iov, mapped_lens, iov_idx);
         return;
     }
 
-    hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_len);
+    hash_write_digest_and_unmap_iov(s, iov, iov_idx, mapped_lens,
+                                    digest_buf, digest_len);
 }
 
 static void hash_execute_acc_mode(AspeedHACEState *s, int algo,
                                   struct iovec *iov, int iov_idx,
-                                  bool final_request)
+                                  bool final_request, hwaddr *mapped_lens)
 {
     g_autofree uint8_t *digest_buf = NULL;
     Error *local_err = NULL;
@@ -411,6 +432,7 @@ static void hash_execute_acc_mode(AspeedHACEState *s, int algo,
             qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto hash new failed : %s",
                           __func__, error_get_pretty(local_err));
             error_free(local_err);
+            hash_iov_unmap(s, iov, mapped_lens, iov_idx);
             return;
         }
     }
@@ -419,6 +441,7 @@ static void hash_execute_acc_mode(AspeedHACEState *s, int algo,
         qemu_log_mask(LOG_GUEST_ERROR, "%s: qcrypto hash updatev failed : %s",
                       __func__, error_get_pretty(local_err));
         error_free(local_err);
+        hash_iov_unmap(s, iov, mapped_lens, iov_idx);
         return;
     }
 
@@ -438,22 +461,25 @@ static void hash_execute_acc_mode(AspeedHACEState *s, int algo,
         s->total_req_len = 0;
     }
 
-    hash_write_digest_and_unmap_iov(s, iov, iov_idx, digest_buf, digest_len);
+    hash_write_digest_and_unmap_iov(s, iov, iov_idx, mapped_lens,
+                                    digest_buf, digest_len);
 }
 
 static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
                               bool acc_mode)
 {
     QEMU_UNINITIALIZED struct iovec iov[ASPEED_HACE_MAX_SG];
+    hwaddr mapped_lens[ASPEED_HACE_MAX_SG] = { 0 };
     bool acc_final_request = false;
     int iov_idx = -1;
 
     /* Prepares the iov for hashing operations based on the selected mode */
     if (sg_mode) {
-        iov_idx = hash_prepare_sg_iov(s, iov, acc_mode, &acc_final_request);
+        iov_idx = hash_prepare_sg_iov(s, iov, acc_mode, &acc_final_request,
+                                      mapped_lens);
     } else {
         iov_idx = hash_prepare_direct_iov(s, iov, acc_mode,
-                                          &acc_final_request);
+                                          &acc_final_request, mapped_lens);
     }
 
     if (iov_idx <= 0) {
@@ -468,9 +494,10 @@ static void do_hash_operation(AspeedHACEState *s, int algo, bool sg_mode,
 
     /* Executes the hash operation */
     if (acc_mode) {
-        hash_execute_acc_mode(s, algo, iov, iov_idx, acc_final_request);
+        hash_execute_acc_mode(s, algo, iov, iov_idx, acc_final_request,
+                              mapped_lens);
     } else {
-        hash_execute_non_acc_mode(s, algo, iov, iov_idx);
+        hash_execute_non_acc_mode(s, algo, iov, iov_idx, mapped_lens);
     }
 }
 
-- 
2.54.0

[PULL 5/9] hw/arm: Remove sonorapass-bmc machine

[Cédric Le Goater]

The sonorapass-bmc machine was deprecated in QEMU 10.2 and is now
removed in QEMU 11.1.

This OCP SonoraPass BMC lab server never entered production and can be
replaced by the ast2500-evb machine with appropriate fmc-model and I2C
device configuration via command line.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-2-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst          |   9 ---
 docs/about/removed-features.rst    |  10 ++-
 docs/system/arm/aspeed.rst         |   5 +-
 hw/arm/aspeed_ast2500_sonorapass.c | 102 -----------------------------
 hw/arm/meson.build                 |   1 -
 5 files changed, 11 insertions(+), 116 deletions(-)
 delete mode 100644 hw/arm/aspeed_ast2500_sonorapass.c

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 5551bd12ad83..cc75afe55d95 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -250,15 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name
 better reflects the way this property affects all random data within
 the device tree blob, not just the ``kaslr-seed`` node.
 
-Arm ``sonorapass-bmc`` machine (since 10.2)
-'''''''''''''''''''''''''''''''''''''''''''
-
-The ``sonorapass-bmc`` machine represents a lab server that never
-entered production. Since it does not rely on any specific device
-models, it can be replaced by the ``ast2500-evb`` machine using the
-``fmc-model`` option to specify the flash type. The I2C devices
-connected to the board can be defined via the QEMU command line.
-
 Arm ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` machine (since 10.2)
 '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 626162022a8c..02e3c06b2988 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1112,7 +1112,7 @@ This machine was removed because it was unused. Alternative AST2500 based
 OpenPOWER machines are ``witherspoon-bmc`` and ``romulus-bmc``.
 
 ppc ``taihu`` machine (removed in 7.2)
-'''''''''''''''''''''''''''''''''''''''''''''
+''''''''''''''''''''''''''''''''''''''
 
 This machine was removed because it was partially emulated and 405
 machines are very similar. Use the ``ref405ep`` machine instead.
@@ -1186,6 +1186,14 @@ Arm ``highbank`` and ``midway`` machines (removed in 11.0)
 There were no known users left for these machines. If you just want to
 boot a Cortex-A15 or Cortex-A9 Linux, use the ``virt`` machine instead.
 
+Arm ``sonorapass-bmc`` machine (removed in 11.1)
+''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``sonorapass-bmc`` machine represents a lab server that never
+entered production. It can be replaced by the ``ast2500-evb`` machine
+using the ``fmc-model`` option to specify the flash type. The I2C
+devices connected to the board can be defined via the QEMU command
+line.
 
 linux-user mode CPUs
 --------------------
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index d0054a7dbb88..1871f31713d4 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,5 +1,5 @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-===================================================================================================================================================================================================================================================================================================================================================================================================================
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+===============================================================================================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
@@ -22,7 +22,6 @@ AST2500 SoC based machines :
 - ``ast2500-evb``          Aspeed AST2500 Evaluation board
 - ``romulus-bmc``          OpenPOWER Romulus POWER9 BMC
 - ``witherspoon-bmc``      OpenPOWER Witherspoon POWER9 BMC
-- ``sonorapass-bmc``       OCP SonoraPass BMC
 - ``fp5280g2-bmc``         Inspur FP5280G2 BMC
 - ``g220a-bmc``            Bytedance G220A BMC
 - ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
diff --git a/hw/arm/aspeed_ast2500_sonorapass.c b/hw/arm/aspeed_ast2500_sonorapass.c
deleted file mode 100644
index 84de4f56b376..000000000000
--- a/hw/arm/aspeed_ast2500_sonorapass.c
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * OCP SonoraPass
- *
- * Copyright 2016 IBM Corp.
- *
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "hw/arm/machines-qom.h"
-#include "hw/arm/aspeed.h"
-#include "hw/arm/aspeed_soc.h"
-#include "hw/i2c/smbus_eeprom.h"
-
-/* Sonorapass hardware value: 0xF100D216 */
-#define SONORAPASS_BMC_HW_STRAP1 (                                      \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
-        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
-        SCU_HW_STRAP_VGA_BIOS_ROM |                                     \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
-        SCU_AST2500_HW_STRAP_RESERVED1)
-
-static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    /* bus 2 : */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x49);
-    /* bus 2 : pca9546 @ 0x73 */
-
-    /* bus 3 : pca9548 @ 0x70 */
-
-    /* bus 4 : */
-    uint8_t *eeprom4_54 = g_malloc0(8 * 1024);
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54,
-                          eeprom4_54);
-    /* PCA9539 @ 0x76, but PCA9552 is compatible */
-    aspeed_create_pca9552(soc, 4, 0x76);
-    /* PCA9539 @ 0x77, but PCA9552 is compatible */
-    aspeed_create_pca9552(soc, 4, 0x77);
-
-    /* bus 6 : */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x49);
-    /* bus 6 : pca9546 @ 0x73 */
-
-    /* bus 8 : */
-    uint8_t *eeprom8_56 = g_malloc0(8 * 1024);
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 8), 0x56,
-                          eeprom8_56);
-    aspeed_create_pca9552(soc, 8, 0x60);
-    aspeed_create_pca9552(soc, 8, 0x61);
-    /* bus 8 : adc128d818 @ 0x1d */
-    /* bus 8 : adc128d818 @ 0x1f */
-
-    /*
-     * bus 13 : pca9548 @ 0x71
-     *      - channel 3:
-     *          - tmm421 @ 0x4c
-     *          - tmp421 @ 0x4e
-     *          - tmp421 @ 0x4f
-     */
-
-}
-
-static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
-                                                 const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "OCP SonoraPass BMC (ARM1176)";
-    mc->deprecation_reason = "use 'ast2500-evb' instead";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = SONORAPASS_BMC_HW_STRAP1;
-    amc->fmc_model = "mx66l1g45g";
-    amc->spi_model = "mx66l1g45g";
-    amc->num_cs    = 2;
-    amc->i2c_init  = sonorapass_bmc_i2c_init;
-    mc->default_ram_size       = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
-static const TypeInfo aspeed_ast2500_sonorapass_types[] = {
-    {
-        .name          = MACHINE_TYPE_NAME("sonorapass-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_sonorapass_class_init,
-        .interfaces    = arm_machine_interfaces,
-    }
-};
-
-DEFINE_TYPES(aspeed_ast2500_sonorapass_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 84b8ec5fb5ab..098015357ddc 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -50,7 +50,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
   'aspeed_ast2500_romulus.c',
-  'aspeed_ast2500_sonorapass.c',
   'aspeed_ast2500_supermicro-x11spi.c',
   'aspeed_ast2500_tiogapass.c',
   'aspeed_ast2500_witherspoon.c',
-- 
2.54.0

[PULL 6/9] hw/arm: Remove qcom-dc-scm-v1-bmc and qcom-firework-bmc machines

[Cédric Le Goater]

The qcom-dc-scm-v1-bmc and qcom-firework-bmc machines were deprecated
in QEMU 10.2 and are now removed in QEMU 11.1.

These Qualcomm lab servers never entered production and do not rely on
specific device models. They can be replaced by the ast2600-evb
machine with appropriate fmc-model and I2C device configuration via
command line.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-3-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst              | 10 ---
 docs/about/removed-features.rst        | 10 +++
 docs/system/arm/aspeed.rst             |  6 +-
 hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c | 55 ----------------
 hw/arm/aspeed_ast2600_qcom-firework.c  | 91 --------------------------
 hw/arm/meson.build                     |  2 -
 6 files changed, 12 insertions(+), 162 deletions(-)
 delete mode 100644 hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c
 delete mode 100644 hw/arm/aspeed_ast2600_qcom-firework.c

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index cc75afe55d95..bbb4a9886fbc 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -250,16 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name
 better reflects the way this property affects all random data within
 the device tree blob, not just the ``kaslr-seed`` node.
 
-Arm ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` machine (since 10.2)
-'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
-
-The ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` represent lab
-servers that never entered production. Since they do not rely on any
-specific device models, they can be replaced by the ``ast2600-evb``
-machine using the ``fmc-model`` option to specify the flash type. The
-I2C devices connected to the board can be defined via the QEMU command
-line.
-
 Arm ``fp5280g2-bmc`` machine (since 10.2)
 '''''''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 02e3c06b2988..b9e9d43dada3 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1195,6 +1195,16 @@ using the ``fmc-model`` option to specify the flash type. The I2C
 devices connected to the board can be defined via the QEMU command
 line.
 
+Arm ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` machine (removed in 11.1)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` represent lab
+servers that never entered production. Since they do not rely on any
+specific device models, they can be replaced by the ``ast2600-evb``
+machine using the ``fmc-model`` option to specify the flash type. The
+I2C devices connected to the board can be defined via the QEMU command
+line.
+
 linux-user mode CPUs
 --------------------
 
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 1871f31713d4..cbaab5edd65c 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,5 +1,5 @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-===============================================================================================================================================================================================================================================================================================================================================================================================
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+================================================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
@@ -35,8 +35,6 @@ AST2600 SoC based machines :
 - ``bletchley-bmc``        Facebook Bletchley BMC
 - ``fby35-bmc``            Facebook fby35 BMC
 - ``gb200nvl-bmc``         Nvidia GB200nvl BMC
-- ``qcom-dc-scm-v1-bmc``   Qualcomm DC-SCM V1 BMC
-- ``qcom-firework-bmc``    Qualcomm Firework BMC
 
 Supported devices
 -----------------
diff --git a/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c b/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c
deleted file mode 100644
index bbdeb6023686..000000000000
--- a/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c
+++ /dev/null
@@ -1,55 +0,0 @@
-/*
- * Qualcomm DC-SCM V1
- *
- * Copyright 2016 IBM Corp.
- *
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "hw/arm/machines-qom.h"
-#include "hw/arm/aspeed.h"
-#include "hw/arm/aspeed_soc.h"
-
-/* Qualcomm DC-SCM hardware value */
-#define QCOM_DC_SCM_V1_BMC_HW_STRAP1  0x00000000
-#define QCOM_DC_SCM_V1_BMC_HW_STRAP2  0x00000041
-
-static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
-}
-
-static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
-                                                     const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Qualcomm DC-SCM V1 BMC (Cortex A7)";
-    mc->deprecation_reason = "use 'ast2600-evb' instead";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
-    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
-    amc->fmc_model = "n25q512a";
-    amc->spi_model = "n25q512a";
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
-    amc->i2c_init  = qcom_dc_scm_bmc_i2c_init;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
-static const TypeInfo aspeed_ast2600_qcom_dc_scm_v1_types[] = {
-    {
-        .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
-        .interfaces    = arm_machine_interfaces,
-    }
-};
-
-DEFINE_TYPES(aspeed_ast2600_qcom_dc_scm_v1_types)
diff --git a/hw/arm/aspeed_ast2600_qcom-firework.c b/hw/arm/aspeed_ast2600_qcom-firework.c
deleted file mode 100644
index a4dbe6eea8ab..000000000000
--- a/hw/arm/aspeed_ast2600_qcom-firework.c
+++ /dev/null
@@ -1,91 +0,0 @@
-/*
- * Qualcomm DC-SCM V1/Firework
- *
- * Copyright 2016 IBM Corp.
- *
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "hw/arm/machines-qom.h"
-#include "hw/arm/aspeed.h"
-#include "hw/arm/aspeed_soc.h"
-#include "hw/i2c/i2c_mux_pca954x.h"
-#include "hw/sensor/tmp105.h"
-
-/* Qualcomm DC-SCM Firework hardware value */
-#define QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP1  0x00000000
-#define QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP2  0x00000041
-
-#define TYPE_LM75 TYPE_TMP105
-
-static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
-}
-
-static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CSlave *therm_mux, *cpuvr_mux;
-
-    /* Create the generic DC-SCM hardware */
-    qcom_dc_scm_bmc_i2c_init(bmc);
-
-    /* Now create the Firework specific hardware */
-
-    /* I2C7 CPUVR MUX */
-    cpuvr_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7),
-                                        "pca9546", 0x70);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 0), "pca9548", 0x72);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 1), "pca9548", 0x72);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 2), "pca9548", 0x72);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 3), "pca9548", 0x72);
-
-    /* I2C8 Thermal Diodes*/
-    therm_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
-                                        "pca9548", 0x70);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 0), TYPE_LM75, 0x4C);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 1), TYPE_LM75, 0x4C);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 2), TYPE_LM75, 0x48);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 3), TYPE_LM75, 0x48);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 4), TYPE_LM75, 0x48);
-
-    /* I2C9 Fan Controller (MAX31785) */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x52);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x54);
-}
-
-static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
-                                                    const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Qualcomm DC-SCM V1/Firework BMC (Cortex A7)";
-    mc->deprecation_reason = "use 'ast2600-evb' instead";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP1;
-    amc->hw_strap2 = QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP2;
-    amc->fmc_model = "n25q512a";
-    amc->spi_model = "n25q512a";
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
-    amc->i2c_init  = qcom_dc_scm_firework_i2c_init;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
-static const TypeInfo aspeed_ast2600_qcom_firework_types[] = {
-    {
-        .name          = MACHINE_TYPE_NAME("qcom-firework-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_qcom_firework_class_init,
-        .interfaces    = arm_machine_interfaces,
-    }
-};
-
-DEFINE_TYPES(aspeed_ast2600_qcom_firework_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 098015357ddc..2be74b575efc 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -61,8 +61,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600_fby35.c',
   'aspeed_ast2600_fuji.c',
   'aspeed_ast2600_gb200nvl.c',
-  'aspeed_ast2600_qcom-dc-scm-v1.c',
-  'aspeed_ast2600_qcom-firework.c',
   'aspeed_ast2600_rainier.c',
   'aspeed_ast10x0.c',
   'aspeed_ast10x0_evb.c',
-- 
2.54.0

[PULL 7/9] hw/arm: Remove fp5280g2-bmc machine

[Cédric Le Goater]

The fp5280g2-bmc machine was deprecated in QEMU 10.2 and is now
removed in QEMU 11.1.

This Inspur FP5280G2 BMC board does not rely on specific device models
and can be replaced by the ast2500-evb machine with appropriate
fmc-model and I2C device configuration via command line.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-4-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst        |  8 ---
 docs/about/removed-features.rst  |  8 +++
 docs/system/arm/aspeed.rst       |  5 +-
 hw/arm/aspeed_ast2500_fp5280g2.c | 88 --------------------------------
 hw/arm/meson.build               |  1 -
 5 files changed, 10 insertions(+), 100 deletions(-)
 delete mode 100644 hw/arm/aspeed_ast2500_fp5280g2.c

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index bbb4a9886fbc..e416f3d8a74b 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -250,14 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name
 better reflects the way this property affects all random data within
 the device tree blob, not just the ``kaslr-seed`` node.
 
-Arm ``fp5280g2-bmc`` machine (since 10.2)
-'''''''''''''''''''''''''''''''''''''''''
-
-The ``fp5280g2-bmc`` machine does not rely on any specific device
-models, it can be replaced by the ``ast2500-evb`` machine using the
-``fmc-model`` option to specify the flash type. The I2C devices
-connected to the board can be defined via the QEMU command line.
-
 Arm ``fby35`` machine (since 10.2)
 ''''''''''''''''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index b9e9d43dada3..2da8283d0e1e 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1205,6 +1205,14 @@ machine using the ``fmc-model`` option to specify the flash type. The
 I2C devices connected to the board can be defined via the QEMU command
 line.
 
+Arm ``fp5280g2-bmc`` machine (removed in 11.1)
+''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``fp5280g2-bmc`` machine does not rely on any specific device
+models, it can be replaced by the ``ast2500-evb`` machine using the
+``fmc-model`` option to specify the flash type. The I2C devices
+connected to the board can be defined via the QEMU command line.
+
 linux-user mode CPUs
 --------------------
 
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index cbaab5edd65c..df2f539b0257 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,5 +1,5 @@
-Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-================================================================================================================================================================================================================================================================================================================================================
+Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
+==============================================================================================================================================================================================================================================================================================================================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
@@ -22,7 +22,6 @@ AST2500 SoC based machines :
 - ``ast2500-evb``          Aspeed AST2500 Evaluation board
 - ``romulus-bmc``          OpenPOWER Romulus POWER9 BMC
 - ``witherspoon-bmc``      OpenPOWER Witherspoon POWER9 BMC
-- ``fp5280g2-bmc``         Inspur FP5280G2 BMC
 - ``g220a-bmc``            Bytedance G220A BMC
 - ``yosemitev2-bmc``       Facebook YosemiteV2 BMC
 - ``tiogapass-bmc``        Facebook Tiogapass BMC
diff --git a/hw/arm/aspeed_ast2500_fp5280g2.c b/hw/arm/aspeed_ast2500_fp5280g2.c
deleted file mode 100644
index 858e0388714b..000000000000
--- a/hw/arm/aspeed_ast2500_fp5280g2.c
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Inspur FP5280G2
- *
- * Copyright 2016 IBM Corp.
- *
- * SPDX-License-Identifier: GPL-2.0-or-later
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "hw/arm/machines-qom.h"
-#include "hw/arm/aspeed.h"
-#include "hw/arm/aspeed_soc.h"
-#include "hw/nvram/eeprom_at24c.h"
-#include "hw/i2c/i2c_mux_pca954x.h"
-#include "hw/sensor/tmp105.h"
-
-/* FP5280G2 hardware value: 0XF100D286 */
-#define FP5280G2_BMC_HW_STRAP1 (                                      \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
-        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
-        SCU_HW_STRAP_MAC1_RGMII |                                       \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
-        SCU_AST2500_HW_STRAP_RESERVED1)
-
-static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CSlave *i2c_mux;
-
-    /* The at24c256 */
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 1), 0x50, 32768);
-
-    /* The fp5280g2 expects a TMP112 but a TMP105 is compatible */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105,
-                     0x49);
-
-    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2),
-                     "pca9546", 0x70);
-    /* It expects a TMP112 but a TMP105 is compatible */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 0), TYPE_TMP105,
-                     0x4a);
-
-    /* It expects a ds3232 but a ds1338 is good enough */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "ds1338", 0x68);
-
-    /* It expects a pca9555 but a pca9552 is compatible */
-    aspeed_create_pca9552(soc, 8, 0x30);
-}
-
-static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc,
-                                               const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Inspur FP5280G2 BMC (ARM1176)";
-    mc->deprecation_reason = "use 'ast2500-evb' instead";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = FP5280G2_BMC_HW_STRAP1;
-    amc->fmc_model = "n25q512a";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 2;
-    amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
-    amc->i2c_init  = fp5280g2_bmc_i2c_init;
-    mc->default_ram_size = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
-static const TypeInfo aspeed_ast2500_fp5280g2_types[] = {
-    {
-        .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_fp5280g2_class_init,
-        .interfaces    = arm_machine_interfaces,
-    }
-};
-
-DEFINE_TYPES(aspeed_ast2500_fp5280g2_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 2be74b575efc..063abf2cf654 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -47,7 +47,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2400_quanta-q71l.c',
   'aspeed_ast2400_supermicrox11.c',
   'aspeed_ast2500_evb.c',
-  'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
   'aspeed_ast2500_romulus.c',
   'aspeed_ast2500_supermicro-x11spi.c',
-- 
2.54.0

[PULL 8/9] hw/arm: Remove fby35 machine

[Cédric Le Goater]

The fby35 machine was deprecated in QEMU 10.2 and is now removed in
QEMU 11.1.

This multi-SoC machine was added as an example of heterogeneous
systems, but the models never evolved and no public firmware is
available to boot it. Users needing multi-SoC emulation should use the
ast2700fc machine instead, which is based on newer AST2700 SoCs with
better support.

Link: https://lore.kernel.org/qemu-devel/20260510165704.2935316-5-clg@redhat.com
Acked-by: Peter Delevoryas <peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS                     |   2 -
 docs/about/deprecated.rst       |  10 --
 docs/about/removed-features.rst |  10 ++
 docs/system/arm/fby35.rst       |  52 --------
 docs/system/target-arm.rst      |   1 -
 hw/arm/fby35.c                  | 203 --------------------------------
 hw/arm/meson.build              |   3 +-
 7 files changed, 11 insertions(+), 270 deletions(-)
 delete mode 100644 docs/system/arm/fby35.rst
 delete mode 100644 hw/arm/fby35.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 93a1e4e4822e..06788fde5acd 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1276,12 +1276,10 @@ F: include/hw/*/*aspeed*
 F: hw/net/ftgmac100.c
 F: include/hw/net/ftgmac100.h
 F: docs/system/arm/aspeed.rst
-F: docs/system/arm/fby35.rst
 F: docs/specs/aspeed*
 F: tests/functional/*/*aspeed*
 F: tests/*/*aspeed*
 F: tests/*/*ast2700*
-F: hw/arm/fby35.c
 F: pc-bios/ast27x0_bootrom.bin
 F: roms/vbootrom
 
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index e416f3d8a74b..bf6182d61c6e 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -250,16 +250,6 @@ deprecated; use the new name ``dtb-randomness`` instead. The new name
 better reflects the way this property affects all random data within
 the device tree blob, not just the ``kaslr-seed`` node.
 
-Arm ``fby35`` machine (since 10.2)
-''''''''''''''''''''''''''''''''''
-
-The ``fby35`` machine was originally added as an example of a
-multi-SoC system, with the expectation the models would evolve over
-time in an heterogeneous system. This hasn't happened and no public
-firmware is available to boot it. It can be replaced by the
-``ast2700fc``, another multi-SoC machine based on the newer AST2700
-SoCs which are excepted to receive better support in the future.
-
 
 RISC-V default machine option (since 10.0)
 ''''''''''''''''''''''''''''''''''''''''''
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 2da8283d0e1e..9bd83b183f46 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1213,6 +1213,16 @@ models, it can be replaced by the ``ast2500-evb`` machine using the
 ``fmc-model`` option to specify the flash type. The I2C devices
 connected to the board can be defined via the QEMU command line.
 
+Arm ``fby35`` machine (removed in 11.1)
+'''''''''''''''''''''''''''''''''''''''
+
+The ``fby35`` machine was originally added as an example of a
+multi-SoC system, with the expectation the models would evolve over
+time in an heterogeneous system. This hasn't happened and no public
+firmware is available to boot it. It can be replaced by the
+``ast2700fc``, another multi-SoC machine based on the newer AST2700
+SoCs which are excepted to receive better support in the future.
+
 linux-user mode CPUs
 --------------------
 
diff --git a/docs/system/arm/fby35.rst b/docs/system/arm/fby35.rst
deleted file mode 100644
index e19274e75c81..000000000000
--- a/docs/system/arm/fby35.rst
+++ /dev/null
@@ -1,52 +0,0 @@
-Facebook Yosemite v3.5 Platform and CraterLake Server (``fby35``)
-==================================================================
-
-Facebook has a series of multi-node compute server designs named
-Yosemite. The most recent version released was
-`Yosemite v3 <https://www.opencompute.org/documents/ocp-yosemite-v3-platform-design-specification-1v16-pdf>`__.
-
-Yosemite v3.5 is an iteration on this design, and is very similar: there's a
-baseboard with a BMC, and 4 server slots. The new server board design termed
-"CraterLake" includes a Bridge IC (BIC), with room for expansion boards to
-include various compute accelerators (video, inferencing, etc). At the moment,
-only the first server slot's BIC is included.
-
-Yosemite v3.5 is itself a sled which fits into a 40U chassis, and 3 sleds
-can be fit into a chassis. See `here <https://www.opencompute.org/products-chiplets/237/wiwynn-yosemite-v3-server>`__
-for an example.
-
-In this generation, the BMC is an AST2600 and each BIC is an AST1030. The BMC
-runs `OpenBMC <https://github.com/facebook/openbmc>`__, and the BIC runs
-`OpenBIC <https://github.com/facebook/openbic>`__.
-
-Firmware images can be retrieved from the Github releases or built from the
-source code, see the README's for instructions on that. This image uses the
-"fby35" machine recipe from OpenBMC, and the "yv35-cl" target from OpenBIC.
-Some reference images can also be found here:
-
-.. code-block:: bash
-
-    $ wget https://github.com/facebook/openbmc/releases/download/openbmc-e2294ff5d31d/fby35.mtd
-    $ wget https://github.com/peterdelevoryas/OpenBIC/releases/download/oby35-cl-2022.13.01/Y35BCL.elf
-
-Since this machine has multiple SoC's, each with their own serial console, the
-recommended way to run it is to allocate a pseudoterminal for each serial
-console and let the monitor use stdio. Also, starting in a paused state is
-useful because it allows you to attach to the pseudoterminals before the boot
-process starts.
-
-.. code-block:: bash
-
-    $ qemu-system-arm -machine fby35 \
-        -drive file=fby35.mtd,format=raw,if=mtd \
-        -device loader,file=Y35BCL.elf,addr=0,cpu-num=2 \
-        -serial pty -serial pty -serial mon:stdio \
-        -display none -S
-    $ screen /dev/tty0 # In a separate TMUX pane, terminal window, etc.
-    $ screen /dev/tty1
-    $ (qemu) c		   # Start the boot process once screen is setup.
-
-This machine model supports emulation of the boot from the CE0 flash device by
-setting option ``execute-in-place``. When using this option, the CPU fetches
-instructions to execute by reading CE0 and not from a preloaded ROM
-initialized at machine init time. As a result, execution will be slower.
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index c57102a4149f..e34492402f0a 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -87,7 +87,6 @@ Board-specific documentation
    arm/cubieboard
    arm/emcraft-sf2
    arm/exynos
-   arm/fby35
    arm/musicpal
    arm/kzm
    arm/nrf
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
deleted file mode 100644
index d3bfd2c7d26a..000000000000
--- a/hw/arm/fby35.c
+++ /dev/null
@@ -1,203 +0,0 @@
-/*
- * Copyright (c) Meta Platforms, Inc. and affiliates. (http://www.meta.com)
- *
- * This code is licensed under the GPL version 2 or later. See the COPYING
- * file in the top-level directory.
- */
-
-#include "qemu/osdep.h"
-#include "qemu/units.h"
-#include "qapi/error.h"
-#include "system/system.h"
-#include "system/block-backend.h"
-#include "hw/core/boards.h"
-#include "hw/core/qdev-clock.h"
-#include "hw/arm/aspeed_soc.h"
-#include "hw/arm/boot.h"
-#include "hw/arm/machines-qom.h"
-
-#define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
-OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
-
-struct Fby35State {
-    MachineState parent_obj;
-
-    MemoryRegion bmc_memory;
-    MemoryRegion bmc_dram;
-    MemoryRegion bmc_boot_rom;
-    MemoryRegion bic_memory;
-    Clock *bic_sysclk;
-
-    Aspeed2600SoCState bmc;
-    Aspeed10x0SoCState bic;
-
-    bool mmio_exec;
-};
-
-#define FBY35_BMC_RAM_SIZE (2 * GiB)
-#define FBY35_BMC_FIRMWARE_ADDR 0x0
-
-static void fby35_bmc_write_boot_rom(DriveInfo *dinfo, MemoryRegion *mr,
-                                     hwaddr offset, size_t rom_size,
-                                     Error **errp)
-{
-    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);
-    g_autofree void *storage = NULL;
-    int64_t size;
-
-    /*
-     * The block backend size should have already been 'validated' by
-     * the creation of the m25p80 object.
-     */
-    size = blk_getlength(blk);
-    if (size <= 0) {
-        error_setg(errp, "failed to get flash size");
-        return;
-    }
-
-    if (rom_size > size) {
-        rom_size = size;
-    }
-
-    storage = g_malloc0(rom_size);
-    if (blk_pread(blk, 0, rom_size, storage, 0) < 0) {
-        error_setg(errp, "failed to read the initial flash content");
-        return;
-    }
-
-    /* TODO: find a better way to install the ROM */
-    memcpy(memory_region_get_ram_ptr(mr) + offset, storage, rom_size);
-}
-
-static void fby35_bmc_init(Fby35State *s)
-{
-    AspeedSoCState *soc;
-    AspeedSoCClass *sc;
-
-    object_initialize_child(OBJECT(s), "bmc", &s->bmc, "ast2600-a3");
-    soc = ASPEED_SOC(&s->bmc);
-    sc = ASPEED_SOC_GET_CLASS(soc);
-
-    memory_region_init(&s->bmc_memory, OBJECT(&s->bmc), "bmc-memory",
-                       UINT64_MAX);
-    memory_region_add_subregion(get_system_memory(), 0, &s->bmc_memory);
-    memory_region_init_ram(&s->bmc_dram, OBJECT(&s->bmc), "bmc-dram",
-                           FBY35_BMC_RAM_SIZE, &error_abort);
-
-    object_property_set_int(OBJECT(&s->bmc), "ram-size", FBY35_BMC_RAM_SIZE,
-                            &error_abort);
-    object_property_set_link(OBJECT(&s->bmc), "memory", OBJECT(&s->bmc_memory),
-                             &error_abort);
-    object_property_set_link(OBJECT(&s->bmc), "dram", OBJECT(&s->bmc_dram),
-                             &error_abort);
-    object_property_set_int(OBJECT(&s->bmc), "hw-strap1", 0x000000C0,
-                            &error_abort);
-    object_property_set_int(OBJECT(&s->bmc), "hw-strap2", 0x00000003,
-                            &error_abort);
-    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART5, sc->uarts_base,
-                            sc->uarts_num, serial_hd(0));
-    qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
-
-    aspeed_board_init_flashes(&soc->fmc, "n25q00", 2, 0);
-
-    /* Install first FMC flash content as a boot rom. */
-    if (!s->mmio_exec) {
-        DriveInfo *mtd0 = drive_get(IF_MTD, 0, 0);
-
-        if (mtd0) {
-            uint64_t rom_size = memory_region_size(&soc->spi_boot);
-
-            memory_region_init_rom(&s->bmc_boot_rom, NULL, "aspeed.boot_rom",
-                                   rom_size, &error_abort);
-            memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
-                                                &s->bmc_boot_rom, 1);
-
-            fby35_bmc_write_boot_rom(mtd0, &s->bmc_boot_rom,
-                                     FBY35_BMC_FIRMWARE_ADDR,
-                                     rom_size, &error_abort);
-        }
-    }
-}
-
-static void fby35_bic_init(Fby35State *s)
-{
-    AspeedSoCState *soc;
-    AspeedSoCClass *sc;
-
-    s->bic_sysclk = clock_new(OBJECT(s), "SYSCLK");
-    clock_set_hz(s->bic_sysclk, 200000000ULL);
-
-    object_initialize_child(OBJECT(s), "bic", &s->bic, "ast1030-a1");
-    soc = ASPEED_SOC(&s->bic);
-    sc = ASPEED_SOC_GET_CLASS(soc);
-
-    memory_region_init(&s->bic_memory, OBJECT(&s->bic), "bic-memory",
-                       UINT64_MAX);
-
-    qdev_connect_clock_in(DEVICE(&s->bic), "sysclk", s->bic_sysclk);
-    object_property_set_link(OBJECT(&s->bic), "memory", OBJECT(&s->bic_memory),
-                             &error_abort);
-    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART5, sc->uarts_base,
-                            sc->uarts_num, serial_hd(1));
-    qdev_realize(DEVICE(&s->bic), NULL, &error_abort);
-
-    aspeed_board_init_flashes(&soc->fmc, "sst25vf032b", 2, 2);
-    aspeed_board_init_flashes(&soc->spi[0], "sst25vf032b", 2, 4);
-    aspeed_board_init_flashes(&soc->spi[1], "sst25vf032b", 2, 6);
-}
-
-static void fby35_init(MachineState *machine)
-{
-    Fby35State *s = FBY35(machine);
-
-    fby35_bmc_init(s);
-    fby35_bic_init(s);
-}
-
-
-static bool fby35_get_mmio_exec(Object *obj, Error **errp)
-{
-    return FBY35(obj)->mmio_exec;
-}
-
-static void fby35_set_mmio_exec(Object *obj, bool value, Error **errp)
-{
-    FBY35(obj)->mmio_exec = value;
-}
-
-static void fby35_instance_init(Object *obj)
-{
-    FBY35(obj)->mmio_exec = false;
-}
-
-static void fby35_class_init(ObjectClass *oc, const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-
-    mc->desc = "Meta Platforms fby35";
-    mc->deprecation_reason = "For a multi-soc machine, use 'ast2700fc' instead";
-    mc->init = fby35_init;
-    mc->no_floppy = 1;
-    mc->no_cdrom = 1;
-    mc->auto_create_sdcard = true;
-    mc->min_cpus = mc->max_cpus = mc->default_cpus = 3;
-
-    object_class_property_add_bool(oc, "execute-in-place",
-                                   fby35_get_mmio_exec,
-                                   fby35_set_mmio_exec);
-    object_class_property_set_description(oc, "execute-in-place",
-                           "boot directly from CE0 flash device");
-}
-
-static const TypeInfo fby35_types[] = {
-    {
-        .name = MACHINE_TYPE_NAME("fby35"),
-        .parent = TYPE_MACHINE,
-        .class_init = fby35_class_init,
-        .instance_size = sizeof(Fby35State),
-        .instance_init = fby35_instance_init,
-        .interfaces = arm_machine_interfaces,
-    },
-};
-
-DEFINE_TYPES(fby35_types);
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 063abf2cf654..80068f70bb9c 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -62,8 +62,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600_gb200nvl.c',
   'aspeed_ast2600_rainier.c',
   'aspeed_ast10x0.c',
-  'aspeed_ast10x0_evb.c',
-  'fby35.c'))
+  'aspeed_ast10x0_evb.c'))
 arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
   'aspeed_ast1700.c',
   'aspeed_ast27x0.c',
-- 
2.54.0

[PULL 9/9] hw/i3c/dw-i3c: Fix BCR/DCR extraction and PID assembly during ENTDAA

[Cédric Le Goater]

From: Ashish Anand <ashish.a6@samsung.com>

The target_info union in dw_i3c_addr_assign_cmd() declares pid, bcr,
and dcr as separate union members, causing them to all alias b[0]
rather than their correct positions in the ENTDAA response buffer.
This results in dw_i3c_update_char_table() being called with BCR and
DCR both read from b[0] instead of b[6] and b[7] respectively,
corrupting the device characteristics table on every ENTDAA operation.
Fix by replacing the broken members with uint64_t d and extracting fields
per the I3C spec ENTDAA wire format.

Additionally, dw_i3c_update_char_table() incorrectly splits PID across
LOC1 and LOC2 at bit 32. Per the Linux kernel HCI driver
(drivers/i3c/master/mipi-i3c-hci/dct_v1.c), the DCT layout requires
LOC1 to hold pid[47:16] and LOC2 to hold pid[15:0]. Fix the split
accordingly.

Signed-off-by: Ashish Anand <ashish.a6@samsung.com>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20260505134002.509037-1-ashish.a6@samsung.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/i3c/i3c.h |  7 +++++++
 hw/i3c/dw-i3c.c      | 16 +++++++---------
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/include/hw/i3c/i3c.h b/include/hw/i3c/i3c.h
index 6ba90793ad01..dcf8d9b1435b 100644
--- a/include/hw/i3c/i3c.h
+++ b/include/hw/i3c/i3c.h
@@ -138,6 +138,13 @@ struct I3CTarget {
     uint8_t static_address;
     uint8_t dcr;
     uint8_t bcr;
+    /*
+     * Provisioned ID. Since core.c sends this LSB-first during ENTDAA
+     * via (pid >> (offset * 8)) & 0xff, targets must store it
+     * pre-reversed so that pid[47:40] goes on the wire first, as
+     * required by the I3C spec.
+     *  e.g. for a device with pid 0xAABBCCDDEEFF, store 0xFFEEDDCCBBAA.
+     */
     uint64_t pid;
 
     /* CCC State tracking. */
diff --git a/hw/i3c/dw-i3c.c b/hw/i3c/dw-i3c.c
index d87d42be8914..17ff484c5df1 100644
--- a/hw/i3c/dw-i3c.c
+++ b/hw/i3c/dw-i3c.c
@@ -1459,11 +1459,10 @@ static void dw_i3c_update_char_table(DWI3C *s, uint8_t offset, uint64_t pid,
                                           P_DEV_CHAR_TABLE_START_ADDR) /
                                           sizeof(uint32_t)) +
                                           (offset * sizeof(uint32_t));
-    s->regs[dev_index] = pid & 0xffffffff;
-    pid >>= 32;
+    s->regs[dev_index] = (pid >> 16) & 0xffffffff;
     s->regs[dev_index + 1] = FIELD_DP32(s->regs[dev_index + 1],
                                         DEVICE_CHARACTERISTIC_TABLE_LOC2,
-                                        MSB_PID, pid);
+                                        MSB_PID, pid & 0xffff);
     s->regs[dev_index + 2] = FIELD_DP32(s->regs[dev_index + 2],
                                         DEVICE_CHARACTERISTIC_TABLE_LOC3, DCR,
                                         dcr);
@@ -1507,10 +1506,9 @@ static void dw_i3c_addr_assign_cmd(DWI3C *s, DWI3CAddrAssignCmd cmd)
     for (i = 0; i < cmd.dev_count; i++) {
         uint8_t addr = dw_i3c_target_addr(s, cmd.dev_index + i);
         union {
-            uint64_t pid:48;
-            uint8_t bcr;
-            uint8_t dcr;
+            uint64_t d;
             uint32_t w[2];
+            /* Per I3C spec: b[0]=PID MSB, b[5]=PID LSB, b[6]=BCR, b[7]=DCR */
             uint8_t b[8];
         } target_info;
 
@@ -1544,9 +1542,9 @@ static void dw_i3c_addr_assign_cmd(DWI3C *s, DWI3CAddrAssignCmd cmd)
             err = DW_I3C_RESP_QUEUE_ERR_DAA_NACK;
             break;
         }
-        dw_i3c_update_char_table(s, cmd.dev_index + i,
-                                            target_info.pid, target_info.bcr,
-                                            target_info.dcr, addr);
+        uint64_t pid = be64_to_cpu(target_info.d) >> 16;
+        dw_i3c_update_char_table(s, cmd.dev_index + i, pid, target_info.b[6],
+                                 target_info.b[7], addr);
 
         /* Push the PID, BCR, and DCR to the RX queue. */
         dw_i3c_push_rx(s, target_info.w[0]);
-- 
2.54.0

Re: [PULL 0/9] aspeed queue

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 116 bytes --]

Applied, thanks.

Please update the changelog at https://wiki.qemu.org/ChangeLog/11.1 for any user-visible changes.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]