This patch introduces a dedicated ca35_boot_rom memory region and
copies the FMC0 flash data into it when mmio_exec is disabled.

The main purpose of this change is to support the upcoming VBOOTROM
, which can directly fetch data from FMC0 flash at the SPI boot ROM
base address (0x100000000) without requiring any SPI controller
drivers.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index b15cb94c39..2e6036b192 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -35,6 +35,7 @@ struct Ast2700FCState {
 
     MemoryRegion ca35_memory;
     MemoryRegion ca35_dram;
+    MemoryRegion ca35_boot_rom;
     MemoryRegion ssp_memory;
     MemoryRegion tsp_memory;
 
@@ -61,7 +62,10 @@ static void ast2700fc_ca35_init(MachineState *machine)
     Ast2700FCState *s = AST2700A1FC(machine);
     AspeedSoCState *soc;
     AspeedSoCClass *sc;
+    BlockBackend *fmc0 = NULL;
+    DeviceState *dev = NULL;
     Error **errp = NULL;
+    uint64_t rom_size;
 
     object_initialize_child(OBJECT(s), "ca35", &s->ca35, "ast2700-a1");
     soc = ASPEED_SOC(&s->ca35);
@@ -119,6 +123,16 @@ static void ast2700fc_ca35_init(MachineState *machine)
     ast2700fc_board_info.ram_size = machine->ram_size;
     ast2700fc_board_info.loader_start = sc->memmap[ASPEED_DEV_SDRAM];
 
+    if (!s->mmio_exec) {
+        dev = ssi_get_cs(soc->fmc.spi, 0);
+        fmc0 = dev ? m25p80_get_blk(dev) : NULL;
+
+        if (fmc0) {
+            rom_size = memory_region_size(&soc->spi_boot);
+            aspeed_install_boot_rom(soc, fmc0, &s->ca35_boot_rom, rom_size);
+        }
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), machine, &ast2700fc_board_info);
 }
 
-- 
2.43.0

On 9/24/25 07:56, Jamin Lin wrote:
> This patch introduces a dedicated ca35_boot_rom memory region and
> copies the FMC0 flash data into it when mmio_exec is disabled.
> 
> The main purpose of this change is to support the upcoming VBOOTROM
> , which can directly fetch data from FMC0 flash at the SPI boot ROM
> base address (0x100000000) without requiring any SPI controller
> drivers.

That's the 'execute-in-place' case but the property activating
'execute-in-place' is always false in this machine. Could you
explain why booting from vbootrom needs the fmc0 contents to be
mapped in memory too ?




> Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> ---
>   hw/arm/aspeed_ast27x0-fc.c | 14 ++++++++++++++
>   1 file changed, 14 insertions(+)
> 
> diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
> index b15cb94c39..2e6036b192 100644
> --- a/hw/arm/aspeed_ast27x0-fc.c
> +++ b/hw/arm/aspeed_ast27x0-fc.c
> @@ -35,6 +35,7 @@ struct Ast2700FCState {
>   
>       MemoryRegion ca35_memory;
>       MemoryRegion ca35_dram;
> +    MemoryRegion ca35_boot_rom;
>       MemoryRegion ssp_memory;
>       MemoryRegion tsp_memory;
>   
> @@ -61,7 +62,10 @@ static void ast2700fc_ca35_init(MachineState *machine)
>       Ast2700FCState *s = AST2700A1FC(machine);
>       AspeedSoCState *soc;
>       AspeedSoCClass *sc;
> +    BlockBackend *fmc0 = NULL;
> +    DeviceState *dev = NULL;
>       Error **errp = NULL;
> +    uint64_t rom_size;
>   
>       object_initialize_child(OBJECT(s), "ca35", &s->ca35, "ast2700-a1");
>       soc = ASPEED_SOC(&s->ca35);
> @@ -119,6 +123,16 @@ static void ast2700fc_ca35_init(MachineState *machine)
>       ast2700fc_board_info.ram_size = machine->ram_size;
>       ast2700fc_board_info.loader_start = sc->memmap[ASPEED_DEV_SDRAM];
>   
> +    if (!s->mmio_exec) {

bool 'mmio_exec' is always false in this machine. Should we keep it ?

Thanks,

C.



> +        dev = ssi_get_cs(soc->fmc.spi, 0);
> +        fmc0 = dev ? m25p80_get_blk(dev) : NULL;
> +
> +        if (fmc0) {
> +            rom_size = memory_region_size(&soc->spi_boot);
> +            aspeed_install_boot_rom(soc, fmc0, &s->ca35_boot_rom, rom_size);
> +        }
> +    }
> +
>       arm_load_kernel(ARM_CPU(first_cpu), machine, &ast2700fc_board_info);
>   }
>

Hi Cédric

> Subject: Re: [PATCH v2 6/7] hw/arm/aspeed_ast27x0-fc: Map FMC0 flash
> contents into CA35 boot ROM
> 
> On 9/24/25 07:56, Jamin Lin wrote:
> > This patch introduces a dedicated ca35_boot_rom memory region and
> > copies the FMC0 flash data into it when mmio_exec is disabled.
> >
> > The main purpose of this change is to support the upcoming VBOOTROM ,
> > which can directly fetch data from FMC0 flash at the SPI boot ROM base
> > address (0x100000000) without requiring any SPI controller drivers.
> 
> That's the 'execute-in-place' case but the property activating
> 'execute-in-place' is always false in this machine. Could you explain why
> booting from vbootrom needs the fmc0 contents to be mapped in memory
> too ?
> 
The main goal of vbootrom is to replace bootmuc (RISC-V 32).
Our current bootmuc firmware is SPL.
The SPL reads flash data (image-bmc) via FMC_CS0 and loads the following components into different DRAM addresses:
Trusted Firmware-A
OP-TEE OS
u-boot-nodtb.bin
u-boot.dtb

After loading, it(BOOTMCU) releases the CA35(PSP) reset so that CA35 can run Trusted Firmware-A.

The vbootrom performs the same sequence: it reads flash data (image-bmc), parses the FIT image,
and loads each image into its designated DRAM address. Finally, it jumps to Trusted Firmware-A.

https://github.com/google/vbootrom/blob/master/ast27x0/include/image.h#L21
https://github.com/google/vbootrom/blob/master/ast27x0/image.c#L30 
https://github.com/google/vbootrom/blob/master/ast27x0/image.c#L457
https://github.com/google/vbootrom/blob/master/ast27x0/image.c#L488-L505

That is why I need to copy FMC0 data into the its memory region to make vbootrom work correctly.

> 
> 
> 
> > Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
> > ---
> >   hw/arm/aspeed_ast27x0-fc.c | 14 ++++++++++++++
> >   1 file changed, 14 insertions(+)
> >
> > diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
> > index b15cb94c39..2e6036b192 100644
> > --- a/hw/arm/aspeed_ast27x0-fc.c
> > +++ b/hw/arm/aspeed_ast27x0-fc.c
> > @@ -35,6 +35,7 @@ struct Ast2700FCState {
> >
> >       MemoryRegion ca35_memory;
> >       MemoryRegion ca35_dram;
> > +    MemoryRegion ca35_boot_rom;
> >       MemoryRegion ssp_memory;
> >       MemoryRegion tsp_memory;
> >
> > @@ -61,7 +62,10 @@ static void ast2700fc_ca35_init(MachineState
> *machine)
> >       Ast2700FCState *s = AST2700A1FC(machine);
> >       AspeedSoCState *soc;
> >       AspeedSoCClass *sc;
> > +    BlockBackend *fmc0 = NULL;
> > +    DeviceState *dev = NULL;
> >       Error **errp = NULL;
> > +    uint64_t rom_size;
> >
> >       object_initialize_child(OBJECT(s), "ca35", &s->ca35, "ast2700-a1");
> >       soc = ASPEED_SOC(&s->ca35);
> > @@ -119,6 +123,16 @@ static void ast2700fc_ca35_init(MachineState
> *machine)
> >       ast2700fc_board_info.ram_size = machine->ram_size;
> >       ast2700fc_board_info.loader_start =
> > sc->memmap[ASPEED_DEV_SDRAM];
> >
> > +    if (!s->mmio_exec) {
> 
> bool 'mmio_exec' is always false in this machine. Should we keep it ?
> 

Will remove it.

Thanks-Jamin
> Thanks,
> 
> C.
> 
> 
> 
> > +        dev = ssi_get_cs(soc->fmc.spi, 0);
> > +        fmc0 = dev ? m25p80_get_blk(dev) : NULL;
> > +
> > +        if (fmc0) {
> > +            rom_size = memory_region_size(&soc->spi_boot);
> > +            aspeed_install_boot_rom(soc, fmc0, &s->ca35_boot_rom,
> rom_size);
> > +        }
> > +    }
> > +
> >       arm_load_kernel(ARM_CPU(first_cpu), machine,
> &ast2700fc_board_info);
> >   }
> >