[PULL 00/21] aspeed queue

[PULL 00/21] aspeed queue

[Cédric Le Goater]

The following changes since commit d5b5083cb783c447001e862c2b525e59f48ad78c:

  Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2026-10-15 11:53:41 +0200)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-aspeed-20261015

for you to fetch changes up to 4cf1f0e37d9491eb8b0c8be8dd9dab9260b8fa36:

  tests/functional: give the set_machine probe VM the test workdir (2026-10-15 13:14:09 +0200)

----------------------------------------------------------------
aspeed queue:

* Fix OOB read in HACE has_padding() when padding_size is zero
* Allocate ACRY RSA qtest SRAM buffers on the heap to reduce stack usage
* Consolidate OTP layout definitions between aspeed_otp and aspeed_sbc
* Derive ABR and secure boot state from OTP config straps, removing
  the "emmc-abr" and "signing-settings" machine properties
* Sort device IDs alphabetically
* Add I2C test for IO expander 1 on the AST2700A2
* Update ASPEED BMCs reviewer list
* Add a create_unimplemented_devices() helper and convert all Aspeed
  SoCs and coprocessors to table-driven unimplemented devices
* Fix the set_machine probe VM to use the test workdir

----------------------------------------------------------------
Cédric Le Goater (1):
      hw/misc/aspeed_hace: Fix OOB read in has_padding()

Emmanuel Blot (1):
      tests/functional: give the set_machine probe VM the test workdir

Jamin Lin (16):
      tests/qtest/aspeed-acry: Allocate SRAM buffers on the heap
      hw/arm/aspeed: Sort device IDs alphabetically
      tests/functional/aarch64/test_aspeed_ast2700a2: Add I2C test for IO expander 1
      MAINTAINERS: Update ASPEED BMCs reviewers
      hw/misc/unimp: Add create_unimplemented_devices() helper
      hw/arm/aspeed_ast2400: Use a table for unimplemented devices
      hw/arm/aspeed_ast2600: Use a table for unimplemented devices
      hw/arm/aspeed_ast27x0: Use a table for unimplemented devices
      hw/arm/aspeed_ast10x0: Use a table for unimplemented devices
      hw/arm/aspeed_ast1040: Use a table for unimplemented devices
      hw/arm/aspeed: Remove unused unimplemented device fields
      hw/arm/aspeed_ast27x0: Use a table for unimplemented devices for SSP/TSP
      hw/arm/aspeed_coprocessor: Remove unused unimplemented device fields
      hw/arm/aspeed_ast1700: Use a table for unimplemented devices
      hw/arm/aspeed_ast1700: Remove unused unimplemented device field
      hw/arm/aspeed: Remove unused aspeed_mmio_map_unimplemented()

Kane Chen (3):
      hw/nvram/aspeed_otp, hw/misc/aspeed_sbc: Consolidate OTP layout definitions
      hw/misc/aspeed_sbc: Derive ABR state from OTP config straps
      hw/misc/aspeed_sbc: Derive secure boot state from OTP config

 MAINTAINERS                                       |   4 -
 include/hw/arm/aspeed_ast1700.h                   |   2 -
 include/hw/arm/aspeed_coprocessor.h               |   5 +-
 include/hw/arm/aspeed_soc.h                       | 190 ++++++++++------------
 include/hw/misc/aspeed_sbc.h                      |   3 -
 include/hw/misc/unimp.h                           |  21 +++
 include/hw/nvram/aspeed_otp.h                     |  32 ++++
 hw/arm/aspeed_ast1040.c                           |  40 ++---
 hw/arm/aspeed_ast10x0.c                           |  55 ++-----
 hw/arm/aspeed_ast1700.c                           |  21 +--
 hw/arm/aspeed_ast2400.c                           |  25 ++-
 hw/arm/aspeed_ast2600.c                           |  44 ++---
 hw/arm/aspeed_ast27x0-ssp.c                       |  44 ++---
 hw/arm/aspeed_ast27x0-tsp.c                       |  44 ++---
 hw/arm/aspeed_ast27x0.c                           |  41 ++---
 hw/arm/aspeed_soc_common.c                        |  11 --
 hw/misc/aspeed_hace.c                             |   2 +-
 hw/misc/aspeed_sbc.c                              |  97 ++++++-----
 hw/misc/unimp.c                                   |  20 +++
 hw/nvram/aspeed_otp.c                             |  63 +++++++
 tests/qtest/aspeed-acry-test.c                    |   8 +-
 tests/functional/aarch64/test_aspeed_ast2700a2.py |   3 +
 tests/functional/qemu_test/testcase.py            |   2 +-
 23 files changed, 378 insertions(+), 399 deletions(-)

[PULL 01/21] hw/misc/aspeed_hace: Fix OOB read in has_padding()

[Cédric Le Goater]

When total_msg_len equals total_req_len, padding_size is 0, making
pad_offset equal to req_len. The subsequent padding[pad_offset] read
accesses one byte past the buffer. Return false early when
padding_size is zero.

Fixes: 5cd7d8564a8b ("aspeed/hace: Support AST2600 HACE")
Reported-by: Christopher Boker <Chris@cveasyai.com>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20260908053101.1149625-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_hace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/misc/aspeed_hace.c b/hw/misc/aspeed_hace.c
index 8de05a9d98b3..bf8af710335d 100644
--- a/hw/misc/aspeed_hace.c
+++ b/hw/misc/aspeed_hace.c
@@ -225,7 +225,7 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
         uint32_t padding_size = s->total_req_len - *total_msg_len;
         uint8_t *padding = iov->iov_base;
 
-        if (padding_size > req_len) {
+        if (padding_size == 0 || padding_size > req_len) {
             return false;
         }
 
-- 
2.56.0

[PULL 02/21] tests/qtest/aspeed-acry: Allocate SRAM buffers on the heap

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The ACRY RSA qtest allocates two ACRY_SRAM_SIZE buffers on the
stack. Since each buffer is nearly 9 KiB, this unnecessarily increases
the stack usage of test_modexp_rsa() and may cause unexpected failures
on environments with a limited stack size.

This reduces the stack usage while preserving the existing test
behavior.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Link: https://lore.kernel.org/qemu-devel/20260910012422.4065857-1-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed-acry-test.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/aspeed-acry-test.c b/tests/qtest/aspeed-acry-test.c
index ec348c220664..51048d697cf6 100644
--- a/tests/qtest/aspeed-acry-test.c
+++ b/tests/qtest/aspeed-acry-test.c
@@ -327,8 +327,8 @@ static void test_modexp_rsa(const void *opaque)
         .alg = QCRYPTO_AK_CIPHER_ALGO_RSA,
         .u.rsa.padding_alg = QCRYPTO_RSA_PADDING_ALGO_RAW,
     };
-    uint8_t dram_buf[ACRY_SRAM_SIZE] = { 0 };
-    uint8_t sram_buf[ACRY_SRAM_SIZE] = { 0 };
+    g_autofree uint8_t *dram_buf = g_malloc0(ACRY_SRAM_SIZE);
+    g_autofree uint8_t *sram_buf = g_malloc0(ACRY_SRAM_SIZE);
     uint8_t result[ACRY_MAX_BYTES] = { 0 };
     QTestState *qts;
 
@@ -345,7 +345,7 @@ static void test_modexp_rsa(const void *opaque)
     put_bignum_be_bytes(dram_buf, ACRY_MOD_OFFSET, t->n, t->n_len);
     put_bignum_be_bytes(dram_buf, ACRY_DATA_OFFSET, t->m, t->m_len);
 
-    qtest_memwrite(qts, c->dram_addr, dram_buf, sizeof(dram_buf));
+    qtest_memwrite(qts, c->dram_addr, dram_buf, ACRY_SRAM_SIZE);
 
     qtest_writel(qts, c->acry_addr + ACRY_DMA_CMD, ACRY_DMA_CMD_DMEM_AHB);
     qtest_writel(qts, c->acry_addr + ACRY_DMA_SRC, c->dram_addr);
@@ -362,7 +362,7 @@ static void test_modexp_rsa(const void *opaque)
     g_assert_cmphex(qtest_readl(qts, c->acry_addr + ACRY_STATUS), ==,
                     ACRY_STATUS_RSA_DONE);
 
-    qtest_memread(qts, c->sram_addr, sram_buf, sizeof(sram_buf));
+    qtest_memread(qts, c->sram_addr, sram_buf, ACRY_SRAM_SIZE);
     get_bignum_be_bytes(sram_buf, ACRY_DATA_OFFSET, result, t->c_len);
     g_assert_cmpmem(result, t->c_len, t->c, t->c_len);
 
-- 
2.56.0

[PULL 03/21] hw/nvram/aspeed_otp, hw/misc/aspeed_sbc: Consolidate OTP layout definitions

[Cédric Le Goater]

From: Kane Chen <kane_chen@aspeedtech.com>

Move the OTP address-space layout definitions from aspeed_sbc.c to
aspeed_otp.h, as they describe the OTP device layout.

Add an aspeed_otp_read() helper to reduce duplicated OTP read code.

Remove the redundant OTP address bounds checks, as invalid accesses
are already handled by the OTP address space.

No functional change.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260918065347.3713868-2-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/nvram/aspeed_otp.h | 13 +++++++++
 hw/misc/aspeed_sbc.c          | 52 +++++++++++------------------------
 2 files changed, 29 insertions(+), 36 deletions(-)

diff --git a/include/hw/nvram/aspeed_otp.h b/include/hw/nvram/aspeed_otp.h
index 375235386079..2b6c2eaaa353 100644
--- a/include/hw/nvram/aspeed_otp.h
+++ b/include/hw/nvram/aspeed_otp.h
@@ -16,6 +16,19 @@
 #define TYPE_ASPEED_OTP "aspeed-otp"
 OBJECT_DECLARE_SIMPLE_TYPE(AspeedOTPState, ASPEED_OTP)
 
+#define OTP_MEMORY_SIZE                 0x4000
+
+/*
+ * The OTP address space is indexed by dword address and is split into
+ * two regions:
+ *
+ *  - [0, OTP_DATA_DWORD_COUNT]: the data region. Each address contains
+ *    64 bits of data.
+ *  - [OTP_DATA_DWORD_COUNT, OTP_MEMORY_SIZE / 4]: the configuration
+ *    region. Each address contains 32 bits of data.
+ */
+#define OTP_DATA_DWORD_COUNT            (0x800)
+
 typedef struct AspeedOTPState {
     DeviceState parent_obj;
 
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 5c193d9086ed..3402cef5c3ec 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -66,15 +66,11 @@
 #define QSR_RSA_MASK           (0x3 << 12)
 #define QSR_HASH_MASK          (0x3 << 10)
 
-#define OTP_MEMORY_SIZE 0x4000
 /* OTP command */
 #define SBC_OTP_CMD_READ 0x23b1e361
 #define SBC_OTP_CMD_WRITE 0x23b1e362
 #define SBC_OTP_CMD_PROG 0x23b1e364
 
-#define OTP_DATA_DWORD_COUNT        (0x800)
-#define OTP_TOTAL_DWORD_COUNT       (0x1000)
-
 /* Voltage mode */
 #define MODE_REGISTER               (0x1000)
 #define MODE_REGISTER_A             (0x3000)
@@ -96,43 +92,34 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
     return s->regs[addr];
 }
 
-static bool aspeed_sbc_otp_read(AspeedSBCState *s,
-                                   uint32_t otp_addr)
+static bool aspeed_otp_read(AspeedSBCState *s, uint32_t otp_addr,
+                             uint32_t *value)
 {
-    MemTxResult ret;
-    AspeedOTPState *otp = &s->otp;
-    uint32_t value, otp_offset;
-    bool is_data = false;
-
-    if (otp_addr < OTP_DATA_DWORD_COUNT) {
-        is_data = true;
-    } else if (otp_addr >= OTP_TOTAL_DWORD_COUNT) {
+    if (address_space_read(&s->otp.as, otp_addr << 2, MEMTXATTRS_UNSPECIFIED,
+                            value, sizeof(*value)) != MEMTX_OK) {
         qemu_log_mask(LOG_GUEST_ERROR,
-                      "Invalid OTP addr 0x%x\n",
+                      "Failed to read OTP memory, addr = %x\n",
                       otp_addr);
         return false;
     }
 
-    otp_offset = otp_addr << 2;
-    ret = address_space_read(&otp->as, otp_offset, MEMTXATTRS_UNSPECIFIED,
-                             &value, sizeof(value));
-    if (ret != MEMTX_OK) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "Failed to read OTP memory, addr = %x\n",
-                      otp_addr);
+    return true;
+}
+
+static bool aspeed_sbc_otp_read(AspeedSBCState *s,
+                                   uint32_t otp_addr)
+{
+    uint32_t value;
+    bool is_data = otp_addr < OTP_DATA_DWORD_COUNT;
+
+    if (!aspeed_otp_read(s, otp_addr, &value)) {
         return false;
     }
     s->regs[R_CAMP1] = value;
     trace_aspeed_sbc_otp_read(otp_addr, value);
 
     if (is_data) {
-        ret = address_space_read(&otp->as, otp_offset + 4,
-                                 MEMTXATTRS_UNSPECIFIED,
-                                 &value, sizeof(value));
-        if (ret != MEMTX_OK) {
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "Failed to read OTP memory, addr = %x\n",
-                          otp_addr);
+        if (!aspeed_otp_read(s, otp_addr + 1, &value)) {
             return false;
         }
         s->regs[R_CAMP2] = value;
@@ -181,13 +168,6 @@ static bool aspeed_sbc_otp_prog(AspeedSBCState *s,
     uint32_t value = s->regs[R_CAMP1];
     uint32_t otp_offset = otp_addr << 2;
 
-    if (otp_addr >= OTP_TOTAL_DWORD_COUNT) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "Invalid OTP addr 0x%x\n",
-                      otp_addr);
-        return false;
-    }
-
     ret = address_space_write(&otp->as, otp_offset, MEMTXATTRS_UNSPECIFIED,
                               &value, sizeof(value));
     if (ret != MEMTX_OK) {
-- 
2.56.0

[PULL 04/21] hw/misc/aspeed_sbc: Derive ABR state from OTP config straps

[Cédric Le Goater]

From: Kane Chen <kane_chen@aspeedtech.com>

The eMMC ABR enable state is currently controlled by the "emmc-abr"
machine property instead of the OTP configuration.

Add helpers to read the OTP configuration and resolve strap values.
Use the ABR strap value to update ABR_EN when R_STATUS is read.

Remove the "emmc-abr" property as the ABR state is now derived from
OTP.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260918065347.3713868-3-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/misc/aspeed_sbc.h  |  1 -
 include/hw/nvram/aspeed_otp.h | 23 +++++++++++--
 hw/misc/aspeed_sbc.c          | 29 ++++++++++++----
 hw/nvram/aspeed_otp.c         | 63 +++++++++++++++++++++++++++++++++++
 4 files changed, 106 insertions(+), 10 deletions(-)

diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 756c61235697..b210ffb8aa86 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -32,7 +32,6 @@ OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
 struct AspeedSBCState {
     SysBusDevice parent;
 
-    bool emmc_abr;
     uint32_t signing_settings;
 
     MemoryRegion iomem;
diff --git a/include/hw/nvram/aspeed_otp.h b/include/hw/nvram/aspeed_otp.h
index 2b6c2eaaa353..f91af12ea9ef 100644
--- a/include/hw/nvram/aspeed_otp.h
+++ b/include/hw/nvram/aspeed_otp.h
@@ -24,11 +24,27 @@ OBJECT_DECLARE_SIMPLE_TYPE(AspeedOTPState, ASPEED_OTP)
  *
  *  - [0, OTP_DATA_DWORD_COUNT]: the data region. Each address contains
  *    64 bits of data.
- *  - [OTP_DATA_DWORD_COUNT, OTP_MEMORY_SIZE / 4]: the configuration
- *    region. Each address contains 32 bits of data.
+ *  - [OTP_DATA_DWORD_COUNT(OTP_CFG0), OTP_MEMORY_SIZE / 4]: the
+ *    configuration region. Each address contains 32 bits of data.
  */
 #define OTP_DATA_DWORD_COUNT            (0x800)
 
+/* Start of the OTP configuration/strap region. */
+#define OTP_CFG0                        (0x800)
+
+/*
+ * OTP straps are a 64-bit value packed as two 32-bit halves starting at
+ * config word OTP_STRAP_START_INDEX (OTPCFG16 and OTPCFG17). Each strap
+ * bit is stored redundantly in OTP_STRAP_COPY_NUM config words, spaced
+ * (OTP_STRAP_BIT_NUM / 32) words apart -- i.e. one word per 32-bit half,
+ * so the two halves interleave; the effective bit value is the XOR of
+ * all copies, matching how the real hardware and the ast-otp reference
+ * tool resolve straps.
+ */
+#define OTP_STRAP_START_INDEX           16
+#define OTP_STRAP_BIT_NUM               64
+#define OTP_STRAP_COPY_NUM              6
+
 typedef struct AspeedOTPState {
     DeviceState parent_obj;
 
@@ -43,4 +59,7 @@ typedef struct AspeedOTPState {
     uint8_t *storage;
 } AspeedOTPState;
 
+uint32_t aspeed_otp_read_config(AspeedOTPState *s, unsigned int cfg_word);
+bool aspeed_otp_read_strap(AspeedOTPState *s, unsigned int bit);
+
 #endif /* ASPEED_OTP_H */
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 3402cef5c3ec..6cec9ad3daf0 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -71,6 +71,9 @@
 #define SBC_OTP_CMD_WRITE 0x23b1e362
 #define SBC_OTP_CMD_PROG 0x23b1e364
 
+/* OTP strap bits */
+#define OTP_STRAP_ABR_EN        0x2b
+
 /* Voltage mode */
 #define MODE_REGISTER               (0x1000)
 #define MODE_REGISTER_A             (0x3000)
@@ -89,7 +92,21 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
         return 0;
     }
 
-    return s->regs[addr];
+    switch (addr) {
+    case R_STATUS: {
+        uint32_t val = s->regs[R_STATUS];
+
+        if (aspeed_otp_read_strap(&s->otp, OTP_STRAP_ABR_EN)) {
+            val |= ABR_EN;
+        } else {
+            val &= ~ABR_EN;
+        }
+
+        return val;
+    }
+    default:
+        return s->regs[addr];
+    }
 }
 
 static bool aspeed_otp_read(AspeedSBCState *s, uint32_t otp_addr,
@@ -388,13 +405,12 @@ static void aspeed_sbc_reset_hold(Object *obj, ResetType type)
 
     memset(s->regs, 0, sizeof(s->regs));
 
-    /* Set secure boot enabled with RSA4096_SHA256 and enable eMMC ABR */
+    /*
+     * ABR_EN is derived from OTP on every read, see aspeed_sbc_read().
+     * Set secure boot enabled with RSA4096_SHA256.
+     */
     s->regs[R_STATUS] = OTP_IDLE | OTP_MEM_IDLE;
 
-    if (s->emmc_abr) {
-        s->regs[R_STATUS] &= ABR_EN;
-    }
-
     if (s->signing_settings) {
         s->regs[R_STATUS] &= SECURE_BOOT_EN;
     }
@@ -452,7 +468,6 @@ static const VMStateDescription vmstate_aspeed_sbc = {
 };
 
 static const Property aspeed_sbc_properties[] = {
-    DEFINE_PROP_BOOL("emmc-abr", AspeedSBCState, emmc_abr, 0),
     DEFINE_PROP_UINT32("signing-settings", AspeedSBCState, signing_settings, 0),
     DEFINE_PROP_LINK("sram", AspeedSBCState, sram,
                      TYPE_MEMORY_REGION, MemoryRegion *),
diff --git a/hw/nvram/aspeed_otp.c b/hw/nvram/aspeed_otp.c
index 81304bda3abe..127da15642f2 100644
--- a/hw/nvram/aspeed_otp.c
+++ b/hw/nvram/aspeed_otp.c
@@ -106,6 +106,69 @@ static void aspeed_otp_write(void *opaque, hwaddr otp_offset,
     trace_aspeed_otp_prog(otp_offset, val, value);
 }
 
+/*
+ * Each OTP configuration setting contains 32 bits of data.
+ * Configuration words are grouped in banks of 8, with banks spaced
+ * 0x200 dwords apart and words within a bank spaced 2 dwords apart:
+ *
+ *   offset(n) = OTP_CFG0 + (n / 8) * 0x200 + (n % 8) * 2
+ *
+ * Returns 0 if the OTP read fails.
+ */
+uint32_t aspeed_otp_read_config(AspeedOTPState *s, unsigned int cfg_word)
+{
+    uint32_t otp_addr = OTP_CFG0 + (cfg_word / 8) * 0x200 + (cfg_word % 8) * 2;
+    uint32_t value = 0;
+
+    if (address_space_read(&s->as, otp_addr << 2, MEMTXATTRS_UNSPECIFIED,
+                            &value, sizeof(value)) != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Failed to read OTP config word %u\n",
+                      __func__, cfg_word);
+        return 0;
+    }
+
+    return value;
+}
+
+/*
+ * OTP straps are a 64-bit value split across two 32-bit config words,
+ * each of which is repeated OTP_STRAP_COPY_NUM times for reliability.
+ * The two words interleave starting at OTP_STRAP_START_INDEX:
+ *
+ *   cfg_word:    16   17   18   19   20   21   22   23   24   25   26   27
+ *              +----+----+----+----+----+----+----+----+----+----+----+----+
+ *              | L0 | H0 | L1 | H1 | L2 | H2 | L3 | H3 | L4 | H4 | L5 | H5 |
+ *              +----+----+----+----+----+----+----+----+----+----+----+----+
+ *
+ *   Lx = copy #x of bit 0-31, Hx = copy #x of bit 32-63
+ *   (x = 0 .. OTP_STRAP_COPY_NUM - 1)
+ *
+ * To resolve strap bit `n` (0 <= n < OTP_STRAP_BIT_NUM):
+ *   half    = n / 32   -- 0 selects the L* words, 1 selects the H* words
+ *   bit_pos = n % 32   -- bit position within the word
+ *   word(i) = OTP_STRAP_START_INDEX + half + i * (OTP_STRAP_BIT_NUM / 32)
+ *
+ * The effective value of bit `n` is the XOR of bit `bit_pos` across all
+ * OTP_STRAP_COPY_NUM copies of word(i).
+ */
+bool aspeed_otp_read_strap(AspeedOTPState *s, unsigned int bit)
+{
+    uint32_t cfg_word = OTP_STRAP_START_INDEX + bit / 32;
+    uint32_t bit_pos = bit % 32;
+    bool enable = false;
+    int i;
+
+    assert(bit < OTP_STRAP_BIT_NUM);
+
+    for (i = 0; i < OTP_STRAP_COPY_NUM; i++) {
+        enable ^= (aspeed_otp_read_config(s, cfg_word) >> bit_pos) & 0x1;
+        cfg_word += OTP_STRAP_BIT_NUM / 32;
+    }
+
+    return enable;
+}
+
 static bool aspeed_otp_init_storage(AspeedOTPState *s, Error **errp)
 {
     uint32_t *p;
-- 
2.56.0

[PULL 05/21] hw/misc/aspeed_sbc: Derive secure boot state from OTP config

[Cédric Le Goater]

From: Kane Chen <kane_chen@aspeedtech.com>

The secure boot state is currently controlled by the
"signing-settings" machine property instead of the OTP configuration.

Derive SECURE_BOOT_EN and R_QSR from the OTP configuration when the
registers are read.

Remove the "signing-settings" property as the secure boot state is now
derived from OTP.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260918065347.3713868-4-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/misc/aspeed_sbc.h |  2 --
 hw/misc/aspeed_sbc.c         | 22 +++++++++++++---------
 2 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index b210ffb8aa86..7f3fa7062f96 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -32,8 +32,6 @@ OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
 struct AspeedSBCState {
     SysBusDevice parent;
 
-    uint32_t signing_settings;
-
     MemoryRegion iomem;
 
     uint32_t regs[ASPEED_SBC_NR_REGS];
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 6cec9ad3daf0..ad4c2b4b1d0c 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -79,6 +79,8 @@
 #define MODE_REGISTER_A             (0x3000)
 #define MODE_REGISTER_B             (0x5000)
 
+static bool aspeed_sbc_otp_read(AspeedSBCState *s, uint32_t otp_addr);
+
 static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
 {
     AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -102,8 +104,16 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
             val &= ~ABR_EN;
         }
 
+        if (aspeed_otp_read_config(&s->otp, 0) & BIT(1)) {
+            val |= SECURE_BOOT_EN;
+        } else {
+            val &= ~SECURE_BOOT_EN;
+        }
+
         return val;
     }
+    case R_QSR:
+        return aspeed_otp_read_config(&s->otp, 0);
     default:
         return s->regs[addr];
     }
@@ -406,16 +416,11 @@ static void aspeed_sbc_reset_hold(Object *obj, ResetType type)
     memset(s->regs, 0, sizeof(s->regs));
 
     /*
-     * ABR_EN is derived from OTP on every read, see aspeed_sbc_read().
-     * Set secure boot enabled with RSA4096_SHA256.
+     * ABR_EN and SECURE_BOOT_EN are derived from OTP on every read, see
+     * aspeed_sbc_read(), since the SBC status register is just a
+     * reflection of the OTP fuse state.
      */
     s->regs[R_STATUS] = OTP_IDLE | OTP_MEM_IDLE;
-
-    if (s->signing_settings) {
-        s->regs[R_STATUS] &= SECURE_BOOT_EN;
-    }
-
-    s->regs[R_QSR] = s->signing_settings;
 }
 
 static void aspeed_sbc_instance_init(Object *obj)
@@ -468,7 +473,6 @@ static const VMStateDescription vmstate_aspeed_sbc = {
 };
 
 static const Property aspeed_sbc_properties[] = {
-    DEFINE_PROP_UINT32("signing-settings", AspeedSBCState, signing_settings, 0),
     DEFINE_PROP_LINK("sram", AspeedSBCState, sram,
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
-- 
2.56.0

[PULL 06/21] hw/arm/aspeed: Sort device IDs alphabetically

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The ASPEED device ID enum has grown over time without a consistent
ordering rule. This makes it difficult to determine where new device
IDs should be added and reduces readability and maintainability as
more devices are introduced.

Sort the device IDs alphabetically to provide a consistent ordering
rule. Keep related numbered devices together, such as SPI0, SPI1 and
SPI2.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261005020428.3496039-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h | 176 ++++++++++++++++++------------------
 1 file changed, 88 insertions(+), 88 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 38226d9b8049..a11038574338 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -195,64 +195,56 @@ struct AspeedSoCClass {
 };
 
 enum {
-    ASPEED_DEV_VBOOTROM,
-    ASPEED_DEV_SPI_BOOT,
-    ASPEED_DEV_IOMEM,
-    ASPEED_DEV_IOMEM0,
-    ASPEED_DEV_IOMEM1,
-    ASPEED_DEV_UART0,
-    ASPEED_DEV_UART1,
-    ASPEED_DEV_UART2,
-    ASPEED_DEV_UART3,
-    ASPEED_DEV_UART4,
-    ASPEED_DEV_UART5,
-    ASPEED_DEV_UART6,
-    ASPEED_DEV_UART7,
-    ASPEED_DEV_UART8,
-    ASPEED_DEV_UART9,
-    ASPEED_DEV_UART10,
-    ASPEED_DEV_UART11,
-    ASPEED_DEV_UART12,
-    ASPEED_DEV_UART13,
-    ASPEED_DEV_VUART,
-    ASPEED_DEV_FMC,
-    ASPEED_DEV_SPI0,
-    ASPEED_DEV_SPI1,
-    ASPEED_DEV_SPI2,
+    ASPEED_DEV_ACRY,
+    ASPEED_DEV_ADC,
+    ASPEED_DEV_DP,
+    ASPEED_DEV_DPMCU,
     ASPEED_DEV_EHCI1,
     ASPEED_DEV_EHCI2,
     ASPEED_DEV_EHCI3,
     ASPEED_DEV_EHCI4,
-    ASPEED_DEV_VIC,
-    ASPEED_DEV_INTC,
-    ASPEED_DEV_INTCIO,
-    ASPEED_DEV_SDMC,
-    ASPEED_DEV_SCU,
-    ASPEED_DEV_ADC,
-    ASPEED_DEV_SBC,
+    ASPEED_DEV_EMMC,
     ASPEED_DEV_EMMC_BC,
-    ASPEED_DEV_VIDEO,
-    ASPEED_DEV_SRAM0,
-    ASPEED_DEV_SRAM1,
-    ASPEED_DEV_SDHCI,
+    ASPEED_DEV_ESPI,
+    ASPEED_DEV_ETH1,
+    ASPEED_DEV_ETH2,
+    ASPEED_DEV_ETH3,
+    ASPEED_DEV_ETH4,
+    ASPEED_DEV_FMC,
+    ASPEED_DEV_FSI1,
+    ASPEED_DEV_FSI2,
     ASPEED_DEV_GPIO,
     ASPEED_DEV_GPIO_1_8V,
-    ASPEED_DEV_SGPIOM0,
-    ASPEED_DEV_SGPIOM1,
-    ASPEED_DEV_RTC,
-    ASPEED_DEV_TIMER1,
-    ASPEED_DEV_TIMER2,
-    ASPEED_DEV_TIMER3,
-    ASPEED_DEV_TIMER4,
-    ASPEED_DEV_TIMER5,
-    ASPEED_DEV_TIMER6,
-    ASPEED_DEV_TIMER7,
-    ASPEED_DEV_TIMER8,
-    ASPEED_DEV_WDT,
-    ASPEED_DEV_PWM,
-    ASPEED_DEV_LPC,
-    ASPEED_DEV_IBT,
+    ASPEED_DEV_HACE,
     ASPEED_DEV_I2C,
+    ASPEED_DEV_I3C,
+    ASPEED_DEV_IBT,
+    ASPEED_DEV_INTC,
+    ASPEED_DEV_INTCIO,
+    ASPEED_DEV_IOMEM,
+    ASPEED_DEV_IOMEM0,
+    ASPEED_DEV_IOMEM1,
+    ASPEED_DEV_IOEXP0_I2C,
+    ASPEED_DEV_IOEXP1_I2C,
+    ASPEED_DEV_IOEXP0_I3C,
+    ASPEED_DEV_IOEXP1_I3C,
+    ASPEED_DEV_IOEXP0_INTCIO,
+    ASPEED_DEV_IOEXP1_INTCIO,
+    ASPEED_DEV_IPC0,
+    ASPEED_DEV_IPC1,
+    ASPEED_DEV_JTAG0,
+    ASPEED_DEV_JTAG1,
+    ASPEED_DEV_KCS,
+    ASPEED_DEV_LPC,
+    ASPEED_DEV_LTPI_CTRL1,
+    ASPEED_DEV_LTPI_CTRL2,
+    ASPEED_DEV_LTPI_IO0,
+    ASPEED_DEV_LTPI_IO1,
+    ASPEED_DEV_MII1,
+    ASPEED_DEV_MII2,
+    ASPEED_DEV_MII3,
+    ASPEED_DEV_MII4,
+    ASPEED_DEV_OTP,
     ASPEED_DEV_PCIE0,
     ASPEED_DEV_PCIE1,
     ASPEED_DEV_PCIE2,
@@ -263,49 +255,57 @@ enum {
     ASPEED_DEV_PCIE_MMIO1,
     ASPEED_DEV_PCIE_MMIO2,
     ASPEED_DEV_PECI,
-    ASPEED_DEV_ETH1,
-    ASPEED_DEV_ETH2,
-    ASPEED_DEV_ETH3,
-    ASPEED_DEV_ETH4,
-    ASPEED_DEV_MII1,
-    ASPEED_DEV_MII2,
-    ASPEED_DEV_MII3,
-    ASPEED_DEV_MII4,
-    ASPEED_DEV_SDRAM,
-    ASPEED_DEV_XDMA,
-    ASPEED_DEV_EMMC,
-    ASPEED_DEV_KCS,
-    ASPEED_DEV_HACE,
-    ASPEED_DEV_ACRY,
-    ASPEED_DEV_DPMCU,
-    ASPEED_DEV_DP,
-    ASPEED_DEV_I3C,
-    ASPEED_DEV_ESPI,
-    ASPEED_DEV_UDC,
-    ASPEED_DEV_JTAG0,
-    ASPEED_DEV_JTAG1,
-    ASPEED_DEV_FSI1,
-    ASPEED_DEV_FSI2,
+    ASPEED_DEV_PRIC0,
+    ASPEED_DEV_PRIC1,
+    ASPEED_DEV_PWM,
+    ASPEED_DEV_RTC,
+    ASPEED_DEV_SBC,
+    ASPEED_DEV_SCU,
     ASPEED_DEV_SCUIO,
+    ASPEED_DEV_SDHCI,
+    ASPEED_DEV_SDMC,
+    ASPEED_DEV_SDRAM,
+    ASPEED_DEV_SGPIOM0,
+    ASPEED_DEV_SGPIOM1,
     ASPEED_DEV_SLI,
     ASPEED_DEV_SLIIO,
+    ASPEED_DEV_SPI_BOOT,
+    ASPEED_DEV_SPI0,
+    ASPEED_DEV_SPI1,
+    ASPEED_DEV_SPI2,
+    ASPEED_DEV_SRAM0,
+    ASPEED_DEV_SRAM1,
+    ASPEED_DEV_TIMER1,
+    ASPEED_DEV_TIMER2,
+    ASPEED_DEV_TIMER3,
+    ASPEED_DEV_TIMER4,
+    ASPEED_DEV_TIMER5,
+    ASPEED_DEV_TIMER6,
+    ASPEED_DEV_TIMER7,
+    ASPEED_DEV_TIMER8,
+    ASPEED_DEV_UART0,
+    ASPEED_DEV_UART1,
+    ASPEED_DEV_UART2,
+    ASPEED_DEV_UART3,
+    ASPEED_DEV_UART4,
+    ASPEED_DEV_UART5,
+    ASPEED_DEV_UART6,
+    ASPEED_DEV_UART7,
+    ASPEED_DEV_UART8,
+    ASPEED_DEV_UART9,
+    ASPEED_DEV_UART10,
+    ASPEED_DEV_UART11,
+    ASPEED_DEV_UART12,
+    ASPEED_DEV_UART13,
+    ASPEED_DEV_UDC,
+    ASPEED_DEV_VBOOTROM,
+    ASPEED_DEV_VIC,
+    ASPEED_DEV_VIDEO,
+    ASPEED_DEV_VUART,
+    ASPEED_DEV_WDT,
+    ASPEED_DEV_XDMA,
     ASPEED_GIC_DIST,
     ASPEED_GIC_REDIST,
-    ASPEED_DEV_IPC0,
-    ASPEED_DEV_IPC1,
-    ASPEED_DEV_LTPI_CTRL1,
-    ASPEED_DEV_LTPI_CTRL2,
-    ASPEED_DEV_LTPI_IO0,
-    ASPEED_DEV_LTPI_IO1,
-    ASPEED_DEV_IOEXP0_I2C,
-    ASPEED_DEV_IOEXP1_I2C,
-    ASPEED_DEV_IOEXP0_INTCIO,
-    ASPEED_DEV_IOEXP1_INTCIO,
-    ASPEED_DEV_IOEXP0_I3C,
-    ASPEED_DEV_IOEXP1_I3C,
-    ASPEED_DEV_PRIC0,
-    ASPEED_DEV_PRIC1,
-    ASPEED_DEV_OTP,
 };
 
 const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
-- 
2.56.0

[PULL 07/21] tests/functional/aarch64/test_aspeed_ast2700a2: Add I2C test for IO expander 1

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The IO expander test only checks the I2C bus of IO expander 0. The I2C
buses of IO expander 1 are not tested, so a wrong interrupt wiring for
IO expander 1 can not be detected.

Add a TMP105 device on the first I2C bus of IO expander 1 and check that
it can be read from firmware.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261005020428.3496039-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700a2.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700a2.py b/tests/functional/aarch64/test_aspeed_ast2700a2.py
index 01c7c4fdbe35..74ef93fc0d57 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700a2.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700a2.py
@@ -196,10 +196,13 @@ def test_aarch64_ast2700a2_evb_ioexp_v11_03(self):
         self.vm.set_machine('ast2700a2-evb,fmc-model=w25q512jv')
         self.vm.add_args('-device',
                          'tmp105,bus=ioexp0.0,address=0x4d,id=tmp-test-16')
+        self.vm.add_args('-device',
+                         'tmp105,bus=ioexp1.0,address=0x4d,id=tmp-test-32')
         self.start_ast2700_test('ast2700-dcscm-image', 8)
         self.verify_openbmc_boot_and_login('ast2700-dcscm', False)
         self.do_ast2700_i2c_test(8)
         self.do_ast2700_i2c_test(16)
+        self.do_ast2700_i2c_test(32)
 
 if __name__ == '__main__':
     QemuSystemTest.main()
-- 
2.56.0

[PULL 08/21] MAINTAINERS: Update ASPEED BMCs reviewers

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Update the ASPEED BMCs reviewer list to reflect the current active
reviewers.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20261005015015.3466808-1-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index fc60193aa3fb..1ee661cc23ab 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1265,12 +1265,8 @@ F: tests/functional/arm/test_emcraft_sf2.py
 ASPEED BMCs
 M: Cédric Le Goater <clg@kaod.org>
 M: Peter Maydell <peter.maydell@linaro.org>
-R: Steven Lee <steven_lee@aspeedtech.com>
-R: Troy Lee <leetroy@gmail.com>
 R: Jamin Lin <jamin_lin@aspeedtech.com>
 R: Kane Chen <kane_chen@aspeedtech.com>
-R: Andrew Jeffery <andrew@codeconstruct.com.au>
-R: Joel Stanley <joel@jms.id.au>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/*aspeed*
-- 
2.56.0

[PULL 09/21] hw/misc/unimp: Add create_unimplemented_devices() helper

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Several boards and SoCs create many unimplemented devices. Each of them
uses its own structure and helper to describe and map these devices.

Add an UnimplementedDeviceConfig structure and a
create_unimplemented_devices() helper. The helper creates an
unimplemented device for each entry of a table, adds it as a QOM child
of the parent object, and maps it in a memory region container with
the given priority. The table is terminated by an empty entry.

Suggested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Tested-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/misc/unimp.h | 21 +++++++++++++++++++++
 hw/misc/unimp.c         | 20 ++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/include/hw/misc/unimp.h b/include/hw/misc/unimp.h
index 77a5077511f2..073575159d60 100644
--- a/include/hw/misc/unimp.h
+++ b/include/hw/misc/unimp.h
@@ -25,6 +25,27 @@ struct UnimplementedDeviceState {
     uint64_t size;
 };
 
+typedef struct UnimplementedDeviceConfig {
+    const char *qom_name;
+    const char *region_name;
+    uint64_t offset;
+    uint64_t size;
+    int priority;
+} UnimplementedDeviceConfig;
+
+/**
+ * create_unimplemented_devices:
+ * @parentobj: the parent object
+ * @container: a #MemoryRegion within which @addr is a relative address
+ * @devconfigs: NULL terminated array of #UnimplementedDeviceConfig
+ *
+ * For each entries in @devconfigs, create a TYPE_UNIMPLEMENTED_DEVICE
+ * and mmap it in @container at UnimplementedDeviceConfig::offset.
+ * @container is expected to be a QOM child of @parentobj.
+ */
+void create_unimplemented_devices(Object *parentobj, MemoryRegion *container,
+                                  const UnimplementedDeviceConfig *devconfigs);
+
 /**
  * create_unimplemented_device: create and map a dummy device
  * @name: name of the device for debug logging
diff --git a/hw/misc/unimp.c b/hw/misc/unimp.c
index 521b84bf20bf..4c8dcbdff336 100644
--- a/hw/misc/unimp.c
+++ b/hw/misc/unimp.c
@@ -96,3 +96,23 @@ static void unimp_register_types(void)
 }
 
 type_init(unimp_register_types)
+
+void create_unimplemented_devices(Object *parentobj, MemoryRegion *container,
+                                  const UnimplementedDeviceConfig *devconfigs)
+{
+    const UnimplementedDeviceConfig *cfg;
+
+    for (cfg = devconfigs; cfg->qom_name; cfg++) {
+        DeviceState *dev = qdev_new(TYPE_UNIMPLEMENTED_DEVICE);
+        SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+        object_property_add_child(parentobj, cfg->qom_name, OBJECT(dev));
+        qdev_prop_set_string(dev, "name", cfg->region_name);
+        qdev_prop_set_uint64(dev, "size", cfg->size);
+        sysbus_realize_and_unref(sbd, &error_fatal);
+
+        memory_region_add_subregion_overlap(container, cfg->offset,
+                                            sysbus_mmio_get_region(sbd, 0),
+                                            cfg->priority);
+    }
+}
-- 
2.56.0

[PULL 10/21] hw/arm/aspeed_ast2400: Use a table for unimplemented devices

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Before this change, each unimplemented device needed its own field in
AspeedSoCState. This made the variable names confusing. For example,
AspeedSoCState has "udc" as an unimplemented device, but
Aspeed2600SoCState also has "udc" as the real UDC model.

Add an unimp_devs table in AspeedSoCClass to describe the unimplemented
devices, and use create_unimplemented_devices() to create and map them.
This makes the code easier to maintain and read. Convert AST2400/AST2500
to use them.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h |  1 +
 hw/arm/aspeed_ast2400.c     | 25 ++++++++++---------------
 2 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index a11038574338..82e394f08539 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -190,6 +190,7 @@ struct AspeedSoCClass {
     int ioexp_num;
     const int *irqmap;
     const hwaddr *memmap;
+    const UnimplementedDeviceConfig *unimp_devs;
     uint32_t num_cpus;
     bool (*boot_from_emmc)(AspeedSoCState *s);
 };
diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/aspeed_ast2400.c
index 79a653f65f09..fa2782da6180 100644
--- a/hw/arm/aspeed_ast2400.c
+++ b/hw/arm/aspeed_ast2400.c
@@ -23,8 +23,6 @@
 #include "system/system.h"
 #include "target/arm/cpu-qom.h"
 
-#define ASPEED_SOC_IOMEM_SIZE       0x00200000
-
 static const hwaddr aspeed_soc_ast2400_memmap[] = {
     [ASPEED_DEV_SPI_BOOT]  = 0x00000000,
     [ASPEED_DEV_IOMEM]  = 0x1E600000,
@@ -134,6 +132,12 @@ static const int aspeed_soc_ast2400_irqmap[] = {
 
 #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
 
+static const UnimplementedDeviceConfig aspeed_soc_ast2400_unimp_devs[] = {
+    { "iomem", "aspeed.io", 0x1E600000, 0x00200000, -1000 },
+    { "video", "aspeed.video", 0x1E700000, 0x1000, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast2400_get_irq(AspeedSoCState *s, int dev)
 {
     Aspeed2400SoCState *a = ASPEED2400_SOC(s);
@@ -239,9 +243,6 @@ static void aspeed_ast2400_soc_init(Object *obj)
 
     snprintf(typename, sizeof(typename), "aspeed.hace-%s", socname);
     object_initialize_child(obj, "hace", &s->hace, typename);
-
-    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
@@ -259,16 +260,8 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
                                 &s->spi_boot_container);
 
-    /* IO space */
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
-                                  "aspeed.io",
-                                  sc->memmap[ASPEED_DEV_IOMEM],
-                                  ASPEED_SOC_IOMEM_SIZE);
-
-    /* Video engine stub */
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->video),
-                                  "aspeed.video",
-                                  sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 
     /* CPU */
     for (i = 0; i < sc->num_cpus; i++) {
@@ -542,6 +535,7 @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, const void *data)
     sc->uarts_base   = ASPEED_DEV_UART1;
     sc->irqmap       = aspeed_soc_ast2400_irqmap;
     sc->memmap       = aspeed_soc_ast2400_memmap;
+    sc->unimp_devs   = aspeed_soc_ast2400_unimp_devs;
     sc->num_cpus     = 1;
 }
 
@@ -569,6 +563,7 @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, const void *data)
     sc->uarts_base   = ASPEED_DEV_UART1;
     sc->irqmap       = aspeed_soc_ast2500_irqmap;
     sc->memmap       = aspeed_soc_ast2500_memmap;
+    sc->unimp_devs   = aspeed_soc_ast2400_unimp_devs;
     sc->num_cpus     = 1;
 }
 
-- 
2.56.0

[PULL 11/21] hw/arm/aspeed_ast2600: Use a table for unimplemented devices

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Before this change, each unimplemented device needed its own field in
AspeedSoCState. This made the variable names confusing. For example,
AspeedSoCState has "udc" as an unimplemented device, but
Aspeed2600SoCState also has "udc" as the real UDC model.

Use the unimp_devs table in AspeedSoCClass to describe the
unimplemented devices, and use create_unimplemented_devices() to create
and map them. This makes the code easier to maintain and read. Convert
AST2600 to use them.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast2600.c | 44 +++++++++++------------------------------
 1 file changed, 12 insertions(+), 32 deletions(-)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 1a10d0fe1ecc..ebaf07d3128a 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -19,9 +19,6 @@
 #include "system/system.h"
 #include "target/arm/cpu-qom.h"
 
-#define ASPEED_SOC_IOMEM_SIZE       0x00200000
-#define ASPEED_SOC_DPMCU_SIZE       0x00040000
-
 static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_DEV_SPI_BOOT]  = 0x00000000,
     [ASPEED_DEV_SRAM0]     = 0x10000000,
@@ -149,6 +146,15 @@ static const int aspeed_soc_ast2600_irqmap[] = {
     [ASPEED_DEV_ACRY]      = 160,
 };
 
+static const UnimplementedDeviceConfig aspeed_soc_ast2600_unimp_devs[] = {
+    { "iomem", "aspeed.io", 0x1E600000, 0x00200000, -1000 },
+    { "video", "aspeed.video", 0x1E700000, 0x1000, -1000 },
+    { "dpmcu", "aspeed.dpmcu", 0x18000000, 0x00040000, -1000 },
+    { "emmc-boot-controller", "aspeed.emmc-boot-controller",
+      0x1E6F5000, 0x1000, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast2600_get_irq(AspeedSoCState *s, int dev)
 {
     Aspeed2600SoCState *a = ASPEED2600_SOC(s);
@@ -282,13 +288,6 @@ static void aspeed_soc_ast2600_init(Object *obj)
 
     object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_AST2600_SBC);
 
-    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "dpmcu", &s->dpmcu, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "emmc-boot-controller",
-                            &s->emmc_boot_controller,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-
     for (i = 0; i < ASPEED_FSI_NUM; i++) {
         object_initialize_child(obj, "fsi[*]", &s->fsi[i], TYPE_ASPEED_APB2OPB);
     }
@@ -382,22 +381,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SPI_BOOT],
                                 &s->spi_boot_container);
 
-    /* IO space */
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
-                                  "aspeed.io",
-                                  sc->memmap[ASPEED_DEV_IOMEM],
-                                  ASPEED_SOC_IOMEM_SIZE);
-
-    /* Video engine stub */
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->video),
-                                  "aspeed.video",
-                                  sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
-
-    /* eMMC Boot Controller stub */
-    aspeed_mmio_map_unimplemented(s->memory,
-                                  SYS_BUS_DEVICE(&s->emmc_boot_controller),
-                                  "aspeed.emmc-boot-controller",
-                                  sc->memmap[ASPEED_DEV_EMMC_BC], 0x1000);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 
     /* CPU */
     for (i = 0; i < sc->num_cpus; i++) {
@@ -469,12 +454,6 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SRAM1],
                                 &s->sram_container[1]);
 
-    /* DPMCU */
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->dpmcu),
-                                  "aspeed.dpmcu",
-                                  sc->memmap[ASPEED_DEV_DPMCU],
-                                  ASPEED_SOC_DPMCU_SIZE);
-
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
@@ -838,6 +817,7 @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, const void *data)
     sc->uarts_base   = ASPEED_DEV_UART1;
     sc->irqmap       = aspeed_soc_ast2600_irqmap;
     sc->memmap       = aspeed_soc_ast2600_memmap;
+    sc->unimp_devs   = aspeed_soc_ast2600_unimp_devs;
     sc->num_cpus     = 2;
     sc->boot_from_emmc = aspeed_soc_ast2600_boot_from_emmc;
 }
-- 
2.56.0

[PULL 12/21] hw/arm/aspeed_ast27x0: Use a table for unimplemented devices

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Before this change, each unimplemented device needed its own field in
AspeedSoCState. This made the variable names confusing. For example,
AspeedSoCState has "udc" as an unimplemented device, but
Aspeed2600SoCState also has "udc" as the real UDC model.

Use the unimp_devs table in AspeedSoCClass to describe the
unimplemented devices, and use create_unimplemented_devices() to create
and map them. This makes the code easier to maintain and read. Convert
AST2700 to use them.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 41 ++++++++++++-----------------------------
 1 file changed, 12 insertions(+), 29 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 6365dbd638b5..2ef29e31e9a5 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -24,10 +24,6 @@
 #include "qobject/qlist.h"
 #include "qemu/log.h"
 
-#define AST2700_SOC_IO_SIZE          0x00FE0000
-#define AST2700_SOC_IOMEM_SIZE       0x01000000
-#define AST2700_SOC_DPMCU_SIZE       0x00040000
-
 static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_VBOOTROM]  =  0x00000000,
     [ASPEED_DEV_IOMEM]     =  0x00020000,
@@ -263,6 +259,14 @@ static const struct gic_intc_irq_info ast2700_gic_intcmap[] = {
     {201, 3, 1, ast2700_gic201_intcmap},
 };
 
+static const UnimplementedDeviceConfig aspeed_soc_ast2700_unimp_devs[] = {
+    { "dpmcu", "aspeed.dpmcu", 0x11000000, 0x00040000, -1000 },
+    { "iomem", "aspeed.io", 0x00020000, 0x00FE0000, -1000 },
+    { "iomem0", "aspeed.iomem0", 0x12000000, 0x01000000, -1000 },
+    { "iomem1", "aspeed.iomem1", 0x14000000, 0x01000000, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast2700_get_irq(AspeedSoCState *s, int dev)
 {
     Aspeed27x0SoCState *a = ASPEED27X0_SOC(s);
@@ -558,15 +562,6 @@ static void aspeed_soc_ast2700_init(Object *obj)
         qdev_prop_set_uint32(DEVICE(&s->ioexp[i]), "silicon-rev",
                              sc->silicon_rev);
     }
-
-    object_initialize_child(obj, "dpmcu", &s->dpmcu,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "iomem", &s->iomem,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "iomem0", &s->iomem0,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "iomem1", &s->iomem1,
-                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 /*
@@ -1137,22 +1132,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->dpmcu),
-                                  "aspeed.dpmcu",
-                                  sc->memmap[ASPEED_DEV_DPMCU],
-                                  AST2700_SOC_DPMCU_SIZE);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
-                                  "aspeed.io",
-                                  sc->memmap[ASPEED_DEV_IOMEM],
-                                  AST2700_SOC_IO_SIZE);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem0),
-                                  "aspeed.iomem0",
-                                  sc->memmap[ASPEED_DEV_IOMEM0],
-                                  AST2700_SOC_IOMEM_SIZE);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem1),
-                                  "aspeed.iomem1",
-                                  sc->memmap[ASPEED_DEV_IOMEM1],
-                                  AST2700_SOC_IOMEM_SIZE);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 }
 
 static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, const void *data)
@@ -1183,6 +1164,7 @@ static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, const void *data)
     sc->uarts_base   = ASPEED_DEV_UART0;
     sc->irqmap       = aspeed_soc_ast2700a1_irqmap;
     sc->memmap       = aspeed_soc_ast2700_memmap;
+    sc->unimp_devs   = aspeed_soc_ast2700_unimp_devs;
 }
 
 static void aspeed_soc_ast2700a2_class_init(ObjectClass *oc, const void *data)
@@ -1213,6 +1195,7 @@ static void aspeed_soc_ast2700a2_class_init(ObjectClass *oc, const void *data)
     sc->uarts_base   = ASPEED_DEV_UART0;
     sc->irqmap       = aspeed_soc_ast2700a1_irqmap;
     sc->memmap       = aspeed_soc_ast2700_memmap;
+    sc->unimp_devs   = aspeed_soc_ast2700_unimp_devs;
 }
 
 static const TypeInfo aspeed_soc_ast27x0_types[] = {
-- 
2.56.0

[PULL 13/21] hw/arm/aspeed_ast10x0: Use a table for unimplemented devices

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Before this change, each unimplemented device needed its own field in
AspeedSoCState. This made the variable names confusing. For example,
AspeedSoCState has "udc" as an unimplemented device, but
Aspeed2600SoCState also has "udc" as the real UDC model.

Use the unimp_devs table in AspeedSoCClass to describe the
unimplemented devices, and use create_unimplemented_devices() to create
and map them. This makes the code easier to maintain and read. Convert
AST1030/AST1060 to use them.

This also fixes a type mismatch. AST10x0 used the "pwm" field
(AspeedPWMState) and the "sgpiom" field (AspeedSGPIOState array) to
create unimplemented devices. They are not used for that anymore.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c | 55 +++++++++++------------------------------
 1 file changed, 15 insertions(+), 40 deletions(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index aeb5a4423dd3..07908597351a 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -17,8 +17,6 @@
 #include "hw/misc/unimp.h"
 #include "hw/arm/aspeed_soc.h"
 
-#define ASPEED_SOC_IOMEM_SIZE 0x00200000
-
 static const hwaddr aspeed_soc_ast1030_memmap[] = {
     [ASPEED_DEV_SRAM0]     = 0x00000000,
     [ASPEED_DEV_SRAM1]     = 0x79000000, /* SEC SRAM */
@@ -99,6 +97,17 @@ static const int aspeed_soc_ast1030_irqmap[] = {
     [ASPEED_DEV_JTAG1]     = 53,
 };
 
+static const UnimplementedDeviceConfig aspeed_soc_ast10x0_unimp_devs[] = {
+    { "iomem", "aspeed.io", 0x7E600000, 0x00200000, -1000 },
+    { "pwm", "aspeed.pwm", 0x7E610000, 0x100, -1000 },
+    { "espi", "aspeed.espi", 0x7E6EE000, 0x800, -1000 },
+    { "udc", "aspeed.udc", 0x7E6A2000, 0x1000, -1000 },
+    { "sgpiom", "aspeed.sgpiom", 0x7E780500, 0x100, -1000 },
+    { "jtag[0]", "aspeed.jtag0", 0x7E6E4000, 0x20, -1000 },
+    { "jtag[1]", "aspeed.jtag1", 0x7E6E4100, 0x20, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast1030_get_irq(AspeedSoCState *s, int dev)
 {
     Aspeed10x0SoCState *a = ASPEED10X0_SOC(s);
@@ -161,17 +170,6 @@ static void aspeed_soc_ast10x0_init(Object *obj, const char *socname)
 
     snprintf(typename, sizeof(typename), "aspeed.hace-%s", socname);
     object_initialize_child(obj, "hace", &s->hace, typename);
-
-    object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "pwm", &s->pwm, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "espi", &s->espi, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "udc", &s->udc, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "sgpiom", &s->sgpiom,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "jtag[0]", &s->jtag[0],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "jtag[1]", &s->jtag[1],
-                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 static void aspeed_soc_ast1030_init(Object *obj)
@@ -215,11 +213,8 @@ static bool aspeed_soc_ast10x0_realize(Aspeed10x0SoCState *a, Error **errp)
         return false;
     }
 
-    /* General I/O memory space to catch all unimplemented device */
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
-                                  "aspeed.io",
-                                  sc->memmap[ASPEED_DEV_IOMEM],
-                                  ASPEED_SOC_IOMEM_SIZE);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
     /* AST10x0 CPU Core */
     armv7m = DEVICE(&a->armv7m);
     qdev_prop_set_uint32(armv7m, "num-irq", 256);
@@ -394,28 +389,6 @@ static bool aspeed_soc_ast10x0_realize(Aspeed10x0SoCState *a, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_GPIO));
 
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->pwm),
-                                  "aspeed.pwm",
-                                  sc->memmap[ASPEED_DEV_PWM], 0x100);
-
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->espi),
-                                  "aspeed.espi",
-                                  sc->memmap[ASPEED_DEV_ESPI], 0x800);
-
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->udc),
-                                  "aspeed.udc",
-                                  sc->memmap[ASPEED_DEV_UDC], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->sgpiom),
-                                  "aspeed.sgpiom",
-                                  sc->memmap[ASPEED_DEV_SGPIOM0], 0x100);
-
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->jtag[0]),
-                                  "aspeed.jtag",
-                                  sc->memmap[ASPEED_DEV_JTAG0], 0x20);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->jtag[1]),
-                                  "aspeed.jtag",
-                                  sc->memmap[ASPEED_DEV_JTAG1], 0x20);
-
     return true;
 }
 
@@ -503,6 +476,7 @@ static void aspeed_soc_ast1030_class_init(ObjectClass *klass, const void *data)
     sc->uarts_base = ASPEED_DEV_UART1;
     sc->irqmap = aspeed_soc_ast1030_irqmap;
     sc->memmap = aspeed_soc_ast1030_memmap;
+    sc->unimp_devs = aspeed_soc_ast10x0_unimp_devs;
     sc->num_cpus = 1;
 }
 
@@ -529,6 +503,7 @@ static void aspeed_soc_ast1060_class_init(ObjectClass *klass, const void *data)
     sc->uarts_base = ASPEED_DEV_UART5;
     sc->irqmap = aspeed_soc_ast1030_irqmap;
     sc->memmap = aspeed_soc_ast1030_memmap;
+    sc->unimp_devs = aspeed_soc_ast10x0_unimp_devs;
     sc->num_cpus = 1;
 }
 
-- 
2.56.0

[PULL 14/21] hw/arm/aspeed_ast1040: Use a table for unimplemented devices

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Before this change, each unimplemented device needed its own field in
AspeedSoCState. This made the variable names confusing. For example,
AspeedSoCState has "udc" as an unimplemented device, but
Aspeed2600SoCState also has "udc" as the real UDC model.

Use the unimp_devs table in AspeedSoCClass to describe the
unimplemented devices, and use create_unimplemented_devices() to create
and map them. This makes the code easier to maintain and read. Convert
AST1040 to use them.

This also fixes a type mismatch. AST1040 used the "pwm" field
(AspeedPWMState) to create an unimplemented device. It is not used for
that anymore.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 40 ++++++++++++----------------------------
 1 file changed, 12 insertions(+), 28 deletions(-)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 57ffc0807ab7..0b078f10c403 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -81,6 +81,15 @@ static const int aspeed_soc_ast1040_irqmap[] = {
     [ASPEED_DEV_PECI]      = 164,
 };
 
+static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
+    { "pwm", "aspeed.pwm", 0x740C0000, 0x10000, -1000 },
+    { "espi", "aspeed.espi", 0x74C05000, 0x1000, -1000 },
+    { "udc", "aspeed.udc", 0x74120000, 0x4000, -1000 },
+    { "jtag[0]", "aspeed.jtag0", 0x74C01000, 0x100, -1000 },
+    { "jtag[1]", "aspeed.jtag1", 0x74C09000, 0x100, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast1040_get_irq(AspeedSoCState *s, int dev)
 {
     Aspeed10x0SoCState *a = ASPEED10X0_SOC(s);
@@ -123,14 +132,6 @@ static void aspeed_soc_ast1040_init(Object *obj)
         object_initialize_child(obj, "wdt[*]", &s->wdt[i],
                                 "aspeed.wdt-ast2700");
     }
-
-    object_initialize_child(obj, "pwm", &s->pwm, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "espi", &s->espi, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "udc", &s->udc, TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "jtag[0]", &s->jtag[0],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "jtag[1]", &s->jtag[1],
-                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
@@ -267,26 +268,8 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
 
-    /* Unimplemented peripherals */
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->pwm),
-                                  "aspeed.pwm",
-                                  sc->memmap[ASPEED_DEV_PWM], 0x10000);
-
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->espi),
-                                  "aspeed.espi",
-                                  sc->memmap[ASPEED_DEV_ESPI], 0x1000);
-
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->udc),
-                                  "aspeed.udc",
-                                  sc->memmap[ASPEED_DEV_UDC], 0x4000);
-
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->jtag[0]),
-                                  "aspeed.jtag0",
-                                  sc->memmap[ASPEED_DEV_JTAG0], 0x100);
-
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->jtag[1]),
-                                  "aspeed.jtag1",
-                                  sc->memmap[ASPEED_DEV_JTAG1], 0x100);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 }
 
 static void aspeed_soc_ast1040_class_init(ObjectClass *klass, const void *data)
@@ -312,6 +295,7 @@ static void aspeed_soc_ast1040_class_init(ObjectClass *klass, const void *data)
     sc->uarts_base      = ASPEED_DEV_UART0;
     sc->irqmap          = aspeed_soc_ast1040_irqmap;
     sc->memmap          = aspeed_soc_ast1040_memmap;
+    sc->unimp_devs      = aspeed_soc_ast1040_unimp_devs;
     sc->num_cpus        = 1;
 }
 
-- 
2.56.0

[PULL 15/21] hw/arm/aspeed: Remove unused unimplemented device fields

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

All Aspeed SoCs now use the unimp_devs table and
create_unimplemented_devices() for their unimplemented devices. Remove
the old fields in AspeedSoCState and the ASPEED_JTAG_NUM define, which
are not used anymore.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 82e394f08539..b47ac5aa05b5 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -59,7 +59,6 @@
 #define ASPEED_CPUS_NUM  4
 #define ASPEED_MACS_NUM  4
 #define ASPEED_UARTS_NUM 13
-#define ASPEED_JTAG_NUM  2
 #define ASPEED_PCIE_NUM  3
 #define ASPEED_INTC_NUM  2
 #define ASPEED_IOEXP_NUM 2
@@ -110,15 +109,6 @@ struct AspeedSoCState {
     AspeedPECIState peci;
     SerialMM uart[ASPEED_UARTS_NUM];
     Clock *sysclk;
-    UnimplementedDeviceState iomem;
-    UnimplementedDeviceState iomem0;
-    UnimplementedDeviceState iomem1;
-    UnimplementedDeviceState video;
-    UnimplementedDeviceState emmc_boot_controller;
-    UnimplementedDeviceState dpmcu;
-    UnimplementedDeviceState espi;
-    UnimplementedDeviceState udc;
-    UnimplementedDeviceState jtag[ASPEED_JTAG_NUM];
     AspeedAPB2OPBState fsi[2];
     AspeedLTPIState ltpi_ctrl[ASPEED_IOEXP_NUM];
     AspeedAST1700SoCState ioexp[ASPEED_IOEXP_NUM];
-- 
2.56.0

[PULL 16/21] hw/arm/aspeed_ast27x0: Use a table for unimplemented devices for SSP/TSP

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Before this change, each unimplemented device needed its own field in
the coprocessor state. This made the code hard to maintain.

Add an unimp_devs table in AspeedCoprocessorClass to describe the
unimplemented devices, and use create_unimplemented_devices() to create
and map them. This makes the code easier to maintain and read. Convert
AST2700 SSP and TSP to use them.

This also fixes a type mismatch. SSP and TSP used the "timerctrl"
field (AspeedTimerCtrlState) to create an unimplemented device. It is
not used for that anymore.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_coprocessor.h |  1 +
 hw/arm/aspeed_ast27x0-ssp.c         | 44 +++++++++--------------------
 hw/arm/aspeed_ast27x0-tsp.c         | 44 +++++++++--------------------
 3 files changed, 27 insertions(+), 62 deletions(-)

diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index acb8b0645777..39209d2579f7 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -37,6 +37,7 @@ struct AspeedCoprocessorClass {
     /** valid_cpu_types: NULL terminated array of a single CPU type. */
     const char * const *valid_cpu_types;
     const hwaddr *memmap;
+    const UnimplementedDeviceConfig *unimp_devs;
     const int *irqmap;
 };
 
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index e03653086c88..0238dc36725f 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -101,6 +101,16 @@ static struct nvic_intc_irq_info ast2700_ssp_intcmap[] = {
     {169, 1, 9, NULL},
 };
 
+static const UnimplementedDeviceConfig aspeed_soc_ast27x0ssp_unimp_devs[] = {
+    { "timerctrl", "aspeed.timerctrl", 0x72C10000, 0x200, -1000 },
+    { "ipc0", "aspeed.ipc0", 0x72C1C000, 0x1000, -1000 },
+    { "ipc1", "aspeed.ipc1", 0x74C39000, 0x1000, -1000 },
+    { "pric0", "aspeed.pric0", 0x72140000, 0x1000, -1000 },
+    { "pric1", "aspeed.pric1", 0x74100000, 0x1000, -1000 },
+    { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedCoprocessorState *s,
                                               int dev)
 {
@@ -136,19 +146,6 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
                             TYPE_ASPEED_2700SSP_INTC);
     object_initialize_child(obj, "intc1", &a->intc[1],
                             TYPE_ASPEED_2700SSP_INTCIO);
-
-    object_initialize_child(obj, "timerctrl", &s->timerctrl,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "ipc0", &a->ipc[0],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "ipc1", &a->ipc[1],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "pric0", &a->pric[0],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "pric1", &a->pric[1],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "otp", &a->otp,
-                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
@@ -283,24 +280,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
     memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_FMC],
                                 &a->fmc_alias);
 
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
-                                  "aspeed.timerctrl",
-                                  sc->memmap[ASPEED_DEV_TIMER1], 0x200);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[0]),
-                                  "aspeed.ipc0",
-                                  sc->memmap[ASPEED_DEV_IPC0], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
-                                  "aspeed.ipc1",
-                                  sc->memmap[ASPEED_DEV_IPC1], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
-                                  "aspeed.pric0",
-                                  sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
-                                  "aspeed.pric1",
-                                  sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->otp),
-                                  "aspeed.otp",
-                                  sc->memmap[ASPEED_DEV_OTP], 0x800);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 }
 
 static const Property aspeed_27x0_coprocessor_properties[] = {
@@ -330,6 +311,7 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
     sc->valid_cpu_types = valid_cpu_types;
     sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
     sc->memmap = aspeed_soc_ast27x0ssp_memmap;
+    sc->unimp_devs = aspeed_soc_ast27x0ssp_unimp_devs;
 }
 
 static const TypeInfo aspeed_soc_ast27x0ssp_types[] = {
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 39ba062a20f7..7f057ff1357d 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -101,6 +101,16 @@ static struct nvic_intc_irq_info ast2700_tsp_intcmap[] = {
     {169, 1, 9, NULL},
 };
 
+static const UnimplementedDeviceConfig aspeed_soc_ast27x0tsp_unimp_devs[] = {
+    { "timerctrl", "aspeed.timerctrl", 0x72C10000, 0x200, -1000 },
+    { "ipc0", "aspeed.ipc0", 0x72C1C000, 0x1000, -1000 },
+    { "ipc1", "aspeed.ipc1", 0x74C39000, 0x1000, -1000 },
+    { "pric0", "aspeed.pric0", 0x72140000, 0x1000, -1000 },
+    { "pric1", "aspeed.pric1", 0x74100000, 0x1000, -1000 },
+    { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedCoprocessorState *s,
                                               int dev)
 {
@@ -136,19 +146,6 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
                             TYPE_ASPEED_2700TSP_INTC);
     object_initialize_child(obj, "intc1", &a->intc[1],
                             TYPE_ASPEED_2700TSP_INTCIO);
-
-    object_initialize_child(obj, "timerctrl", &s->timerctrl,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "ipc0", &a->ipc[0],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "ipc1", &a->ipc[1],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "pric0", &a->pric[0],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "pric1", &a->pric[1],
-                            TYPE_UNIMPLEMENTED_DEVICE);
-    object_initialize_child(obj, "otp", &a->otp,
-                            TYPE_UNIMPLEMENTED_DEVICE);
 }
 
 static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
@@ -283,24 +280,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
     memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_FMC],
                                 &a->fmc_alias);
 
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
-                                  "aspeed.timerctrl",
-                                  sc->memmap[ASPEED_DEV_TIMER1], 0x200);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[0]),
-                                  "aspeed.ipc0",
-                                  sc->memmap[ASPEED_DEV_IPC0], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
-                                  "aspeed.ipc1",
-                                  sc->memmap[ASPEED_DEV_IPC1], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
-                                  "aspeed.pric0",
-                                  sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
-                                  "aspeed.pric1",
-                                  sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
-    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->otp),
-                                  "aspeed.otp",
-                                  sc->memmap[ASPEED_DEV_OTP], 0x800);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 }
 
 static const Property aspeed_27x0_coprocessor_properties[] = {
@@ -330,6 +311,7 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
     sc->valid_cpu_types = valid_cpu_types;
     sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
     sc->memmap = aspeed_soc_ast27x0tsp_memmap;
+    sc->unimp_devs = aspeed_soc_ast27x0tsp_unimp_devs;
 }
 
 static const TypeInfo aspeed_soc_ast27x0tsp_types[] = {
-- 
2.56.0

[PULL 17/21] hw/arm/aspeed_coprocessor: Remove unused unimplemented device fields

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

AST2700 SSP and TSP now use the unimp_devs table and
create_unimplemented_devices() for their unimplemented devices. Remove
the old "ipc", "pric" and "otp" fields in Aspeed27x0CoprocessorState
and the "timerctrl" field in AspeedCoprocessorState, which are not used
anymore.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_coprocessor.h | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 39209d2579f7..b0d72f916383 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -22,7 +22,6 @@ struct AspeedCoprocessorState {
     MemoryRegion uart_alias;
     Clock *sysclk;
 
-    AspeedTimerCtrlState timerctrl;
     SerialMM *uart;
     int uart_dev;
 };
@@ -44,9 +43,6 @@ struct AspeedCoprocessorClass {
 struct Aspeed27x0CoprocessorState {
     AspeedCoprocessorState parent;
     AspeedINTCState intc[2];
-    UnimplementedDeviceState ipc[2];
-    UnimplementedDeviceState pric[2];
-    UnimplementedDeviceState otp;
 
     ARMv7MState armv7m;
 
-- 
2.56.0

[PULL 18/21] hw/arm/aspeed_ast1700: Use a table for unimplemented devices

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Before this change, the I3C unimplemented device of AST1700 needed its
own field in AspeedAST1700SoCState and was created and mapped with
open-coded calls.

Describe it in a table and use create_unimplemented_devices() to create
and map it in the AST1700 memory region. This makes the code easier to
maintain and read.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-11-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1700.c | 21 ++++++++-------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/hw/arm/aspeed_ast1700.c b/hw/arm/aspeed_ast1700.c
index 5af5da5b8a73..e5d5bf405623 100644
--- a/hw/arm/aspeed_ast1700.c
+++ b/hw/arm/aspeed_ast1700.c
@@ -15,7 +15,6 @@
 
 #define AST2700_SOC_LTPI_SIZE        0x01000000
 #define AST1700_SOC_SRAM_SIZE        0x00040000
-#define AST1700_SOC_I3C_SIZE         0x00010000
 
 enum {
     ASPEED_AST1700_DEV_SPI0,
@@ -51,6 +50,11 @@ static const hwaddr aspeed_ast1700_io_memmap[] = {
     [ASPEED_AST1700_DEV_SPI0_MEM]  =  0x04000000,
 };
 
+static const UnimplementedDeviceConfig aspeed_ast1700_unimp_devs[] = {
+    { "ioexp-i3c", "ioexp-i3c", 0x00C20000, 0x00010000, -1000 },
+    { }
+};
+
 static void aspeed_ast1700_realize(DeviceState *dev, Error **errp)
 {
     AspeedAST1700SoCState *s = ASPEED_AST1700(dev);
@@ -181,14 +185,9 @@ static void aspeed_ast1700_realize(DeviceState *dev, Error **errp)
                         sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->wdt[i]), 0));
     }
 
-    /* I3C */
-    qdev_prop_set_string(DEVICE(&s->i3c), "name", "ioexp-i3c");
-    qdev_prop_set_uint64(DEVICE(&s->i3c), "size", AST1700_SOC_I3C_SIZE);
-    sysbus_realize(SYS_BUS_DEVICE(&s->i3c), errp);
-    memory_region_add_subregion_overlap(&s->iomem,
-                        aspeed_ast1700_io_memmap[ASPEED_AST1700_DEV_I3C],
-                        sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->i3c), 0),
-                        -1000);
+    /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), &s->iomem,
+                                 aspeed_ast1700_unimp_devs);
 }
 
 static void aspeed_ast1700_instance_init(Object *obj)
@@ -238,10 +237,6 @@ static void aspeed_ast1700_instance_init(Object *obj)
                                 &s->wdt[i], "aspeed.wdt-ast2700");
     }
 
-    /* I3C */
-    object_initialize_child(obj, "ioexp-i3c", &s->i3c,
-                            TYPE_UNIMPLEMENTED_DEVICE);
-
     return;
 }
 
-- 
2.56.0

[PULL 19/21] hw/arm/aspeed_ast1700: Remove unused unimplemented device field

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

AST1700 now uses create_unimplemented_devices() for its unimplemented
devices. Remove the old "i3c" field in AspeedAST1700SoCState, which is
not used anymore.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-12-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_ast1700.h | 2 --
 1 file changed, 2 deletions(-)

diff --git a/include/hw/arm/aspeed_ast1700.h b/include/hw/arm/aspeed_ast1700.h
index 39c5977cf109..d30483c88a69 100644
--- a/include/hw/arm/aspeed_ast1700.h
+++ b/include/hw/arm/aspeed_ast1700.h
@@ -47,8 +47,6 @@ struct AspeedAST1700SoCState {
     AspeedI2CState i2c;
     AspeedPWMState pwm;
     AspeedWDTState wdt[AST1700_WDT_NUM];
-
-    UnimplementedDeviceState i3c;
 };
 
 #endif /* ASPEED_AST1700_H */
-- 
2.56.0

[PULL 20/21] hw/arm/aspeed: Remove unused aspeed_mmio_map_unimplemented()

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

All Aspeed SoCs now use create_unimplemented_devices() to create and
map their unimplemented devices. Remove aspeed_mmio_map_unimplemented(),
which is not used anymore.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261012064445.2571633-13-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h |  3 ---
 hw/arm/aspeed_soc_common.c  | 11 -----------
 2 files changed, 14 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index b47ac5aa05b5..338496a4210a 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -307,9 +307,6 @@ void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
 void aspeed_mmio_map(MemoryRegion *memory, SysBusDevice *dev, int n,
                      hwaddr addr);
-void aspeed_mmio_map_unimplemented(MemoryRegion *memory, SysBusDevice *dev,
-                                   const char *name, hwaddr addr,
-                                   uint64_t size);
 void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                unsigned int count, int unit0);
 void aspeed_write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index fd08793575ab..54a128c96591 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -104,17 +104,6 @@ void aspeed_mmio_map(MemoryRegion *memory, SysBusDevice *dev, int n,
     memory_region_add_subregion(memory, addr, sysbus_mmio_get_region(dev, n));
 }
 
-void aspeed_mmio_map_unimplemented(MemoryRegion *memory, SysBusDevice *dev,
-                                   const char *name, hwaddr addr, uint64_t size)
-{
-    qdev_prop_set_string(DEVICE(dev), "name", name);
-    qdev_prop_set_uint64(DEVICE(dev), "size", size);
-    sysbus_realize(dev, &error_abort);
-
-    memory_region_add_subregion_overlap(memory, addr,
-                                        sysbus_mmio_get_region(dev, 0), -1000);
-}
-
 void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                unsigned int count, int unit0)
 {
-- 
2.56.0

[PULL 21/21] tests/functional: give the set_machine probe VM the test workdir

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

set_machine() launches a throwaway QEMUMachine to query the available
machine types, but constructs it without base_temp_dir, so it falls back
to the hardcoded "/var/tmp" default instead of the writable per-test
workdir that the actual test VM already uses. Pass base_temp_dir=
self.workdir for consistency; this also fixes VM launch on hosts where
/var/tmp is not writable.

Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260731-sanmiguel-bmc-locator-v2-17-1266926ba769@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index bf2dc1dc101c..d4aee359517d 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -317,7 +317,7 @@ def set_machine(self, machinename):
         cls = type(self)
 
         if not hasattr(cls, "_machines"):
-            tmp_vm = QEMUMachine(self.qemu_bin)
+            tmp_vm = QEMUMachine(self.qemu_bin, base_temp_dir=self.workdir)
             tmp_vm.set_machine('none')
 
             try:
-- 
2.56.0

Re: [PULL 00/21] aspeed queue

[Richard Henderson]

On 10/15/26 14:21, Cédric Le Goater wrote:
> The following changes since commit d5b5083cb783c447001e862c2b525e59f48ad78c:
> 
>    Merge tag 'block-pull-request' ofhttps://gitlab.com/stefanha/qemu into staging (2026-10-15 11:53:41 +0200)
> 
> are available in the Git repository at:
> 
>    https://github.com/legoater/qemu/ tags/pull-aspeed-20261015
> 
> for you to fetch changes up to 4cf1f0e37d9491eb8b0c8be8dd9dab9260b8fa36:
> 
>    tests/functional: give the set_machine probe VM the test workdir (2026-10-15 13:14:09 +0200)
> 
> ----------------------------------------------------------------
> aspeed queue:
> 
> * Fix OOB read in HACE has_padding() when padding_size is zero
> * Allocate ACRY RSA qtest SRAM buffers on the heap to reduce stack usage
> * Consolidate OTP layout definitions between aspeed_otp and aspeed_sbc
> * Derive ABR and secure boot state from OTP config straps, removing
>    the "emmc-abr" and "signing-settings" machine properties
> * Sort device IDs alphabetically
> * Add I2C test for IO expander 1 on the AST2700A2
> * Update ASPEED BMCs reviewer list
> * Add a create_unimplemented_devices() helper and convert all Aspeed
>    SoCs and coprocessors to table-driven unimplemented devices
> * Fix the set_machine probe VM to use the test workdir

Applied, thanks.

r~