# p2afan: mapping ASPEED BMC fan control through the P2A bridge

> p2afan investigates the Tyan FT77C-B7079 BMC and controls its ASPEED AST2400 fan PWM registers from the host through the PCIe-to-AHB bridge. Its write-up maps BAR1, the PWM block and firmware layout, while the Python controller computes duty from IPMI, hwmon or command output.

- Type: Case study
- Targets: Firmware
- Category: Independent reconstruction cases
- Relationship: Independent reconstruction project
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-08
- Original resource: <https://github.com/larkinwc/p2afan>
- Primary source: <https://github.com/larkinwc/p2afan/blob/2fe3417f328dbf49165f549baaf19b780627b38c/docs/bmc-re.md>
- Catalog page: <https://awesomerea.org/resources/p2afan-case/>
- Record JSON: <https://awesomerea.org/resources/p2afan-case/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/p2afan-case/index.md)

## Requirements & limits

- **Prerequisites:** ASPEED AST2400/AST2500 BMC with an enabled, unlocked P2A bridge; root access, ipmitool and /dev/ipmi0.
- **Prerequisites:** Source installation requires Python 3.11–3.14.
- **Limits:** The measured register and sensor values come from one Tyan FT77C-B7079 chassis and must be re-derived for other machines.
- **License:** MIT license.

## Primary sources

1. <https://github.com/larkinwc/p2afan/blob/2fe3417f328dbf49165f549baaf19b780627b38c/docs/bmc-re.md>
2. <https://github.com/larkinwc/p2afan/blob/2fe3417f328dbf49165f549baaf19b780627b38c/README.md>
3. <https://github.com/larkinwc/p2afan/blob/2fe3417f328dbf49165f549baaf19b780627b38c/re/firmware-findings.md>

## More in Firmware and hardware

- [Cisco CP-9951 DOOM: mapping phone input for a native game port](https://awesomerea.org/resources/cisco-9951-doom-case/index.md) · Case study
- [Zeppelin Air: reconstructing USB firmware recovery](https://awesomerea.org/resources/zeppelin-air-recovery-case/index.md) · Case study
- [EmuWorks: emulating NumWorks N0110 calculator hardware](https://awesomerea.org/resources/emuworks-case/index.md) · Case study
- [CH899: reconstructing the clock's MM32–ESP exchange](https://awesomerea.org/resources/chouchin-ch899-firmware-case/index.md) · Case study
- [telink-usb-ota: reconstructing Telink USB-HID firmware updates](https://awesomerea.org/resources/telink-usb-ota-case/index.md) · Case study
- [K2 OpenKlipper: reconstructing the Creality K2 control stack](https://awesomerea.org/resources/k2-openklipper-case/index.md) · Case study

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.