1Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``bletchley-bmc``, ``fuji-bmc``, ``gb200nvl-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``) 2==================================================================================================================================================================================================================================================================================================================================================================================================================================== 3 4The QEMU Aspeed machines model BMCs of various OpenPOWER systems and 5Aspeed evaluation boards. They are based on different releases of the 6Aspeed SoC : the AST2400 integrating an ARM926EJ-S CPU (400MHz), the 7AST2500 with an ARM1176JZS CPU (800MHz), the AST2600 8with dual cores ARM Cortex-A7 CPUs (1.2GHz). 9 10The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 11etc. 12 13AST2400 SoC based machines : 14 15- ``palmetto-bmc`` OpenPOWER Palmetto POWER8 BMC 16- ``quanta-q71l-bmc`` OpenBMC Quanta BMC 17- ``supermicrox11-bmc`` Supermicro X11 BMC (ARM926EJ-S) 18- ``supermicrox11spi-bmc`` Supermicro X11 SPI BMC (ARM1176) 19 20AST2500 SoC based machines : 21 22- ``ast2500-evb`` Aspeed AST2500 Evaluation board 23- ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC 24- ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC 25- ``sonorapass-bmc`` OCP SonoraPass BMC 26- ``fp5280g2-bmc`` Inspur FP5280G2 BMC 27- ``g220a-bmc`` Bytedance G220A BMC 28- ``yosemitev2-bmc`` Facebook YosemiteV2 BMC 29- ``tiogapass-bmc`` Facebook Tiogapass BMC 30 31AST2600 SoC based machines : 32 33- ``ast2600-evb`` Aspeed AST2600 Evaluation board (Cortex-A7) 34- ``rainier-bmc`` IBM Rainier POWER10 BMC 35- ``fuji-bmc`` Facebook Fuji BMC 36- ``bletchley-bmc`` Facebook Bletchley BMC 37- ``fby35-bmc`` Facebook fby35 BMC 38- ``gb200nvl-bmc`` Nvidia GB200nvl BMC 39- ``qcom-dc-scm-v1-bmc`` Qualcomm DC-SCM V1 BMC 40- ``qcom-firework-bmc`` Qualcomm Firework BMC 41 42Supported devices 43----------------- 44 45 * SMP (for the AST2600 Cortex-A7) 46 * Interrupt Controller (VIC) 47 * Timer Controller 48 * RTC Controller 49 * I2C Controller, including the new register interface of the AST2600 50 * System Control Unit (SCU) 51 * SRAM mapping 52 * X-DMA Controller (basic interface) 53 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 54 * SPI Memory Controller 55 * USB 2.0 Controller 56 * SD/MMC storage controllers 57 * SDRAM controller (dummy interface for basic settings and training) 58 * Watchdog Controller 59 * GPIO Controller (Master only) 60 * UART 61 * Ethernet controllers 62 * Front LEDs (PCA9552 on I2C bus) 63 * LPC Peripheral Controller (a subset of subdevices are supported) 64 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 65 * ADC 66 * Secure Boot Controller (AST2600) 67 * eMMC Boot Controller (dummy) 68 * PECI Controller (minimal) 69 * I3C Controller 70 * Internal Bridge Controller (SLI dummy) 71 72 73Missing devices 74--------------- 75 76 * Coprocessor support 77 * PWM and Fan Controller 78 * Slave GPIO Controller 79 * Super I/O Controller 80 * PCI-Express 1 Controller 81 * Graphic Display Controller 82 * MCTP Controller 83 * Mailbox Controller 84 * Virtual UART 85 * eSPI Controller 86 87Boot options 88------------ 89 90The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options 91to load a Linux kernel or from a firmware. Images can be downloaded from the 92OpenBMC jenkins : 93 94 https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/ 95 96or directly from the OpenBMC GitHub release repository : 97 98 https://github.com/openbmc/openbmc/releases 99 100or directly from the ASPEED Forked OpenBMC GitHub release repository : 101 102 https://github.com/AspeedTech-BMC/openbmc/releases 103 104Booting from a kernel image 105^^^^^^^^^^^^^^^^^^^^^^^^^^^ 106 107To boot a kernel directly from a Linux build tree: 108 109.. code-block:: bash 110 111 $ qemu-system-arm -M ast2600-evb -nographic \ 112 -kernel arch/arm/boot/zImage \ 113 -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \ 114 -initrd rootfs.cpio 115 116Booting from a flash image 117^^^^^^^^^^^^^^^^^^^^^^^^^^^ 118 119The machine options specific to Aspeed to boot from a flash image are : 120 121 * ``execute-in-place`` which emulates the boot from the CE0 flash 122 device by using the FMC controller to load the instructions, and 123 not simply from RAM. This takes a little longer. 124 125 * ``fmc-model`` to change the default FMC Flash model. FW needs 126 support for the chip model to boot. 127 128 * ``spi-model`` to change the default SPI Flash model. 129 130To boot the machine from the flash image, use an MTD drive : 131 132.. code-block:: bash 133 134 $ qemu-system-arm -M romulus-bmc -nic user \ 135 -drive file=obmc-phosphor-image-romulus.static.mtd,format=raw,if=mtd -nographic 136 137To use other flash models, for instance a different FMC chip and a 138bigger (64M) SPI for the ``ast2500-evb`` machine, run : 139 140.. code-block:: bash 141 142 -M ast2500-evb,fmc-model=mx25l25635e,spi-model=mx66u51235f 143 144When more flexibility is needed to define the flash devices, to use 145different flash models or define all flash devices (up to 8), the 146``-nodefaults`` QEMU option can be used to avoid creating the default 147flash devices. 148 149Flash devices should then be created from the command line and attached 150to a block device : 151 152.. code-block:: bash 153 154 $ qemu-system-arm -M ast2600-evb \ 155 -blockdev node-name=fmc0,driver=file,filename=/path/to/fmc0.img \ 156 -device mx66u51235f,bus=ssi.0,cs=0x0,drive=fmc0 \ 157 -blockdev node-name=fmc1,driver=file,filename=/path/to/fmc1.img \ 158 -device mx66u51235f,bus=ssi.0,cs=0x1,drive=fmc1 \ 159 -blockdev node-name=spi1,driver=file,filename=/path/to/spi1.img \ 160 -device mx66u51235f,cs=0x0,bus=ssi.1,drive=spi1 \ 161 -nographic -nodefaults 162 163In that case, the machine boots fetching instructions from the FMC0 164device. It is slower to start but closer to what HW does. Using the 165machine option ``execute-in-place`` has a similar effect. 166 167Booting from an eMMC image 168^^^^^^^^^^^^^^^^^^^^^^^^^^ 169 170The machine options specific to Aspeed machines to boot from an eMMC 171image are : 172 173 * ``boot-emmc`` to set or unset boot from eMMC (AST2600). 174 175Only the ``ast2600-evb`` and ``rainier-emmc`` machines have support to 176boot from an eMMC device. In this case, the machine assumes that the 177eMMC image includes special boot partitions. Such an image can be 178built this way : 179 180.. code-block:: bash 181 182 $ dd if=/dev/zero of=mmc-bootarea.img count=2 bs=1M 183 $ dd if=u-boot-spl.bin of=mmc-bootarea.img conv=notrunc 184 $ dd if=u-boot.bin of=mmc-bootarea.img conv=notrunc count=64 bs=1K 185 $ cat mmc-bootarea.img obmc-phosphor-image.wic > mmc.img 186 $ truncate --size 16GB mmc.img 187 188Boot the machine ``rainier-emmc`` with : 189 190.. code-block:: bash 191 192 $ qemu-system-arm -M rainier-bmc \ 193 -drive file=mmc.img,format=raw,if=sd,index=2 \ 194 -nographic 195 196The ``boot-emmc`` option can be set or unset, to change the default 197boot mode of machine: SPI or eMMC. This can be useful to boot the 198``ast2600-evb`` machine from an eMMC device (default being SPI) or to 199boot the ``rainier-bmc`` machine from a flash device (default being 200eMMC). 201 202As an example, here is how to to boot the ``rainier-bmc`` machine from 203the flash device with ``boot-emmc=false`` and let the machine use an 204eMMC image : 205 206.. code-block:: bash 207 208 $ qemu-system-arm -M rainier-bmc,boot-emmc=false \ 209 -drive file=flash.img,format=raw,if=mtd \ 210 -drive file=mmc.img,format=raw,if=sd,index=2 \ 211 -nographic 212 213It should be noted that in this case the eMMC device must not have 214boot partitions, otherwise the contents will not be accessible to the 215machine. This limitation is due to the use of the ``-drive`` 216interface. 217 218Ideally, one should be able to define the eMMC device and the 219associated backend directly on the command line, such as : 220 221.. code-block:: bash 222 223 -blockdev node-name=emmc0,driver=file,filename=mmc.img \ 224 -device emmc,bus=sdhci-bus.2,drive=emmc0,boot-partition-size=1048576,boot-config=8 225 226This is not yet supported (as of QEMU-10.0). Work is needed to 227refactor the sdhci bus model. 228 229Other booting options 230^^^^^^^^^^^^^^^^^^^^^ 231 232Other machine options specific to Aspeed machines are : 233 234 * ``bmc-console`` to change the default console device. Most of the 235 machines use the ``UART5`` device for a boot console, which is 236 mapped on ``/dev/ttyS4`` under Linux, but it is not always the 237 case. 238 239To change the boot console and use device ``UART3`` (``/dev/ttyS2`` 240under Linux), use : 241 242.. code-block:: bash 243 244 -M ast2500-evb,bmc-console=uart3 245 246Aspeed 2700 family boards (``ast2700-evb``) 247================================================================== 248 249The QEMU Aspeed machines model BMCs of Aspeed evaluation boards. 250They are based on different releases of the Aspeed SoC : 251the AST2700 with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz). 252 253The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 254etc. 255 256AST2700 SoC based machines : 257 258- ``ast2700-evb`` Aspeed AST2700 Evaluation board (Cortex-A35) 259- ``ast2700fc`` Aspeed AST2700 Evaluation board (Cortex-A35 + Cortex-M4) 260 261Supported devices 262----------------- 263 * Interrupt Controller 264 * Timer Controller 265 * RTC Controller 266 * I2C Controller 267 * System Control Unit (SCU) 268 * SRAM mapping 269 * X-DMA Controller (basic interface) 270 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 271 * SPI Memory Controller 272 * USB 2.0 Controller 273 * SD/MMC storage controllers 274 * SDRAM controller (dummy interface for basic settings and training) 275 * Watchdog Controller 276 * GPIO Controller (Master only) 277 * UART 278 * Ethernet controllers 279 * Front LEDs (PCA9552 on I2C bus) 280 * LPC Peripheral Controller (a subset of subdevices are supported) 281 * Hash/Crypto Engine (HACE) - Hash support only. TODO: Crypto 282 * ADC 283 * eMMC Boot Controller (dummy) 284 * PECI Controller (minimal) 285 * I3C Controller 286 * Internal Bridge Controller (SLI dummy) 287 288Missing devices 289--------------- 290 * PWM and Fan Controller 291 * Slave GPIO Controller 292 * Super I/O Controller 293 * PCI-Express 1 Controller 294 * Graphic Display Controller 295 * MCTP Controller 296 * Mailbox Controller 297 * Virtual UART 298 * eSPI Controller 299 300Boot options 301------------ 302 303Images can be downloaded from the ASPEED Forked OpenBMC GitHub release repository : 304 305 https://github.com/AspeedTech-BMC/openbmc/releases 306 307Booting the ast2700-evb machine 308^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 309 310Boot the AST2700 machine from the flash image. 311 312There are two supported methods for booting the AST2700 machine with a flash image: 313 314Manual boot using ``-device loader``: 315 316It causes all 4 CPU cores to start execution from address ``0x430000000``, which 317corresponds to the BL31 image load address. 318 319.. code-block:: bash 320 321 IMGDIR=ast2700-default 322 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 323 324 $ qemu-system-aarch64 -M ast2700-evb \ 325 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 326 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 327 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 328 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 329 -device loader,cpu-num=0,addr=0x430000000 \ 330 -device loader,cpu-num=1,addr=0x430000000 \ 331 -device loader,cpu-num=2,addr=0x430000000 \ 332 -device loader,cpu-num=3,addr=0x430000000 \ 333 -smp 4 \ 334 -drive file=${IMGDIR}/image-bmc,format=raw,if=mtd \ 335 -nographic 336 337Boot using a virtual boot ROM (``-bios``): 338 339If users do not specify the ``-bios option``, QEMU will attempt to load the 340default vbootrom image ``ast27x0_bootrom.bin`` from either the current working 341directory or the ``pc-bios`` directory within the QEMU source tree. 342 343.. code-block:: bash 344 345 $ qemu-system-aarch64 -M ast2700-evb \ 346 -drive file=image-bmc,format=raw,if=mtd \ 347 -nographic 348 349The ``-bios`` option allows users to specify a custom path for the vbootrom 350image to be loaded during boot. This will load the vbootrom image from the 351specified path in the ${HOME} directory. 352 353.. code-block:: bash 354 355 -bios ${HOME}/ast27x0_bootrom.bin 356 357Booting the ast2700fc machine 358^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 359 360AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors. 361**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors, 362**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors. 363 364Steps to boot the AST2700fc machine: 365 3661. Ensure you have the following AST2700A1 binaries available in a directory 367 368 * u-boot-nodtb.bin 369 * u-boot.dtb 370 * bl31.bin 371 * optee/tee-raw.bin 372 * image-bmc 373 * zephyr-aspeed-ssp.elf (for SSP firmware, CPU 5) 374 * zephyr-aspeed-tsp.elf (for TSP firmware, CPU 6) 375 3762. Execute the following command to start ``ast2700fc`` machine: 377 378.. code-block:: bash 379 380 IMGDIR=ast2700-default 381 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 382 383 $ qemu-system-aarch64 -M ast2700fc \ 384 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 385 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 386 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 387 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 388 -device loader,cpu-num=0,addr=0x430000000 \ 389 -device loader,cpu-num=1,addr=0x430000000 \ 390 -device loader,cpu-num=2,addr=0x430000000 \ 391 -device loader,cpu-num=3,addr=0x430000000 \ 392 -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \ 393 -device loader,file=${IMGDIR}/zephyr-aspeed-ssp.elf,cpu-num=4 \ 394 -device loader,file=${IMGDIR}/zephyr-aspeed-tsp.elf,cpu-num=5 \ 395 -serial pty -serial pty -serial pty \ 396 -snapshot \ 397 -S -nographic 398 399After launching QEMU, serial devices will be automatically redirected. 400Example output: 401 402.. code-block:: bash 403 404 char device redirected to /dev/pts/55 (label serial0) 405 char device redirected to /dev/pts/56 (label serial1) 406 char device redirected to /dev/pts/57 (label serial2) 407 408- serial0: Console for the four Cortex-A35 primary processors. 409- serial1 and serial2: Consoles for the two Cortex-M4 coprocessors. 410 411Use ``tio`` or another terminal emulator to connect to the consoles: 412 413.. code-block:: bash 414 415 $ tio /dev/pts/55 416 $ tio /dev/pts/56 417 $ tio /dev/pts/57 418 419 420Aspeed minibmc family boards (``ast1030-evb``) 421================================================================== 422 423The QEMU Aspeed machines model mini BMCs of various Aspeed evaluation 424boards. They are based on different releases of the 425Aspeed SoC : the AST1030 integrating an ARM Cortex M4F CPU (200MHz). 426 427The SoC comes with SRAM, SPI, I2C, etc. 428 429AST1030 SoC based machines : 430 431- ``ast1030-evb`` Aspeed AST1030 Evaluation board (Cortex-M4F) 432 433Supported devices 434----------------- 435 436 * SMP (for the AST1030 Cortex-M4F) 437 * Interrupt Controller (VIC) 438 * Timer Controller 439 * I2C Controller 440 * System Control Unit (SCU) 441 * SRAM mapping 442 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 443 * SPI Memory Controller 444 * USB 2.0 Controller 445 * Watchdog Controller 446 * GPIO Controller (Master only) 447 * UART 448 * LPC Peripheral Controller (a subset of subdevices are supported) 449 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 450 * ADC 451 * Secure Boot Controller 452 * PECI Controller (minimal) 453 454 455Missing devices 456--------------- 457 458 * PWM and Fan Controller 459 * Slave GPIO Controller 460 * Mailbox Controller 461 * Virtual UART 462 * eSPI Controller 463 * I3C Controller 464 465Boot options 466------------ 467 468The Aspeed machines can be started using the ``-kernel`` to load a 469Zephyr OS or from a firmware. Images can be downloaded from the 470ASPEED GitHub release repository : 471 472 https://github.com/AspeedTech-BMC/zephyr/releases 473 474To boot a kernel directly from a Zephyr build tree: 475 476.. code-block:: bash 477 478 $ qemu-system-arm -M ast1030-evb -nographic \ 479 -kernel zephyr.elf 480