1Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``) 2==================================================================================================================================================================================================================================================================================================================================================================================================================================== 3 4The QEMU Aspeed machines model BMCs of various OpenPOWER systems and 5Aspeed evaluation boards. They are based on different releases of the 6Aspeed SoC : the AST2400 integrating an ARM926EJ-S CPU (400MHz), the 7AST2500 with an ARM1176JZS CPU (800MHz), the AST2600 8with dual cores ARM Cortex-A7 CPUs (1.2GHz). 9 10The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 11etc. 12 13AST2400 SoC based machines : 14 15- ``palmetto-bmc`` OpenPOWER Palmetto POWER8 BMC 16- ``quanta-q71l-bmc`` OpenBMC Quanta BMC 17- ``supermicrox11-bmc`` Supermicro X11 BMC (ARM926EJ-S) 18- ``supermicrox11spi-bmc`` Supermicro X11 SPI BMC (ARM1176) 19 20AST2500 SoC based machines : 21 22- ``ast2500-evb`` Aspeed AST2500 Evaluation board 23- ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC 24- ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC 25- ``sonorapass-bmc`` OCP SonoraPass BMC 26- ``fp5280g2-bmc`` Inspur FP5280G2 BMC 27- ``g220a-bmc`` Bytedance G220A BMC 28- ``yosemitev2-bmc`` Facebook YosemiteV2 BMC 29- ``tiogapass-bmc`` Facebook Tiogapass BMC 30 31AST2600 SoC based machines : 32 33- ``ast2600-evb`` Aspeed AST2600 Evaluation board (Cortex-A7) 34- ``rainier-bmc`` IBM Rainier POWER10 BMC 35- ``fuji-bmc`` Facebook Fuji BMC 36- ``bletchley-bmc`` Facebook Bletchley BMC 37- ``fby35-bmc`` Facebook fby35 BMC 38- ``gb200nvl-bmc`` Nvidia GB200nvl BMC 39- ``qcom-dc-scm-v1-bmc`` Qualcomm DC-SCM V1 BMC 40- ``qcom-firework-bmc`` Qualcomm Firework BMC 41 42Supported devices 43----------------- 44 45 * SMP (for the AST2600 Cortex-A7) 46 * Interrupt Controller (VIC) 47 * Timer Controller 48 * RTC Controller 49 * I2C Controller, including the new register interface of the AST2600 50 * System Control Unit (SCU) 51 * SRAM mapping 52 * X-DMA Controller (basic interface) 53 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 54 * SPI Memory Controller 55 * USB 2.0 Controller 56 * SD/MMC storage controllers 57 * SDRAM controller (dummy interface for basic settings and training) 58 * Watchdog Controller 59 * GPIO Controller (Master only) 60 * UART 61 * Ethernet controllers 62 * Front LEDs (PCA9552 on I2C bus) 63 * LPC Peripheral Controller (a subset of subdevices are supported) 64 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 65 * ADC 66 * Secure Boot Controller (AST2600) 67 * eMMC Boot Controller (dummy) 68 * PECI Controller (minimal) 69 * I3C Controller 70 * Internal Bridge Controller (SLI dummy) 71 72 73Missing devices 74--------------- 75 76 * Coprocessor support 77 * PWM and Fan Controller 78 * Slave GPIO Controller 79 * Super I/O Controller 80 * PCI-Express 1 Controller 81 * Graphic Display Controller 82 * MCTP Controller 83 * Mailbox Controller 84 * Virtual UART 85 * eSPI Controller 86 87Boot options 88------------ 89 90The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options 91to load a Linux kernel or from a firmware. Images can be downloaded from the 92OpenBMC jenkins : 93 94 https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/ 95 96or directly from the OpenBMC GitHub release repository : 97 98 https://github.com/openbmc/openbmc/releases 99 100or directly from the ASPEED Forked OpenBMC GitHub release repository : 101 102 https://github.com/AspeedTech-BMC/openbmc/releases 103 104Booting from a kernel image 105^^^^^^^^^^^^^^^^^^^^^^^^^^^ 106 107To boot a kernel directly from a Linux build tree: 108 109.. code-block:: bash 110 111 $ qemu-system-arm -M ast2600-evb -nographic \ 112 -kernel arch/arm/boot/zImage \ 113 -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \ 114 -initrd rootfs.cpio 115 116Booting from a flash image 117^^^^^^^^^^^^^^^^^^^^^^^^^^^ 118 119The machine options specific to Aspeed to boot from a flash image are : 120 121 * ``execute-in-place`` which emulates the boot from the CE0 flash 122 device by using the FMC controller to load the instructions, and 123 not simply from RAM. This takes a little longer. 124 125 * ``fmc-model`` to change the default FMC Flash model. FW needs 126 support for the chip model to boot. 127 128 * ``spi-model`` to change the default SPI Flash model. 129 130To boot the machine from the flash image, use an MTD drive : 131 132.. code-block:: bash 133 134 $ qemu-system-arm -M romulus-bmc -nic user \ 135 -drive file=obmc-phosphor-image-romulus.static.mtd,format=raw,if=mtd -nographic 136 137To use other flash models, for instance a different FMC chip and a 138bigger (64M) SPI for the ``ast2500-evb`` machine, run : 139 140.. code-block:: bash 141 142 -M ast2500-evb,fmc-model=mx25l25635e,spi-model=mx66u51235f 143 144When more flexibility is needed to define the flash devices, to use 145different flash models or define all flash devices (up to 8), the 146``-nodefaults`` QEMU option can be used to avoid creating the default 147flash devices. 148 149Flash devices should then be created from the command line and attached 150to a block device : 151 152.. code-block:: bash 153 154 $ qemu-system-arm -M ast2600-evb \ 155 -blockdev node-name=fmc0,driver=file,filename=/path/to/fmc0.img \ 156 -device mx66u51235f,bus=ssi.0,cs=0x0,drive=fmc0 \ 157 -blockdev node-name=fmc1,driver=file,filename=/path/to/fmc1.img \ 158 -device mx66u51235f,bus=ssi.0,cs=0x1,drive=fmc1 \ 159 -blockdev node-name=spi1,driver=file,filename=/path/to/spi1.img \ 160 -device mx66u51235f,cs=0x0,bus=ssi.1,drive=spi1 \ 161 -nographic -nodefaults 162 163In that case, the machine boots fetching instructions from the FMC0 164device. It is slower to start but closer to what HW does. Using the 165machine option ``execute-in-place`` has a similar effect. 166 167Booting from an eMMC image 168^^^^^^^^^^^^^^^^^^^^^^^^^^ 169 170The machine options specific to Aspeed machines to boot from an eMMC 171image are : 172 173 * ``boot-emmc`` to set or unset boot from eMMC (AST2600). 174 175Only the ``ast2600-evb`` and ``rainier-emmc`` machines have support to 176boot from an eMMC device. In this case, the machine assumes that the 177eMMC image includes special boot partitions. Such an image can be 178built this way : 179 180.. code-block:: bash 181 182 $ dd if=/dev/zero of=mmc-bootarea.img count=2 bs=1M 183 $ dd if=u-boot-spl.bin of=mmc-bootarea.img conv=notrunc 184 $ dd if=u-boot.bin of=mmc-bootarea.img conv=notrunc count=64 bs=1K 185 $ cat mmc-bootarea.img obmc-phosphor-image.wic > mmc.img 186 $ truncate --size 16GB mmc.img 187 188Boot the machine ``rainier-emmc`` with : 189 190.. code-block:: bash 191 192 $ qemu-system-arm -M rainier-bmc \ 193 -drive file=mmc.img,format=raw,if=sd,index=2 \ 194 -nographic 195 196The ``boot-emmc`` option can be set or unset, to change the default 197boot mode of machine: SPI or eMMC. This can be useful to boot the 198``ast2600-evb`` machine from an eMMC device (default being SPI) or to 199boot the ``rainier-bmc`` machine from a flash device (default being 200eMMC). 201 202As an example, here is how to to boot the ``rainier-bmc`` machine from 203the flash device with ``boot-emmc=false`` and let the machine use an 204eMMC image : 205 206.. code-block:: bash 207 208 $ qemu-system-arm -M rainier-bmc,boot-emmc=false \ 209 -drive file=flash.img,format=raw,if=mtd \ 210 -drive file=mmc.img,format=raw,if=sd,index=2 \ 211 -nographic 212 213It should be noted that in this case the eMMC device must not have 214boot partitions, otherwise the contents will not be accessible to the 215machine. This limitation is due to the use of the ``-drive`` 216interface. 217 218Ideally, one should be able to define the eMMC device and the 219associated backend directly on the command line, such as : 220 221.. code-block:: bash 222 223 -blockdev node-name=emmc0,driver=file,filename=mmc.img \ 224 -device emmc,bus=sdhci-bus.2,drive=emmc0,boot-partition-size=1048576,boot-config=8 225 226This is not yet supported (as of QEMU-10.0). Work is needed to 227refactor the sdhci bus model. 228 229Other booting options 230^^^^^^^^^^^^^^^^^^^^^ 231 232Other machine options specific to Aspeed machines are : 233 234 * ``bmc-console`` to change the default console device. Most of the 235 machines use the ``UART5`` device for a boot console, which is 236 mapped on ``/dev/ttyS4`` under Linux, but it is not always the 237 case. 238 239To change the boot console and use device ``UART3`` (``/dev/ttyS2`` 240under Linux), use : 241 242.. code-block:: bash 243 244 -M ast2500-evb,bmc-console=uart3 245 246OTP Option 247^^^^^^^^^^ 248 249Both the AST2600 and AST1030 chips use the same One Time Programmable 250(OTP) memory module, which is utilized for configuration, key storage, 251and storing user-programmable data. This OTP memory module is managed 252by the Secure Boot Controller (SBC). The following options can be 253specified or omitted based on your needs. 254 255 * When the options are specified, the pre-generated configuration 256 file will be used as the OTP memory storage. 257 258 * When the options are omitted, an internal memory buffer will be 259 used to store the OTP memory data. 260 261.. code-block:: bash 262 263 -blockdev driver=file,filename=otpmem.img,node-name=otp \ 264 -global aspeed-otp.drive=otp \ 265 266The following bash command can be used to generate a default 267configuration file for OTP memory: 268 269.. code-block:: bash 270 271 if [ ! -f otpmem.img ]; then 272 for i in $(seq 1 2048); do 273 printf '\x00\x00\x00\x00\xff\xff\xff\xff' 274 done > otpmem.img 275 fi 276 277Aspeed 2700 family boards (``ast2700-evb``, ``ast2700fc``) 278================================================================== 279 280The QEMU Aspeed machines model BMCs of Aspeed evaluation boards. 281They are based on different releases of the Aspeed SoC : 282the AST2700 with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz). 283 284The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 285etc. 286 287AST2700 SoC based machines : 288 289- ``ast2700-evb`` Aspeed AST2700 Evaluation board (Cortex-A35) 290- ``ast2700fc`` Aspeed AST2700 Evaluation board (Cortex-A35 + Cortex-M4) 291 292Supported devices 293----------------- 294 * Interrupt Controller 295 * Timer Controller 296 * RTC Controller 297 * I2C Controller 298 * System Control Unit (SCU) 299 * SRAM mapping 300 * X-DMA Controller (basic interface) 301 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 302 * SPI Memory Controller 303 * USB 2.0 Controller 304 * SD/MMC storage controllers 305 * SDRAM controller (dummy interface for basic settings and training) 306 * Watchdog Controller 307 * GPIO Controller (Master only) 308 * UART 309 * Ethernet controllers 310 * Front LEDs (PCA9552 on I2C bus) 311 * LPC Peripheral Controller (a subset of subdevices are supported) 312 * Hash/Crypto Engine (HACE) - Hash support only. TODO: Crypto 313 * ADC 314 * eMMC Boot Controller (dummy) 315 * PECI Controller (minimal) 316 * I3C Controller 317 * Internal Bridge Controller (SLI dummy) 318 319Missing devices 320--------------- 321 * PWM and Fan Controller 322 * Slave GPIO Controller 323 * Super I/O Controller 324 * PCI-Express 1 Controller 325 * Graphic Display Controller 326 * MCTP Controller 327 * Mailbox Controller 328 * Virtual UART 329 * eSPI Controller 330 331Boot options 332------------ 333 334Images can be downloaded from the ASPEED Forked OpenBMC GitHub release repository : 335 336 https://github.com/AspeedTech-BMC/openbmc/releases 337 338Booting the ast2700-evb machine 339^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 340 341Boot the AST2700 machine from the flash image. 342 343There are two supported methods for booting the AST2700 machine with a flash image: 344 345Manual boot using ``-device loader``: 346 347It causes all 4 CPU cores to start execution from address ``0x430000000``, which 348corresponds to the BL31 image load address. 349 350.. code-block:: bash 351 352 IMGDIR=ast2700-default 353 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 354 355 $ qemu-system-aarch64 -M ast2700-evb \ 356 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 357 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 358 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 359 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 360 -device loader,cpu-num=0,addr=0x430000000 \ 361 -device loader,cpu-num=1,addr=0x430000000 \ 362 -device loader,cpu-num=2,addr=0x430000000 \ 363 -device loader,cpu-num=3,addr=0x430000000 \ 364 -smp 4 \ 365 -drive file=${IMGDIR}/image-bmc,format=raw,if=mtd \ 366 -nographic 367 368Boot using a virtual boot ROM (``-bios``): 369 370If users do not specify the ``-bios option``, QEMU will attempt to load the 371default vbootrom image ``ast27x0_bootrom.bin`` from either the current working 372directory or the ``pc-bios`` directory within the QEMU source tree. 373 374.. code-block:: bash 375 376 $ qemu-system-aarch64 -M ast2700-evb \ 377 -drive file=image-bmc,format=raw,if=mtd \ 378 -nographic 379 380The ``-bios`` option allows users to specify a custom path for the vbootrom 381image to be loaded during boot. This will load the vbootrom image from the 382specified path in the ${HOME} directory. 383 384.. code-block:: bash 385 386 -bios ${HOME}/ast27x0_bootrom.bin 387 388Booting the ast2700fc machine 389^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 390 391AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors. 392**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors, 393**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors. 394There are two methods to boot the ast2700fc machine. 395 396Manual boot using ``-device loader``: 397 398In this approach, users manually load firmware and assign entry points via QEMU loader devices. 399By default, the PSP begins execution at address ``0x430000000``, the load address of the bl31 400firmware. The SSP and TSP start in the powered-off state and must be explicitly enabled by the 401PSP through writes to SCU registers. 402 403Steps to boot the AST2700fc machine: 404 4051. Ensure you have the following AST2700A1 binaries available in a directory 406 407 * u-boot-nodtb.bin 408 * u-boot.dtb 409 * bl31.bin 410 * optee/tee-raw.bin 411 * image-bmc 412 * zephyr-aspeed-ssp.bin (for SSP firmware, CPU 5) 413 * zephyr-aspeed-tsp.bin (for TSP firmware, CPU 6) 414 4152. Execute the following command to start ``ast2700fc`` machine: 416 417.. code-block:: bash 418 419 IMGDIR=ast2700-default 420 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 421 422 $ qemu-system-aarch64 -M ast2700fc \ 423 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 424 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 425 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 426 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 427 -device loader,addr=0x42C000000,file=${IMGDIR}/zephyr-aspeed-ssp.bin,force-raw=on \ 428 -device loader,addr=0x42E000000,file=${IMGDIR}/zephyr-aspeed-tsp.bin,force-raw=on \ 429 -device loader,cpu-num=0,addr=0x430000000 \ 430 -device loader,cpu-num=1,addr=0x430000000 \ 431 -device loader,cpu-num=2,addr=0x430000000 \ 432 -device loader,cpu-num=3,addr=0x430000000 \ 433 -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \ 434 -serial pty -serial pty -serial pty \ 435 -snapshot \ 436 -S -nographic 437 438Boot using a virtual boot ROM (-bios): 439 440In this method, the virtual boot ROM (vbootrom) handles the full initialization sequence. 441It starts the PSP, which then enables the SSP and TSP by programming the appropriate SCU 442registers, following the hardware behavior. 443 444Execute the following command to start ``ast2700fc`` machine: 445 446.. code-block:: bash 447 448 IMGDIR=ast2700-default 449 450 $ qemu-system-aarch64 -M ast2700fc \ 451 -bios ast27x0_bootrom.bin \ 452 -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \ 453 -serial pty -serial pty -serial pty \ 454 -snapshot \ 455 -S -nographic 456 457Serial Console Redirection: 458 459After launching QEMU, serial devices will be automatically redirected. 460Example output: 461 462.. code-block:: bash 463 464 char device redirected to /dev/pts/55 (label serial0) 465 char device redirected to /dev/pts/56 (label serial1) 466 char device redirected to /dev/pts/57 (label serial2) 467 468- serial0: Console for the four Cortex-A35 primary processors. 469- serial1 and serial2: Consoles for the two Cortex-M4 coprocessors. 470 471Use ``tio`` or another terminal emulator to connect to the consoles: 472 473.. code-block:: bash 474 475 $ tio /dev/pts/55 476 $ tio /dev/pts/56 477 $ tio /dev/pts/57 478 479 480Aspeed minibmc family boards (``ast1030-evb``) 481================================================================== 482 483The QEMU Aspeed machines model mini BMCs of various Aspeed evaluation 484boards. They are based on different releases of the 485Aspeed SoC : the AST1030 integrating an ARM Cortex M4F CPU (200MHz). 486 487The SoC comes with SRAM, SPI, I2C, etc. 488 489AST1030 SoC based machines : 490 491- ``ast1030-evb`` Aspeed AST1030 Evaluation board (Cortex-M4F) 492 493Supported devices 494----------------- 495 496 * SMP (for the AST1030 Cortex-M4F) 497 * Interrupt Controller (VIC) 498 * Timer Controller 499 * I2C Controller 500 * System Control Unit (SCU) 501 * SRAM mapping 502 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 503 * SPI Memory Controller 504 * USB 2.0 Controller 505 * Watchdog Controller 506 * GPIO Controller (Master only) 507 * UART 508 * LPC Peripheral Controller (a subset of subdevices are supported) 509 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 510 * ADC 511 * Secure Boot Controller 512 * PECI Controller (minimal) 513 514 515Missing devices 516--------------- 517 518 * PWM and Fan Controller 519 * Slave GPIO Controller 520 * Mailbox Controller 521 * Virtual UART 522 * eSPI Controller 523 * I3C Controller 524 525Boot options 526------------ 527 528The Aspeed machines can be started using the ``-kernel`` to load a 529Zephyr OS or from a firmware. Images can be downloaded from the 530ASPEED GitHub release repository : 531 532 https://github.com/AspeedTech-BMC/zephyr/releases 533 534To boot a kernel directly from a Zephyr build tree: 535 536.. code-block:: bash 537 538 $ qemu-system-arm -M ast1030-evb -nographic \ 539 -kernel zephyr.elf 540