1Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``) 2==================================================================================================================================================================================================================================================================================================================================================================================================================================== 3 4The QEMU Aspeed machines model BMCs of various OpenPOWER systems and 5Aspeed evaluation boards. They are based on different releases of the 6Aspeed SoC : the AST2400 integrating an ARM926EJ-S CPU (400MHz), the 7AST2500 with an ARM1176JZS CPU (800MHz), the AST2600 8with dual cores ARM Cortex-A7 CPUs (1.2GHz). 9 10The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 11etc. 12 13AST2400 SoC based machines : 14 15- ``palmetto-bmc`` OpenPOWER Palmetto POWER8 BMC 16- ``quanta-q71l-bmc`` OpenBMC Quanta BMC 17- ``supermicrox11-bmc`` Supermicro X11 BMC (ARM926EJ-S) 18- ``supermicrox11spi-bmc`` Supermicro X11 SPI BMC (ARM1176) 19 20AST2500 SoC based machines : 21 22- ``ast2500-evb`` Aspeed AST2500 Evaluation board 23- ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC 24- ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC 25- ``sonorapass-bmc`` OCP SonoraPass BMC 26- ``fp5280g2-bmc`` Inspur FP5280G2 BMC 27- ``g220a-bmc`` Bytedance G220A BMC 28- ``yosemitev2-bmc`` Facebook YosemiteV2 BMC 29- ``tiogapass-bmc`` Facebook Tiogapass BMC 30 31AST2600 SoC based machines : 32 33- ``ast2600-evb`` Aspeed AST2600 Evaluation board (Cortex-A7) 34- ``rainier-bmc`` IBM Rainier POWER10 BMC 35- ``fuji-bmc`` Facebook Fuji BMC 36- ``bletchley-bmc`` Facebook Bletchley BMC 37- ``fby35-bmc`` Facebook fby35 BMC 38- ``gb200nvl-bmc`` Nvidia GB200nvl BMC 39- ``qcom-dc-scm-v1-bmc`` Qualcomm DC-SCM V1 BMC 40- ``qcom-firework-bmc`` Qualcomm Firework BMC 41 42Supported devices 43----------------- 44 45 * SMP (for the AST2600 Cortex-A7) 46 * Interrupt Controller (VIC) 47 * Timer Controller 48 * RTC Controller 49 * I2C Controller, including the new register interface of the AST2600 50 * System Control Unit (SCU) 51 * SRAM mapping 52 * X-DMA Controller (basic interface) 53 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 54 * SPI Memory Controller 55 * USB 2.0 Controller 56 * SD/MMC storage controllers 57 * SDRAM controller (dummy interface for basic settings and training) 58 * Watchdog Controller 59 * GPIO Controller (Master only) 60 * UART 61 * Ethernet controllers 62 * Front LEDs (PCA9552 on I2C bus) 63 * LPC Peripheral Controller (a subset of subdevices are supported) 64 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 65 * ADC 66 * Secure Boot Controller (AST2600) 67 * eMMC Boot Controller (dummy) 68 * PECI Controller (minimal) 69 * I3C Controller 70 * Internal Bridge Controller (SLI dummy) 71 72 73Missing devices 74--------------- 75 76 * Coprocessor support 77 * PWM and Fan Controller 78 * Slave GPIO Controller 79 * Super I/O Controller 80 * PCI-Express 1 Controller 81 * Graphic Display Controller 82 * MCTP Controller 83 * Mailbox Controller 84 * Virtual UART 85 * eSPI Controller 86 87Boot options 88------------ 89 90The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options 91to load a Linux kernel or from a firmware. Images can be downloaded from the 92OpenBMC jenkins : 93 94 https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/ 95 96or directly from the OpenBMC GitHub release repository : 97 98 https://github.com/openbmc/openbmc/releases 99 100or directly from the ASPEED Forked OpenBMC GitHub release repository : 101 102 https://github.com/AspeedTech-BMC/openbmc/releases 103 104Booting from a kernel image 105^^^^^^^^^^^^^^^^^^^^^^^^^^^ 106 107To boot a kernel directly from a Linux build tree: 108 109.. code-block:: bash 110 111 $ qemu-system-arm -M ast2600-evb -nographic \ 112 -kernel arch/arm/boot/zImage \ 113 -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \ 114 -initrd rootfs.cpio 115 116Booting from a flash image 117^^^^^^^^^^^^^^^^^^^^^^^^^^^ 118 119The machine options specific to Aspeed to boot from a flash image are : 120 121 * ``execute-in-place`` which emulates the boot from the CE0 flash 122 device by using the FMC controller to load the instructions, and 123 not simply from RAM. This takes a little longer. 124 125 * ``fmc-model`` to change the default FMC Flash model. FW needs 126 support for the chip model to boot. 127 128 * ``spi-model`` to change the default SPI Flash model. 129 130To boot the machine from the flash image, use an MTD drive : 131 132.. code-block:: bash 133 134 $ qemu-system-arm -M romulus-bmc -nic user \ 135 -drive file=obmc-phosphor-image-romulus.static.mtd,format=raw,if=mtd -nographic 136 137To use other flash models, for instance a different FMC chip and a 138bigger (64M) SPI for the ``ast2500-evb`` machine, run : 139 140.. code-block:: bash 141 142 -M ast2500-evb,fmc-model=mx25l25635e,spi-model=mx66u51235f 143 144When more flexibility is needed to define the flash devices, to use 145different flash models or define all flash devices (up to 8), the 146``-nodefaults`` QEMU option can be used to avoid creating the default 147flash devices. 148 149Flash devices should then be created from the command line and attached 150to a block device : 151 152.. code-block:: bash 153 154 $ qemu-system-arm -M ast2600-evb \ 155 -blockdev node-name=fmc0,driver=file,filename=/path/to/fmc0.img \ 156 -device mx66u51235f,bus=ssi.0,cs=0x0,drive=fmc0 \ 157 -blockdev node-name=fmc1,driver=file,filename=/path/to/fmc1.img \ 158 -device mx66u51235f,bus=ssi.0,cs=0x1,drive=fmc1 \ 159 -blockdev node-name=spi1,driver=file,filename=/path/to/spi1.img \ 160 -device mx66u51235f,cs=0x0,bus=ssi.1,drive=spi1 \ 161 -nographic -nodefaults 162 163In that case, the machine boots fetching instructions from the FMC0 164device. It is slower to start but closer to what HW does. Using the 165machine option ``execute-in-place`` has a similar effect. 166 167Booting from an eMMC image 168^^^^^^^^^^^^^^^^^^^^^^^^^^ 169 170The machine options specific to Aspeed machines to boot from an eMMC 171image are : 172 173 * ``boot-emmc`` to set or unset boot from eMMC (AST2600). 174 175Only the ``ast2600-evb`` and ``rainier-emmc`` machines have support to 176boot from an eMMC device. In this case, the machine assumes that the 177eMMC image includes special boot partitions. Such an image can be 178built this way : 179 180.. code-block:: bash 181 182 $ dd if=/dev/zero of=mmc-bootarea.img count=2 bs=1M 183 $ dd if=u-boot-spl.bin of=mmc-bootarea.img conv=notrunc 184 $ dd if=u-boot.bin of=mmc-bootarea.img conv=notrunc count=64 bs=1K 185 $ cat mmc-bootarea.img obmc-phosphor-image.wic > mmc.img 186 $ truncate --size 16GB mmc.img 187 188Boot the machine ``rainier-emmc`` with : 189 190.. code-block:: bash 191 192 $ qemu-system-arm -M rainier-bmc \ 193 -drive file=mmc.img,format=raw,if=sd,index=2 \ 194 -nographic 195 196The ``boot-emmc`` option can be set or unset, to change the default 197boot mode of machine: SPI or eMMC. This can be useful to boot the 198``ast2600-evb`` machine from an eMMC device (default being SPI) or to 199boot the ``rainier-bmc`` machine from a flash device (default being 200eMMC). 201 202As an example, here is how to to boot the ``rainier-bmc`` machine from 203the flash device with ``boot-emmc=false`` and let the machine use an 204eMMC image : 205 206.. code-block:: bash 207 208 $ qemu-system-arm -M rainier-bmc,boot-emmc=false \ 209 -drive file=flash.img,format=raw,if=mtd \ 210 -drive file=mmc.img,format=raw,if=sd,index=2 \ 211 -nographic 212 213It should be noted that in this case the eMMC device must not have 214boot partitions, otherwise the contents will not be accessible to the 215machine. This limitation is due to the use of the ``-drive`` 216interface. 217 218Ideally, one should be able to define the eMMC device and the 219associated backend directly on the command line, such as : 220 221.. code-block:: bash 222 223 -blockdev node-name=emmc0,driver=file,filename=mmc.img \ 224 -device emmc,bus=sdhci-bus.2,drive=emmc0,boot-partition-size=1048576,boot-config=8 225 226This is not yet supported (as of QEMU-10.0). Work is needed to 227refactor the sdhci bus model. 228 229Other booting options 230^^^^^^^^^^^^^^^^^^^^^ 231 232Other machine options specific to Aspeed machines are : 233 234 * ``bmc-console`` to change the default console device. Most of the 235 machines use the ``UART5`` device for a boot console, which is 236 mapped on ``/dev/ttyS4`` under Linux, but it is not always the 237 case. 238 239To change the boot console and use device ``UART3`` (``/dev/ttyS2`` 240under Linux), use : 241 242.. code-block:: bash 243 244 -M ast2500-evb,bmc-console=uart3 245 246Aspeed 2700 family boards (``ast2700-evb``, ``ast2700fc``) 247================================================================== 248 249The QEMU Aspeed machines model BMCs of Aspeed evaluation boards. 250They are based on different releases of the Aspeed SoC : 251the AST2700 with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz). 252 253The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 254etc. 255 256AST2700 SoC based machines : 257 258- ``ast2700-evb`` Aspeed AST2700 Evaluation board (Cortex-A35) 259- ``ast2700fc`` Aspeed AST2700 Evaluation board (Cortex-A35 + Cortex-M4) 260 261Supported devices 262----------------- 263 * Interrupt Controller 264 * Timer Controller 265 * RTC Controller 266 * I2C Controller 267 * System Control Unit (SCU) 268 * SRAM mapping 269 * X-DMA Controller (basic interface) 270 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 271 * SPI Memory Controller 272 * USB 2.0 Controller 273 * SD/MMC storage controllers 274 * SDRAM controller (dummy interface for basic settings and training) 275 * Watchdog Controller 276 * GPIO Controller (Master only) 277 * UART 278 * Ethernet controllers 279 * Front LEDs (PCA9552 on I2C bus) 280 * LPC Peripheral Controller (a subset of subdevices are supported) 281 * Hash/Crypto Engine (HACE) - Hash support only. TODO: Crypto 282 * ADC 283 * eMMC Boot Controller (dummy) 284 * PECI Controller (minimal) 285 * I3C Controller 286 * Internal Bridge Controller (SLI dummy) 287 288Missing devices 289--------------- 290 * PWM and Fan Controller 291 * Slave GPIO Controller 292 * Super I/O Controller 293 * PCI-Express 1 Controller 294 * Graphic Display Controller 295 * MCTP Controller 296 * Mailbox Controller 297 * Virtual UART 298 * eSPI Controller 299 300Boot options 301------------ 302 303Images can be downloaded from the ASPEED Forked OpenBMC GitHub release repository : 304 305 https://github.com/AspeedTech-BMC/openbmc/releases 306 307Booting the ast2700-evb machine 308^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 309 310Boot the AST2700 machine from the flash image. 311 312There are two supported methods for booting the AST2700 machine with a flash image: 313 314Manual boot using ``-device loader``: 315 316It causes all 4 CPU cores to start execution from address ``0x430000000``, which 317corresponds to the BL31 image load address. 318 319.. code-block:: bash 320 321 IMGDIR=ast2700-default 322 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 323 324 $ qemu-system-aarch64 -M ast2700-evb \ 325 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 326 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 327 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 328 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 329 -device loader,cpu-num=0,addr=0x430000000 \ 330 -device loader,cpu-num=1,addr=0x430000000 \ 331 -device loader,cpu-num=2,addr=0x430000000 \ 332 -device loader,cpu-num=3,addr=0x430000000 \ 333 -smp 4 \ 334 -drive file=${IMGDIR}/image-bmc,format=raw,if=mtd \ 335 -nographic 336 337Boot using a virtual boot ROM (``-bios``): 338 339If users do not specify the ``-bios option``, QEMU will attempt to load the 340default vbootrom image ``ast27x0_bootrom.bin`` from either the current working 341directory or the ``pc-bios`` directory within the QEMU source tree. 342 343.. code-block:: bash 344 345 $ qemu-system-aarch64 -M ast2700-evb \ 346 -drive file=image-bmc,format=raw,if=mtd \ 347 -nographic 348 349The ``-bios`` option allows users to specify a custom path for the vbootrom 350image to be loaded during boot. This will load the vbootrom image from the 351specified path in the ${HOME} directory. 352 353.. code-block:: bash 354 355 -bios ${HOME}/ast27x0_bootrom.bin 356 357Booting the ast2700fc machine 358^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 359 360AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors. 361**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors, 362**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors. 363There are two methods to boot the ast2700fc machine. 364 365Manual boot using ``-device loader``: 366 367In this approach, users manually load firmware and assign entry points via QEMU loader devices. 368By default, the PSP begins execution at address ``0x430000000``, the load address of the bl31 369firmware. The SSP and TSP start in the powered-off state and must be explicitly enabled by the 370PSP through writes to SCU registers. 371 372Steps to boot the AST2700fc machine: 373 3741. Ensure you have the following AST2700A1 binaries available in a directory 375 376 * u-boot-nodtb.bin 377 * u-boot.dtb 378 * bl31.bin 379 * optee/tee-raw.bin 380 * image-bmc 381 * zephyr-aspeed-ssp.bin (for SSP firmware, CPU 5) 382 * zephyr-aspeed-tsp.bin (for TSP firmware, CPU 6) 383 3842. Execute the following command to start ``ast2700fc`` machine: 385 386.. code-block:: bash 387 388 IMGDIR=ast2700-default 389 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 390 391 $ qemu-system-aarch64 -M ast2700fc \ 392 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 393 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 394 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 395 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 396 -device loader,addr=0x42C000000,file=${IMGDIR}/zephyr-aspeed-ssp.bin,force-raw=on \ 397 -device loader,addr=0x42E000000,file=${IMGDIR}/zephyr-aspeed-tsp.bin,force-raw=on \ 398 -device loader,cpu-num=0,addr=0x430000000 \ 399 -device loader,cpu-num=1,addr=0x430000000 \ 400 -device loader,cpu-num=2,addr=0x430000000 \ 401 -device loader,cpu-num=3,addr=0x430000000 \ 402 -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \ 403 -serial pty -serial pty -serial pty \ 404 -snapshot \ 405 -S -nographic 406 407Boot using a virtual boot ROM (-bios): 408 409In this method, the virtual boot ROM (vbootrom) handles the full initialization sequence. 410It starts the PSP, which then enables the SSP and TSP by programming the appropriate SCU 411registers, following the hardware behavior. 412 413Execute the following command to start ``ast2700fc`` machine: 414 415.. code-block:: bash 416 417 IMGDIR=ast2700-default 418 419 $ qemu-system-aarch64 -M ast2700fc \ 420 -bios ast27x0_bootrom.bin \ 421 -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \ 422 -serial pty -serial pty -serial pty \ 423 -snapshot \ 424 -S -nographic 425 426Serial Console Redirection: 427 428After launching QEMU, serial devices will be automatically redirected. 429Example output: 430 431.. code-block:: bash 432 433 char device redirected to /dev/pts/55 (label serial0) 434 char device redirected to /dev/pts/56 (label serial1) 435 char device redirected to /dev/pts/57 (label serial2) 436 437- serial0: Console for the four Cortex-A35 primary processors. 438- serial1 and serial2: Consoles for the two Cortex-M4 coprocessors. 439 440Use ``tio`` or another terminal emulator to connect to the consoles: 441 442.. code-block:: bash 443 444 $ tio /dev/pts/55 445 $ tio /dev/pts/56 446 $ tio /dev/pts/57 447 448 449Aspeed minibmc family boards (``ast1030-evb``) 450================================================================== 451 452The QEMU Aspeed machines model mini BMCs of various Aspeed evaluation 453boards. They are based on different releases of the 454Aspeed SoC : the AST1030 integrating an ARM Cortex M4F CPU (200MHz). 455 456The SoC comes with SRAM, SPI, I2C, etc. 457 458AST1030 SoC based machines : 459 460- ``ast1030-evb`` Aspeed AST1030 Evaluation board (Cortex-M4F) 461 462Supported devices 463----------------- 464 465 * SMP (for the AST1030 Cortex-M4F) 466 * Interrupt Controller (VIC) 467 * Timer Controller 468 * I2C Controller 469 * System Control Unit (SCU) 470 * SRAM mapping 471 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 472 * SPI Memory Controller 473 * USB 2.0 Controller 474 * Watchdog Controller 475 * GPIO Controller (Master only) 476 * UART 477 * LPC Peripheral Controller (a subset of subdevices are supported) 478 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 479 * ADC 480 * Secure Boot Controller 481 * PECI Controller (minimal) 482 483 484Missing devices 485--------------- 486 487 * PWM and Fan Controller 488 * Slave GPIO Controller 489 * Mailbox Controller 490 * Virtual UART 491 * eSPI Controller 492 * I3C Controller 493 494Boot options 495------------ 496 497The Aspeed machines can be started using the ``-kernel`` to load a 498Zephyr OS or from a firmware. Images can be downloaded from the 499ASPEED GitHub release repository : 500 501 https://github.com/AspeedTech-BMC/zephyr/releases 502 503To boot a kernel directly from a Zephyr build tree: 504 505.. code-block:: bash 506 507 $ qemu-system-arm -M ast1030-evb -nographic \ 508 -kernel zephyr.elf 509