[PATCH v1 00/14] hw/arm/aspeed: Add AST1040 FMC/SPI controllers and unimplemented devices

[PATCH v1 00/14] hw/arm/aspeed: Add AST1040 FMC/SPI controllers and unimplemented devices

[Jamin Lin]

Dependency:

This series is based on the aspeed-next branch: 
https://github.com/legoater/qemu/commits/aspeed-next

v1:
 1. Fix AST2700 segment end address decoding
 2. Fix AST2700 DMA flash address mask
 3. Rename w25q32dw to w25q33pw and add the SFDP table for the W25Q33PW,
 4. Correct the AST1040 A0 silicon revision ID
 5. Add FMC and SPI controllers
 6. Add the FMC/SPI filters, OTP, ATC, I3C and Caliptra register
    regions as unimplemented device
 7. Update the AST1040 functional test to use the official pre-built
    image from aspeed-mcu-fw-hub v01.00.

Jamin Lin (14):
  hw/ssi/aspeed_smc: Fix AST2700 segment end address decoding
  hw/ssi/aspeed_smc: Fix AST2700 DMA flash address mask
  hw/block/m25p80: Rename w25q32dw to w25q33pw
  hw/block/m25p80: Add SFDP table for Winbond W25Q33PW flash
  hw/misc/aspeed_scu: Correct AST1040 A0 revision ID
  hw/ssi/aspeed_smc: Add AST1040 FMC and SPI controllers
  hw/arm/aspeed_ast1040: Add FMC and SPI controllers
  hw/arm/aspeed_ast1040: Add FMC and SPI filters as unimplemented
    devices
  hw/arm/aspeed_ast1040: Add OTP as an unimplemented device
  hw/arm/aspeed_ast1040: Add Anti-Tamper Controller (ATC) as an
    unimplemented device
  hw/arm/aspeed_ast1040: Add I3C as an unimplemented device
  hw/arm/aspeed_ast1040: Add Caliptra as an unimplemented device
  tests/qtest/aspeed_smc: Add AST1040 SMC tests
  tests/functional/arm/test_aspeed_ast1040: Update AST1040 image to
    aspeed-mcu-fw-hub v01.00

 hw/block/m25p80_sfdp.h                      |   1 +
 include/hw/misc/aspeed_scu.h                |   2 +-
 hw/arm/aspeed_ast1040.c                     |  45 ++++++++
 hw/block/m25p80.c                           |   3 +-
 hw/block/m25p80_sfdp.c                      |  36 ++++++
 hw/ssi/aspeed_smc.c                         | 121 +++++++++++++++++++-
 tests/qtest/aspeed_smc-test.c               |  61 ++++++++++
 tests/functional/arm/test_aspeed_ast1040.py |  12 +-
 8 files changed, 268 insertions(+), 13 deletions(-)

-- 
2.53.0

[PATCH v1 01/14] hw/ssi/aspeed_smc: Fix AST2700 segment end address decoding

[Jamin Lin]

The AST2700 Address Decoding Range Registers (SPI030 - SPI03C) define
the end address as an exclusive upper bound, with a unit of 64KB:

  StartAdr <= CEx < EndAdr

When the start address equals the end address, the decoding is
disabled.

However, aspeed_2700_smc_segment_to_reg() and
aspeed_2700_smc_reg_to_segment() treat the end address as inclusive.

The end offset is programmed as (addr + size - 1) and an extra 64KB is
added back when decoding it. As a result, every segment is 64KB larger
than the range defined by the register and overlaps the next chip
select.

The issue can be reproduced by booting an AST2700 ASPEED SDK image
with "-d guest_errors", which reports a lot of segment overlap errors
such as:

  aspeed_smc_flash_set_segment: new segment for CS0 is not aligned :
    [ 0x100000000 - 0x108010000 ]
  aspeed_smc_flash_overlap: new segment CS1 [ 0x108000000 - 0x110010000 ]
    overlaps with CS0 [ 0x100000000 - 0x108010000 ]

Fix the segment helpers to use an exclusive end address, so that the
decoded segments match the definition in the AST2700 datasheet.

Fixes: bdb3748dba30 ("aspeed/smc: Add AST2700 support")
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/ssi/aspeed_smc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index bf596f7b2d..10ea9e5aa0 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -1823,7 +1823,7 @@ static uint32_t aspeed_2700_smc_segment_to_reg(const AspeedSMCState *s,
     }
 
     reg |= (seg->addr & AST2700_SEG_ADDR_MASK) >> 16; /* start offset */
-    reg |= (seg->addr + seg->size - 1) & AST2700_SEG_ADDR_MASK; /* end offset */
+    reg |= (seg->addr + seg->size) & AST2700_SEG_ADDR_MASK; /* end offset */
     return reg;
 }
 
@@ -1836,7 +1836,7 @@ static void aspeed_2700_smc_reg_to_segment(const AspeedSMCState *s,
 
     if (reg) {
         seg->addr = asc->flash_window_base + start_offset;
-        seg->size = end_offset + (64 * KiB) - start_offset;
+        seg->size = end_offset - start_offset;
     } else {
         seg->addr = asc->flash_window_base;
         seg->size = 0;
-- 
2.53.0

[PATCH v1 02/14] hw/ssi/aspeed_smc: Fix AST2700 DMA flash address mask

[Jamin Lin]

The DMA flash address register (SPI084) holds the offset of the
flash access within the controller's flash window. The AST2700 FMC,
SPI0 and SPI1 controllers use a dma_flash_mask of 0x2FFFFFFC, which
clears bit 28, and SPI2 uses 0x0FFFFFFC, which limits DMA to the
first 256MB of the window.

With the default segment layout, FMC CS2 is mapped at offset
0x10000000. A DMA read from that offset is masked to 0x0 and returns
data from CS0 instead of CS2.

The Linux driver programs SPI084 with the window offset masked by
0x7fffffff, so bit 28 is a valid address bit.

Set dma_flash_mask to 0x3FFFFFFC for all AST2700 controllers to cover
the full 1GB flash window.

Fixes: bdb3748dba30 ("aspeed/smc: Add AST2700 support")
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/ssi/aspeed_smc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index 10ea9e5aa0..c0c3666dbc 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -1952,7 +1952,7 @@ static void aspeed_2700_fmc_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x2FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
@@ -1989,7 +1989,7 @@ static void aspeed_2700_spi0_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x2FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
@@ -2025,7 +2025,7 @@ static void aspeed_2700_spi1_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x2FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
@@ -2061,7 +2061,7 @@ static void aspeed_2700_spi2_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x0FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
-- 
2.53.0

[PATCH v1 03/14] hw/block/m25p80: Rename w25q32dw to w25q33pw

[Jamin Lin]

The W25Q32DW and W25Q33PW use the same JEDEC ID (0xef6016), but
have different part names. Since the JEDEC ID is used to uniquely
identify a flash model in QEMU, both parts cannot be added as separate
entries with the same ID.

According to Winbond, the W25Q32DW has been end-of-life for many years
and the W25Q33PW is its next-generation replacement. The W25Q33PW is
compatible with the W25Q32DW and uses the same JEDEC ID.

Rename the existing w25q32dw model to w25q33pw to reflect the currently
supported part.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/block/m25p80.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index 545e0b5728..e88efd913b 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -353,7 +353,7 @@ static const FlashPartInfo known_devices[] = {
     { INFO("w25x16",      0xef3015,      0,  64 << 10,  32, ER_4K) },
     { INFO("w25x32",      0xef3016,      0,  64 << 10,  64, ER_4K) },
     { INFO("w25q32",      0xef4016,      0,  64 << 10,  64, ER_4K) },
-    { INFO("w25q32dw",    0xef6016,      0,  64 << 10,  64, ER_4K) },
+    { INFO("w25q33pw",    0xef6016,      0,  64 << 10,  64, ER_4K) },
     { INFO("w25x64",      0xef3017,      0,  64 << 10, 128, ER_4K) },
     { INFO("w25q64",      0xef4017,      0,  64 << 10, 128, ER_4K) },
     { INFO("w25q80",      0xef5014,      0,  64 << 10,  16, ER_4K) },
-- 
2.53.0

[PATCH v1 04/14] hw/block/m25p80: Add SFDP table for Winbond W25Q33PW flash

[Jamin Lin]

Add the SFDP data table for the Winbond W25Q33PW flash device. The table
was generated from a real device under Linux by dumping the SFDP content
using the following command:

Example:

```
hexdump -v -e '8/1 "0x%02x, " "\n"' \
    /sys/bus/spi/devices/spi1.0/spi-nor/sfdp
```

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/block/m25p80_sfdp.h |  1 +
 hw/block/m25p80.c      |  3 ++-
 hw/block/m25p80_sfdp.c | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/hw/block/m25p80_sfdp.h b/hw/block/m25p80_sfdp.h
index c1e532de5a..61544fb7cc 100644
--- a/hw/block/m25p80_sfdp.h
+++ b/hw/block/m25p80_sfdp.h
@@ -23,6 +23,7 @@ uint8_t m25p80_sfdp_mx25l25635e(uint32_t addr);
 uint8_t m25p80_sfdp_mx25l25635f(uint32_t addr);
 uint8_t m25p80_sfdp_mx66l1g45g(uint32_t addr);
 
+uint8_t m25p80_sfdp_w25q33pw(uint32_t addr);
 uint8_t m25p80_sfdp_w25q256(uint32_t addr);
 uint8_t m25p80_sfdp_w25q512jv(uint32_t addr);
 uint8_t m25p80_sfdp_w25q80bl(uint32_t addr);
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index e88efd913b..0e4bd93f34 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -353,7 +353,8 @@ static const FlashPartInfo known_devices[] = {
     { INFO("w25x16",      0xef3015,      0,  64 << 10,  32, ER_4K) },
     { INFO("w25x32",      0xef3016,      0,  64 << 10,  64, ER_4K) },
     { INFO("w25q32",      0xef4016,      0,  64 << 10,  64, ER_4K) },
-    { INFO("w25q33pw",    0xef6016,      0,  64 << 10,  64, ER_4K) },
+    { INFO("w25q33pw",    0xef6016,      0,  64 << 10,  64, ER_4K),
+      .sfdp_read = m25p80_sfdp_w25q33pw },
     { INFO("w25x64",      0xef3017,      0,  64 << 10, 128, ER_4K) },
     { INFO("w25q64",      0xef4017,      0,  64 << 10, 128, ER_4K) },
     { INFO("w25q80",      0xef5014,      0,  64 << 10,  16, ER_4K) },
diff --git a/hw/block/m25p80_sfdp.c b/hw/block/m25p80_sfdp.c
index 87878c2bf0..8ac603e212 100644
--- a/hw/block/m25p80_sfdp.c
+++ b/hw/block/m25p80_sfdp.c
@@ -296,6 +296,42 @@ define_sfdp_read(mx66l1g45g);
  * Windbond
  */
 
+static const uint8_t sfdp_w25q33pw[] = {
+    0x53, 0x46, 0x44, 0x50, 0x0a, 0x01, 0x00, 0xff,
+    0x00, 0x08, 0x01, 0x17, 0x80, 0x00, 0x00, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xe5, 0x20, 0xf9, 0xff, 0xff, 0xff, 0xff, 0x01,
+    0x44, 0xeb, 0x08, 0x6b, 0x08, 0x3b, 0x42, 0xbb,
+    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
+    0xff, 0xff, 0x44, 0xeb, 0x0c, 0x20, 0x0f, 0x52,
+    0x10, 0xd8, 0x00, 0x00, 0x14, 0x32, 0x01, 0x01,
+    0x81, 0xe3, 0x14, 0xc2, 0xe9, 0x63, 0x76, 0x33,
+    0x7a, 0x75, 0x7a, 0x75, 0xf7, 0xa9, 0xd5, 0x5c,
+    0x39, 0xf6, 0x6d, 0xff, 0xe9, 0x30, 0xf8, 0x80,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xac, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0xf7, 0xf5, 0xff, 0xff,
+    0x0f, 0x00, 0x00, 0x00, 0x06, 0x0d, 0x44, 0xbd,
+    0x27, 0xed, 0x08, 0x0d, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+};
+define_sfdp_read(w25q33pw);
+
 static const uint8_t sfdp_w25q256[] = {
     0x53, 0x46, 0x44, 0x50, 0x00, 0x01, 0x00, 0xff,
     0x00, 0x00, 0x01, 0x09, 0x80, 0x00, 0x00, 0xff,
-- 
2.53.0

[PATCH v1 05/14] hw/misc/aspeed_scu: Correct AST1040 A0 revision ID

[Jamin Lin]

Correct the AST1040 A0 silicon revision ID from 0x81000000 to 0x80000000.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 include/hw/misc/aspeed_scu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 904549465f..6482038f12 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -51,7 +51,7 @@ struct Aspeed2700SCUState {
 #define AST2600_A3_SILICON_REV   0x05030303U
 #define AST1030_A1_SILICON_REV   0x80010000U
 #define AST1060_A2_SILICON_REV   0xA0030000U
-#define AST1040_A0_SILICON_REV   0x81000000U
+#define AST1040_A0_SILICON_REV   0x80000000U
 #define AST2700_A1_SILICON_REV   0x06010103U
 #define AST2700_A2_SILICON_REV   0x06020103U
 
-- 
2.53.0

[PATCH v1 06/14] hw/ssi/aspeed_smc: Add AST1040 FMC and SPI controllers

[Jamin Lin]

The AST1040 FMC and SPI controllers are compatible with the AST2700
controllers, but use different flash window. Therefore, the AST2700
controller types cannot be reused directly for AST1040.

Add dedicated AST1040 FMC, SPI0 and SPI1 controller types with the
appropriate parameter settings.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/ssi/aspeed_smc.c | 109 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 109 insertions(+)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index c0c3666dbc..89a7dc1105 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -2072,6 +2072,100 @@ static void aspeed_2700_spi2_class_init(ObjectClass *klass, const void *data)
     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
 }
 
+static void aspeed_1040_fmc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
+
+    dc->desc               = "Aspeed 1040 FMC Controller";
+    asc->r_conf            = R_CONF;
+    asc->r_ce_ctrl         = R_CE_CTRL;
+    asc->r_ctrl0           = R_CTRL0;
+    asc->r_timings         = R_TIMINGS;
+    asc->nregs_timings     = 2;
+    asc->conf_enable_w0    = CONF_ENABLE_W0;
+    asc->cs_num_max        = 2;
+    asc->segments          = aspeed_2700_spi0_segments;
+    asc->segment_addr_mask = 0xffffffff;
+    asc->flash_window_base = 0x80000000;
+    asc->flash_window_size = 512 * MiB;
+    asc->features          = ASPEED_SMC_FEATURE_DMA |
+                             ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+    asc->dma_flash_mask    = 0x1FFFFFFC;
+    asc->dma_dram_mask     = 0x00FFFFFC;
+    asc->dma_start_length  = 1;
+    asc->nregs             = ASPEED_SMC_R_MAX;
+    asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
+    asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
+    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
+    asc->reg_ops           = &aspeed_2700_smc_flash_ops;
+}
+
+static const AspeedSegments aspeed_1040_spi0_segments[] = {
+    { 0x0, 128 * MiB },
+    { 128 * MiB, 128 * MiB },
+    { 256 * MiB, 128 * MiB },
+    { 384 * MiB, 128 * MiB },
+};
+
+static void aspeed_1040_spi0_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
+
+    dc->desc               = "Aspeed 1040 SPI0 Controller";
+    asc->r_conf            = R_CONF;
+    asc->r_ce_ctrl         = R_CE_CTRL;
+    asc->r_ctrl0           = R_CTRL0;
+    asc->r_timings         = R_TIMINGS;
+    asc->nregs_timings     = 4;
+    asc->conf_enable_w0    = CONF_ENABLE_W0;
+    asc->cs_num_max        = 4;
+    asc->segments          = aspeed_1040_spi0_segments;
+    asc->segment_addr_mask = 0xffffffff;
+    asc->flash_window_base = 0xA0000000;
+    asc->flash_window_size = 512 * MiB;
+    asc->features          = ASPEED_SMC_FEATURE_DMA |
+                             ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+    asc->dma_flash_mask    = 0x1FFFFFFC;
+    asc->dma_dram_mask     = 0x00FFFFFC;
+    asc->dma_start_length  = 1;
+    asc->nregs             = ASPEED_SMC_R_MAX;
+    asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
+    asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
+    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
+    asc->reg_ops           = &aspeed_2700_smc_flash_ops;
+}
+
+static void aspeed_1040_spi1_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
+
+    dc->desc               = "Aspeed 1040 SPI1 Controller";
+    asc->r_conf            = R_CONF;
+    asc->r_ce_ctrl         = R_CE_CTRL;
+    asc->r_ctrl0           = R_CTRL0;
+    asc->r_timings         = R_TIMINGS;
+    asc->nregs_timings     = 2;
+    asc->conf_enable_w0    = CONF_ENABLE_W0;
+    asc->cs_num_max        = 2;
+    asc->segments          = aspeed_2700_spi0_segments;
+    asc->segment_addr_mask = 0xffffffff;
+    asc->flash_window_base = 0xC0000000;
+    asc->flash_window_size = 512 * MiB;
+    asc->features          = ASPEED_SMC_FEATURE_DMA |
+                             ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+    asc->dma_flash_mask    = 0x1FFFFFFC;
+    asc->dma_dram_mask     = 0x00FFFFFC;
+    asc->dma_start_length  = 1;
+    asc->nregs             = ASPEED_SMC_R_MAX;
+    asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
+    asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
+    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
+    asc->reg_ops           = &aspeed_2700_smc_flash_ops;
+}
+
 static const TypeInfo aspeed_smc_types[] = {
     {
         .name           = TYPE_ASPEED_SMC_FLASH,
@@ -2103,6 +2197,21 @@ static const TypeInfo aspeed_smc_types[] = {
         .parent     = TYPE_ASPEED_SMC,
         .class_init = aspeed_1030_spi2_class_init,
     },
+    {
+        .name       = "aspeed.fmc-ast1040",
+        .parent     = TYPE_ASPEED_SMC,
+        .class_init = aspeed_1040_fmc_class_init,
+    },
+    {
+        .name       = "aspeed.spi0-ast1040",
+        .parent     = TYPE_ASPEED_SMC,
+        .class_init = aspeed_1040_spi0_class_init,
+    },
+    {
+        .name       = "aspeed.spi1-ast1040",
+        .parent     = TYPE_ASPEED_SMC,
+        .class_init = aspeed_1040_spi1_class_init,
+    },
     {
         .name       = "aspeed.smc-ast2400",
         .parent     = TYPE_ASPEED_SMC,
-- 
2.53.0

[PATCH v1 07/14] hw/arm/aspeed_ast1040: Add FMC and SPI controllers

[Jamin Lin]

Add the FMC, SPI0 and SPI1 controllers to the AST1040 SoC. Map their
register and flash memory regions, connect their interrupts, and link
the DMA DRAM region to internal Hyper RAM.

The AST1040 supports two SPI controllers, SPI0 and SPI1.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast1040.c | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 0b078f10c4..6e3b6900e0 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -103,7 +103,9 @@ static void aspeed_soc_ast1040_init(Object *obj)
     Aspeed10x0SoCState *a = ASPEED10X0_SOC(obj);
     AspeedSoCState *s = ASPEED_SOC(obj);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    char typename[64];
     int i;
+
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
 
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
@@ -132,6 +134,13 @@ static void aspeed_soc_ast1040_init(Object *obj)
         object_initialize_child(obj, "wdt[*]", &s->wdt[i],
                                 "aspeed.wdt-ast2700");
     }
+
+    object_initialize_child(obj, "fmc", &s->fmc, "aspeed.fmc-ast1040");
+
+    for (i = 0; i < sc->spis_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.spi%d-ast1040", i);
+        object_initialize_child(obj, "spi[*]", &s->spi[i], typename);
+    }
 }
 
 static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
@@ -268,6 +277,34 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
 
+    /* FMC, The number of CS is set at the board level */
+    object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(&s->sram[1]),
+            &error_abort);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 0,
+                    sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
+                    ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
+                       aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_FMC));
+
+    /* SPI */
+    for (i = 0; i < sc->spis_num; i++) {
+        object_property_set_link(OBJECT(&s->spi[i]), "dram",
+                                 OBJECT(&s->sram[1]), &error_abort);
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
+            return;
+        }
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 0,
+                        sc->memmap[ASPEED_DEV_SPI0 + i]);
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
+                        ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
+                           aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_SPI0 + i));
+    }
+
     /* Unimplemented devices */
     create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 }
@@ -292,6 +329,7 @@ static void aspeed_soc_ast1040_class_init(ObjectClass *klass, const void *data)
     sc->uarts_num       = 13;
     sc->sgpio_num       = 2;
     sc->wdts_num        = 8;
+    sc->spis_num        = 2;
     sc->uarts_base      = ASPEED_DEV_UART0;
     sc->irqmap          = aspeed_soc_ast1040_irqmap;
     sc->memmap          = aspeed_soc_ast1040_memmap;
-- 
2.53.0

[PATCH v1 08/14] hw/arm/aspeed_ast1040: Add FMC and SPI filters as unimplemented devices

[Jamin Lin]

The AST1040 provides filter register regions for the FMC, SPI0 and SPI1
controllers at the following addresses:

FMC filter: 0x74000400
SPI0 filter: 0x74010400
SPI1 filter: 0x74020400

These filters are not modeled yet. Add the register regions as
unimplemented devices to reflect the AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast1040.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 6e3b6900e0..5eb091e675 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -87,6 +87,9 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "udc", "aspeed.udc", 0x74120000, 0x4000, -1000 },
     { "jtag[0]", "aspeed.jtag0", 0x74C01000, 0x100, -1000 },
     { "jtag[1]", "aspeed.jtag1", 0x74C09000, 0x100, -1000 },
+    { "fmc-filter",  "aspeed.fmc-filter", 0x74000400, 0x1000, -1000 },
+    { "spi0-filter", "aspeed.spi0-filter", 0x74010400, 0x1000, -1000 },
+    { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
     { }
 };
 
-- 
2.53.0

[PATCH v1 09/14] hw/arm/aspeed_ast1040: Add OTP as an unimplemented device

[Jamin Lin]

The AST1040 provides an OTP controller at 0x74c07000, but the controller
is not modeled yet.

Add the OTP register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 5eb091e675..48eda35ffe 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -90,6 +90,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "fmc-filter",  "aspeed.fmc-filter", 0x74000400, 0x1000, -1000 },
     { "spi0-filter", "aspeed.spi0-filter", 0x74010400, 0x1000, -1000 },
     { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
+    { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
     { }
 };
 
-- 
2.53.0

[PATCH v1 10/14] hw/arm/aspeed_ast1040: Add Anti-Tamper Controller (ATC) as an unimplemented device

[Jamin Lin]

The AST1040 provides an Anti-Tamper Controller (ATC) at 0x74c35000,
but the controller is not modeled yet.

Add the ATC register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 48eda35ffe..88f7a2df2c 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -91,6 +91,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "spi0-filter", "aspeed.spi0-filter", 0x74010400, 0x1000, -1000 },
     { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
     { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
+    { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
     { }
 };
 
-- 
2.53.0

[PATCH v1 11/14] hw/arm/aspeed_ast1040: Add I3C as an unimplemented device

[Jamin Lin]

The AST1040 provides an I3C at 0x74c20000, but the controller is not
modeled yet.

Add the I3C register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 88f7a2df2c..5f6aa1503a 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -92,6 +92,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
     { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
     { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
+    { "i3c", "aspeed.i3c", 0x74C20000, 0x8000, -1000 },
     { }
 };
 
-- 
2.53.0

[PATCH v1 12/14] hw/arm/aspeed_ast1040: Add Caliptra as an unimplemented device

[Jamin Lin]

The AST1040 provides a Caliptra Wrapper at 0x74200000 with
a size of 1MB, but it is not modeled yet.

Add the Caliptra register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 5f6aa1503a..74a1097bd7 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -93,6 +93,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
     { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
     { "i3c", "aspeed.i3c", 0x74C20000, 0x8000, -1000 },
+    { "caliptra", "aspeed.caliptra", 0x74200000, 0x100000, -1000 },
     { }
 };
 
-- 
2.53.0

[PATCH v1 13/14] tests/qtest/aspeed_smc: Add AST1040 SMC tests

[Jamin Lin]

Add SMC qtests for the AST1040 EVB using a 4 MiB W25Q33PW flash
connected to FMC CS0.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 tests/qtest/aspeed_smc-test.c | 61 +++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
index 59c96bd68a..34010e283f 100644
--- a/tests/qtest/aspeed_smc-test.c
+++ b/tests/qtest/aspeed_smc-test.c
@@ -240,12 +240,69 @@ static void test_ast1030_evb(AspeedSMCTestData *data)
                         data, aspeed_smc_test_write_page_qor);
 }
 
+static void test_ast1040_evb(AspeedSMCTestData *data)
+{
+    int ret;
+    int fd;
+
+    fd = g_file_open_tmp("qtest.m25p80.w25q33pw.XXXXXX",
+                         &data->tmp_path, NULL);
+    g_assert(fd >= 0);
+    ret = ftruncate(fd, 4 * 1024 * 1024);
+    g_assert(ret == 0);
+    close(fd);
+
+    data->s = qtest_initf("-machine ast1040-evb "
+                          "-device w25q33pw,bus=ssi.0,cs=0x0,drive=fmc0 "
+                          "-blockdev node-name=fmc0,driver=file,filename=%s",
+                          data->tmp_path);
+
+    /* fmc cs0 with w25q33pw flash */
+    data->flash_base = 0x80000000;
+    data->spi_base = 0x74000000;
+    data->jedec_id = 0xef6016;
+    data->cs = 0;
+    data->node = "/machine/soc/fmc/ssi.0/child[0]";
+    /* beyond 512KB */
+    data->page_addr = 0x800 * FLASH_PAGE_SIZE;
+
+    qtest_add_data_func("/ast1040/smc/read_jedec",
+                        data, aspeed_smc_test_read_jedec);
+    qtest_add_data_func("/ast1040/smc/erase_sector",
+                        data, aspeed_smc_test_erase_sector);
+    qtest_add_data_func("/ast1040/smc/erase_all",
+                        data, aspeed_smc_test_erase_all);
+    qtest_add_data_func("/ast1040/smc/write_page",
+                        data, aspeed_smc_test_write_page);
+    qtest_add_data_func("/ast1040/smc/read_page_mem",
+                        data, aspeed_smc_test_read_page_mem);
+    qtest_add_data_func("/ast1040/smc/write_page_mem",
+                        data, aspeed_smc_test_write_page_mem);
+    qtest_add_data_func("/ast1040/smc/read_status_reg",
+                        data, aspeed_smc_test_read_status_reg);
+    qtest_add_data_func("/ast1040/smc/write_page_qpi",
+                        data, aspeed_smc_test_write_page_qpi);
+    qtest_add_data_func("/ast1040/smc/read_page_mem_fast_read",
+                        data, aspeed_smc_test_read_page_mem_fast_read);
+    qtest_add_data_func("/ast1040/smc/write_page_fast_read",
+                        data, aspeed_smc_test_write_page_fast_read);
+    qtest_add_data_func("/ast1040/smc/read_page_mem_dor",
+                        data, aspeed_smc_test_read_page_mem_dor);
+    qtest_add_data_func("/ast1040/smc/write_page_dor",
+                        data, aspeed_smc_test_write_page_dor);
+    qtest_add_data_func("/ast1040/smc/read_page_mem_qor",
+                        data, aspeed_smc_test_read_page_mem_qor);
+    qtest_add_data_func("/ast1040/smc/write_page_qor",
+                        data, aspeed_smc_test_write_page_qor);
+}
+
 int main(int argc, char **argv)
 {
     AspeedSMCTestData palmetto_data;
     AspeedSMCTestData ast2500_evb_data;
     AspeedSMCTestData ast2600_evb_data;
     AspeedSMCTestData ast1030_evb_data;
+    AspeedSMCTestData ast1040_evb_data;
     int ret;
 
     g_test_init(&argc, &argv, NULL);
@@ -254,20 +311,24 @@ int main(int argc, char **argv)
     test_ast2500_evb(&ast2500_evb_data);
     test_ast2600_evb(&ast2600_evb_data);
     test_ast1030_evb(&ast1030_evb_data);
+    test_ast1040_evb(&ast1040_evb_data);
     ret = g_test_run();
 
     qtest_quit(palmetto_data.s);
     qtest_quit(ast2500_evb_data.s);
     qtest_quit(ast2600_evb_data.s);
     qtest_quit(ast1030_evb_data.s);
+    qtest_quit(ast1040_evb_data.s);
     unlink(palmetto_data.tmp_path);
     unlink(ast2500_evb_data.tmp_path);
     unlink(ast2600_evb_data.tmp_path);
     unlink(ast1030_evb_data.tmp_path);
+    unlink(ast1040_evb_data.tmp_path);
     g_free(palmetto_data.tmp_path);
     g_free(ast2500_evb_data.tmp_path);
     g_free(ast2600_evb_data.tmp_path);
     g_free(ast1030_evb_data.tmp_path);
+    g_free(ast1040_evb_data.tmp_path);
 
     return ret;
 }
-- 
2.53.0

[PATCH v1 14/14] tests/functional/arm/test_aspeed_ast1040: Update AST1040 image to aspeed-mcu-fw-hub v01.00

[Jamin Lin]

Previously, ASPEED hosted the AST1040 pre-built image in the Zephyr GitHub repository
as a temporary solution for QEMU functional tests.

ASPEED now provides official AST1040/AST1080 pre-built images in the aspeed-mcu-fw-hub
repository, starting with release v01.00.

Update the AST1040 functional test to use the official pre-built image from
aspeed-mcu-fw-hub instead of the Zephyr repository.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 tests/functional/arm/test_aspeed_ast1040.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast1040.py b/tests/functional/arm/test_aspeed_ast1040.py
index e4d8ecb37a..bdfd815673 100644
--- a/tests/functional/arm/test_aspeed_ast1040.py
+++ b/tests/functional/arm/test_aspeed_ast1040.py
@@ -12,17 +12,19 @@
 
 class AST1040Machine(AspeedTest):
 
-    ASSET_ZEPHYR_3_07 = Asset(
+    ASSET_ASPEED_AST1040_EVB_01_00 = Asset(
         ('https://github.com/AspeedTech-BMC'
-         '/zephyr/releases/download/v00.03.07/ast1040-evb-demo.zip'),
-         'b5189797c22c2d732ddc27670c1efdeba821a2747c9c7434f190791125baa121')
+         '/aspeed-mcu-fw-hub/releases/download/v01.00'
+         '/ast1040a0-evb-v01.00.tar.gz'),
+         '62dff10cef99a72a9ec679b7ed2c80ba1b76dcdab6bb66251e99a83a31612a02')
 
     def test_arm_ast1040_zephyros(self):
         self.set_machine('ast1040-evb')
 
-        kernel_name = "zephyr.bin"
+        kernel_name = ('ast1040a0-evb-v01.00/ast1040/ast1040a0/evb/'
+                       'zephyr-shell-module.bin')
         kernel_file = self.archive_extract(
-            self.ASSET_ZEPHYR_3_07, member=kernel_name)
+            self.ASSET_ASPEED_AST1040_EVB_01_00, member=kernel_name)
 
         self.vm.set_console()
         self.vm.add_args('-kernel', kernel_file, '-nographic')
-- 
2.53.0

Re: [PATCH v1 00/14] hw/arm/aspeed: Add AST1040 FMC/SPI controllers and unimplemented devices

[Cédric Le Goater]

Hello Jamin,

On 10/15/26 07:56, Jamin Lin wrote:
> Dependency:
> 
> This series is based on the aspeed-next branch:
> https://github.com/legoater/qemu/commits/aspeed-next

I appreciate all these new additions, but there are also pending proposals
that require some feedback too ...

Thanks,

C.


> 
> v1:
>   1. Fix AST2700 segment end address decoding
>   2. Fix AST2700 DMA flash address mask
>   3. Rename w25q32dw to w25q33pw and add the SFDP table for the W25Q33PW,
>   4. Correct the AST1040 A0 silicon revision ID
>   5. Add FMC and SPI controllers
>   6. Add the FMC/SPI filters, OTP, ATC, I3C and Caliptra register
>      regions as unimplemented device
>   7. Update the AST1040 functional test to use the official pre-built
>      image from aspeed-mcu-fw-hub v01.00.
> 
> Jamin Lin (14):
>    hw/ssi/aspeed_smc: Fix AST2700 segment end address decoding
>    hw/ssi/aspeed_smc: Fix AST2700 DMA flash address mask
>    hw/block/m25p80: Rename w25q32dw to w25q33pw
>    hw/block/m25p80: Add SFDP table for Winbond W25Q33PW flash
>    hw/misc/aspeed_scu: Correct AST1040 A0 revision ID
>    hw/ssi/aspeed_smc: Add AST1040 FMC and SPI controllers
>    hw/arm/aspeed_ast1040: Add FMC and SPI controllers
>    hw/arm/aspeed_ast1040: Add FMC and SPI filters as unimplemented
>      devices
>    hw/arm/aspeed_ast1040: Add OTP as an unimplemented device
>    hw/arm/aspeed_ast1040: Add Anti-Tamper Controller (ATC) as an
>      unimplemented device
>    hw/arm/aspeed_ast1040: Add I3C as an unimplemented device
>    hw/arm/aspeed_ast1040: Add Caliptra as an unimplemented device
>    tests/qtest/aspeed_smc: Add AST1040 SMC tests
>    tests/functional/arm/test_aspeed_ast1040: Update AST1040 image to
>      aspeed-mcu-fw-hub v01.00
> 
>   hw/block/m25p80_sfdp.h                      |   1 +
>   include/hw/misc/aspeed_scu.h                |   2 +-
>   hw/arm/aspeed_ast1040.c                     |  45 ++++++++
>   hw/block/m25p80.c                           |   3 +-
>   hw/block/m25p80_sfdp.c                      |  36 ++++++
>   hw/ssi/aspeed_smc.c                         | 121 +++++++++++++++++++-
>   tests/qtest/aspeed_smc-test.c               |  61 ++++++++++
>   tests/functional/arm/test_aspeed_ast1040.py |  12 +-
>   8 files changed, 268 insertions(+), 13 deletions(-)
>