* [PATCH v2 00/11] Add SSP/TSP power control and DRAM remap support for AST2700
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This series improves AST2700 platform support by aligning SSP/TSP
power and reset behavior with hardware, and enabling DRAM remapping
required for proper firmware boot flow.
v1:
1. The changes move DRAM/SDMC initialization earlier to support memory
aliasing, add DRAM aliases for SSP/TSP SDRAM remap, and implement
SSP/TSP reset, power-on, and remap controls via SCU registers.
2. With these updates, SSP and TSP can be booted via PSP and load their
binaries from DRAM. Functional tests and documentation are updated
accordingly.
v2:
Fix "make check" failure caused by both AST2700 and AST1700 realizing the same
TYPE_AST2700_SCU model.
Jamin Lin (11):
hw/arm/ast27x0: Move DRAM and SDMC initialization earlier to support
memory aliasing
hw/arm/ast27x0: Start SSP in powered-off state to match hardware
behavior
hw/arm/ast27x0: Start TSP in powered-off state to match hardware
behavior
hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap
hw/arm/ast27x0: Add DRAM alias for TSP SDRAM remap
hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU
registers
hw/misc/aspeed_scu: Implement TSP reset and power-on control via SCU
registers
hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap
hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap
tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP
and load binaries from DRAM
docs: Add support vbootrom and update Manual boot for ast2700fc
docs/system/arm/aspeed.rst | 37 ++-
include/hw/misc/aspeed_scu.h | 6 +
hw/arm/aspeed_ast27x0-fc.c | 4 +
hw/arm/aspeed_ast27x0-ssp.c | 13 +
hw/arm/aspeed_ast27x0-tsp.c | 10 +
hw/arm/aspeed_ast27x0.c | 46 +--
hw/misc/aspeed_scu.c | 268 +++++++++++++++++-
.../aarch64/test_aspeed_ast2700fc.py | 35 ++-
8 files changed, 378 insertions(+), 41 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 24+ messages in thread* [PATCH v2 01/11] hw/arm/ast27x0: Move DRAM and SDMC initialization earlier to support memory aliasing
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
To support DRAM aliasing for coprocessors (SSP/TSP), this commit moves the
initialization of the SDMC (SDRAM controller) and DRAM models earlier in
the device realization order.
In the upcoming changes, the PSP will expose a portion of its DRAM as shared
memory by creating a memory region alias at a specific offset. This alias is
mapped into the coprocessor's SDRAM address space, allowing both PSP and the
coprocessor (SSP/TSP) to access the same physical memory through their respective
views — PSP via its DRAM, and the coprocessor via its SDRAM.
The remapping is configured through SCU registers and enables shared memory
communication between PSP and the coprocessors.
Therefore, the DRAM and SDMC devices must be realized before:
- the SCU, which configures the alias offset and size
- the coprocessors, which access the alias through their SDRAM window
No functional change.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0.c | 40 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index d17f446661..74a004adca 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -702,6 +702,26 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
}
+ /*
+ * SDMC - SDRAM Memory Controller
+ * The SDMC controller is unlocked at SPL stage.
+ * At present, only supports to emulate booting
+ * start from u-boot stage. Set SDMC controller
+ * unlocked by default. It is a temporarily solution.
+ */
+ object_property_set_bool(OBJECT(&s->sdmc), "unlocked", true,
+ &error_abort);
+ if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
+ return;
+ }
+ aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdmc), 0,
+ sc->memmap[ASPEED_DEV_SDMC]);
+
+ /* RAM */
+ if (!aspeed_soc_ast2700_dram_init(dev, errp)) {
+ return;
+ }
+
/* SRAM */
name = g_strdup_printf("aspeed.sram.%d", CPU(&a->cpu[0])->cpu_index);
if (!memory_region_init_ram(&s->sram, OBJECT(s), name, sc->sram_size,
@@ -792,26 +812,6 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
ASPEED_DEV_EHCI1 + i));
}
- /*
- * SDMC - SDRAM Memory Controller
- * The SDMC controller is unlocked at SPL stage.
- * At present, only supports to emulate booting
- * start from u-boot stage. Set SDMC controller
- * unlocked by default. It is a temporarily solution.
- */
- object_property_set_bool(OBJECT(&s->sdmc), "unlocked", true,
- &error_abort);
- if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
- return;
- }
- aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdmc), 0,
- sc->memmap[ASPEED_DEV_SDMC]);
-
- /* RAM */
- if (!aspeed_soc_ast2700_dram_init(dev, errp)) {
- return;
- }
-
/* Net */
for (i = 0; i < sc->macs_num; i++) {
object_property_set_bool(OBJECT(&s->ftgmac100[i]), "aspeed", true,
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 01/11] hw/arm/ast27x0: Move DRAM and SDMC initialization earlier to support memory aliasing
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
To support DRAM aliasing for coprocessors (SSP/TSP), this commit moves the
initialization of the SDMC (SDRAM controller) and DRAM models earlier in
the device realization order.
In the upcoming changes, the PSP will expose a portion of its DRAM as shared
memory by creating a memory region alias at a specific offset. This alias is
mapped into the coprocessor's SDRAM address space, allowing both PSP and the
coprocessor (SSP/TSP) to access the same physical memory through their respective
views — PSP via its DRAM, and the coprocessor via its SDRAM.
The remapping is configured through SCU registers and enables shared memory
communication between PSP and the coprocessors.
Therefore, the DRAM and SDMC devices must be realized before:
- the SCU, which configures the alias offset and size
- the coprocessors, which access the alias through their SDRAM window
No functional change.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0.c | 40 ++++++++++++++++++++--------------------
1 file changed, 20 insertions(+), 20 deletions(-)
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index d17f446661..74a004adca 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -702,6 +702,26 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
}
+ /*
+ * SDMC - SDRAM Memory Controller
+ * The SDMC controller is unlocked at SPL stage.
+ * At present, only supports to emulate booting
+ * start from u-boot stage. Set SDMC controller
+ * unlocked by default. It is a temporarily solution.
+ */
+ object_property_set_bool(OBJECT(&s->sdmc), "unlocked", true,
+ &error_abort);
+ if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
+ return;
+ }
+ aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdmc), 0,
+ sc->memmap[ASPEED_DEV_SDMC]);
+
+ /* RAM */
+ if (!aspeed_soc_ast2700_dram_init(dev, errp)) {
+ return;
+ }
+
/* SRAM */
name = g_strdup_printf("aspeed.sram.%d", CPU(&a->cpu[0])->cpu_index);
if (!memory_region_init_ram(&s->sram, OBJECT(s), name, sc->sram_size,
@@ -792,26 +812,6 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
ASPEED_DEV_EHCI1 + i));
}
- /*
- * SDMC - SDRAM Memory Controller
- * The SDMC controller is unlocked at SPL stage.
- * At present, only supports to emulate booting
- * start from u-boot stage. Set SDMC controller
- * unlocked by default. It is a temporarily solution.
- */
- object_property_set_bool(OBJECT(&s->sdmc), "unlocked", true,
- &error_abort);
- if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
- return;
- }
- aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdmc), 0,
- sc->memmap[ASPEED_DEV_SDMC]);
-
- /* RAM */
- if (!aspeed_soc_ast2700_dram_init(dev, errp)) {
- return;
- }
-
/* Net */
for (i = 0; i < sc->macs_num; i++) {
object_property_set_bool(OBJECT(&s->ftgmac100[i]), "aspeed", true,
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 02/11] hw/arm/ast27x0: Start SSP in powered-off state to match hardware behavior
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
In the previous design, both the PSP and SSP were started together during
SoC initialization. However, on real hardware, the SSP begins in a powered-off
state. The typical boot sequence involves the PSP powering up first, loading
the SSP firmware binary into shared memory via DRAM remap, and then releasing
the SSP reset and enabling it through SCU control registers.
To more accurately model this behavior in QEMU, this commit sets the
"start-powered-off" property for the SSP's ARMv7M core. This change ensures
the SSP remains off until explicitly enabled via the SCU, simulating the
real-world flow where the PSP controls SSP boot through SCU interaction.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0-ssp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index cee937b37e..cba59ae11a 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -165,6 +165,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
object_property_set_link(OBJECT(&a->armv7m), "memory",
OBJECT(s->memory), &error_abort);
+ /*
+ * The SSP starts in a powered-down state and can be powered up
+ * by setting the SSP Control Register through the SCU
+ * (System Control Unit)
+ */
+ object_property_set_bool(OBJECT(&a->armv7m), "start-powered-off", true,
+ &error_abort);
sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
/* SDRAM */
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 02/11] hw/arm/ast27x0: Start SSP in powered-off state to match hardware behavior
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
In the previous design, both the PSP and SSP were started together during
SoC initialization. However, on real hardware, the SSP begins in a powered-off
state. The typical boot sequence involves the PSP powering up first, loading
the SSP firmware binary into shared memory via DRAM remap, and then releasing
the SSP reset and enabling it through SCU control registers.
To more accurately model this behavior in QEMU, this commit sets the
"start-powered-off" property for the SSP's ARMv7M core. This change ensures
the SSP remains off until explicitly enabled via the SCU, simulating the
real-world flow where the PSP controls SSP boot through SCU interaction.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0-ssp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index cee937b37e..cba59ae11a 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -165,6 +165,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
object_property_set_link(OBJECT(&a->armv7m), "memory",
OBJECT(s->memory), &error_abort);
+ /*
+ * The SSP starts in a powered-down state and can be powered up
+ * by setting the SSP Control Register through the SCU
+ * (System Control Unit)
+ */
+ object_property_set_bool(OBJECT(&a->armv7m), "start-powered-off", true,
+ &error_abort);
sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
/* SDRAM */
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 03/11] hw/arm/ast27x0: Start TSP in powered-off state to match hardware behavior
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
In the previous design, both the PSP and TSP were started together during
SoC initialization. However, on real hardware, the TSP begins in a powered-off
state. The typical boot sequence involves the PSP powering up first, loading
the TSP firmware binary into shared memory via DRAM remap, and then releasing
the TSP reset and enabling it through SCU control registers.
To more accurately model this behavior in QEMU, this commit sets the
"start-powered-off" property for the TSP's ARMv7M core. This change ensures
the TSP remains off until explicitly enabled via the SCU, simulating the
real-world flow where the PSP controls TSP boot through SCU interaction.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0-tsp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 9c11c016ca..46691080d1 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -165,6 +165,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
object_property_set_link(OBJECT(&a->armv7m), "memory",
OBJECT(s->memory), &error_abort);
+ /*
+ * The TSP starts in a powered-down state and can be powered up
+ * by setting the TSP Control Register through the SCU
+ * (System Control Unit)
+ */
+ object_property_set_bool(OBJECT(&a->armv7m), "start-powered-off", true,
+ &error_abort);
sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
/* SDRAM */
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 03/11] hw/arm/ast27x0: Start TSP in powered-off state to match hardware behavior
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
In the previous design, both the PSP and TSP were started together during
SoC initialization. However, on real hardware, the TSP begins in a powered-off
state. The typical boot sequence involves the PSP powering up first, loading
the TSP firmware binary into shared memory via DRAM remap, and then releasing
the TSP reset and enabling it through SCU control registers.
To more accurately model this behavior in QEMU, this commit sets the
"start-powered-off" property for the TSP's ARMv7M core. This change ensures
the TSP remains off until explicitly enabled via the SCU, simulating the
real-world flow where the PSP controls TSP boot through SCU interaction.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0-tsp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 9c11c016ca..46691080d1 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -165,6 +165,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
object_property_set_link(OBJECT(&a->armv7m), "memory",
OBJECT(s->memory), &error_abort);
+ /*
+ * The TSP starts in a powered-down state and can be powered up
+ * by setting the TSP Control Register through the SCU
+ * (System Control Unit)
+ */
+ object_property_set_bool(OBJECT(&a->armv7m), "start-powered-off", true,
+ &error_abort);
sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
/* SDRAM */
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 04/11] hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds two MemoryRegion aliases to support PSP access to
SSP SDRAM through shared memory remapping, as defined by the default SCU
configuration.
The SSP exposes two DRAM aliases:
- remap1 maps PSP DRAM at 0x400000000 (32MB) to SSP SDRAM offset 0x2000000
- remap2 maps PSP DRAM at 0x42c000000 (32MB) to SSP SDRAM offset 0x0
These regions correspond to the default SCU register values, which control
the mapping between PSP and coprocessor memory windows.
Set SSP CPUID 4 and bumps the SCU VMState version to 3.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/misc/aspeed_scu.h | 5 +++++
hw/arm/aspeed_ast27x0-fc.c | 2 ++
hw/arm/aspeed_ast27x0-ssp.c | 6 ++++++
hw/arm/aspeed_ast27x0.c | 4 ++++
hw/misc/aspeed_scu.c | 38 ++++++++++++++++++++++++++++++++++--
5 files changed, 53 insertions(+), 2 deletions(-)
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 9e28bd4d2e..6f7f7d2766 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -39,6 +39,10 @@ struct AspeedSCUState {
uint32_t hw_strap1;
uint32_t hw_strap2;
uint32_t hw_prot_key;
+
+ MemoryRegion dram_remap_alias[3];
+ MemoryRegion *dram;
+ int ssp_cpuid;
};
#define AST2400_A0_SILICON_REV 0x02000303U
@@ -73,6 +77,7 @@ struct AspeedSCUClass {
uint32_t nr_regs;
bool clkin_25Mhz;
const MemoryRegionOps *ops;
+ void (*dram_remap)(AspeedSCUState *s);
};
#define ASPEED_SCU_PROT_KEY 0x1688A8A8
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 0502a137f3..b788e6ca2a 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -101,6 +101,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
sc->uarts_num, serial_hd(1));
aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
sc->uarts_num, serial_hd(2));
+ object_property_set_int(OBJECT(&s->ca35), "ssp-cpuid", 4,
+ &error_abort);
if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index cba59ae11a..cf1339e2c7 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -198,6 +198,12 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
&s->scu_alias);
+ /* SDRAM remap alias used by PSP to access SSP SDRAM */
+ memory_region_add_subregion(&s->sdram, 0, &s->scu->dram_remap_alias[1]);
+ memory_region_add_subregion(&s->sdram,
+ memory_region_size(&s->scu->dram_remap_alias[1]),
+ &s->scu->dram_remap_alias[0]);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 74a004adca..ae8b22fc1c 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -389,6 +389,8 @@ static void aspeed_soc_ast2700_init(Object *obj)
"hw-strap1");
object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
"hw-prot-key");
+ object_property_add_alias(obj, "ssp-cpuid", OBJECT(&s->scu),
+ "ssp-cpuid");
object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
qdev_prop_set_uint32(DEVICE(&s->scuio), "silicon-rev",
@@ -740,6 +742,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
sc->memmap[ASPEED_DEV_VBOOTROM], &s->vbootrom);
/* SCU */
+ object_property_set_link(OBJECT(&s->scu), "dram", OBJECT(s->dram_mr),
+ &error_abort);
if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
return;
}
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 6829efa2dc..f8d0d3a3fc 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -20,6 +20,7 @@
#include "qemu/guest-random.h"
#include "qemu/module.h"
#include "trace.h"
+#include "qemu/units.h"
#define TO_REG(offset) ((offset) >> 2)
@@ -602,12 +603,20 @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
TYPE_ASPEED_SCU, SCU_IO_REGION_SIZE);
sysbus_init_mmio(sbd, &s->iomem);
+
+ if (s->ssp_cpuid > 0) {
+ if (!s->dram) {
+ error_setg(errp, TYPE_ASPEED_SCU ": 'dram' link not set");
+ return;
+ }
+ asc->dram_remap(s);
+ }
}
static const VMStateDescription vmstate_aspeed_scu = {
.name = "aspeed.scu",
- .version_id = 2,
- .minimum_version_id = 2,
+ .version_id = 3,
+ .minimum_version_id = 3,
.fields = (const VMStateField[]) {
VMSTATE_UINT32_ARRAY(regs, AspeedSCUState, ASPEED_AST2600_SCU_NR_REGS),
VMSTATE_END_OF_LIST()
@@ -619,6 +628,9 @@ static const Property aspeed_scu_properties[] = {
DEFINE_PROP_UINT32("hw-strap1", AspeedSCUState, hw_strap1, 0),
DEFINE_PROP_UINT32("hw-strap2", AspeedSCUState, hw_strap2, 0),
DEFINE_PROP_UINT32("hw-prot-key", AspeedSCUState, hw_prot_key, 0),
+ DEFINE_PROP_INT32("ssp-cpuid", AspeedSCUState, ssp_cpuid, -1),
+ DEFINE_PROP_LINK("dram", AspeedSCUState, dram, TYPE_MEMORY_REGION,
+ MemoryRegion *),
};
static void aspeed_scu_class_init(ObjectClass *klass, const void *data)
@@ -872,6 +884,27 @@ static const TypeInfo aspeed_2600_scu_info = {
.class_init = aspeed_2600_scu_class_init,
};
+static void aspeed_2700_scu_dram_remap_alias_init(AspeedSCUState *s)
+{
+ if (s->ssp_cpuid > 0) {
+ /*
+ * The SSP coprocessor uses two memory aliases (remap1 and remap2)
+ * to access shared memory regions in the PSP DRAM:
+ *
+ * - remap1 maps PSP DRAM at 0x400000000 (size: 32MB) to SSP SDRAM
+ * offset 0x2000000
+ * - remap2 maps PSP DRAM at 0x42c000000 (size: 32MB) to SSP SDRAM
+ * offset 0x0
+ */
+ memory_region_init_alias(&s->dram_remap_alias[0], OBJECT(s),
+ "ssp.dram.remap1", s->dram,
+ 0, 32 * MiB);
+ memory_region_init_alias(&s->dram_remap_alias[1], OBJECT(s),
+ "ssp.dram.remap2", s->dram,
+ 0x2c000000, 32 * MiB);
+ }
+}
+
static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
unsigned size)
{
@@ -982,6 +1015,7 @@ static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
asc->nr_regs = ASPEED_AST2700_SCU_NR_REGS;
asc->clkin_25Mhz = true;
asc->ops = &aspeed_ast2700_scu_ops;
+ asc->dram_remap = aspeed_2700_scu_dram_remap_alias_init;
}
static uint64_t aspeed_ast2700_scuio_read(void *opaque, hwaddr offset,
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 04/11] hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds two MemoryRegion aliases to support PSP access to
SSP SDRAM through shared memory remapping, as defined by the default SCU
configuration.
The SSP exposes two DRAM aliases:
- remap1 maps PSP DRAM at 0x400000000 (32MB) to SSP SDRAM offset 0x2000000
- remap2 maps PSP DRAM at 0x42c000000 (32MB) to SSP SDRAM offset 0x0
These regions correspond to the default SCU register values, which control
the mapping between PSP and coprocessor memory windows.
Set SSP CPUID 4 and bumps the SCU VMState version to 3.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/misc/aspeed_scu.h | 5 +++++
hw/arm/aspeed_ast27x0-fc.c | 2 ++
hw/arm/aspeed_ast27x0-ssp.c | 6 ++++++
hw/arm/aspeed_ast27x0.c | 4 ++++
hw/misc/aspeed_scu.c | 38 ++++++++++++++++++++++++++++++++++--
5 files changed, 53 insertions(+), 2 deletions(-)
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 9e28bd4d2e..6f7f7d2766 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -39,6 +39,10 @@ struct AspeedSCUState {
uint32_t hw_strap1;
uint32_t hw_strap2;
uint32_t hw_prot_key;
+
+ MemoryRegion dram_remap_alias[3];
+ MemoryRegion *dram;
+ int ssp_cpuid;
};
#define AST2400_A0_SILICON_REV 0x02000303U
@@ -73,6 +77,7 @@ struct AspeedSCUClass {
uint32_t nr_regs;
bool clkin_25Mhz;
const MemoryRegionOps *ops;
+ void (*dram_remap)(AspeedSCUState *s);
};
#define ASPEED_SCU_PROT_KEY 0x1688A8A8
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 0502a137f3..b788e6ca2a 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -101,6 +101,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
sc->uarts_num, serial_hd(1));
aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
sc->uarts_num, serial_hd(2));
+ object_property_set_int(OBJECT(&s->ca35), "ssp-cpuid", 4,
+ &error_abort);
if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index cba59ae11a..cf1339e2c7 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -198,6 +198,12 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
&s->scu_alias);
+ /* SDRAM remap alias used by PSP to access SSP SDRAM */
+ memory_region_add_subregion(&s->sdram, 0, &s->scu->dram_remap_alias[1]);
+ memory_region_add_subregion(&s->sdram,
+ memory_region_size(&s->scu->dram_remap_alias[1]),
+ &s->scu->dram_remap_alias[0]);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 74a004adca..ae8b22fc1c 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -389,6 +389,8 @@ static void aspeed_soc_ast2700_init(Object *obj)
"hw-strap1");
object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
"hw-prot-key");
+ object_property_add_alias(obj, "ssp-cpuid", OBJECT(&s->scu),
+ "ssp-cpuid");
object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
qdev_prop_set_uint32(DEVICE(&s->scuio), "silicon-rev",
@@ -740,6 +742,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
sc->memmap[ASPEED_DEV_VBOOTROM], &s->vbootrom);
/* SCU */
+ object_property_set_link(OBJECT(&s->scu), "dram", OBJECT(s->dram_mr),
+ &error_abort);
if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
return;
}
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 6829efa2dc..f8d0d3a3fc 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -20,6 +20,7 @@
#include "qemu/guest-random.h"
#include "qemu/module.h"
#include "trace.h"
+#include "qemu/units.h"
#define TO_REG(offset) ((offset) >> 2)
@@ -602,12 +603,20 @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
TYPE_ASPEED_SCU, SCU_IO_REGION_SIZE);
sysbus_init_mmio(sbd, &s->iomem);
+
+ if (s->ssp_cpuid > 0) {
+ if (!s->dram) {
+ error_setg(errp, TYPE_ASPEED_SCU ": 'dram' link not set");
+ return;
+ }
+ asc->dram_remap(s);
+ }
}
static const VMStateDescription vmstate_aspeed_scu = {
.name = "aspeed.scu",
- .version_id = 2,
- .minimum_version_id = 2,
+ .version_id = 3,
+ .minimum_version_id = 3,
.fields = (const VMStateField[]) {
VMSTATE_UINT32_ARRAY(regs, AspeedSCUState, ASPEED_AST2600_SCU_NR_REGS),
VMSTATE_END_OF_LIST()
@@ -619,6 +628,9 @@ static const Property aspeed_scu_properties[] = {
DEFINE_PROP_UINT32("hw-strap1", AspeedSCUState, hw_strap1, 0),
DEFINE_PROP_UINT32("hw-strap2", AspeedSCUState, hw_strap2, 0),
DEFINE_PROP_UINT32("hw-prot-key", AspeedSCUState, hw_prot_key, 0),
+ DEFINE_PROP_INT32("ssp-cpuid", AspeedSCUState, ssp_cpuid, -1),
+ DEFINE_PROP_LINK("dram", AspeedSCUState, dram, TYPE_MEMORY_REGION,
+ MemoryRegion *),
};
static void aspeed_scu_class_init(ObjectClass *klass, const void *data)
@@ -872,6 +884,27 @@ static const TypeInfo aspeed_2600_scu_info = {
.class_init = aspeed_2600_scu_class_init,
};
+static void aspeed_2700_scu_dram_remap_alias_init(AspeedSCUState *s)
+{
+ if (s->ssp_cpuid > 0) {
+ /*
+ * The SSP coprocessor uses two memory aliases (remap1 and remap2)
+ * to access shared memory regions in the PSP DRAM:
+ *
+ * - remap1 maps PSP DRAM at 0x400000000 (size: 32MB) to SSP SDRAM
+ * offset 0x2000000
+ * - remap2 maps PSP DRAM at 0x42c000000 (size: 32MB) to SSP SDRAM
+ * offset 0x0
+ */
+ memory_region_init_alias(&s->dram_remap_alias[0], OBJECT(s),
+ "ssp.dram.remap1", s->dram,
+ 0, 32 * MiB);
+ memory_region_init_alias(&s->dram_remap_alias[1], OBJECT(s),
+ "ssp.dram.remap2", s->dram,
+ 0x2c000000, 32 * MiB);
+ }
+}
+
static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
unsigned size)
{
@@ -982,6 +1015,7 @@ static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
asc->nr_regs = ASPEED_AST2700_SCU_NR_REGS;
asc->clkin_25Mhz = true;
asc->ops = &aspeed_ast2700_scu_ops;
+ asc->dram_remap = aspeed_2700_scu_dram_remap_alias_init;
}
static uint64_t aspeed_ast2700_scuio_read(void *opaque, hwaddr offset,
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 05/11] hw/arm/ast27x0: Add DRAM alias for TSP SDRAM remap
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds a MemoryRegion alias to support PSP access to
TSP SDRAM through shared memory remapping, as defined by the default SCU
configuration.
The TSP coprocessor exposes one DRAM alias:
- remap maps PSP DRAM at 0x42e000000 (32MB) to TSP SDRAM offset 0x0
This region corresponds to the default SCU register value, which controls
the mapping between PSP and coprocessor memory windows.
Set TSP CPUID 5. SCU VMState version remains at 3, as it was already bumped in a
previous commit.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/misc/aspeed_scu.h | 1 +
hw/arm/aspeed_ast27x0-fc.c | 2 ++
hw/arm/aspeed_ast27x0-tsp.c | 3 +++
hw/arm/aspeed_ast27x0.c | 2 ++
hw/misc/aspeed_scu.c | 17 ++++++++++++++++-
5 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 6f7f7d2766..1e18dcd4a5 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -43,6 +43,7 @@ struct AspeedSCUState {
MemoryRegion dram_remap_alias[3];
MemoryRegion *dram;
int ssp_cpuid;
+ int tsp_cpuid;
};
#define AST2400_A0_SILICON_REV 0x02000303U
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index b788e6ca2a..e03f6870e7 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -103,6 +103,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
sc->uarts_num, serial_hd(2));
object_property_set_int(OBJECT(&s->ca35), "ssp-cpuid", 4,
&error_abort);
+ object_property_set_int(OBJECT(&s->ca35), "tsp-cpuid", 5,
+ &error_abort);
if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 46691080d1..5d2977b45c 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -198,6 +198,9 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
&s->scu_alias);
+ /* SDRAM remap alias used by PSP to access TSP SDRAM */
+ memory_region_add_subregion(&s->sdram, 0, &s->scu->dram_remap_alias[2]);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index ae8b22fc1c..6e4b456b8c 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -391,6 +391,8 @@ static void aspeed_soc_ast2700_init(Object *obj)
"hw-prot-key");
object_property_add_alias(obj, "ssp-cpuid", OBJECT(&s->scu),
"ssp-cpuid");
+ object_property_add_alias(obj, "tsp-cpuid", OBJECT(&s->scu),
+ "tsp-cpuid");
object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
qdev_prop_set_uint32(DEVICE(&s->scuio), "silicon-rev",
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index f8d0d3a3fc..3027ac0687 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -604,7 +604,7 @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
sysbus_init_mmio(sbd, &s->iomem);
- if (s->ssp_cpuid > 0) {
+ if (s->ssp_cpuid > 0 || s->tsp_cpuid > 0) {
if (!s->dram) {
error_setg(errp, TYPE_ASPEED_SCU ": 'dram' link not set");
return;
@@ -629,6 +629,7 @@ static const Property aspeed_scu_properties[] = {
DEFINE_PROP_UINT32("hw-strap2", AspeedSCUState, hw_strap2, 0),
DEFINE_PROP_UINT32("hw-prot-key", AspeedSCUState, hw_prot_key, 0),
DEFINE_PROP_INT32("ssp-cpuid", AspeedSCUState, ssp_cpuid, -1),
+ DEFINE_PROP_INT32("tsp-cpuid", AspeedSCUState, tsp_cpuid, -1),
DEFINE_PROP_LINK("dram", AspeedSCUState, dram, TYPE_MEMORY_REGION,
MemoryRegion *),
};
@@ -903,6 +904,20 @@ static void aspeed_2700_scu_dram_remap_alias_init(AspeedSCUState *s)
"ssp.dram.remap2", s->dram,
0x2c000000, 32 * MiB);
}
+
+ if (s->tsp_cpuid > 0) {
+ /*
+ * The TSP coprocessor uses one memory alias (remap) to access a shared
+ * region in the PSP DRAM:
+ *
+ * - remap maps PSP DRAM at 0x42e000000 (size: 32MB) to TSP SDRAM
+ * offset 0x0
+ *
+ */
+ memory_region_init_alias(&s->dram_remap_alias[2], OBJECT(s),
+ "tsp.dram.remap", s->dram,
+ 0x2e000000, 32 * MiB);
+ }
}
static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 05/11] hw/arm/ast27x0: Add DRAM alias for TSP SDRAM remap
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds a MemoryRegion alias to support PSP access to
TSP SDRAM through shared memory remapping, as defined by the default SCU
configuration.
The TSP coprocessor exposes one DRAM alias:
- remap maps PSP DRAM at 0x42e000000 (32MB) to TSP SDRAM offset 0x0
This region corresponds to the default SCU register value, which controls
the mapping between PSP and coprocessor memory windows.
Set TSP CPUID 5. SCU VMState version remains at 3, as it was already bumped in a
previous commit.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/misc/aspeed_scu.h | 1 +
hw/arm/aspeed_ast27x0-fc.c | 2 ++
hw/arm/aspeed_ast27x0-tsp.c | 3 +++
hw/arm/aspeed_ast27x0.c | 2 ++
hw/misc/aspeed_scu.c | 17 ++++++++++++++++-
5 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 6f7f7d2766..1e18dcd4a5 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -43,6 +43,7 @@ struct AspeedSCUState {
MemoryRegion dram_remap_alias[3];
MemoryRegion *dram;
int ssp_cpuid;
+ int tsp_cpuid;
};
#define AST2400_A0_SILICON_REV 0x02000303U
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index b788e6ca2a..e03f6870e7 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -103,6 +103,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
sc->uarts_num, serial_hd(2));
object_property_set_int(OBJECT(&s->ca35), "ssp-cpuid", 4,
&error_abort);
+ object_property_set_int(OBJECT(&s->ca35), "tsp-cpuid", 5,
+ &error_abort);
if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 46691080d1..5d2977b45c 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -198,6 +198,9 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
&s->scu_alias);
+ /* SDRAM remap alias used by PSP to access TSP SDRAM */
+ memory_region_add_subregion(&s->sdram, 0, &s->scu->dram_remap_alias[2]);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index ae8b22fc1c..6e4b456b8c 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -391,6 +391,8 @@ static void aspeed_soc_ast2700_init(Object *obj)
"hw-prot-key");
object_property_add_alias(obj, "ssp-cpuid", OBJECT(&s->scu),
"ssp-cpuid");
+ object_property_add_alias(obj, "tsp-cpuid", OBJECT(&s->scu),
+ "tsp-cpuid");
object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
qdev_prop_set_uint32(DEVICE(&s->scuio), "silicon-rev",
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index f8d0d3a3fc..3027ac0687 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -604,7 +604,7 @@ static void aspeed_scu_realize(DeviceState *dev, Error **errp)
sysbus_init_mmio(sbd, &s->iomem);
- if (s->ssp_cpuid > 0) {
+ if (s->ssp_cpuid > 0 || s->tsp_cpuid > 0) {
if (!s->dram) {
error_setg(errp, TYPE_ASPEED_SCU ": 'dram' link not set");
return;
@@ -629,6 +629,7 @@ static const Property aspeed_scu_properties[] = {
DEFINE_PROP_UINT32("hw-strap2", AspeedSCUState, hw_strap2, 0),
DEFINE_PROP_UINT32("hw-prot-key", AspeedSCUState, hw_prot_key, 0),
DEFINE_PROP_INT32("ssp-cpuid", AspeedSCUState, ssp_cpuid, -1),
+ DEFINE_PROP_INT32("tsp-cpuid", AspeedSCUState, tsp_cpuid, -1),
DEFINE_PROP_LINK("dram", AspeedSCUState, dram, TYPE_MEMORY_REGION,
MemoryRegion *),
};
@@ -903,6 +904,20 @@ static void aspeed_2700_scu_dram_remap_alias_init(AspeedSCUState *s)
"ssp.dram.remap2", s->dram,
0x2c000000, 32 * MiB);
}
+
+ if (s->tsp_cpuid > 0) {
+ /*
+ * The TSP coprocessor uses one memory alias (remap) to access a shared
+ * region in the PSP DRAM:
+ *
+ * - remap maps PSP DRAM at 0x42e000000 (size: 32MB) to TSP SDRAM
+ * offset 0x0
+ *
+ */
+ memory_region_init_alias(&s->dram_remap_alias[2], OBJECT(s),
+ "tsp.dram.remap", s->dram,
+ 0x2e000000, 32 * MiB);
+ }
}
static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 06/11] hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU registers
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This patch implements SSP reset and power control logic in the SCU for AST2700.
It introduces support for the following behavior:
1. SSP Reset Trigger (via SCU 0x200):
- SSP reset is triggered by writing 1 to bit 30 (RW1S) of SYS_RESET_CTRL_1.
2. SSP Reset State and Source Hold (via SCU 0x120):
- Upon reset, bit 8 (RST_RB) is set to indicate the SSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding SSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the SSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.
3. Hold Release and Power-on:
- If RST_HOLD_RB is clear (0), SSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to SSP_CTRL_0 to release
the hold and power on SSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.
4. Reset Status Clear (via SCU 0x204):
- The reset status can be cleared by writing 1 to bit 30 (RW1C) of SYS_RST_CLR_1,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.
5. SSP Power Control Logic:
- `handle_ssp_tsp_on()` clears RST_SRC_RB and RST_RB (if not held), and invokes
`arm_set_cpu_on_and_reset(cpuid)` to power on the SSP core (CPUID 4).
- `handle_ssp_tsp_off()` sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes `arm_set_cpu_off(cpuid)`.
6. Register Initialization and Definitions:
- Adds SCU register definitions for SSP_CTRL_0 (0x120), SYS_RST_CTRL_1 (0x200),
and SYS_RST_CLR_1 (0x204).
- Updates the reset values for these registers during SCU initialization.
The default values are based on EVB (evaluation board) register dump observations.
This patch enables proper modeling of SSP lifecycle management across reset,
hold, and power-on states for the AST2700 SoC.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 107 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 107 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 3027ac0687..a213e684a5 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -21,6 +21,7 @@
#include "qemu/module.h"
#include "trace.h"
#include "qemu/units.h"
+#include "target/arm/arm-powerctl.h"
#define TO_REG(offset) ((offset) >> 2)
@@ -144,6 +145,17 @@
#define AST2700_HW_STRAP1_SEC2 TO_REG(0x28)
#define AST2700_HW_STRAP1_SEC3 TO_REG(0x2C)
+/* SSP TSP */
+#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SSP_TSP_ENABLE BIT(0)
+#define AST2700_SSP_TSP_RST BIT(1)
+#define AST2700_SSP_TSP_RST_RB BIT(8)
+#define AST2700_SSP_TSP_RST_HOLD_RB BIT(9)
+#define AST2700_SSP_TSP_RST_SRC_RB BIT(10)
+#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
+#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
+#define AST2700_SCU_SYS_RST_SSP BIT(30)
+
#define AST2700_SCU_CLK_SEL_1 TO_REG(0x280)
#define AST2700_SCU_HPLL_PARAM TO_REG(0x300)
#define AST2700_SCU_HPLL_EXT_PARAM TO_REG(0x304)
@@ -920,6 +932,35 @@ static void aspeed_2700_scu_dram_remap_alias_init(AspeedSCUState *s)
}
}
+static void handle_2700_ssp_tsp_on(struct AspeedSCUState *s, int cpuid,
+ int reg)
+{
+ uint32_t val = s->regs[reg];
+
+ val &= ~AST2700_SSP_TSP_RST_SRC_RB;
+ if (!(val & AST2700_SSP_TSP_RST_HOLD_RB)) {
+ val &= ~AST2700_SSP_TSP_RST_RB;
+ arm_set_cpu_on_and_reset(cpuid);
+ }
+
+ s->regs[reg] = val;
+}
+
+static void handle_2700_ssp_tsp_off(struct AspeedSCUState *s, int cpuid,
+ int reg)
+{
+ uint32_t val = s->regs[reg];
+
+ val |= AST2700_SSP_TSP_RST_RB;
+ val |= AST2700_SSP_TSP_RST_SRC_RB;
+ if (val & AST2700_SSP_TSP_RST) {
+ val |= AST2700_SSP_TSP_RST_HOLD_RB;
+ }
+ arm_set_cpu_off(cpuid);
+
+ s->regs[reg] = val;
+}
+
static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
unsigned size)
{
@@ -951,6 +992,9 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
int reg = TO_REG(offset);
/* Truncate here so bitwise operations below behave as expected */
uint32_t data = data64;
+ uint32_t active;
+ uint32_t oldval;
+ int cpuid;
if (reg >= ASPEED_AST2700_SCU_NR_REGS) {
qemu_log_mask(LOG_GUEST_ERROR,
@@ -962,6 +1006,63 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
trace_aspeed_ast2700_scu_write(offset, size, data);
switch (reg) {
+ case AST2700_SCU_SSP_CTRL_0:
+ cpuid = s->ssp_cpuid;
+ if (cpuid < 0) {
+ return;
+ }
+ oldval = s->regs[reg];
+ data &= 0xff;
+ active = oldval ^ data;
+
+ /*
+ * If reset bit is being released (1 -> 0) and no other reset source
+ * is active, clear HOLD_RB and power on the corresponding CPU.
+ */
+ if ((active & AST2700_SSP_TSP_RST) && !(data & AST2700_SSP_TSP_RST)) {
+ s->regs[reg] &= ~AST2700_SSP_TSP_RST_HOLD_RB;
+ if ((oldval & AST2700_SSP_TSP_RST_RB) &&
+ !(oldval & AST2700_SSP_TSP_RST_SRC_RB)) {
+ handle_2700_ssp_tsp_on(s, cpuid, reg);
+ }
+ }
+
+ /*
+ * If ENABLE bit is newly set and reset state is ready,
+ * clear HOLD_RB and power on the corresponding CPU.
+ */
+ if ((active & AST2700_SSP_TSP_ENABLE) &&
+ (oldval & AST2700_SSP_TSP_RST_RB) &&
+ (oldval & AST2700_SSP_TSP_RST_HOLD_RB) &&
+ !(oldval & AST2700_SSP_TSP_RST_SRC_RB)) {
+ s->regs[reg] &= ~AST2700_SSP_TSP_RST_HOLD_RB;
+ handle_2700_ssp_tsp_on(s, cpuid, reg);
+ }
+
+ /* Auto-clear the ENABLE bit (one-shot behavior) */
+ data &= ~AST2700_SSP_TSP_ENABLE;
+ s->regs[reg] = (s->regs[reg] & ~0xff) | (data & 0xff);
+ return;
+ case AST2700_SCU_SYS_RST_CTRL_1:
+ if (s->ssp_cpuid < 0) {
+ return;
+ }
+ if (data & AST2700_SCU_SYS_RST_SSP) {
+ handle_2700_ssp_tsp_off(s, s->ssp_cpuid, AST2700_SCU_SSP_CTRL_0);
+ }
+ s->regs[reg] |= data;
+ return;
+ case AST2700_SCU_SYS_RST_CLR_1:
+ if (s->ssp_cpuid < 0) {
+ return;
+ }
+ oldval = s->regs[AST2700_SCU_SYS_RST_CTRL_1];
+ active = data & oldval;
+ if (active & AST2700_SCU_SYS_RST_SSP) {
+ handle_2700_ssp_tsp_on(s, s->ssp_cpuid, AST2700_SCU_SSP_CTRL_0);
+ }
+ s->regs[AST2700_SCU_SYS_RST_CTRL_1] &= ~active;
+ return;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Unhandled write at offset 0x%" HWADDR_PRIx "\n",
@@ -989,6 +1090,8 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC1] = 0x000000FF,
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
+ [AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
[AST2700_SCU_HPLL_EXT_PARAM] = 0x8000004f,
[AST2700_SCU_DPLL_PARAM] = 0x0080009f,
@@ -1014,6 +1117,10 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
memcpy(s->regs, asc->resets, asc->nr_regs * 4);
s->regs[AST2700_SILICON_REV] = s->silicon_rev;
s->regs[AST2700_HW_STRAP1] = s->hw_strap1;
+
+ if (s->ssp_cpuid > 0) {
+ arm_set_cpu_off(s->ssp_cpuid);
+ }
}
static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 06/11] hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU registers
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This patch implements SSP reset and power control logic in the SCU for AST2700.
It introduces support for the following behavior:
1. SSP Reset Trigger (via SCU 0x200):
- SSP reset is triggered by writing 1 to bit 30 (RW1S) of SYS_RESET_CTRL_1.
2. SSP Reset State and Source Hold (via SCU 0x120):
- Upon reset, bit 8 (RST_RB) is set to indicate the SSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding SSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the SSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.
3. Hold Release and Power-on:
- If RST_HOLD_RB is clear (0), SSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to SSP_CTRL_0 to release
the hold and power on SSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.
4. Reset Status Clear (via SCU 0x204):
- The reset status can be cleared by writing 1 to bit 30 (RW1C) of SYS_RST_CLR_1,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.
5. SSP Power Control Logic:
- `handle_ssp_tsp_on()` clears RST_SRC_RB and RST_RB (if not held), and invokes
`arm_set_cpu_on_and_reset(cpuid)` to power on the SSP core (CPUID 4).
- `handle_ssp_tsp_off()` sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes `arm_set_cpu_off(cpuid)`.
6. Register Initialization and Definitions:
- Adds SCU register definitions for SSP_CTRL_0 (0x120), SYS_RST_CTRL_1 (0x200),
and SYS_RST_CLR_1 (0x204).
- Updates the reset values for these registers during SCU initialization.
The default values are based on EVB (evaluation board) register dump observations.
This patch enables proper modeling of SSP lifecycle management across reset,
hold, and power-on states for the AST2700 SoC.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 107 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 107 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 3027ac0687..a213e684a5 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -21,6 +21,7 @@
#include "qemu/module.h"
#include "trace.h"
#include "qemu/units.h"
+#include "target/arm/arm-powerctl.h"
#define TO_REG(offset) ((offset) >> 2)
@@ -144,6 +145,17 @@
#define AST2700_HW_STRAP1_SEC2 TO_REG(0x28)
#define AST2700_HW_STRAP1_SEC3 TO_REG(0x2C)
+/* SSP TSP */
+#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SSP_TSP_ENABLE BIT(0)
+#define AST2700_SSP_TSP_RST BIT(1)
+#define AST2700_SSP_TSP_RST_RB BIT(8)
+#define AST2700_SSP_TSP_RST_HOLD_RB BIT(9)
+#define AST2700_SSP_TSP_RST_SRC_RB BIT(10)
+#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
+#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
+#define AST2700_SCU_SYS_RST_SSP BIT(30)
+
#define AST2700_SCU_CLK_SEL_1 TO_REG(0x280)
#define AST2700_SCU_HPLL_PARAM TO_REG(0x300)
#define AST2700_SCU_HPLL_EXT_PARAM TO_REG(0x304)
@@ -920,6 +932,35 @@ static void aspeed_2700_scu_dram_remap_alias_init(AspeedSCUState *s)
}
}
+static void handle_2700_ssp_tsp_on(struct AspeedSCUState *s, int cpuid,
+ int reg)
+{
+ uint32_t val = s->regs[reg];
+
+ val &= ~AST2700_SSP_TSP_RST_SRC_RB;
+ if (!(val & AST2700_SSP_TSP_RST_HOLD_RB)) {
+ val &= ~AST2700_SSP_TSP_RST_RB;
+ arm_set_cpu_on_and_reset(cpuid);
+ }
+
+ s->regs[reg] = val;
+}
+
+static void handle_2700_ssp_tsp_off(struct AspeedSCUState *s, int cpuid,
+ int reg)
+{
+ uint32_t val = s->regs[reg];
+
+ val |= AST2700_SSP_TSP_RST_RB;
+ val |= AST2700_SSP_TSP_RST_SRC_RB;
+ if (val & AST2700_SSP_TSP_RST) {
+ val |= AST2700_SSP_TSP_RST_HOLD_RB;
+ }
+ arm_set_cpu_off(cpuid);
+
+ s->regs[reg] = val;
+}
+
static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
unsigned size)
{
@@ -951,6 +992,9 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
int reg = TO_REG(offset);
/* Truncate here so bitwise operations below behave as expected */
uint32_t data = data64;
+ uint32_t active;
+ uint32_t oldval;
+ int cpuid;
if (reg >= ASPEED_AST2700_SCU_NR_REGS) {
qemu_log_mask(LOG_GUEST_ERROR,
@@ -962,6 +1006,63 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
trace_aspeed_ast2700_scu_write(offset, size, data);
switch (reg) {
+ case AST2700_SCU_SSP_CTRL_0:
+ cpuid = s->ssp_cpuid;
+ if (cpuid < 0) {
+ return;
+ }
+ oldval = s->regs[reg];
+ data &= 0xff;
+ active = oldval ^ data;
+
+ /*
+ * If reset bit is being released (1 -> 0) and no other reset source
+ * is active, clear HOLD_RB and power on the corresponding CPU.
+ */
+ if ((active & AST2700_SSP_TSP_RST) && !(data & AST2700_SSP_TSP_RST)) {
+ s->regs[reg] &= ~AST2700_SSP_TSP_RST_HOLD_RB;
+ if ((oldval & AST2700_SSP_TSP_RST_RB) &&
+ !(oldval & AST2700_SSP_TSP_RST_SRC_RB)) {
+ handle_2700_ssp_tsp_on(s, cpuid, reg);
+ }
+ }
+
+ /*
+ * If ENABLE bit is newly set and reset state is ready,
+ * clear HOLD_RB and power on the corresponding CPU.
+ */
+ if ((active & AST2700_SSP_TSP_ENABLE) &&
+ (oldval & AST2700_SSP_TSP_RST_RB) &&
+ (oldval & AST2700_SSP_TSP_RST_HOLD_RB) &&
+ !(oldval & AST2700_SSP_TSP_RST_SRC_RB)) {
+ s->regs[reg] &= ~AST2700_SSP_TSP_RST_HOLD_RB;
+ handle_2700_ssp_tsp_on(s, cpuid, reg);
+ }
+
+ /* Auto-clear the ENABLE bit (one-shot behavior) */
+ data &= ~AST2700_SSP_TSP_ENABLE;
+ s->regs[reg] = (s->regs[reg] & ~0xff) | (data & 0xff);
+ return;
+ case AST2700_SCU_SYS_RST_CTRL_1:
+ if (s->ssp_cpuid < 0) {
+ return;
+ }
+ if (data & AST2700_SCU_SYS_RST_SSP) {
+ handle_2700_ssp_tsp_off(s, s->ssp_cpuid, AST2700_SCU_SSP_CTRL_0);
+ }
+ s->regs[reg] |= data;
+ return;
+ case AST2700_SCU_SYS_RST_CLR_1:
+ if (s->ssp_cpuid < 0) {
+ return;
+ }
+ oldval = s->regs[AST2700_SCU_SYS_RST_CTRL_1];
+ active = data & oldval;
+ if (active & AST2700_SCU_SYS_RST_SSP) {
+ handle_2700_ssp_tsp_on(s, s->ssp_cpuid, AST2700_SCU_SSP_CTRL_0);
+ }
+ s->regs[AST2700_SCU_SYS_RST_CTRL_1] &= ~active;
+ return;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Unhandled write at offset 0x%" HWADDR_PRIx "\n",
@@ -989,6 +1090,8 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC1] = 0x000000FF,
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
+ [AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
[AST2700_SCU_HPLL_EXT_PARAM] = 0x8000004f,
[AST2700_SCU_DPLL_PARAM] = 0x0080009f,
@@ -1014,6 +1117,10 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
memcpy(s->regs, asc->resets, asc->nr_regs * 4);
s->regs[AST2700_SILICON_REV] = s->silicon_rev;
s->regs[AST2700_HW_STRAP1] = s->hw_strap1;
+
+ if (s->ssp_cpuid > 0) {
+ arm_set_cpu_off(s->ssp_cpuid);
+ }
}
static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 07/11] hw/misc/aspeed_scu: Implement TSP reset and power-on control via SCU registers
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This patch implements TSP reset and power control logic in the SCU module
for AST2700. It introduces support for the following behavior:
1. TSP Reset Trigger (via SCU 0x220):
- TSP reset is triggered by writing 1 to bit 9 (RW1S) of SYS_RESET_CTRL_2.
2. TSP Reset State and Source Hold (via SCU 0x160):
- Upon reset, bit 8 (RST_RB) is set to indicate the TSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding TSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the TSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.
3. Hold Release and Power-on:
- If RST_HOLD_RB is clear (0), TSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to TSP_CTRL_0 to release
the hold and power on TSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.
4. Reset Status Clear (via SCU 0x224):
- The reset status can be cleared by writing 1 to bit 9 (RW1C) of SYS_RST_CLR_2,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.
5. TSP Power Control Logic:
- handle_ssp_tsp_on() clears RST_SRC_RB and RST_RB (if not held), and invokes
arm_set_cpu_on_and_reset(cpuid) to power on the TSP core (CPUID 5).
- handle_ssp_tsp_off() sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes arm_set_cpu_off(cpuid).
The default values are based on EVB (evaluation board) register dump observations.
TSP reset control shares the same helper functions and register bit layout as SSP,
with logic selected by cpuid and distinct external reset sources.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 37 ++++++++++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index a213e684a5..fe93afed35 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -147,6 +147,7 @@
/* SSP TSP */
#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SCU_TSP_CTRL_0 TO_REG(0x160)
#define AST2700_SSP_TSP_ENABLE BIT(0)
#define AST2700_SSP_TSP_RST BIT(1)
#define AST2700_SSP_TSP_RST_RB BIT(8)
@@ -155,6 +156,9 @@
#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
#define AST2700_SCU_SYS_RST_SSP BIT(30)
+#define AST2700_SCU_SYS_RST_CTRL_2 TO_REG(0x220)
+#define AST2700_SCU_SYS_RST_CLR_2 TO_REG(0x224)
+#define AST2700_SCU_SYS_RST_TSP BIT(9)
#define AST2700_SCU_CLK_SEL_1 TO_REG(0x280)
#define AST2700_SCU_HPLL_PARAM TO_REG(0x300)
@@ -1007,7 +1011,10 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
switch (reg) {
case AST2700_SCU_SSP_CTRL_0:
- cpuid = s->ssp_cpuid;
+ case AST2700_SCU_TSP_CTRL_0:
+ cpuid = (reg == AST2700_SCU_SSP_CTRL_0) ?
+ s->ssp_cpuid : s->tsp_cpuid;
+
if (cpuid < 0) {
return;
}
@@ -1063,6 +1070,28 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
}
s->regs[AST2700_SCU_SYS_RST_CTRL_1] &= ~active;
return;
+ case AST2700_SCU_SYS_RST_CTRL_2:
+ if (s->tsp_cpuid < 0) {
+ return;
+ }
+ data &= 0x00001fff;
+ if (data & AST2700_SCU_SYS_RST_TSP) {
+ handle_2700_ssp_tsp_off(s, s->tsp_cpuid, AST2700_SCU_TSP_CTRL_0);
+ }
+ s->regs[reg] |= data;
+ return;
+ case AST2700_SCU_SYS_RST_CLR_2:
+ if (s->tsp_cpuid < 0) {
+ return;
+ }
+ data &= 0x00001fff;
+ oldval = s->regs[AST2700_SCU_SYS_RST_CTRL_2];
+ active = data & oldval;
+ if (active & AST2700_SCU_SYS_RST_TSP) {
+ handle_2700_ssp_tsp_on(s, s->tsp_cpuid, AST2700_SCU_TSP_CTRL_0);
+ }
+ s->regs[AST2700_SCU_SYS_RST_CTRL_2] &= ~active;
+ return;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Unhandled write at offset 0x%" HWADDR_PRIx "\n",
@@ -1091,7 +1120,9 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
[AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
+ [AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
[AST2700_SCU_HPLL_EXT_PARAM] = 0x8000004f,
[AST2700_SCU_DPLL_PARAM] = 0x0080009f,
@@ -1121,6 +1152,10 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (s->ssp_cpuid > 0) {
arm_set_cpu_off(s->ssp_cpuid);
}
+
+ if (s->tsp_cpuid > 0) {
+ arm_set_cpu_off(s->tsp_cpuid);
+ }
}
static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 07/11] hw/misc/aspeed_scu: Implement TSP reset and power-on control via SCU registers
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This patch implements TSP reset and power control logic in the SCU module
for AST2700. It introduces support for the following behavior:
1. TSP Reset Trigger (via SCU 0x220):
- TSP reset is triggered by writing 1 to bit 9 (RW1S) of SYS_RESET_CTRL_2.
2. TSP Reset State and Source Hold (via SCU 0x160):
- Upon reset, bit 8 (RST_RB) is set to indicate the TSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding TSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the TSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.
3. Hold Release and Power-on:
- If RST_HOLD_RB is clear (0), TSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to TSP_CTRL_0 to release
the hold and power on TSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.
4. Reset Status Clear (via SCU 0x224):
- The reset status can be cleared by writing 1 to bit 9 (RW1C) of SYS_RST_CLR_2,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.
5. TSP Power Control Logic:
- handle_ssp_tsp_on() clears RST_SRC_RB and RST_RB (if not held), and invokes
arm_set_cpu_on_and_reset(cpuid) to power on the TSP core (CPUID 5).
- handle_ssp_tsp_off() sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes arm_set_cpu_off(cpuid).
The default values are based on EVB (evaluation board) register dump observations.
TSP reset control shares the same helper functions and register bit layout as SSP,
with logic selected by cpuid and distinct external reset sources.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 37 ++++++++++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index a213e684a5..fe93afed35 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -147,6 +147,7 @@
/* SSP TSP */
#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SCU_TSP_CTRL_0 TO_REG(0x160)
#define AST2700_SSP_TSP_ENABLE BIT(0)
#define AST2700_SSP_TSP_RST BIT(1)
#define AST2700_SSP_TSP_RST_RB BIT(8)
@@ -155,6 +156,9 @@
#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
#define AST2700_SCU_SYS_RST_SSP BIT(30)
+#define AST2700_SCU_SYS_RST_CTRL_2 TO_REG(0x220)
+#define AST2700_SCU_SYS_RST_CLR_2 TO_REG(0x224)
+#define AST2700_SCU_SYS_RST_TSP BIT(9)
#define AST2700_SCU_CLK_SEL_1 TO_REG(0x280)
#define AST2700_SCU_HPLL_PARAM TO_REG(0x300)
@@ -1007,7 +1011,10 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
switch (reg) {
case AST2700_SCU_SSP_CTRL_0:
- cpuid = s->ssp_cpuid;
+ case AST2700_SCU_TSP_CTRL_0:
+ cpuid = (reg == AST2700_SCU_SSP_CTRL_0) ?
+ s->ssp_cpuid : s->tsp_cpuid;
+
if (cpuid < 0) {
return;
}
@@ -1063,6 +1070,28 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
}
s->regs[AST2700_SCU_SYS_RST_CTRL_1] &= ~active;
return;
+ case AST2700_SCU_SYS_RST_CTRL_2:
+ if (s->tsp_cpuid < 0) {
+ return;
+ }
+ data &= 0x00001fff;
+ if (data & AST2700_SCU_SYS_RST_TSP) {
+ handle_2700_ssp_tsp_off(s, s->tsp_cpuid, AST2700_SCU_TSP_CTRL_0);
+ }
+ s->regs[reg] |= data;
+ return;
+ case AST2700_SCU_SYS_RST_CLR_2:
+ if (s->tsp_cpuid < 0) {
+ return;
+ }
+ data &= 0x00001fff;
+ oldval = s->regs[AST2700_SCU_SYS_RST_CTRL_2];
+ active = data & oldval;
+ if (active & AST2700_SCU_SYS_RST_TSP) {
+ handle_2700_ssp_tsp_on(s, s->tsp_cpuid, AST2700_SCU_TSP_CTRL_0);
+ }
+ s->regs[AST2700_SCU_SYS_RST_CTRL_2] &= ~active;
+ return;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Unhandled write at offset 0x%" HWADDR_PRIx "\n",
@@ -1091,7 +1120,9 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
[AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
+ [AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
[AST2700_SCU_HPLL_EXT_PARAM] = 0x8000004f,
[AST2700_SCU_DPLL_PARAM] = 0x0080009f,
@@ -1121,6 +1152,10 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (s->ssp_cpuid > 0) {
arm_set_cpu_off(s->ssp_cpuid);
}
+
+ if (s->tsp_cpuid > 0) {
+ arm_set_cpu_off(s->tsp_cpuid);
+ }
}
static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 08/11] hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds SCU register support for SSP SDRAM remap control and runtime
activation. It introduces logic for the PSP to dynamically configure the mapping
of its own DRAM windows into SSP-visible SDRAM space, enabling shared memory
communication via memory region aliases.
- coprocessor_sdram_remap[0]: maps PSP DRAM offset 0x400000000 (size: 32MB) to SSP SDRAM
offset 0x2000000
- coprocessor_sdram_remap[0]: maps PSP DRAM offset 0x42c000000 (size: 32MB) to SSP SDRAM
offset 0x0
The SCU registers AST2700_SCU_SSP_CTRL_1/2 and
AST2700_SCU_SSP_REMAP_ADDR_{1,2} / REMAP_SIZE_{1,2} allow runtime reconfiguration
of alias offset, base, and size.
|------------------------------------------| |----------------------------|
| PSP DRAM | | SSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x4_0000_0000 (SCU_124 << 4) | --> | 0x0000_0000 |
| remap1 base |---| | | - SCU_150: target addr |
| size: 32MB (SCU_14C) | | | | remap2 |
|------------------------------------------| | | |----------------------------|
| | | | | |
| 0x4_2C00_0000 (SCU_128 << 4) |-----| | 0x0200_0000 |
| remap2 base | | | - SCU_148: target addr |
| size: 32MB (SCU_154) | |---> | remap1 |
|------------------------------------------| |----------------------------|
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 50 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index fe93afed35..333fa964d3 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -147,6 +147,12 @@
/* SSP TSP */
#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SCU_SSP_CTRL_1 TO_REG(0x124)
+#define AST2700_SCU_SSP_CTRL_2 TO_REG(0x128)
+#define AST2700_SCU_SSP_REMAP_ADDR_1 TO_REG(0x148)
+#define AST2700_SCU_SSP_REMAP_SIZE_1 TO_REG(0x14C)
+#define AST2700_SCU_SSP_REMAP_ADDR_2 TO_REG(0x150)
+#define AST2700_SCU_SSP_REMAP_SIZE_2 TO_REG(0x154)
#define AST2700_SCU_TSP_CTRL_0 TO_REG(0x160)
#define AST2700_SSP_TSP_ENABLE BIT(0)
#define AST2700_SSP_TSP_RST BIT(1)
@@ -993,6 +999,7 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
uint64_t data64, unsigned size)
{
AspeedSCUState *s = ASPEED_SCU(opaque);
+ MemoryRegion *mr = NULL;
int reg = TO_REG(offset);
/* Truncate here so bitwise operations below behave as expected */
uint32_t data = data64;
@@ -1050,6 +1057,37 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
data &= ~AST2700_SSP_TSP_ENABLE;
s->regs[reg] = (s->regs[reg] & ~0xff) | (data & 0xff);
return;
+ case AST2700_SCU_SSP_CTRL_1:
+ case AST2700_SCU_SSP_CTRL_2:
+ mr = (reg == AST2700_SCU_SSP_CTRL_1) ?
+ &s->dram_remap_alias[0] : &s->dram_remap_alias[1];
+ if (s->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x7fffffff;
+ memory_region_set_alias_offset(mr,
+ ((uint64_t) data << 4) & 0x3ffffffff);
+ break;
+ case AST2700_SCU_SSP_REMAP_ADDR_1:
+ case AST2700_SCU_SSP_REMAP_ADDR_2:
+ mr = (reg == AST2700_SCU_SSP_REMAP_ADDR_1) ?
+ &s->dram_remap_alias[0] : &s->dram_remap_alias[1];
+ if (s->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_address(mr, data);
+ break;
+ case AST2700_SCU_SSP_REMAP_SIZE_1:
+ case AST2700_SCU_SSP_REMAP_SIZE_2:
+ mr = (reg == AST2700_SCU_SSP_REMAP_SIZE_1) ?
+ &s->dram_remap_alias[0] : &s->dram_remap_alias[1];
+ if (s->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_size(mr, data);
+ break;
case AST2700_SCU_SYS_RST_CTRL_1:
if (s->ssp_cpuid < 0) {
return;
@@ -1120,6 +1158,12 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
[AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_SSP_CTRL_1] = 0x40000000,
+ [AST2700_SCU_SSP_CTRL_2] = 0x42C00000,
+ [AST2700_SCU_SSP_REMAP_ADDR_1] = 0x02000000,
+ [AST2700_SCU_SSP_REMAP_SIZE_1] = 0x02000000,
+ [AST2700_SCU_SSP_REMAP_ADDR_2] = 0x00000000,
+ [AST2700_SCU_SSP_REMAP_SIZE_2] = 0x02000000,
[AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
@@ -1151,6 +1195,12 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (s->ssp_cpuid > 0) {
arm_set_cpu_off(s->ssp_cpuid);
+ memory_region_set_address(&s->dram_remap_alias[0], 32 * MiB);
+ memory_region_set_alias_offset(&s->dram_remap_alias[0], 0);
+ memory_region_set_size(&s->dram_remap_alias[0], 32 * MiB);
+ memory_region_set_address(&s->dram_remap_alias[1], 0);
+ memory_region_set_alias_offset(&s->dram_remap_alias[1], 0x2c000000);
+ memory_region_set_size(&s->dram_remap_alias[1], 32 * MiB);
}
if (s->tsp_cpuid > 0) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 08/11] hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds SCU register support for SSP SDRAM remap control and runtime
activation. It introduces logic for the PSP to dynamically configure the mapping
of its own DRAM windows into SSP-visible SDRAM space, enabling shared memory
communication via memory region aliases.
- coprocessor_sdram_remap[0]: maps PSP DRAM offset 0x400000000 (size: 32MB) to SSP SDRAM
offset 0x2000000
- coprocessor_sdram_remap[0]: maps PSP DRAM offset 0x42c000000 (size: 32MB) to SSP SDRAM
offset 0x0
The SCU registers AST2700_SCU_SSP_CTRL_1/2 and
AST2700_SCU_SSP_REMAP_ADDR_{1,2} / REMAP_SIZE_{1,2} allow runtime reconfiguration
of alias offset, base, and size.
|------------------------------------------| |----------------------------|
| PSP DRAM | | SSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x4_0000_0000 (SCU_124 << 4) | --> | 0x0000_0000 |
| remap1 base |---| | | - SCU_150: target addr |
| size: 32MB (SCU_14C) | | | | remap2 |
|------------------------------------------| | | |----------------------------|
| | | | | |
| 0x4_2C00_0000 (SCU_128 << 4) |-----| | 0x0200_0000 |
| remap2 base | | | - SCU_148: target addr |
| size: 32MB (SCU_154) | |---> | remap1 |
|------------------------------------------| |----------------------------|
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 50 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 50 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index fe93afed35..333fa964d3 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -147,6 +147,12 @@
/* SSP TSP */
#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SCU_SSP_CTRL_1 TO_REG(0x124)
+#define AST2700_SCU_SSP_CTRL_2 TO_REG(0x128)
+#define AST2700_SCU_SSP_REMAP_ADDR_1 TO_REG(0x148)
+#define AST2700_SCU_SSP_REMAP_SIZE_1 TO_REG(0x14C)
+#define AST2700_SCU_SSP_REMAP_ADDR_2 TO_REG(0x150)
+#define AST2700_SCU_SSP_REMAP_SIZE_2 TO_REG(0x154)
#define AST2700_SCU_TSP_CTRL_0 TO_REG(0x160)
#define AST2700_SSP_TSP_ENABLE BIT(0)
#define AST2700_SSP_TSP_RST BIT(1)
@@ -993,6 +999,7 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
uint64_t data64, unsigned size)
{
AspeedSCUState *s = ASPEED_SCU(opaque);
+ MemoryRegion *mr = NULL;
int reg = TO_REG(offset);
/* Truncate here so bitwise operations below behave as expected */
uint32_t data = data64;
@@ -1050,6 +1057,37 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
data &= ~AST2700_SSP_TSP_ENABLE;
s->regs[reg] = (s->regs[reg] & ~0xff) | (data & 0xff);
return;
+ case AST2700_SCU_SSP_CTRL_1:
+ case AST2700_SCU_SSP_CTRL_2:
+ mr = (reg == AST2700_SCU_SSP_CTRL_1) ?
+ &s->dram_remap_alias[0] : &s->dram_remap_alias[1];
+ if (s->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x7fffffff;
+ memory_region_set_alias_offset(mr,
+ ((uint64_t) data << 4) & 0x3ffffffff);
+ break;
+ case AST2700_SCU_SSP_REMAP_ADDR_1:
+ case AST2700_SCU_SSP_REMAP_ADDR_2:
+ mr = (reg == AST2700_SCU_SSP_REMAP_ADDR_1) ?
+ &s->dram_remap_alias[0] : &s->dram_remap_alias[1];
+ if (s->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_address(mr, data);
+ break;
+ case AST2700_SCU_SSP_REMAP_SIZE_1:
+ case AST2700_SCU_SSP_REMAP_SIZE_2:
+ mr = (reg == AST2700_SCU_SSP_REMAP_SIZE_1) ?
+ &s->dram_remap_alias[0] : &s->dram_remap_alias[1];
+ if (s->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_size(mr, data);
+ break;
case AST2700_SCU_SYS_RST_CTRL_1:
if (s->ssp_cpuid < 0) {
return;
@@ -1120,6 +1158,12 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
[AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_SSP_CTRL_1] = 0x40000000,
+ [AST2700_SCU_SSP_CTRL_2] = 0x42C00000,
+ [AST2700_SCU_SSP_REMAP_ADDR_1] = 0x02000000,
+ [AST2700_SCU_SSP_REMAP_SIZE_1] = 0x02000000,
+ [AST2700_SCU_SSP_REMAP_ADDR_2] = 0x00000000,
+ [AST2700_SCU_SSP_REMAP_SIZE_2] = 0x02000000,
[AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
@@ -1151,6 +1195,12 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (s->ssp_cpuid > 0) {
arm_set_cpu_off(s->ssp_cpuid);
+ memory_region_set_address(&s->dram_remap_alias[0], 32 * MiB);
+ memory_region_set_alias_offset(&s->dram_remap_alias[0], 0);
+ memory_region_set_size(&s->dram_remap_alias[0], 32 * MiB);
+ memory_region_set_address(&s->dram_remap_alias[1], 0);
+ memory_region_set_alias_offset(&s->dram_remap_alias[1], 0x2c000000);
+ memory_region_set_size(&s->dram_remap_alias[1], 32 * MiB);
}
if (s->tsp_cpuid > 0) {
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 09/11] hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds SCU register support for TSP SDRAM remap control and runtime
activation. Unlike SSP, the TSP does not support configurable target address remapping
through SCU registers. It only supports setting the PSP DRAM base and size, which
are then aliased into the TSP-visible SDRAM window.
coprocessor_sdram_remap[2]: maps PSP DRAM offset 0x42E000000 (size: 32MB) to TSP SDRAM
offset 0x0
The SCU registers AST2700_SCU_TSP_CTRL_1 and
AST2700_SCU_TSP_REMAP_SIZE_2 allow runtime reconfiguration of the DRAM base (alias offset)
and mapping size.
|------------------------------------------| |----------------------------|
| PSP DRAM | | TSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x42E0_0000_0 (SCU_168 << 4) | | 0x0000_0000 |
| remap base |------> | - fixed target addr |
| size: 32MB (SCU_194) | | |
|------------------------------------------| |----------------------------|
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 333fa964d3..a551063c03 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -159,6 +159,8 @@
#define AST2700_SSP_TSP_RST_RB BIT(8)
#define AST2700_SSP_TSP_RST_HOLD_RB BIT(9)
#define AST2700_SSP_TSP_RST_SRC_RB BIT(10)
+#define AST2700_SCU_TSP_CTRL_1 TO_REG(0x168)
+#define AST2700_SCU_TSP_REMAP_SIZE_2 TO_REG(0x194)
#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
#define AST2700_SCU_SYS_RST_SSP BIT(30)
@@ -1088,6 +1090,23 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
data &= 0x3fffffff;
memory_region_set_size(mr, data);
break;
+ case AST2700_SCU_TSP_CTRL_1:
+ mr = &s->dram_remap_alias[2];
+ if (s->tsp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x7fffffff;
+ memory_region_set_alias_offset(mr,
+ ((uint64_t) data << 4) & 0x3ffffffff);
+ break;
+ case AST2700_SCU_TSP_REMAP_SIZE_2:
+ mr = &s->dram_remap_alias[2];
+ if (s->tsp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_size(mr, data);
+ break;
case AST2700_SCU_SYS_RST_CTRL_1:
if (s->ssp_cpuid < 0) {
return;
@@ -1165,6 +1184,8 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_SCU_SSP_REMAP_ADDR_2] = 0x00000000,
[AST2700_SCU_SSP_REMAP_SIZE_2] = 0x02000000,
[AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_TSP_CTRL_1] = 0x42E00000,
+ [AST2700_SCU_TSP_REMAP_SIZE_2] = 0x02000000,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
@@ -1205,6 +1226,8 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (s->tsp_cpuid > 0) {
arm_set_cpu_off(s->tsp_cpuid);
+ memory_region_set_alias_offset(&s->dram_remap_alias[2], 0x2e000000);
+ memory_region_set_size(&s->dram_remap_alias[2], 32 * MiB);
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 09/11] hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
This commit adds SCU register support for TSP SDRAM remap control and runtime
activation. Unlike SSP, the TSP does not support configurable target address remapping
through SCU registers. It only supports setting the PSP DRAM base and size, which
are then aliased into the TSP-visible SDRAM window.
coprocessor_sdram_remap[2]: maps PSP DRAM offset 0x42E000000 (size: 32MB) to TSP SDRAM
offset 0x0
The SCU registers AST2700_SCU_TSP_CTRL_1 and
AST2700_SCU_TSP_REMAP_SIZE_2 allow runtime reconfiguration of the DRAM base (alias offset)
and mapping size.
|------------------------------------------| |----------------------------|
| PSP DRAM | | TSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x42E0_0000_0 (SCU_168 << 4) | | 0x0000_0000 |
| remap base |------> | - fixed target addr |
| size: 32MB (SCU_194) | | |
|------------------------------------------| |----------------------------|
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 333fa964d3..a551063c03 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -159,6 +159,8 @@
#define AST2700_SSP_TSP_RST_RB BIT(8)
#define AST2700_SSP_TSP_RST_HOLD_RB BIT(9)
#define AST2700_SSP_TSP_RST_SRC_RB BIT(10)
+#define AST2700_SCU_TSP_CTRL_1 TO_REG(0x168)
+#define AST2700_SCU_TSP_REMAP_SIZE_2 TO_REG(0x194)
#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
#define AST2700_SCU_SYS_RST_SSP BIT(30)
@@ -1088,6 +1090,23 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
data &= 0x3fffffff;
memory_region_set_size(mr, data);
break;
+ case AST2700_SCU_TSP_CTRL_1:
+ mr = &s->dram_remap_alias[2];
+ if (s->tsp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x7fffffff;
+ memory_region_set_alias_offset(mr,
+ ((uint64_t) data << 4) & 0x3ffffffff);
+ break;
+ case AST2700_SCU_TSP_REMAP_SIZE_2:
+ mr = &s->dram_remap_alias[2];
+ if (s->tsp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_size(mr, data);
+ break;
case AST2700_SCU_SYS_RST_CTRL_1:
if (s->ssp_cpuid < 0) {
return;
@@ -1165,6 +1184,8 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_SCU_SSP_REMAP_ADDR_2] = 0x00000000,
[AST2700_SCU_SSP_REMAP_SIZE_2] = 0x02000000,
[AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_TSP_CTRL_1] = 0x42E00000,
+ [AST2700_SCU_TSP_REMAP_SIZE_2] = 0x02000000,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
@@ -1205,6 +1226,8 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (s->tsp_cpuid > 0) {
arm_set_cpu_off(s->tsp_cpuid);
+ memory_region_set_alias_offset(&s->dram_remap_alias[2], 0x2e000000);
+ memory_region_set_size(&s->dram_remap_alias[2], 32 * MiB);
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 10/11] tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP and load binaries from DRAM
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
SSP and TSP now boot in a powered-off state by default. Enabling them requires
the PSP (Cortex-A35) to explicitly set SCU control registers at runtime. This
behavior aligns with real hardware.
Update the AST2700 FC functional test to reflect this behavior by enabling
SSP and TSP from the U-Boot shell before booting OpenBMC. The test now
programs the required SCU registers, saves the environment, and boots the
system so that SSP and TSP are powered on when the PSP starts.
For the vbootrom test case, these steps are not required because vbootrom
already performs the necessary initialization. Therefore, the U-Boot shell
configuration is only applied to the manual loader test flow.
Additionally, switch SSP and TSP loading from ELF-based CPU loaders to
binary images loaded into PSP DRAM at fixed addresses, and remove the use
of snapshot mode.
Changes include:
- Add enable_ssp_tsp() to configure SCU registers via U-Boot
- Remove snapshot option from QEMU command line
- Load SSP binary at DRAM address 0x42C000000
- Load TSP binary at DRAM address 0x42E000000
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
.../aarch64/test_aspeed_ast2700fc.py | 35 +++++++++++--------
1 file changed, 20 insertions(+), 15 deletions(-)
diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index 8dbc8f234f..b536266685 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -9,7 +9,7 @@
import os
from qemu_test import QemuSystemTest, Asset
-from qemu_test import wait_for_console_pattern
+from qemu_test import wait_for_console_pattern, exec_command
from qemu_test import exec_command_and_wait_for_pattern
@@ -23,12 +23,22 @@ def do_test_aarch64_aspeed_sdk_start(self, image):
self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
self.vm.add_args('-netdev', 'user,id=net1')
self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
- '-net', 'nic', '-net', 'user', '-snapshot')
+ '-net', 'nic', '-net', 'user')
self.vm.launch()
+ def enable_ssp_tsp(self):
+ wait_for_console_pattern(self, 'Hit any key to stop autoboot')
+ exec_command_and_wait_for_pattern(self, '\012', '=>')
+ exec_command_and_wait_for_pattern(self,
+ 'setenv bootcmd "mw 12c02204 40000000; mw 12c02120 1; '
+ 'mw 12c02224 00000200; mw 12c02160 1; run bootspi"', '=>')
+ exec_command_and_wait_for_pattern(self, 'saveenv', 'OK')
+ exec_command(self, 'boot')
+
def verify_openbmc_boot_and_login(self, name):
wait_for_console_pattern(self, 'U-Boot 2023.10')
+ self.enable_ssp_tsp();
wait_for_console_pattern(self, '## Loading kernel from FIT Image')
wait_for_console_pattern(self, 'Starting kernel ...')
@@ -36,17 +46,6 @@ def verify_openbmc_boot_and_login(self, name):
exec_command_and_wait_for_pattern(self, 'root', 'Password:')
exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
- def load_ast2700fc_coprocessor(self, name):
- load_elf_list = {
- 'ssp': self.scratch_file(name, 'zephyr-aspeed-ssp.elf'),
- 'tsp': self.scratch_file(name, 'zephyr-aspeed-tsp.elf')
- }
-
- for cpu_num, key in enumerate(load_elf_list, start=4):
- file = load_elf_list[key]
- self.vm.add_args('-device',
- f'loader,file={file},cpu-num={cpu_num}')
-
ASSET_SDK_V908_AST2700 = Asset(
'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2700-default-obmc.tar.gz',
'eac3dc409b7ea3cd4b03d4792d3cebd469792ad893cb51e1d15f0fc20bd1e2cd')
@@ -121,6 +120,14 @@ def start_ast2700fc_test(self, name):
'addr': '0x430080000',
'file': self.scratch_file(name, 'optee',
'tee-raw.bin')
+ },
+ {
+ 'addr': '0x42C000000',
+ 'file': self.scratch_file(name, 'zephyr-aspeed-ssp.bin')
+ },
+ {
+ 'addr': '0x42E000000',
+ 'file': self.scratch_file(name, 'zephyr-aspeed-tsp.bin')
}
]
@@ -134,13 +141,11 @@ def start_ast2700fc_test(self, name):
self.vm.add_args('-device',
f'loader,addr=0x430000000,cpu-num={i}')
- self.load_ast2700fc_coprocessor(name)
self.do_test_aarch64_aspeed_sdk_start(
self.scratch_file(name, 'image-bmc'))
def start_ast2700fc_test_vbootrom(self, name):
self.vm.add_args('-bios', 'ast27x0_bootrom.bin')
- self.load_ast2700fc_coprocessor(name)
self.do_test_aarch64_aspeed_sdk_start(
self.scratch_file(name, 'image-bmc'))
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 10/11] tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP and load binaries from DRAM
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
SSP and TSP now boot in a powered-off state by default. Enabling them requires
the PSP (Cortex-A35) to explicitly set SCU control registers at runtime. This
behavior aligns with real hardware.
Update the AST2700 FC functional test to reflect this behavior by enabling
SSP and TSP from the U-Boot shell before booting OpenBMC. The test now
programs the required SCU registers, saves the environment, and boots the
system so that SSP and TSP are powered on when the PSP starts.
For the vbootrom test case, these steps are not required because vbootrom
already performs the necessary initialization. Therefore, the U-Boot shell
configuration is only applied to the manual loader test flow.
Additionally, switch SSP and TSP loading from ELF-based CPU loaders to
binary images loaded into PSP DRAM at fixed addresses, and remove the use
of snapshot mode.
Changes include:
- Add enable_ssp_tsp() to configure SCU registers via U-Boot
- Remove snapshot option from QEMU command line
- Load SSP binary at DRAM address 0x42C000000
- Load TSP binary at DRAM address 0x42E000000
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
.../aarch64/test_aspeed_ast2700fc.py | 35 +++++++++++--------
1 file changed, 20 insertions(+), 15 deletions(-)
diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index 8dbc8f234f..b536266685 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -9,7 +9,7 @@
import os
from qemu_test import QemuSystemTest, Asset
-from qemu_test import wait_for_console_pattern
+from qemu_test import wait_for_console_pattern, exec_command
from qemu_test import exec_command_and_wait_for_pattern
@@ -23,12 +23,22 @@ def do_test_aarch64_aspeed_sdk_start(self, image):
self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
self.vm.add_args('-netdev', 'user,id=net1')
self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
- '-net', 'nic', '-net', 'user', '-snapshot')
+ '-net', 'nic', '-net', 'user')
self.vm.launch()
+ def enable_ssp_tsp(self):
+ wait_for_console_pattern(self, 'Hit any key to stop autoboot')
+ exec_command_and_wait_for_pattern(self, '\012', '=>')
+ exec_command_and_wait_for_pattern(self,
+ 'setenv bootcmd "mw 12c02204 40000000; mw 12c02120 1; '
+ 'mw 12c02224 00000200; mw 12c02160 1; run bootspi"', '=>')
+ exec_command_and_wait_for_pattern(self, 'saveenv', 'OK')
+ exec_command(self, 'boot')
+
def verify_openbmc_boot_and_login(self, name):
wait_for_console_pattern(self, 'U-Boot 2023.10')
+ self.enable_ssp_tsp();
wait_for_console_pattern(self, '## Loading kernel from FIT Image')
wait_for_console_pattern(self, 'Starting kernel ...')
@@ -36,17 +46,6 @@ def verify_openbmc_boot_and_login(self, name):
exec_command_and_wait_for_pattern(self, 'root', 'Password:')
exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
- def load_ast2700fc_coprocessor(self, name):
- load_elf_list = {
- 'ssp': self.scratch_file(name, 'zephyr-aspeed-ssp.elf'),
- 'tsp': self.scratch_file(name, 'zephyr-aspeed-tsp.elf')
- }
-
- for cpu_num, key in enumerate(load_elf_list, start=4):
- file = load_elf_list[key]
- self.vm.add_args('-device',
- f'loader,file={file},cpu-num={cpu_num}')
-
ASSET_SDK_V908_AST2700 = Asset(
'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2700-default-obmc.tar.gz',
'eac3dc409b7ea3cd4b03d4792d3cebd469792ad893cb51e1d15f0fc20bd1e2cd')
@@ -121,6 +120,14 @@ def start_ast2700fc_test(self, name):
'addr': '0x430080000',
'file': self.scratch_file(name, 'optee',
'tee-raw.bin')
+ },
+ {
+ 'addr': '0x42C000000',
+ 'file': self.scratch_file(name, 'zephyr-aspeed-ssp.bin')
+ },
+ {
+ 'addr': '0x42E000000',
+ 'file': self.scratch_file(name, 'zephyr-aspeed-tsp.bin')
}
]
@@ -134,13 +141,11 @@ def start_ast2700fc_test(self, name):
self.vm.add_args('-device',
f'loader,addr=0x430000000,cpu-num={i}')
- self.load_ast2700fc_coprocessor(name)
self.do_test_aarch64_aspeed_sdk_start(
self.scratch_file(name, 'image-bmc'))
def start_ast2700fc_test_vbootrom(self, name):
self.vm.add_args('-bios', 'ast27x0_bootrom.bin')
- self.load_ast2700fc_coprocessor(name)
self.do_test_aarch64_aspeed_sdk_start(
self.scratch_file(name, 'image-bmc'))
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread
* [PATCH v2 11/11] docs: Add support vbootrom and update Manual boot for ast2700fc
2026-01-27 9:29 ` Jamin Lin via qemu development
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
-1 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
docs/system/arm/aspeed.rst | 37 +++++++++++++++++++++++++++++++++----
1 file changed, 33 insertions(+), 4 deletions(-)
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 97e14b7d33..e8d8a85ec4 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -391,6 +391,14 @@ Booting the ast2700fc machine
AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors.
**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors,
**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors.
+There are two methods to boot the ast2700fc machine.
+
+Manual boot using ``-device loader``:
+
+In this approach, users manually load firmware and assign entry points via QEMU loader devices.
+By default, the PSP begins execution at address ``0x430000000``, the load address of the bl31
+firmware. The SSP and TSP start in the powered-off state and must be explicitly enabled by the
+PSP through writes to SCU registers.
Steps to boot the AST2700fc machine:
@@ -401,8 +409,8 @@ Steps to boot the AST2700fc machine:
* bl31.bin
* optee/tee-raw.bin
* image-bmc
- * zephyr-aspeed-ssp.elf (for SSP firmware, CPU 5)
- * zephyr-aspeed-tsp.elf (for TSP firmware, CPU 6)
+ * zephyr-aspeed-ssp.bin (for SSP firmware, CPU 5)
+ * zephyr-aspeed-tsp.bin (for TSP firmware, CPU 6)
2. Execute the following command to start ``ast2700fc`` machine:
@@ -416,17 +424,38 @@ Steps to boot the AST2700fc machine:
-device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \
-device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \
-device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \
+ -device loader,addr=0x42C000000,file=${IMGDIR}/zephyr-aspeed-ssp.bin,force-raw=on \
+ -device loader,addr=0x42E000000,file=${IMGDIR}/zephyr-aspeed-tsp.bin,force-raw=on \
-device loader,cpu-num=0,addr=0x430000000 \
-device loader,cpu-num=1,addr=0x430000000 \
-device loader,cpu-num=2,addr=0x430000000 \
-device loader,cpu-num=3,addr=0x430000000 \
-drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
- -device loader,file=${IMGDIR}/zephyr-aspeed-ssp.elf,cpu-num=4 \
- -device loader,file=${IMGDIR}/zephyr-aspeed-tsp.elf,cpu-num=5 \
-serial pty -serial pty -serial pty \
-snapshot \
-S -nographic
+Boot using a virtual boot ROM (-bios):
+
+In this method, the virtual boot ROM (vbootrom) handles the full initialization sequence.
+It starts the PSP, which then enables the SSP and TSP by programming the appropriate SCU
+registers, following the hardware behavior.
+
+Execute the following command to start ``ast2700fc`` machine:
+
+.. code-block:: bash
+
+ IMGDIR=ast2700-default
+
+ $ qemu-system-aarch64 -M ast2700fc \
+ -bios ast27x0_bootrom.bin \
+ -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
+ -serial pty -serial pty -serial pty \
+ -snapshot \
+ -S -nographic
+
+Serial Console Redirection:
+
After launching QEMU, serial devices will be automatically redirected.
Example output:
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH v2 11/11] docs: Add support vbootrom and update Manual boot for ast2700fc
@ 2026-01-27 9:29 ` Jamin Lin via qemu development
0 siblings, 0 replies; 24+ messages in thread
From: Jamin Lin via qemu development @ 2026-01-27 9:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Andrew Jeffery, Joel Stanley, open list:ASPEED BMCs,
open list:All patches CC here
Cc: jamin_lin, troy_lee, kane_chen
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
docs/system/arm/aspeed.rst | 37 +++++++++++++++++++++++++++++++++----
1 file changed, 33 insertions(+), 4 deletions(-)
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index 97e14b7d33..e8d8a85ec4 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -391,6 +391,14 @@ Booting the ast2700fc machine
AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors.
**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors,
**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors.
+There are two methods to boot the ast2700fc machine.
+
+Manual boot using ``-device loader``:
+
+In this approach, users manually load firmware and assign entry points via QEMU loader devices.
+By default, the PSP begins execution at address ``0x430000000``, the load address of the bl31
+firmware. The SSP and TSP start in the powered-off state and must be explicitly enabled by the
+PSP through writes to SCU registers.
Steps to boot the AST2700fc machine:
@@ -401,8 +409,8 @@ Steps to boot the AST2700fc machine:
* bl31.bin
* optee/tee-raw.bin
* image-bmc
- * zephyr-aspeed-ssp.elf (for SSP firmware, CPU 5)
- * zephyr-aspeed-tsp.elf (for TSP firmware, CPU 6)
+ * zephyr-aspeed-ssp.bin (for SSP firmware, CPU 5)
+ * zephyr-aspeed-tsp.bin (for TSP firmware, CPU 6)
2. Execute the following command to start ``ast2700fc`` machine:
@@ -416,17 +424,38 @@ Steps to boot the AST2700fc machine:
-device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \
-device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \
-device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \
+ -device loader,addr=0x42C000000,file=${IMGDIR}/zephyr-aspeed-ssp.bin,force-raw=on \
+ -device loader,addr=0x42E000000,file=${IMGDIR}/zephyr-aspeed-tsp.bin,force-raw=on \
-device loader,cpu-num=0,addr=0x430000000 \
-device loader,cpu-num=1,addr=0x430000000 \
-device loader,cpu-num=2,addr=0x430000000 \
-device loader,cpu-num=3,addr=0x430000000 \
-drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
- -device loader,file=${IMGDIR}/zephyr-aspeed-ssp.elf,cpu-num=4 \
- -device loader,file=${IMGDIR}/zephyr-aspeed-tsp.elf,cpu-num=5 \
-serial pty -serial pty -serial pty \
-snapshot \
-S -nographic
+Boot using a virtual boot ROM (-bios):
+
+In this method, the virtual boot ROM (vbootrom) handles the full initialization sequence.
+It starts the PSP, which then enables the SSP and TSP by programming the appropriate SCU
+registers, following the hardware behavior.
+
+Execute the following command to start ``ast2700fc`` machine:
+
+.. code-block:: bash
+
+ IMGDIR=ast2700-default
+
+ $ qemu-system-aarch64 -M ast2700fc \
+ -bios ast27x0_bootrom.bin \
+ -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
+ -serial pty -serial pty -serial pty \
+ -snapshot \
+ -S -nographic
+
+Serial Console Redirection:
+
After launching QEMU, serial devices will be automatically redirected.
Example output:
--
2.43.0
^ permalink raw reply related [flat|nested] 24+ messages in thread