* [RFC v5 1/4] hw/misc/aspeed_otp: Add ASPEED OTP memory device model
2025-06-19 6:41 [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs Kane Chen via
@ 2025-06-19 6:41 ` Kane Chen via
2025-06-19 6:41 ` Kane Chen via
` (3 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: Kane Chen via @ 2025-06-19 6:41 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Jamin Lin, Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: troy_lee, Kane-Chen-AS
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Introduce a QEMU device model for ASPEED's One-Time Programmable (OTP)
memory.
This model simulates a word-addressable OTP region used for secure
fuse storage or boot-time configuration. The OTP memory can operate
with either:
- a file-backed backend via the 'drive' property, which allows
persistent emulation of burned fuse states using -blockdev, or
- an internal fallback buffer
The OTP model provides a memory-like interface through a dedicated
AddressSpace, allowing other device models (e.g., SBC) to issue
transactions as if accessing a memory-mapped region. Actual data is
maintained in a file-backed or internal buffer.
Logging is included to assist with debugging and to indicate fallback
behavior when no backend is provided.
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
---
hw/misc/aspeed_otpmem.c | 117 ++++++++++++++++++++++++++++++++
hw/misc/meson.build | 1 +
include/hw/misc/aspeed_otpmem.h | 35 ++++++++++
3 files changed, 153 insertions(+)
create mode 100644 hw/misc/aspeed_otpmem.c
create mode 100644 include/hw/misc/aspeed_otpmem.h
diff --git a/hw/misc/aspeed_otpmem.c b/hw/misc/aspeed_otpmem.c
new file mode 100644
index 0000000000..c5a67621c9
--- /dev/null
+++ b/hw/misc/aspeed_otpmem.c
@@ -0,0 +1,117 @@
+/*
+ * ASPEED OTP (One-Time Programmable) memory
+ *
+ * Copyright (C) 2025 Aspeed
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "trace.h"
+#include "system/block-backend-global-state.h"
+#include "system/block-backend-io.h"
+#include "hw/misc/aspeed_otpmem.h"
+
+static uint64_t aspeed_otpmem_read(void *opaque, hwaddr offset, unsigned size)
+{
+ AspeedOTPMemState *s = opaque;
+ uint64_t val = 0;
+
+ memcpy(&val, s->storage + offset, size);
+
+ return val;
+}
+
+static void aspeed_otpmem_write(void *opaque, hwaddr offset,
+ uint64_t val, unsigned size)
+{
+ int ret;
+ AspeedOTPMemState *s = opaque;
+
+ memcpy(s->storage + offset, &val, size);
+ if (s->blk) {
+ ret = blk_pwrite(s->blk, offset, size, &val, BDRV_REQ_FUA);
+ if (ret < 0) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "blk_pwrite failed offset 0x%" HWADDR_PRIx
+ ", ret = %d\n",
+ offset, ret);
+ }
+ }
+}
+
+static const MemoryRegionOps aspeed_otpmem_ops = {
+ .read = aspeed_otpmem_read,
+ .write = aspeed_otpmem_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 4,
+};
+
+static void aspeed_otpmem_realize(DeviceState *dev, Error **errp)
+{
+ AspeedOTPMemState *s = ASPEED_OTPMEM(dev);
+ const size_t size = OTPMEM_SIZE;
+ int i, num;
+ uint32_t *p;
+
+ s->storage = blk_blockalign(s->blk, size);
+ if (!s->storage) {
+ error_setg(errp, "Failed to allocate OTP memory storage buffer");
+ return;
+ }
+
+ if (s->blk) {
+ uint64_t perm = BLK_PERM_CONSISTENT_READ |
+ (blk_supports_write_perm(s->blk) ? BLK_PERM_WRITE : 0);
+ if (blk_set_perm(s->blk, perm, BLK_PERM_ALL, errp) < 0) {
+ error_setg(errp, "Failed to set permission");
+ return;
+ }
+
+ if (blk_pread(s->blk, 0, s->size, s->storage, 0) < 0) {
+ error_setg(errp, "Failed to read the initial flash content");
+ return;
+ }
+ } else {
+ num = size / sizeof(uint32_t);
+ p = (uint32_t *)s->storage;
+ for (i = 0; i < num; i++) {
+ p[i] = (i % 2 == 0) ? 0x00000000 : 0xFFFFFFFF;
+ }
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "OTP image is not presented, use local buffer\n");
+ }
+
+ memory_region_init_io(&s->mmio, OBJECT(dev), &aspeed_otpmem_ops,
+ s, "aspeed.otpmem", size);
+ address_space_init(&s->as, &s->mmio, NULL);
+}
+
+static const Property aspeed_otpmem_properties[] = {
+ DEFINE_PROP_UINT64("size", AspeedOTPMemState, size, OTPMEM_SIZE),
+ DEFINE_PROP_DRIVE("drive", AspeedOTPMemState, blk),
+};
+
+static void aspeed_otpmem_class_init(ObjectClass *klass, const void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ dc->realize = aspeed_otpmem_realize;
+ device_class_set_props(dc, aspeed_otpmem_properties);
+}
+
+static const TypeInfo aspeed_otpmem_info = {
+ .name = TYPE_ASPEED_OTPMEM,
+ .parent = TYPE_DEVICE,
+ .instance_size = sizeof(AspeedOTPMemState),
+ .class_init = aspeed_otpmem_class_init,
+};
+
+static void aspeed_otpmem_register_types(void)
+{
+ type_register_static(&aspeed_otpmem_info);
+}
+
+type_init(aspeed_otpmem_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index 6d47de482c..ed1eaaa2ad 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -136,6 +136,7 @@ system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
'aspeed_sbc.c',
'aspeed_sdmc.c',
'aspeed_xdma.c',
+ 'aspeed_otpmem.c',
'aspeed_peci.c',
'aspeed_sli.c'))
diff --git a/include/hw/misc/aspeed_otpmem.h b/include/hw/misc/aspeed_otpmem.h
new file mode 100644
index 0000000000..7f469d9fd7
--- /dev/null
+++ b/include/hw/misc/aspeed_otpmem.h
@@ -0,0 +1,35 @@
+/*
+ * ASPEED OTP (One-Time Programmable) memory
+ *
+ * Copyright (C) 2025 Aspeed
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ASPEED_OTPMMEM_H
+#define ASPEED_OTPMMEM_H
+
+#include "system/memory.h"
+#include "hw/block/block.h"
+#include "system/memory.h"
+#include "system/address-spaces.h"
+
+#define OTPMEM_SIZE 0x4000
+#define TYPE_ASPEED_OTPMEM "aspeed.otpmem"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedOTPMemState, ASPEED_OTPMEM)
+
+typedef struct AspeedOTPMemState {
+ DeviceState parent_obj;
+
+ BlockBackend *blk;
+
+ uint64_t size;
+
+ AddressSpace as;
+
+ MemoryRegion mmio;
+
+ uint8_t *storage;
+} AspeedOTPMemState;
+
+#endif /* ASPEED_OTPMMEM_H */
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [RFC v5 2/4] hw/misc/aspeed_sbc: Connect ASPEED OTP memory device to SBC
2025-06-19 6:41 [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs Kane Chen via
@ 2025-06-19 6:41 ` Kane Chen via
2025-06-19 6:41 ` Kane Chen via
` (3 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: Kane Chen via @ 2025-06-19 6:41 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Jamin Lin, Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: troy_lee, Kane-Chen-AS
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
This patch connects the aspeed.otpmem device to the ASPEED Secure Boot
Controller (SBC) model. It implements OTP memory access via the SBC's
command interface and enables emulation of secure fuse programming flows.
The following OTP commands are supported:
- READ: reads a 32-bit word from OTP memory into internal registers
- PROG: programs a 32-bit word value to the specified OTP address
The integration supports both externally provided OTP devices (via
-M otpmem=XYZ and -device aspeed.otpmem) and fallback to an internal OTP
instance if no drive is specified.
A dedicated AddressSpace is used to issue memory transactions from SBC
to the OTP backend. Trace events are added to observe read/program
operations and command handling flow.
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
---
hw/misc/aspeed_sbc.c | 161 +++++++++++++++++++++++++++++++++++
hw/misc/trace-events | 7 ++
include/hw/misc/aspeed_sbc.h | 7 ++
3 files changed, 175 insertions(+)
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index a7d101ba71..8e192e9496 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -12,12 +12,19 @@
#include "qemu/log.h"
#include "qemu/error-report.h"
#include "hw/qdev-properties.h"
+#include "system/system.h"
+#include "qemu/notify.h"
#include "hw/misc/aspeed_sbc.h"
#include "qapi/error.h"
#include "migration/vmstate.h"
+#include "trace.h"
#define R_PROT (0x000 / 4)
+#define R_CMD (0x004 / 4)
+#define R_ADDR (0x010 / 4)
#define R_STATUS (0x014 / 4)
+#define R_CAMP1 (0x020 / 4)
+#define R_CAMP2 (0x024 / 4)
#define R_QSR (0x040 / 4)
/* R_STATUS */
@@ -41,6 +48,14 @@
#define QSR_RSA_MASK (0x3 << 12)
#define QSR_HASH_MASK (0x3 << 10)
+typedef enum {
+ SBC_OTP_CMD_READ = 0x23b1e361,
+ SBC_OTP_CMD_PROG = 0x23b1e364,
+} SBC_OTP_Command;
+
+#define OTP_DATA_DWORD_COUNT (0x800)
+#define OTP_TOTAL_DWORD_COUNT (0x1000)
+
static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
{
AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -57,6 +72,82 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
return s->regs[addr];
}
+static bool aspeed_sbc_otpmem_read(AspeedSBCState *s,
+ uint32_t otp_addr, Error **errp)
+{
+ MemTxResult ret;
+ AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(s);
+ AspeedOTPMemState *otp = ASPEED_OTPMEM(s->otpmem);
+ uint32_t value;
+
+ if (sc->has_otpmem == false) {
+ trace_aspeed_sbc_otpmem_state("disabled");
+ return true;
+ }
+ ret = address_space_read(&otp->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
+ &value, sizeof(value));
+ if (ret != 0) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Failed to read OTP memory\n");
+ return false;
+ }
+ s->regs[R_CAMP1] = value;
+ trace_aspeed_sbc_otp_read(otp_addr, value);
+
+ return true;
+}
+
+static bool aspeed_sbc_otpmem_prog(AspeedSBCState *s,
+ uint32_t otp_addr, Error **errp)
+{
+ AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(s);
+ AspeedOTPMemState *otp = ASPEED_OTPMEM(s->otpmem);
+ uint32_t value = 0x12345678;
+
+ if (sc->has_otpmem == false) {
+ trace_aspeed_sbc_otpmem_state("disabled");
+ return true;
+ }
+ address_space_write(&otp->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
+ &value, sizeof(value));
+ trace_aspeed_sbc_otp_prog(otp_addr, value);
+
+ return true;
+}
+
+static void aspeed_sbc_handle_command(void *opaque, uint32_t cmd)
+{
+ AspeedSBCState *s = ASPEED_SBC(opaque);
+ Error *local_err = NULL;
+ bool ret = false;
+ uint32_t otp_addr;
+
+ s->regs[R_STATUS] &= ~(OTP_MEM_IDLE | OTP_IDLE);
+ otp_addr = s->regs[R_ADDR];
+
+ switch (cmd) {
+ case SBC_OTP_CMD_READ:
+ ret = aspeed_sbc_otpmem_read(s, otp_addr, &local_err);
+ break;
+ case SBC_OTP_CMD_PROG:
+ ret = aspeed_sbc_otpmem_prog(s, otp_addr, &local_err);
+ break;
+ default:
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Unknown command 0x%x\n",
+ __func__, cmd);
+ break;
+ }
+
+ trace_aspeed_sbc_handle_cmd(cmd, otp_addr, ret);
+ if (ret == false && local_err) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: %s\n",
+ __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ }
+ s->regs[R_STATUS] |= (OTP_MEM_IDLE | OTP_IDLE);
+}
+
static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
unsigned int size)
{
@@ -78,6 +169,9 @@ static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
"%s: write to read only register 0x%" HWADDR_PRIx "\n",
__func__, addr << 2);
return;
+ case R_CMD:
+ aspeed_sbc_handle_command(opaque, data);
+ return;
default:
break;
}
@@ -115,15 +209,82 @@ static void aspeed_sbc_reset(DeviceState *dev)
s->regs[R_QSR] = s->signing_settings;
}
+static void aspeed_otp_machine_init_done_notify(Notifier *n, void *opaque)
+{
+ AspeedSBCState *s = container_of(n, AspeedSBCState, machine_done);
+ Object *machine = qdev_get_machine();
+ Object *sbc = object_resolve_path("/machine/soc/sbc", NULL);
+ char *otpmem_drive = NULL;
+ Object *otp_dev = NULL;
+ Error *local_err = NULL;
+ char otp_path[128];
+
+ if (!sbc || !machine) {
+ error_report("Failed to resolve QOM paths");
+ return;
+ }
+
+ otpmem_drive = object_property_get_str(machine, "otpmem", &local_err);
+ if (local_err) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to get otpmem property, %s\n",
+ error_get_pretty(local_err));
+ error_free(local_err);
+ return;
+ }
+ if (strlen(otpmem_drive)) {
+ snprintf(otp_path, sizeof(otp_path),
+ "/machine/peripheral/%s", otpmem_drive);
+ otp_dev = object_resolve_path(otp_path, NULL);
+ if (otp_dev) {
+ object_property_add_alias(sbc, "otpmem", otp_dev, "drive");
+ } else {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to get otpmem object\n");
+ }
+ } else {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "otpmem-drive is not presented\n");
+ error_free(local_err);
+ }
+ g_free(otpmem_drive);
+
+ if (!otp_dev) {
+ s->otpmem = ASPEED_OTPMEM(object_new(TYPE_ASPEED_OTPMEM));
+ object_initialize_child(OBJECT(s), "otp", s->otpmem,
+ TYPE_ASPEED_OTPMEM);
+ qdev_realize(DEVICE(s->otpmem), NULL, &local_err);
+
+ if (local_err) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "OTP memory realize is failed, err = %s\n",
+ error_get_pretty(local_err));
+ error_free(local_err);
+ }
+ } else {
+ s->otpmem = ASPEED_OTPMEM(otp_dev);
+ }
+}
+
static void aspeed_sbc_realize(DeviceState *dev, Error **errp)
{
AspeedSBCState *s = ASPEED_SBC(dev);
SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(s);
memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sbc_ops, s,
TYPE_ASPEED_SBC, 0x1000);
sysbus_init_mmio(sbd, &s->iomem);
+
+ /*
+ * Blockdev backend is created later than realize stage,
+ * to associate SBC and OTP in a later stage.
+ */
+ if (sc->has_otpmem) {
+ s->machine_done.notify = aspeed_otp_machine_init_done_notify;
+ qemu_add_machine_init_done_notifier(&s->machine_done);
+ }
}
static const VMStateDescription vmstate_aspeed_sbc = {
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index e3f64c0ff6..0f6e2038cf 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -90,6 +90,13 @@ slavio_sysctrl_mem_readl(uint32_t ret) "Read system control 0x%08x"
slavio_led_mem_writew(uint32_t val) "Write diagnostic LED 0x%04x"
slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED 0x%04x"
+# aspped_sbc.c
+aspeed_sbc_otpmem_state(const char *enabled) "OTP Memory is %s"
+aspeed_sbc_ignore_cmd(uint32_t cmd) "Ignoring command 0x%" PRIx32
+aspeed_sbc_handle_cmd(uint32_t cmd, uint32_t addr, bool ret) "Handling command 0x%" PRIx32 " for OTP addr 0x%" PRIx32 " Result: %d"
+aspeed_sbc_otp_read(uint32_t addr, uint32_t value) "OTP Memory read: addr 0x%" PRIx32 " value 0x%" PRIx32
+aspeed_sbc_otp_prog(uint32_t addr, uint32_t value) "OTP Memory write: addr 0x%" PRIx32 " value 0x%" PRIx32
+
# aspeed_scu.c
aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
aspeed_scu_read(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 405e6782b9..858e82861b 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -10,6 +10,7 @@
#define ASPEED_SBC_H
#include "hw/sysbus.h"
+#include "hw/misc/aspeed_otpmem.h"
#define TYPE_ASPEED_SBC "aspeed.sbc"
#define TYPE_ASPEED_AST2600_SBC TYPE_ASPEED_SBC "-ast2600"
@@ -30,16 +31,22 @@ OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
struct AspeedSBCState {
SysBusDevice parent;
+ Notifier machine_done;
+
bool emmc_abr;
uint32_t signing_settings;
MemoryRegion iomem;
uint32_t regs[ASPEED_SBC_NR_REGS];
+
+ AspeedOTPMemState *otpmem;
};
struct AspeedSBCClass {
SysBusDeviceClass parent_class;
+
+ bool has_otpmem;
};
#endif /* ASPEED_SBC_H */
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [RFC v5 2/4] hw/misc/aspeed_sbc: Connect ASPEED OTP memory device to SBC
@ 2025-06-19 6:41 ` Kane Chen via
0 siblings, 0 replies; 10+ messages in thread
From: Kane Chen via @ 2025-06-19 6:41 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Jamin Lin, Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: troy_lee, Kane-Chen-AS
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
This patch connects the aspeed.otpmem device to the ASPEED Secure Boot
Controller (SBC) model. It implements OTP memory access via the SBC's
command interface and enables emulation of secure fuse programming flows.
The following OTP commands are supported:
- READ: reads a 32-bit word from OTP memory into internal registers
- PROG: programs a 32-bit word value to the specified OTP address
The integration supports both externally provided OTP devices (via
-M otpmem=XYZ and -device aspeed.otpmem) and fallback to an internal OTP
instance if no drive is specified.
A dedicated AddressSpace is used to issue memory transactions from SBC
to the OTP backend. Trace events are added to observe read/program
operations and command handling flow.
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
---
hw/misc/aspeed_sbc.c | 161 +++++++++++++++++++++++++++++++++++
hw/misc/trace-events | 7 ++
include/hw/misc/aspeed_sbc.h | 7 ++
3 files changed, 175 insertions(+)
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index a7d101ba71..8e192e9496 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -12,12 +12,19 @@
#include "qemu/log.h"
#include "qemu/error-report.h"
#include "hw/qdev-properties.h"
+#include "system/system.h"
+#include "qemu/notify.h"
#include "hw/misc/aspeed_sbc.h"
#include "qapi/error.h"
#include "migration/vmstate.h"
+#include "trace.h"
#define R_PROT (0x000 / 4)
+#define R_CMD (0x004 / 4)
+#define R_ADDR (0x010 / 4)
#define R_STATUS (0x014 / 4)
+#define R_CAMP1 (0x020 / 4)
+#define R_CAMP2 (0x024 / 4)
#define R_QSR (0x040 / 4)
/* R_STATUS */
@@ -41,6 +48,14 @@
#define QSR_RSA_MASK (0x3 << 12)
#define QSR_HASH_MASK (0x3 << 10)
+typedef enum {
+ SBC_OTP_CMD_READ = 0x23b1e361,
+ SBC_OTP_CMD_PROG = 0x23b1e364,
+} SBC_OTP_Command;
+
+#define OTP_DATA_DWORD_COUNT (0x800)
+#define OTP_TOTAL_DWORD_COUNT (0x1000)
+
static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
{
AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -57,6 +72,82 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
return s->regs[addr];
}
+static bool aspeed_sbc_otpmem_read(AspeedSBCState *s,
+ uint32_t otp_addr, Error **errp)
+{
+ MemTxResult ret;
+ AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(s);
+ AspeedOTPMemState *otp = ASPEED_OTPMEM(s->otpmem);
+ uint32_t value;
+
+ if (sc->has_otpmem == false) {
+ trace_aspeed_sbc_otpmem_state("disabled");
+ return true;
+ }
+ ret = address_space_read(&otp->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
+ &value, sizeof(value));
+ if (ret != 0) {
+ qemu_log_mask(LOG_GUEST_ERROR, "Failed to read OTP memory\n");
+ return false;
+ }
+ s->regs[R_CAMP1] = value;
+ trace_aspeed_sbc_otp_read(otp_addr, value);
+
+ return true;
+}
+
+static bool aspeed_sbc_otpmem_prog(AspeedSBCState *s,
+ uint32_t otp_addr, Error **errp)
+{
+ AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(s);
+ AspeedOTPMemState *otp = ASPEED_OTPMEM(s->otpmem);
+ uint32_t value = 0x12345678;
+
+ if (sc->has_otpmem == false) {
+ trace_aspeed_sbc_otpmem_state("disabled");
+ return true;
+ }
+ address_space_write(&otp->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
+ &value, sizeof(value));
+ trace_aspeed_sbc_otp_prog(otp_addr, value);
+
+ return true;
+}
+
+static void aspeed_sbc_handle_command(void *opaque, uint32_t cmd)
+{
+ AspeedSBCState *s = ASPEED_SBC(opaque);
+ Error *local_err = NULL;
+ bool ret = false;
+ uint32_t otp_addr;
+
+ s->regs[R_STATUS] &= ~(OTP_MEM_IDLE | OTP_IDLE);
+ otp_addr = s->regs[R_ADDR];
+
+ switch (cmd) {
+ case SBC_OTP_CMD_READ:
+ ret = aspeed_sbc_otpmem_read(s, otp_addr, &local_err);
+ break;
+ case SBC_OTP_CMD_PROG:
+ ret = aspeed_sbc_otpmem_prog(s, otp_addr, &local_err);
+ break;
+ default:
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: Unknown command 0x%x\n",
+ __func__, cmd);
+ break;
+ }
+
+ trace_aspeed_sbc_handle_cmd(cmd, otp_addr, ret);
+ if (ret == false && local_err) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "%s: %s\n",
+ __func__, error_get_pretty(local_err));
+ error_free(local_err);
+ }
+ s->regs[R_STATUS] |= (OTP_MEM_IDLE | OTP_IDLE);
+}
+
static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
unsigned int size)
{
@@ -78,6 +169,9 @@ static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
"%s: write to read only register 0x%" HWADDR_PRIx "\n",
__func__, addr << 2);
return;
+ case R_CMD:
+ aspeed_sbc_handle_command(opaque, data);
+ return;
default:
break;
}
@@ -115,15 +209,82 @@ static void aspeed_sbc_reset(DeviceState *dev)
s->regs[R_QSR] = s->signing_settings;
}
+static void aspeed_otp_machine_init_done_notify(Notifier *n, void *opaque)
+{
+ AspeedSBCState *s = container_of(n, AspeedSBCState, machine_done);
+ Object *machine = qdev_get_machine();
+ Object *sbc = object_resolve_path("/machine/soc/sbc", NULL);
+ char *otpmem_drive = NULL;
+ Object *otp_dev = NULL;
+ Error *local_err = NULL;
+ char otp_path[128];
+
+ if (!sbc || !machine) {
+ error_report("Failed to resolve QOM paths");
+ return;
+ }
+
+ otpmem_drive = object_property_get_str(machine, "otpmem", &local_err);
+ if (local_err) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to get otpmem property, %s\n",
+ error_get_pretty(local_err));
+ error_free(local_err);
+ return;
+ }
+ if (strlen(otpmem_drive)) {
+ snprintf(otp_path, sizeof(otp_path),
+ "/machine/peripheral/%s", otpmem_drive);
+ otp_dev = object_resolve_path(otp_path, NULL);
+ if (otp_dev) {
+ object_property_add_alias(sbc, "otpmem", otp_dev, "drive");
+ } else {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "Failed to get otpmem object\n");
+ }
+ } else {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "otpmem-drive is not presented\n");
+ error_free(local_err);
+ }
+ g_free(otpmem_drive);
+
+ if (!otp_dev) {
+ s->otpmem = ASPEED_OTPMEM(object_new(TYPE_ASPEED_OTPMEM));
+ object_initialize_child(OBJECT(s), "otp", s->otpmem,
+ TYPE_ASPEED_OTPMEM);
+ qdev_realize(DEVICE(s->otpmem), NULL, &local_err);
+
+ if (local_err) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "OTP memory realize is failed, err = %s\n",
+ error_get_pretty(local_err));
+ error_free(local_err);
+ }
+ } else {
+ s->otpmem = ASPEED_OTPMEM(otp_dev);
+ }
+}
+
static void aspeed_sbc_realize(DeviceState *dev, Error **errp)
{
AspeedSBCState *s = ASPEED_SBC(dev);
SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+ AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(s);
memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sbc_ops, s,
TYPE_ASPEED_SBC, 0x1000);
sysbus_init_mmio(sbd, &s->iomem);
+
+ /*
+ * Blockdev backend is created later than realize stage,
+ * to associate SBC and OTP in a later stage.
+ */
+ if (sc->has_otpmem) {
+ s->machine_done.notify = aspeed_otp_machine_init_done_notify;
+ qemu_add_machine_init_done_notifier(&s->machine_done);
+ }
}
static const VMStateDescription vmstate_aspeed_sbc = {
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index e3f64c0ff6..0f6e2038cf 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -90,6 +90,13 @@ slavio_sysctrl_mem_readl(uint32_t ret) "Read system control 0x%08x"
slavio_led_mem_writew(uint32_t val) "Write diagnostic LED 0x%04x"
slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED 0x%04x"
+# aspped_sbc.c
+aspeed_sbc_otpmem_state(const char *enabled) "OTP Memory is %s"
+aspeed_sbc_ignore_cmd(uint32_t cmd) "Ignoring command 0x%" PRIx32
+aspeed_sbc_handle_cmd(uint32_t cmd, uint32_t addr, bool ret) "Handling command 0x%" PRIx32 " for OTP addr 0x%" PRIx32 " Result: %d"
+aspeed_sbc_otp_read(uint32_t addr, uint32_t value) "OTP Memory read: addr 0x%" PRIx32 " value 0x%" PRIx32
+aspeed_sbc_otp_prog(uint32_t addr, uint32_t value) "OTP Memory write: addr 0x%" PRIx32 " value 0x%" PRIx32
+
# aspeed_scu.c
aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
aspeed_scu_read(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 405e6782b9..858e82861b 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -10,6 +10,7 @@
#define ASPEED_SBC_H
#include "hw/sysbus.h"
+#include "hw/misc/aspeed_otpmem.h"
#define TYPE_ASPEED_SBC "aspeed.sbc"
#define TYPE_ASPEED_AST2600_SBC TYPE_ASPEED_SBC "-ast2600"
@@ -30,16 +31,22 @@ OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
struct AspeedSBCState {
SysBusDevice parent;
+ Notifier machine_done;
+
bool emmc_abr;
uint32_t signing_settings;
MemoryRegion iomem;
uint32_t regs[ASPEED_SBC_NR_REGS];
+
+ AspeedOTPMemState *otpmem;
};
struct AspeedSBCClass {
SysBusDeviceClass parent_class;
+
+ bool has_otpmem;
};
#endif /* ASPEED_SBC_H */
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [RFC v5 3/4] hw/arm: Integrate ASPEED OTP memory support into AST10x0 and AST2600 SoCs
2025-06-19 6:41 [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs Kane Chen via
2025-06-19 6:41 ` [RFC v5 1/4] hw/misc/aspeed_otp: Add ASPEED OTP memory device model Kane Chen via
2025-06-19 6:41 ` Kane Chen via
@ 2025-06-19 6:41 ` Kane Chen via
2025-06-19 6:41 ` Kane Chen via
2025-06-20 5:44 ` [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs Cédric Le Goater
4 siblings, 0 replies; 10+ messages in thread
From: Kane Chen via @ 2025-06-19 6:41 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Jamin Lin, Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: troy_lee, Kane-Chen-AS
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
This patch exposes a new "otpmem" machine parameter to allow users to
attach an OTP memory device to AST1030 and AST2600-based platforms.
The value of this parameter is passed as a QOM alias to the Secure Boot
Controller (SBC), enabling binding to an aspeed.otpmem device created
via -device. This allows emulation of secure boot flows that rely on
fuse-based configuration stored in OTP memory.
The has_otpmem attribute is enabled in the SBC subclasses for AST10x0
and AST2600 to control the presence of OTP support per SoC type.
Users can preload a custom OTP memory image for boot-time behavior.
For example:
```bash
for i in $(seq 1 2048); do
printf '\x00\x00\x00\x00\xff\xff\xff\xff'
done > otpmem.img
```
Users can test OTP memory integration using the following command,
which loads a file-backed OTP image into the emulated SoC:
```bash
qemu-system-arm -machine ast2600-evb,otpmem=otpmem-drive \
-blockdev driver=file,filename=otpmem.img,node-name=otpmem \
-device aspeed.otpmem,drive=otpmem,id=otpmem-drive \
...
```
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
---
hw/arm/aspeed.c | 20 ++++++++++++++++++++
hw/arm/aspeed_ast10x0.c | 2 +-
hw/arm/aspeed_ast2600.c | 2 +-
hw/misc/aspeed_sbc.c | 18 ++++++++++++++++++
include/hw/misc/aspeed_sbc.h | 1 +
5 files changed, 41 insertions(+), 2 deletions(-)
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index d0b333646e..734416c217 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -47,6 +47,7 @@ struct AspeedMachineState {
uint32_t uart_chosen;
char *fmc_model;
char *spi_model;
+ char *otpmem;
uint32_t hw_strap1;
};
@@ -1199,6 +1200,21 @@ static void aspeed_set_bmc_console(Object *obj, const char *value, Error **errp)
bmc->uart_chosen = val + ASPEED_DEV_UART0;
}
+static char *aspeed_get_otpmem(Object *obj, Error **errp)
+{
+ AspeedMachineState *bmc = ASPEED_MACHINE(obj);
+
+ return g_strdup(bmc->otpmem);
+}
+
+static void aspeed_set_otpmem(Object *obj, const char *value, Error **errp)
+{
+ AspeedMachineState *bmc = ASPEED_MACHINE(obj);
+
+ g_free(bmc->otpmem);
+ bmc->otpmem = g_strdup(value);
+}
+
static void aspeed_machine_class_props_init(ObjectClass *oc)
{
object_class_property_add_bool(oc, "execute-in-place",
@@ -1220,6 +1236,10 @@ static void aspeed_machine_class_props_init(ObjectClass *oc)
aspeed_set_spi_model);
object_class_property_set_description(oc, "spi-model",
"Change the SPI Flash model");
+ object_class_property_add_str(oc, "otpmem", aspeed_get_otpmem,
+ aspeed_set_otpmem);
+ object_class_property_set_description(oc, "otpmem",
+ "Set OTP Memory Drive");
}
static void aspeed_machine_class_init_cpus_defaults(MachineClass *mc)
diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index e6e1ee63c1..c446e70b24 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -154,7 +154,7 @@ static void aspeed_soc_ast1030_init(Object *obj)
object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
- object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
+ object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_AST10X0_SBC);
for (i = 0; i < sc->wdts_num; i++) {
snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index d12707f0ab..59ffd41a4a 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -261,7 +261,7 @@ static void aspeed_soc_ast2600_init(Object *obj)
object_initialize_child(obj, "i3c", &s->i3c, TYPE_ASPEED_I3C);
- object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
+ object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_AST2600_SBC);
object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 8e192e9496..38f6d2745e 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -323,8 +323,10 @@ static const TypeInfo aspeed_sbc_info = {
static void aspeed_ast2600_sbc_class_init(ObjectClass *klass, const void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
+ AspeedSBCClass *sc = ASPEED_SBC_CLASS(klass);
dc->desc = "AST2600 Secure Boot Controller";
+ sc->has_otpmem = true;
}
static const TypeInfo aspeed_ast2600_sbc_info = {
@@ -333,9 +335,25 @@ static const TypeInfo aspeed_ast2600_sbc_info = {
.class_init = aspeed_ast2600_sbc_class_init,
};
+static void aspeed_ast10x0_sbc_class_init(ObjectClass *klass, const void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ AspeedSBCClass *sc = ASPEED_SBC_CLASS(klass);
+
+ dc->desc = "AST10X0 Secure Boot Controller";
+ sc->has_otpmem = true;
+}
+
+static const TypeInfo aspeed_ast10x0_sbc_info = {
+ .name = TYPE_ASPEED_AST10X0_SBC,
+ .parent = TYPE_ASPEED_SBC,
+ .class_init = aspeed_ast10x0_sbc_class_init,
+};
+
static void aspeed_sbc_register_types(void)
{
type_register_static(&aspeed_ast2600_sbc_info);
+ type_register_static(&aspeed_ast10x0_sbc_info);
type_register_static(&aspeed_sbc_info);
}
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 858e82861b..34ee949fad 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -14,6 +14,7 @@
#define TYPE_ASPEED_SBC "aspeed.sbc"
#define TYPE_ASPEED_AST2600_SBC TYPE_ASPEED_SBC "-ast2600"
+#define TYPE_ASPEED_AST10X0_SBC TYPE_ASPEED_SBC "-ast10X0"
OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
#define ASPEED_SBC_NR_REGS (0x93c >> 2)
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [RFC v5 4/4] tests/functional: Add integration tests for ASPEED OTP memory model
2025-06-19 6:41 [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs Kane Chen via
@ 2025-06-19 6:41 ` Kane Chen via
2025-06-19 6:41 ` Kane Chen via
` (3 subsequent siblings)
4 siblings, 0 replies; 10+ messages in thread
From: Kane Chen via @ 2025-06-19 6:41 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Jamin Lin, Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: troy_lee, Kane-Chen-AS
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Introduce a functional test suite to validate the ASPEED OTP memory
device integration under different machine configurations.
The following cases are covered:
- AST2600 with blockdev + device + machine parameter (full binding)
- AST2600 fallback with no machine parameter
- AST2600 with only blockdev + device (no machine param)
- AST2600 with only machine parameter (no backend/device)
- AST1030 fallback test with Zephyr-based image
The tests ensure that the OTP model behaves correctly across boot-time
binding variations and fallback paths, and that firmware boot is
successful under each condition.
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
---
tests/functional/meson.build | 1 +
tests/functional/test_aspeed_otpmem.py | 82 ++++++++++++++++++++++++++
2 files changed, 83 insertions(+)
create mode 100644 tests/functional/test_aspeed_otpmem.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index e9f19d54a2..ce999eeab1 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -41,6 +41,7 @@ test_timeouts = {
'arm_replay' : 240,
'arm_tuxrun' : 240,
'arm_sx1' : 360,
+ 'aspeed_otpmem': 1200,
'intel_iommu': 300,
'mips_malta' : 480,
'mipsel_malta' : 420,
diff --git a/tests/functional/test_aspeed_otpmem.py b/tests/functional/test_aspeed_otpmem.py
new file mode 100644
index 0000000000..67d2a7ecf6
--- /dev/null
+++ b/tests/functional/test_aspeed_otpmem.py
@@ -0,0 +1,82 @@
+
+import os
+import time
+import tempfile
+import subprocess
+
+from qemu_test import LinuxKernelTest, Asset
+from aspeed import AspeedTest
+from qemu_test import exec_command_and_wait_for_pattern, skipIfMissingCommands
+
+class AspeedOtpMemoryTest(AspeedTest):
+ # AST2600 SDK image
+ ASSET_SDK_V906_AST2600 = Asset(
+ 'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2600-default-obmc.tar.gz',
+ '768d76e247896ad78c154b9cff4f766da2ce65f217d620b286a4a03a8a4f68f5')
+
+ # AST1030 Zephyr image
+ ASSET_ZEPHYR_3_00 = Asset(
+ ('https://github.com/AspeedTech-BMC'
+ '/zephyr/releases/download/v00.03.00/ast1030-evb-demo.zip'),
+ '37fe3ecd4a1b9d620971a15b96492a81093435396eeac69b6f3e384262ff555f')
+ def generate_otpmem_image(self):
+ path = self.scratch_file("otpmem.img")
+ pattern = b'\x00\x00\x00\x00\xff\xff\xff\xff' * (16 * 1024 // 8)
+ with open(path, "wb") as f:
+ f.write(pattern)
+ return path
+
+ def test_ast2600_otp_fallback(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ bmc_image = self.scratch_file("ast2600-default", "image-bmc")
+ self.vm.set_machine("ast2600-evb")
+ self.vm.set_console()
+ self.do_test_arm_aspeed_sdk_start(
+ self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern('ast2600-default login:')
+
+ def test_ast2600_otp_blockdev_device(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ otp_img = self.generate_otpmem_image()
+ self.vm.set_console()
+ self.vm.add_args(
+ "-blockdev", f"node-name=otpmem,driver=file,filename={otp_img}",
+ "-device", "aspeed.otpmem,drive=otpmem,id=otpmem-drive",
+ "-machine", "ast2600-evb,otpmem=otpmem-drive"
+ )
+ self.do_test_arm_aspeed_sdk_start(self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern("ast2600-default login:")
+
+ def test_ast2600_otp_only_blockdev(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ otp_img = self.generate_otpmem_image()
+ self.vm.set_machine("ast2600-evb")
+ self.vm.set_console()
+ self.vm.add_args(
+ "-blockdev", f"node-name=otpmem,driver=file,filename={otp_img}",
+ "-device", "aspeed.otpmem,drive=otpmem,id=otpmem-drive",
+ )
+ self.do_test_arm_aspeed_sdk_start(self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern("ast2600-default login:")
+
+ def test_ast2600_otp_only_machine_param(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ self.vm.set_console()
+ self.vm.add_args(
+ "-machine", "ast2600-evb,otpmem=otpmem-drive"
+ )
+ self.do_test_arm_aspeed_sdk_start(self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern("ast2600-default login:")
+
+ def test_ast1030_otp_fallback(self):
+ kernel_name = "ast1030-evb-demo/zephyr.elf"
+ kernel_file = self.archive_extract(self.ASSET_ZEPHYR_3_00, member=kernel_name)
+
+ self.vm.set_machine("ast1030-evb")
+ self.vm.set_console()
+ self.vm.add_args("-kernel", kernel_file)
+ self.vm.launch()
+ self.wait_for_console_pattern("Booting Zephyr OS")
+
+if __name__ == '__main__':
+ AspeedTest.main()
\ No newline at end of file
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [RFC v5 4/4] tests/functional: Add integration tests for ASPEED OTP memory model
@ 2025-06-19 6:41 ` Kane Chen via
0 siblings, 0 replies; 10+ messages in thread
From: Kane Chen via @ 2025-06-19 6:41 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Jamin Lin, Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: troy_lee, Kane-Chen-AS
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Introduce a functional test suite to validate the ASPEED OTP memory
device integration under different machine configurations.
The following cases are covered:
- AST2600 with blockdev + device + machine parameter (full binding)
- AST2600 fallback with no machine parameter
- AST2600 with only blockdev + device (no machine param)
- AST2600 with only machine parameter (no backend/device)
- AST1030 fallback test with Zephyr-based image
The tests ensure that the OTP model behaves correctly across boot-time
binding variations and fallback paths, and that firmware boot is
successful under each condition.
Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
---
tests/functional/meson.build | 1 +
tests/functional/test_aspeed_otpmem.py | 82 ++++++++++++++++++++++++++
2 files changed, 83 insertions(+)
create mode 100644 tests/functional/test_aspeed_otpmem.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index e9f19d54a2..ce999eeab1 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -41,6 +41,7 @@ test_timeouts = {
'arm_replay' : 240,
'arm_tuxrun' : 240,
'arm_sx1' : 360,
+ 'aspeed_otpmem': 1200,
'intel_iommu': 300,
'mips_malta' : 480,
'mipsel_malta' : 420,
diff --git a/tests/functional/test_aspeed_otpmem.py b/tests/functional/test_aspeed_otpmem.py
new file mode 100644
index 0000000000..67d2a7ecf6
--- /dev/null
+++ b/tests/functional/test_aspeed_otpmem.py
@@ -0,0 +1,82 @@
+
+import os
+import time
+import tempfile
+import subprocess
+
+from qemu_test import LinuxKernelTest, Asset
+from aspeed import AspeedTest
+from qemu_test import exec_command_and_wait_for_pattern, skipIfMissingCommands
+
+class AspeedOtpMemoryTest(AspeedTest):
+ # AST2600 SDK image
+ ASSET_SDK_V906_AST2600 = Asset(
+ 'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2600-default-obmc.tar.gz',
+ '768d76e247896ad78c154b9cff4f766da2ce65f217d620b286a4a03a8a4f68f5')
+
+ # AST1030 Zephyr image
+ ASSET_ZEPHYR_3_00 = Asset(
+ ('https://github.com/AspeedTech-BMC'
+ '/zephyr/releases/download/v00.03.00/ast1030-evb-demo.zip'),
+ '37fe3ecd4a1b9d620971a15b96492a81093435396eeac69b6f3e384262ff555f')
+ def generate_otpmem_image(self):
+ path = self.scratch_file("otpmem.img")
+ pattern = b'\x00\x00\x00\x00\xff\xff\xff\xff' * (16 * 1024 // 8)
+ with open(path, "wb") as f:
+ f.write(pattern)
+ return path
+
+ def test_ast2600_otp_fallback(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ bmc_image = self.scratch_file("ast2600-default", "image-bmc")
+ self.vm.set_machine("ast2600-evb")
+ self.vm.set_console()
+ self.do_test_arm_aspeed_sdk_start(
+ self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern('ast2600-default login:')
+
+ def test_ast2600_otp_blockdev_device(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ otp_img = self.generate_otpmem_image()
+ self.vm.set_console()
+ self.vm.add_args(
+ "-blockdev", f"node-name=otpmem,driver=file,filename={otp_img}",
+ "-device", "aspeed.otpmem,drive=otpmem,id=otpmem-drive",
+ "-machine", "ast2600-evb,otpmem=otpmem-drive"
+ )
+ self.do_test_arm_aspeed_sdk_start(self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern("ast2600-default login:")
+
+ def test_ast2600_otp_only_blockdev(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ otp_img = self.generate_otpmem_image()
+ self.vm.set_machine("ast2600-evb")
+ self.vm.set_console()
+ self.vm.add_args(
+ "-blockdev", f"node-name=otpmem,driver=file,filename={otp_img}",
+ "-device", "aspeed.otpmem,drive=otpmem,id=otpmem-drive",
+ )
+ self.do_test_arm_aspeed_sdk_start(self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern("ast2600-default login:")
+
+ def test_ast2600_otp_only_machine_param(self):
+ image_path = self.archive_extract(self.ASSET_SDK_V906_AST2600)
+ self.vm.set_console()
+ self.vm.add_args(
+ "-machine", "ast2600-evb,otpmem=otpmem-drive"
+ )
+ self.do_test_arm_aspeed_sdk_start(self.scratch_file("ast2600-default", "image-bmc"))
+ self.wait_for_console_pattern("ast2600-default login:")
+
+ def test_ast1030_otp_fallback(self):
+ kernel_name = "ast1030-evb-demo/zephyr.elf"
+ kernel_file = self.archive_extract(self.ASSET_ZEPHYR_3_00, member=kernel_name)
+
+ self.vm.set_machine("ast1030-evb")
+ self.vm.set_console()
+ self.vm.add_args("-kernel", kernel_file)
+ self.vm.launch()
+ self.wait_for_console_pattern("Booting Zephyr OS")
+
+if __name__ == '__main__':
+ AspeedTest.main()
\ No newline at end of file
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs
2025-06-19 6:41 [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs Kane Chen via
` (3 preceding siblings ...)
2025-06-19 6:41 ` Kane Chen via
@ 2025-06-20 5:44 ` Cédric Le Goater
2025-06-23 3:23 ` Kane Chen
4 siblings, 1 reply; 10+ messages in thread
From: Cédric Le Goater @ 2025-06-20 5:44 UTC (permalink / raw)
To: Kane Chen, Peter Maydell, Steven Lee, Troy Lee, Jamin Lin,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: troy_lee
Hello Kane,
On 6/19/25 08:41, Kane Chen wrote:
> From: Kane-Chen-AS <kane_chen@aspeedtech.com>
>
> This patch series introduces a QEMU model for the ASPEED OTP (One-Time
> Programmable) memory, along with its integration into the Secure Boot
> Controller (SBC) and supported SoCs (AST2600, AST1030).
>
> The OTP model emulates a simple fuse array used for secure boot or
> device configuration, with support for both file-backed content and
> internal fallback buffers. It exposes an AddressSpace to support
> transaction-based access from controllers like the SBC.
>
> This series includes:
> - OTP memory device implementation
> - SBC integration with command decoding (READ/PROG)
> - Machine property wiring (via "otpmem" alias)
> - A functional test suite covering various initialization paths
>
> **[RFC notice]**
> This is an RFC submission. While the OTP model itself is mostly
> complete, this version is primarily intended to gather feedback on the
> device initialization flow-specifically how the OTP instance is created,
> connected, and exposed via machine properties. Any comment on QOM
> integration style, late binding via notifier, and fallback behavior are
> welcome.
>
> In particular, I am seeking input on:
> - Whether the current notifier-based connection from SBC to OTP is
> appropriate, or if there is a preferred QOM idiom for linking
> peripheral devices post-realize.
> - The use of "optmem" as a drive alias and machine parameter handling.
>
> A more finalized version with any requested changes, documentation,
> and test refinements will follow after review.
>
> Example usage:
> ```bash
> qemu-system-arm -machine ast2600-evb,otpmem=otpmem-drive \
> -blockdev driver=file,filename=otpmem.img,node-name=otpmem \
> -device aspeed.otpmem,drive=otpmem,id=otpmem-drive \
> ...
> ```
>
> Any feedback or suggestions are appreciated!
>
> Thanks,
> Kane
>
> ---
>
> ChangeLog
> ---------
> v5:
> - Switched to notifier-based late binding between SBC and OTP
> - Exposed 'otpmem' as a machine parameter using QOM alias mechanism
> - Added fallback support when no backend is provided
> - Introduced functional test suite covering multiple init configurations
> - Submitted as [RFC] to gather feedback on QOM integration approach
>
> v4:
> - Replaces blockdev backend with memory-mapped AddressSpace access
> - Switches from `-drive` CLI option to `otpmem` machine parameter
> - Restructures the OTP device under the SBC in the QOM tree
>
> v3:
> - Minor fixes and refinements on top of v2 content
>
> v2:
> - Separated the OTP memory into a standalone QEMU device (`aspeed.otpmem`)
> - Replaced ad-hoc file handling with standard `-drive` backend integration
> - Linked OTP to SBC via QOM property for cleaner abstraction
> - Improved memory bounds checking and irreversible programming logic
>
> v1:
> - Embedded OTP logic in the SBC model and created the backing file internally.
>
> ---
>
> Kane-Chen-AS (4):
> hw/misc/aspeed_otp: Add ASPEED OTP memory device model
> hw/misc/aspeed_sbc: Connect ASPEED OTP memory device to SBC
> hw/arm: Integrate ASPEED OTP memory support into AST10x0 and AST2600
> SoCs
> tests/functional: Add integration tests for ASPEED OTP memory model
>
> hw/arm/aspeed.c | 20 +++
> hw/arm/aspeed_ast10x0.c | 2 +-
> hw/arm/aspeed_ast2600.c | 2 +-
> hw/misc/aspeed_otpmem.c | 117 ++++++++++++++++
> hw/misc/aspeed_sbc.c | 179 +++++++++++++++++++++++++
> hw/misc/meson.build | 1 +
> hw/misc/trace-events | 7 +
> include/hw/misc/aspeed_otpmem.h | 35 +++++
> include/hw/misc/aspeed_sbc.h | 8 ++
> tests/functional/meson.build | 1 +
> tests/functional/test_aspeed_otpmem.py | 82 +++++++++++
> 11 files changed, 452 insertions(+), 2 deletions(-)
> create mode 100644 hw/misc/aspeed_otpmem.c
> create mode 100644 include/hw/misc/aspeed_otpmem.h
> create mode 100644 tests/functional/test_aspeed_otpmem.py
>
I would like to see first a proposal without a BlockBackend and
without an 'optmem' machine property. Please rework the series
accordingly.
Thanks,
C.
^ permalink raw reply [flat|nested] 10+ messages in thread* RE: [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs
2025-06-20 5:44 ` [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs Cédric Le Goater
@ 2025-06-23 3:23 ` Kane Chen
2025-06-23 6:45 ` Cédric Le Goater
0 siblings, 1 reply; 10+ messages in thread
From: Kane Chen @ 2025-06-23 3:23 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Jamin Lin, Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Troy Lee
Hi Cédric,
Sure, I will submit a follow-up patch that includes the following changes:
1. Introduce a new OTP memory device model, which provides in-memory storage and implements basic MMIO read/write via address space.
2. Initialize the OTP memory device as a child of the SBC controller.
3. Add command handling logic in the SBC to operate on the OTP memory, supporting both read and program operations.
4. Introduce TYPE_ASPEED_AST2600_SBC to support OTP memory attachment via the SBC class attribute in the AST2600 SoC.
5. Add trace events to facilitate debugging and tracing of OTP memory operations.
As requested, the BlockBackend integration, the otpmem machine property, and the related alias handling will be removed.
Please let me know if there is anything else that should be adjusted.
Best regards,
Kane
> -----Original Message-----
> From: Cédric Le Goater <clg@kaod.org>
> Sent: Friday, June 20, 2025 1:44 PM
> To: Kane Chen <kane_chen@aspeedtech.com>; Peter Maydell
> <peter.maydell@linaro.org>; Steven Lee <steven_lee@aspeedtech.com>; Troy
> Lee <leetroy@gmail.com>; Jamin Lin <jamin_lin@aspeedtech.com>; Andrew
> Jeffery <andrew@codeconstruct.com.au>; Joel Stanley <joel@jms.id.au>;
> open list:ASPEED BMCs <qemu-arm@nongnu.org>; open list:All patches CC
> here <qemu-devel@nongnu.org>
> Cc: Troy Lee <troy_lee@aspeedtech.com>
> Subject: Re: [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and
> integrate with SoCs
>
> Hello Kane,
>
> On 6/19/25 08:41, Kane Chen wrote:
> > From: Kane-Chen-AS <kane_chen@aspeedtech.com>
> >
> > This patch series introduces a QEMU model for the ASPEED OTP (One-Time
> > Programmable) memory, along with its integration into the Secure Boot
> > Controller (SBC) and supported SoCs (AST2600, AST1030).
> >
> > The OTP model emulates a simple fuse array used for secure boot or
> > device configuration, with support for both file-backed content and
> > internal fallback buffers. It exposes an AddressSpace to support
> > transaction-based access from controllers like the SBC.
> >
> > This series includes:
> > - OTP memory device implementation
> > - SBC integration with command decoding (READ/PROG)
> > - Machine property wiring (via "otpmem" alias)
> > - A functional test suite covering various initialization paths
> >
> > **[RFC notice]**
> > This is an RFC submission. While the OTP model itself is mostly
> > complete, this version is primarily intended to gather feedback on the
> > device initialization flow-specifically how the OTP instance is
> > created, connected, and exposed via machine properties. Any comment on
> > QOM integration style, late binding via notifier, and fallback
> > behavior are welcome.
> >
> > In particular, I am seeking input on:
> > - Whether the current notifier-based connection from SBC to OTP is
> > appropriate, or if there is a preferred QOM idiom for linking
> > peripheral devices post-realize.
> > - The use of "optmem" as a drive alias and machine parameter handling.
> >
> > A more finalized version with any requested changes, documentation,
> > and test refinements will follow after review.
> >
> > Example usage:
> > ```bash
> > qemu-system-arm -machine ast2600-evb,otpmem=otpmem-drive \
> > -blockdev driver=file,filename=otpmem.img,node-name=otpmem \
> > -device aspeed.otpmem,drive=otpmem,id=otpmem-drive \
> > ...
> > ```
> >
> > Any feedback or suggestions are appreciated!
> >
> > Thanks,
> > Kane
> >
> > ---
> >
> > ChangeLog
> > ---------
> > v5:
> > - Switched to notifier-based late binding between SBC and OTP
> > - Exposed 'otpmem' as a machine parameter using QOM alias mechanism
> > - Added fallback support when no backend is provided
> > - Introduced functional test suite covering multiple init
> > configurations
> > - Submitted as [RFC] to gather feedback on QOM integration approach
> >
> > v4:
> > - Replaces blockdev backend with memory-mapped AddressSpace access
> > - Switches from `-drive` CLI option to `otpmem` machine parameter
> > - Restructures the OTP device under the SBC in the QOM tree
> >
> > v3:
> > - Minor fixes and refinements on top of v2 content
> >
> > v2:
> > - Separated the OTP memory into a standalone QEMU device
> > (`aspeed.otpmem`)
> > - Replaced ad-hoc file handling with standard `-drive` backend
> > integration
> > - Linked OTP to SBC via QOM property for cleaner abstraction
> > - Improved memory bounds checking and irreversible programming logic
> >
> > v1:
> > - Embedded OTP logic in the SBC model and created the backing file
> internally.
> >
> > ---
> >
> > Kane-Chen-AS (4):
> > hw/misc/aspeed_otp: Add ASPEED OTP memory device model
> > hw/misc/aspeed_sbc: Connect ASPEED OTP memory device to SBC
> > hw/arm: Integrate ASPEED OTP memory support into AST10x0 and
> AST2600
> > SoCs
> > tests/functional: Add integration tests for ASPEED OTP memory model
> >
> > hw/arm/aspeed.c | 20 +++
> > hw/arm/aspeed_ast10x0.c | 2 +-
> > hw/arm/aspeed_ast2600.c | 2 +-
> > hw/misc/aspeed_otpmem.c | 117
> ++++++++++++++++
> > hw/misc/aspeed_sbc.c | 179
> +++++++++++++++++++++++++
> > hw/misc/meson.build | 1 +
> > hw/misc/trace-events | 7 +
> > include/hw/misc/aspeed_otpmem.h | 35 +++++
> > include/hw/misc/aspeed_sbc.h | 8 ++
> > tests/functional/meson.build | 1 +
> > tests/functional/test_aspeed_otpmem.py | 82 +++++++++++
> > 11 files changed, 452 insertions(+), 2 deletions(-)
> > create mode 100644 hw/misc/aspeed_otpmem.c
> > create mode 100644 include/hw/misc/aspeed_otpmem.h
> > create mode 100644 tests/functional/test_aspeed_otpmem.py
> >
>
> I would like to see first a proposal without a BlockBackend and without an
> 'optmem' machine property. Please rework the series accordingly.
>
> Thanks,
>
> C.
>
>
>
>
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [RFC v5 0/4] Add QEMU model for ASPEED OTP memory and integrate with SoCs
2025-06-23 3:23 ` Kane Chen
@ 2025-06-23 6:45 ` Cédric Le Goater
0 siblings, 0 replies; 10+ messages in thread
From: Cédric Le Goater @ 2025-06-23 6:45 UTC (permalink / raw)
To: Kane Chen, Peter Maydell, Steven Lee, Troy Lee, Jamin Lin,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: Troy Lee
Hello Kane,
On 6/23/25 05:23, Kane Chen wrote:
> Hi Cédric,
>
> Sure, I will submit a follow-up patch that includes the following changes:
>
> 1. Introduce a new OTP memory device model, which provides in-memory storage and implements basic MMIO read/write via address space.
> 2. Initialize the OTP memory device as a child of the SBC controller.
> 3. Add command handling logic in the SBC to operate on the OTP memory, supporting both read and program operations.
> 4. Introduce TYPE_ASPEED_AST2600_SBC to support OTP memory attachment via the SBC class attribute in the AST2600 SoC.
> 5. Add trace events to facilitate debugging and tracing of OTP memory operations.
>
> As requested, the BlockBackend integration, the otpmem machine property, and the related alias handling will be removed.
> Please let me know if there is anything else that should be adjusted.
Looks good.
Then, we will re-introduce the BlockBackend and last, the 'otpmem'
machine property.
Thanks,
C.
^ permalink raw reply [flat|nested] 10+ messages in thread