* [PATCH v4 01/21] hw/misc/aspeed_scu: Introduce Aspeed2700SCU subclass and separate from generic SCU
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:05 ` Cédric Le Goater
2026-04-17 3:28 ` [PATCH v4 02/21] hw/misc/aspeed_scu: Add separate reset handler for AST2700 SCUIO Jamin Lin
` (20 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
Introduce a dedicated Aspeed2700SCUState subclass to isolate AST2700-specific
behavior from the generic AspeedSCUState implementation.
Previously, AST17x0/27x0 platforms reused AspeedSCUState directly, including
in coprocessor paths. With AST2700 introducing additional requirements (e.g.
future coprocessor features such as DRAM remapping), continuing to extend the
generic SCU risks impacting other SoCs.
To address this, add Aspeed2700SCUState as a subclass of AspeedSCUState and
migrate all AST2700-related users to it, including:
- AST1700 SoC
- AST27x0 SoC
- AST27x0 FC
- AST27x0 coprocessors
As part of this refactoring:
- Remove SCU linkage from the common AspeedCoprocessorState
- Add a dedicated 'scu' link property to Aspeed27x0CoprocessorState
- Update SCU memory aliasing to reference the subclass (parent_obj.iomem)
This separation keeps the common code generic while enabling AST2700-specific
extensions in both SCU and coprocessor paths.
No functional change.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/arm/aspeed_ast1700.h | 2 +-
include/hw/arm/aspeed_coprocessor.h | 5 +++--
include/hw/arm/aspeed_soc.h | 1 +
include/hw/misc/aspeed_scu.h | 5 +++++
hw/arm/aspeed_ast27x0-fc.c | 4 ++--
hw/arm/aspeed_ast27x0-ssp.c | 14 ++++++++++----
hw/arm/aspeed_ast27x0-tsp.c | 14 ++++++++++----
hw/arm/aspeed_ast27x0.c | 16 ++++++++--------
hw/arm/aspeed_coprocessor_common.c | 2 --
hw/misc/aspeed_scu.c | 8 +++++++-
10 files changed, 47 insertions(+), 24 deletions(-)
diff --git a/include/hw/arm/aspeed_ast1700.h b/include/hw/arm/aspeed_ast1700.h
index f7bd4e8650..39c5977cf1 100644
--- a/include/hw/arm/aspeed_ast1700.h
+++ b/include/hw/arm/aspeed_ast1700.h
@@ -41,7 +41,7 @@ struct AspeedAST1700SoCState {
MemoryRegion sram;
AspeedSMCState spi;
AspeedADCState adc;
- AspeedSCUState scu;
+ Aspeed2700SCUState scu;
AspeedGPIOState gpio;
AspeedSGPIOState sgpiom[AST1700_SGPIO_NUM];
AspeedI2CState i2c;
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 4a50f688ec..4db995d251 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -20,10 +20,8 @@ struct AspeedCoprocessorState {
MemoryRegion *sram;
MemoryRegion sram_alias;
MemoryRegion uart_alias;
- MemoryRegion scu_alias;
Clock *sysclk;
- AspeedSCUState *scu;
AspeedSCUState scuio;
AspeedTimerCtrlState timerctrl;
SerialMM *uart;
@@ -50,6 +48,9 @@ struct Aspeed27x0CoprocessorState {
UnimplementedDeviceState scuio;
ARMv7MState armv7m;
+
+ MemoryRegion scu_alias;
+ Aspeed2700SCUState *scu;
};
#define TYPE_ASPEED27X0SSP_COPROCESSOR "aspeed27x0ssp-coprocessor"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index d7b3647ca1..adf2f2898a 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -151,6 +151,7 @@ struct Aspeed27x0SoCState {
AspeedINTCState intcioexp[ASPEED_IOEXP_NUM];
GICv3State gic;
MemoryRegion dram_empty;
+ Aspeed2700SCUState scu;
};
#define TYPE_ASPEED27X0_SOC "aspeed27x0-soc"
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index d003955428..fd30313e69 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -20,6 +20,7 @@ OBJECT_DECLARE_TYPE(AspeedSCUState, AspeedSCUClass, ASPEED_SCU)
#define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
#define TYPE_ASPEED_2600_SCU TYPE_ASPEED_SCU "-ast2600"
#define TYPE_ASPEED_2700_SCU TYPE_ASPEED_SCU "-ast2700"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2700SCUState, ASPEED_2700_SCU)
#define TYPE_ASPEED_2700_SCUIO TYPE_ASPEED_SCU "io" "-ast2700"
#define TYPE_ASPEED_1030_SCU TYPE_ASPEED_SCU "-ast1030"
@@ -41,6 +42,10 @@ struct AspeedSCUState {
uint32_t hw_prot_key;
};
+struct Aspeed2700SCUState {
+ AspeedSCUState parent_obj;
+};
+
#define AST2400_A1_SILICON_REV 0x02010303U
#define AST2500_A1_SILICON_REV 0x04010303U
#define AST2600_A3_SILICON_REV 0x05030303U
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 5eb6680da9..46f0c97329 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -156,7 +156,7 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
object_property_set_link(OBJECT(&s->ssp), "sram",
OBJECT(&psp->sram), &error_abort);
object_property_set_link(OBJECT(&s->ssp), "scu",
- OBJECT(&psp->scu), &error_abort);
+ OBJECT(&s->ca35.scu), &error_abort);
if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
return false;
}
@@ -188,7 +188,7 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
object_property_set_link(OBJECT(&s->tsp), "sram",
OBJECT(&psp->sram), &error_abort);
object_property_set_link(OBJECT(&s->tsp), "scu",
- OBJECT(&psp->scu), &error_abort);
+ OBJECT(&s->ca35.scu), &error_abort);
if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 8b84300e0f..9a2079668b 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -186,11 +186,11 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
&s->sram_alias);
/* SCU */
- memory_region_init_alias(&s->scu_alias, OBJECT(s), "scu.alias",
- &s->scu->iomem, 0,
- memory_region_size(&s->scu->iomem));
+ memory_region_init_alias(&a->scu_alias, OBJECT(a), "scu.alias",
+ &a->scu->parent_obj.iomem, 0,
+ memory_region_size(&a->scu->parent_obj.iomem));
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
- &s->scu_alias);
+ &a->scu_alias);
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
@@ -257,6 +257,11 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
}
+static const Property aspeed_27x0_coprocessor_properties[] = {
+ DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
+ TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
+};
+
static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
const void *data)
{
@@ -270,6 +275,7 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
/* Reason: The Aspeed Coprocessor can only be instantiated from a board */
dc->user_creatable = false;
dc->realize = aspeed_soc_ast27x0ssp_realize;
+ device_class_set_props(dc, aspeed_27x0_coprocessor_properties);
sc->valid_cpu_types = valid_cpu_types;
sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index e7c7b74491..674307103e 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -186,11 +186,11 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
&s->sram_alias);
/* SCU */
- memory_region_init_alias(&s->scu_alias, OBJECT(s), "scu.alias",
- &s->scu->iomem, 0,
- memory_region_size(&s->scu->iomem));
+ memory_region_init_alias(&a->scu_alias, OBJECT(a), "scu.alias",
+ &a->scu->parent_obj.iomem, 0,
+ memory_region_size(&a->scu->parent_obj.iomem));
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
- &s->scu_alias);
+ &a->scu_alias);
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
@@ -257,6 +257,11 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
}
+static const Property aspeed_27x0_coprocessor_properties[] = {
+ DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
+ TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
+};
+
static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
const void *data)
{
@@ -270,6 +275,7 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
/* Reason: The Aspeed Coprocessor can only be instantiated from a board */
dc->user_creatable = false;
dc->realize = aspeed_soc_ast27x0tsp_realize;
+ device_class_set_props(dc, aspeed_27x0_coprocessor_properties);
sc->valid_cpu_types = valid_cpu_types;
sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 87dcb82e1b..e84975a9c4 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -425,12 +425,12 @@ static void aspeed_soc_ast2700_init(Object *obj)
object_initialize_child(obj, "gic", &a->gic, gicv3_class_name());
- object_initialize_child(obj, "scu", &s->scu, TYPE_ASPEED_2700_SCU);
- qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
+ object_initialize_child(obj, "scu", &a->scu, TYPE_ASPEED_2700_SCU);
+ qdev_prop_set_uint32(DEVICE(&a->scu), "silicon-rev",
sc->silicon_rev);
- object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
+ object_property_add_alias(obj, "hw-strap1", OBJECT(&a->scu),
"hw-strap1");
- object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
+ object_property_add_alias(obj, "hw-prot-key", OBJECT(&a->scu),
"hw-prot-key");
object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
@@ -794,10 +794,10 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
sc->memmap[ASPEED_DEV_VBOOTROM], &s->vbootrom);
/* SCU */
- if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
+ if (!sysbus_realize(SYS_BUS_DEVICE(&a->scu), errp)) {
return;
}
- aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
+ aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->scu), 0,
sc->memmap[ASPEED_DEV_SCU]);
/* SCU1 */
@@ -915,7 +915,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
hwaddr wdt_offset = sc->memmap[ASPEED_DEV_WDT] + i * awc->iosize;
- object_property_set_link(OBJECT(&s->wdt[i]), "scu", OBJECT(&s->scu),
+ object_property_set_link(OBJECT(&s->wdt[i]), "scu", OBJECT(&a->scu),
&error_abort);
if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
return;
@@ -1018,7 +1018,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_EMMC));
/* Timer */
- object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&s->scu),
+ object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&a->scu),
&error_abort);
if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
return;
diff --git a/hw/arm/aspeed_coprocessor_common.c b/hw/arm/aspeed_coprocessor_common.c
index a0a4c73d08..43026d2a55 100644
--- a/hw/arm/aspeed_coprocessor_common.c
+++ b/hw/arm/aspeed_coprocessor_common.c
@@ -27,8 +27,6 @@ static const Property aspeed_coprocessor_properties[] = {
TYPE_MEMORY_REGION, MemoryRegion *),
DEFINE_PROP_LINK("sram", AspeedCoprocessorState, sram, TYPE_MEMORY_REGION,
MemoryRegion *),
- DEFINE_PROP_LINK("scu", AspeedCoprocessorState, scu, TYPE_ASPEED_SCU,
- AspeedSCUState *),
DEFINE_PROP_LINK("uart", AspeedCoprocessorState, uart, TYPE_SERIAL_MM,
SerialMM *),
DEFINE_PROP_INT32("uart-dev", AspeedCoprocessorState, uart_dev, 0),
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index e4160356e4..0a2dad4537 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -959,6 +959,11 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
s->regs[AST2700_HW_STRAP1] = s->hw_strap1;
}
+static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
+{
+ aspeed_scu_realize(dev, errp);
+}
+
static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
@@ -966,6 +971,7 @@ static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
dc->desc = "ASPEED 2700 System Control Unit";
device_class_set_legacy_reset(dc, aspeed_ast2700_scu_reset);
+ dc->realize = aspeed_2700_scu_realize;
asc->resets = ast2700_a0_resets;
asc->calc_hpll = aspeed_2600_scu_calc_hpll;
asc->get_apb = aspeed_2700_scu_get_apb_freq;
@@ -1097,7 +1103,7 @@ static void aspeed_2700_scuio_class_init(ObjectClass *klass, const void *data)
static const TypeInfo aspeed_2700_scu_info = {
.name = TYPE_ASPEED_2700_SCU,
.parent = TYPE_ASPEED_SCU,
- .instance_size = sizeof(AspeedSCUState),
+ .instance_size = sizeof(Aspeed2700SCUState),
.class_init = aspeed_2700_scu_class_init,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 01/21] hw/misc/aspeed_scu: Introduce Aspeed2700SCU subclass and separate from generic SCU
2026-04-17 3:28 ` [PATCH v4 01/21] hw/misc/aspeed_scu: Introduce Aspeed2700SCU subclass and separate from generic SCU Jamin Lin
@ 2026-06-01 17:05 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:05 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> Introduce a dedicated Aspeed2700SCUState subclass to isolate AST2700-specific
> behavior from the generic AspeedSCUState implementation.
>
> Previously, AST17x0/27x0 platforms reused AspeedSCUState directly, including
> in coprocessor paths. With AST2700 introducing additional requirements (e.g.
> future coprocessor features such as DRAM remapping), continuing to extend the
> generic SCU risks impacting other SoCs.
>
> To address this, add Aspeed2700SCUState as a subclass of AspeedSCUState and
> migrate all AST2700-related users to it, including:
> - AST1700 SoC
> - AST27x0 SoC
> - AST27x0 FC
> - AST27x0 coprocessors
>
> As part of this refactoring:
> - Remove SCU linkage from the common AspeedCoprocessorState
> - Add a dedicated 'scu' link property to Aspeed27x0CoprocessorState
> - Update SCU memory aliasing to reference the subclass (parent_obj.iomem)
>
> This separation keeps the common code generic while enabling AST2700-specific
> extensions in both SCU and coprocessor paths.
>
> No functional change.
I think this patch needs to be broken down further.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> include/hw/arm/aspeed_ast1700.h | 2 +-
> include/hw/arm/aspeed_coprocessor.h | 5 +++--
> include/hw/arm/aspeed_soc.h | 1 +
> include/hw/misc/aspeed_scu.h | 5 +++++
> hw/arm/aspeed_ast27x0-fc.c | 4 ++--
> hw/arm/aspeed_ast27x0-ssp.c | 14 ++++++++++----
> hw/arm/aspeed_ast27x0-tsp.c | 14 ++++++++++----
> hw/arm/aspeed_ast27x0.c | 16 ++++++++--------
> hw/arm/aspeed_coprocessor_common.c | 2 --
> hw/misc/aspeed_scu.c | 8 +++++++-
> 10 files changed, 47 insertions(+), 24 deletions(-)
>
> diff --git a/include/hw/arm/aspeed_ast1700.h b/include/hw/arm/aspeed_ast1700.h
> index f7bd4e8650..39c5977cf1 100644
> --- a/include/hw/arm/aspeed_ast1700.h
> +++ b/include/hw/arm/aspeed_ast1700.h
> @@ -41,7 +41,7 @@ struct AspeedAST1700SoCState {
> MemoryRegion sram;
> AspeedSMCState spi;
> AspeedADCState adc;
> - AspeedSCUState scu;
> + Aspeed2700SCUState scu;
> AspeedGPIOState gpio;
> AspeedSGPIOState sgpiom[AST1700_SGPIO_NUM];
> AspeedI2CState i2c;
> diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
> index 4a50f688ec..4db995d251 100644
> --- a/include/hw/arm/aspeed_coprocessor.h
> +++ b/include/hw/arm/aspeed_coprocessor.h
> @@ -20,10 +20,8 @@ struct AspeedCoprocessorState {
> MemoryRegion *sram;
> MemoryRegion sram_alias;
> MemoryRegion uart_alias;
> - MemoryRegion scu_alias;
> Clock *sysclk;
>
> - AspeedSCUState *scu;
> AspeedSCUState scuio;
> AspeedTimerCtrlState timerctrl;
> SerialMM *uart;
> @@ -50,6 +48,9 @@ struct Aspeed27x0CoprocessorState {
> UnimplementedDeviceState scuio;
>
> ARMv7MState armv7m;
> +
> + MemoryRegion scu_alias;
> + Aspeed2700SCUState *scu;
> };
>
> #define TYPE_ASPEED27X0SSP_COPROCESSOR "aspeed27x0ssp-coprocessor"
> diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
> index d7b3647ca1..adf2f2898a 100644
> --- a/include/hw/arm/aspeed_soc.h
> +++ b/include/hw/arm/aspeed_soc.h
> @@ -151,6 +151,7 @@ struct Aspeed27x0SoCState {
> AspeedINTCState intcioexp[ASPEED_IOEXP_NUM];
> GICv3State gic;
> MemoryRegion dram_empty;
> + Aspeed2700SCUState scu;
> };
>
> #define TYPE_ASPEED27X0_SOC "aspeed27x0-soc"
> diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
> index d003955428..fd30313e69 100644
> --- a/include/hw/misc/aspeed_scu.h
> +++ b/include/hw/misc/aspeed_scu.h
> @@ -20,6 +20,7 @@ OBJECT_DECLARE_TYPE(AspeedSCUState, AspeedSCUClass, ASPEED_SCU)
> #define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
> #define TYPE_ASPEED_2600_SCU TYPE_ASPEED_SCU "-ast2600"
> #define TYPE_ASPEED_2700_SCU TYPE_ASPEED_SCU "-ast2700"
> +OBJECT_DECLARE_SIMPLE_TYPE(Aspeed2700SCUState, ASPEED_2700_SCU)
> #define TYPE_ASPEED_2700_SCUIO TYPE_ASPEED_SCU "io" "-ast2700"
> #define TYPE_ASPEED_1030_SCU TYPE_ASPEED_SCU "-ast1030"
>
> @@ -41,6 +42,10 @@ struct AspeedSCUState {
> uint32_t hw_prot_key;
> };
>
> +struct Aspeed2700SCUState {
> + AspeedSCUState parent_obj;
> +};
> +
> #define AST2400_A1_SILICON_REV 0x02010303U
> #define AST2500_A1_SILICON_REV 0x04010303U
> #define AST2600_A3_SILICON_REV 0x05030303U
> diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
> index 5eb6680da9..46f0c97329 100644
> --- a/hw/arm/aspeed_ast27x0-fc.c
> +++ b/hw/arm/aspeed_ast27x0-fc.c
> @@ -156,7 +156,7 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
> object_property_set_link(OBJECT(&s->ssp), "sram",
> OBJECT(&psp->sram), &error_abort);
> object_property_set_link(OBJECT(&s->ssp), "scu",
> - OBJECT(&psp->scu), &error_abort);
> + OBJECT(&s->ca35.scu), &error_abort);
> if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
> return false;
> }
> @@ -188,7 +188,7 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
> object_property_set_link(OBJECT(&s->tsp), "sram",
> OBJECT(&psp->sram), &error_abort);
> object_property_set_link(OBJECT(&s->tsp), "scu",
> - OBJECT(&psp->scu), &error_abort);
> + OBJECT(&s->ca35.scu), &error_abort);
> if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
> return false;
> }
> diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
> index 8b84300e0f..9a2079668b 100644
> --- a/hw/arm/aspeed_ast27x0-ssp.c
> +++ b/hw/arm/aspeed_ast27x0-ssp.c
> @@ -186,11 +186,11 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> &s->sram_alias);
>
> /* SCU */
> - memory_region_init_alias(&s->scu_alias, OBJECT(s), "scu.alias",
> - &s->scu->iomem, 0,
> - memory_region_size(&s->scu->iomem));
> + memory_region_init_alias(&a->scu_alias, OBJECT(a), "scu.alias",
> + &a->scu->parent_obj.iomem, 0,
a->scu->parent_obj.iomem seems wrong
> + memory_region_size(&a->scu->parent_obj.iomem));
> memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
> - &s->scu_alias);
> + &a->scu_alias);
>
> /* INTC */
> if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
> @@ -257,6 +257,11 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
> }
>
> +static const Property aspeed_27x0_coprocessor_properties[] = {
> + DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
> + TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
> +};
> +
> static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
> const void *data)
> {
> @@ -270,6 +275,7 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
> /* Reason: The Aspeed Coprocessor can only be instantiated from a board */
> dc->user_creatable = false;
> dc->realize = aspeed_soc_ast27x0ssp_realize;
> + device_class_set_props(dc, aspeed_27x0_coprocessor_properties);
>
> sc->valid_cpu_types = valid_cpu_types;
> sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
> diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
> index e7c7b74491..674307103e 100644
> --- a/hw/arm/aspeed_ast27x0-tsp.c
> +++ b/hw/arm/aspeed_ast27x0-tsp.c
> @@ -186,11 +186,11 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> &s->sram_alias);
>
> /* SCU */
> - memory_region_init_alias(&s->scu_alias, OBJECT(s), "scu.alias",
> - &s->scu->iomem, 0,
> - memory_region_size(&s->scu->iomem));
> + memory_region_init_alias(&a->scu_alias, OBJECT(a), "scu.alias",
> + &a->scu->parent_obj.iomem, 0,
> + memory_region_size(&a->scu->parent_obj.iomem));
> memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
> - &s->scu_alias);
> + &a->scu_alias);
>
> /* INTC */
> if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
> @@ -257,6 +257,11 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
> }
>
> +static const Property aspeed_27x0_coprocessor_properties[] = {
> + DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
> + TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
a TYPE_ASPEED_2700_SCU is still a TYPE_ASPEED_SCU. Could you keep
the property removed below ?
> +};
> +
> static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
> const void *data)
> {
> @@ -270,6 +275,7 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
> /* Reason: The Aspeed Coprocessor can only be instantiated from a board */
> dc->user_creatable = false;
> dc->realize = aspeed_soc_ast27x0tsp_realize;
> + device_class_set_props(dc, aspeed_27x0_coprocessor_properties);
>
> sc->valid_cpu_types = valid_cpu_types;
> sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
> diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
> index 87dcb82e1b..e84975a9c4 100644
> --- a/hw/arm/aspeed_ast27x0.c
> +++ b/hw/arm/aspeed_ast27x0.c
> @@ -425,12 +425,12 @@ static void aspeed_soc_ast2700_init(Object *obj)
>
> object_initialize_child(obj, "gic", &a->gic, gicv3_class_name());
>
> - object_initialize_child(obj, "scu", &s->scu, TYPE_ASPEED_2700_SCU);
> - qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
> + object_initialize_child(obj, "scu", &a->scu, TYPE_ASPEED_2700_SCU);
> + qdev_prop_set_uint32(DEVICE(&a->scu), "silicon-rev",
> sc->silicon_rev);
> - object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
> + object_property_add_alias(obj, "hw-strap1", OBJECT(&a->scu),
> "hw-strap1");
> - object_property_add_alias(obj, "hw-prot-key", OBJECT(&s->scu),
> + object_property_add_alias(obj, "hw-prot-key", OBJECT(&a->scu),
> "hw-prot-key");
>
> object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
> @@ -794,10 +794,10 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
> sc->memmap[ASPEED_DEV_VBOOTROM], &s->vbootrom);
>
> /* SCU */
> - if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
> + if (!sysbus_realize(SYS_BUS_DEVICE(&a->scu), errp)) {
> return;
> }
> - aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
> + aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->scu), 0,
> sc->memmap[ASPEED_DEV_SCU]);
>
> /* SCU1 */
> @@ -915,7 +915,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
> AspeedWDTClass *awc = ASPEED_WDT_GET_CLASS(&s->wdt[i]);
> hwaddr wdt_offset = sc->memmap[ASPEED_DEV_WDT] + i * awc->iosize;
>
> - object_property_set_link(OBJECT(&s->wdt[i]), "scu", OBJECT(&s->scu),
> + object_property_set_link(OBJECT(&s->wdt[i]), "scu", OBJECT(&a->scu),
> &error_abort);
> if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
> return;
> @@ -1018,7 +1018,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
> aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_EMMC));
>
> /* Timer */
> - object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&s->scu),
> + object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&a->scu),
> &error_abort);
> if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
> return;
> diff --git a/hw/arm/aspeed_coprocessor_common.c b/hw/arm/aspeed_coprocessor_common.c
> index a0a4c73d08..43026d2a55 100644
> --- a/hw/arm/aspeed_coprocessor_common.c
> +++ b/hw/arm/aspeed_coprocessor_common.c
> @@ -27,8 +27,6 @@ static const Property aspeed_coprocessor_properties[] = {
> TYPE_MEMORY_REGION, MemoryRegion *),
> DEFINE_PROP_LINK("sram", AspeedCoprocessorState, sram, TYPE_MEMORY_REGION,
> MemoryRegion *),
> - DEFINE_PROP_LINK("scu", AspeedCoprocessorState, scu, TYPE_ASPEED_SCU,
> - AspeedSCUState *),
> DEFINE_PROP_LINK("uart", AspeedCoprocessorState, uart, TYPE_SERIAL_MM,
> SerialMM *),
> DEFINE_PROP_INT32("uart-dev", AspeedCoprocessorState, uart_dev, 0),
> diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
> index e4160356e4..0a2dad4537 100644
> --- a/hw/misc/aspeed_scu.c
> +++ b/hw/misc/aspeed_scu.c
> @@ -959,6 +959,11 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
> s->regs[AST2700_HW_STRAP1] = s->hw_strap1;
> }
>
> +static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
> +{
> + aspeed_scu_realize(dev, errp);
> +}
> +
> static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
> {
> DeviceClass *dc = DEVICE_CLASS(klass);
> @@ -966,6 +971,7 @@ static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
>
> dc->desc = "ASPEED 2700 System Control Unit";
> device_class_set_legacy_reset(dc, aspeed_ast2700_scu_reset);
> + dc->realize = aspeed_2700_scu_realize;
> asc->resets = ast2700_a0_resets;
> asc->calc_hpll = aspeed_2600_scu_calc_hpll;
> asc->get_apb = aspeed_2700_scu_get_apb_freq;
> @@ -1097,7 +1103,7 @@ static void aspeed_2700_scuio_class_init(ObjectClass *klass, const void *data)
> static const TypeInfo aspeed_2700_scu_info = {
> .name = TYPE_ASPEED_2700_SCU,
> .parent = TYPE_ASPEED_SCU,
> - .instance_size = sizeof(AspeedSCUState),
> + .instance_size = sizeof(Aspeed2700SCUState),
> .class_init = aspeed_2700_scu_class_init,
> };
>
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 02/21] hw/misc/aspeed_scu: Add separate reset handler for AST2700 SCUIO
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
2026-04-17 3:28 ` [PATCH v4 01/21] hw/misc/aspeed_scu: Introduce Aspeed2700SCU subclass and separate from generic SCU Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 03/21] hw/arm/ast27x0: Start SSP in powered-off state to match hardware behavior Jamin Lin
` (19 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
Introduce a dedicated reset handler for SCUIO.
Previously, SCU and SCUIO shared the same reset handler. This no longer
fits the AST2700 design, where SCU uses the Aspeed2700SCUState subclass
and will handle coprocessor-related control in future changes.
Since these controls are defined in SCU (not SCUIO), SCU and SCUIO
should not share the same reset logic.
This change gives SCUIO its own reset handler and prepares for upcoming
SCU-specific functionality.
No functional change.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 0a2dad4537..51696443bd 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -1084,13 +1084,23 @@ static const uint32_t ast2700_a0_resets_io[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_SCUIO_FREQ_CNT_CTL] = 0x00000080,
};
+static void aspeed_ast2700_scuio_reset(DeviceState *dev)
+{
+ AspeedSCUState *s = ASPEED_SCU(dev);
+ AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
+
+ memcpy(s->regs, asc->resets, asc->nr_regs * 4);
+ s->regs[AST2700_SILICON_REV] = s->silicon_rev;
+ s->regs[AST2700_HW_STRAP1] = s->hw_strap1;
+}
+
static void aspeed_2700_scuio_class_init(ObjectClass *klass, const void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
dc->desc = "ASPEED 2700 System Control Unit I/O";
- device_class_set_legacy_reset(dc, aspeed_ast2700_scu_reset);
+ device_class_set_legacy_reset(dc, aspeed_ast2700_scuio_reset);
asc->resets = ast2700_a0_resets_io;
asc->calc_hpll = aspeed_2600_scu_calc_hpll;
asc->get_apb = aspeed_2700_scuio_get_apb_freq;
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 03/21] hw/arm/ast27x0: Start SSP in powered-off state to match hardware behavior
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
2026-04-17 3:28 ` [PATCH v4 01/21] hw/misc/aspeed_scu: Introduce Aspeed2700SCU subclass and separate from generic SCU Jamin Lin
2026-04-17 3:28 ` [PATCH v4 02/21] hw/misc/aspeed_scu: Add separate reset handler for AST2700 SCUIO Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 04/21] hw/arm/ast27x0: Start TSP " Jamin Lin
` (18 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
In the previous design, both the PSP and SSP were started together during
SoC initialization. However, on real hardware, the SSP begins in a powered-off
state. The typical boot sequence involves the PSP powering up first, loading
the SSP firmware binary into shared memory via DRAM remap, and then releasing
the SSP reset and enabling it through SCU control registers.
To more accurately model this behavior in QEMU, this commit sets the
"start-powered-off" property for the SSP's ARMv7M core. This change ensures
the SSP remains off until explicitly enabled via the SCU, simulating the
real-world flow where the PSP controls SSP boot through SCU interaction.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0-ssp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 9a2079668b..edfcf1badb 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -166,6 +166,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
object_property_set_link(OBJECT(&a->armv7m), "memory",
OBJECT(s->memory), &error_abort);
+ /*
+ * The SSP starts in a powered-down state and can be powered up
+ * by setting the SSP Control Register through the SCU
+ * (System Control Unit)
+ */
+ object_property_set_bool(OBJECT(&a->armv7m), "start-powered-off", true,
+ &error_abort);
sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
/* SDRAM */
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 04/21] hw/arm/ast27x0: Start TSP in powered-off state to match hardware behavior
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (2 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 03/21] hw/arm/ast27x0: Start SSP in powered-off state to match hardware behavior Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 05/21] hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap Jamin Lin
` (17 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
In the previous design, both the PSP and TSP were started together during
SoC initialization. However, on real hardware, the TSP begins in a powered-off
state. The typical boot sequence involves the PSP powering up first, loading
the TSP firmware binary into shared memory via DRAM remap, and then releasing
the TSP reset and enabling it through SCU control registers.
To more accurately model this behavior in QEMU, this commit sets the
"start-powered-off" property for the TSP's ARMv7M core. This change ensures
the TSP remains off until explicitly enabled via the SCU, simulating the
real-world flow where the PSP controls TSP boot through SCU interaction.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0-tsp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 674307103e..b30f2afd62 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -166,6 +166,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
object_property_set_link(OBJECT(&a->armv7m), "memory",
OBJECT(s->memory), &error_abort);
+ /*
+ * The TSP starts in a powered-down state and can be powered up
+ * by setting the TSP Control Register through the SCU
+ * (System Control Unit)
+ */
+ object_property_set_bool(OBJECT(&a->armv7m), "start-powered-off", true,
+ &error_abort);
sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
/* SDRAM */
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 05/21] hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (3 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 04/21] hw/arm/ast27x0: Start TSP " Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:07 ` Cédric Le Goater
2026-04-17 3:28 ` [PATCH v4 06/21] hw/arm/ast27x0: Add DRAM alias for TSP " Jamin Lin
` (16 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
This commit adds two MemoryRegion aliases to support PSP access to
SSP SDRAM through shared memory remapping.
The SSP exposes two DRAM aliases:
- remap1 maps PSP DRAM at 0x400000000 to SSP SDRAM offset 0x5880000
- remap2 maps PSP DRAM at 0x42C000000 to SSP SDRAM offset 0x0
These mappings follow the default SCU register configuration used by
the ASPEED SDK firmware, which defines the memory window mapping
between PSP and the SSP.
Set SSP CPUID 4.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/misc/aspeed_scu.h | 4 ++++
hw/arm/aspeed_ast27x0-fc.c | 2 ++
hw/arm/aspeed_ast27x0-ssp.c | 6 ++++++
hw/arm/aspeed_ast27x0.c | 4 ++++
hw/misc/aspeed_scu.c | 36 ++++++++++++++++++++++++++++++++++++
5 files changed, 52 insertions(+)
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index fd30313e69..106ab4b04a 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -44,6 +44,10 @@ struct AspeedSCUState {
struct Aspeed2700SCUState {
AspeedSCUState parent_obj;
+
+ MemoryRegion dram_remap_alias[3];
+ MemoryRegion *dram;
+ int ssp_cpuid;
};
#define AST2400_A1_SILICON_REV 0x02010303U
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 46f0c97329..0688750e78 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -100,6 +100,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
sc->uarts_num, serial_hd(1));
aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
sc->uarts_num, serial_hd(2));
+ object_property_set_int(OBJECT(&s->ca35), "ssp-cpuid", 4,
+ &error_abort);
if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index edfcf1badb..0500c02755 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -199,6 +199,12 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
&a->scu_alias);
+ /* SDRAM remap alias used by PSP to access SSP SDRAM */
+ memory_region_add_subregion(&s->sdram, 0, &a->scu->dram_remap_alias[1]);
+ memory_region_add_subregion(&s->sdram,
+ memory_region_size(&a->scu->dram_remap_alias[1]),
+ &a->scu->dram_remap_alias[0]);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index e84975a9c4..e38b829cc7 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -432,6 +432,8 @@ static void aspeed_soc_ast2700_init(Object *obj)
"hw-strap1");
object_property_add_alias(obj, "hw-prot-key", OBJECT(&a->scu),
"hw-prot-key");
+ object_property_add_alias(obj, "ssp-cpuid", OBJECT(&a->scu),
+ "ssp-cpuid");
object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
qdev_prop_set_uint32(DEVICE(&s->scuio), "silicon-rev",
@@ -794,6 +796,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
sc->memmap[ASPEED_DEV_VBOOTROM], &s->vbootrom);
/* SCU */
+ object_property_set_link(OBJECT(&a->scu), "dram", OBJECT(s->dram_mr),
+ &error_abort);
if (!sysbus_realize(SYS_BUS_DEVICE(&a->scu), errp)) {
return;
}
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 51696443bd..7080bd6241 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -20,6 +20,7 @@
#include "qemu/guest-random.h"
#include "qemu/module.h"
#include "trace.h"
+#include "qemu/units.h"
#define TO_REG(offset) ((offset) >> 2)
@@ -961,9 +962,42 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
{
+ Aspeed2700SCUState *a = ASPEED_2700_SCU(dev);
+
aspeed_scu_realize(dev, errp);
+
+ if (a->ssp_cpuid > 0) {
+ if (!a->dram) {
+ error_setg(errp, TYPE_ASPEED_2700_SCU ": 'dram' link not set");
+ return;
+ }
+ }
+
+ if (a->ssp_cpuid > 0) {
+ /*
+ * The SSP coprocessor uses two memory aliases (remap1 and remap2)
+ * to access shared memory regions in the PSP DRAM:
+ *
+ * - remap1 maps PSP DRAM at 0x400000000 (size: 0x1A77E000) to
+ * SSP SDRAM offset 0x5880000
+ * - remap2 maps PSP DRAM at 0x42C000000 (size: 0x05880000) to
+ * SSP SDRAM offset 0x0
+ */
+ memory_region_init_alias(&a->dram_remap_alias[0], OBJECT(a),
+ "ssp.dram.remap1", a->dram,
+ 0, 0x1a77e000);
+ memory_region_init_alias(&a->dram_remap_alias[1], OBJECT(a),
+ "ssp.dram.remap2", a->dram,
+ 0x2c000000, 0x05880000);
+ }
}
+static const Property aspeed_2700_scu_properties[] = {
+ DEFINE_PROP_INT32("ssp-cpuid", Aspeed2700SCUState, ssp_cpuid, -1),
+ DEFINE_PROP_LINK("dram", Aspeed2700SCUState, dram, TYPE_MEMORY_REGION,
+ MemoryRegion *),
+};
+
static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
@@ -972,6 +1006,8 @@ static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
dc->desc = "ASPEED 2700 System Control Unit";
device_class_set_legacy_reset(dc, aspeed_ast2700_scu_reset);
dc->realize = aspeed_2700_scu_realize;
+ device_class_set_props(dc, aspeed_2700_scu_properties);
+
asc->resets = ast2700_a0_resets;
asc->calc_hpll = aspeed_2600_scu_calc_hpll;
asc->get_apb = aspeed_2700_scu_get_apb_freq;
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 05/21] hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap
2026-04-17 3:28 ` [PATCH v4 05/21] hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap Jamin Lin
@ 2026-06-01 17:07 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:07 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> This commit adds two MemoryRegion aliases to support PSP access to
> SSP SDRAM through shared memory remapping.
>
> The SSP exposes two DRAM aliases:
> - remap1 maps PSP DRAM at 0x400000000 to SSP SDRAM offset 0x5880000
> - remap2 maps PSP DRAM at 0x42C000000 to SSP SDRAM offset 0x0
>
> These mappings follow the default SCU register configuration used by
> the ASPEED SDK firmware, which defines the memory window mapping
> between PSP and the SSP.
>
> Set SSP CPUID 4.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> include/hw/misc/aspeed_scu.h | 4 ++++
> hw/arm/aspeed_ast27x0-fc.c | 2 ++
> hw/arm/aspeed_ast27x0-ssp.c | 6 ++++++
> hw/arm/aspeed_ast27x0.c | 4 ++++
> hw/misc/aspeed_scu.c | 36 ++++++++++++++++++++++++++++++++++++
> 5 files changed, 52 insertions(+)
>
> diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
> index fd30313e69..106ab4b04a 100644
> --- a/include/hw/misc/aspeed_scu.h
> +++ b/include/hw/misc/aspeed_scu.h
> @@ -44,6 +44,10 @@ struct AspeedSCUState {
>
> struct Aspeed2700SCUState {
> AspeedSCUState parent_obj;
> +
> + MemoryRegion dram_remap_alias[3];
> + MemoryRegion *dram;
> + int ssp_cpuid;
> };
>
> #define AST2400_A1_SILICON_REV 0x02010303U
> diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
> index 46f0c97329..0688750e78 100644
> --- a/hw/arm/aspeed_ast27x0-fc.c
> +++ b/hw/arm/aspeed_ast27x0-fc.c
> @@ -100,6 +100,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
> sc->uarts_num, serial_hd(1));
> aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
> sc->uarts_num, serial_hd(2));
> + object_property_set_int(OBJECT(&s->ca35), "ssp-cpuid", 4,
> + &error_abort);
> if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
> return false;
> }
> diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
> index edfcf1badb..0500c02755 100644
> --- a/hw/arm/aspeed_ast27x0-ssp.c
> +++ b/hw/arm/aspeed_ast27x0-ssp.c
> @@ -199,6 +199,12 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
> &a->scu_alias);
>
> + /* SDRAM remap alias used by PSP to access SSP SDRAM */
> + memory_region_add_subregion(&s->sdram, 0, &a->scu->dram_remap_alias[1]);
> + memory_region_add_subregion(&s->sdram,
> + memory_region_size(&a->scu->dram_remap_alias[1]),
> + &a->scu->dram_remap_alias[0]);
> +
> /* INTC */
> if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
> return;
> diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
> index e84975a9c4..e38b829cc7 100644
> --- a/hw/arm/aspeed_ast27x0.c
> +++ b/hw/arm/aspeed_ast27x0.c
> @@ -432,6 +432,8 @@ static void aspeed_soc_ast2700_init(Object *obj)
> "hw-strap1");
> object_property_add_alias(obj, "hw-prot-key", OBJECT(&a->scu),
> "hw-prot-key");
> + object_property_add_alias(obj, "ssp-cpuid", OBJECT(&a->scu),
> + "ssp-cpuid");
>
> object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
> qdev_prop_set_uint32(DEVICE(&s->scuio), "silicon-rev",
> @@ -794,6 +796,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
> sc->memmap[ASPEED_DEV_VBOOTROM], &s->vbootrom);
>
> /* SCU */
> + object_property_set_link(OBJECT(&a->scu), "dram", OBJECT(s->dram_mr),
> + &error_abort);
> if (!sysbus_realize(SYS_BUS_DEVICE(&a->scu), errp)) {
> return;
> }
> diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
> index 51696443bd..7080bd6241 100644
> --- a/hw/misc/aspeed_scu.c
> +++ b/hw/misc/aspeed_scu.c
> @@ -20,6 +20,7 @@
> #include "qemu/guest-random.h"
> #include "qemu/module.h"
> #include "trace.h"
> +#include "qemu/units.h"
>
> #define TO_REG(offset) ((offset) >> 2)
>
> @@ -961,9 +962,42 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
>
> static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
> {
> + Aspeed2700SCUState *a = ASPEED_2700_SCU(dev);
> +
> aspeed_scu_realize(dev, errp);
> +
> + if (a->ssp_cpuid > 0) {
hmm, this 'ssp_cpuid' atribute looks like an easy way to avoid a sub class.
> + if (!a->dram) {
> + error_setg(errp, TYPE_ASPEED_2700_SCU ": 'dram' link not set");
> + return;
> + }
> + }
> +
> + if (a->ssp_cpuid > 0) {
double if.
> + /*
> + * The SSP coprocessor uses two memory aliases (remap1 and remap2)
> + * to access shared memory regions in the PSP DRAM:
> + *
> + * - remap1 maps PSP DRAM at 0x400000000 (size: 0x1A77E000) to
> + * SSP SDRAM offset 0x5880000
> + * - remap2 maps PSP DRAM at 0x42C000000 (size: 0x05880000) to
> + * SSP SDRAM offset 0x0
> + */
> + memory_region_init_alias(&a->dram_remap_alias[0], OBJECT(a),
> + "ssp.dram.remap1", a->dram,
> + 0, 0x1a77e000);
> + memory_region_init_alias(&a->dram_remap_alias[1], OBJECT(a),
> + "ssp.dram.remap2", a->dram,
> + 0x2c000000, 0x05880000);
> + }
> }
>
> +static const Property aspeed_2700_scu_properties[] = {
> + DEFINE_PROP_INT32("ssp-cpuid", Aspeed2700SCUState, ssp_cpuid, -1),
> + DEFINE_PROP_LINK("dram", Aspeed2700SCUState, dram, TYPE_MEMORY_REGION,
> + MemoryRegion *),
> +};
> +
> static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
> {
> DeviceClass *dc = DEVICE_CLASS(klass);
> @@ -972,6 +1006,8 @@ static void aspeed_2700_scu_class_init(ObjectClass *klass, const void *data)
> dc->desc = "ASPEED 2700 System Control Unit";
> device_class_set_legacy_reset(dc, aspeed_ast2700_scu_reset);
> dc->realize = aspeed_2700_scu_realize;
> + device_class_set_props(dc, aspeed_2700_scu_properties);
> +
> asc->resets = ast2700_a0_resets;
> asc->calc_hpll = aspeed_2600_scu_calc_hpll;
> asc->get_apb = aspeed_2700_scu_get_apb_freq;
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 06/21] hw/arm/ast27x0: Add DRAM alias for TSP SDRAM remap
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (4 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 05/21] hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 07/21] hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU registers Jamin Lin
` (15 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
This commit adds a MemoryRegion alias to support PSP access to
TSP SDRAM through shared memory remapping.
The TSP coprocessor exposes one DRAM alias:
- remap maps PSP DRAM at 0x42E000000 to TSP SDRAM offset 0x0
These mappings follow the default SCU register configuration used by
the ASPEED SDK firmware, which defines the memory window mapping
between PSP and TSP.
Set TSP CPUID 5.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/misc/aspeed_scu.h | 1 +
hw/arm/aspeed_ast27x0-fc.c | 2 ++
hw/arm/aspeed_ast27x0-tsp.c | 3 +++
hw/arm/aspeed_ast27x0.c | 2 ++
hw/misc/aspeed_scu.c | 16 +++++++++++++++-
5 files changed, 23 insertions(+), 1 deletion(-)
diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index 106ab4b04a..839cd30361 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -48,6 +48,7 @@ struct Aspeed2700SCUState {
MemoryRegion dram_remap_alias[3];
MemoryRegion *dram;
int ssp_cpuid;
+ int tsp_cpuid;
};
#define AST2400_A1_SILICON_REV 0x02010303U
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 0688750e78..62bd6a0568 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -102,6 +102,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
sc->uarts_num, serial_hd(2));
object_property_set_int(OBJECT(&s->ca35), "ssp-cpuid", 4,
&error_abort);
+ object_property_set_int(OBJECT(&s->ca35), "tsp-cpuid", 5,
+ &error_abort);
if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index b30f2afd62..4da4741d8a 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -199,6 +199,9 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
&a->scu_alias);
+ /* SDRAM remap alias used by PSP to access TSP SDRAM */
+ memory_region_add_subregion(&s->sdram, 0, &a->scu->dram_remap_alias[2]);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index e38b829cc7..46cc116ef2 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -434,6 +434,8 @@ static void aspeed_soc_ast2700_init(Object *obj)
"hw-prot-key");
object_property_add_alias(obj, "ssp-cpuid", OBJECT(&a->scu),
"ssp-cpuid");
+ object_property_add_alias(obj, "tsp-cpuid", OBJECT(&a->scu),
+ "tsp-cpuid");
object_initialize_child(obj, "scuio", &s->scuio, TYPE_ASPEED_2700_SCUIO);
qdev_prop_set_uint32(DEVICE(&s->scuio), "silicon-rev",
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 7080bd6241..2150261f40 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -966,7 +966,7 @@ static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
aspeed_scu_realize(dev, errp);
- if (a->ssp_cpuid > 0) {
+ if (a->ssp_cpuid > 0 || a->tsp_cpuid > 0) {
if (!a->dram) {
error_setg(errp, TYPE_ASPEED_2700_SCU ": 'dram' link not set");
return;
@@ -990,10 +990,24 @@ static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
"ssp.dram.remap2", a->dram,
0x2c000000, 0x05880000);
}
+
+ if (a->tsp_cpuid > 0) {
+ /*
+ * The TSP coprocessor uses one memory alias (remap) to access a shared
+ * region in the PSP DRAM:
+ *
+ * - remap maps PSP DRAM at 0x42E000000 (size: 32MB) to TSP SDRAM
+ * offset 0x0
+ */
+ memory_region_init_alias(&a->dram_remap_alias[2], OBJECT(a),
+ "tsp.dram.remap", a->dram,
+ 0x2e000000, 32 * MiB);
+ }
}
static const Property aspeed_2700_scu_properties[] = {
DEFINE_PROP_INT32("ssp-cpuid", Aspeed2700SCUState, ssp_cpuid, -1),
+ DEFINE_PROP_INT32("tsp-cpuid", Aspeed2700SCUState, tsp_cpuid, -1),
DEFINE_PROP_LINK("dram", Aspeed2700SCUState, dram, TYPE_MEMORY_REGION,
MemoryRegion *),
};
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 07/21] hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU registers
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (5 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 06/21] hw/arm/ast27x0: Add DRAM alias for TSP " Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 08/21] hw/misc/aspeed_scu: Implement TSP " Jamin Lin
` (14 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
This patch implements SSP reset and power control logic in the SCU for AST2700.
It introduces support for the following behavior:
1. SSP Reset Trigger (via SCU 0x200):
- SSP reset is triggered by writing 1 to bit 30 (RW1S) of SYS_RESET_CTRL_1.
2. SSP Reset State and Source Hold (via SCU 0x120):
- Upon reset, bit 8 (RST_RB) is set to indicate the SSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding SSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the SSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.
3. Hold Release and Power-on:
- If RST_HOLD_RB is clear (0), SSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to SSP_CTRL_0 to release
the hold and power on SSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.
4. Reset Status Clear (via SCU 0x204):
- The reset status can be cleared by writing 1 to bit 30 (RW1C) of SYS_RST_CLR_1,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.
5. SSP Power Control Logic:
- `handle_ssp_tsp_on()` clears RST_SRC_RB and RST_RB (if not held), and invokes
`arm_set_cpu_on_and_reset(cpuid)` to power on the SSP core (CPUID 4).
- `handle_ssp_tsp_off()` sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes `arm_set_cpu_off(cpuid)`.
6. Register Initialization and Definitions:
- Adds SCU register definitions for SSP_CTRL_0 (0x120), SYS_RST_CTRL_1 (0x200),
and SYS_RST_CLR_1 (0x204).
- Updates the reset values for these registers during SCU initialization.
The default values are based on EVB (evaluation board) register dump observations.
This patch enables proper modeling of SSP lifecycle management across reset,
hold, and power-on states for the AST2700 SoC.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 109 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 109 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 2150261f40..d6c60b1d34 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -21,6 +21,7 @@
#include "qemu/module.h"
#include "trace.h"
#include "qemu/units.h"
+#include "target/arm/arm-powerctl.h"
#define TO_REG(offset) ((offset) >> 2)
@@ -144,6 +145,17 @@
#define AST2700_HW_STRAP1_SEC2 TO_REG(0x28)
#define AST2700_HW_STRAP1_SEC3 TO_REG(0x2C)
+/* SSP TSP */
+#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SSP_TSP_ENABLE BIT(0)
+#define AST2700_SSP_TSP_RST BIT(1)
+#define AST2700_SSP_TSP_RST_RB BIT(8)
+#define AST2700_SSP_TSP_RST_HOLD_RB BIT(9)
+#define AST2700_SSP_TSP_RST_SRC_RB BIT(10)
+#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
+#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
+#define AST2700_SCU_SYS_RST_SSP BIT(30)
+
#define AST2700_SCU_CLK_SEL_1 TO_REG(0x280)
#define AST2700_SCU_HPLL_PARAM TO_REG(0x300)
#define AST2700_SCU_HPLL_EXT_PARAM TO_REG(0x304)
@@ -864,6 +876,35 @@ static const TypeInfo aspeed_2600_scu_info = {
.class_init = aspeed_2600_scu_class_init,
};
+static void handle_2700_ssp_tsp_on(struct AspeedSCUState *s, int cpuid,
+ int reg)
+{
+ uint32_t val = s->regs[reg];
+
+ val &= ~AST2700_SSP_TSP_RST_SRC_RB;
+ if (!(val & AST2700_SSP_TSP_RST_HOLD_RB)) {
+ val &= ~AST2700_SSP_TSP_RST_RB;
+ arm_set_cpu_on_and_reset(cpuid);
+ }
+
+ s->regs[reg] = val;
+}
+
+static void handle_2700_ssp_tsp_off(struct AspeedSCUState *s, int cpuid,
+ int reg)
+{
+ uint32_t val = s->regs[reg];
+
+ val |= AST2700_SSP_TSP_RST_RB;
+ val |= AST2700_SSP_TSP_RST_SRC_RB;
+ if (val & AST2700_SSP_TSP_RST) {
+ val |= AST2700_SSP_TSP_RST_HOLD_RB;
+ }
+ arm_set_cpu_off(cpuid);
+
+ s->regs[reg] = val;
+}
+
static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
unsigned size)
{
@@ -891,10 +932,14 @@ static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
uint64_t data64, unsigned size)
{
+ Aspeed2700SCUState *a = ASPEED_2700_SCU(opaque);
AspeedSCUState *s = ASPEED_SCU(opaque);
int reg = TO_REG(offset);
/* Truncate here so bitwise operations below behave as expected */
uint32_t data = data64;
+ uint32_t active;
+ uint32_t oldval;
+ int cpuid;
if (reg >= ASPEED_AST2700_SCU_NR_REGS) {
qemu_log_mask(LOG_GUEST_ERROR,
@@ -906,6 +951,63 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
trace_aspeed_ast2700_scu_write(offset, size, data);
switch (reg) {
+ case AST2700_SCU_SSP_CTRL_0:
+ cpuid = a->ssp_cpuid;
+ if (cpuid < 0) {
+ return;
+ }
+ oldval = s->regs[reg];
+ data &= 0xff;
+ active = oldval ^ data;
+
+ /*
+ * If reset bit is being released (1 -> 0) and no other reset source
+ * is active, clear HOLD_RB and power on the corresponding CPU.
+ */
+ if ((active & AST2700_SSP_TSP_RST) && !(data & AST2700_SSP_TSP_RST)) {
+ s->regs[reg] &= ~AST2700_SSP_TSP_RST_HOLD_RB;
+ if ((oldval & AST2700_SSP_TSP_RST_RB) &&
+ !(oldval & AST2700_SSP_TSP_RST_SRC_RB)) {
+ handle_2700_ssp_tsp_on(s, cpuid, reg);
+ }
+ }
+
+ /*
+ * If ENABLE bit is newly set and reset state is ready,
+ * clear HOLD_RB and power on the corresponding CPU.
+ */
+ if ((active & AST2700_SSP_TSP_ENABLE) &&
+ (oldval & AST2700_SSP_TSP_RST_RB) &&
+ (oldval & AST2700_SSP_TSP_RST_HOLD_RB) &&
+ !(oldval & AST2700_SSP_TSP_RST_SRC_RB)) {
+ s->regs[reg] &= ~AST2700_SSP_TSP_RST_HOLD_RB;
+ handle_2700_ssp_tsp_on(s, cpuid, reg);
+ }
+
+ /* Auto-clear the ENABLE bit (one-shot behavior) */
+ data &= ~AST2700_SSP_TSP_ENABLE;
+ s->regs[reg] = (s->regs[reg] & ~0xff) | (data & 0xff);
+ return;
+ case AST2700_SCU_SYS_RST_CTRL_1:
+ if (a->ssp_cpuid < 0) {
+ return;
+ }
+ if (data & AST2700_SCU_SYS_RST_SSP) {
+ handle_2700_ssp_tsp_off(s, a->ssp_cpuid, AST2700_SCU_SSP_CTRL_0);
+ }
+ s->regs[reg] |= data;
+ return;
+ case AST2700_SCU_SYS_RST_CLR_1:
+ if (a->ssp_cpuid < 0) {
+ return;
+ }
+ oldval = s->regs[AST2700_SCU_SYS_RST_CTRL_1];
+ active = data & oldval;
+ if (active & AST2700_SCU_SYS_RST_SSP) {
+ handle_2700_ssp_tsp_on(s, a->ssp_cpuid, AST2700_SCU_SSP_CTRL_0);
+ }
+ s->regs[AST2700_SCU_SYS_RST_CTRL_1] &= ~active;
+ return;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Unhandled write at offset 0x%" HWADDR_PRIx "\n",
@@ -933,6 +1035,8 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC1] = 0x000000FF,
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
+ [AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
[AST2700_SCU_HPLL_EXT_PARAM] = 0x8000004f,
[AST2700_SCU_DPLL_PARAM] = 0x0080009f,
@@ -952,12 +1056,17 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
static void aspeed_ast2700_scu_reset(DeviceState *dev)
{
+ Aspeed2700SCUState *a = ASPEED_2700_SCU(dev);
AspeedSCUState *s = ASPEED_SCU(dev);
AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
memcpy(s->regs, asc->resets, asc->nr_regs * 4);
s->regs[AST2700_SILICON_REV] = s->silicon_rev;
s->regs[AST2700_HW_STRAP1] = s->hw_strap1;
+
+ if (a->ssp_cpuid > 0) {
+ arm_set_cpu_off(a->ssp_cpuid);
+ }
}
static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 08/21] hw/misc/aspeed_scu: Implement TSP reset and power-on control via SCU registers
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (6 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 07/21] hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU registers Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 09/21] hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap Jamin Lin
` (13 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
This patch implements TSP reset and power control logic in the SCU module
for AST2700. It introduces support for the following behavior:
1. TSP Reset Trigger (via SCU 0x220):
- TSP reset is triggered by writing 1 to bit 9 (RW1S) of SYS_RESET_CTRL_2.
2. TSP Reset State and Source Hold (via SCU 0x160):
- Upon reset, bit 8 (RST_RB) is set to indicate the TSP is in reset.
- Bit 10 (RST_SRC_RB) is set to indicate the reset was triggered by an external source.
- Bit 1 (RST) is a software-controlled bit used to request holding TSP in reset.
- If an external reset source is present and bit 1 is set, bit 9 (RST_HOLD_RB)
will also be asserted to indicate the TSP is being held in reset.
- If bit 1 is cleared, RST_HOLD_RB will be deasserted accordingly.
3. Hold Release and Power-on:
- If RST_HOLD_RB is clear (0), TSP is powered on immediately after reset is deasserted.
- If RST_HOLD_RB is set (1), the user must write ENABLE (bit 0) to TSP_CTRL_0 to release
the hold and power on TSP explicitly.
- Writing ENABLE (bit 0) is a one-shot operation and will auto-clear after execution.
4. Reset Status Clear (via SCU 0x224):
- The reset status can be cleared by writing 1 to bit 9 (RW1C) of SYS_RST_CLR_2,
which will deassert RST_SRC_RB and potentially trigger power-on if no hold is active.
5. TSP Power Control Logic:
- handle_ssp_tsp_on() clears RST_SRC_RB and RST_RB (if not held), and invokes
arm_set_cpu_on_and_reset(cpuid) to power on the TSP core (CPUID 5).
- handle_ssp_tsp_off() sets RST_RB and RST_SRC_RB; if RST is active, also asserts
RST_HOLD_RB and invokes arm_set_cpu_off(cpuid).
The default values are based on EVB (evaluation board) register dump observations.
TSP reset control shares the same helper functions and register bit layout as SSP,
with logic selected by cpuid and distinct external reset sources.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 37 ++++++++++++++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index d6c60b1d34..6512b5fccd 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -147,6 +147,7 @@
/* SSP TSP */
#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SCU_TSP_CTRL_0 TO_REG(0x160)
#define AST2700_SSP_TSP_ENABLE BIT(0)
#define AST2700_SSP_TSP_RST BIT(1)
#define AST2700_SSP_TSP_RST_RB BIT(8)
@@ -155,6 +156,9 @@
#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
#define AST2700_SCU_SYS_RST_SSP BIT(30)
+#define AST2700_SCU_SYS_RST_CTRL_2 TO_REG(0x220)
+#define AST2700_SCU_SYS_RST_CLR_2 TO_REG(0x224)
+#define AST2700_SCU_SYS_RST_TSP BIT(9)
#define AST2700_SCU_CLK_SEL_1 TO_REG(0x280)
#define AST2700_SCU_HPLL_PARAM TO_REG(0x300)
@@ -952,7 +956,10 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
switch (reg) {
case AST2700_SCU_SSP_CTRL_0:
- cpuid = a->ssp_cpuid;
+ case AST2700_SCU_TSP_CTRL_0:
+ cpuid = (reg == AST2700_SCU_SSP_CTRL_0) ?
+ a->ssp_cpuid : a->tsp_cpuid;
+
if (cpuid < 0) {
return;
}
@@ -1008,6 +1015,28 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
}
s->regs[AST2700_SCU_SYS_RST_CTRL_1] &= ~active;
return;
+ case AST2700_SCU_SYS_RST_CTRL_2:
+ if (a->tsp_cpuid < 0) {
+ return;
+ }
+ data &= 0x00001fff;
+ if (data & AST2700_SCU_SYS_RST_TSP) {
+ handle_2700_ssp_tsp_off(s, a->tsp_cpuid, AST2700_SCU_TSP_CTRL_0);
+ }
+ s->regs[reg] |= data;
+ return;
+ case AST2700_SCU_SYS_RST_CLR_2:
+ if (a->tsp_cpuid < 0) {
+ return;
+ }
+ data &= 0x00001fff;
+ oldval = s->regs[AST2700_SCU_SYS_RST_CTRL_2];
+ active = data & oldval;
+ if (active & AST2700_SCU_SYS_RST_TSP) {
+ handle_2700_ssp_tsp_on(s, a->tsp_cpuid, AST2700_SCU_TSP_CTRL_0);
+ }
+ s->regs[AST2700_SCU_SYS_RST_CTRL_2] &= ~active;
+ return;
default:
qemu_log_mask(LOG_GUEST_ERROR,
"%s: Unhandled write at offset 0x%" HWADDR_PRIx "\n",
@@ -1036,7 +1065,9 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
[AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
+ [AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
[AST2700_SCU_HPLL_EXT_PARAM] = 0x8000004f,
[AST2700_SCU_DPLL_PARAM] = 0x0080009f,
@@ -1067,6 +1098,10 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (a->ssp_cpuid > 0) {
arm_set_cpu_off(a->ssp_cpuid);
}
+
+ if (a->tsp_cpuid > 0) {
+ arm_set_cpu_off(a->tsp_cpuid);
+ }
}
static void aspeed_2700_scu_realize(DeviceState *dev, Error **errp)
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 09/21] hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (7 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 08/21] hw/misc/aspeed_scu: Implement TSP " Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:28 ` Cédric Le Goater
2026-04-17 3:28 ` [PATCH v4 10/21] hw/misc/aspeed_scu: Add SCU support for TSP " Jamin Lin
` (12 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
This commit adds SCU register support for SSP SDRAM remap control and runtime
activation. It introduces logic for the PSP to dynamically configure the mapping
of its own DRAM windows into SSP-visible SDRAM space, enabling shared memory
communication via memory region aliases.
- coprocessor_sdram_remap[0]: maps PSP DRAM offset 0x400000000 (size: 0x1A77E000) to SSP SDRAM
offset 0x5880000
- coprocessor_sdram_remap[1]: maps PSP DRAM offset 0x42C000000 (size: 0x05880000) to SSP SDRAM
offset 0x0
The SCU registers AST2700_SCU_SSP_CTRL_1/2 and
AST2700_SCU_SSP_REMAP_ADDR_{1,2} / REMAP_SIZE_{1,2} allow runtime reconfiguration
of alias offset, base, and size.
|------------------------------------------| |----------------------------|
| PSP DRAM | | SSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x4_0000_0000 (SCU_124 << 4) | --> | 0x0000_0000 |
| remap1 base |---| | | - SCU_150: target addr |
| size: 0x1A77E000 (SCU_14C) | | | | remap2 |
|------------------------------------------| | | |----------------------------|
| | | | | |
| 0x4_2C00_0000 (SCU_128 << 4) |-----| | 0x5880000 |
| remap2 base | | | - SCU_148: target addr |
| size: 0x05880000 (SCU_154) | |---> | remap1 |
|------------------------------------------| |----------------------------|
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 54 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 54 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 6512b5fccd..8d1ad95402 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -147,6 +147,14 @@
/* SSP TSP */
#define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
+#define AST2700_SCU_SSP_CTRL_1 TO_REG(0x124)
+#define AST2700_SCU_SSP_CTRL_2 TO_REG(0x128)
+#define AST2700_SCU_SSP_REMAP_ADDR_0 TO_REG(0x140)
+#define AST2700_SCU_SSP_REMAP_SIZE_0 TO_REG(0x144)
+#define AST2700_SCU_SSP_REMAP_ADDR_1 TO_REG(0x148)
+#define AST2700_SCU_SSP_REMAP_SIZE_1 TO_REG(0x14C)
+#define AST2700_SCU_SSP_REMAP_ADDR_2 TO_REG(0x150)
+#define AST2700_SCU_SSP_REMAP_SIZE_2 TO_REG(0x154)
#define AST2700_SCU_TSP_CTRL_0 TO_REG(0x160)
#define AST2700_SSP_TSP_ENABLE BIT(0)
#define AST2700_SSP_TSP_RST BIT(1)
@@ -938,6 +946,7 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
{
Aspeed2700SCUState *a = ASPEED_2700_SCU(opaque);
AspeedSCUState *s = ASPEED_SCU(opaque);
+ MemoryRegion *mr = NULL;
int reg = TO_REG(offset);
/* Truncate here so bitwise operations below behave as expected */
uint32_t data = data64;
@@ -995,6 +1004,37 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
data &= ~AST2700_SSP_TSP_ENABLE;
s->regs[reg] = (s->regs[reg] & ~0xff) | (data & 0xff);
return;
+ case AST2700_SCU_SSP_CTRL_1:
+ case AST2700_SCU_SSP_CTRL_2:
+ mr = (reg == AST2700_SCU_SSP_CTRL_1) ?
+ &a->dram_remap_alias[0] : &a->dram_remap_alias[1];
+ if (a->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x7fffffff;
+ memory_region_set_alias_offset(mr,
+ ((uint64_t) data << 4) & 0x3ffffffff);
+ break;
+ case AST2700_SCU_SSP_REMAP_ADDR_1:
+ case AST2700_SCU_SSP_REMAP_ADDR_2:
+ mr = (reg == AST2700_SCU_SSP_REMAP_ADDR_1) ?
+ &a->dram_remap_alias[0] : &a->dram_remap_alias[1];
+ if (a->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_address(mr, data);
+ break;
+ case AST2700_SCU_SSP_REMAP_SIZE_1:
+ case AST2700_SCU_SSP_REMAP_SIZE_2:
+ mr = (reg == AST2700_SCU_SSP_REMAP_SIZE_1) ?
+ &a->dram_remap_alias[0] : &a->dram_remap_alias[1];
+ if (a->ssp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_size(mr, data);
+ break;
case AST2700_SCU_SYS_RST_CTRL_1:
if (a->ssp_cpuid < 0) {
return;
@@ -1065,6 +1105,14 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_HW_STRAP1_SEC2] = 0x00000000,
[AST2700_HW_STRAP1_SEC3] = 0x1000408F,
[AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_SSP_CTRL_1] = 0x40000000,
+ [AST2700_SCU_SSP_CTRL_2] = 0x42C00000,
+ [AST2700_SCU_SSP_REMAP_ADDR_0] = 0x1FFFE000,
+ [AST2700_SCU_SSP_REMAP_SIZE_0] = 0x00002000,
+ [AST2700_SCU_SSP_REMAP_ADDR_1] = 0x05880000,
+ [AST2700_SCU_SSP_REMAP_SIZE_1] = 0x1A77E000,
+ [AST2700_SCU_SSP_REMAP_ADDR_2] = 0x00000000,
+ [AST2700_SCU_SSP_REMAP_SIZE_2] = 0x05880000,
[AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
@@ -1097,6 +1145,12 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (a->ssp_cpuid > 0) {
arm_set_cpu_off(a->ssp_cpuid);
+ memory_region_set_address(&a->dram_remap_alias[0], 0x5880000);
+ memory_region_set_alias_offset(&a->dram_remap_alias[0], 0);
+ memory_region_set_size(&a->dram_remap_alias[0], 0x1a77e000);
+ memory_region_set_address(&a->dram_remap_alias[1], 0);
+ memory_region_set_alias_offset(&a->dram_remap_alias[1], 0x2c000000);
+ memory_region_set_size(&a->dram_remap_alias[1], 0x5880000);
}
if (a->tsp_cpuid > 0) {
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 09/21] hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap
2026-04-17 3:28 ` [PATCH v4 09/21] hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap Jamin Lin
@ 2026-06-01 17:28 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:28 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> This commit adds SCU register support for SSP SDRAM remap control and runtime
> activation. It introduces logic for the PSP to dynamically configure the mapping
> of its own DRAM windows into SSP-visible SDRAM space, enabling shared memory
> communication via memory region aliases.
>
> - coprocessor_sdram_remap[0]: maps PSP DRAM offset 0x400000000 (size: 0x1A77E000) to SSP SDRAM
> offset 0x5880000
> - coprocessor_sdram_remap[1]: maps PSP DRAM offset 0x42C000000 (size: 0x05880000) to SSP SDRAM
> offset 0x0
>
> The SCU registers AST2700_SCU_SSP_CTRL_1/2 and
> AST2700_SCU_SSP_REMAP_ADDR_{1,2} / REMAP_SIZE_{1,2} allow runtime reconfiguration
> of alias offset, base, and size.
>
> |------------------------------------------| |----------------------------|
> | PSP DRAM | | SSP SDRAM |
> |------------------------------------------| |----------------------------|
> | 0x4_0000_0000 (SCU_124 << 4) | --> | 0x0000_0000 |
> | remap1 base |---| | | - SCU_150: target addr |
> | size: 0x1A77E000 (SCU_14C) | | | | remap2 |
> |------------------------------------------| | | |----------------------------|
> | | | | | |
> | 0x4_2C00_0000 (SCU_128 << 4) |-----| | 0x5880000 |
> | remap2 base | | | - SCU_148: target addr |
> | size: 0x05880000 (SCU_154) | |---> | remap1 |
> |------------------------------------------| |----------------------------|
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> hw/misc/aspeed_scu.c | 54 ++++++++++++++++++++++++++++++++++++++++++++
> 1 file changed, 54 insertions(+)
>
> diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
> index 6512b5fccd..8d1ad95402 100644
> --- a/hw/misc/aspeed_scu.c
> +++ b/hw/misc/aspeed_scu.c
> @@ -147,6 +147,14 @@
>
> /* SSP TSP */
> #define AST2700_SCU_SSP_CTRL_0 TO_REG(0x120)
> +#define AST2700_SCU_SSP_CTRL_1 TO_REG(0x124)
> +#define AST2700_SCU_SSP_CTRL_2 TO_REG(0x128)
> +#define AST2700_SCU_SSP_REMAP_ADDR_0 TO_REG(0x140)
> +#define AST2700_SCU_SSP_REMAP_SIZE_0 TO_REG(0x144)
> +#define AST2700_SCU_SSP_REMAP_ADDR_1 TO_REG(0x148)
> +#define AST2700_SCU_SSP_REMAP_SIZE_1 TO_REG(0x14C)
> +#define AST2700_SCU_SSP_REMAP_ADDR_2 TO_REG(0x150)
> +#define AST2700_SCU_SSP_REMAP_SIZE_2 TO_REG(0x154)
> #define AST2700_SCU_TSP_CTRL_0 TO_REG(0x160)
> #define AST2700_SSP_TSP_ENABLE BIT(0)
> #define AST2700_SSP_TSP_RST BIT(1)
> @@ -938,6 +946,7 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
> {
> Aspeed2700SCUState *a = ASPEED_2700_SCU(opaque);
> AspeedSCUState *s = ASPEED_SCU(opaque);
> + MemoryRegion *mr = NULL;
> int reg = TO_REG(offset);
> /* Truncate here so bitwise operations below behave as expected */
> uint32_t data = data64;
> @@ -995,6 +1004,37 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
> data &= ~AST2700_SSP_TSP_ENABLE;
> s->regs[reg] = (s->regs[reg] & ~0xff) | (data & 0xff);
> return;
> + case AST2700_SCU_SSP_CTRL_1:
> + case AST2700_SCU_SSP_CTRL_2:
> + mr = (reg == AST2700_SCU_SSP_CTRL_1) ?
> + &a->dram_remap_alias[0] : &a->dram_remap_alias[1];
> + if (a->ssp_cpuid < 0 || mr == NULL) {
> + return;
> + }
> + data &= 0x7fffffff;
> + memory_region_set_alias_offset(mr,
> + ((uint64_t) data << 4) & 0x3ffffffff);
I am not sure if transactions need to be protected. To check.
> + break;
> + case AST2700_SCU_SSP_REMAP_ADDR_1:
> + case AST2700_SCU_SSP_REMAP_ADDR_2:
> + mr = (reg == AST2700_SCU_SSP_REMAP_ADDR_1) ?
> + &a->dram_remap_alias[0] : &a->dram_remap_alias[1];
> + if (a->ssp_cpuid < 0 || mr == NULL) {
> + return;
> + }
> + data &= 0x3fffffff;
> + memory_region_set_address(mr, data);
> + break;
> + case AST2700_SCU_SSP_REMAP_SIZE_1:
> + case AST2700_SCU_SSP_REMAP_SIZE_2:
> + mr = (reg == AST2700_SCU_SSP_REMAP_SIZE_1) ?
> + &a->dram_remap_alias[0] : &a->dram_remap_alias[1];
> + if (a->ssp_cpuid < 0 || mr == NULL) {
> + return;
> + }
> + data &= 0x3fffffff;
> + memory_region_set_size(mr, data);
> + break;
> case AST2700_SCU_SYS_RST_CTRL_1:
> if (a->ssp_cpuid < 0) {
> return;
> @@ -1065,6 +1105,14 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
> [AST2700_HW_STRAP1_SEC2] = 0x00000000,
> [AST2700_HW_STRAP1_SEC3] = 0x1000408F,
> [AST2700_SCU_SSP_CTRL_0] = 0x000007FE,
> + [AST2700_SCU_SSP_CTRL_1] = 0x40000000,
> + [AST2700_SCU_SSP_CTRL_2] = 0x42C00000,
> + [AST2700_SCU_SSP_REMAP_ADDR_0] = 0x1FFFE000,
> + [AST2700_SCU_SSP_REMAP_SIZE_0] = 0x00002000,
> + [AST2700_SCU_SSP_REMAP_ADDR_1] = 0x05880000,
> + [AST2700_SCU_SSP_REMAP_SIZE_1] = 0x1A77E000,
> + [AST2700_SCU_SSP_REMAP_ADDR_2] = 0x00000000,
> + [AST2700_SCU_SSP_REMAP_SIZE_2] = 0x05880000,
> [AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
> [AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
> [AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
> @@ -1097,6 +1145,12 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
>
> if (a->ssp_cpuid > 0) {
> arm_set_cpu_off(a->ssp_cpuid);
memory_region_transaction_begin();
> + memory_region_set_address(&a->dram_remap_alias[0], 0x5880000);
> + memory_region_set_alias_offset(&a->dram_remap_alias[0], 0);
> + memory_region_set_size(&a->dram_remap_alias[0], 0x1a77e000);
> + memory_region_set_address(&a->dram_remap_alias[1], 0);
> + memory_region_set_alias_offset(&a->dram_remap_alias[1], 0x2c000000);
> + memory_region_set_size(&a->dram_remap_alias[1], 0x5880000);
memory_region_transaction_commit();
> }
>
> if (a->tsp_cpuid > 0) {
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 10/21] hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (8 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 09/21] hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 11/21] hw/arm/ast27x0: Share FMC controller with SSP and TSP Jamin Lin
` (11 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
This commit adds SCU register support for TSP SDRAM remap control and runtime
activation. Unlike SSP, the TSP does not support configurable target address remapping
through SCU registers. It only supports setting the PSP DRAM base and size, which
are then aliased into the TSP-visible SDRAM window.
coprocessor_sdram_remap[2]: maps PSP DRAM offset 0x42E000000 (size: 32MB) to TSP SDRAM
offset 0x0
The SCU registers AST2700_SCU_TSP_CTRL_1 and
AST2700_SCU_TSP_REMAP_SIZE_2 allow runtime reconfiguration of the DRAM base (alias offset)
and mapping size.
|------------------------------------------| |----------------------------|
| PSP DRAM | | TSP SDRAM |
|------------------------------------------| |----------------------------|
| 0x42E0_0000_0 (SCU_168 << 4) | | 0x0000_0000 |
| remap base |------> | - fixed target addr |
| size: 32MB (SCU_194) | | |
|------------------------------------------| |----------------------------|
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 8d1ad95402..251c23def0 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -161,6 +161,8 @@
#define AST2700_SSP_TSP_RST_RB BIT(8)
#define AST2700_SSP_TSP_RST_HOLD_RB BIT(9)
#define AST2700_SSP_TSP_RST_SRC_RB BIT(10)
+#define AST2700_SCU_TSP_CTRL_1 TO_REG(0x168)
+#define AST2700_SCU_TSP_REMAP_SIZE_2 TO_REG(0x194)
#define AST2700_SCU_SYS_RST_CTRL_1 TO_REG(0x200)
#define AST2700_SCU_SYS_RST_CLR_1 TO_REG(0x204)
#define AST2700_SCU_SYS_RST_SSP BIT(30)
@@ -1035,6 +1037,23 @@ static void aspeed_ast2700_scu_write(void *opaque, hwaddr offset,
data &= 0x3fffffff;
memory_region_set_size(mr, data);
break;
+ case AST2700_SCU_TSP_CTRL_1:
+ mr = &a->dram_remap_alias[2];
+ if (a->tsp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x7fffffff;
+ memory_region_set_alias_offset(mr,
+ ((uint64_t) data << 4) & 0x3ffffffff);
+ break;
+ case AST2700_SCU_TSP_REMAP_SIZE_2:
+ mr = &a->dram_remap_alias[2];
+ if (a->tsp_cpuid < 0 || mr == NULL) {
+ return;
+ }
+ data &= 0x3fffffff;
+ memory_region_set_size(mr, data);
+ break;
case AST2700_SCU_SYS_RST_CTRL_1:
if (a->ssp_cpuid < 0) {
return;
@@ -1114,6 +1133,8 @@ static const uint32_t ast2700_a0_resets[ASPEED_AST2700_SCU_NR_REGS] = {
[AST2700_SCU_SSP_REMAP_ADDR_2] = 0x00000000,
[AST2700_SCU_SSP_REMAP_SIZE_2] = 0x05880000,
[AST2700_SCU_TSP_CTRL_0] = 0x000007FE,
+ [AST2700_SCU_TSP_CTRL_1] = 0x42E00000,
+ [AST2700_SCU_TSP_REMAP_SIZE_2] = 0x02000000,
[AST2700_SCU_SYS_RST_CTRL_1] = 0xFFC37FDC,
[AST2700_SCU_SYS_RST_CTRL_2] = 0x00001FFF,
[AST2700_SCU_HPLL_PARAM] = 0x0000009f,
@@ -1155,6 +1176,8 @@ static void aspeed_ast2700_scu_reset(DeviceState *dev)
if (a->tsp_cpuid > 0) {
arm_set_cpu_off(a->tsp_cpuid);
+ memory_region_set_alias_offset(&a->dram_remap_alias[2], 0x2e000000);
+ memory_region_set_size(&a->dram_remap_alias[2], 32 * MiB);
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 11/21] hw/arm/ast27x0: Share FMC controller with SSP and TSP
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (9 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 10/21] hw/misc/aspeed_scu: Add SCU support for TSP " Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:18 ` Cédric Le Goater
2026-04-17 3:28 ` [PATCH v4 12/21] hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller MMIO regions for SSP/TSP Jamin Lin
` (10 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
AST2700 provides a single FMC controller shared by the main CA35 processor
(PSP) and the SSP/TSP coprocessors.
From the PSP perspective, the FMC controller is memory-mapped at
0x14000000–0x140000FF. The SSP and TSP access the same controller through
a different address window at 0x74000000–0x740000FF.
This change allows the SSP and TSP SoC models to reference the existing
PSP FMC instance instead of creating independent controllers. An MMIO
alias is added in the SSP and TSP address spaces to map their FMC access
window to the shared FMC device.
This ensures consistent FMC state across PSP, SSP, and TSP and matches
the AST2700 hardware design.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/arm/aspeed_coprocessor.h | 2 ++
hw/arm/aspeed_ast27x0-fc.c | 4 ++++
hw/arm/aspeed_ast27x0-ssp.c | 10 ++++++++++
hw/arm/aspeed_ast27x0-tsp.c | 10 ++++++++++
4 files changed, 26 insertions(+)
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 4db995d251..2460a11401 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -50,7 +50,9 @@ struct Aspeed27x0CoprocessorState {
ARMv7MState armv7m;
MemoryRegion scu_alias;
+ MemoryRegion fmc_alias;
Aspeed2700SCUState *scu;
+ AspeedSMCState *fmc;
};
#define TYPE_ASPEED27X0SSP_COPROCESSOR "aspeed27x0ssp-coprocessor"
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 62bd6a0568..56dd86e2c2 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -161,6 +161,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
OBJECT(&psp->sram), &error_abort);
object_property_set_link(OBJECT(&s->ssp), "scu",
OBJECT(&s->ca35.scu), &error_abort);
+ object_property_set_link(OBJECT(&s->ssp), "fmc",
+ OBJECT(&psp->fmc), &error_abort);
if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
return false;
}
@@ -193,6 +195,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
OBJECT(&psp->sram), &error_abort);
object_property_set_link(OBJECT(&s->tsp), "scu",
OBJECT(&s->ca35.scu), &error_abort);
+ object_property_set_link(OBJECT(&s->tsp), "fmc",
+ OBJECT(&psp->fmc), &error_abort);
if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
return false;
}
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 0500c02755..bfd6fe4485 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -26,6 +26,7 @@ static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
[ASPEED_DEV_TIMER1] = 0x72C10000,
[ASPEED_DEV_UART4] = 0x72C1A000,
[ASPEED_DEV_IPC0] = 0x72C1C000,
+ [ASPEED_DEV_FMC] = 0x74000000,
[ASPEED_DEV_SCUIO] = 0x74C02000,
[ASPEED_DEV_INTCIO] = 0x74C18000,
[ASPEED_DEV_UART0] = 0x74C33000,
@@ -256,6 +257,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
sysbus_connect_irq(SYS_BUS_DEVICE(s->uart), 0,
aspeed_soc_ast27x0ssp_get_irq(s, s->uart_dev));
+ /* FMC */
+ memory_region_init_alias(&a->fmc_alias, OBJECT(a), "fmc.alias",
+ &a->fmc->mmio, 0,
+ memory_region_size(&a->fmc->mmio));
+ memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_FMC],
+ &a->fmc_alias);
+
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
"aspeed.timerctrl",
sc->memmap[ASPEED_DEV_TIMER1], 0x200);
@@ -273,6 +281,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
static const Property aspeed_27x0_coprocessor_properties[] = {
DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
+ DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
+ AspeedSMCState *),
};
static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 4da4741d8a..166dcb14ed 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -26,6 +26,7 @@ static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
[ASPEED_DEV_TIMER1] = 0x72C10000,
[ASPEED_DEV_UART4] = 0x72C1A000,
[ASPEED_DEV_IPC0] = 0x72C1C000,
+ [ASPEED_DEV_FMC] = 0x74000000,
[ASPEED_DEV_SCUIO] = 0x74C02000,
[ASPEED_DEV_INTCIO] = 0x74C18000,
[ASPEED_DEV_UART0] = 0x74C33000,
@@ -253,6 +254,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
sysbus_connect_irq(SYS_BUS_DEVICE(s->uart), 0,
aspeed_soc_ast27x0tsp_get_irq(s, s->uart_dev));
+ /* FMC */
+ memory_region_init_alias(&a->fmc_alias, OBJECT(a), "fmc.alias",
+ &a->fmc->mmio, 0,
+ memory_region_size(&a->fmc->mmio));
+ memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_FMC],
+ &a->fmc_alias);
+
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
"aspeed.timerctrl",
sc->memmap[ASPEED_DEV_TIMER1], 0x200);
@@ -270,6 +278,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
static const Property aspeed_27x0_coprocessor_properties[] = {
DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
+ DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
+ AspeedSMCState *),
};
static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 11/21] hw/arm/ast27x0: Share FMC controller with SSP and TSP
2026-04-17 3:28 ` [PATCH v4 11/21] hw/arm/ast27x0: Share FMC controller with SSP and TSP Jamin Lin
@ 2026-06-01 17:18 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:18 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> AST2700 provides a single FMC controller shared by the main CA35 processor
> (PSP) and the SSP/TSP coprocessors.
>
> From the PSP perspective, the FMC controller is memory-mapped at
> 0x14000000–0x140000FF. The SSP and TSP access the same controller through
> a different address window at 0x74000000–0x740000FF.
>
> This change allows the SSP and TSP SoC models to reference the existing
> PSP FMC instance instead of creating independent controllers. An MMIO
> alias is added in the SSP and TSP address spaces to map their FMC access
> window to the shared FMC device.
>
> This ensures consistent FMC state across PSP, SSP, and TSP and matches
> the AST2700 hardware design.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> include/hw/arm/aspeed_coprocessor.h | 2 ++
> hw/arm/aspeed_ast27x0-fc.c | 4 ++++
> hw/arm/aspeed_ast27x0-ssp.c | 10 ++++++++++
> hw/arm/aspeed_ast27x0-tsp.c | 10 ++++++++++
> 4 files changed, 26 insertions(+)
>
> diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
> index 4db995d251..2460a11401 100644
> --- a/include/hw/arm/aspeed_coprocessor.h
> +++ b/include/hw/arm/aspeed_coprocessor.h
> @@ -50,7 +50,9 @@ struct Aspeed27x0CoprocessorState {
> ARMv7MState armv7m;
>
> MemoryRegion scu_alias;
> + MemoryRegion fmc_alias;
> Aspeed2700SCUState *scu;
> + AspeedSMCState *fmc;
> };
>
> #define TYPE_ASPEED27X0SSP_COPROCESSOR "aspeed27x0ssp-coprocessor"
> diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
> index 62bd6a0568..56dd86e2c2 100644
> --- a/hw/arm/aspeed_ast27x0-fc.c
> +++ b/hw/arm/aspeed_ast27x0-fc.c
> @@ -161,6 +161,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
> OBJECT(&psp->sram), &error_abort);
> object_property_set_link(OBJECT(&s->ssp), "scu",
> OBJECT(&s->ca35.scu), &error_abort);
I would change ast2700fc_ssp_init() and ast2700fc_tsp_init() to use
a AspeedSoCState argument and not a MachineState. This to reflect
that the AspeedSoCState *needs* to be realized before the coprocessors.
A comment is worth adding.
> + object_property_set_link(OBJECT(&s->ssp), "fmc",
> + OBJECT(&psp->fmc), &error_abort);
> if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
> return false;
> }
> @@ -193,6 +195,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
> OBJECT(&psp->sram), &error_abort);
> object_property_set_link(OBJECT(&s->tsp), "scu",
> OBJECT(&s->ca35.scu), &error_abort);
> + object_property_set_link(OBJECT(&s->tsp), "fmc",
> + OBJECT(&psp->fmc), &error_abort);
> if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
> return false;
> }
> diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
> index 0500c02755..bfd6fe4485 100644
> --- a/hw/arm/aspeed_ast27x0-ssp.c
> +++ b/hw/arm/aspeed_ast27x0-ssp.c
> @@ -26,6 +26,7 @@ static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
> [ASPEED_DEV_TIMER1] = 0x72C10000,
> [ASPEED_DEV_UART4] = 0x72C1A000,
> [ASPEED_DEV_IPC0] = 0x72C1C000,
> + [ASPEED_DEV_FMC] = 0x74000000,
> [ASPEED_DEV_SCUIO] = 0x74C02000,
> [ASPEED_DEV_INTCIO] = 0x74C18000,
> [ASPEED_DEV_UART0] = 0x74C33000,
> @@ -256,6 +257,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> sysbus_connect_irq(SYS_BUS_DEVICE(s->uart), 0,
> aspeed_soc_ast27x0ssp_get_irq(s, s->uart_dev));
Please check that a->fmc is set :
if (!a->fmc) {
error_setg(errp, TYPE_ASPEED27X0SSP_COPROCESSOR ": 'fmc' link not set");
return;
}
>
> + /* FMC */
> + memory_region_init_alias(&a->fmc_alias, OBJECT(a), "fmc.alias",
> + &a->fmc->mmio, 0,
> + memory_region_size(&a->fmc->mmio));
Isn't that too big for 0x14000000–0x140000FF ?
What about the flash contents window ? Is there one in the coprocessor
socs ? Is is unimplemented ?
> + memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_FMC],
> + &a->fmc_alias);
> +
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
> "aspeed.timerctrl",
> sc->memmap[ASPEED_DEV_TIMER1], 0x200);
> @@ -273,6 +281,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> static const Property aspeed_27x0_coprocessor_properties[] = {
> DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
> TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
> + DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
> + AspeedSMCState *),
> };
>
> static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
> diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
> index 4da4741d8a..166dcb14ed 100644
> --- a/hw/arm/aspeed_ast27x0-tsp.c
> +++ b/hw/arm/aspeed_ast27x0-tsp.c
> @@ -26,6 +26,7 @@ static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
> [ASPEED_DEV_TIMER1] = 0x72C10000,
> [ASPEED_DEV_UART4] = 0x72C1A000,
> [ASPEED_DEV_IPC0] = 0x72C1C000,
> + [ASPEED_DEV_FMC] = 0x74000000,
> [ASPEED_DEV_SCUIO] = 0x74C02000,
> [ASPEED_DEV_INTCIO] = 0x74C18000,
> [ASPEED_DEV_UART0] = 0x74C33000,
> @@ -253,6 +254,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> sysbus_connect_irq(SYS_BUS_DEVICE(s->uart), 0,
> aspeed_soc_ast27x0tsp_get_irq(s, s->uart_dev));
>
> + /* FMC */
> + memory_region_init_alias(&a->fmc_alias, OBJECT(a), "fmc.alias",
> + &a->fmc->mmio, 0,
> + memory_region_size(&a->fmc->mmio));
> + memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_FMC],
> + &a->fmc_alias);
> +
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
> "aspeed.timerctrl",
> sc->memmap[ASPEED_DEV_TIMER1], 0x200);
> @@ -270,6 +278,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> static const Property aspeed_27x0_coprocessor_properties[] = {
> DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
> TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
> + DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
> + AspeedSMCState *),
> };
>
> static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 12/21] hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller MMIO regions for SSP/TSP
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (10 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 11/21] hw/arm/ast27x0: Share FMC controller with SSP and TSP Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:19 ` Cédric Le Goater
2026-04-17 3:28 ` [PATCH v4 13/21] hw/arm/aspeed_ast27x0: Add unimplemented OTP controller " Jamin Lin
` (9 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
The AST2700 SSP/TSP firmware accesses Privilege Controller MMIO regions that
are not yet implemented in QEMU.
This change adds unimplemented MMIO devices for the Privilege Controller
blocks and maps them to their corresponding physical addresses in the SSP/TSP
address space. These stub devices allow QEMU to safely handle firmware
accesses and prevent spurious exceptions, while accurately reflecting
the hardware memory map.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/arm/aspeed_coprocessor.h | 1 +
include/hw/arm/aspeed_soc.h | 2 ++
hw/arm/aspeed_ast27x0-ssp.c | 12 ++++++++++++
hw/arm/aspeed_ast27x0-tsp.c | 12 ++++++++++++
4 files changed, 27 insertions(+)
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 2460a11401..084040bbed 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -46,6 +46,7 @@ struct Aspeed27x0CoprocessorState {
AspeedINTCState intc[2];
UnimplementedDeviceState ipc[2];
UnimplementedDeviceState scuio;
+ UnimplementedDeviceState pric[2];
ARMv7MState armv7m;
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index adf2f2898a..d39e4f7553 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -297,6 +297,8 @@ enum {
ASPEED_DEV_IOEXP1_INTCIO,
ASPEED_DEV_IOEXP0_I3C,
ASPEED_DEV_IOEXP1_I3C,
+ ASPEED_DEV_PRIC0,
+ ASPEED_DEV_PRIC1,
};
const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index bfd6fe4485..467fdea9db 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -22,11 +22,13 @@ static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
[ASPEED_DEV_SDRAM] = 0x00000000,
[ASPEED_DEV_SRAM] = 0x70000000,
[ASPEED_DEV_INTC] = 0x72100000,
+ [ASPEED_DEV_PRIC0] = 0x72140000,
[ASPEED_DEV_SCU] = 0x72C02000,
[ASPEED_DEV_TIMER1] = 0x72C10000,
[ASPEED_DEV_UART4] = 0x72C1A000,
[ASPEED_DEV_IPC0] = 0x72C1C000,
[ASPEED_DEV_FMC] = 0x74000000,
+ [ASPEED_DEV_PRIC1] = 0x74100000,
[ASPEED_DEV_SCUIO] = 0x74C02000,
[ASPEED_DEV_INTCIO] = 0x74C18000,
[ASPEED_DEV_UART0] = 0x74C33000,
@@ -142,6 +144,10 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "scuio", &a->scuio,
TYPE_UNIMPLEMENTED_DEVICE);
+ object_initialize_child(obj, "pric0", &a->pric[0],
+ TYPE_UNIMPLEMENTED_DEVICE);
+ object_initialize_child(obj, "pric1", &a->pric[1],
+ TYPE_UNIMPLEMENTED_DEVICE);
}
static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
@@ -276,6 +282,12 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
"aspeed.scuio",
sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
+ aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
+ "aspeed.pric0",
+ sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
+ aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
+ "aspeed.pric1",
+ sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
}
static const Property aspeed_27x0_coprocessor_properties[] = {
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 166dcb14ed..3a90bbec51 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -22,11 +22,13 @@ static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
[ASPEED_DEV_SDRAM] = 0x00000000,
[ASPEED_DEV_SRAM] = 0x70000000,
[ASPEED_DEV_INTC] = 0x72100000,
+ [ASPEED_DEV_PRIC0] = 0x72140000,
[ASPEED_DEV_SCU] = 0x72C02000,
[ASPEED_DEV_TIMER1] = 0x72C10000,
[ASPEED_DEV_UART4] = 0x72C1A000,
[ASPEED_DEV_IPC0] = 0x72C1C000,
[ASPEED_DEV_FMC] = 0x74000000,
+ [ASPEED_DEV_PRIC1] = 0x74100000,
[ASPEED_DEV_SCUIO] = 0x74C02000,
[ASPEED_DEV_INTCIO] = 0x74C18000,
[ASPEED_DEV_UART0] = 0x74C33000,
@@ -142,6 +144,10 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "scuio", &a->scuio,
TYPE_UNIMPLEMENTED_DEVICE);
+ object_initialize_child(obj, "pric0", &a->pric[0],
+ TYPE_UNIMPLEMENTED_DEVICE);
+ object_initialize_child(obj, "pric1", &a->pric[1],
+ TYPE_UNIMPLEMENTED_DEVICE);
}
static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
@@ -273,6 +279,12 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
"aspeed.scuio",
sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
+ aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
+ "aspeed.pric0",
+ sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
+ aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
+ "aspeed.pric1",
+ sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
}
static const Property aspeed_27x0_coprocessor_properties[] = {
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 12/21] hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller MMIO regions for SSP/TSP
2026-04-17 3:28 ` [PATCH v4 12/21] hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller MMIO regions for SSP/TSP Jamin Lin
@ 2026-06-01 17:19 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:19 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> The AST2700 SSP/TSP firmware accesses Privilege Controller MMIO regions that
> are not yet implemented in QEMU.
>
> This change adds unimplemented MMIO devices for the Privilege Controller
> blocks and maps them to their corresponding physical addresses in the SSP/TSP
> address space. These stub devices allow QEMU to safely handle firmware
> accesses and prevent spurious exceptions, while accurately reflecting
> the hardware memory map.
>
> No functional changes.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> include/hw/arm/aspeed_coprocessor.h | 1 +
> include/hw/arm/aspeed_soc.h | 2 ++
> hw/arm/aspeed_ast27x0-ssp.c | 12 ++++++++++++
> hw/arm/aspeed_ast27x0-tsp.c | 12 ++++++++++++
> 4 files changed, 27 insertions(+)
please send first.
Thanks,
C.
>
> diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
> index 2460a11401..084040bbed 100644
> --- a/include/hw/arm/aspeed_coprocessor.h
> +++ b/include/hw/arm/aspeed_coprocessor.h
> @@ -46,6 +46,7 @@ struct Aspeed27x0CoprocessorState {
> AspeedINTCState intc[2];
> UnimplementedDeviceState ipc[2];
> UnimplementedDeviceState scuio;
> + UnimplementedDeviceState pric[2];
>
> ARMv7MState armv7m;
>
> diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
> index adf2f2898a..d39e4f7553 100644
> --- a/include/hw/arm/aspeed_soc.h
> +++ b/include/hw/arm/aspeed_soc.h
> @@ -297,6 +297,8 @@ enum {
> ASPEED_DEV_IOEXP1_INTCIO,
> ASPEED_DEV_IOEXP0_I3C,
> ASPEED_DEV_IOEXP1_I3C,
> + ASPEED_DEV_PRIC0,
> + ASPEED_DEV_PRIC1,
> };
>
> const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
> diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
> index bfd6fe4485..467fdea9db 100644
> --- a/hw/arm/aspeed_ast27x0-ssp.c
> +++ b/hw/arm/aspeed_ast27x0-ssp.c
> @@ -22,11 +22,13 @@ static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
> [ASPEED_DEV_SDRAM] = 0x00000000,
> [ASPEED_DEV_SRAM] = 0x70000000,
> [ASPEED_DEV_INTC] = 0x72100000,
> + [ASPEED_DEV_PRIC0] = 0x72140000,
> [ASPEED_DEV_SCU] = 0x72C02000,
> [ASPEED_DEV_TIMER1] = 0x72C10000,
> [ASPEED_DEV_UART4] = 0x72C1A000,
> [ASPEED_DEV_IPC0] = 0x72C1C000,
> [ASPEED_DEV_FMC] = 0x74000000,
> + [ASPEED_DEV_PRIC1] = 0x74100000,
> [ASPEED_DEV_SCUIO] = 0x74C02000,
> [ASPEED_DEV_INTCIO] = 0x74C18000,
> [ASPEED_DEV_UART0] = 0x74C33000,
> @@ -142,6 +144,10 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "scuio", &a->scuio,
> TYPE_UNIMPLEMENTED_DEVICE);
> + object_initialize_child(obj, "pric0", &a->pric[0],
> + TYPE_UNIMPLEMENTED_DEVICE);
> + object_initialize_child(obj, "pric1", &a->pric[1],
> + TYPE_UNIMPLEMENTED_DEVICE);
> }
>
> static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> @@ -276,6 +282,12 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
> "aspeed.scuio",
> sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
> + aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
> + "aspeed.pric0",
> + sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
> + aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
> + "aspeed.pric1",
> + sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
> }
>
> static const Property aspeed_27x0_coprocessor_properties[] = {
> diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
> index 166dcb14ed..3a90bbec51 100644
> --- a/hw/arm/aspeed_ast27x0-tsp.c
> +++ b/hw/arm/aspeed_ast27x0-tsp.c
> @@ -22,11 +22,13 @@ static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
> [ASPEED_DEV_SDRAM] = 0x00000000,
> [ASPEED_DEV_SRAM] = 0x70000000,
> [ASPEED_DEV_INTC] = 0x72100000,
> + [ASPEED_DEV_PRIC0] = 0x72140000,
> [ASPEED_DEV_SCU] = 0x72C02000,
> [ASPEED_DEV_TIMER1] = 0x72C10000,
> [ASPEED_DEV_UART4] = 0x72C1A000,
> [ASPEED_DEV_IPC0] = 0x72C1C000,
> [ASPEED_DEV_FMC] = 0x74000000,
> + [ASPEED_DEV_PRIC1] = 0x74100000,
> [ASPEED_DEV_SCUIO] = 0x74C02000,
> [ASPEED_DEV_INTCIO] = 0x74C18000,
> [ASPEED_DEV_UART0] = 0x74C33000,
> @@ -142,6 +144,10 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "scuio", &a->scuio,
> TYPE_UNIMPLEMENTED_DEVICE);
> + object_initialize_child(obj, "pric0", &a->pric[0],
> + TYPE_UNIMPLEMENTED_DEVICE);
> + object_initialize_child(obj, "pric1", &a->pric[1],
> + TYPE_UNIMPLEMENTED_DEVICE);
> }
>
> static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> @@ -273,6 +279,12 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
> "aspeed.scuio",
> sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
> + aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
> + "aspeed.pric0",
> + sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
> + aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
> + "aspeed.pric1",
> + sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
> }
>
> static const Property aspeed_27x0_coprocessor_properties[] = {
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 13/21] hw/arm/aspeed_ast27x0: Add unimplemented OTP controller MMIO regions for SSP/TSP
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (11 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 12/21] hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller MMIO regions for SSP/TSP Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:19 ` Cédric Le Goater
2026-04-17 3:28 ` [PATCH v4 14/21] hw/block/m25p80: Implement volatile status register write enable for Winbond Jamin Lin
` (8 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
The AST2700 SSP/TSP firmware accesses OTP MMIO regions that
are not yet implemented in QEMU.
This change adds unimplemented MMIO devices for the OTP and maps them to
their corresponding physical addresses in the SSP/TSP address space.
These stub devices allow QEMU to safely handle firmware
accesses and prevent spurious exceptions, while accurately reflecting
the hardware memory map.
No functional changes.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/arm/aspeed_coprocessor.h | 1 +
include/hw/arm/aspeed_soc.h | 1 +
hw/arm/aspeed_ast27x0-ssp.c | 6 ++++++
hw/arm/aspeed_ast27x0-tsp.c | 6 ++++++
4 files changed, 14 insertions(+)
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 084040bbed..7750569eed 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -47,6 +47,7 @@ struct Aspeed27x0CoprocessorState {
UnimplementedDeviceState ipc[2];
UnimplementedDeviceState scuio;
UnimplementedDeviceState pric[2];
+ UnimplementedDeviceState otp;
ARMv7MState armv7m;
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index d39e4f7553..1df847b34d 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -299,6 +299,7 @@ enum {
ASPEED_DEV_IOEXP1_I3C,
ASPEED_DEV_PRIC0,
ASPEED_DEV_PRIC1,
+ ASPEED_DEV_OTP,
};
const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 467fdea9db..78bd6f342c 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -30,6 +30,7 @@ static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
[ASPEED_DEV_FMC] = 0x74000000,
[ASPEED_DEV_PRIC1] = 0x74100000,
[ASPEED_DEV_SCUIO] = 0x74C02000,
+ [ASPEED_DEV_OTP] = 0x74C07000,
[ASPEED_DEV_INTCIO] = 0x74C18000,
[ASPEED_DEV_UART0] = 0x74C33000,
[ASPEED_DEV_UART1] = 0x74C33100,
@@ -148,6 +149,8 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "pric1", &a->pric[1],
TYPE_UNIMPLEMENTED_DEVICE);
+ object_initialize_child(obj, "otp", &a->otp,
+ TYPE_UNIMPLEMENTED_DEVICE);
}
static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
@@ -288,6 +291,9 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
"aspeed.pric1",
sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
+ aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->otp),
+ "aspeed.otp",
+ sc->memmap[ASPEED_DEV_OTP], 0x800);
}
static const Property aspeed_27x0_coprocessor_properties[] = {
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 3a90bbec51..d6448d82f5 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -30,6 +30,7 @@ static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
[ASPEED_DEV_FMC] = 0x74000000,
[ASPEED_DEV_PRIC1] = 0x74100000,
[ASPEED_DEV_SCUIO] = 0x74C02000,
+ [ASPEED_DEV_OTP] = 0x74C07000,
[ASPEED_DEV_INTCIO] = 0x74C18000,
[ASPEED_DEV_UART0] = 0x74C33000,
[ASPEED_DEV_UART1] = 0x74C33100,
@@ -148,6 +149,8 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "pric1", &a->pric[1],
TYPE_UNIMPLEMENTED_DEVICE);
+ object_initialize_child(obj, "otp", &a->otp,
+ TYPE_UNIMPLEMENTED_DEVICE);
}
static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
@@ -285,6 +288,9 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
"aspeed.pric1",
sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
+ aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->otp),
+ "aspeed.otp",
+ sc->memmap[ASPEED_DEV_OTP], 0x800);
}
static const Property aspeed_27x0_coprocessor_properties[] = {
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 13/21] hw/arm/aspeed_ast27x0: Add unimplemented OTP controller MMIO regions for SSP/TSP
2026-04-17 3:28 ` [PATCH v4 13/21] hw/arm/aspeed_ast27x0: Add unimplemented OTP controller " Jamin Lin
@ 2026-06-01 17:19 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:19 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> The AST2700 SSP/TSP firmware accesses OTP MMIO regions that
> are not yet implemented in QEMU.
>
> This change adds unimplemented MMIO devices for the OTP and maps them to
> their corresponding physical addresses in the SSP/TSP address space.
> These stub devices allow QEMU to safely handle firmware
> accesses and prevent spurious exceptions, while accurately reflecting
> the hardware memory map.
>
> No functional changes.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> include/hw/arm/aspeed_coprocessor.h | 1 +
> include/hw/arm/aspeed_soc.h | 1 +
> hw/arm/aspeed_ast27x0-ssp.c | 6 ++++++
> hw/arm/aspeed_ast27x0-tsp.c | 6 ++++++
> 4 files changed, 14 insertions(+)
please send first.
Thanks,
C.
> diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
> index 084040bbed..7750569eed 100644
> --- a/include/hw/arm/aspeed_coprocessor.h
> +++ b/include/hw/arm/aspeed_coprocessor.h
> @@ -47,6 +47,7 @@ struct Aspeed27x0CoprocessorState {
> UnimplementedDeviceState ipc[2];
> UnimplementedDeviceState scuio;
> UnimplementedDeviceState pric[2];
> + UnimplementedDeviceState otp;
>
> ARMv7MState armv7m;
>
> diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
> index d39e4f7553..1df847b34d 100644
> --- a/include/hw/arm/aspeed_soc.h
> +++ b/include/hw/arm/aspeed_soc.h
> @@ -299,6 +299,7 @@ enum {
> ASPEED_DEV_IOEXP1_I3C,
> ASPEED_DEV_PRIC0,
> ASPEED_DEV_PRIC1,
> + ASPEED_DEV_OTP,
> };
>
> const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
> diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
> index 467fdea9db..78bd6f342c 100644
> --- a/hw/arm/aspeed_ast27x0-ssp.c
> +++ b/hw/arm/aspeed_ast27x0-ssp.c
> @@ -30,6 +30,7 @@ static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
> [ASPEED_DEV_FMC] = 0x74000000,
> [ASPEED_DEV_PRIC1] = 0x74100000,
> [ASPEED_DEV_SCUIO] = 0x74C02000,
> + [ASPEED_DEV_OTP] = 0x74C07000,
> [ASPEED_DEV_INTCIO] = 0x74C18000,
> [ASPEED_DEV_UART0] = 0x74C33000,
> [ASPEED_DEV_UART1] = 0x74C33100,
> @@ -148,6 +149,8 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "pric1", &a->pric[1],
> TYPE_UNIMPLEMENTED_DEVICE);
> + object_initialize_child(obj, "otp", &a->otp,
> + TYPE_UNIMPLEMENTED_DEVICE);
> }
>
> static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> @@ -288,6 +291,9 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
> "aspeed.pric1",
> sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
> + aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->otp),
> + "aspeed.otp",
> + sc->memmap[ASPEED_DEV_OTP], 0x800);
> }
>
> static const Property aspeed_27x0_coprocessor_properties[] = {
> diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
> index 3a90bbec51..d6448d82f5 100644
> --- a/hw/arm/aspeed_ast27x0-tsp.c
> +++ b/hw/arm/aspeed_ast27x0-tsp.c
> @@ -30,6 +30,7 @@ static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
> [ASPEED_DEV_FMC] = 0x74000000,
> [ASPEED_DEV_PRIC1] = 0x74100000,
> [ASPEED_DEV_SCUIO] = 0x74C02000,
> + [ASPEED_DEV_OTP] = 0x74C07000,
> [ASPEED_DEV_INTCIO] = 0x74C18000,
> [ASPEED_DEV_UART0] = 0x74C33000,
> [ASPEED_DEV_UART1] = 0x74C33100,
> @@ -148,6 +149,8 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "pric1", &a->pric[1],
> TYPE_UNIMPLEMENTED_DEVICE);
> + object_initialize_child(obj, "otp", &a->otp,
> + TYPE_UNIMPLEMENTED_DEVICE);
> }
>
> static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> @@ -285,6 +288,9 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[1]),
> "aspeed.pric1",
> sc->memmap[ASPEED_DEV_PRIC1], 0x1000);
> + aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->otp),
> + "aspeed.otp",
> + sc->memmap[ASPEED_DEV_OTP], 0x800);
> }
>
> static const Property aspeed_27x0_coprocessor_properties[] = {
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 14/21] hw/block/m25p80: Implement volatile status register write enable for Winbond
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (12 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 13/21] hw/arm/aspeed_ast27x0: Add unimplemented OTP controller " Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:31 ` Cédric Le Goater
2026-04-17 3:28 ` [PATCH v4 15/21] hw/ssi/aspeed_smc: Add Data FIFO-based flash access support for AST2700 Jamin Lin
` (7 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
Winbond SPI NOR flashes require the Volatile Status Register Write Enable
(VSR WREN, opcode 0x50) command to be issued before updating volatile
status register bits, such as those accessed via the WRSR2 command.
Currently, WRSR2 handling only checks the standard write enable latch,
which does not fully model Winbond hardware behavior.
Add support for the volatile write enable mechanism by introducing a
separate volatile_write_enable flag. For Winbond devices, WRSR2 writes
that update volatile status register bits are gated by the VSR WREN
command. If the volatile write enable latch is not set, such writes are
rejected.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/block/m25p80.c | 36 ++++++++++++++++++++++++++++++++----
1 file changed, 32 insertions(+), 4 deletions(-)
diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index b8a2543c0b..5bb8b8efa9 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -438,6 +438,11 @@ typedef enum {
*/
WRSR2 = 0x31,
+ /*
+ * Winbond: 0x50 - Write Enable for Volatile Status Register
+ */
+ VSR_WREN = 0x50,
+
RNVCR = 0xB5,
WNVCR = 0xB1,
@@ -510,6 +515,7 @@ struct Flash {
uint8_t spansion_cr4v;
bool wp_level;
bool write_enable;
+ bool volatile_write_enable;
bool four_bytes_address_mode;
bool reset_enable;
bool quad_enable;
@@ -897,6 +903,7 @@ static void reset_memory(Flash *s)
s->pos = 0;
s->state = STATE_IDLE;
s->write_enable = false;
+ s->volatile_write_enable = false;
s->reset_enable = false;
s->quad_enable = false;
s->aai_enable = false;
@@ -1305,8 +1312,7 @@ static void decode_new_cmd(Flash *s, uint32_t value)
* combinations of the two states are called "software protected mode"
* (SPM), and status register writes are permitted.
*/
- if ((s->wp_level == 0 && s->status_register_write_disabled)
- || !s->write_enable) {
+ if (s->wp_level == 0 && s->status_register_write_disabled) {
qemu_log_mask(LOG_GUEST_ERROR,
"M25P80: Status register 2 write is disabled!\n");
break;
@@ -1314,6 +1320,17 @@ static void decode_new_cmd(Flash *s, uint32_t value)
switch (get_man(s)) {
case MAN_WINBOND:
+ /*
+ * Winbond requires VSR WREN (0x50) prior to updating volatile
+ * status register bits. VSR WREN does not set WEL.
+ *
+ * Accept either standard WEL (0x06) or VSR WREN (0x50).
+ */
+ if (!s->write_enable && !s->volatile_write_enable) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "M25P80: Status register 2 write is disabled!\n");
+ break;
+ }
s->needed_bytes = 1;
s->state = STATE_COLLECTING_DATA;
s->pos = 0;
@@ -1332,6 +1349,16 @@ static void decode_new_cmd(Flash *s, uint32_t value)
s->write_enable = true;
break;
+ case VSR_WREN:
+ switch (get_man(s)) {
+ case MAN_WINBOND:
+ s->volatile_write_enable = true;
+ break;
+ default:
+ break;
+ }
+ break;
+
case RDSR:
s->data[0] = (!!s->write_enable) << 1;
s->data[0] |= (!!s->status_register_write_disabled) << 7;
@@ -1824,8 +1851,8 @@ static const VMStateDescription vmstate_m25p80_block_protect = {
static const VMStateDescription vmstate_m25p80 = {
.name = "m25p80",
- .version_id = 0,
- .minimum_version_id = 0,
+ .version_id = 1,
+ .minimum_version_id = 1,
.pre_save = m25p80_pre_save,
.pre_load = m25p80_pre_load,
.fields = (const VMStateField[]) {
@@ -1837,6 +1864,7 @@ static const VMStateDescription vmstate_m25p80 = {
VMSTATE_UINT8(cmd_in_progress, Flash),
VMSTATE_UINT32(cur_addr, Flash),
VMSTATE_BOOL(write_enable, Flash),
+ VMSTATE_BOOL(volatile_write_enable, Flash),
VMSTATE_BOOL(reset_enable, Flash),
VMSTATE_UINT8(ear, Flash),
VMSTATE_BOOL(four_bytes_address_mode, Flash),
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 14/21] hw/block/m25p80: Implement volatile status register write enable for Winbond
2026-04-17 3:28 ` [PATCH v4 14/21] hw/block/m25p80: Implement volatile status register write enable for Winbond Jamin Lin
@ 2026-06-01 17:31 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:31 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> Winbond SPI NOR flashes require the Volatile Status Register Write Enable
> (VSR WREN, opcode 0x50) command to be issued before updating volatile
> status register bits, such as those accessed via the WRSR2 command.
>
> Currently, WRSR2 handling only checks the standard write enable latch,
> which does not fully model Winbond hardware behavior.
>
> Add support for the volatile write enable mechanism by introducing a
> separate volatile_write_enable flag. For Winbond devices, WRSR2 writes
> that update volatile status register bits are gated by the VSR WREN
> command. If the volatile write enable latch is not set, such writes are
> rejected.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Please send independently.
> ---
> hw/block/m25p80.c | 36 ++++++++++++++++++++++++++++++++----
> 1 file changed, 32 insertions(+), 4 deletions(-)
>
> diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
> index b8a2543c0b..5bb8b8efa9 100644
> --- a/hw/block/m25p80.c
> +++ b/hw/block/m25p80.c
> @@ -438,6 +438,11 @@ typedef enum {
> */
> WRSR2 = 0x31,
>
> + /*
> + * Winbond: 0x50 - Write Enable for Volatile Status Register
> + */
> + VSR_WREN = 0x50,
> +
> RNVCR = 0xB5,
> WNVCR = 0xB1,
>
> @@ -510,6 +515,7 @@ struct Flash {
> uint8_t spansion_cr4v;
> bool wp_level;
> bool write_enable;
> + bool volatile_write_enable;
> bool four_bytes_address_mode;
> bool reset_enable;
> bool quad_enable;
> @@ -897,6 +903,7 @@ static void reset_memory(Flash *s)
> s->pos = 0;
> s->state = STATE_IDLE;
> s->write_enable = false;
> + s->volatile_write_enable = false;
> s->reset_enable = false;
> s->quad_enable = false;
> s->aai_enable = false;
> @@ -1305,8 +1312,7 @@ static void decode_new_cmd(Flash *s, uint32_t value)
> * combinations of the two states are called "software protected mode"
> * (SPM), and status register writes are permitted.
> */
> - if ((s->wp_level == 0 && s->status_register_write_disabled)
> - || !s->write_enable) {
> + if (s->wp_level == 0 && s->status_register_write_disabled) {
> qemu_log_mask(LOG_GUEST_ERROR,
> "M25P80: Status register 2 write is disabled!\n");
> break;
> @@ -1314,6 +1320,17 @@ static void decode_new_cmd(Flash *s, uint32_t value)
>
> switch (get_man(s)) {
> case MAN_WINBOND:
> + /*
> + * Winbond requires VSR WREN (0x50) prior to updating volatile
> + * status register bits. VSR WREN does not set WEL.
> + *
> + * Accept either standard WEL (0x06) or VSR WREN (0x50).
> + */
> + if (!s->write_enable && !s->volatile_write_enable) {
> + qemu_log_mask(LOG_GUEST_ERROR,
> + "M25P80: Status register 2 write is disabled!\n");
> + break;
> + }
> s->needed_bytes = 1;
> s->state = STATE_COLLECTING_DATA;
> s->pos = 0;
> @@ -1332,6 +1349,16 @@ static void decode_new_cmd(Flash *s, uint32_t value)
> s->write_enable = true;
> break;
>
> + case VSR_WREN:
> + switch (get_man(s)) {
> + case MAN_WINBOND:
> + s->volatile_write_enable = true;
> + break;
> + default:
> + break;
> + }
> + break;
> +
> case RDSR:
> s->data[0] = (!!s->write_enable) << 1;
> s->data[0] |= (!!s->status_register_write_disabled) << 7;
> @@ -1824,8 +1851,8 @@ static const VMStateDescription vmstate_m25p80_block_protect = {
>
> static const VMStateDescription vmstate_m25p80 = {
> .name = "m25p80",
> - .version_id = 0,
> - .minimum_version_id = 0,
> + .version_id = 1,
> + .minimum_version_id = 1,
> .pre_save = m25p80_pre_save,
> .pre_load = m25p80_pre_load,
> .fields = (const VMStateField[]) {
> @@ -1837,6 +1864,7 @@ static const VMStateDescription vmstate_m25p80 = {
> VMSTATE_UINT8(cmd_in_progress, Flash),
> VMSTATE_UINT32(cur_addr, Flash),
> VMSTATE_BOOL(write_enable, Flash),
> + VMSTATE_BOOL(volatile_write_enable, Flash),
> VMSTATE_BOOL(reset_enable, Flash),
> VMSTATE_UINT8(ear, Flash),
> VMSTATE_BOOL(four_bytes_address_mode, Flash),
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 15/21] hw/ssi/aspeed_smc: Add Data FIFO-based flash access support for AST2700
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (13 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 14/21] hw/block/m25p80: Implement volatile status register write enable for Winbond Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-04-17 3:28 ` [PATCH v4 16/21] hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700 SCU/SCUIO Jamin Lin
` (6 subsequent siblings)
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
AST2700 supports a Data FIFO mode where flash accesses can be performed
directly through Data FIFO MMIO offsets. The Data FIFO start offset
increments by one for every 16MB of flash address space, allowing the
chip select (CS) to be decoded from the Data FIFO offset.
This change adds Data FIFO support to the Aspeed SMC model and introduces
a class callback to translate Data FIFO offsets into CS indices. For
AST2700, the Data FIFO offset is matched against the segment start address
of each CS to determine the target flash device.
The SMC register region size (nregs) is also extended dynamically
based on the number of supported chip selects to cover all possible
Data FIFO regions.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/ssi/aspeed_smc.h | 3 +-
hw/ssi/aspeed_smc.c | 113 +++++++++++++++++++++++++++++++++---
2 files changed, 107 insertions(+), 9 deletions(-)
diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
index 76831422c6..640efade94 100644
--- a/include/hw/ssi/aspeed_smc.h
+++ b/include/hw/ssi/aspeed_smc.h
@@ -47,7 +47,7 @@ struct AspeedSMCFlash {
#define TYPE_ASPEED_SMC "aspeed.smc"
OBJECT_DECLARE_TYPE(AspeedSMCState, AspeedSMCClass, ASPEED_SMC)
-#define ASPEED_SMC_R_MAX (0x100 / 4)
+#define ASPEED_SMC_R_MAX (0x300 / 4)
#define ASPEED_SMC_CS_MAX 5
struct AspeedSMCState {
@@ -116,6 +116,7 @@ struct AspeedSMCClass {
AspeedSegments *seg);
void (*dma_ctrl)(AspeedSMCState *s, uint32_t value);
int (*addr_width)(const AspeedSMCState *s);
+ int (*data_fifo_offset_to_cs)(const AspeedSMCState *s, uint32_t offset);
const MemoryRegionOps *reg_ops;
};
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index f0deeea996..186446c1ec 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -163,6 +163,9 @@
/* Read Timing Compensation Register */
#define R_TIMINGS (0x94 / 4)
+/* Data fifo */
+#define R_DATA_FIFO (0x200 / 4)
+
/* SPI controller registers and bits (AST2400) */
#define R_SPI_CONF (0x00 / 4)
#define SPI_CONF_ENABLE_W0 0
@@ -212,6 +215,7 @@ static const AspeedSegments aspeed_2500_spi2_segments[];
#define ASPEED_SMC_FEATURE_DMA_GRANT 0x2
#define ASPEED_SMC_FEATURE_WDT_CONTROL 0x4
#define ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH 0x08
+#define ASPEED_SMC_FEATURE_DATA_FIFO 0x10
static inline bool aspeed_smc_has_dma(const AspeedSMCClass *asc)
{
@@ -228,6 +232,11 @@ static inline bool aspeed_smc_has_dma64(const AspeedSMCClass *asc)
return !!(asc->features & ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH);
}
+static inline bool aspeed_smc_has_data_fifo(const AspeedSMCClass *asc)
+{
+ return !!(asc->features & ASPEED_SMC_FEATURE_DATA_FIFO);
+}
+
#define aspeed_smc_error(fmt, ...) \
qemu_log_mask(LOG_GUEST_ERROR, "%s: " fmt "\n", __func__, ## __VA_ARGS__)
@@ -764,6 +773,7 @@ static MemTxResult aspeed_smc_read(void *opaque, hwaddr addr, uint64_t *data,
{
AspeedSMCState *s = ASPEED_SMC(opaque);
AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(opaque);
+ int cs;
addr >>= 2;
@@ -789,6 +799,18 @@ static MemTxResult aspeed_smc_read(void *opaque, hwaddr addr, uint64_t *data,
trace_aspeed_smc_read(addr << 2, size, s->regs[addr]);
*data = s->regs[addr];
+ } else if (aspeed_smc_has_data_fifo(asc) && addr >= R_DATA_FIFO) {
+ cs = asc->data_fifo_offset_to_cs(s, addr << 2);
+ if (cs >= 0) {
+ /*
+ * Data fifo mode only supports SPI user mode.
+ * The flash address is provided by the SPI command/address cycles,
+ * the MMIO addr parameter is ignored.
+ */
+ return aspeed_smc_flash_read(&s->flashes[cs], 0, data, size, attrs);
+ }
+ aspeed_smc_error("Invalid data fifo offset %" HWADDR_PRIx, addr << 2);
+ return MEMTX_ERROR;
} else {
qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
__func__, addr);
@@ -1163,6 +1185,19 @@ static MemTxResult aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
} else if (aspeed_smc_has_dma(asc) && aspeed_smc_has_dma64(asc) &&
addr == R_DMA_DRAM_ADDR_HIGH) {
s->regs[addr] = DMA_DRAM_ADDR_HIGH(value);
+ } else if (aspeed_smc_has_data_fifo(asc) && addr >= R_DATA_FIFO) {
+ int cs = asc->data_fifo_offset_to_cs(s, addr << 2);
+ if (cs >= 0) {
+ /*
+ * Data fifo mode only supports SPI user mode.
+ * The flash address is provided by the SPI command/address cycles,
+ * the MMIO addr parameter is ignored.
+ */
+ return aspeed_smc_flash_write(&s->flashes[cs], 0, data, size,
+ attrs);
+ }
+ aspeed_smc_error("Invalid data fifo offset %" HWADDR_PRIx, addr << 2);
+ return MEMTX_ERROR;
} else {
qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
__func__, addr);
@@ -1996,6 +2031,39 @@ static void aspeed_2700_smc_reg_to_segment(const AspeedSMCState *s,
}
}
+/*
+ * Convert a data fifo offset to a chip select (CS).
+ *
+ * Data fifo access starts at 0x200. The data fifo offset index is
+ * calculated by subtracting the data fifo base offset from the MMIO address.
+ *
+ * The data fifo offset index increments by 1 for every 16MB of flash address
+ * space. Each offset step therefore represents a 16MB address decode range.
+ *
+ * The CS is determined by matching the data fifo offset index against the
+ * segment start address of each CS.
+ *
+ * Returns the CS index on success, or -1 if the offset is invalid.
+ */
+static int aspeed_2700_smc_data_fifo_offset_to_cs(const AspeedSMCState *s,
+ uint32_t offset)
+{
+ AspeedSMCClass *asc = ASPEED_SMC_GET_CLASS(s);
+ uint32_t start_offset;
+ uint32_t fifo_offset;
+ int i;
+
+ for (i = 0; i < asc->cs_num_max; i++) {
+ start_offset = (s->regs[R_SEG_ADDR0 + i] & 0x0000ffff) << 16;
+ fifo_offset = start_offset / 0x1000000;
+ if (fifo_offset == offset - (R_DATA_FIFO << 2)) {
+ return i;
+ }
+ }
+
+ return -1;
+}
+
static const uint32_t aspeed_2700_fmc_resets[ASPEED_SMC_R_MAX] = {
[R_CONF] = (CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE0 |
CONF_FLASH_TYPE_SPI << CONF_FLASH_TYPE1),
@@ -2030,6 +2098,27 @@ static const AspeedSegments aspeed_2700_fmc_segments[] = {
{ 0x0, 0 }, /* disabled */
};
+/*
+ * AST2700 supports data fifo mode with a base data fifo start offset of 0x200.
+ *
+ * The data fifo start offset increments by 1 for every 16MB of flash address
+ * space. Each offset step therefore represents a 16MB address decode range.
+ *
+ * Assuming each chip select (CS) can use the maximum flash size of 256MB:
+ * 256MB / 16MB = 0x10 offset steps per CS.
+ *
+ * Data fifo start offset for CSn:
+ * 0x200 + (n * 0x10)
+ *
+ * Examples:
+ * CS0: 0x200
+ * CS1: 0x210
+ * CS2: 0x220
+ * CS3: 0x230
+ *
+ * asc->nregs should be set to: 0x200 + (asc->cs_num_max * 0x10)
+ * to cover all possible data fifo regions.
+ */
static void aspeed_2700_fmc_class_init(ObjectClass *klass, const void *data)
{
DeviceClass *dc = DEVICE_CLASS(klass);
@@ -2049,14 +2138,16 @@ static void aspeed_2700_fmc_class_init(ObjectClass *klass, const void *data)
asc->flash_window_base = 0x100000000;
asc->flash_window_size = 1 * GiB;
asc->features = ASPEED_SMC_FEATURE_DMA |
- ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+ ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
+ ASPEED_SMC_FEATURE_DATA_FIFO;
asc->dma_flash_mask = 0x2FFFFFFC;
asc->dma_dram_mask = 0xFFFFFFFC;
asc->dma_start_length = 1;
- asc->nregs = ASPEED_SMC_R_MAX;
+ asc->nregs = 0x200 + (asc->cs_num_max * 0x10);
asc->segment_to_reg = aspeed_2700_smc_segment_to_reg;
asc->reg_to_segment = aspeed_2700_smc_reg_to_segment;
asc->dma_ctrl = aspeed_2600_smc_dma_ctrl;
+ asc->data_fifo_offset_to_cs = aspeed_2700_smc_data_fifo_offset_to_cs;
asc->reg_ops = &aspeed_2700_smc_flash_ops;
}
@@ -2090,14 +2181,16 @@ static void aspeed_2700_spi0_class_init(ObjectClass *klass, const void *data)
asc->flash_window_base = 0x180000000;
asc->flash_window_size = 1 * GiB;
asc->features = ASPEED_SMC_FEATURE_DMA |
- ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+ ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
+ ASPEED_SMC_FEATURE_DATA_FIFO;
asc->dma_flash_mask = 0x2FFFFFFC;
asc->dma_dram_mask = 0xFFFFFFFC;
asc->dma_start_length = 1;
- asc->nregs = ASPEED_SMC_R_MAX;
+ asc->nregs = 0x200 + (asc->cs_num_max * 0x10);
asc->segment_to_reg = aspeed_2700_smc_segment_to_reg;
asc->reg_to_segment = aspeed_2700_smc_reg_to_segment;
asc->dma_ctrl = aspeed_2600_smc_dma_ctrl;
+ asc->data_fifo_offset_to_cs = aspeed_2700_smc_data_fifo_offset_to_cs;
asc->reg_ops = &aspeed_2700_smc_flash_ops;
}
@@ -2130,14 +2223,16 @@ static void aspeed_2700_spi1_class_init(ObjectClass *klass, const void *data)
asc->flash_window_base = 0x200000000;
asc->flash_window_size = 1 * GiB;
asc->features = ASPEED_SMC_FEATURE_DMA |
- ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+ ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
+ ASPEED_SMC_FEATURE_DATA_FIFO;
asc->dma_flash_mask = 0x2FFFFFFC;
asc->dma_dram_mask = 0xFFFFFFFC;
asc->dma_start_length = 1;
- asc->nregs = ASPEED_SMC_R_MAX;
+ asc->nregs = 0x200 + (asc->cs_num_max * 0x10);
asc->segment_to_reg = aspeed_2700_smc_segment_to_reg;
asc->reg_to_segment = aspeed_2700_smc_reg_to_segment;
asc->dma_ctrl = aspeed_2600_smc_dma_ctrl;
+ asc->data_fifo_offset_to_cs = aspeed_2700_smc_data_fifo_offset_to_cs;
asc->reg_ops = &aspeed_2700_smc_flash_ops;
}
@@ -2170,14 +2265,16 @@ static void aspeed_2700_spi2_class_init(ObjectClass *klass, const void *data)
asc->flash_window_base = 0x280000000;
asc->flash_window_size = 1 * GiB;
asc->features = ASPEED_SMC_FEATURE_DMA |
- ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH;
+ ASPEED_SMC_FEATURE_DMA_DRAM_ADDR_HIGH |
+ ASPEED_SMC_FEATURE_DATA_FIFO;
asc->dma_flash_mask = 0x0FFFFFFC;
asc->dma_dram_mask = 0xFFFFFFFC;
asc->dma_start_length = 1;
- asc->nregs = ASPEED_SMC_R_MAX;
+ asc->nregs = 0x200 + (asc->cs_num_max * 0x10);
asc->segment_to_reg = aspeed_2700_smc_segment_to_reg;
asc->reg_to_segment = aspeed_2700_smc_reg_to_segment;
asc->dma_ctrl = aspeed_2600_smc_dma_ctrl;
+ asc->data_fifo_offset_to_cs = aspeed_2700_smc_data_fifo_offset_to_cs;
asc->reg_ops = &aspeed_2700_smc_flash_ops;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 16/21] hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700 SCU/SCUIO
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (14 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 15/21] hw/ssi/aspeed_smc: Add Data FIFO-based flash access support for AST2700 Jamin Lin
@ 2026-04-17 3:28 ` Jamin Lin
2026-06-01 17:20 ` Cédric Le Goater
2026-04-17 3:29 ` [PATCH v4 17/21] hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data registers Jamin Lin
` (5 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:28 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
The AST2700 SCU/SCUIO read handlers currently emit LOG_GUEST_ERROR
messages for all registers that are not explicitly handled.
However, most SCU registers are simple read-back registers without
side effects, and do not require explicit handling in the read path.
Returning the stored register value is sufficient.
Emitting "Unhandled read" logs for these cases generates excessive
and misleading noise during normal guest operation, making it harder
to spot real issues.
Remove the default unhandled read logging from the SCU and SCUIO read
handlers to reduce log noise and align with common QEMU device model
behavior for passive registers.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 14 --------------
1 file changed, 14 deletions(-)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 251c23def0..362733ba11 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -932,13 +932,6 @@ static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
return 0;
}
- switch (reg) {
- default:
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: Unhandled read at offset 0x%" HWADDR_PRIx "\n",
- __func__, offset);
- }
-
trace_aspeed_ast2700_scu_read(offset, size, s->regs[reg]);
return s->regs[reg];
}
@@ -1264,13 +1257,6 @@ static uint64_t aspeed_ast2700_scuio_read(void *opaque, hwaddr offset,
return 0;
}
- switch (reg) {
- default:
- qemu_log_mask(LOG_GUEST_ERROR,
- "%s: Unhandled read at offset 0x%" HWADDR_PRIx "\n",
- __func__, offset);
- }
-
trace_aspeed_ast2700_scuio_read(offset, size, s->regs[reg]);
return s->regs[reg];
}
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 16/21] hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700 SCU/SCUIO
2026-04-17 3:28 ` [PATCH v4 16/21] hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700 SCU/SCUIO Jamin Lin
@ 2026-06-01 17:20 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:20 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:28, Jamin Lin wrote:
> The AST2700 SCU/SCUIO read handlers currently emit LOG_GUEST_ERROR
> messages for all registers that are not explicitly handled.
>
> However, most SCU registers are simple read-back registers without
> side effects, and do not require explicit handling in the read path.
> Returning the stored register value is sufficient.
>
> Emitting "Unhandled read" logs for these cases generates excessive
> and misleading noise during normal guest operation, making it harder
> to spot real issues.
>
> Remove the default unhandled read logging from the SCU and SCUIO read
> handlers to reduce log noise and align with common QEMU device model
> behavior for passive registers.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
please send first.
Thanks,
C.
> ---
> hw/misc/aspeed_scu.c | 14 --------------
> 1 file changed, 14 deletions(-)
>
> diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
> index 251c23def0..362733ba11 100644
> --- a/hw/misc/aspeed_scu.c
> +++ b/hw/misc/aspeed_scu.c
> @@ -932,13 +932,6 @@ static uint64_t aspeed_ast2700_scu_read(void *opaque, hwaddr offset,
> return 0;
> }
>
> - switch (reg) {
> - default:
> - qemu_log_mask(LOG_GUEST_ERROR,
> - "%s: Unhandled read at offset 0x%" HWADDR_PRIx "\n",
> - __func__, offset);
> - }
> -
> trace_aspeed_ast2700_scu_read(offset, size, s->regs[reg]);
> return s->regs[reg];
> }
> @@ -1264,13 +1257,6 @@ static uint64_t aspeed_ast2700_scuio_read(void *opaque, hwaddr offset,
> return 0;
> }
>
> - switch (reg) {
> - default:
> - qemu_log_mask(LOG_GUEST_ERROR,
> - "%s: Unhandled read at offset 0x%" HWADDR_PRIx "\n",
> - __func__, offset);
> - }
> -
> trace_aspeed_ast2700_scuio_read(offset, size, s->regs[reg]);
> return s->regs[reg];
> }
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 17/21] hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data registers
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (15 preceding siblings ...)
2026-04-17 3:28 ` [PATCH v4 16/21] hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700 SCU/SCUIO Jamin Lin
@ 2026-04-17 3:29 ` Jamin Lin
2026-06-01 17:21 ` Cédric Le Goater
2026-04-17 3:29 ` [PATCH v4 18/21] hw/arm/ast27x0: Share single SCUIO instance across PSP, SSP, and TSP Jamin Lin
` (4 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
Implement basic behavior for RNG_CTRL and RNG_DATA:
- RNG_CTRL allows guest to enable/disable the RNG via the DIS bit.
Only bits [0:3] and bit 5 are writable; other bits are masked.
- The VLD bit (bit 31) is updated by the model to reflect the RNG
enable state, and is not writable by the guest.
- When RNG is enabled, reads from RNG_DATA return a newly generated
random value.
- When RNG is disabled, RNG_DATA return 0.
This provides a minimal functional model of the RNG sufficient for
software that expects readable random data without modeling full
hardware behavior.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/misc/aspeed_scu.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index 362733ba11..f9ae65d83c 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -187,6 +187,11 @@
#define AST2700_SCU_CPU_SCRATCH_1 TO_REG(0x784)
#define AST2700_SCU_VGA_SCRATCH_0 TO_REG(0x900)
+#define AST2700_SCUIO_RNG_CTRL TO_REG(0xF0)
+#define AST2700_SCUIO_RNG_CTRL_MASK 0x2F
+#define AST2700_SCUIO_RNG_CTRL_DIS BIT(0)
+#define AST2700_SCUIO_RNG_CTRL_VLD BIT(31)
+#define AST2700_SCUIO_RNG_DATA TO_REG(0xF4)
#define AST2700_SCUIO_CLK_STOP_CTL_1 TO_REG(0x240)
#define AST2700_SCUIO_CLK_STOP_CLR_1 TO_REG(0x244)
#define AST2700_SCUIO_CLK_STOP_CTL_2 TO_REG(0x260)
@@ -1257,6 +1262,14 @@ static uint64_t aspeed_ast2700_scuio_read(void *opaque, hwaddr offset,
return 0;
}
+ switch (reg) {
+ case AST2700_SCUIO_RNG_DATA:
+ if (!(s->regs[AST2700_SCUIO_RNG_CTRL] & AST2700_SCUIO_RNG_CTRL_DIS)) {
+ s->regs[AST2700_SCUIO_RNG_DATA] = aspeed_scu_get_random();
+ }
+ break;
+ }
+
trace_aspeed_ast2700_scuio_read(offset, size, s->regs[reg]);
return s->regs[reg];
}
@@ -1280,6 +1293,18 @@ static void aspeed_ast2700_scuio_write(void *opaque, hwaddr offset,
trace_aspeed_ast2700_scuio_write(offset, size, data);
switch (reg) {
+ case AST2700_SCUIO_RNG_CTRL:
+ data &= AST2700_SCUIO_RNG_CTRL_MASK;
+ if (data & AST2700_SCUIO_RNG_CTRL_DIS) {
+ data &= ~AST2700_SCUIO_RNG_CTRL_VLD;
+ s->regs[AST2700_SCUIO_RNG_DATA] = 0;
+ } else {
+ s->regs[AST2700_SCUIO_RNG_DATA] = aspeed_scu_get_random();
+ data |= AST2700_SCUIO_RNG_CTRL_VLD;
+ }
+ s->regs[reg] = data;
+ updated = true;
+ break;
case AST2700_SCUIO_CLK_STOP_CTL_1:
case AST2700_SCUIO_CLK_STOP_CTL_2:
s->regs[reg] |= data;
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 17/21] hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data registers
2026-04-17 3:29 ` [PATCH v4 17/21] hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data registers Jamin Lin
@ 2026-06-01 17:21 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:21 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:29, Jamin Lin wrote:
> Implement basic behavior for RNG_CTRL and RNG_DATA:
>
> - RNG_CTRL allows guest to enable/disable the RNG via the DIS bit.
> Only bits [0:3] and bit 5 are writable; other bits are masked.
> - The VLD bit (bit 31) is updated by the model to reflect the RNG
> enable state, and is not writable by the guest.
> - When RNG is enabled, reads from RNG_DATA return a newly generated
> random value.
> - When RNG is disabled, RNG_DATA return 0.
>
> This provides a minimal functional model of the RNG sufficient for
> software that expects readable random data without modeling full
> hardware behavior.
please send first.
Thanks,
C.
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> hw/misc/aspeed_scu.c | 25 +++++++++++++++++++++++++
> 1 file changed, 25 insertions(+)
>
> diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
> index 362733ba11..f9ae65d83c 100644
> --- a/hw/misc/aspeed_scu.c
> +++ b/hw/misc/aspeed_scu.c
> @@ -187,6 +187,11 @@
> #define AST2700_SCU_CPU_SCRATCH_1 TO_REG(0x784)
> #define AST2700_SCU_VGA_SCRATCH_0 TO_REG(0x900)
>
> +#define AST2700_SCUIO_RNG_CTRL TO_REG(0xF0)
> +#define AST2700_SCUIO_RNG_CTRL_MASK 0x2F
> +#define AST2700_SCUIO_RNG_CTRL_DIS BIT(0)
> +#define AST2700_SCUIO_RNG_CTRL_VLD BIT(31)
> +#define AST2700_SCUIO_RNG_DATA TO_REG(0xF4)
> #define AST2700_SCUIO_CLK_STOP_CTL_1 TO_REG(0x240)
> #define AST2700_SCUIO_CLK_STOP_CLR_1 TO_REG(0x244)
> #define AST2700_SCUIO_CLK_STOP_CTL_2 TO_REG(0x260)
> @@ -1257,6 +1262,14 @@ static uint64_t aspeed_ast2700_scuio_read(void *opaque, hwaddr offset,
> return 0;
> }
>
> + switch (reg) {
> + case AST2700_SCUIO_RNG_DATA:
> + if (!(s->regs[AST2700_SCUIO_RNG_CTRL] & AST2700_SCUIO_RNG_CTRL_DIS)) {
> + s->regs[AST2700_SCUIO_RNG_DATA] = aspeed_scu_get_random();
> + }
> + break;
> + }
> +
> trace_aspeed_ast2700_scuio_read(offset, size, s->regs[reg]);
> return s->regs[reg];
> }
> @@ -1280,6 +1293,18 @@ static void aspeed_ast2700_scuio_write(void *opaque, hwaddr offset,
> trace_aspeed_ast2700_scuio_write(offset, size, data);
>
> switch (reg) {
> + case AST2700_SCUIO_RNG_CTRL:
> + data &= AST2700_SCUIO_RNG_CTRL_MASK;
> + if (data & AST2700_SCUIO_RNG_CTRL_DIS) {
> + data &= ~AST2700_SCUIO_RNG_CTRL_VLD;
> + s->regs[AST2700_SCUIO_RNG_DATA] = 0;
> + } else {
> + s->regs[AST2700_SCUIO_RNG_DATA] = aspeed_scu_get_random();
> + data |= AST2700_SCUIO_RNG_CTRL_VLD;
> + }
> + s->regs[reg] = data;
> + updated = true;
> + break;
> case AST2700_SCUIO_CLK_STOP_CTL_1:
> case AST2700_SCUIO_CLK_STOP_CTL_2:
> s->regs[reg] |= data;
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 18/21] hw/arm/ast27x0: Share single SCUIO instance across PSP, SSP, and TSP
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (16 preceding siblings ...)
2026-04-17 3:29 ` [PATCH v4 17/21] hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data registers Jamin Lin
@ 2026-04-17 3:29 ` Jamin Lin
2026-06-01 17:23 ` Cédric Le Goater
2026-04-17 3:29 ` [PATCH v4 19/21] hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings Jamin Lin
` (3 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
AST2700 has a single SCUIO hardware block, memory-mapped at
0x14C02000–0x14C03FFF from the perspective of the main CA35 processor (PSP).
The SSP and TSP coprocessors access this same SCUIO block at different
addresses: 0x74C02000–0x74C03FFF.
Previously, each subsystem (PSP, SSP, and TSP) instantiated its own SCUIO
device, resulting in three independent SCUIO instances in the QEMU model.
In real hardware, however, only a single SCUIO exists and is shared among
all processors.
This commit reworks the SCUIO model to correctly reflect the hardware
behavior by allowing SSP and TSP to reference the PSP’s SCUIO instance.
The following changes are introduced:
- Add a scuio property to Aspeed27x0CoprocessorState for linking the
coprocessor to the PSP’s SCUIO instance.
- Replace per-coprocessor SCUIO instantiation with a shared SCUIO link.
- Add "MemoryRegion scuio_alias" to model address remapping for SSP and TSP.
- Create SCUIO alias regions in both SSP and TSP coprocessors and map
them at 0x74C02000 to mirror the PSP’s SCUIO registers.
- Ensure the SCUIO device in PSP is realized before SSP/TSP alias setup.
With this change, PSP, SSP, and TSP now share a consistent SCUIO state,
matching the single-SCUIO hardware design of AST2700.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
include/hw/arm/aspeed_coprocessor.h | 4 ++--
hw/arm/aspeed_ast27x0-fc.c | 4 ++++
hw/arm/aspeed_ast27x0-ssp.c | 14 +++++++++-----
hw/arm/aspeed_ast27x0-tsp.c | 14 +++++++++-----
4 files changed, 24 insertions(+), 12 deletions(-)
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 7750569eed..23c3b97f06 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -22,7 +22,6 @@ struct AspeedCoprocessorState {
MemoryRegion uart_alias;
Clock *sysclk;
- AspeedSCUState scuio;
AspeedTimerCtrlState timerctrl;
SerialMM *uart;
int uart_dev;
@@ -45,15 +44,16 @@ struct Aspeed27x0CoprocessorState {
AspeedCoprocessorState parent;
AspeedINTCState intc[2];
UnimplementedDeviceState ipc[2];
- UnimplementedDeviceState scuio;
UnimplementedDeviceState pric[2];
UnimplementedDeviceState otp;
ARMv7MState armv7m;
MemoryRegion scu_alias;
+ MemoryRegion scuio_alias;
MemoryRegion fmc_alias;
Aspeed2700SCUState *scu;
+ AspeedSCUState *scuio;
AspeedSMCState *fmc;
};
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 56dd86e2c2..d1ff6fbd4d 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -161,6 +161,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
OBJECT(&psp->sram), &error_abort);
object_property_set_link(OBJECT(&s->ssp), "scu",
OBJECT(&s->ca35.scu), &error_abort);
+ object_property_set_link(OBJECT(&s->ssp), "scuio",
+ OBJECT(&psp->scuio), &error_abort);
object_property_set_link(OBJECT(&s->ssp), "fmc",
OBJECT(&psp->fmc), &error_abort);
if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
@@ -195,6 +197,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
OBJECT(&psp->sram), &error_abort);
object_property_set_link(OBJECT(&s->tsp), "scu",
OBJECT(&s->ca35.scu), &error_abort);
+ object_property_set_link(OBJECT(&s->tsp), "scuio",
+ OBJECT(&psp->scuio), &error_abort);
object_property_set_link(OBJECT(&s->tsp), "fmc",
OBJECT(&psp->fmc), &error_abort);
if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 78bd6f342c..6c8945ce6c 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -143,8 +143,6 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "ipc1", &a->ipc[1],
TYPE_UNIMPLEMENTED_DEVICE);
- object_initialize_child(obj, "scuio", &a->scuio,
- TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "pric0", &a->pric[0],
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "pric1", &a->pric[1],
@@ -215,6 +213,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
memory_region_size(&a->scu->dram_remap_alias[1]),
&a->scu->dram_remap_alias[0]);
+ /* SCUIO */
+ memory_region_init_alias(&a->scuio_alias, OBJECT(a), "scuio.alias",
+ &a->scuio->iomem, 0,
+ memory_region_size(&a->scuio->iomem));
+ memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCUIO],
+ &a->scuio_alias);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
@@ -282,9 +287,6 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
"aspeed.ipc1",
sc->memmap[ASPEED_DEV_IPC1], 0x1000);
- aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
- "aspeed.scuio",
- sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
"aspeed.pric0",
sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
@@ -299,6 +301,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
static const Property aspeed_27x0_coprocessor_properties[] = {
DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
+ DEFINE_PROP_LINK("scuio", Aspeed27x0CoprocessorState, scuio,
+ TYPE_ASPEED_SCU, AspeedSCUState *),
DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
AspeedSMCState *),
};
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index d6448d82f5..cab7f47ac8 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -143,8 +143,6 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "ipc1", &a->ipc[1],
TYPE_UNIMPLEMENTED_DEVICE);
- object_initialize_child(obj, "scuio", &a->scuio,
- TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "pric0", &a->pric[0],
TYPE_UNIMPLEMENTED_DEVICE);
object_initialize_child(obj, "pric1", &a->pric[1],
@@ -212,6 +210,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
/* SDRAM remap alias used by PSP to access TSP SDRAM */
memory_region_add_subregion(&s->sdram, 0, &a->scu->dram_remap_alias[2]);
+ /* SCUIO */
+ memory_region_init_alias(&a->scuio_alias, OBJECT(a), "scuio.alias",
+ &a->scuio->iomem, 0,
+ memory_region_size(&a->scuio->iomem));
+ memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCUIO],
+ &a->scuio_alias);
+
/* INTC */
if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
return;
@@ -279,9 +284,6 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
"aspeed.ipc1",
sc->memmap[ASPEED_DEV_IPC1], 0x1000);
- aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
- "aspeed.scuio",
- sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
"aspeed.pric0",
sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
@@ -296,6 +298,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
static const Property aspeed_27x0_coprocessor_properties[] = {
DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
+ DEFINE_PROP_LINK("scuio", Aspeed27x0CoprocessorState, scuio,
+ TYPE_ASPEED_SCU, AspeedSCUState *),
DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
AspeedSMCState *),
};
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 18/21] hw/arm/ast27x0: Share single SCUIO instance across PSP, SSP, and TSP
2026-04-17 3:29 ` [PATCH v4 18/21] hw/arm/ast27x0: Share single SCUIO instance across PSP, SSP, and TSP Jamin Lin
@ 2026-06-01 17:23 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:23 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:29, Jamin Lin wrote:
> AST2700 has a single SCUIO hardware block, memory-mapped at
> 0x14C02000–0x14C03FFF from the perspective of the main CA35 processor (PSP).
> The SSP and TSP coprocessors access this same SCUIO block at different
> addresses: 0x74C02000–0x74C03FFF.
>
> Previously, each subsystem (PSP, SSP, and TSP) instantiated its own SCUIO
> device, resulting in three independent SCUIO instances in the QEMU model.
> In real hardware, however, only a single SCUIO exists and is shared among
> all processors.
>
> This commit reworks the SCUIO model to correctly reflect the hardware
> behavior by allowing SSP and TSP to reference the PSP’s SCUIO instance.
> The following changes are introduced:
>
> - Add a scuio property to Aspeed27x0CoprocessorState for linking the
> coprocessor to the PSP’s SCUIO instance.
> - Replace per-coprocessor SCUIO instantiation with a shared SCUIO link.
> - Add "MemoryRegion scuio_alias" to model address remapping for SSP and TSP.
> - Create SCUIO alias regions in both SSP and TSP coprocessors and map
> them at 0x74C02000 to mirror the PSP’s SCUIO registers.
> - Ensure the SCUIO device in PSP is realized before SSP/TSP alias setup.
>
> With this change, PSP, SSP, and TSP now share a consistent SCUIO state,
> matching the single-SCUIO hardware design of AST2700.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> include/hw/arm/aspeed_coprocessor.h | 4 ++--
> hw/arm/aspeed_ast27x0-fc.c | 4 ++++
> hw/arm/aspeed_ast27x0-ssp.c | 14 +++++++++-----
> hw/arm/aspeed_ast27x0-tsp.c | 14 +++++++++-----
> 4 files changed, 24 insertions(+), 12 deletions(-)
>
> diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
> index 7750569eed..23c3b97f06 100644
> --- a/include/hw/arm/aspeed_coprocessor.h
> +++ b/include/hw/arm/aspeed_coprocessor.h
> @@ -22,7 +22,6 @@ struct AspeedCoprocessorState {
> MemoryRegion uart_alias;
> Clock *sysclk;
>
> - AspeedSCUState scuio;
> AspeedTimerCtrlState timerctrl;
> SerialMM *uart;
> int uart_dev;
> @@ -45,15 +44,16 @@ struct Aspeed27x0CoprocessorState {
> AspeedCoprocessorState parent;
> AspeedINTCState intc[2];
> UnimplementedDeviceState ipc[2];
> - UnimplementedDeviceState scuio;
> UnimplementedDeviceState pric[2];
> UnimplementedDeviceState otp;
>
> ARMv7MState armv7m;
>
> MemoryRegion scu_alias;
> + MemoryRegion scuio_alias;
> MemoryRegion fmc_alias;
> Aspeed2700SCUState *scu;
> + AspeedSCUState *scuio;
> AspeedSMCState *fmc;
> };
>
> diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
> index 56dd86e2c2..d1ff6fbd4d 100644
> --- a/hw/arm/aspeed_ast27x0-fc.c
> +++ b/hw/arm/aspeed_ast27x0-fc.c
> @@ -161,6 +161,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
> OBJECT(&psp->sram), &error_abort);
> object_property_set_link(OBJECT(&s->ssp), "scu",
> OBJECT(&s->ca35.scu), &error_abort);
> + object_property_set_link(OBJECT(&s->ssp), "scuio",
> + OBJECT(&psp->scuio), &error_abort);
> object_property_set_link(OBJECT(&s->ssp), "fmc",
> OBJECT(&psp->fmc), &error_abort);
> if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
> @@ -195,6 +197,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
> OBJECT(&psp->sram), &error_abort);
> object_property_set_link(OBJECT(&s->tsp), "scu",
> OBJECT(&s->ca35.scu), &error_abort);
> + object_property_set_link(OBJECT(&s->tsp), "scuio",
> + OBJECT(&psp->scuio), &error_abort);
> object_property_set_link(OBJECT(&s->tsp), "fmc",
> OBJECT(&psp->fmc), &error_abort);
> if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
> diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
> index 78bd6f342c..6c8945ce6c 100644
> --- a/hw/arm/aspeed_ast27x0-ssp.c
> +++ b/hw/arm/aspeed_ast27x0-ssp.c
> @@ -143,8 +143,6 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "ipc1", &a->ipc[1],
> TYPE_UNIMPLEMENTED_DEVICE);
> - object_initialize_child(obj, "scuio", &a->scuio,
> - TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "pric0", &a->pric[0],
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "pric1", &a->pric[1],
> @@ -215,6 +213,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> memory_region_size(&a->scu->dram_remap_alias[1]),
> &a->scu->dram_remap_alias[0]);
>
> + /* SCUIO */
> + memory_region_init_alias(&a->scuio_alias, OBJECT(a), "scuio.alias",
> + &a->scuio->iomem, 0,
> + memory_region_size(&a->scuio->iomem));
> + memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCUIO],
> + &a->scuio_alias);
> +
> /* INTC */
> if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
> return;
> @@ -282,9 +287,6 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
> "aspeed.ipc1",
> sc->memmap[ASPEED_DEV_IPC1], 0x1000);
> - aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
> - "aspeed.scuio",
> - sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
> "aspeed.pric0",
> sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
> @@ -299,6 +301,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
> static const Property aspeed_27x0_coprocessor_properties[] = {
> DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
> TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
> + DEFINE_PROP_LINK("scuio", Aspeed27x0CoprocessorState, scuio,
> + TYPE_ASPEED_SCU, AspeedSCUState *),
Check that the link is set in the realize routines.
Thanks,
C.
> DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
> AspeedSMCState *),
> };
> diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
> index d6448d82f5..cab7f47ac8 100644
> --- a/hw/arm/aspeed_ast27x0-tsp.c
> +++ b/hw/arm/aspeed_ast27x0-tsp.c
> @@ -143,8 +143,6 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "ipc1", &a->ipc[1],
> TYPE_UNIMPLEMENTED_DEVICE);
> - object_initialize_child(obj, "scuio", &a->scuio,
> - TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "pric0", &a->pric[0],
> TYPE_UNIMPLEMENTED_DEVICE);
> object_initialize_child(obj, "pric1", &a->pric[1],
> @@ -212,6 +210,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> /* SDRAM remap alias used by PSP to access TSP SDRAM */
> memory_region_add_subregion(&s->sdram, 0, &a->scu->dram_remap_alias[2]);
>
> + /* SCUIO */
> + memory_region_init_alias(&a->scuio_alias, OBJECT(a), "scuio.alias",
> + &a->scuio->iomem, 0,
> + memory_region_size(&a->scuio->iomem));
> + memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCUIO],
> + &a->scuio_alias);
> +
> /* INTC */
> if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
> return;
> @@ -279,9 +284,6 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
> "aspeed.ipc1",
> sc->memmap[ASPEED_DEV_IPC1], 0x1000);
> - aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
> - "aspeed.scuio",
> - sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
> aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->pric[0]),
> "aspeed.pric0",
> sc->memmap[ASPEED_DEV_PRIC0], 0x1000);
> @@ -296,6 +298,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
> static const Property aspeed_27x0_coprocessor_properties[] = {
> DEFINE_PROP_LINK("scu", Aspeed27x0CoprocessorState, scu,
> TYPE_ASPEED_2700_SCU, Aspeed2700SCUState *),
> + DEFINE_PROP_LINK("scuio", Aspeed27x0CoprocessorState, scuio,
> + TYPE_ASPEED_SCU, AspeedSCUState *),
> DEFINE_PROP_LINK("fmc", Aspeed27x0CoprocessorState, fmc, TYPE_ASPEED_SMC,
> AspeedSMCState *),
> };
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 19/21] hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (17 preceding siblings ...)
2026-04-17 3:29 ` [PATCH v4 18/21] hw/arm/ast27x0: Share single SCUIO instance across PSP, SSP, and TSP Jamin Lin
@ 2026-04-17 3:29 ` Jamin Lin
2026-06-01 17:23 ` Cédric Le Goater
2026-04-17 3:29 ` [PATCH v4 20/21] tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP and load binaries from DRAM Jamin Lin
` (2 subsequent siblings)
21 siblings, 1 reply; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
The hardware strap settings in the AST2700 FC machine model were incorrect.
Update HW_STRAP1 and HW_STRAP2 to match the values observed from the
real EVB dump. These values are also consistent with the current
aspeed_ast27x0_evb.c machine setup.
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
hw/arm/aspeed_ast27x0-fc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index d1ff6fbd4d..69f114e68d 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -50,8 +50,10 @@ struct Ast2700FCState {
#define AST2700FC_BMC_RAM_SIZE (2 * GiB)
-#define AST2700FC_HW_STRAP1 0x000000C0
-#define AST2700FC_HW_STRAP2 0x00000003
+/* SCU HW Strap1 */
+#define AST2700FC_HW_STRAP1 0x00000800
+/* SCUIO HW Strap1 */
+#define AST2700FC_HW_STRAP2 0x00000700
#define AST2700FC_FMC_MODEL "w25q01jvq"
#define AST2700FC_SPI_MODEL "w25q512jv"
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 19/21] hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings
2026-04-17 3:29 ` [PATCH v4 19/21] hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings Jamin Lin
@ 2026-06-01 17:23 ` Cédric Le Goater
0 siblings, 0 replies; 35+ messages in thread
From: Cédric Le Goater @ 2026-06-01 17:23 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
On 4/17/26 05:29, Jamin Lin wrote:
> The hardware strap settings in the AST2700 FC machine model were incorrect.
>
> Update HW_STRAP1 and HW_STRAP2 to match the values observed from the
> real EVB dump. These values are also consistent with the current
> aspeed_ast27x0_evb.c machine setup.
>
> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
> hw/arm/aspeed_ast27x0-fc.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
> index d1ff6fbd4d..69f114e68d 100644
> --- a/hw/arm/aspeed_ast27x0-fc.c
> +++ b/hw/arm/aspeed_ast27x0-fc.c
> @@ -50,8 +50,10 @@ struct Ast2700FCState {
>
> #define AST2700FC_BMC_RAM_SIZE (2 * GiB)
>
> -#define AST2700FC_HW_STRAP1 0x000000C0
> -#define AST2700FC_HW_STRAP2 0x00000003
> +/* SCU HW Strap1 */
> +#define AST2700FC_HW_STRAP1 0x00000800
> +/* SCUIO HW Strap1 */
> +#define AST2700FC_HW_STRAP2 0x00000700
> #define AST2700FC_FMC_MODEL "w25q01jvq"
> #define AST2700FC_SPI_MODEL "w25q512jv"
>
Please send first.
Thanks,
C.
^ permalink raw reply [flat|nested] 35+ messages in thread
* [PATCH v4 20/21] tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP and load binaries from DRAM
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (18 preceding siblings ...)
2026-04-17 3:29 ` [PATCH v4 19/21] hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings Jamin Lin
@ 2026-04-17 3:29 ` Jamin Lin
2026-04-17 3:29 ` [PATCH v4 21/21] docs: Add support vbootrom and update Manual boot for ast2700fc Jamin Lin
2026-05-21 6:42 ` [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Cédric Le Goater
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
SSP and TSP now boot in a powered-off state by default. Enabling them requires
the PSP (Cortex-A35) to explicitly set SCU control registers at runtime. This
behavior aligns with real hardware.
Update the AST2700 FC functional test to reflect this behavior by enabling
SSP and TSP from the U-Boot shell before booting OpenBMC. The test now
programs the required SCU registers, saves the environment, and boots the
system so that SSP and TSP are powered on when the PSP starts.
Additionally, switch SSP and TSP loading from ELF-based CPU loaders to
binary images loaded into PSP DRAM at fixed addresses, and remove the use
of snapshot mode.
Changes include:
- Add enable_ast2700_ssp_tsp() to configure SCU registers via U-Boot
- Remove snapshot option from QEMU command line
- Load SSP binary at DRAM address 0x42C000000
- Load TSP binary at DRAM address 0x42E000000
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
.../aarch64/test_aspeed_ast2700fc.py | 29 ++++++++++---------
1 file changed, 16 insertions(+), 13 deletions(-)
diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index df889134ed..c0204ceb6c 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -23,7 +23,7 @@ def do_test_aarch64_aspeed_sdk_start(self, image):
self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
self.vm.add_args('-netdev', 'user,id=net1')
self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
- '-net', 'nic', '-net', 'user', '-snapshot')
+ '-net', 'nic', '-net', 'user')
self.vm.launch()
@@ -31,6 +31,12 @@ def disable_kernel_crypto_selftest(self):
exec_command_and_wait_for_pattern(self,
'setenv bootargs "${bootargs} cryptomgr.notests=1"', '=>')
+ def enable_ast2700_ssp_tsp(self):
+ exec_command_and_wait_for_pattern(self,
+ 'setenv bootcmd "mw 12c02204 40000000; mw 12c02120 1; '
+ 'mw 12c02224 00000200; mw 12c02160 1; run bootspi"', '=>')
+ exec_command_and_wait_for_pattern(self, 'saveenv', 'OK')
+
def enable_ast2700_pcie2(self):
exec_command_and_wait_for_pattern(self,
'cp 100420000 403000000 900000', '=>')
@@ -48,6 +54,7 @@ def verify_openbmc_boot_and_login(self, name):
wait_for_console_pattern(self, 'Hit any key to stop autoboot')
exec_command_and_wait_for_pattern(self, '\012', '=>')
self.disable_kernel_crypto_selftest()
+ self.enable_ast2700_ssp_tsp()
self.enable_ast2700_pcie2()
wait_for_console_pattern(self, 'Starting kernel ...')
@@ -55,16 +62,6 @@ def verify_openbmc_boot_and_login(self, name):
exec_command_and_wait_for_pattern(self, 'root', 'Password:')
exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
- def load_ast2700fc_coprocessor(self, name):
- load_elf_list = {
- 'ssp': self.scratch_file(name, 'zephyr-aspeed-ssp.elf'),
- 'tsp': self.scratch_file(name, 'zephyr-aspeed-tsp.elf')
- }
-
- for cpu_num, key in enumerate(load_elf_list, start=4):
- file = load_elf_list[key]
- self.vm.add_args('-device',
- f'loader,file={file},cpu-num={cpu_num}')
ASSET_SDK_V1101_AST2700 = Asset(
'https://github.com/AspeedTech-BMC/openbmc/releases/download/v11.01/ast2700-default-image.tar.gz',
@@ -123,6 +120,14 @@ def start_ast2700fc_test(self, name):
'addr': '0x400000000',
'file': self.scratch_file(name, 'u-boot.bin')
},
+ {
+ 'addr': '0x42C000000',
+ 'file': self.scratch_file(name, 'zephyr-aspeed-ssp.bin')
+ },
+ {
+ 'addr': '0x42E000000',
+ 'file': self.scratch_file(name, 'zephyr-aspeed-tsp.bin')
+ },
{
'addr': '0x430000000',
'file': self.scratch_file(name, 'bl31.bin')
@@ -143,13 +148,11 @@ def start_ast2700fc_test(self, name):
self.vm.add_args('-device',
f'loader,addr=0x430000000,cpu-num={i}')
- self.load_ast2700fc_coprocessor(name)
self.do_test_aarch64_aspeed_sdk_start(
self.scratch_file(name, 'image-bmc'))
def start_ast2700fc_test_vbootrom(self, name):
self.vm.add_args('-bios', 'ast27x0_bootrom.bin')
- self.load_ast2700fc_coprocessor(name)
self.do_test_aarch64_aspeed_sdk_start(
self.scratch_file(name, 'image-bmc'))
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* [PATCH v4 21/21] docs: Add support vbootrom and update Manual boot for ast2700fc
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (19 preceding siblings ...)
2026-04-17 3:29 ` [PATCH v4 20/21] tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP and load binaries from DRAM Jamin Lin
@ 2026-04-17 3:29 ` Jamin Lin
2026-05-21 6:42 ` [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Cédric Le Goater
21 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-04-17 3:29 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Jamin Lin, Troy Lee
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
docs/system/arm/aspeed.rst | 42 +++++++++++++++++++++++++++++++-------
1 file changed, 35 insertions(+), 7 deletions(-)
diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index d0054a7dbb..8454a04b13 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -389,18 +389,25 @@ Booting the ast2700fc machine
AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors.
**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors,
**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors.
+There are two methods to boot the ast2700fc machine.
+
+Manual boot using ``-device loader``:
+
+In this approach, users manually load firmware and assign entry points via QEMU loader devices.
+By default, the PSP begins execution at address ``0x430000000``, the load address of the bl31
+firmware. The SSP and TSP start in the powered-off state and must be explicitly enabled by the
+PSP through writes to SCU registers.
Steps to boot the AST2700fc machine:
-1. Ensure you have the following AST2700A1 binaries available in a directory
+1. Ensure you have the following AST2700 binaries available in a directory
- * u-boot-nodtb.bin
- * u-boot.dtb
+ * u-boot.bin
* bl31.bin
* optee/tee-raw.bin
* image-bmc
- * zephyr-aspeed-ssp.elf (for SSP firmware, CPU 5)
- * zephyr-aspeed-tsp.elf (for TSP firmware, CPU 6)
+ * zephyr-aspeed-ssp.bin (for SSP firmware, CPU 5)
+ * zephyr-aspeed-tsp.bin (for TSP firmware, CPU 6)
2. Execute the following command to start ``ast2700fc`` machine:
@@ -410,6 +417,8 @@ Steps to boot the AST2700fc machine:
$ qemu-system-aarch64 -M ast2700fc \
-device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot.bin \
+ -device loader,force-raw=on,addr=0x42C000000,file=${IMGDIR}/zephyr-aspeed-ssp.bin \
+ -device loader,force-raw=on,addr=0x42E000000,file=${IMGDIR}/zephyr-aspeed-tsp.bin \
-device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \
-device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \
-device loader,cpu-num=0,addr=0x430000000 \
@@ -417,12 +426,31 @@ Steps to boot the AST2700fc machine:
-device loader,cpu-num=2,addr=0x430000000 \
-device loader,cpu-num=3,addr=0x430000000 \
-drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
- -device loader,file=${IMGDIR}/zephyr-aspeed-ssp.elf,cpu-num=4 \
- -device loader,file=${IMGDIR}/zephyr-aspeed-tsp.elf,cpu-num=5 \
-serial pty -serial pty -serial pty \
-snapshot \
-S -nographic
+Boot using a virtual boot ROM (-bios):
+
+In this method, the virtual boot ROM (vbootrom) handles the full initialization sequence.
+It starts the PSP, which then enables the SSP and TSP by programming the appropriate SCU
+registers, following the hardware behavior.
+
+Execute the following command to start ``ast2700fc`` machine:
+
+.. code-block:: bash
+
+ IMGDIR=ast2700-default
+
+ $ qemu-system-aarch64 -M ast2700fc \
+ -bios ast27x0_bootrom.bin \
+ -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \
+ -serial pty -serial pty -serial pty \
+ -snapshot \
+ -S -nographic
+
+Serial Console Redirection:
+
After launching QEMU, serial devices will be automatically redirected.
Example output:
--
2.43.0
^ permalink raw reply related [flat|nested] 35+ messages in thread* Re: [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700
2026-04-17 3:28 [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Jamin Lin
` (20 preceding siblings ...)
2026-04-17 3:29 ` [PATCH v4 21/21] docs: Add support vbootrom and update Manual boot for ast2700fc Jamin Lin
@ 2026-05-21 6:42 ` Cédric Le Goater
2026-05-21 6:47 ` Jamin Lin
21 siblings, 1 reply; 35+ messages in thread
From: Cédric Le Goater @ 2026-05-21 6:42 UTC (permalink / raw)
To: Jamin Lin, Peter Maydell, Steven Lee, Troy Lee, Kane Chen,
Andrew Jeffery, Joel Stanley, Pierrick Bouvier, Alistair Francis,
Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
Jamin,
On 4/17/26 05:28, Jamin Lin wrote:
> This series improves AST2700 platform support by aligning SSP/TSP
> power and reset behavior with hardware, and enabling DRAM remapping
> required for proper firmware boot flow.
>
> v1:
> 1. The changes move DRAM/SDMC initialization earlier to support memory
> aliasing, add DRAM aliases for SSP/TSP SDRAM remap, and implement
> SSP/TSP reset, power-on, and remap controls via SCU registers.
> 2. With these updates, SSP and TSP can be booted via PSP and load their
> binaries from DRAM. Functional tests and documentation are updated
> accordingly.
>
> v2:
> Fix "make check" failure caused by both AST2700 and AST1700 realizing the same
> TYPE_AST2700_SCU model.
>
> v3:
> 1. Drop "Move DRAM and SDMC initialization earlier to support memory aliasing"
> 2. Support SPI/FMC FIFO Mode
> 3. Add unimplemented devices
>
> v4:
> 1. Introduce Aspeed2700SCU subclass and separate from generic SCU.
> 2. Add separate reset handler for AST2700 SCUIO
> 3. Add AST2700 SCUIO RNG control and data registers
> 4. Share single SCUIO instance across PSP, SSP, and TSP
> 5. Fix AST2700 FC hardware strap settings
Just a quick note to tell you that I didn't forget this series.
This is on my TODO list for QEMU 11.1. It's spring time and
changes are blooming all around.
Thanks,
C.
> Jamin Lin (21):
> hw/misc/aspeed_scu: Introduce Aspeed2700SCU subclass and separate from
> generic SCU
> hw/misc/aspeed_scu: Add separate reset handler for AST2700 SCUIO
> hw/arm/ast27x0: Start SSP in powered-off state to match hardware
> behavior
> hw/arm/ast27x0: Start TSP in powered-off state to match hardware
> behavior
> hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap
> hw/arm/ast27x0: Add DRAM alias for TSP SDRAM remap
> hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU
> registers
> hw/misc/aspeed_scu: Implement TSP reset and power-on control via SCU
> registers
> hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap
> hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap
> hw/arm/ast27x0: Share FMC controller with SSP and TSP
> hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller MMIO
> regions for SSP/TSP
> hw/arm/aspeed_ast27x0: Add unimplemented OTP controller MMIO regions
> for SSP/TSP
> hw/block/m25p80: Implement volatile status register write enable for
> Winbond
> hw/ssi/aspeed_smc: Add Data FIFO-based flash access support for
> AST2700
> hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700
> SCU/SCUIO
> hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data registers
> hw/arm/ast27x0: Share single SCUIO instance across PSP, SSP, and TSP
> hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings
> tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP
> and load binaries from DRAM
> docs: Add support vbootrom and update Manual boot for ast2700fc
>
> docs/system/arm/aspeed.rst | 42 ++-
> include/hw/arm/aspeed_ast1700.h | 2 +-
> include/hw/arm/aspeed_coprocessor.h | 13 +-
> include/hw/arm/aspeed_soc.h | 4 +
> include/hw/misc/aspeed_scu.h | 10 +
> include/hw/ssi/aspeed_smc.h | 3 +-
> hw/arm/aspeed_ast27x0-fc.c | 22 +-
> hw/arm/aspeed_ast27x0-ssp.c | 67 +++-
> hw/arm/aspeed_ast27x0-tsp.c | 64 +++-
> hw/arm/aspeed_ast27x0.c | 22 +-
> hw/arm/aspeed_coprocessor_common.c | 2 -
> hw/block/m25p80.c | 36 +-
> hw/misc/aspeed_scu.c | 324 +++++++++++++++++-
> hw/ssi/aspeed_smc.c | 113 +++++-
> .../aarch64/test_aspeed_ast2700fc.py | 29 +-
> 15 files changed, 672 insertions(+), 81 deletions(-)
>
^ permalink raw reply [flat|nested] 35+ messages in thread* RE: [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700
2026-05-21 6:42 ` [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap support for AST2700 Cédric Le Goater
@ 2026-05-21 6:47 ` Jamin Lin
0 siblings, 0 replies; 35+ messages in thread
From: Jamin Lin @ 2026-05-21 6:47 UTC (permalink / raw)
To: Cédric Le Goater, Peter Maydell, Steven Lee, Troy Lee,
Kane Chen, Andrew Jeffery, Joel Stanley, Pierrick Bouvier,
Alistair Francis, Kevin Wolf, Hanna Reitz, open list:ASPEED BMCs,
open list:All patches CC here, open list:Block layer core
Cc: Troy Lee
Hi Cédric
> Subject: Re: [PATCH v4 00/21] Add SSP/TSP power control and DRAM remap
> support for AST2700
>
> Jamin,
>
> On 4/17/26 05:28, Jamin Lin wrote:
> > This series improves AST2700 platform support by aligning SSP/TSP
> > power and reset behavior with hardware, and enabling DRAM remapping
> > required for proper firmware boot flow.
> >
> > v1:
> > 1. The changes move DRAM/SDMC initialization earlier to support
> > memory aliasing, add DRAM aliases for SSP/TSP SDRAM remap, and
> > implement SSP/TSP reset, power-on, and remap controls via SCU registers.
> > 2. With these updates, SSP and TSP can be booted via PSP and load
> > their binaries from DRAM. Functional tests and documentation are
> > updated accordingly.
> >
> > v2:
> > Fix "make check" failure caused by both AST2700 and AST1700 realizing
> the same
> > TYPE_AST2700_SCU model.
> >
> > v3:
> > 1. Drop "Move DRAM and SDMC initialization earlier to support memory
> aliasing"
> > 2. Support SPI/FMC FIFO Mode
> > 3. Add unimplemented devices
> >
> > v4:
> > 1. Introduce Aspeed2700SCU subclass and separate from generic SCU.
> > 2. Add separate reset handler for AST2700 SCUIO
> > 3. Add AST2700 SCUIO RNG control and data registers
> > 4. Share single SCUIO instance across PSP, SSP, and TSP
> > 5. Fix AST2700 FC hardware strap settings
>
>
> Just a quick note to tell you that I didn't forget this series.
> This is on my TODO list for QEMU 11.1. It's spring time and changes are
> blooming all around.
>
> Thanks,
>
> C.
>
No problem - whenever you have time to review it is totally fine.
This series is not very urgent.
Thank you for your support and all the help as always!
Best regards,
Jamin
>
> > Jamin Lin (21):
> > hw/misc/aspeed_scu: Introduce Aspeed2700SCU subclass and separate
> from
> > generic SCU
> > hw/misc/aspeed_scu: Add separate reset handler for AST2700 SCUIO
> > hw/arm/ast27x0: Start SSP in powered-off state to match hardware
> > behavior
> > hw/arm/ast27x0: Start TSP in powered-off state to match hardware
> > behavior
> > hw/arm/ast27x0: Add DRAM alias for SSP SDRAM remap
> > hw/arm/ast27x0: Add DRAM alias for TSP SDRAM remap
> > hw/misc/aspeed_scu: Implement SSP reset and power-on control via SCU
> > registers
> > hw/misc/aspeed_scu: Implement TSP reset and power-on control via
> SCU
> > registers
> > hw/misc/aspeed_scu: Add SCU support for SSP SDRAM remap
> > hw/misc/aspeed_scu: Add SCU support for TSP SDRAM remap
> > hw/arm/ast27x0: Share FMC controller with SSP and TSP
> > hw/arm/aspeed_ast27x0: Add unimplemented Privilege Controller
> MMIO
> > regions for SSP/TSP
> > hw/arm/aspeed_ast27x0: Add unimplemented OTP controller MMIO
> regions
> > for SSP/TSP
> > hw/block/m25p80: Implement volatile status register write enable for
> > Winbond
> > hw/ssi/aspeed_smc: Add Data FIFO-based flash access support for
> > AST2700
> > hw/misc/aspeed_scu: Drop noisy unhandled read logs for AST2700
> > SCU/SCUIO
> > hw/misc/aspeed_scu: Add AST2700 SCUIO RNG control and data
> registers
> > hw/arm/ast27x0: Share single SCUIO instance across PSP, SSP, and TSP
> > hw/arm/aspeed_ast27x0-fc: Fix hardware strap settings
> > tests/functional/aarch64/test_aspeed_ast2700fc: Boot SSP/TSP via PSP
> > and load binaries from DRAM
> > docs: Add support vbootrom and update Manual boot for ast2700fc
> >
> > docs/system/arm/aspeed.rst | 42 ++-
> > include/hw/arm/aspeed_ast1700.h | 2 +-
> > include/hw/arm/aspeed_coprocessor.h | 13 +-
> > include/hw/arm/aspeed_soc.h | 4 +
> > include/hw/misc/aspeed_scu.h | 10 +
> > include/hw/ssi/aspeed_smc.h | 3 +-
> > hw/arm/aspeed_ast27x0-fc.c | 22 +-
> > hw/arm/aspeed_ast27x0-ssp.c | 67 +++-
> > hw/arm/aspeed_ast27x0-tsp.c | 64 +++-
> > hw/arm/aspeed_ast27x0.c | 22 +-
> > hw/arm/aspeed_coprocessor_common.c | 2 -
> > hw/block/m25p80.c | 36 +-
> > hw/misc/aspeed_scu.c | 324
> +++++++++++++++++-
> > hw/ssi/aspeed_smc.c | 113 +++++-
> > .../aarch64/test_aspeed_ast2700fc.py | 29 +-
> > 15 files changed, 672 insertions(+), 81 deletions(-)
> >
^ permalink raw reply [flat|nested] 35+ messages in thread