1Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``tacoma-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``) 2================================================================================================================================================================================================================================================================================================================================================================================================================================== 3 4The QEMU Aspeed machines model BMCs of various OpenPOWER systems and 5Aspeed evaluation boards. They are based on different releases of the 6Aspeed SoC : the AST2400 integrating an ARM926EJ-S CPU (400MHz), the 7AST2500 with an ARM1176JZS CPU (800MHz), the AST2600 8with dual cores ARM Cortex-A7 CPUs (1.2GHz) and more recently the AST2700 9with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz) 10 11The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 12etc. 13 14AST2400 SoC based machines : 15 16- ``palmetto-bmc`` OpenPOWER Palmetto POWER8 BMC 17- ``quanta-q71l-bmc`` OpenBMC Quanta BMC 18- ``supermicrox11-bmc`` Supermicro X11 BMC (ARM926EJ-S) 19- ``supermicrox11spi-bmc`` Supermicro X11 SPI BMC (ARM1176) 20 21AST2500 SoC based machines : 22 23- ``ast2500-evb`` Aspeed AST2500 Evaluation board 24- ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC 25- ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC 26- ``sonorapass-bmc`` OCP SonoraPass BMC 27- ``fp5280g2-bmc`` Inspur FP5280G2 BMC 28- ``g220a-bmc`` Bytedance G220A BMC 29- ``yosemitev2-bmc`` Facebook YosemiteV2 BMC 30- ``tiogapass-bmc`` Facebook Tiogapass BMC 31 32AST2600 SoC based machines : 33 34- ``ast2600-evb`` Aspeed AST2600 Evaluation board (Cortex-A7) 35- ``rainier-bmc`` IBM Rainier POWER10 BMC 36- ``fuji-bmc`` Facebook Fuji BMC 37- ``bletchley-bmc`` Facebook Bletchley BMC 38- ``fby35-bmc`` Facebook fby35 BMC 39- ``qcom-dc-scm-v1-bmc`` Qualcomm DC-SCM V1 BMC 40- ``qcom-firework-bmc`` Qualcomm Firework BMC 41 42AST2700 SoC based machines : 43 44- ``ast2700-evb`` Aspeed AST2700 Evaluation board (Cortex-A35) 45 46Supported devices 47----------------- 48 49 * SMP (for the AST2600 Cortex-A7) 50 * Interrupt Controller (VIC) 51 * Timer Controller 52 * RTC Controller 53 * I2C Controller, including the new register interface of the AST2600 54 * System Control Unit (SCU) 55 * SRAM mapping 56 * X-DMA Controller (basic interface) 57 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 58 * SPI Memory Controller 59 * USB 2.0 Controller 60 * SD/MMC storage controllers 61 * SDRAM controller (dummy interface for basic settings and training) 62 * Watchdog Controller 63 * GPIO Controller (Master only) 64 * UART 65 * Ethernet controllers 66 * Front LEDs (PCA9552 on I2C bus) 67 * LPC Peripheral Controller (a subset of subdevices are supported) 68 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 69 * ADC 70 * Secure Boot Controller (AST2600) 71 * eMMC Boot Controller (dummy) 72 * PECI Controller (minimal) 73 * I3C Controller 74 * Internal Bridge Controller (SLI dummy) 75 76 77Missing devices 78--------------- 79 80 * Coprocessor support 81 * PWM and Fan Controller 82 * Slave GPIO Controller 83 * Super I/O Controller 84 * PCI-Express 1 Controller 85 * Graphic Display Controller 86 * MCTP Controller 87 * Mailbox Controller 88 * Virtual UART 89 * eSPI Controller 90 91Boot options 92------------ 93 94The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options 95to load a Linux kernel or from a firmware. Images can be downloaded from the 96OpenBMC jenkins : 97 98 https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/ 99 100or directly from the OpenBMC GitHub release repository : 101 102 https://github.com/openbmc/openbmc/releases 103 104or directly from the ASPEED Forked OpenBMC GitHub release repository : 105 106 https://github.com/AspeedTech-BMC/openbmc/releases 107 108Booting from a kernel image 109^^^^^^^^^^^^^^^^^^^^^^^^^^^ 110 111To boot a kernel directly from a Linux build tree: 112 113.. code-block:: bash 114 115 $ qemu-system-arm -M ast2600-evb -nographic \ 116 -kernel arch/arm/boot/zImage \ 117 -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \ 118 -initrd rootfs.cpio 119 120Booting from a flash image 121^^^^^^^^^^^^^^^^^^^^^^^^^^^ 122 123The machine options specific to Aspeed to boot from a flash image are : 124 125 * ``execute-in-place`` which emulates the boot from the CE0 flash 126 device by using the FMC controller to load the instructions, and 127 not simply from RAM. This takes a little longer. 128 129 * ``fmc-model`` to change the default FMC Flash model. FW needs 130 support for the chip model to boot. 131 132 * ``spi-model`` to change the default SPI Flash model. 133 134To boot the machine from the flash image, use an MTD drive : 135 136.. code-block:: bash 137 138 $ qemu-system-arm -M romulus-bmc -nic user \ 139 -drive file=obmc-phosphor-image-romulus.static.mtd,format=raw,if=mtd -nographic 140 141To use other flash models, for instance a different FMC chip and a 142bigger (64M) SPI for the ``ast2500-evb`` machine, run : 143 144.. code-block:: bash 145 146 -M ast2500-evb,fmc-model=mx25l25635e,spi-model=mx66u51235f 147 148When more flexibility is needed to define the flash devices, to use 149different flash models or define all flash devices (up to 8), the 150``-nodefaults`` QEMU option can be used to avoid creating the default 151flash devices. 152 153Flash devices should then be created from the command line and attached 154to a block device : 155 156.. code-block:: bash 157 158 $ qemu-system-arm -M ast2600-evb \ 159 -blockdev node-name=fmc0,driver=file,filename=/path/to/fmc0.img \ 160 -device mx66u51235f,bus=ssi.0,cs=0x0,drive=fmc0 \ 161 -blockdev node-name=fmc1,driver=file,filename=/path/to/fmc1.img \ 162 -device mx66u51235f,bus=ssi.0,cs=0x1,drive=fmc1 \ 163 -blockdev node-name=spi1,driver=file,filename=/path/to/spi1.img \ 164 -device mx66u51235f,cs=0x0,bus=ssi.1,drive=spi1 \ 165 -nographic -nodefaults 166 167In that case, the machine boots fetching instructions from the FMC0 168device. It is slower to start but closer to what HW does. Using the 169machine option ``execute-in-place`` has a similar effect. 170 171Booting from an eMMC image 172^^^^^^^^^^^^^^^^^^^^^^^^^^ 173 174The machine options specific to Aspeed machines to boot from an eMMC 175image are : 176 177 * ``boot-emmc`` to set or unset boot from eMMC (AST2600). 178 179Only the ``ast2600-evb`` and ``rainier-emmc`` machines have support to 180boot from an eMMC device. In this case, the machine assumes that the 181eMMC image includes special boot partitions. Such an image can be 182built this way : 183 184.. code-block:: bash 185 186 $ dd if=/dev/zero of=mmc-bootarea.img count=2 bs=1M 187 $ dd if=u-boot-spl.bin of=mmc-bootarea.img conv=notrunc 188 $ dd if=u-boot.bin of=mmc-bootarea.img conv=notrunc count=64 bs=1K 189 $ cat mmc-bootarea.img obmc-phosphor-image.wic > mmc.img 190 $ truncate --size 16GB mmc.img 191 192Boot the machine ``rainier-emmc`` with : 193 194.. code-block:: bash 195 196 $ qemu-system-arm -M rainier-bmc \ 197 -drive file=mmc.img,format=raw,if=sd,index=2 \ 198 -nographic 199 200The ``boot-emmc`` option can be set or unset, to change the default 201boot mode of machine: SPI or eMMC. This can be useful to boot the 202``ast2600-evb`` machine from an eMMC device (default being SPI) or to 203boot the ``rainier-bmc`` machine from a flash device (default being 204eMMC). 205 206As an example, here is how to to boot the ``rainier-bmc`` machine from 207the flash device with ``boot-emmc=false`` and let the machine use an 208eMMC image : 209 210.. code-block:: bash 211 212 $ qemu-system-arm -M rainier-bmc,boot-emmc=false \ 213 -drive file=flash.img,format=raw,if=mtd \ 214 -drive file=mmc.img,format=raw,if=sd,index=2 \ 215 -nographic 216 217It should be noted that in this case the eMMC device must not have 218boot partitions, otherwise the contents will not be accessible to the 219machine. This limitation is due to the use of the ``-drive`` 220interface. 221 222Ideally, one should be able to define the eMMC device and the 223associated backend directly on the command line, such as : 224 225.. code-block:: bash 226 227 -blockdev node-name=emmc0,driver=file,filename=mmc.img \ 228 -device emmc,bus=sdhci-bus.2,drive=emmc0,boot-partition-size=1048576,boot-config=8 229 230This is not yet supported (as of QEMU-10.0). Work is needed to 231refactor the sdhci bus model. 232 233Other booting options 234^^^^^^^^^^^^^^^^^^^^^ 235 236Other machine options specific to Aspeed machines are : 237 238 * ``bmc-console`` to change the default console device. Most of the 239 machines use the ``UART5`` device for a boot console, which is 240 mapped on ``/dev/ttyS4`` under Linux, but it is not always the 241 case. 242 243To change the boot console and use device ``UART3`` (``/dev/ttyS2`` 244under Linux), use : 245 246.. code-block:: bash 247 248 -M ast2500-evb,bmc-console=uart3 249 250Booting the ast2700-evb machine 251^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 252 253Boot the AST2700 machine from the flash image, use an MTD drive : 254 255.. code-block:: bash 256 257 IMGDIR=ast2700-default 258 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 259 260 $ qemu-system-aarch64 -M ast2700-evb \ 261 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 262 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 263 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 264 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 265 -device loader,cpu-num=0,addr=0x430000000 \ 266 -device loader,cpu-num=1,addr=0x430000000 \ 267 -device loader,cpu-num=2,addr=0x430000000 \ 268 -device loader,cpu-num=3,addr=0x430000000 \ 269 -smp 4 \ 270 -drive file=${IMGDIR}/image-bmc,format=raw,if=mtd \ 271 -nographic 272 273Aspeed minibmc family boards (``ast1030-evb``) 274================================================================== 275 276The QEMU Aspeed machines model mini BMCs of various Aspeed evaluation 277boards. They are based on different releases of the 278Aspeed SoC : the AST1030 integrating an ARM Cortex M4F CPU (200MHz). 279 280The SoC comes with SRAM, SPI, I2C, etc. 281 282AST1030 SoC based machines : 283 284- ``ast1030-evb`` Aspeed AST1030 Evaluation board (Cortex-M4F) 285 286Supported devices 287----------------- 288 289 * SMP (for the AST1030 Cortex-M4F) 290 * Interrupt Controller (VIC) 291 * Timer Controller 292 * I2C Controller 293 * System Control Unit (SCU) 294 * SRAM mapping 295 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 296 * SPI Memory Controller 297 * USB 2.0 Controller 298 * Watchdog Controller 299 * GPIO Controller (Master only) 300 * UART 301 * LPC Peripheral Controller (a subset of subdevices are supported) 302 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 303 * ADC 304 * Secure Boot Controller 305 * PECI Controller (minimal) 306 307 308Missing devices 309--------------- 310 311 * PWM and Fan Controller 312 * Slave GPIO Controller 313 * Mailbox Controller 314 * Virtual UART 315 * eSPI Controller 316 * I3C Controller 317 318Boot options 319------------ 320 321The Aspeed machines can be started using the ``-kernel`` to load a 322Zephyr OS or from a firmware. Images can be downloaded from the 323ASPEED GitHub release repository : 324 325 https://github.com/AspeedTech-BMC/zephyr/releases 326 327To boot a kernel directly from a Zephyr build tree: 328 329.. code-block:: bash 330 331 $ qemu-system-arm -M ast1030-evb -nographic \ 332 -kernel zephyr.elf 333