[PULL 00/34] aspeed queue

[PULL 00/34] aspeed queue

[Cédric Le Goater]

The following changes since commit 4075aa42daecf701cd3869da8b3271dc3c04a4b1:

  Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2026-10-30 15:26:36 -0500)

are available in the Git repository at:

  https://github.com/legoater/qemu/ tags/pull-aspeed-20261031

for you to fetch changes up to d83158a1e9f6fa74cc7ae3bdac9e4fd5077909a2:

  hw/rtc: ds1338: parameterise the register map via a device class (2026-10-31 06:52:19 +0100)

----------------------------------------------------------------
aspeed queue:

* Fix AST2700 SMC segment end address decoding and DMA flash address mask
* Add Winbond W25Q33PW flash SFDP data
* Correct AST1040 A0 revision ID
* Add AST1040 FMC and SPI controllers with SMC qtests, and stub
  unimplemented devices
* Bump AST1040 functional test image version to v01.00
* Add the AST1080 Platform Root of Trust SoC and EVB machine,
  with functional test
* Adjust Aspeed documentation with catalina-bmc and sanmiguel-bmc
* Remove unused SPI flash controller from the SanMiguel board
* Add PCA9545 4-channel I2C mux with qtest coverage
* Rework the DS1338 RTC

----------------------------------------------------------------
Emmanuel Blot (12):
      docs/system/arm/aspeed: add the catalina-bmc machine
      docs/system/arm/aspeed: add the sanmiguel-bmc machine
      hw/arm: sanmiguel: remove the second SPI flash controller
      hw/i2c: pca954x: drop unused header inclusions
      hw/i2c: pca954x: add PCA9545 4-channel mux model
      hw/i2c: pca954x: migrate mux state
      tests/qtest: pca9545: add mux test
      hw/rtc: ds1338: move TYPE_DS1338 to a public header
      hw: ds1338: use the TYPE_DS1338 constant instead of the "ds1338" string
      hw/rtc: ds1338: implement Resettable reset
      hw/rtc: ds1338: prefix the file-local helpers with ds1338_
      hw/rtc: ds1338: parameterise the register map via a device class

Jamin Lin (22):
      hw/ssi/aspeed_smc: Fix AST2700 segment end address decoding
      hw/ssi/aspeed_smc: Fix AST2700 DMA flash address mask
      hw/block/m25p80: Add Winbond W25Q33PW flash
      hw/misc/aspeed_scu: Correct AST1040 A0 revision ID
      hw/ssi/aspeed_smc: Add AST1040 FMC and SPI controllers
      hw/arm/aspeed_ast1040: Add FMC and SPI controllers
      hw/arm/aspeed_ast1040: Add FMC and SPI filters as unimplemented devices
      hw/arm/aspeed_ast1040: Add OTP as an unimplemented device
      hw/arm/aspeed_ast1040: Add Anti-Tamper Controller (ATC) as an unimplemented device
      hw/arm/aspeed_ast1040: Add I3C as an unimplemented device
      hw/arm/aspeed_ast1040: Add Caliptra as an unimplemented device
      tests/qtest/aspeed_smc: Add AST1040 SMC tests
      tests/functional/arm/test_aspeed_ast1040: Update AST1040 image to aspeed-mcu-fw-hub v01.00
      hw/arm/aspeed_ast1040: Add common init function for AST1040/AST1080 SoCs
      hw/arm/aspeed_ast1040: Add common realize function for AST1040/AST1080 SoCs
      hw/misc/aspeed_scu: Add AST1080 A0 silicon revision definition
      hw/arm/aspeed_ast1040: Add AST1080 SoC support
      hw/arm/aspeed_ast1040: Add AST1080 QSPI filters as unimplemented device
      hw/arm/aspeed_ast1040: Add AST1080 I2C filter as an unimplemented device
      hw/arm/aspeed_ast1040_evb: Add AST1080 EVB machine support
      tests/functional/arm/aspeed: Add AST1080 test with ASPEED MCU FW Hub v01.00
      docs/system/arm/aspeed: Add AST1080 Platform Root of Trust evaluation board

 docs/system/arm/aspeed.rst                  |  14 ++-
 hw/block/m25p80_sfdp.h                      |   1 +
 include/hw/i2c/i2c_mux_pca954x.h            |   1 +
 include/hw/misc/aspeed_scu.h                |   3 +-
 include/hw/rtc/ds1338.h                     |  20 +++
 hw/arm/aspeed_ast1040.c                     | 183 +++++++++++++++++++++++-----
 hw/arm/aspeed_ast1040_evb.c                 |  23 ++++
 hw/arm/aspeed_ast2400_palmetto.c            |   4 +-
 hw/arm/aspeed_ast2400_supermicrox11.c       |   4 +-
 hw/arm/aspeed_ast2500_romulus.c             |   4 +-
 hw/arm/aspeed_ast2500_supermicro-x11spi.c   |   4 +-
 hw/arm/aspeed_ast2500_witherspoon.c         |   4 +-
 hw/arm/aspeed_ast2600_bletchley.c           |   3 +-
 hw/arm/aspeed_ast2600_catalina.c            |   2 +-
 hw/arm/aspeed_ast2600_sanmiguel.c           |   7 +-
 hw/arm/realview.c                           |   3 +-
 hw/arm/versatilepb.c                        |   3 +-
 hw/block/m25p80.c                           |   2 +
 hw/block/m25p80_sfdp.c                      |  36 ++++++
 hw/i2c/i2c_mux_pca954x.c                    |  98 ++++++++++++++-
 hw/misc/aspeed_scu.c                        |   1 +
 hw/ppc/e500.c                               |   3 +-
 hw/riscv/tt_atlantis.c                      |   3 +-
 hw/rtc/ds1338.c                             |  92 +++++++++-----
 hw/ssi/aspeed_smc.c                         | 131 +++++++++++++++++++-
 tests/qtest/aspeed_smc-test.c               |  61 ++++++++++
 tests/qtest/pca9545-test.c                  | 116 ++++++++++++++++++
 tests/functional/arm/meson.build            |   1 +
 tests/functional/arm/test_aspeed_ast1040.py |  12 +-
 tests/functional/arm/test_aspeed_ast1080.py |  37 ++++++
 tests/qtest/meson.build                     |   1 +
 31 files changed, 784 insertions(+), 93 deletions(-)
 create mode 100644 include/hw/rtc/ds1338.h
 create mode 100644 tests/qtest/pca9545-test.c
 create mode 100644 tests/functional/arm/test_aspeed_ast1080.py

[PULL 01/34] hw/ssi/aspeed_smc: Fix AST2700 segment end address decoding

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST2700 Address Decoding Range Registers (SPI030 - SPI03C) define
the end address as an exclusive upper bound, with a unit of 64KB:

  StartAdr <= CEx < EndAdr

When the start address equals the end address, the decoding is
disabled.

However, aspeed_2700_smc_segment_to_reg() and
aspeed_2700_smc_reg_to_segment() treat the end address as inclusive.

The end offset is programmed as (addr + size - 1) and an extra 64KB is
added back when decoding it. As a result, every segment is 64KB larger
than the range defined by the register and overlaps the next chip
select.

The issue can be reproduced by booting an AST2700 ASPEED SDK image
with "-d guest_errors", which reports a lot of segment overlap errors
such as:

  aspeed_smc_flash_set_segment: new segment for CS0 is not aligned :
    [ 0x100000000 - 0x108010000 ]
  aspeed_smc_flash_overlap: new segment CS1 [ 0x108000000 - 0x110010000 ]
    overlaps with CS0 [ 0x100000000 - 0x108010000 ]

Fix the segment helpers to use an exclusive end address, so that the
decoded segments match the definition in the AST2700 datasheet.

Fixes: bdb3748dba30 ("aspeed/smc: Add AST2700 support")
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ssi/aspeed_smc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index bf596f7b2d68..10ea9e5aa063 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -1823,7 +1823,7 @@ static uint32_t aspeed_2700_smc_segment_to_reg(const AspeedSMCState *s,
     }
 
     reg |= (seg->addr & AST2700_SEG_ADDR_MASK) >> 16; /* start offset */
-    reg |= (seg->addr + seg->size - 1) & AST2700_SEG_ADDR_MASK; /* end offset */
+    reg |= (seg->addr + seg->size) & AST2700_SEG_ADDR_MASK; /* end offset */
     return reg;
 }
 
@@ -1836,7 +1836,7 @@ static void aspeed_2700_smc_reg_to_segment(const AspeedSMCState *s,
 
     if (reg) {
         seg->addr = asc->flash_window_base + start_offset;
-        seg->size = end_offset + (64 * KiB) - start_offset;
+        seg->size = end_offset - start_offset;
     } else {
         seg->addr = asc->flash_window_base;
         seg->size = 0;
-- 
2.56.0

[PULL 02/34] hw/ssi/aspeed_smc: Fix AST2700 DMA flash address mask

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The DMA flash address register (SPI084) holds the offset of the
flash access within the controller's flash window. The AST2700 FMC,
SPI0 and SPI1 controllers use a dma_flash_mask of 0x2FFFFFFC, which
clears bit 28, and SPI2 uses 0x0FFFFFFC, which limits DMA to the
first 256MB of the window.

With the default segment layout, FMC CS2 is mapped at offset
0x10000000. A DMA read from that offset is masked to 0x0 and returns
data from CS0 instead of CS2.

The Linux driver programs SPI084 with the window offset masked by
0x7fffffff, so bit 28 is a valid address bit.

Set dma_flash_mask to 0x3FFFFFFC for all AST2700 controllers to cover
the full 1GB flash window.

Fixes: bdb3748dba30 ("aspeed/smc: Add AST2700 support")
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ssi/aspeed_smc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index 10ea9e5aa063..c0c3666dbca3 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -1952,7 +1952,7 @@ static void aspeed_2700_fmc_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x2FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
@@ -1989,7 +1989,7 @@ static void aspeed_2700_spi0_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x2FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
@@ -2025,7 +2025,7 @@ static void aspeed_2700_spi1_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x2FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
@@ -2061,7 +2061,7 @@ static void aspeed_2700_spi2_class_init(ObjectClass *klass, const void *data)
     asc->features          = ASPEED_SMC_FEATURE_DMA |
                              ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
                              ASPEED_SMC_FEATURE_DATA_FIFO;
-    asc->dma_flash_mask    = 0x0FFFFFFC;
+    asc->dma_flash_mask    = 0x3FFFFFFC;
     asc->dma_dram_mask     = 0xFFFFFFFC;
     asc->dma_start_length  = 1;
     asc->nregs             = (0x200 + (asc->cs_num_max * 0x10)) >> 2;
-- 
2.56.0

[PULL 03/34] hw/block/m25p80: Add Winbond W25Q33PW flash

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The W25Q32DW and W25Q33PW use the same JEDEC ID (0xef6016), but
have different part names.

Add the SFDP data table for the Winbond W25Q33PW flash device. The table
was generated from a real device under Linux by dumping the SFDP content
using the following command:

Example:

```
hexdump -v -e '8/1 "0x%02x, " "\n"' \
    /sys/bus/spi/devices/spi1.0/spi-nor/sfdp
```

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/block/m25p80_sfdp.h |  1 +
 hw/block/m25p80.c      |  2 ++
 hw/block/m25p80_sfdp.c | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/hw/block/m25p80_sfdp.h b/hw/block/m25p80_sfdp.h
index c1e532de5aeb..61544fb7cc69 100644
--- a/hw/block/m25p80_sfdp.h
+++ b/hw/block/m25p80_sfdp.h
@@ -23,6 +23,7 @@ uint8_t m25p80_sfdp_mx25l25635e(uint32_t addr);
 uint8_t m25p80_sfdp_mx25l25635f(uint32_t addr);
 uint8_t m25p80_sfdp_mx66l1g45g(uint32_t addr);
 
+uint8_t m25p80_sfdp_w25q33pw(uint32_t addr);
 uint8_t m25p80_sfdp_w25q256(uint32_t addr);
 uint8_t m25p80_sfdp_w25q512jv(uint32_t addr);
 uint8_t m25p80_sfdp_w25q80bl(uint32_t addr);
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index 545e0b572859..baf798c6b5cc 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -354,6 +354,8 @@ static const FlashPartInfo known_devices[] = {
     { INFO("w25x32",      0xef3016,      0,  64 << 10,  64, ER_4K) },
     { INFO("w25q32",      0xef4016,      0,  64 << 10,  64, ER_4K) },
     { INFO("w25q32dw",    0xef6016,      0,  64 << 10,  64, ER_4K) },
+    { INFO("w25q33pw",    0xef6016,      0,  64 << 10,  64, ER_4K | ER_32K),
+      .sfdp_read = m25p80_sfdp_w25q33pw },
     { INFO("w25x64",      0xef3017,      0,  64 << 10, 128, ER_4K) },
     { INFO("w25q64",      0xef4017,      0,  64 << 10, 128, ER_4K) },
     { INFO("w25q80",      0xef5014,      0,  64 << 10,  16, ER_4K) },
diff --git a/hw/block/m25p80_sfdp.c b/hw/block/m25p80_sfdp.c
index 87878c2bf0fa..8ac603e21267 100644
--- a/hw/block/m25p80_sfdp.c
+++ b/hw/block/m25p80_sfdp.c
@@ -296,6 +296,42 @@ define_sfdp_read(mx66l1g45g);
  * Windbond
  */
 
+static const uint8_t sfdp_w25q33pw[] = {
+    0x53, 0x46, 0x44, 0x50, 0x0a, 0x01, 0x00, 0xff,
+    0x00, 0x08, 0x01, 0x17, 0x80, 0x00, 0x00, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xe5, 0x20, 0xf9, 0xff, 0xff, 0xff, 0xff, 0x01,
+    0x44, 0xeb, 0x08, 0x6b, 0x08, 0x3b, 0x42, 0xbb,
+    0xfe, 0xff, 0xff, 0xff, 0xff, 0xff, 0x00, 0x00,
+    0xff, 0xff, 0x44, 0xeb, 0x0c, 0x20, 0x0f, 0x52,
+    0x10, 0xd8, 0x00, 0x00, 0x14, 0x32, 0x01, 0x01,
+    0x81, 0xe3, 0x14, 0xc2, 0xe9, 0x63, 0x76, 0x33,
+    0x7a, 0x75, 0x7a, 0x75, 0xf7, 0xa9, 0xd5, 0x5c,
+    0x39, 0xf6, 0x6d, 0xff, 0xe9, 0x30, 0xf8, 0x80,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xac, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0xf7, 0xf5, 0xff, 0xff,
+    0x0f, 0x00, 0x00, 0x00, 0x06, 0x0d, 0x44, 0xbd,
+    0x27, 0xed, 0x08, 0x0d, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+};
+define_sfdp_read(w25q33pw);
+
 static const uint8_t sfdp_w25q256[] = {
     0x53, 0x46, 0x44, 0x50, 0x00, 0x01, 0x00, 0xff,
     0x00, 0x00, 0x01, 0x09, 0x80, 0x00, 0x00, 0xff,
-- 
2.56.0

[PULL 04/34] hw/misc/aspeed_scu: Correct AST1040 A0 revision ID

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Correct the AST1040 A0 silicon revision ID from 0x81000000 to 0x80000000.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/misc/aspeed_scu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 904549465fd1..6482038f123a 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -51,7 +51,7 @@ struct Aspeed2700SCUState {
 #define AST2600_A3_SILICON_REV   0x05030303U
 #define AST1030_A1_SILICON_REV   0x80010000U
 #define AST1060_A2_SILICON_REV   0xA0030000U
-#define AST1040_A0_SILICON_REV   0x81000000U
+#define AST1040_A0_SILICON_REV   0x80000000U
 #define AST2700_A1_SILICON_REV   0x06010103U
 #define AST2700_A2_SILICON_REV   0x06020103U
 
-- 
2.56.0

[PULL 05/34] hw/ssi/aspeed_smc: Add AST1040 FMC and SPI controllers

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1040 FMC and SPI controllers are compatible with the AST2700
controllers, but use different flash window. Therefore, the AST2700
controller types cannot be reused directly for AST1040.

Add dedicated AST1040 FMC, SPI0 and SPI1 controller types with the
appropriate parameter settings.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ssi/aspeed_smc.c | 119 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 119 insertions(+)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index c0c3666dbca3..ec9ad0f747e1 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -2072,6 +2072,110 @@ static void aspeed_2700_spi2_class_init(ObjectClass *klass, const void *data)
     asc->reg_ops           = &aspeed_2700_smc_flash_ops;
 }
 
+static const uint32_t aspeed_1040_resets[ASPEED_SMC_R_MAX] = {
+    [R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
+                CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1 |
+                CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE2 |
+                CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE3),
+};
+
+static void aspeed_1040_fmc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
+
+    dc->desc               = "Aspeed 1040 FMC Controller";
+    asc->r_conf            = R_CONF;
+    asc->r_ce_ctrl         = R_CE_CTRL;
+    asc->r_ctrl0           = R_CTRL0;
+    asc->r_timings         = R_TIMINGS;
+    asc->nregs_timings     = 2;
+    asc->conf_enable_w0    = CONF_ENABLE_W0;
+    asc->cs_num_max        = 2;
+    asc->segments          = aspeed_2700_spi0_segments;
+    asc->segment_addr_mask = 0xffffffff;
+    asc->resets            = aspeed_1040_resets;
+    asc->flash_window_base = 0x80000000;
+    asc->flash_window_size = 512 * MiB;
+    asc->features          = ASPEED_SMC_FEATURE_DMA |
+                             ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+    asc->dma_flash_mask    = 0x1FFFFFFC;
+    asc->dma_dram_mask     = 0x00FFFFFC;
+    asc->dma_start_length  = 1;
+    asc->nregs             = ASPEED_SMC_R_MAX;
+    asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
+    asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
+    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
+    asc->reg_ops           = &aspeed_2700_smc_flash_ops;
+}
+
+static const AspeedSegments aspeed_1040_spi0_segments[] = {
+    { 0x0, 128 * MiB },
+    { 128 * MiB, 128 * MiB },
+    { 256 * MiB, 128 * MiB },
+    { 384 * MiB, 128 * MiB },
+};
+
+static void aspeed_1040_spi0_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
+
+    dc->desc               = "Aspeed 1040 SPI0 Controller";
+    asc->r_conf            = R_CONF;
+    asc->r_ce_ctrl         = R_CE_CTRL;
+    asc->r_ctrl0           = R_CTRL0;
+    asc->r_timings         = R_TIMINGS;
+    asc->nregs_timings     = 4;
+    asc->conf_enable_w0    = CONF_ENABLE_W0;
+    asc->cs_num_max        = 4;
+    asc->segments          = aspeed_1040_spi0_segments;
+    asc->segment_addr_mask = 0xffffffff;
+    asc->resets            = aspeed_1040_resets;
+    asc->flash_window_base = 0xA0000000;
+    asc->flash_window_size = 512 * MiB;
+    asc->features          = ASPEED_SMC_FEATURE_DMA |
+                             ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+    asc->dma_flash_mask    = 0x1FFFFFFC;
+    asc->dma_dram_mask     = 0x00FFFFFC;
+    asc->dma_start_length  = 1;
+    asc->nregs             = ASPEED_SMC_R_MAX;
+    asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
+    asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
+    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
+    asc->reg_ops           = &aspeed_2700_smc_flash_ops;
+}
+
+static void aspeed_1040_spi1_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSMCClass *asc = ASPEED_SMC_CLASS(klass);
+
+    dc->desc               = "Aspeed 1040 SPI1 Controller";
+    asc->r_conf            = R_CONF;
+    asc->r_ce_ctrl         = R_CE_CTRL;
+    asc->r_ctrl0           = R_CTRL0;
+    asc->r_timings         = R_TIMINGS;
+    asc->nregs_timings     = 2;
+    asc->conf_enable_w0    = CONF_ENABLE_W0;
+    asc->cs_num_max        = 2;
+    asc->segments          = aspeed_2700_spi0_segments;
+    asc->segment_addr_mask = 0xffffffff;
+    asc->resets            = aspeed_1040_resets;
+    asc->flash_window_base = 0xC0000000;
+    asc->flash_window_size = 512 * MiB;
+    asc->features          = ASPEED_SMC_FEATURE_DMA |
+                             ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+    asc->dma_flash_mask    = 0x1FFFFFFC;
+    asc->dma_dram_mask     = 0x00FFFFFC;
+    asc->dma_start_length  = 1;
+    asc->nregs             = ASPEED_SMC_R_MAX;
+    asc->segment_to_reg    = aspeed_2700_smc_segment_to_reg;
+    asc->reg_to_segment    = aspeed_2700_smc_reg_to_segment;
+    asc->dma_ctrl          = aspeed_2600_smc_dma_ctrl;
+    asc->reg_ops           = &aspeed_2700_smc_flash_ops;
+}
+
 static const TypeInfo aspeed_smc_types[] = {
     {
         .name           = TYPE_ASPEED_SMC_FLASH,
@@ -2103,6 +2207,21 @@ static const TypeInfo aspeed_smc_types[] = {
         .parent     = TYPE_ASPEED_SMC,
         .class_init = aspeed_1030_spi2_class_init,
     },
+    {
+        .name       = "aspeed.fmc-ast1040",
+        .parent     = TYPE_ASPEED_SMC,
+        .class_init = aspeed_1040_fmc_class_init,
+    },
+    {
+        .name       = "aspeed.spi0-ast1040",
+        .parent     = TYPE_ASPEED_SMC,
+        .class_init = aspeed_1040_spi0_class_init,
+    },
+    {
+        .name       = "aspeed.spi1-ast1040",
+        .parent     = TYPE_ASPEED_SMC,
+        .class_init = aspeed_1040_spi1_class_init,
+    },
     {
         .name       = "aspeed.smc-ast2400",
         .parent     = TYPE_ASPEED_SMC,
-- 
2.56.0

[PULL 06/34] hw/arm/aspeed_ast1040: Add FMC and SPI controllers

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Add the FMC, SPI0 and SPI1 controllers to the AST1040 SoC. Map their
register and flash memory regions, connect their interrupts, and link
the DMA DRAM region to internal Hyper RAM.

The AST1040 supports two SPI controllers, SPI0 and SPI1.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 0b078f10c403..6e3b6900e0fb 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -103,7 +103,9 @@ static void aspeed_soc_ast1040_init(Object *obj)
     Aspeed10x0SoCState *a = ASPEED10X0_SOC(obj);
     AspeedSoCState *s = ASPEED_SOC(obj);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    char typename[64];
     int i;
+
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
 
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
@@ -132,6 +134,13 @@ static void aspeed_soc_ast1040_init(Object *obj)
         object_initialize_child(obj, "wdt[*]", &s->wdt[i],
                                 "aspeed.wdt-ast2700");
     }
+
+    object_initialize_child(obj, "fmc", &s->fmc, "aspeed.fmc-ast1040");
+
+    for (i = 0; i < sc->spis_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.spi%d-ast1040", i);
+        object_initialize_child(obj, "spi[*]", &s->spi[i], typename);
+    }
 }
 
 static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
@@ -268,6 +277,34 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
 
+    /* FMC, The number of CS is set at the board level */
+    object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(&s->sram[1]),
+            &error_abort);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 0,
+                    sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
+                    ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
+                       aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_FMC));
+
+    /* SPI */
+    for (i = 0; i < sc->spis_num; i++) {
+        object_property_set_link(OBJECT(&s->spi[i]), "dram",
+                                 OBJECT(&s->sram[1]), &error_abort);
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
+            return;
+        }
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 0,
+                        sc->memmap[ASPEED_DEV_SPI0 + i]);
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
+                        ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
+                           aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_SPI0 + i));
+    }
+
     /* Unimplemented devices */
     create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 }
@@ -292,6 +329,7 @@ static void aspeed_soc_ast1040_class_init(ObjectClass *klass, const void *data)
     sc->uarts_num       = 13;
     sc->sgpio_num       = 2;
     sc->wdts_num        = 8;
+    sc->spis_num        = 2;
     sc->uarts_base      = ASPEED_DEV_UART0;
     sc->irqmap          = aspeed_soc_ast1040_irqmap;
     sc->memmap          = aspeed_soc_ast1040_memmap;
-- 
2.56.0

[PULL 07/34] hw/arm/aspeed_ast1040: Add FMC and SPI filters as unimplemented devices

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1040 provides filter register regions for the FMC, SPI0 and SPI1
controllers at the following addresses:

FMC filter: 0x74000400
SPI0 filter: 0x74010400
SPI1 filter: 0x74020400

These filters are not modeled yet. Add the register regions as
unimplemented devices to reflect the AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 6e3b6900e0fb..5eb091e67567 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -87,6 +87,9 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "udc", "aspeed.udc", 0x74120000, 0x4000, -1000 },
     { "jtag[0]", "aspeed.jtag0", 0x74C01000, 0x100, -1000 },
     { "jtag[1]", "aspeed.jtag1", 0x74C09000, 0x100, -1000 },
+    { "fmc-filter",  "aspeed.fmc-filter", 0x74000400, 0x1000, -1000 },
+    { "spi0-filter", "aspeed.spi0-filter", 0x74010400, 0x1000, -1000 },
+    { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
     { }
 };
 
-- 
2.56.0

[PULL 08/34] hw/arm/aspeed_ast1040: Add OTP as an unimplemented device

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1040 provides an OTP controller at 0x74c07000, but the controller
is not modeled yet.

Add the OTP register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 5eb091e67567..48eda35ffec7 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -90,6 +90,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "fmc-filter",  "aspeed.fmc-filter", 0x74000400, 0x1000, -1000 },
     { "spi0-filter", "aspeed.spi0-filter", 0x74010400, 0x1000, -1000 },
     { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
+    { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
     { }
 };
 
-- 
2.56.0

[PULL 09/34] hw/arm/aspeed_ast1040: Add Anti-Tamper Controller (ATC) as an unimplemented device

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1040 provides an Anti-Tamper Controller (ATC) at 0x74c35000,
but the controller is not modeled yet.

Add the ATC register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 48eda35ffec7..88f7a2df2c59 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -91,6 +91,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "spi0-filter", "aspeed.spi0-filter", 0x74010400, 0x1000, -1000 },
     { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
     { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
+    { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
     { }
 };
 
-- 
2.56.0

[PULL 10/34] hw/arm/aspeed_ast1040: Add I3C as an unimplemented device

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1040 provides an I3C at 0x74c20000, but the controller is not
modeled yet.

Add the I3C register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-11-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 88f7a2df2c59..5f6aa1503aff 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -92,6 +92,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
     { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
     { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
+    { "i3c", "aspeed.i3c", 0x74C20000, 0x8000, -1000 },
     { }
 };
 
-- 
2.56.0

[PULL 11/34] hw/arm/aspeed_ast1040: Add Caliptra as an unimplemented device

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1040 provides a Caliptra Wrapper at 0x74200000 with
a size of 1MB, but it is not modeled yet.

Add the Caliptra register region as an unimplemented device to reflect the
AST1040 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-12-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 5f6aa1503aff..74a1097bd7d1 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -93,6 +93,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
     { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
     { "i3c", "aspeed.i3c", 0x74C20000, 0x8000, -1000 },
+    { "caliptra", "aspeed.caliptra", 0x74200000, 0x100000, -1000 },
     { }
 };
 
-- 
2.56.0

[PULL 12/34] tests/qtest/aspeed_smc: Add AST1040 SMC tests

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Add SMC qtests for the AST1040 EVB using a 4 MiB W25Q33PW flash
connected to FMC CS0.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-13-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/aspeed_smc-test.c | 61 +++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
index 59c96bd68ae8..34010e283f25 100644
--- a/tests/qtest/aspeed_smc-test.c
+++ b/tests/qtest/aspeed_smc-test.c
@@ -240,12 +240,69 @@ static void test_ast1030_evb(AspeedSMCTestData *data)
                         data, aspeed_smc_test_write_page_qor);
 }
 
+static void test_ast1040_evb(AspeedSMCTestData *data)
+{
+    int ret;
+    int fd;
+
+    fd = g_file_open_tmp("qtest.m25p80.w25q33pw.XXXXXX",
+                         &data->tmp_path, NULL);
+    g_assert(fd >= 0);
+    ret = ftruncate(fd, 4 * 1024 * 1024);
+    g_assert(ret == 0);
+    close(fd);
+
+    data->s = qtest_initf("-machine ast1040-evb "
+                          "-device w25q33pw,bus=ssi.0,cs=0x0,drive=fmc0 "
+                          "-blockdev node-name=fmc0,driver=file,filename=%s",
+                          data->tmp_path);
+
+    /* fmc cs0 with w25q33pw flash */
+    data->flash_base = 0x80000000;
+    data->spi_base = 0x74000000;
+    data->jedec_id = 0xef6016;
+    data->cs = 0;
+    data->node = "/machine/soc/fmc/ssi.0/child[0]";
+    /* beyond 512KB */
+    data->page_addr = 0x800 * FLASH_PAGE_SIZE;
+
+    qtest_add_data_func("/ast1040/smc/read_jedec",
+                        data, aspeed_smc_test_read_jedec);
+    qtest_add_data_func("/ast1040/smc/erase_sector",
+                        data, aspeed_smc_test_erase_sector);
+    qtest_add_data_func("/ast1040/smc/erase_all",
+                        data, aspeed_smc_test_erase_all);
+    qtest_add_data_func("/ast1040/smc/write_page",
+                        data, aspeed_smc_test_write_page);
+    qtest_add_data_func("/ast1040/smc/read_page_mem",
+                        data, aspeed_smc_test_read_page_mem);
+    qtest_add_data_func("/ast1040/smc/write_page_mem",
+                        data, aspeed_smc_test_write_page_mem);
+    qtest_add_data_func("/ast1040/smc/read_status_reg",
+                        data, aspeed_smc_test_read_status_reg);
+    qtest_add_data_func("/ast1040/smc/write_page_qpi",
+                        data, aspeed_smc_test_write_page_qpi);
+    qtest_add_data_func("/ast1040/smc/read_page_mem_fast_read",
+                        data, aspeed_smc_test_read_page_mem_fast_read);
+    qtest_add_data_func("/ast1040/smc/write_page_fast_read",
+                        data, aspeed_smc_test_write_page_fast_read);
+    qtest_add_data_func("/ast1040/smc/read_page_mem_dor",
+                        data, aspeed_smc_test_read_page_mem_dor);
+    qtest_add_data_func("/ast1040/smc/write_page_dor",
+                        data, aspeed_smc_test_write_page_dor);
+    qtest_add_data_func("/ast1040/smc/read_page_mem_qor",
+                        data, aspeed_smc_test_read_page_mem_qor);
+    qtest_add_data_func("/ast1040/smc/write_page_qor",
+                        data, aspeed_smc_test_write_page_qor);
+}
+
 int main(int argc, char **argv)
 {
     AspeedSMCTestData palmetto_data;
     AspeedSMCTestData ast2500_evb_data;
     AspeedSMCTestData ast2600_evb_data;
     AspeedSMCTestData ast1030_evb_data;
+    AspeedSMCTestData ast1040_evb_data;
     int ret;
 
     g_test_init(&argc, &argv, NULL);
@@ -254,20 +311,24 @@ int main(int argc, char **argv)
     test_ast2500_evb(&ast2500_evb_data);
     test_ast2600_evb(&ast2600_evb_data);
     test_ast1030_evb(&ast1030_evb_data);
+    test_ast1040_evb(&ast1040_evb_data);
     ret = g_test_run();
 
     qtest_quit(palmetto_data.s);
     qtest_quit(ast2500_evb_data.s);
     qtest_quit(ast2600_evb_data.s);
     qtest_quit(ast1030_evb_data.s);
+    qtest_quit(ast1040_evb_data.s);
     unlink(palmetto_data.tmp_path);
     unlink(ast2500_evb_data.tmp_path);
     unlink(ast2600_evb_data.tmp_path);
     unlink(ast1030_evb_data.tmp_path);
+    unlink(ast1040_evb_data.tmp_path);
     g_free(palmetto_data.tmp_path);
     g_free(ast2500_evb_data.tmp_path);
     g_free(ast2600_evb_data.tmp_path);
     g_free(ast1030_evb_data.tmp_path);
+    g_free(ast1040_evb_data.tmp_path);
 
     return ret;
 }
-- 
2.56.0

[PULL 13/34] tests/functional/arm/test_aspeed_ast1040: Update AST1040 image to aspeed-mcu-fw-hub v01.00

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Previously, ASPEED hosted the AST1040 pre-built image in the Zephyr GitHub repository
as a temporary solution for QEMU functional tests.

ASPEED now provides official AST1040/AST1080 pre-built images in the aspeed-mcu-fw-hub
repository, starting with release v01.00.

Update the AST1040 functional test to use the official pre-built image from
aspeed-mcu-fw-hub instead of the Zephyr repository.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261028023154.48395-14-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/test_aspeed_ast1040.py | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast1040.py b/tests/functional/arm/test_aspeed_ast1040.py
index e4d8ecb37a58..bdfd81567325 100644
--- a/tests/functional/arm/test_aspeed_ast1040.py
+++ b/tests/functional/arm/test_aspeed_ast1040.py
@@ -12,17 +12,19 @@
 
 class AST1040Machine(AspeedTest):
 
-    ASSET_ZEPHYR_3_07 = Asset(
+    ASSET_ASPEED_AST1040_EVB_01_00 = Asset(
         ('https://github.com/AspeedTech-BMC'
-         '/zephyr/releases/download/v00.03.07/ast1040-evb-demo.zip'),
-         'b5189797c22c2d732ddc27670c1efdeba821a2747c9c7434f190791125baa121')
+         '/aspeed-mcu-fw-hub/releases/download/v01.00'
+         '/ast1040a0-evb-v01.00.tar.gz'),
+         '62dff10cef99a72a9ec679b7ed2c80ba1b76dcdab6bb66251e99a83a31612a02')
 
     def test_arm_ast1040_zephyros(self):
         self.set_machine('ast1040-evb')
 
-        kernel_name = "zephyr.bin"
+        kernel_name = ('ast1040a0-evb-v01.00/ast1040/ast1040a0/evb/'
+                       'zephyr-shell-module.bin')
         kernel_file = self.archive_extract(
-            self.ASSET_ZEPHYR_3_07, member=kernel_name)
+            self.ASSET_ASPEED_AST1040_EVB_01_00, member=kernel_name)
 
         self.vm.set_console()
         self.vm.add_args('-kernel', kernel_file, '-nographic')
-- 
2.56.0

[PULL 14/34] hw/arm/aspeed_ast1040: Add common init function for AST1040/AST1080 SoCs

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

AST1040 and AST1080 are the next-generation SoCs of AST1030 and AST1060,
respectively.

The AST1030 and AST1060 SoCs share common initialization through
aspeed_soc_ast10x0_init(). Similarly, introduce
aspeed_soc_ast10x0_g2_init() to provide common initialization for the
AST1040 and AST1080 SoCs.

Move the shared AST1040 initialization into the new common function so
that it can be reused when adding AST1080 support. The PECI and eSPI
controllers are only available on the AST1040, so their initialization
is kept in aspeed_soc_ast1040_init().

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 36 +++++++++++++++++++++++++-----------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 74a1097bd7d1..5d2713e8bb41 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -81,19 +81,23 @@ static const int aspeed_soc_ast1040_irqmap[] = {
     [ASPEED_DEV_PECI]      = 164,
 };
 
-static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
-    { "pwm", "aspeed.pwm", 0x740C0000, 0x10000, -1000 },
-    { "espi", "aspeed.espi", 0x74C05000, 0x1000, -1000 },
-    { "udc", "aspeed.udc", 0x74120000, 0x4000, -1000 },
-    { "jtag[0]", "aspeed.jtag0", 0x74C01000, 0x100, -1000 },
-    { "jtag[1]", "aspeed.jtag1", 0x74C09000, 0x100, -1000 },
+static const UnimplementedDeviceConfig aspeed_soc_ast10x0_g2_unimp_devs[] = {
     { "fmc-filter",  "aspeed.fmc-filter", 0x74000400, 0x1000, -1000 },
     { "spi0-filter", "aspeed.spi0-filter", 0x74010400, 0x1000, -1000 },
     { "spi1-filter", "aspeed.spi1-filter", 0x74020400, 0x1000, -1000 },
+    { "pwm", "aspeed.pwm", 0x740C0000, 0x10000, -1000 },
+    { "udc", "aspeed.udc", 0x74120000, 0x4000, -1000 },
+    { "caliptra", "aspeed.caliptra", 0x74200000, 0x100000, -1000 },
+    { "jtag[0]", "aspeed.jtag0", 0x74C01000, 0x100, -1000 },
     { "otp", "aspeed.otp", 0x74C07000, 0x800, -1000 },
-    { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
+    { "jtag[1]", "aspeed.jtag1", 0x74C09000, 0x100, -1000 },
     { "i3c", "aspeed.i3c", 0x74C20000, 0x8000, -1000 },
-    { "caliptra", "aspeed.caliptra", 0x74200000, 0x100000, -1000 },
+    { "atc", "aspeed.atc", 0x74C35000, 0x100, -1000 },
+    { }
+};
+
+static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
+    { "espi", "aspeed.espi", 0x74C05000, 0x1000, -1000 },
     { }
 };
 
@@ -105,7 +109,7 @@ static qemu_irq aspeed_soc_ast1040_get_irq(AspeedSoCState *s, int dev)
     return qdev_get_gpio_in(DEVICE(&a->armv7m), sc->irqmap[dev]);
 }
 
-static void aspeed_soc_ast1040_init(Object *obj)
+static void aspeed_soc_ast10x0_g2_init(Object *obj)
 {
     Aspeed10x0SoCState *a = ASPEED10X0_SOC(obj);
     AspeedSoCState *s = ASPEED_SOC(obj);
@@ -117,7 +121,7 @@ static void aspeed_soc_ast1040_init(Object *obj)
 
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 
-    /* AST1040 uses the AST2700 SCUIO model */
+    /* AST10x0 G2 uses the AST2700 SCUIO model */
     object_initialize_child(obj, "scu", &s->scu, TYPE_ASPEED_2700_SCUIO);
     qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev", sc->silicon_rev);
 
@@ -129,7 +133,6 @@ static void aspeed_soc_ast1040_init(Object *obj)
     }
 
     object_initialize_child(obj, "adc", &s->adc, TYPE_ASPEED_2700_ADC);
-    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
     object_initialize_child(obj, "gpio", &s->gpio, "aspeed.gpio-ast2700");
     for (i = 0; i < sc->sgpio_num; i++) {
         object_initialize_child(obj, "sgpio[*]", &s->sgpiom[i],
@@ -150,6 +153,15 @@ static void aspeed_soc_ast1040_init(Object *obj)
     }
 }
 
+static void aspeed_soc_ast1040_init(Object *obj)
+{
+    AspeedSoCState *s = ASPEED_SOC(obj);
+
+    aspeed_soc_ast10x0_g2_init(obj);
+
+    object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
+}
+
 static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
 {
     Aspeed10x0SoCState *a = ASPEED10X0_SOC(dev_soc);
@@ -313,6 +325,8 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
     }
 
     /* Unimplemented devices */
+    create_unimplemented_devices(OBJECT(s), s->memory,
+                                 aspeed_soc_ast10x0_g2_unimp_devs);
     create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
 }
 
-- 
2.56.0

[PULL 15/34] hw/arm/aspeed_ast1040: Add common realize function for AST1040/AST1080 SoCs

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

AST1040 and AST1080 are the next-generation SoCs of AST1030 and AST1060,
respectively.

The AST1030 and AST1060 SoCs share common realization through
aspeed_soc_ast10x0_realize(). Similarly, introduce
aspeed_soc_ast10x0_g2_realize() to provide common realization for the
AST1040 and AST1080 SoCs.

Move the shared AST1040 realization into the new common function so that
it can be reused when adding AST1080 support. The PECI and eSPI
controllers are only available on the AST1040, so their realization is
kept in aspeed_soc_ast1040_realize().

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 62 ++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 25 deletions(-)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 5d2713e8bb41..28abbe70104d 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -162,10 +162,9 @@ static void aspeed_soc_ast1040_init(Object *obj)
     object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
 }
 
-static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
+static bool aspeed_soc_ast10x0_g2_realize(Aspeed10x0SoCState *a, Error **errp)
 {
-    Aspeed10x0SoCState *a = ASPEED10X0_SOC(dev_soc);
-    AspeedSoCState *s = ASPEED_SOC(dev_soc);
+    AspeedSoCState *s = ASPEED_SOC(a);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     g_autofree char *hyperram_name = NULL;
     g_autofree char *sram_name = NULL;
@@ -176,10 +175,10 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
 
     if (!clock_has_source(s->sysclk)) {
         error_setg(errp, "sysclk clock must be wired up by the board code");
-        return;
+        return false;
     }
 
-    /* AST1040 CPU Core */
+    /* AST10x0 G2 CPU Core */
     armv7m = DEVICE(&a->armv7m);
     qdev_prop_set_uint32(armv7m, "num-irq", 256);
     qdev_prop_set_string(armv7m, "cpu-type",
@@ -196,7 +195,7 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
                            sc->sram_size[0], &err);
     if (err) {
         error_propagate(errp, err);
-        return;
+        return false;
     }
     memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SRAM0],
                                 &s->sram[0]);
@@ -208,14 +207,14 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
                            sc->sram_size[1], &err);
     if (err) {
         error_propagate(errp, err);
-        return;
+        return false;
     }
     memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SRAM1],
                                 &s->sram[1]);
 
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
-        return;
+        return false;
     }
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
                     sc->memmap[ASPEED_DEV_SCU]);
@@ -224,7 +223,7 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
     for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
         if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
                                      sc->memmap[uart], errp)) {
-            return;
+            return false;
         }
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
                            aspeed_soc_ast1040_get_irq(s, uart));
@@ -232,25 +231,16 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
 
     /* ADC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
-        return;
+        return false;
     }
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
                     sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_ADC));
 
-    /* PECI */
-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
-        return;
-    }
-    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
-                    sc->memmap[ASPEED_DEV_PECI]);
-    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
-                       aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_PECI));
-
     /* GPIO */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
-        return;
+        return false;
     }
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
@@ -260,7 +250,7 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
     /* SGPIO */
     for (i = 0; i < sc->sgpio_num; i++) {
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->sgpiom[i]), errp)) {
-            return;
+            return false;
         }
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sgpiom[i]), 0,
                         sc->memmap[ASPEED_DEV_SGPIOM0 + i]);
@@ -272,7 +262,7 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
     object_property_set_link(OBJECT(&s->i2c), "dram", OBJECT(&s->sram[1]),
                              &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
-        return;
+        return false;
     }
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i2c), 0,
                     sc->memmap[ASPEED_DEV_I2C]);
@@ -291,7 +281,7 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
         object_property_set_link(OBJECT(&s->wdt[i]), "scu", OBJECT(&s->scu),
                                  &error_abort);
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
-            return;
+            return false;
         }
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
@@ -300,7 +290,7 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
     object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(&s->sram[1]),
             &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
-        return;
+        return false;
     }
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 0,
                     sc->memmap[ASPEED_DEV_FMC]);
@@ -314,7 +304,7 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
         object_property_set_link(OBJECT(&s->spi[i]), "dram",
                                  OBJECT(&s->sram[1]), &error_abort);
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
-            return;
+            return false;
         }
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI0 + i]);
@@ -328,6 +318,28 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
     create_unimplemented_devices(OBJECT(s), s->memory,
                                  aspeed_soc_ast10x0_g2_unimp_devs);
     create_unimplemented_devices(OBJECT(s), s->memory, sc->unimp_devs);
+
+    return true;
+}
+
+static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
+{
+    Aspeed10x0SoCState *a = ASPEED10X0_SOC(dev_soc);
+    AspeedSoCState *s = ASPEED_SOC(a);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+
+    if (!aspeed_soc_ast10x0_g2_realize(a, errp)) {
+        return;
+    }
+
+    /* PECI */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
+        return;
+    }
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
+                    sc->memmap[ASPEED_DEV_PECI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
+                       aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_PECI));
 }
 
 static void aspeed_soc_ast1040_class_init(ObjectClass *klass, const void *data)
-- 
2.56.0

[PULL 16/34] hw/misc/aspeed_scu: Add AST1080 A0 silicon revision definition

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Add a new silicon revision constant AST1080_A0_SILICON_REV for the
AST1080 SoC. This allows the SCU model and related SoC layers to
identify and handle AST1080 A0 revision properly in the same way as
other Aspeed SoC families.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/misc/aspeed_scu.h | 1 +
 hw/misc/aspeed_scu.c         | 1 +
 2 files changed, 2 insertions(+)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 6482038f123a..a7014e43f21e 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -52,6 +52,7 @@ struct Aspeed2700SCUState {
 #define AST1030_A1_SILICON_REV   0x80010000U
 #define AST1060_A2_SILICON_REV   0xA0030000U
 #define AST1040_A0_SILICON_REV   0x80000000U
+#define AST1080_A0_SILICON_REV   0xA0000100U
 #define AST2700_A1_SILICON_REV   0x06010103U
 #define AST2700_A2_SILICON_REV   0x06020103U
 
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 77f9af2ae50e..df26dd0ef427 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -572,6 +572,7 @@ static uint32_t aspeed_silicon_revs[] = {
     AST2700_A1_SILICON_REV,
     AST2700_A2_SILICON_REV,
     AST1040_A0_SILICON_REV,
+    AST1080_A0_SILICON_REV,
 };
 
 bool is_supported_silicon_rev(uint32_t silicon_rev)
-- 
2.56.0

[PULL 17/34] hw/arm/aspeed_ast1040: Add AST1080 SoC support

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Add initial support for the Aspeed AST1080 SoC. The AST1080 reuses most
of the AST1040 peripheral device models, as the two SoCs share nearly
the same controllers including WDT, SCU, GPIO, SGPIO, ADC, I2C, FMC,
and SPI.

The common initialization and realization functions,
aspeed_soc_ast10x0_g2_init() and aspeed_soc_ast10x0_g2_realize(),
introduced in the previous patches are reused, so AST1080 can
instantiate the existing AST1040 device models without defining
duplicate device types.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 47 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 47 insertions(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index 28abbe70104d..c641f84fbe8c 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -162,6 +162,11 @@ static void aspeed_soc_ast1040_init(Object *obj)
     object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
 }
 
+static void aspeed_soc_ast1080_init(Object *obj)
+{
+    aspeed_soc_ast10x0_g2_init(obj);
+}
+
 static bool aspeed_soc_ast10x0_g2_realize(Aspeed10x0SoCState *a, Error **errp)
 {
     AspeedSoCState *s = ASPEED_SOC(a);
@@ -342,6 +347,15 @@ static void aspeed_soc_ast1040_realize(DeviceState *dev_soc, Error **errp)
                        aspeed_soc_ast1040_get_irq(s, ASPEED_DEV_PECI));
 }
 
+static void aspeed_soc_ast1080_realize(DeviceState *dev_soc, Error **errp)
+{
+    Aspeed10x0SoCState *a = ASPEED10X0_SOC(dev_soc);
+
+    if (!aspeed_soc_ast10x0_g2_realize(a, errp)) {
+        return;
+    }
+}
+
 static void aspeed_soc_ast1040_class_init(ObjectClass *klass, const void *data)
 {
     static const char * const valid_cpu_types[] = {
@@ -370,12 +384,45 @@ static void aspeed_soc_ast1040_class_init(ObjectClass *klass, const void *data)
     sc->num_cpus        = 1;
 }
 
+static void aspeed_soc_ast1080_class_init(ObjectClass *klass, const void *data)
+{
+    static const char * const valid_cpu_types[] = {
+        ARM_CPU_TYPE_NAME("cortex-m4"), /* TODO cortex-m4f */
+        NULL
+    };
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSoCClass *sc = ASPEED_SOC_CLASS(dc);
+
+    /* Reason: The Aspeed SoC can only be instantiated from a board */
+    dc->user_creatable = false;
+    dc->realize = aspeed_soc_ast1080_realize;
+
+    sc->valid_cpu_types = valid_cpu_types;
+    sc->silicon_rev     = AST1080_A0_SILICON_REV;
+    sc->sram_size[0]    = 128 * KiB;
+    sc->sram_size[1]    = 16 * MiB; /* Hyper RAM */
+    sc->uarts_num       = 13;
+    sc->sgpio_num       = 1;
+    sc->wdts_num        = 8;
+    sc->spis_num        = 2;
+    sc->uarts_base      = ASPEED_DEV_UART0;
+    sc->irqmap          = aspeed_soc_ast1040_irqmap;
+    sc->memmap          = aspeed_soc_ast1040_memmap;
+    sc->num_cpus        = 1;
+}
+
 static const TypeInfo aspeed_soc_ast1040_types[] = {
     {
         .name           = "ast1040-a0",
         .parent         = TYPE_ASPEED10X0_SOC,
         .instance_init  = aspeed_soc_ast1040_init,
         .class_init     = aspeed_soc_ast1040_class_init,
+    },
+    {
+        .name           = "ast1080-a0",
+        .parent         = TYPE_ASPEED10X0_SOC,
+        .instance_init  = aspeed_soc_ast1080_init,
+        .class_init     = aspeed_soc_ast1080_class_init,
     }
 };
 
-- 
2.56.0

[PULL 18/34] hw/arm/aspeed_ast1040: Add AST1080 QSPI filters as unimplemented device

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1080 provides three QSPI Filter Controllers (SPI monitors) at
the following addresses:

  QSPI filter #0: 0x74c15000
  QSPI filter #1: 0x74c16000
  QSPI filter #2: 0x74c17000

These controllers are only available on the AST1080. The AST1040 does
not have them, so they are added to the AST1080 specific init and
realize functions instead of the common AST10x0 G2 ones.

The controllers are not modeled yet. Add the register regions as
unimplemented devices to reflect the AST1080 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index c641f84fbe8c..e5c8d15dcbfa 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -101,6 +101,13 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
     { }
 };
 
+static const UnimplementedDeviceConfig aspeed_soc_ast1080_unimp_devs[] = {
+    { "spim0", "aspeed.spim0", 0x74C15000, 0x1000, -1000 },
+    { "spim1", "aspeed.spim1", 0x74C16000, 0x1000, -1000 },
+    { "spim2", "aspeed.spim2", 0x74C17000, 0x1000, -1000 },
+    { }
+};
+
 static qemu_irq aspeed_soc_ast1040_get_irq(AspeedSoCState *s, int dev)
 {
     Aspeed10x0SoCState *a = ASPEED10X0_SOC(s);
@@ -408,6 +415,7 @@ static void aspeed_soc_ast1080_class_init(ObjectClass *klass, const void *data)
     sc->uarts_base      = ASPEED_DEV_UART0;
     sc->irqmap          = aspeed_soc_ast1040_irqmap;
     sc->memmap          = aspeed_soc_ast1040_memmap;
+    sc->unimp_devs      = aspeed_soc_ast1080_unimp_devs;
     sc->num_cpus        = 1;
 }
 
-- 
2.56.0

[PULL 19/34] hw/arm/aspeed_ast1040: Add AST1080 I2C filter as an unimplemented device

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

The AST1080 provides an SMBus Filter Controller (I2C filter) at
0x74c14000, but the controller is not modeled yet.

This controller is only available on the AST1080. The AST1040 does not
have it, so it is added to the AST1080 specific init and realize
functions instead of the common AST10x0 G2 ones.

Add the register region as an unimplemented device to reflect the
AST1080 memory map.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/aspeed_ast1040.c b/hw/arm/aspeed_ast1040.c
index e5c8d15dcbfa..56ef6b1268c4 100644
--- a/hw/arm/aspeed_ast1040.c
+++ b/hw/arm/aspeed_ast1040.c
@@ -102,6 +102,7 @@ static const UnimplementedDeviceConfig aspeed_soc_ast1040_unimp_devs[] = {
 };
 
 static const UnimplementedDeviceConfig aspeed_soc_ast1080_unimp_devs[] = {
+    { "i2c-filter", "aspeed.i2c-filter", 0x74C14000, 0x1000, -1000 },
     { "spim0", "aspeed.spim0", 0x74C15000, 0x1000, -1000 },
     { "spim1", "aspeed.spim1", 0x74C16000, 0x1000, -1000 },
     { "spim2", "aspeed.spim2", 0x74C17000, 0x1000, -1000 },
-- 
2.56.0

[PULL 20/34] hw/arm/aspeed_ast1040_evb: Add AST1080 EVB machine support

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Add a new machine definition ast1080-evb to support the Aspeed AST1080
evaluation board. The new EVB reuses the same BIC framework used by
AST1040, as both SoCs share the same core peripherals and controller
designs.

The AST1080 EVB machine initializes the ast1080-a0 SoC.
This enables QEMU to boot and emulate firmware images for AST1080-based
platforms.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast1040_evb.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/aspeed_ast1040_evb.c b/hw/arm/aspeed_ast1040_evb.c
index 486f0f6a1ba0..9da8021653e0 100644
--- a/hw/arm/aspeed_ast1040_evb.c
+++ b/hw/arm/aspeed_ast1040_evb.c
@@ -75,11 +75,34 @@ static void aspeed_machine_ast1040_evb_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 }
 
+static void aspeed_machine_ast1080_evb_class_init(ObjectClass *oc,
+                                                  const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc = "Aspeed AST1080 Platform Root of Trust (Cortex-M4)";
+    amc->soc_name = "ast1080-a0";
+    amc->hw_strap1 = 0;
+    amc->hw_strap2 = 0;
+    mc->init = aspeed_bic_machine_init;
+    amc->i2c_init = ast1040_evb_i2c_init;
+    mc->default_ram_size = 0;
+    amc->macs_mask = 0;
+    amc->uart_default = ASPEED_DEV_UART12;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
 static const TypeInfo aspeed_ast1040_evb_types[] = {
     {
         .name           = MACHINE_TYPE_NAME("ast1040-evb"),
         .parent         = TYPE_ASPEED_MACHINE,
         .class_init     = aspeed_machine_ast1040_evb_class_init,
+    },
+    {
+        .name           = MACHINE_TYPE_NAME("ast1080-evb"),
+        .parent         = TYPE_ASPEED_MACHINE,
+        .class_init     = aspeed_machine_ast1080_evb_class_init,
     }
 };
 
-- 
2.56.0

[PULL 21/34] tests/functional/arm/aspeed: Add AST1080 test with ASPEED MCU FW Hub v01.00

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Add a functional test for the ASPEED AST1080 EVB using the
Zephyr firmware from ASPEED MCU FW Hub v01.00.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/meson.build            |  1 +
 tests/functional/arm/test_aspeed_ast1080.py | 37 +++++++++++++++++++++
 2 files changed, 38 insertions(+)
 create mode 100644 tests/functional/arm/test_aspeed_ast1080.py

diff --git a/tests/functional/arm/meson.build b/tests/functional/arm/meson.build
index e657ecd27824..72c7afc84a1f 100644
--- a/tests/functional/arm/meson.build
+++ b/tests/functional/arm/meson.build
@@ -38,6 +38,7 @@ tests_arm_system_thorough = [
   'aspeed_ast1030',
   'aspeed_ast1040',
   'aspeed_ast1060',
+  'aspeed_ast1080',
   'aspeed_palmetto',
   'aspeed_romulus',
   'aspeed_witherspoon',
diff --git a/tests/functional/arm/test_aspeed_ast1080.py b/tests/functional/arm/test_aspeed_ast1080.py
new file mode 100644
index 000000000000..76f3cc09835c
--- /dev/null
+++ b/tests/functional/arm/test_aspeed_ast1080.py
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots the ASPEED SoCs with firmware
+#
+# Copyright (C) 2026 ASPEED Technology Inc
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from aspeed import AspeedTest
+from qemu_test import Asset, exec_command_and_wait_for_pattern
+
+
+class AST1080Machine(AspeedTest):
+
+    ASSET_ASPEED_AST1080_EVB_01_00 = Asset(
+        ('https://github.com/AspeedTech-BMC'
+         '/aspeed-mcu-fw-hub/releases/download/v01.00'
+         '/ast1080a0-evb-v01.00.tar.gz'),
+         '7c8a95bc51945d70591b20f1a22f8fffebc2b164e6fda47f73ff67f37bed8d87')
+
+    def test_arm_ast1080_zephyros(self):
+        self.set_machine('ast1080-evb')
+
+        kernel_name = ('ast1080a0-evb-v01.00/ast1080/ast1080a0/evb/'
+                       'zephyr-shell-module.bin')
+        kernel_file = self.archive_extract(
+            self.ASSET_ASPEED_AST1080_EVB_01_00, member=kernel_name)
+
+        self.vm.set_console()
+        self.vm.add_args('-kernel', kernel_file, '-nographic')
+        self.vm.launch()
+        self.wait_for_console_pattern("uart:~$")
+        exec_command_and_wait_for_pattern(self, "help",
+                                          "Available commands")
+
+if __name__ == '__main__':
+    AspeedTest.main()
-- 
2.56.0

[PULL 22/34] docs/system/arm/aspeed: Add AST1080 Platform Root of Trust evaluation board

[Cédric Le Goater]

From: Jamin Lin <jamin_lin@aspeedtech.com>

Update the Aspeed AST10x0 documentation to include the AST1080
evaluation board.

The documentation now describes:
- AST1080 as a Platform Root of Trust processor
- AST1080 Cortex-M4F CPU frequency running at 400 MHz

Also add the ast1080-evb machine entry to the supported AST10x0 SoC
based machine list.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20261015063625.186708-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 2d51ceeb8443..be74ee39fa16 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -441,8 +441,8 @@ Use ``tio`` or another terminal emulator to connect to the consoles:
    $ tio /dev/pts/57
 
 
-Aspeed Bridge IC and Platform Root of Trust processor family boards (``ast1030-evb``, ``ast1040-evb``, ``ast1060-evb``)
-=======================================================================================================================
+Aspeed Bridge IC and Platform Root of Trust processor family boards (``ast1030-evb``, ``ast1040-evb``, ``ast1060-evb``, ``ast1080-evb``)
+========================================================================================================================================
 
 The QEMU Aspeed machines model Bridge ICs and Platform Root of Trust processors
 of various Aspeed evaluation boards. They are based on different members of
@@ -451,9 +451,10 @@ the Aspeed AST10x0 SoC family:
 - AST1030 : Bridge IC
 - AST1040 : Bridge IC
 - AST1060 : Platform Root of Trust processor
+- AST1080 : Platform Root of Trust processor
 
 The AST1030 and AST1060 integrate an Arm Cortex-M4F CPU running at 200 MHz.
-The AST1040 integrates an Arm Cortex-M4F CPU running at 400 MHz.
+The AST1040 and AST1080 integrate an Arm Cortex-M4F CPU running at 400 MHz.
 
 The SoC comes with SRAM, SPI, I2C, etc.
 
@@ -462,6 +463,7 @@ AST10x0 SoC based machines :
 - ``ast1030-evb``          Aspeed AST1030 Evaluation board (Cortex-M4F)
 - ``ast1040-evb``          Aspeed AST1040 Evaluation board (Cortex-M4F)
 - ``ast1060-evb``          Aspeed AST1060 Evaluation board (Cortex-M4F)
+- ``ast1080-evb``          Aspeed AST1080 Evaluation board (Cortex-M4F)
 
 Supported devices
 -----------------
-- 
2.56.0

[PULL 23/34] docs/system/arm/aspeed: add the catalina-bmc machine

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

The Facebook Catalina BMC machine is supported by hw/arm but has never
been listed in the Aspeed documentation. Add it to the AST2600 machine
table.

While at it, shorten the document title. Listing every machine name in
the title duplicates the tables right below it, and made the title (and
its underline) grow past 350 columns. The machine list stays available
where it is readable, in the per-SoC tables.

Reviewed-by: Jamin Lin <jaminlin1207@gmail.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-1-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index be74ee39fa16..d3749c07e848 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -1,5 +1,5 @@
-Aspeed family boards (``anacapa-bmc``, ``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``)
-===============================================================================================================================================================================================================================================================================================================================================
+Aspeed family boards
+====================
 
 The QEMU Aspeed machines model BMCs of various OpenPOWER systems and
 Aspeed evaluation boards. They are based on different releases of the
@@ -33,6 +33,7 @@ AST2600 SoC based machines :
 - ``fuji-bmc``             Facebook Fuji BMC
 - ``bletchley-bmc``        Facebook Bletchley BMC
 - ``fby35-bmc``            Facebook fby35 BMC
+- ``catalina-bmc``         Facebook Catalina BMC
 - ``anacapa-bmc``          Facebook Anacapa BMC
 - ``gb200nvl-bmc``         Nvidia GB200nvl BMC
 
-- 
2.56.0

[PULL 24/34] docs/system/arm/aspeed: add the sanmiguel-bmc machine

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

The Facebook SanMiguel BMC machine is supported by hw/arm but has never
been listed in the Aspeed documentation. Add it to the AST2600 machine
table.

Reviewed-by: Jamin Lin <jaminlin1207@gmail.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-2-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index d3749c07e848..2e23123cc63d 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -34,6 +34,7 @@ AST2600 SoC based machines :
 - ``bletchley-bmc``        Facebook Bletchley BMC
 - ``fby35-bmc``            Facebook fby35 BMC
 - ``catalina-bmc``         Facebook Catalina BMC
+- ``sanmiguel-bmc``        Facebook SanMiguel BMC
 - ``anacapa-bmc``          Facebook Anacapa BMC
 - ``gb200nvl-bmc``         Nvidia GB200nvl BMC
 
-- 
2.56.0

[PULL 25/34] hw/arm: sanmiguel: remove the second SPI flash controller

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

The board only populates the flash device attached to the FMC
controller; the SoC SPI controllers are left unused. Advertising a
part there presents the guest with a flash device the hardware does
not have.

While here, add the missing year to the copyright line.

Reviewed-by: Jamin Lin <jaminlin1207@gmail.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-3-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast2600_sanmiguel.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed_ast2600_sanmiguel.c b/hw/arm/aspeed_ast2600_sanmiguel.c
index 345a9c941671..ac2aef740ad0 100644
--- a/hw/arm/aspeed_ast2600_sanmiguel.c
+++ b/hw/arm/aspeed_ast2600_sanmiguel.c
@@ -1,7 +1,7 @@
 /*
  * Facebook SanMiguel BMC
  *
- * Copyright (c) Meta Platforms, Inc. and affiliates.
+ * Copyright (c) 2026 Meta Platforms, Inc. and affiliates.
  *
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
@@ -384,7 +384,7 @@ static void aspeed_machine_sanmiguel_class_init(ObjectClass *oc,
     amc->hw_strap1 = SANMIGUEL_BMC_HW_STRAP1;
     amc->hw_strap2 = SANMIGUEL_BMC_HW_STRAP2;
     amc->fmc_model = "mx66l1g45g";
-    amc->spi_model = "mx66l1g45g";
+    amc->spi_model = NULL;
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC0_ON;
     amc->i2c_init  = sanmiguel_bmc_i2c_init;
-- 
2.56.0

[PULL 26/34] hw/i2c: pca954x: drop unused header inclusions

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

The qapi/error.h, hw/core/sysbus.h and qemu/module.h headers are
included but not used by i2c_mux_pca954x.c. Remove them.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-4-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/i2c/i2c_mux_pca954x.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/i2c/i2c_mux_pca954x.c b/hw/i2c/i2c_mux_pca954x.c
index c6034460284b..c8e75da8b2ed 100644
--- a/hw/i2c/i2c_mux_pca954x.c
+++ b/hw/i2c/i2c_mux_pca954x.c
@@ -15,15 +15,12 @@
  */
 
 #include "qemu/osdep.h"
-#include "qapi/error.h"
 #include "hw/i2c/i2c.h"
 #include "hw/i2c/i2c_mux_pca954x.h"
 #include "hw/i2c/smbus_slave.h"
 #include "hw/core/qdev.h"
 #include "hw/core/qdev-properties.h"
-#include "hw/core/sysbus.h"
 #include "qemu/log.h"
-#include "qemu/module.h"
 #include "qemu/queue.h"
 #include "qom/object.h"
 #include "trace.h"
-- 
2.56.0

[PULL 27/34] hw/i2c: pca954x: add PCA9545 4-channel mux model

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

The PCA9545 is a 4-channel I2C mux/switch. What sets it apart from the
plain PCA9546 is its interrupt logic: one INTn input per channel and a
shared INT output, both active low, asserted whenever any channel
interrupt is active.

Model this behind a new has_irq class flag. The PCA9545 gains four named
"interrupt" GPIO inputs and an "interrupt-out" output, and its control
read-back merges the latched status nibble; the plain PCA9546/PCA9548
switches keep their previous behaviour.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-5-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/i2c/i2c_mux_pca954x.h |  1 +
 hw/i2c/i2c_mux_pca954x.c         | 71 +++++++++++++++++++++++++++++++-
 2 files changed, 70 insertions(+), 2 deletions(-)

diff --git a/include/hw/i2c/i2c_mux_pca954x.h b/include/hw/i2c/i2c_mux_pca954x.h
index 3dd25ec98309..19a105050565 100644
--- a/include/hw/i2c/i2c_mux_pca954x.h
+++ b/include/hw/i2c/i2c_mux_pca954x.h
@@ -3,6 +3,7 @@
 
 #include "hw/i2c/i2c.h"
 
+#define TYPE_PCA9545 "pca9545"
 #define TYPE_PCA9546 "pca9546"
 #define TYPE_PCA9548 "pca9548"
 
diff --git a/hw/i2c/i2c_mux_pca954x.c b/hw/i2c/i2c_mux_pca954x.c
index c8e75da8b2ed..4bb078a03c4c 100644
--- a/hw/i2c/i2c_mux_pca954x.c
+++ b/hw/i2c/i2c_mux_pca954x.c
@@ -12,12 +12,20 @@
  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
  * for more details.
+ *
+ * Limitations:
+ * - A control write longer than one byte is rejected rather than retaining the
+ *   last received byte as the datasheet specifies.
+ * - On reset the cached per-channel interrupt state is cleared; a downstream
+ *   INT input that stays asserted across the reset is not re-sampled until it
+ *   next toggles.
  */
 
 #include "qemu/osdep.h"
 #include "hw/i2c/i2c.h"
 #include "hw/i2c/i2c_mux_pca954x.h"
 #include "hw/i2c/smbus_slave.h"
+#include "hw/core/irq.h"
 #include "hw/core/qdev.h"
 #include "hw/core/qdev-properties.h"
 #include "qemu/log.h"
@@ -26,11 +34,15 @@
 #include "trace.h"
 
 #define PCA9548_CHANNEL_COUNT 8
+#define PCA9545_CHANNEL_COUNT 4
 #define PCA9546_CHANNEL_COUNT 4
 
 /*
  * struct Pca954xState - The pca954x state object.
  * @control: The value written to the mux control.
+ * @int_status: Per-channel interrupt status, for parts with interrupt logic.
+ * @int_out: The mux INT output, driven low while any channel interrupt is
+ * active.
  * @channel: The set of i2c channel buses that act as channels which own the
  * i2c children.
  */
@@ -38,6 +50,8 @@ typedef struct Pca954xState {
     SMBusDevice parent;
 
     uint8_t control;
+    uint8_t int_status;
+    qemu_irq int_out;
 
     bool enabled[PCA9548_CHANNEL_COUNT];
     I2CBus *bus[PCA9548_CHANNEL_COUNT];
@@ -48,11 +62,13 @@ typedef struct Pca954xState {
 /*
  * struct Pca954xClass - The pca954x class object.
  * @nchans: The number of i2c channels this device has.
+ * @has_irq: Whether the part implements interrupt logic.
  */
 typedef struct Pca954xClass {
     SMBusDeviceClass parent;
 
     uint8_t nchans;
+    bool has_irq;
 } Pca954xClass;
 
 #define TYPE_PCA954X "pca954x"
@@ -116,8 +132,10 @@ static void pca954x_enable_channel(Pca954xState *s, uint8_t enable_mask)
 
 static void pca954x_write(Pca954xState *s, uint8_t data)
 {
-    s->control = data;
-    pca954x_enable_channel(s, data);
+    Pca954xClass *c = PCA954X_GET_CLASS(s);
+
+    s->control = c->has_irq ? data & ((1 << c->nchans) - 1) : data;
+    pca954x_enable_channel(s, s->control);
 
     trace_pca954x_write_bytes(data);
 }
@@ -148,16 +166,45 @@ static int pca954x_write_data(SMBusDevice *d, uint8_t *buf, uint8_t len)
 static uint8_t pca954x_read_byte(SMBusDevice *d)
 {
     Pca954xState *s = PCA954X(d);
+    Pca954xClass *c = PCA954X_GET_CLASS(s);
     uint8_t data = s->control;
+
+    /*
+     * On parts with interrupt logic the read-back byte carries the per-channel
+     * interrupt status in the upper nibble.
+     */
+    if (c->has_irq) {
+        data = (s->int_status << 4) | (s->control & 0x0f);
+    }
+
     trace_pca954x_read_data(data);
     return data;
 }
 
+/*
+ * A downstream device drives one of the INTn inputs. INTn and INT are active
+ * low, and both carry the physical level: 0 is asserted, 1 is idle.
+ */
+static void pca954x_irq_handler(void *opaque, int n, int level)
+{
+    Pca954xState *s = PCA954X(opaque);
+
+    if (level) {
+        s->int_status &= ~(1 << n);
+    } else {
+        s->int_status |= (1 << n);
+    }
+
+    qemu_set_irq(s->int_out, s->int_status == 0);
+}
+
 static void pca954x_enter_reset(Object *obj, ResetType type)
 {
     Pca954xState *s = PCA954X(obj);
     /* Reset will disable all channels. */
     pca954x_write(s, 0);
+    s->int_status = 0;
+    qemu_set_irq(s->int_out, 1); /* INT released */
 }
 
 I2CBus *pca954x_i2c_get_bus(I2CSlave *mux, uint8_t channel)
@@ -169,6 +216,13 @@ I2CBus *pca954x_i2c_get_bus(I2CSlave *mux, uint8_t channel)
     return pca954x->bus[channel];
 }
 
+static void pca9545_class_init(ObjectClass *klass, const void *data)
+{
+    Pca954xClass *s = PCA954X_CLASS(klass);
+    s->nchans = PCA9545_CHANNEL_COUNT;
+    s->has_irq = true;
+}
+
 static void pca9546_class_init(ObjectClass *klass, const void *data)
 {
     Pca954xClass *s = PCA954X_CLASS(klass);
@@ -184,12 +238,20 @@ static void pca9548_class_init(ObjectClass *klass, const void *data)
 static void pca954x_realize(DeviceState *dev, Error **errp)
 {
     Pca954xState *s = PCA954X(dev);
+    Pca954xClass *c = PCA954X_GET_CLASS(dev);
     DeviceState *d = DEVICE(s);
     if (s->name) {
         d->id = g_strdup(s->name);
     } else {
         d->id = g_strdup_printf("pca954x[%x]", s->parent.i2c.address);
     }
+
+    if (c->has_irq) {
+        /* One INTn input per channel, plus the shared INT output. */
+        qdev_init_gpio_in_named(dev, pca954x_irq_handler, "interrupt",
+                                c->nchans);
+        qdev_init_gpio_out_named(dev, &s->int_out, "interrupt-out", 1);
+    }
 }
 
 static void pca954x_init(Object *obj)
@@ -242,6 +304,11 @@ static const TypeInfo pca954x_info[] = {
         .class_init    = pca954x_class_init,
         .abstract      = true,
     },
+    {
+        .name          = TYPE_PCA9545,
+        .parent        = TYPE_PCA954X,
+        .class_init    = pca9545_class_init,
+    },
     {
         .name          = TYPE_PCA9546,
         .parent        = TYPE_PCA954X,
-- 
2.56.0

[PULL 28/34] hw/i2c: pca954x: migrate mux state

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

The pca954x model had no VMStateDescription, so neither the channel
selection nor the PCA9545 interrupt status survived a migration.

This changes the migration stream of the pre-existing PCA9546 and
PCA9548, which an older QEMU rejects.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-6-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/i2c/i2c_mux_pca954x.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/hw/i2c/i2c_mux_pca954x.c b/hw/i2c/i2c_mux_pca954x.c
index 4bb078a03c4c..597e57d99a40 100644
--- a/hw/i2c/i2c_mux_pca954x.c
+++ b/hw/i2c/i2c_mux_pca954x.c
@@ -28,6 +28,7 @@
 #include "hw/core/irq.h"
 #include "hw/core/qdev.h"
 #include "hw/core/qdev-properties.h"
+#include "migration/vmstate.h"
 #include "qemu/log.h"
 #include "qemu/queue.h"
 #include "qom/object.h"
@@ -270,6 +271,28 @@ static void pca954x_init(Object *obj)
     }
 }
 
+static int pca954x_post_load(void *opaque, int version_id)
+{
+    Pca954xState *s = PCA954X(opaque);
+
+    pca954x_enable_channel(s, s->control);
+    qemu_set_irq(s->int_out, s->int_status == 0);
+    return 0;
+}
+
+static const VMStateDescription vmstate_pca954x = {
+    .name = "pca954x",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .post_load = pca954x_post_load,
+    .fields = (const VMStateField[]) {
+        VMSTATE_SMBUS_DEVICE(parent, Pca954xState),
+        VMSTATE_UINT8(control, Pca954xState),
+        VMSTATE_UINT8(int_status, Pca954xState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static const Property pca954x_props[] = {
     DEFINE_PROP_STRING("name", Pca954xState, name),
 };
@@ -287,6 +310,7 @@ static void pca954x_class_init(ObjectClass *klass, const void *data)
 
     dc->desc = "Pca954x i2c-mux";
     dc->realize = pca954x_realize;
+    dc->vmsd = &vmstate_pca954x;
 
     k->write_data = pca954x_write_data;
     k->receive_byte = pca954x_read_byte;
-- 
2.56.0

[PULL 29/34] tests/qtest: pca9545: add mux test

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

Exercise the PCA9545 4-channel I2C mux: channel selection through the
control byte, upper-nibble read-back, and interrupt logic.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-7-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/qtest/pca9545-test.c | 116 +++++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build    |   1 +
 2 files changed, 117 insertions(+)
 create mode 100644 tests/qtest/pca9545-test.c

diff --git a/tests/qtest/pca9545-test.c b/tests/qtest/pca9545-test.c
new file mode 100644
index 000000000000..91f56db92fe1
--- /dev/null
+++ b/tests/qtest/pca9545-test.c
@@ -0,0 +1,116 @@
+/*
+ * QTest testcase for the PCA9545 4-channel I2C switch with interrupt logic
+ *
+ * Copyright (c) 2026 Meta Platforms, Inc. and affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "libqtest-single.h"
+#include "libqos/qgraph.h"
+#include "libqos/i2c.h"
+
+#define PCA9545_TEST_ID   "pca9545-test"
+#define PCA9545_TEST_ADDR 0x70
+#define PCA9545_TEST_PATH "/machine/peripheral/" PCA9545_TEST_ID
+
+/* INTn and INT are active low: level 0 is asserted. */
+#define INT_ASSERTED   0
+#define INT_RELEASED   1
+
+/* The mux has no register pointer: a read/write moves a single control byte. */
+static uint8_t pca9545_get(QI2CDevice *dev)
+{
+    uint8_t val;
+
+    qi2c_recv(dev, &val, 1);
+    return val;
+}
+
+static void pca9545_set(QI2CDevice *dev, uint8_t val)
+{
+    qi2c_send(dev, &val, 1);
+}
+
+static void pca9545_set_int(unsigned chan, int level)
+{
+    qtest_set_irq_in(global_qtest, PCA9545_TEST_PATH, "interrupt", chan, level);
+}
+
+/* Channel selection is the lower nibble; the upper nibble reads back 0. */
+static void test_channel_select(void *obj, void *data, QGuestAllocator *alloc)
+{
+    QI2CDevice *dev = (QI2CDevice *)obj;
+
+    g_assert_cmphex(pca9545_get(dev), ==, 0x00);
+
+    pca9545_set(dev, 0x05); /* channels 0 and 2 */
+    g_assert_cmphex(pca9545_get(dev), ==, 0x05);
+
+    pca9545_set(dev, 0x0f); /* all channels */
+    g_assert_cmphex(pca9545_get(dev), ==, 0x0f);
+
+    pca9545_set(dev, 0x00);
+    g_assert_cmphex(pca9545_get(dev), ==, 0x00);
+}
+
+/*
+ * The interrupt status is reported in the upper nibble (INT3..INT0) and is
+ * latched regardless of which channels are selected (PCA9545A Table 5).
+ */
+static void test_interrupt_status(void *obj, void *data, QGuestAllocator *alloc)
+{
+    QI2CDevice *dev = (QI2CDevice *)obj;
+
+    pca9545_set_int(1, INT_ASSERTED);
+    g_assert_cmphex(pca9545_get(dev), ==, 0x20);
+
+    pca9545_set(dev, 0x01);
+    pca9545_set_int(3, INT_ASSERTED);
+    g_assert_cmphex(pca9545_get(dev), ==, 0xa1); /* INT3 | INT1 | channel 0 */
+
+    pca9545_set_int(1, INT_RELEASED);
+    g_assert_cmphex(pca9545_get(dev), ==, 0x81); /* INT3 | channel 0 */
+}
+
+/* The INT output is pulled low while any channel interrupt is active. */
+static void test_interrupt_output(void *obj, void *data, QGuestAllocator *alloc)
+{
+    qtest_irq_intercept_out_named(global_qtest, PCA9545_TEST_PATH,
+                                  "interrupt-out");
+
+    /*
+     * Interception starts with no recorded level, so drive an idle input
+     * first to make the mux publish the released state of its output.
+     */
+    pca9545_set_int(0, INT_RELEASED);
+    g_assert_true(get_irq(0));
+
+    pca9545_set_int(0, INT_ASSERTED);
+    g_assert_false(get_irq(0));
+
+    pca9545_set_int(2, INT_ASSERTED);
+    g_assert_false(get_irq(0));
+
+    pca9545_set_int(0, INT_RELEASED);
+    g_assert_false(get_irq(0));
+    pca9545_set_int(2, INT_RELEASED);
+    g_assert_true(get_irq(0));
+}
+
+static void pca9545_register_nodes(void)
+{
+    QOSGraphEdgeOptions opts = {
+        .extra_device_opts = "id=" PCA9545_TEST_ID ",address=0x70"
+    };
+    add_qi2c_address(&opts, &(QI2CAddress) { PCA9545_TEST_ADDR });
+
+    qos_node_create_driver("pca9545", i2c_device_create);
+    qos_node_consumes("pca9545", "i2c-bus", &opts);
+
+    qos_add_test("channel-select", "pca9545", test_channel_select, NULL);
+    qos_add_test("interrupt-status", "pca9545", test_interrupt_status, NULL);
+    qos_add_test("interrupt-output", "pca9545", test_interrupt_output, NULL);
+}
+libqos_init(pca9545_register_nodes);
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index 46d4fc1d2b03..c461d2a4a104 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -342,6 +342,7 @@ qos_test_ss.add(
   'ne2000-test.c',
   'tulip-test.c',
   'nvme-test.c',
+  'pca9545-test.c',
   'pca9552-test.c',
   'pca9554-test.c',
   'pca9555-test.c',
-- 
2.56.0

[PULL 30/34] hw/rtc: ds1338: move TYPE_DS1338 to a public header

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

Move the TYPE_DS1338 type name definition from ds1338.c into a new
include/hw/rtc/ds1338.h header so that boards instantiating the device
no longer need to redefine the type name string locally.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-8-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/rtc/ds1338.h | 20 ++++++++++++++++++++
 hw/rtc/ds1338.c         |  2 +-
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/rtc/ds1338.h

diff --git a/include/hw/rtc/ds1338.h b/include/hw/rtc/ds1338.h
new file mode 100644
index 000000000000..f4cfe6a8e762
--- /dev/null
+++ b/include/hw/rtc/ds1338.h
@@ -0,0 +1,20 @@
+/*
+ * MAXIM DS1338 I2C RTC+NVRAM
+ *
+ * Copyright (c) 2009 CodeSourcery.
+ * Written by Paul Brook
+ *
+ * This code is licensed under the GNU GPL v2.
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_RTC_DS1338_H
+#define HW_RTC_DS1338_H
+
+#define TYPE_DS1338 "ds1338"
+
+#endif
diff --git a/hw/rtc/ds1338.c b/hw/rtc/ds1338.c
index 5f1ee2e410af..f8b3340bf0f5 100644
--- a/hw/rtc/ds1338.c
+++ b/hw/rtc/ds1338.c
@@ -12,6 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/i2c/i2c.h"
+#include "hw/rtc/ds1338.h"
 #include "migration/vmstate.h"
 #include "qemu/bcd.h"
 #include "qom/object.h"
@@ -29,7 +30,6 @@
 #define HOURS_PM   0x20
 #define CTRL_OSF   0x20
 
-#define TYPE_DS1338 "ds1338"
 OBJECT_DECLARE_SIMPLE_TYPE(DS1338State, DS1338)
 
 struct DS1338State {
-- 
2.56.0

[PULL 31/34] hw: ds1338: use the TYPE_DS1338 constant instead of the "ds1338" string

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

Now that TYPE_DS1338 is exposed by include/hw/rtc/ds1338.h, use it in
the machines that instantiate the RTC by its raw type name string.

No functional change.

Reviewed-by: Jamin Lin <jaminlin1207@gmail.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Bernhard Beschow <sgentey@gmail.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-9-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast2400_palmetto.c          | 4 +++-
 hw/arm/aspeed_ast2400_supermicrox11.c     | 4 +++-
 hw/arm/aspeed_ast2500_romulus.c           | 4 +++-
 hw/arm/aspeed_ast2500_supermicro-x11spi.c | 4 +++-
 hw/arm/aspeed_ast2500_witherspoon.c       | 4 +++-
 hw/arm/aspeed_ast2600_bletchley.c         | 3 ++-
 hw/arm/aspeed_ast2600_catalina.c          | 2 +-
 hw/arm/aspeed_ast2600_sanmiguel.c         | 3 +--
 hw/arm/realview.c                         | 3 ++-
 hw/arm/versatilepb.c                      | 3 ++-
 hw/ppc/e500.c                             | 3 ++-
 hw/riscv/tt_atlantis.c                    | 3 ++-
 12 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/hw/arm/aspeed_ast2400_palmetto.c b/hw/arm/aspeed_ast2400_palmetto.c
index e2350e5b6ca6..185185f0bb46 100644
--- a/hw/arm/aspeed_ast2400_palmetto.c
+++ b/hw/arm/aspeed_ast2400_palmetto.c
@@ -11,6 +11,7 @@
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/i2c/smbus_eeprom.h"
+#include "hw/rtc/ds1338.h"
 
 /* Palmetto hardware value: 0x120CE416 */
 #define PALMETTO_BMC_HW_STRAP1 (                                        \
@@ -36,7 +37,8 @@ static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
      * The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing
      */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "ds1338", 0x68);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), TYPE_DS1338,
+                            0x68);
 
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50,
                           eeprom_buf);
diff --git a/hw/arm/aspeed_ast2400_supermicrox11.c b/hw/arm/aspeed_ast2400_supermicrox11.c
index c75898cc6d1a..051e072c5a05 100644
--- a/hw/arm/aspeed_ast2400_supermicrox11.c
+++ b/hw/arm/aspeed_ast2400_supermicrox11.c
@@ -11,6 +11,7 @@
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/i2c/smbus_eeprom.h"
+#include "hw/rtc/ds1338.h"
 
 /* TODO: Find the actual hardware value */
 #define SUPERMICROX11_BMC_HW_STRAP1 (                                   \
@@ -36,7 +37,8 @@ static void supermicrox11_bmc_i2c_init(AspeedMachineState *bmc)
      * The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing
      */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "ds1338", 0x68);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), TYPE_DS1338,
+                            0x68);
 
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50,
                           eeprom_buf);
diff --git a/hw/arm/aspeed_ast2500_romulus.c b/hw/arm/aspeed_ast2500_romulus.c
index 340a74408b62..87f90ed361c3 100644
--- a/hw/arm/aspeed_ast2500_romulus.c
+++ b/hw/arm/aspeed_ast2500_romulus.c
@@ -10,6 +10,7 @@
 #include "qapi/error.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
+#include "hw/rtc/ds1338.h"
 
 /* Romulus hardware value: 0xF10AD206 */
 #define ROMULUS_BMC_HW_STRAP1 (                                         \
@@ -29,7 +30,8 @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
      * The romulus board expects Epson RX8900 I2C RTC but a ds1338 is
      * good enough
      */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), TYPE_DS1338,
+                            0x32);
 }
 
 static void aspeed_machine_romulus_class_init(ObjectClass *oc,
diff --git a/hw/arm/aspeed_ast2500_supermicro-x11spi.c b/hw/arm/aspeed_ast2500_supermicro-x11spi.c
index 5a7e49d6ccdb..dc0248422d43 100644
--- a/hw/arm/aspeed_ast2500_supermicro-x11spi.c
+++ b/hw/arm/aspeed_ast2500_supermicro-x11spi.c
@@ -11,6 +11,7 @@
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/i2c/smbus_eeprom.h"
+#include "hw/rtc/ds1338.h"
 
 /* TODO: Find the actual hardware value */
 #define SUPERMICRO_X11SPI_BMC_HW_STRAP1 (                               \
@@ -32,7 +33,8 @@ static void supermicro_x11spi_bmc_i2c_init(AspeedMachineState *bmc)
      * The palmetto platform expects a ds3231 RTC but a ds1338 is
      * enough to provide basic RTC features. Alarms will be missing
      */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "ds1338", 0x68);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), TYPE_DS1338,
+                            0x68);
 
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50,
                           eeprom_buf);
diff --git a/hw/arm/aspeed_ast2500_witherspoon.c b/hw/arm/aspeed_ast2500_witherspoon.c
index 26ddb6734702..c69065846c24 100644
--- a/hw/arm/aspeed_ast2500_witherspoon.c
+++ b/hw/arm/aspeed_ast2500_witherspoon.c
@@ -14,6 +14,7 @@
 #include "hw/sensor/tmp105.h"
 #include "hw/i2c/smbus_eeprom.h"
 #include "hw/gpio/pca9552.h"
+#include "hw/rtc/ds1338.h"
 
 /* Witherspoon hardware value: 0xF10AD216 */
 #define WITHERSPOON_BMC_HW_STRAP1 (                                     \
@@ -70,7 +71,8 @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
      * The witherspoon board expects Epson RX8900 I2C RTC but a ds1338 is
      * good enough
      */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), TYPE_DS1338,
+                            0x32);
 
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 11), 0x51,
                           eeprom_buf);
diff --git a/hw/arm/aspeed_ast2600_bletchley.c b/hw/arm/aspeed_ast2600_bletchley.c
index 6fa606c047e6..0e746055a218 100644
--- a/hw/arm/aspeed_ast2600_bletchley.c
+++ b/hw/arm/aspeed_ast2600_bletchley.c
@@ -12,6 +12,7 @@
 #include "hw/arm/aspeed_soc.h"
 #include "hw/gpio/pca9552.h"
 #include "hw/nvram/eeprom_at24c.h"
+#include "hw/rtc/ds1338.h"
 
 #define TYPE_TMP421 "tmp421"
 /* Bletchley hardware value */
@@ -44,7 +45,7 @@ static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
     /* Bus 6 */
     at24c_eeprom_init(i2c[6], 0x56, 65536);
     /* Missing model: nxp,pcf85263 @ 0x51 , but ds1338 works enough */
-    i2c_slave_create_simple(i2c[6], "ds1338", 0x51);
+    i2c_slave_create_simple(i2c[6], TYPE_DS1338, 0x51);
 
 
     /* Bus 7 */
diff --git a/hw/arm/aspeed_ast2600_catalina.c b/hw/arm/aspeed_ast2600_catalina.c
index 4f2b396f6f0c..b15d932086cf 100644
--- a/hw/arm/aspeed_ast2600_catalina.c
+++ b/hw/arm/aspeed_ast2600_catalina.c
@@ -14,6 +14,7 @@
 #include "hw/gpio/pca9552.h"
 #include "hw/gpio/pca9554.h"
 #include "hw/nvram/eeprom_at24c.h"
+#include "hw/rtc/ds1338.h"
 #include "hw/sensor/tmp105.h"
 
 /* Catalina hardware value */
@@ -22,7 +23,6 @@
 #define CATALINA_BMC_RAM_SIZE (2 * GiB)
 
 #define TYPE_TMP421 "tmp421"
-#define TYPE_DS1338 "ds1338"
 
 /*
  * "BMC Storage Module" FRU data.  Generated with frugen.
diff --git a/hw/arm/aspeed_ast2600_sanmiguel.c b/hw/arm/aspeed_ast2600_sanmiguel.c
index ac2aef740ad0..b0935683e2fc 100644
--- a/hw/arm/aspeed_ast2600_sanmiguel.c
+++ b/hw/arm/aspeed_ast2600_sanmiguel.c
@@ -13,6 +13,7 @@
 #include "hw/gpio/pca9552.h"
 #include "hw/gpio/pca9554.h"
 #include "hw/nvram/eeprom_at24c.h"
+#include "hw/rtc/ds1338.h"
 #include "hw/sensor/tmp105.h"
 
 /* SanMiguel hardware values */
@@ -20,8 +21,6 @@
 #define SANMIGUEL_BMC_HW_STRAP2 0x00000000
 #define SANMIGUEL_BMC_RAM_SIZE (2 * GiB)
 
-#define TYPE_DS1338 "ds1338"
-
 /*
  * "Front IO" FRU data. Generated with frugen.
  *
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index ceba0331b08c..4cdf939511d1 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -28,6 +28,7 @@
 #include "hw/intc/realview_gic.h"
 #include "hw/core/irq.h"
 #include "hw/i2c/arm_sbcon_i2c.h"
+#include "hw/rtc/ds1338.h"
 #include "hw/sd/sd.h"
 #include "target/arm/cpu-qom.h"
 
@@ -323,7 +324,7 @@ static void realview_init(MachineState *machine,
 
     dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, 0x10002000, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
-    i2c_slave_create_simple(i2c, "ds1338", 0x68);
+    i2c_slave_create_simple(i2c, TYPE_DS1338, 0x68);
 
     /* Memory map for RealView Emulation Baseboard:  */
     /* 0x10000000 System registers.  */
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index f94bf96599e0..737cd21c27f7 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -18,6 +18,7 @@
 #include "hw/pci/pci.h"
 #include "hw/i2c/i2c.h"
 #include "hw/i2c/arm_sbcon_i2c.h"
+#include "hw/rtc/ds1338.h"
 #include "hw/core/irq.h"
 #include "hw/core/boards.h"
 #include "hw/block/flash.h"
@@ -346,7 +347,7 @@ static void versatile_init(MachineState *machine, int board_id)
 
     dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, 0x10002000, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
-    i2c_slave_create_simple(i2c, "ds1338", 0x68);
+    i2c_slave_create_simple(i2c, TYPE_DS1338, 0x68);
 
     /* Add PL041 AACI Interface to the LM4549 codec */
     pl041 = qdev_new("pl041");
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 1876882a0407..469cef9d2f61 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -50,6 +50,7 @@
 #include "hw/core/platform-bus.h"
 #include "hw/net/fsl_etsec/etsec.h"
 #include "hw/i2c/i2c.h"
+#include "hw/rtc/ds1338.h"
 #include "hw/core/irq.h"
 #include "hw/sd/sdhci.h"
 #include "hw/misc/unimp.h"
@@ -1025,7 +1026,7 @@ void ppce500_init(MachineState *machine)
     memory_region_add_subregion(ccsr_addr_space, MPC8544_I2C_REGS_OFFSET,
                                 sysbus_mmio_get_region(s, 0));
     i2c = I2C_BUS(qdev_get_child_bus(dev, "i2c"));
-    i2c_slave_create_simple(i2c, "ds1338", RTC_REGS_OFFSET);
+    i2c_slave_create_simple(i2c, TYPE_DS1338, RTC_REGS_OFFSET);
 
     /* eSDHC */
     if (pmc->has_esdhc) {
diff --git a/hw/riscv/tt_atlantis.c b/hw/riscv/tt_atlantis.c
index 311de64eda55..df89a525433d 100644
--- a/hw/riscv/tt_atlantis.c
+++ b/hw/riscv/tt_atlantis.c
@@ -27,6 +27,7 @@
 #include "hw/char/dw8250.h"
 #include "hw/intc/riscv_aclint.h"
 #include "hw/misc/tt_atlantis_prcm.h"
+#include "hw/rtc/ds1338.h"
 
 #include "system/system.h"
 #include "system/device_tree.h"
@@ -768,7 +769,7 @@ static void tt_atlantis_machine_init(MachineState *machine)
     qdev_realize(DEVICE(&ams->soc), NULL, &error_fatal);
 
     /* I2C peripherals: qemu specific */
-    i2c_slave_create_simple(i2c_get_bus(s, 0), "ds1338", 0x6f);
+    i2c_slave_create_simple(i2c_get_bus(s, 0), TYPE_DS1338, 0x6f);
     i2c_slave_create_simple(i2c_get_bus(s, 4), "tmp105", 0x48);
 
     /* Load or create device tree */
-- 
2.56.0

[PULL 32/34] hw/rtc: ds1338: implement Resettable reset

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

The device relied on device_class_set_legacy_reset(), a compatibility
shim around the legacy DeviceState reset hook. Convert ds1338_reset()
into a proper Resettable hold phase, dropping the legacy shim.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-10-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/rtc/ds1338.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/rtc/ds1338.c b/hw/rtc/ds1338.c
index f8b3340bf0f5..74aee6c74633 100644
--- a/hw/rtc/ds1338.c
+++ b/hw/rtc/ds1338.c
@@ -208,9 +208,9 @@ static int ds1338_send(I2CSlave *i2c, uint8_t data)
     return 0;
 }
 
-static void ds1338_reset(DeviceState *dev)
+static void ds1338_reset_hold(Object *obj, ResetType type)
 {
-    DS1338State *s = DS1338(dev);
+    DS1338State *s = DS1338(obj);
 
     /* The clock is running and synchronized with the host */
     s->offset = 0;
@@ -224,11 +224,12 @@ static void ds1338_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
     k->event = ds1338_event;
     k->recv = ds1338_recv;
     k->send = ds1338_send;
-    device_class_set_legacy_reset(dc, ds1338_reset);
+    rc->phases.hold = ds1338_reset_hold;
     dc->vmsd = &vmstate_ds1338;
 }
 
-- 
2.56.0

[PULL 33/34] hw/rtc: ds1338: prefix the file-local helpers with ds1338_

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

Two static helpers predate the rest of the file and carry no device
prefix.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-11-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/rtc/ds1338.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/rtc/ds1338.c b/hw/rtc/ds1338.c
index 74aee6c74633..1755a3a37c1d 100644
--- a/hw/rtc/ds1338.c
+++ b/hw/rtc/ds1338.c
@@ -57,7 +57,7 @@ static const VMStateDescription vmstate_ds1338 = {
     }
 };
 
-static void capture_current_time(DS1338State *s)
+static void ds1338_capture_current_time(DS1338State *s)
 {
     /* Capture the current time into the secondary registers
      * which will be actually read by the data transfer operation.
@@ -85,7 +85,7 @@ static void capture_current_time(DS1338State *s)
     s->nvram[6] = to_bcd(now.tm_year - 100);
 }
 
-static void inc_regptr(DS1338State *s)
+static void ds1338_inc_regptr(DS1338State *s)
 {
     /* The register pointer wraps around after 0x3F; wraparound
      * causes the current time/date to be retransferred into
@@ -93,7 +93,7 @@ static void inc_regptr(DS1338State *s)
      */
     s->ptr = (s->ptr + 1) & (NVRAM_SIZE - 1);
     if (!s->ptr) {
-        capture_current_time(s);
+        ds1338_capture_current_time(s);
     }
 }
 
@@ -108,7 +108,7 @@ static int ds1338_event(I2CSlave *i2c, enum i2c_event event)
          * START_SEND, because the guest can't get at that data
          * without going through a START_RECV which would overwrite it.
          */
-        capture_current_time(s);
+        ds1338_capture_current_time(s);
         break;
     case I2C_START_SEND:
         s->addr_byte = true;
@@ -129,7 +129,7 @@ static uint8_t ds1338_recv(I2CSlave *i2c)
 
     trace_ds1338_recv(s->ptr, res);
 
-    inc_regptr(s);
+    ds1338_inc_regptr(s);
     return res;
 }
 
@@ -204,7 +204,7 @@ static int ds1338_send(I2CSlave *i2c, uint8_t data)
     } else {
         s->nvram[s->ptr] = data;
     }
-    inc_regptr(s);
+    ds1338_inc_regptr(s);
     return 0;
 }
 
-- 
2.56.0

[PULL 34/34] hw/rtc: ds1338: parameterise the register map via a device class

[Cédric Le Goater]

From: Emmanuel Blot <emmanuel.blot@free.fr>

In preparation for a register-compatible variant, refactor DS1338
register map. Introduce DS1338Class, carrying the register-pointer wrap
boundary and the control/OSF register location and masks, and drive
inc_regptr() and the control-register handling.

The control-register power-on value is parameterised along with them,
so the part comes up holding the contents its datasheet specifies
rather than zero, and its oscillator-stop flag now reads set at
power-on.

Encode the year register modulo 100 (tm_year % 100) instead of
tm_year - 100.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@free.fr>
Link: https://lore.kernel.org/qemu-devel/20261015-bmc-minerva-v3-12-7d50c8a108e5@free.fr
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/rtc/ds1338.c | 71 ++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 53 insertions(+), 18 deletions(-)

diff --git a/hw/rtc/ds1338.c b/hw/rtc/ds1338.c
index 1755a3a37c1d..7eaa6631137a 100644
--- a/hw/rtc/ds1338.c
+++ b/hw/rtc/ds1338.c
@@ -30,7 +30,14 @@
 #define HOURS_PM   0x20
 #define CTRL_OSF   0x20
 
-OBJECT_DECLARE_SIMPLE_TYPE(DS1338State, DS1338)
+/* DS1338 register map */
+#define DS1338_NUM_REGS    NVRAM_SIZE   /* 0x00..0x3f, then wraps */
+#define DS1338_CONTROL     0x07
+#define DS1338_CTRL_MASK   0xb3         /* bits 2, 3 and 6 read back as zero */
+/* POR: OUT, OSF, SQWE and both rate-select bits come up set. */
+#define DS1338_CTRL_RESET  0xb3
+
+OBJECT_DECLARE_TYPE(DS1338State, DS1338Class, DS1338)
 
 struct DS1338State {
     I2CSlave parent_obj;
@@ -42,6 +49,17 @@ struct DS1338State {
     bool addr_byte;
 };
 
+struct DS1338Class {
+    I2CSlaveClass parent_class;
+
+    uint8_t num_regs;       /* register-pointer wrap boundary */
+    uint8_t ctrl_addr;      /* control register address */
+    uint8_t ctrl_mask;      /* writable/read-back bits of the control reg */
+    uint8_t osf_addr;       /* register holding the OSF flag */
+    uint8_t osf_mask;       /* OSF bit within osf_addr */
+    uint8_t ctrl_reset;     /* control-register power-on value */
+};
+
 static const VMStateDescription vmstate_ds1338 = {
     .name = "ds1338",
     .version_id = 2,
@@ -82,16 +100,19 @@ static void ds1338_capture_current_time(DS1338State *s)
     s->nvram[3] = (now.tm_wday + s->wday_offset) % 7 + 1;
     s->nvram[4] = to_bcd(now.tm_mday);
     s->nvram[5] = to_bcd(now.tm_mon + 1);
-    s->nvram[6] = to_bcd(now.tm_year - 100);
+    s->nvram[6] = to_bcd(now.tm_year % 100);
 }
 
 static void ds1338_inc_regptr(DS1338State *s)
 {
-    /* The register pointer wraps around after 0x3F; wraparound
-     * causes the current time/date to be retransferred into
-     * the secondary registers.
+    DS1338Class *k = DS1338_GET_CLASS(s);
+
+    /*
+     * The register pointer wraps around after the last register; wraparound
+     * causes the current time/date to be retransferred into the secondary
+     * registers.
      */
-    s->ptr = (s->ptr + 1) & (NVRAM_SIZE - 1);
+    s->ptr = (s->ptr + 1) % k->num_regs;
     if (!s->ptr) {
         ds1338_capture_current_time(s);
     }
@@ -136,11 +157,12 @@ static uint8_t ds1338_recv(I2CSlave *i2c)
 static int ds1338_send(I2CSlave *i2c, uint8_t data)
 {
     DS1338State *s = DS1338(i2c);
+    DS1338Class *k = DS1338_GET_CLASS(i2c);
 
     trace_ds1338_send(s->ptr, data);
 
     if (s->addr_byte) {
-        s->ptr = data & (NVRAM_SIZE - 1);
+        s->ptr = data % k->num_regs;
         s->addr_byte = false;
         return 0;
     }
@@ -190,18 +212,19 @@ static int ds1338_send(I2CSlave *i2c, uint8_t data)
             break;
         }
         s->offset = qemu_timedate_diff(&now);
-    } else if (s->ptr == 7) {
-        /* Control register. */
-
-        /* Ensure bits 2, 3 and 6 will read back as zero. */
-        data &= 0xB3;
-
-        /* Attempting to write the OSF flag to logic 1 leaves the
-           value unchanged. */
-        data = (data & ~CTRL_OSF) | (data & s->nvram[s->ptr] & CTRL_OSF);
-
-        s->nvram[s->ptr] = data;
     } else {
+        if (s->ptr == k->ctrl_addr) {
+            /* Control register: reserved bits read back as zero. */
+            data &= k->ctrl_mask;
+        }
+        if (s->ptr == k->osf_addr) {
+            /*
+             * Attempting to write the OSF flag to logic 1 leaves the
+             * value unchanged.
+             */
+            data = (data & ~k->osf_mask) |
+                   (data & s->nvram[s->ptr] & k->osf_mask);
+        }
         s->nvram[s->ptr] = data;
     }
     ds1338_inc_regptr(s);
@@ -211,11 +234,13 @@ static int ds1338_send(I2CSlave *i2c, uint8_t data)
 static void ds1338_reset_hold(Object *obj, ResetType type)
 {
     DS1338State *s = DS1338(obj);
+    DS1338Class *k = DS1338_GET_CLASS(s);
 
     /* The clock is running and synchronized with the host */
     s->offset = 0;
     s->wday_offset = 0;
     memset(s->nvram, 0, NVRAM_SIZE);
+    s->nvram[k->ctrl_addr] = k->ctrl_reset;
     s->ptr = 0;
     s->addr_byte = false;
 }
@@ -225,12 +250,21 @@ static void ds1338_class_init(ObjectClass *klass, const void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     I2CSlaveClass *k = I2C_SLAVE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DS1338Class *dsc = DS1338_CLASS(klass);
 
     k->event = ds1338_event;
     k->recv = ds1338_recv;
     k->send = ds1338_send;
     rc->phases.hold = ds1338_reset_hold;
+    dc->desc = "DS1338 I2C RTC with 56-byte NV RAM";
     dc->vmsd = &vmstate_ds1338;
+
+    dsc->num_regs   = DS1338_NUM_REGS;
+    dsc->ctrl_addr  = DS1338_CONTROL;
+    dsc->ctrl_mask  = DS1338_CTRL_MASK;
+    dsc->osf_addr   = DS1338_CONTROL;
+    dsc->osf_mask   = CTRL_OSF;
+    dsc->ctrl_reset = DS1338_CTRL_RESET;
 }
 
 static const TypeInfo ds1338_types[] = {
@@ -238,6 +272,7 @@ static const TypeInfo ds1338_types[] = {
         .name          = TYPE_DS1338,
         .parent        = TYPE_I2C_SLAVE,
         .instance_size = sizeof(DS1338State),
+        .class_size    = sizeof(DS1338Class),
         .class_init    = ds1338_class_init,
     },
 };
-- 
2.56.0