1Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``) 2================================================================================================================================================================================================================================================================================================================================================================================================================== 3 4The QEMU Aspeed machines model BMCs of various OpenPOWER systems and 5Aspeed evaluation boards. They are based on different releases of the 6Aspeed SoC : the AST2400 integrating an ARM926EJ-S CPU (400MHz), the 7AST2500 with an ARM1176JZS CPU (800MHz), the AST2600 8with dual cores ARM Cortex-A7 CPUs (1.2GHz). 9 10The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 11etc. 12 13AST2400 SoC based machines : 14 15- ``palmetto-bmc`` OpenPOWER Palmetto POWER8 BMC 16- ``quanta-q71l-bmc`` OpenBMC Quanta BMC 17- ``supermicrox11-bmc`` Supermicro X11 BMC (ARM926EJ-S) 18- ``supermicrox11spi-bmc`` Supermicro X11 SPI BMC (ARM1176) 19 20AST2500 SoC based machines : 21 22- ``ast2500-evb`` Aspeed AST2500 Evaluation board 23- ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC 24- ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC 25- ``sonorapass-bmc`` OCP SonoraPass BMC 26- ``fp5280g2-bmc`` Inspur FP5280G2 BMC 27- ``g220a-bmc`` Bytedance G220A BMC 28- ``yosemitev2-bmc`` Facebook YosemiteV2 BMC 29- ``tiogapass-bmc`` Facebook Tiogapass BMC 30 31AST2600 SoC based machines : 32 33- ``ast2600-evb`` Aspeed AST2600 Evaluation board (Cortex-A7) 34- ``rainier-bmc`` IBM Rainier POWER10 BMC 35- ``fuji-bmc`` Facebook Fuji BMC 36- ``bletchley-bmc`` Facebook Bletchley BMC 37- ``fby35-bmc`` Facebook fby35 BMC 38- ``qcom-dc-scm-v1-bmc`` Qualcomm DC-SCM V1 BMC 39- ``qcom-firework-bmc`` Qualcomm Firework BMC 40 41Supported devices 42----------------- 43 44 * SMP (for the AST2600 Cortex-A7) 45 * Interrupt Controller (VIC) 46 * Timer Controller 47 * RTC Controller 48 * I2C Controller, including the new register interface of the AST2600 49 * System Control Unit (SCU) 50 * SRAM mapping 51 * X-DMA Controller (basic interface) 52 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 53 * SPI Memory Controller 54 * USB 2.0 Controller 55 * SD/MMC storage controllers 56 * SDRAM controller (dummy interface for basic settings and training) 57 * Watchdog Controller 58 * GPIO Controller (Master only) 59 * UART 60 * Ethernet controllers 61 * Front LEDs (PCA9552 on I2C bus) 62 * LPC Peripheral Controller (a subset of subdevices are supported) 63 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 64 * ADC 65 * Secure Boot Controller (AST2600) 66 * eMMC Boot Controller (dummy) 67 * PECI Controller (minimal) 68 * I3C Controller 69 * Internal Bridge Controller (SLI dummy) 70 71 72Missing devices 73--------------- 74 75 * Coprocessor support 76 * PWM and Fan Controller 77 * Slave GPIO Controller 78 * Super I/O Controller 79 * PCI-Express 1 Controller 80 * Graphic Display Controller 81 * MCTP Controller 82 * Mailbox Controller 83 * Virtual UART 84 * eSPI Controller 85 86Boot options 87------------ 88 89The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options 90to load a Linux kernel or from a firmware. Images can be downloaded from the 91OpenBMC jenkins : 92 93 https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/ 94 95or directly from the OpenBMC GitHub release repository : 96 97 https://github.com/openbmc/openbmc/releases 98 99or directly from the ASPEED Forked OpenBMC GitHub release repository : 100 101 https://github.com/AspeedTech-BMC/openbmc/releases 102 103Booting from a kernel image 104^^^^^^^^^^^^^^^^^^^^^^^^^^^ 105 106To boot a kernel directly from a Linux build tree: 107 108.. code-block:: bash 109 110 $ qemu-system-arm -M ast2600-evb -nographic \ 111 -kernel arch/arm/boot/zImage \ 112 -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \ 113 -initrd rootfs.cpio 114 115Booting from a flash image 116^^^^^^^^^^^^^^^^^^^^^^^^^^^ 117 118The machine options specific to Aspeed to boot from a flash image are : 119 120 * ``execute-in-place`` which emulates the boot from the CE0 flash 121 device by using the FMC controller to load the instructions, and 122 not simply from RAM. This takes a little longer. 123 124 * ``fmc-model`` to change the default FMC Flash model. FW needs 125 support for the chip model to boot. 126 127 * ``spi-model`` to change the default SPI Flash model. 128 129To boot the machine from the flash image, use an MTD drive : 130 131.. code-block:: bash 132 133 $ qemu-system-arm -M romulus-bmc -nic user \ 134 -drive file=obmc-phosphor-image-romulus.static.mtd,format=raw,if=mtd -nographic 135 136To use other flash models, for instance a different FMC chip and a 137bigger (64M) SPI for the ``ast2500-evb`` machine, run : 138 139.. code-block:: bash 140 141 -M ast2500-evb,fmc-model=mx25l25635e,spi-model=mx66u51235f 142 143When more flexibility is needed to define the flash devices, to use 144different flash models or define all flash devices (up to 8), the 145``-nodefaults`` QEMU option can be used to avoid creating the default 146flash devices. 147 148Flash devices should then be created from the command line and attached 149to a block device : 150 151.. code-block:: bash 152 153 $ qemu-system-arm -M ast2600-evb \ 154 -blockdev node-name=fmc0,driver=file,filename=/path/to/fmc0.img \ 155 -device mx66u51235f,bus=ssi.0,cs=0x0,drive=fmc0 \ 156 -blockdev node-name=fmc1,driver=file,filename=/path/to/fmc1.img \ 157 -device mx66u51235f,bus=ssi.0,cs=0x1,drive=fmc1 \ 158 -blockdev node-name=spi1,driver=file,filename=/path/to/spi1.img \ 159 -device mx66u51235f,cs=0x0,bus=ssi.1,drive=spi1 \ 160 -nographic -nodefaults 161 162In that case, the machine boots fetching instructions from the FMC0 163device. It is slower to start but closer to what HW does. Using the 164machine option ``execute-in-place`` has a similar effect. 165 166Booting from an eMMC image 167^^^^^^^^^^^^^^^^^^^^^^^^^^ 168 169The machine options specific to Aspeed machines to boot from an eMMC 170image are : 171 172 * ``boot-emmc`` to set or unset boot from eMMC (AST2600). 173 174Only the ``ast2600-evb`` and ``rainier-emmc`` machines have support to 175boot from an eMMC device. In this case, the machine assumes that the 176eMMC image includes special boot partitions. Such an image can be 177built this way : 178 179.. code-block:: bash 180 181 $ dd if=/dev/zero of=mmc-bootarea.img count=2 bs=1M 182 $ dd if=u-boot-spl.bin of=mmc-bootarea.img conv=notrunc 183 $ dd if=u-boot.bin of=mmc-bootarea.img conv=notrunc count=64 bs=1K 184 $ cat mmc-bootarea.img obmc-phosphor-image.wic > mmc.img 185 $ truncate --size 16GB mmc.img 186 187Boot the machine ``rainier-emmc`` with : 188 189.. code-block:: bash 190 191 $ qemu-system-arm -M rainier-bmc \ 192 -drive file=mmc.img,format=raw,if=sd,index=2 \ 193 -nographic 194 195The ``boot-emmc`` option can be set or unset, to change the default 196boot mode of machine: SPI or eMMC. This can be useful to boot the 197``ast2600-evb`` machine from an eMMC device (default being SPI) or to 198boot the ``rainier-bmc`` machine from a flash device (default being 199eMMC). 200 201As an example, here is how to to boot the ``rainier-bmc`` machine from 202the flash device with ``boot-emmc=false`` and let the machine use an 203eMMC image : 204 205.. code-block:: bash 206 207 $ qemu-system-arm -M rainier-bmc,boot-emmc=false \ 208 -drive file=flash.img,format=raw,if=mtd \ 209 -drive file=mmc.img,format=raw,if=sd,index=2 \ 210 -nographic 211 212It should be noted that in this case the eMMC device must not have 213boot partitions, otherwise the contents will not be accessible to the 214machine. This limitation is due to the use of the ``-drive`` 215interface. 216 217Ideally, one should be able to define the eMMC device and the 218associated backend directly on the command line, such as : 219 220.. code-block:: bash 221 222 -blockdev node-name=emmc0,driver=file,filename=mmc.img \ 223 -device emmc,bus=sdhci-bus.2,drive=emmc0,boot-partition-size=1048576,boot-config=8 224 225This is not yet supported (as of QEMU-10.0). Work is needed to 226refactor the sdhci bus model. 227 228Other booting options 229^^^^^^^^^^^^^^^^^^^^^ 230 231Other machine options specific to Aspeed machines are : 232 233 * ``bmc-console`` to change the default console device. Most of the 234 machines use the ``UART5`` device for a boot console, which is 235 mapped on ``/dev/ttyS4`` under Linux, but it is not always the 236 case. 237 238To change the boot console and use device ``UART3`` (``/dev/ttyS2`` 239under Linux), use : 240 241.. code-block:: bash 242 243 -M ast2500-evb,bmc-console=uart3 244 245Aspeed 2700 family boards (``ast2700-evb``) 246================================================================== 247 248The QEMU Aspeed machines model BMCs of Aspeed evaluation boards. 249They are based on different releases of the Aspeed SoC : 250the AST2700 with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz). 251 252The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 253etc. 254 255AST2700 SoC based machines : 256 257- ``ast2700-evb`` Aspeed AST2700 Evaluation board (Cortex-A35) 258 259Supported devices 260----------------- 261 * Interrupt Controller 262 * Timer Controller 263 * RTC Controller 264 * I2C Controller 265 * System Control Unit (SCU) 266 * SRAM mapping 267 * X-DMA Controller (basic interface) 268 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 269 * SPI Memory Controller 270 * USB 2.0 Controller 271 * SD/MMC storage controllers 272 * SDRAM controller (dummy interface for basic settings and training) 273 * Watchdog Controller 274 * GPIO Controller (Master only) 275 * UART 276 * Ethernet controllers 277 * Front LEDs (PCA9552 on I2C bus) 278 * LPC Peripheral Controller (a subset of subdevices are supported) 279 * Hash/Crypto Engine (HACE) - Hash support only. TODO: Crypto 280 * ADC 281 * eMMC Boot Controller (dummy) 282 * PECI Controller (minimal) 283 * I3C Controller 284 * Internal Bridge Controller (SLI dummy) 285 286Missing devices 287--------------- 288 * Coprocessor support 289 * PWM and Fan Controller 290 * Slave GPIO Controller 291 * Super I/O Controller 292 * PCI-Express 1 Controller 293 * Graphic Display Controller 294 * MCTP Controller 295 * Mailbox Controller 296 * Virtual UART 297 * eSPI Controller 298 299Boot options 300------------ 301 302Images can be downloaded from the ASPEED Forked OpenBMC GitHub release repository : 303 304 https://github.com/AspeedTech-BMC/openbmc/releases 305 306Booting the ast2700-evb machine 307^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 308 309Boot the AST2700 machine from the flash image. 310 311There are two supported methods for booting the AST2700 machine with a flash image: 312 313Manual boot using ``-device loader``: 314 315It causes all 4 CPU cores to start execution from address ``0x430000000``, which 316corresponds to the BL31 image load address. 317 318.. code-block:: bash 319 320 IMGDIR=ast2700-default 321 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 322 323 $ qemu-system-aarch64 -M ast2700-evb \ 324 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 325 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 326 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 327 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 328 -device loader,cpu-num=0,addr=0x430000000 \ 329 -device loader,cpu-num=1,addr=0x430000000 \ 330 -device loader,cpu-num=2,addr=0x430000000 \ 331 -device loader,cpu-num=3,addr=0x430000000 \ 332 -smp 4 \ 333 -drive file=${IMGDIR}/image-bmc,format=raw,if=mtd \ 334 -nographic 335 336Boot using a virtual boot ROM (``-bios``): 337 338If users do not specify the ``-bios option``, QEMU will attempt to load the 339default vbootrom image ``ast27x0_bootrom.bin`` from either the current working 340directory or the ``pc-bios`` directory within the QEMU source tree. 341 342.. code-block:: bash 343 344 $ qemu-system-aarch64 -M ast2700-evb \ 345 -drive file=image-bmc,format=raw,if=mtd \ 346 -nographic 347 348The ``-bios`` option allows users to specify a custom path for the vbootrom 349image to be loaded during boot. This will load the vbootrom image from the 350specified path in the ${HOME} directory. 351 352.. code-block:: bash 353 354 -bios ${HOME}/ast27x0_bootrom.bin 355 356Aspeed minibmc family boards (``ast1030-evb``) 357================================================================== 358 359The QEMU Aspeed machines model mini BMCs of various Aspeed evaluation 360boards. They are based on different releases of the 361Aspeed SoC : the AST1030 integrating an ARM Cortex M4F CPU (200MHz). 362 363The SoC comes with SRAM, SPI, I2C, etc. 364 365AST1030 SoC based machines : 366 367- ``ast1030-evb`` Aspeed AST1030 Evaluation board (Cortex-M4F) 368 369Supported devices 370----------------- 371 372 * SMP (for the AST1030 Cortex-M4F) 373 * Interrupt Controller (VIC) 374 * Timer Controller 375 * I2C Controller 376 * System Control Unit (SCU) 377 * SRAM mapping 378 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 379 * SPI Memory Controller 380 * USB 2.0 Controller 381 * Watchdog Controller 382 * GPIO Controller (Master only) 383 * UART 384 * LPC Peripheral Controller (a subset of subdevices are supported) 385 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 386 * ADC 387 * Secure Boot Controller 388 * PECI Controller (minimal) 389 390 391Missing devices 392--------------- 393 394 * PWM and Fan Controller 395 * Slave GPIO Controller 396 * Mailbox Controller 397 * Virtual UART 398 * eSPI Controller 399 * I3C Controller 400 401Boot options 402------------ 403 404The Aspeed machines can be started using the ``-kernel`` to load a 405Zephyr OS or from a firmware. Images can be downloaded from the 406ASPEED GitHub release repository : 407 408 https://github.com/AspeedTech-BMC/zephyr/releases 409 410To boot a kernel directly from a Zephyr build tree: 411 412.. code-block:: bash 413 414 $ qemu-system-arm -M ast1030-evb -nographic \ 415 -kernel zephyr.elf 416