Merge tag 'pull-aspeed-20250323' of https://github.com/legoater/qemu into staging

aspeed queue:

* Fix AST2700 SoC model

# -----BEGIN PGP SIGNATURE-----
#
# iQIzBAABCAAdFiEEoPZlSPBIlev+awtgUaNDx8/77KEFAmfgSG0ACgkQUaNDx8/7
# 7KFIaQ//TDinoK375i/tsRxpHPVHU40mQbn2pCx8g+mDoMZubfExSWncxcOpgzbM
# KM+NSOK0PBnCUHt0aWVb/USyMM7hftJHRkC6IY43HFnRIJlKxPeaS/IC73fPMMKu
# sDuBYz1ALseLFM1vArCiAijA8aCQOAiOBq/GSgscuHcgmTTMJ+c0LbwEaV5/aJwO
# BSIn6bRMLByl6w31NCetu7XwybCI9xCdgcGTuv7gNXtjk8poy540gB1CK02smDjc
# 0uRY9QXjh2epDWXz7UqMlJsEkEUc9BZP/95a70OKFsgDKz1K6kuCxgA3QbKLRgY1
# CDlinhERQuyFta6ulsoQ6E6T6nzc9MzTRjLztSdmMWkCd/qm1j4bWVuGnWD++9WT
# 1Q2IX4D5kurKNizux2+HaV02s3RafpeSjGOYMjaTpr74yqPpwa7gM2WnJhxZF1Md
# MF+ee30be5dJaVcZ0doYd+m3c6M0W5S1H5tR99YTA3auwikY0zgEKHrgXoDnv+sb
# 803AQroIBGZxbnxSH1OVJD4MB7Xos5CBxi0FYvpCy8E7Piaz2EGAe7QQUyHhPZjs
# Eg5rKCXODToYIpTHg+JYakHEt3ooewX3/pSVa//PJzde0eR25VNc6ybl4Xklqxib
# SjQ7HFqPkWrbVNK7o6j1LHLVa+sxtIT8FQtHKh5XjD7wnQwYV5U=
# =AwrM
# -----END PGP SIGNATURE-----
# gpg: Signature made Sun 23 Mar 2025 13:44:13 EDT
# gpg:                using RSA key A0F66548F04895EBFE6B0B6051A343C7CFFBECA1
# gpg: Good signature from "Cédric Le Goater <clg@redhat.com>" [full]
# gpg:                 aka "Cédric Le Goater <clg@kaod.org>" [full]
# Primary key fingerprint: A0F6 6548 F048 95EB FE6B  0B60 51A3 43C7 CFFB ECA1

* tag 'pull-aspeed-20250323' of https://github.com/legoater/qemu:
  hw/misc/aspeed_hace: Fix buffer overflow in has_padding function
  hw/intc/aspeed: Fix IRQ handler mask check
  aspeed: Fix maximum number of spi controller

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

hw/intc/aspeed_intc.c

@@ -111,7 +111,7 @@ static void aspeed_intc_set_irq_handler(AspeedINTCState *s,
     outpin_idx = intc_irq->outpin_idx;
     inpin_idx = intc_irq->inpin_idx;
 
-    if (s->mask[inpin_idx] || s->regs[status_reg]) {
+    if ((s->mask[inpin_idx] & select) || (s->regs[status_reg] & select)) {
         /*
          * a. mask is not 0 means in ISR mode
          * sources interrupt routine are executing.

hw/misc/aspeed_hace.c

@@ -128,6 +128,11 @@ static bool has_padding(AspeedHACEState *s, struct iovec *iov,
     if (*total_msg_len <= s->total_req_len) {
         uint32_t padding_size = s->total_req_len - *total_msg_len;
         uint8_t *padding = iov->iov_base;
+
+        if (padding_size > req_len) {
+            return false;
+        }
+
         *pad_offset = req_len - padding_size;
         if (padding[*pad_offset] == 0x80) {
             return true;

include/hw/arm/aspeed_soc.h

@@ -42,7 +42,7 @@
 #include "hw/char/serial-mm.h"
 #include "hw/intc/arm_gicv3.h"
 
-#define ASPEED_SPIS_NUM  2
+#define ASPEED_SPIS_NUM  3
 #define ASPEED_EHCIS_NUM 2
 #define ASPEED_WDTS_NUM  8
 #define ASPEED_CPUS_NUM  4