Merge tag 'pull-aspeed-20260906' of https://github.com/legoater/qemu into stagingHEADmaster

aspeed queue:

* Fixes AST2600 SCU protection key registers on reset
* Fixes I2C byte latching for SMBus block reads
* Hardens EHCI get_dwords()/put_dwords() with DMA error checking
* Adds a second random number generator to the AST2600 SCU
* Adds the ASPEED ACRY RSA accelerator model with ModExp qtest coverage
* Adds ECDSA sign/verify support to the QEMU crypto akcipher layer
  (gcrypt, nettle backends) with tests
* Adds ECDSA verify command to the ASPEED SBC model with qtest  coverage
* Adds the ASPEED UDC (USB Device Controller) with gadget device
  and programmable endpoint DMA, wired on the AST2600
* Reworks the TMP105 temperature sensor: Resettable reset, fault
  queue enforcement, TMP75/TMP175/LM75B variants, and qtest coverage
* Adds the Facebook SanMiguel BMC machine with EEPROM data
* Uses real TMP75/LM75B models on the Catalina and Fuji boards
* Adds optional device tree model checking to functional boot tests

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmqdnl8ACgkQUaNDx8/7
# 7KGMzxAAgxO09nzutoyjvMRK+Tydd65h9TNxZTC68jzUjacGfU9Y+1+1OcgU25D1
# EUorhMrAGMe22zZ6Q6048HjBmw/xRxt4QB6A5CGIroSgVqQH6NAFalZz5jeCwZrm
# HMk2UAzf0/2euBAXRUFEtK/RpfdrSe1kNXcRX2lWkt5HdjfZJxcM/TmOtLl0vDDU
# BUMbmXLWvnv/W8OLiVmGwP8ufGey2HL2dsLn2Fs9riFF1ZUaJGFkKxEc7ApF6tOr
# 0YaY84lainh21Bp+IjXaV2Al8XCyyHpWKFrEYLEm9P3FfMEebIZbJu8he20cidiw
# R5LIgHpb6FcUZvVcfWyAfYK1+yRQDrL9PMQ8OdbiUgtW1WnvqSyQES4GWx55OmPc
# TSRDodPnETxF26n43ruIWdIGa6umgieT891UrI3CsCYc7JpSpujCgMiob6sLWjFD
# h65DNECnSl3qkK8kIneEhUK9MVIX62YskqAWkIF7rwy+Af7QkCcWuMKTGIpC+a/l
# H7SjxPWwy1XW9B+4dhF3teYxqb8iETM0BQwr2ZuAp3mbB/YkTMaIj5TfUpiGrClz
# RdkSc2njjqbeyQZSTV1P+M8cpWBYiHRJNhx58rH6qIpH6ATSZZAym6XCZV2wZDtU
# VJ7TwnOObQMogMp/9iThUd4jEtCcmEp1dxXF/KKXADso6EU6+Do=
# =sX4J
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun Sep  6 18:09:51 2026 BST
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg:                 aka "Cédric Le Goater <clg@kaod.org>" [full]
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-aspeed-20260906' of https://github.com/legoater/qemu: (40 commits)
  tests/functional: aspeed: optionally check the device tree model on boot
  hw/arm: fuji: use the real TMP75 and LM75B temperature sensors
  hw/arm: catalina: use the real TMP75 model
  hw/arm: sanmiguel: populate EEPROM data
  hw/arm: sanmiguel: add Facebook SanMiguel BMC machine
  tests/qtest: tmp105: cover shutdown clearing the ALERT across variants
  tests/qtest: tmp105: cover one-shot and fault-queue write immunity
  tests/qtest: tmp105: cover the TMP75, TMP175 and LM75B variants
  tests/qtest: tmp105: cover the ALERT fault queue
  hw/sensor: tmp105: add TMP75, TMP175 and LM75B variants
  hw/arm: aspeed: guard board-local temperature-sensor aliases
  hw/sensor: tmp105: describe the temperature property
  hw/sensor: tmp105: enforce the configurable fault queue
  hw/sensor: tmp105: implement Resettable reset
  hw/sensor: tmp105: name the parent object field parent_obj
  hw/sensor: tmp105: make device state private to the implementation
  hw/arm/aspeed_ast2600: Wire up the UDC
  hw/usb/aspeed-udc: Add programmable endpoint DMA transfers
  hw/usb/aspeed-udc: Add ASPEED UDC gadget USB device
  hw/usb/aspeed-udc: Add ASPEED UDC device controller
  ...

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

6 files changed, 147 insertions, 41 deletions

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index cd68c7f1ca..38226d9b80 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -25,6 +25,7 @@
 #include "hw/i2c/aspeed_i2c.h"
 #include "hw/i3c/aspeed_i3c.h"
 #include "hw/ssi/aspeed_smc.h"
+#include "hw/misc/aspeed_acry.h"
 #include "hw/misc/aspeed_hace.h"
 #include "hw/misc/aspeed_sbc.h"
 #include "hw/misc/aspeed_sli.h"
@@ -36,6 +37,8 @@
 #include "hw/gpio/aspeed_sgpio.h"
 #include "hw/sd/aspeed_sdhci.h"
 #include "hw/usb/hcd-ehci.h"
+#include "hw/usb/aspeed-udc.h"
+#include "hw/core/or-irq.h"
 #include "qom/object.h"
 #include "hw/misc/aspeed_lpc.h"
 #include "hw/misc/unimp.h"
@@ -69,6 +72,7 @@ struct AspeedSoCState {
     MemoryRegion *dram_mr;
     MemoryRegion dram_container;
     MemoryRegion sram[ASPEED_SRAM_NUM];
+    MemoryRegion sram_container[ASPEED_SRAM_NUM];
     MemoryRegion spi_boot_container;
     MemoryRegion spi_boot;
     MemoryRegion vbootrom;
@@ -81,6 +85,7 @@ struct AspeedSoCState {
     AspeedSCUState scu;
     AspeedSCUState scuio;
     AspeedHACEState hace;
+    AspeedACRYState acry;
     AspeedXDMAState xdma;
     AspeedADCState adc;
     AspeedSMCState fmc;
@@ -89,7 +94,6 @@ struct AspeedSoCState {
     AspeedSBCState sbc;
     AspeedSLIState sli;
     AspeedSLIState sliio;
-    UnimplementedDeviceState sbc_unimplemented;
     AspeedSDMCState sdmc;
     AspeedPWMState pwm;
     AspeedWDTState wdt[ASPEED_WDTS_NUM];
@@ -138,6 +142,8 @@ struct Aspeed2600SoCState {
 
     A15MPPrivState a7mpcore;
     ARMCPU cpu[ASPEED_CPUS_NUM]; /* XXX belong to a7mpcore */
+    AspeedUDCState udc;
+    OrIRQState ehci2_udc_orgate;
 };
 
 #define TYPE_ASPEED2600_SOC "aspeed2600-soc"
@@ -270,6 +276,7 @@ enum {
     ASPEED_DEV_EMMC,
     ASPEED_DEV_KCS,
     ASPEED_DEV_HACE,
+    ASPEED_DEV_ACRY,
     ASPEED_DEV_DPMCU,
     ASPEED_DEV_DP,
     ASPEED_DEV_I3C,
diff --git a/include/hw/i2c/aspeed_i2c.h b/include/hw/i2c/aspeed_i2c.h
index 05937a7a0b..480c6418fe 100644
--- a/include/hw/i2c/aspeed_i2c.h
+++ b/include/hw/i2c/aspeed_i2c.h
@@ -231,6 +231,8 @@ REG32(I2CS_DMA_TX_ADDR_HI, 0x68)
     FIELD(I2CS_DMA_TX_ADDR_HI, ADDR_HI, 0, 7)
 REG32(I2CS_DMA_RX_ADDR_HI, 0x6c)
     FIELD(I2CS_DMA_RX_ADDR_HI, ADDR_HI, 0, 7)
+REG32(I2CC_BYTE_DATA_LOG, 0x84)
+    FIELD(I2CC_BYTE_DATA_LOG, RX_BUF, 0, 8)
 REG32(I2CC_VERSION_CTRL, 0x94)
     FIELD(I2CC_VERSION_CTRL, FUNC_CFG_DMA_EN, 2, 1)
 
@@ -302,6 +304,7 @@ struct AspeedI2CClass {
     bool has_share_pool;
     uint64_t mem_size;
     bool has_dma64;
+    bool has_byte_data_log;
     uint32_t dma_addr_lo_mask;
 };
 
diff --git a/include/hw/misc/aspeed_acry.h b/include/hw/misc/aspeed_acry.h
new file mode 100644
index 0000000000..5ca80deec4
--- /dev/null
+++ b/include/hw/misc/aspeed_acry.h
@@ -0,0 +1,39 @@
+/*
+ * ASPEED ACRY Engine
+ *
+ * Copyright (C) 2026 ASPEED Technology Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ASPEED_ACRY_H
+#define ASPEED_ACRY_H
+
+#include "hw/core/sysbus.h"
+#include "system/memory.h"
+
+#define TYPE_ASPEED_ACRY "aspeed.acry"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedACRYState, ASPEED_ACRY)
+
+#define ASPEED_ACRY_NR_REGS     (0x400 >> 2)
+/* Max size of the "data" (message) field within the SRAM buffer. */
+#define ASPEED_ACRY_DATA_MAX_LEN 0x800
+#define ASPEED_ACRY_MAX_BITS     4096
+/* Max exponent/modulus size for a 4096-bit RSA key, in bytes. */
+#define ASPEED_ACRY_MAX_BYTES    (ASPEED_ACRY_MAX_BITS / 8)
+
+struct AspeedACRYState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    qemu_irq irq;
+
+    uint32_t regs[ASPEED_ACRY_NR_REGS];
+
+    MemoryRegion *dram_mr;
+    MemoryRegion *sram_mr;
+    AddressSpace dram_as;
+    AddressSpace sram_as;
+};
+
+#endif /* ASPEED_ACRY_H */
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 07c7c22a86..756c612356 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -17,7 +17,7 @@
 #define TYPE_ASPEED_AST10X0_SBC TYPE_ASPEED_SBC "-ast10x0"
 OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
 
-#define ASPEED_SBC_NR_REGS (0x93c >> 2)
+#define ASPEED_SBC_NR_REGS (0x1000 >> 2)
 
 #define QSR_AES                     BIT(27)
 #define QSR_RSA1024                 (0x0 << 12)
@@ -40,12 +40,16 @@ struct AspeedSBCState {
     uint32_t regs[ASPEED_SBC_NR_REGS];
 
     AspeedOTPState otp;
+
+    MemoryRegion *sram;
+    AddressSpace sram_as;
 };
 
 struct AspeedSBCClass {
     SysBusDeviceClass parent_class;
 
     bool has_otp;
+    bool has_ecdsa;
 };
 
 #endif /* ASPEED_SBC_H */
diff --git a/include/hw/sensor/tmp105.h b/include/hw/sensor/tmp105.h
index 244e2989fe..0698aeead7 100644
--- a/include/hw/sensor/tmp105.h
+++ b/include/hw/sensor/tmp105.h
@@ -1,5 +1,5 @@
 /*
- * Texas Instruments TMP105 Temperature Sensor
+ * Texas Instruments TMP105/TMP75/TMP175/LM75B Temperature Sensor
  *
  * Browse the data sheet:
  *
@@ -11,45 +11,13 @@
  * This work is licensed under the terms of the GNU GPL, version 2 or
  * later. See the COPYING file in the top-level directory.
  */
-#ifndef QEMU_TMP105_H
-#define QEMU_TMP105_H
-
-#include "hw/i2c/i2c.h"
-#include "hw/sensor/tmp105_regs.h"
-#include "qom/object.h"
+#ifndef HW_SENSOR_TMP105_H
+#define HW_SENSOR_TMP105_H
 
+/* TMP75, TMP175 and NXP LM75B are register-compatible with TMP105. */
 #define TYPE_TMP105 "tmp105"
-OBJECT_DECLARE_SIMPLE_TYPE(TMP105State, TMP105)
-
-/**
- * TMP105State:
- * @config: Bits 5 and 6 (value 32 and 64) determine the precision of the
- * temperature. See Table 8 in the data sheet.
- *
- * @see_also: http://www.ti.com/lit/gpn/tmp105
- */
-struct TMP105State {
-    /*< private >*/
-    I2CSlave i2c;
-    /*< public >*/
-
-    uint8_t len;
-    uint8_t buf[2];
-    qemu_irq pin;
-
-    uint8_t pointer;
-    uint8_t config;
-    int16_t temperature;
-    int16_t limit[2];
-    int faults;
-    uint8_t alarm;
-    /*
-     * The TMP105 initially looks for a temperature rising above T_high;
-     * once this is detected, the condition it looks for next is the
-     * temperature falling below T_low. This flag is false when initially
-     * looking for T_high, true when looking for T_low.
-     */
-    bool detect_falling;
-};
+#define TYPE_TMP175 "tmp175"
+#define TYPE_TMP75  "tmp75"
+#define TYPE_LM75B  "lm75b"
 
 #endif
diff --git a/include/hw/usb/aspeed-udc.h b/include/hw/usb/aspeed-udc.h
new file mode 100644
index 0000000000..7701c1aa34
--- /dev/null
+++ b/include/hw/usb/aspeed-udc.h
@@ -0,0 +1,85 @@
+/*
+ * ASPEED USB Device Controller (UDC)
+ *
+ * Copyright (c) 2026 ASPEED Technology Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_USB_ASPEED_UDC_H
+#define HW_USB_ASPEED_UDC_H
+
+#include "hw/core/sysbus.h"
+#include "hw/usb/usb.h"
+#include "qom/object.h"
+
+#define TYPE_ASPEED_UDC "aspeed.udc"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedUDCState, ASPEED_UDC)
+
+/*
+ * The gadget side of the controller is presented to a USB host controller's
+ * bus as a single USB device that delegates back to the AspeedUDCState.
+ */
+#define TYPE_ASPEED_UDC_GADGET "aspeed.udc-gadget"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedUDCGadget, ASPEED_UDC_GADGET)
+
+/*
+ * Register map: root/global block at 0x000 - 0x087, then one 0x10 byte bank
+ * per programmable endpoint from 0x200.
+ */
+#define ASPEED_UDC_MEM_SIZE     0x300
+#define ASPEED_UDC_ROOT_NR_REGS (0x88 >> 2)
+#define ASPEED_UDC_EP_REG_BASE  0x200
+#define ASPEED_UDC_EP_NR_REGS   (0x10 >> 2)
+
+/*
+ * EP0 (control) is served through the root registers (UDC_EP0_*), so only
+ * the 4 programmable endpoints get their own register bank / ep[] entry.
+ */
+#define ASPEED_UDC_NUM_EP   4
+
+typedef struct AspeedUDCEP {
+    MemoryRegion mr;
+    uint32_t regs[ASPEED_UDC_EP_NR_REGS];
+    int index;
+
+    /*
+     * host packet parked until the guest gadget driver queues (IN) or
+     * arms (OUT) data
+     */
+    USBPacket *pkt;
+    /* bytes of the current IN descriptor already served */
+    uint32_t desc_off;
+} AspeedUDCEP;
+
+struct AspeedUDCGadget {
+    USBDevice parent_obj;
+    AspeedUDCState *udc;
+};
+
+struct AspeedUDCState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion udc_container;
+    MemoryRegion root_mr;
+    MemoryRegion *dram_mr;
+    AddressSpace dram_as;
+    uint32_t regs[ASPEED_UDC_ROOT_NR_REGS];
+    AspeedUDCEP ep[ASPEED_UDC_NUM_EP];
+    qemu_irq irq;
+
+    /* gadget USB device bound to this controller (set at its realize) */
+    AspeedUDCGadget *usbgadget;
+
+    /*
+     * In-flight EP0 control transfer (host side), deferred until the guest
+     * gadget driver responds via MMIO.
+     */
+    USBPacket *ep0_packet;
+    uint32_t ep0_setup_len;
+    uint32_t ep0_offset;
+    uint8_t *ep0_data;
+    bool ep0_dir_in;
+};
+
+#endif /* HW_USB_ASPEED_UDC_H */