i2c: Add a ir35221 device

Simple model of a PSU device of the witherspoon.

TODO:
- generate "real" values
- implement property visitors to generate faults.

Signed-off-by: Cédric Le Goater <c

i2c: Add a ir35221 device

Simple model of a PSU device of the witherspoon.

TODO:
- generate "real" values
- implement property visitors to generate faults.

Signed-off-by: Cédric Le Goater <clg@kaod.org>

show more ...

i2c: Add a IBM CFF Power Supply device

Simple model of a PSU device of the witherspoon.

TODO:
- generate "real" values
- implement property visitors to generate faults.

Signed-off-by: Cédric

i2c: Add a IBM CFF Power Supply device

Simple model of a PSU device of the witherspoon.

TODO:
- generate "real" values
- implement property visitors to generate faults.

Signed-off-by: Cédric Le Goater <clg@kaod.org>

show more ...

hw/misc: Add an iBT device model

Implement an IPMI BT interface model using a chardev backend to
communicate with an external PowerNV machine. It uses the OpenIPMI
simulator protocol for virtual mac

hw/misc: Add an iBT device model

Implement an IPMI BT interface model using a chardev backend to
communicate with an external PowerNV machine. It uses the OpenIPMI
simulator protocol for virtual machines described in :

https://github.com/cminyard/openipmi/blob/master/lanserv/README.vm

and implemented by the 'ipmi-bmc-extern' model on the host side.

To use, start the Aspeed BMC machine with :

-chardev socket,id=ipmi0,host=localhost,port=9002,ipv4,server,nowait \
-global driver=aspeed.ibt,property=chardev,value=ipmi0

and the PowerNV machine with :

-chardev socket,id=ipmi0,host=localhost,port=9002,reconnect=10 \
-device ipmi-bmc-extern,id=bmc0,chardev=ipmi0 \
-device isa-ipmi-bt,bmc=bmc0,irq=10 -nodefaults

Cc: Hao Wu <wuhaotsh@google.com>
Cc: Corey Minyard <cminyard@mvista.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Cédric Le Goater <clg@kaod.org>

show more ...

hw/misc: Add basic Aspeed PWM model

Just enough to quiet down the output when running with the logs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>

hw/misc: Add basic Aspeed GFX model

Enough model to capture the pinmux writes to enable correct operation of
the parts of pinmux that depend on GFX registers.

Signed-off-by: Joel Stanley <joel@jms.

hw/misc: Add basic Aspeed GFX model

Enough model to capture the pinmux writes to enable correct operation of
the parts of pinmux that depend on GFX registers.

Signed-off-by: Joel Stanley <joel@jms.id.au>

show more ...

hw/aspeed: Correct minimum access size for all models

Guest code was performing a byte load to the SCU MMIO region, leading to
the guest code crashing (it should be using proper accessors, but
that

hw/aspeed: Correct minimum access size for all models

Guest code was performing a byte load to the SCU MMIO region, leading to
the guest code crashing (it should be using proper accessors, but
that is not Qemu's bug). Hardware and the documentation[1] both agree that
byte loads are okay, so change all of the aspeed devices to accept a
minimum access size of 1.

[1] See the 'ARM Address Space Mapping' table in the ASPEED docs. This
is section 6.1 in the ast2400 and ast2700, and 7.1 in the ast2500 and
ast2600 datasheets.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2636
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Troy Lee <leetroy@gmail.com>
[ clg: SCU part already merged :
https://lore.kernel.org/qemu-devel/20250331230444.88295-3-philmd@linaro.org/ ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_i3c: Move to i3c directory

Moves the Aspeed I3C model and traces into hw/i3c and creates I3C build
files.

Signed-off-by: Joe Komlodi <komlodi@google.com>

Reviewed-by: Patrick Ventur

hw/misc/aspeed_i3c: Move to i3c directory

Moves the Aspeed I3C model and traces into hw/i3c and creates I3C build
files.

Signed-off-by: Joe Komlodi <komlodi@google.com>

Reviewed-by: Patrick Venture <venture@google.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250613000411.1516521-2-komlodi@google.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_sbc: Handle OTP write command for voltage mode registers

Extend OTP command handling to recognize specific voltage mode register
addresses and emulate the expected hardware behavior.

hw/misc/aspeed_sbc: Handle OTP write command for voltage mode registers

Extend OTP command handling to recognize specific voltage mode register
addresses and emulate the expected hardware behavior. Without this
change, legitimate voltage mode change requests would be incorrectly
reported as "Unknown command" and logged as an error.

This implementation does not perform actual mode changes, but ensures
that valid requests are accepted and ignored as per hardware behavior.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-9-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_sbc: Add CAMP2 support for OTP data reads

The OTP space contains three types of entries: data, conf, and strap.
Data entries consist of two DWORDs, while the other types contain
only

hw/misc/aspeed_sbc: Add CAMP2 support for OTP data reads

The OTP space contains three types of entries: data, conf, and strap.
Data entries consist of two DWORDs, while the other types contain
only one DWORD. This change adds the R_CAMP2 register (0x024 / 4) to
store the second DWORD when reading from the OTP data region.

With this enhancement, OTP reads now correctly return both DWORDs for
data entries via the CAMP registers, along with improved address
validation and error handling.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-8-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/arm: Integrate ASPEED OTP memory support into AST1030 SoCs

The has_otp attribute is enabled in the SBC subclasses for AST1030 to
control the presence of OTP support per SoC type.

Signed-off-by:

hw/arm: Integrate ASPEED OTP memory support into AST1030 SoCs

The has_otp attribute is enabled in the SBC subclasses for AST1030 to
control the presence of OTP support per SoC type.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-7-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/arm: Integrate ASPEED OTP memory support into AST2600 SoCs

The has_otp attribute is enabled in the SBC subclasses for AST2600 to
control the presence of OTP support per SoC type.

Signed-off-by:

hw/arm: Integrate ASPEED OTP memory support into AST2600 SoCs

The has_otp attribute is enabled in the SBC subclasses for AST2600 to
control the presence of OTP support per SoC type.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-4-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_sbc: Connect ASPEED OTP memory device to SBC

This patch connects the aspeed.otp device to the ASPEED Secure Boot
Controller (SBC) model. It implements OTP memory access via the SBC's

hw/misc/aspeed_sbc: Connect ASPEED OTP memory device to SBC

This patch connects the aspeed.otp device to the ASPEED Secure Boot
Controller (SBC) model. It implements OTP memory access via the SBC's
command interface and enables emulation of secure fuse programming
flows.

The following OTP commands are supported:
- READ: reads a 32-bit word from OTP memory into internal registers
- PROG: programs a 32-bit word value to the specified OTP address

Trace events are added to observe read/program operations and command
handling flow.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-3-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_scu: Implement TSP reset and power-on control via SCU registers

This patch implements TSP reset and power control logic in the SCU module
for AST2700. It introduces support for the fo

hw/misc/aspeed_scu: Implement TSP reset and power-on control via SCU registers

This patch implements TSP reset and power control logic in the SCU module
for AST2700. It introduces support for the following behavior:

1. TSP Reset Trigger (via SCU 0x224):

- TSP reset is triggered by writing 1 to bit 9 (RW1S) of SYS_RESET_CTRL_2.

2. TSP Reset State and Source Hold (via SCU 0x160):

- Upon reset, bit 8 (RST_RB) is set to indicate the TSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding TSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the TSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.

3. Hold Release and Power-on:

- If RST_HOLD_RB is clear (0), TSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to TSP_CTRL_0 to release
the hold and power on TSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.

4. Reset Status Clear (via SCU 0x224):

- The reset status can be cleared by writing 1 to bit 9 (RW1C) of SYS_RST_CLR_2,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.

5. TSP Power Control Logic:

- handle_ssp_tsp_on() clears RST_SRC_RB and RST_RB (if not held), and invokes
arm_set_cpu_on_and_reset(cpuid) to power on the TSP core (CPUID 5).
- handle_ssp_tsp_off() sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes arm_set_cpu_off(cpuid).

The default values are based on EVB (evaluation board) register dump observations.
TSP reset control shares the same helper functions and register bit layout as SSP,
with logic selected by cpuid and distinct external reset sources.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250717034054.1903991-19-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU registers

This patch implements SSP reset and power control logic in the SCU for AST2700.
It introduces support for the following

hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU registers

This patch implements SSP reset and power control logic in the SCU for AST2700.
It introduces support for the following behavior:

1. SSP Reset Trigger (via SCU 0x220):
- SSP reset is triggered by writing 1 to bit 30 (RW1S) of SYS_RESET_CTRL_1.

2. SSP Reset State and Source Hold (via SCU 0x120):
- Upon reset, bit 8 (RST_RB) is set to indicate the SSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding SSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the SSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.

3. Hold Release and Power-on:
- If RST_HOLD_RB is clear (0), SSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to SSP_CTRL_0 to release
the hold and power on SSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.

4. Reset Status Clear (via SCU 0x204):
- The reset status can be cleared by writing 1 to bit 30 (RW1C) of SYS_RST_CLR_1,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.

5. SSP Power Control Logic:
- `handle_ssp_tsp_on()` clears RST_SRC_RB and RST_RB (if not held), and invokes
`arm_set_cpu_on_and_reset(cpuid)` to power on the SSP core (CPUID 4).
- `handle_ssp_tsp_off()` sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes `arm_set_cpu_off(cpuid)`.

6. Register Initialization and Definitions:
- Adds SCU register definitions for SSP_CTRL_0 (0x120), SYS_RST_CTRL_1 (0x220),
and SYS_RST_CLR_1 (0x204).
- Updates the reset values for these registers during SCU initialization.

The default values are based on EVB (evaluation board) register dump observations.
This patch enables proper modeling of SSP lifecycle management across reset,
hold, and power-on states for the AST2700 SoC.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250717034054.1903991-18-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap

This commit adds SCU register support for TSP SDRAM remap control and runtime
activation. Unlike SSP, the TSP does not support configurable ta

hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap

This commit adds SCU register support for TSP SDRAM remap control and runtime
activation. Unlike SSP, the TSP does not support configurable target address remapping
through SCU registers. It only supports setting the PSP DRAM base and size, which
are then aliased into the TSP-visible SDRAM window.

One MemoryRegion alias is attached to the SCU via QOM property link:
- tsp-sdram-remap: maps PSP DRAM at 0x42E000000 (size: 32MB) to TSP SDRAM
offset 0x0

The SCU registers AST2700_SCU_TSP_CTRL_1 and
AST2700_SCU_TSP_REMAP_SIZE_2 allow runtime reconfiguration of the DRAM base (alias offset)
and mapping size.

|------------------------------------------| |----------------------------|
| PSP DRAM | | TSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x42E0_0000_0 (SCU_168 << 4) | | 0x0000_0000 |
| remap base |------> | - fixed target addr |
| size: 32MB (SCU_194) | | |
|------------------------------------------| |----------------------------|

SCU VMState version remains at 3, as it was already bumped in a previous commit.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250717034054.1903991-17-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap

This commit adds SCU register support for SSP SDRAM remap control and runtime
activation. It introduces logic for the PSP to dynamically confi

hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap

This commit adds SCU register support for SSP SDRAM remap control and runtime
activation. It introduces logic for the PSP to dynamically configure the mapping
of its own DRAM windows into SSP-visible SDRAM space, enabling shared memory
communication via memory region aliases.

Two MemoryRegion aliases are attached to the SCU via QOM property links:
- ssp-sdram-remap1: maps PSP DRAM at 0x400000000 (size: 32MB) to SSP SDRAM
offset 0x2000000
- ssp-sdram-remap2: maps PSP DRAM at 0x42c000000 (size: 32MB) to SSP SDRAM
offset 0x0

The SCU registers AST2700_SCU_SSP_CTRL_1/2 and
AST2700_SCU_SSP_REMAP_ADDR_{1,2} / REMAP_SIZE_{1,2} allow runtime reconfiguration
of alias offset, base, and size.

Bumps the SCU VMState version to 3.

|------------------------------------------| |----------------------------|
| PSP DRAM | | SSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x4_0000_0000 (SCU_124 << 4) | --> | 0x0000_0000 |
| remap1 base |---| | | - SCU_150: target addr |
| size: 32MB (SCU_14C) | | | | remap2 |
|------------------------------------------| | | |----------------------------|
| | | | | |
| 0x4_2C00_0000 (SCU_128 << 4) |-----| | 0x0200_0000 |
| remap2 base | | | - SCU_148: target addr |
| size: 32MB (SCU_154) | |---> | remap1 |
|------------------------------------------| |----------------------------|

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250717034054.1903991-16-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/max78000_aes: Comment Internal Key Storage

Coverity Scan noted an unusual pattern in the
MAX78000 aes device, with duplicated calls to
set_decrypt. This commit adds a comment noting
why the

hw/misc/max78000_aes: Comment Internal Key Storage

Coverity Scan noted an unusual pattern in the
MAX78000 aes device, with duplicated calls to
set_decrypt. This commit adds a comment noting
why the implementation is correct.

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Message-id: 20250716002622.84685-1-jcksn@duck.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/misc/ivshmem-pci: Improve error handling

Coverity points out that the ivshmem-pci code has some error handling
cases where it incorrectly tries to use an invalid filedescriptor.
These generally h

hw/misc/ivshmem-pci: Improve error handling

Coverity points out that the ivshmem-pci code has some error handling
cases where it incorrectly tries to use an invalid filedescriptor.
These generally happen because ivshmem_recv_msg() calls
qemu_chr_fe_get_msgfd(), which might return -1, but the code in
process_msg() generally assumes that the file descriptor was provided
when it was supposed to be. In particular:
* the error case in process_msg() only needs to close the fd
if one was provided
* process_msg_shmem() should fail if no fd was provided

Coverity: CID 1508726
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250711145012.1521936-1-peter.maydell@linaro.org

show more ...

hw/mips: Restrict ITU to TCG

MIPS Inter-Thread Communication Unit is implemented using
TCG. Check for TCG both in Kconfig and CPS source.

Fixes: 2321d971b6f ("hw/mips: Add dependency MIPS_CPS -> MI

hw/mips: Restrict ITU to TCG

MIPS Inter-Thread Communication Unit is implemented using
TCG. Check for TCG both in Kconfig and CPS source.

Fixes: 2321d971b6f ("hw/mips: Add dependency MIPS_CPS -> MIPS_ITU")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250702164953.18579-1-philmd@linaro.org>

show more ...

MAX78000: AES implementation

This commit implements AES for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704

MAX78000: AES implementation

This commit implements AES for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-11-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

MAX78000: TRNG Implementation

This commit implements the True Random Number
Generator for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@li

MAX78000: TRNG Implementation

This commit implements the True Random Number
Generator for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-9-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

MAX78000: GCR Implementation

This commit implements the Global Control Register
for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.o

MAX78000: GCR Implementation

This commit implements the Global Control Register
for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-7-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

MAX78000: ICC Implementation

This commit implements the Instruction Cache Controller
for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@lin

MAX78000: ICC Implementation

This commit implements the Instruction Cache Controller
for the MAX78000

Signed-off-by: Jackson Donaldson <jcksn@duck.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250704223239.248781-3-jcksn@duck.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

show more ...

hw/misc/aspeed_scu: Handle AST2600 protection key registers correctly

The AST2600 SCU has two protection key registers (0x00 and 0x10) that
both need to be unlocked. (Un-)locking 0x00 modifies both

hw/misc/aspeed_scu: Handle AST2600 protection key registers correctly

The AST2600 SCU has two protection key registers (0x00 and 0x10) that
both need to be unlocked. (Un-)locking 0x00 modifies both protection key
registers, while modifying 0x10 only modifies itself.

This commit updates the SCU write logic to reject writes unless both
protection key registers are unlocked, matching the behaviour of
real hardware.

Signed-off-by: Tan Siewert <tan@siewert.io>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20250619085329.42125-1-tan@siewert.io
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...

hw/misc/aspeed_scu: Support the Frequency Counter Control register for AST2700

According to the datasheet:
BIT[1] (SCU_FREQ_OSC_EN) enables the oscillator frequency measurement counter.
BIT[6] (SCU_

hw/misc/aspeed_scu: Support the Frequency Counter Control register for AST2700

According to the datasheet:
BIT[1] (SCU_FREQ_OSC_EN) enables the oscillator frequency measurement counter.
BIT[6] (SCU_FREQ_DONE) indicates the measurement is finished.
Firmware polls BIT[6] to determine when measurement is complete.
The flag can be cleared by writing BIT[1] to 0.

To simulate this hardware behavior in QEMU:
If BIT[1] is set to 1, BIT[6] is immediately set to 1 to avoid
firmware hanging during polling.
If BIT[1] is cleared to 0, BIT[6] is also cleared to 0 to match
hardware semantics.

The initial value of this register is initialized to 0x80, reflecting the
default value confirmed from an EVB register dump.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250618080006.846355-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>

show more ...