1Aspeed family boards (``ast2500-evb``, ``ast2600-evb``, ``ast2700-evb``, ``ast2700fc``, ``bletchley-bmc``, ``fuji-bmc``, ``fby35-bmc``, ``fp5280g2-bmc``, ``g220a-bmc``, ``palmetto-bmc``, ``qcom-dc-scm-v1-bmc``, ``qcom-firework-bmc``, ``quanta-q71l-bmc``, ``rainier-bmc``, ``romulus-bmc``, ``sonorapass-bmc``, ``supermicrox11-bmc``, ``supermicrox11spi-bmc``, ``tiogapass-bmc``, ``witherspoon-bmc``, ``yosemitev2-bmc``) 2================================================================================================================================================================================================================================================================================================================================================================================================================================= 3 4The QEMU Aspeed machines model BMCs of various OpenPOWER systems and 5Aspeed evaluation boards. They are based on different releases of the 6Aspeed SoC : the AST2400 integrating an ARM926EJ-S CPU (400MHz), the 7AST2500 with an ARM1176JZS CPU (800MHz), the AST2600 8with dual cores ARM Cortex-A7 CPUs (1.2GHz). 9 10The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 11etc. 12 13AST2400 SoC based machines : 14 15- ``palmetto-bmc`` OpenPOWER Palmetto POWER8 BMC 16- ``quanta-q71l-bmc`` OpenBMC Quanta BMC 17- ``supermicrox11-bmc`` Supermicro X11 BMC (ARM926EJ-S) 18- ``supermicrox11spi-bmc`` Supermicro X11 SPI BMC (ARM1176) 19 20AST2500 SoC based machines : 21 22- ``ast2500-evb`` Aspeed AST2500 Evaluation board 23- ``romulus-bmc`` OpenPOWER Romulus POWER9 BMC 24- ``witherspoon-bmc`` OpenPOWER Witherspoon POWER9 BMC 25- ``sonorapass-bmc`` OCP SonoraPass BMC 26- ``fp5280g2-bmc`` Inspur FP5280G2 BMC 27- ``g220a-bmc`` Bytedance G220A BMC 28- ``yosemitev2-bmc`` Facebook YosemiteV2 BMC 29- ``tiogapass-bmc`` Facebook Tiogapass BMC 30 31AST2600 SoC based machines : 32 33- ``ast2600-evb`` Aspeed AST2600 Evaluation board (Cortex-A7) 34- ``rainier-bmc`` IBM Rainier POWER10 BMC 35- ``fuji-bmc`` Facebook Fuji BMC 36- ``bletchley-bmc`` Facebook Bletchley BMC 37- ``fby35-bmc`` Facebook fby35 BMC 38- ``qcom-dc-scm-v1-bmc`` Qualcomm DC-SCM V1 BMC 39- ``qcom-firework-bmc`` Qualcomm Firework BMC 40 41Supported devices 42----------------- 43 44 * SMP (for the AST2600 Cortex-A7) 45 * Interrupt Controller (VIC) 46 * Timer Controller 47 * RTC Controller 48 * I2C Controller, including the new register interface of the AST2600 49 * System Control Unit (SCU) 50 * SRAM mapping 51 * X-DMA Controller (basic interface) 52 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 53 * SPI Memory Controller 54 * USB 2.0 Controller 55 * SD/MMC storage controllers 56 * SDRAM controller (dummy interface for basic settings and training) 57 * Watchdog Controller 58 * GPIO Controller (Master only) 59 * UART 60 * Ethernet controllers 61 * Front LEDs (PCA9552 on I2C bus) 62 * LPC Peripheral Controller (a subset of subdevices are supported) 63 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 64 * ADC 65 * Secure Boot Controller (AST2600) 66 * eMMC Boot Controller (dummy) 67 * PECI Controller (minimal) 68 * I3C Controller 69 * Internal Bridge Controller (SLI dummy) 70 71 72Missing devices 73--------------- 74 75 * Coprocessor support 76 * PWM and Fan Controller 77 * Slave GPIO Controller 78 * Super I/O Controller 79 * PCI-Express 1 Controller 80 * Graphic Display Controller 81 * MCTP Controller 82 * Mailbox Controller 83 * Virtual UART 84 * eSPI Controller 85 86Boot options 87------------ 88 89The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options 90to load a Linux kernel or from a firmware. Images can be downloaded from the 91OpenBMC jenkins : 92 93 https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/ 94 95or directly from the OpenBMC GitHub release repository : 96 97 https://github.com/openbmc/openbmc/releases 98 99or directly from the ASPEED Forked OpenBMC GitHub release repository : 100 101 https://github.com/AspeedTech-BMC/openbmc/releases 102 103Booting from a kernel image 104^^^^^^^^^^^^^^^^^^^^^^^^^^^ 105 106To boot a kernel directly from a Linux build tree: 107 108.. code-block:: bash 109 110 $ qemu-system-arm -M ast2600-evb -nographic \ 111 -kernel arch/arm/boot/zImage \ 112 -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \ 113 -initrd rootfs.cpio 114 115Booting from a flash image 116^^^^^^^^^^^^^^^^^^^^^^^^^^^ 117 118The machine options specific to Aspeed to boot from a flash image are : 119 120 * ``execute-in-place`` which emulates the boot from the CE0 flash 121 device by using the FMC controller to load the instructions, and 122 not simply from RAM. This takes a little longer. 123 124 * ``fmc-model`` to change the default FMC Flash model. FW needs 125 support for the chip model to boot. 126 127 * ``spi-model`` to change the default SPI Flash model. 128 129To boot the machine from the flash image, use an MTD drive : 130 131.. code-block:: bash 132 133 $ qemu-system-arm -M romulus-bmc -nic user \ 134 -drive file=obmc-phosphor-image-romulus.static.mtd,format=raw,if=mtd -nographic 135 136To use other flash models, for instance a different FMC chip and a 137bigger (64M) SPI for the ``ast2500-evb`` machine, run : 138 139.. code-block:: bash 140 141 -M ast2500-evb,fmc-model=mx25l25635e,spi-model=mx66u51235f 142 143When more flexibility is needed to define the flash devices, to use 144different flash models or define all flash devices (up to 8), the 145``-nodefaults`` QEMU option can be used to avoid creating the default 146flash devices. 147 148Flash devices should then be created from the command line and attached 149to a block device : 150 151.. code-block:: bash 152 153 $ qemu-system-arm -M ast2600-evb \ 154 -blockdev node-name=fmc0,driver=file,filename=/path/to/fmc0.img \ 155 -device mx66u51235f,bus=ssi.0,cs=0x0,drive=fmc0 \ 156 -blockdev node-name=fmc1,driver=file,filename=/path/to/fmc1.img \ 157 -device mx66u51235f,bus=ssi.0,cs=0x1,drive=fmc1 \ 158 -blockdev node-name=spi1,driver=file,filename=/path/to/spi1.img \ 159 -device mx66u51235f,cs=0x0,bus=ssi.1,drive=spi1 \ 160 -nographic -nodefaults 161 162In that case, the machine boots fetching instructions from the FMC0 163device. It is slower to start but closer to what HW does. Using the 164machine option ``execute-in-place`` has a similar effect. 165 166Booting from an eMMC image 167^^^^^^^^^^^^^^^^^^^^^^^^^^ 168 169The machine options specific to Aspeed machines to boot from an eMMC 170image are : 171 172 * ``boot-emmc`` to set or unset boot from eMMC (AST2600). 173 174Only the ``ast2600-evb`` and ``rainier-emmc`` machines have support to 175boot from an eMMC device. In this case, the machine assumes that the 176eMMC image includes special boot partitions. Such an image can be 177built this way : 178 179.. code-block:: bash 180 181 $ dd if=/dev/zero of=mmc-bootarea.img count=2 bs=1M 182 $ dd if=u-boot-spl.bin of=mmc-bootarea.img conv=notrunc 183 $ dd if=u-boot.bin of=mmc-bootarea.img conv=notrunc count=64 bs=1K 184 $ cat mmc-bootarea.img obmc-phosphor-image.wic > mmc.img 185 $ truncate --size 16GB mmc.img 186 187Boot the machine ``rainier-emmc`` with : 188 189.. code-block:: bash 190 191 $ qemu-system-arm -M rainier-bmc \ 192 -drive file=mmc.img,format=raw,if=sd,index=2 \ 193 -nographic 194 195The ``boot-emmc`` option can be set or unset, to change the default 196boot mode of machine: SPI or eMMC. This can be useful to boot the 197``ast2600-evb`` machine from an eMMC device (default being SPI) or to 198boot the ``rainier-bmc`` machine from a flash device (default being 199eMMC). 200 201As an example, here is how to to boot the ``rainier-bmc`` machine from 202the flash device with ``boot-emmc=false`` and let the machine use an 203eMMC image : 204 205.. code-block:: bash 206 207 $ qemu-system-arm -M rainier-bmc,boot-emmc=false \ 208 -drive file=flash.img,format=raw,if=mtd \ 209 -drive file=mmc.img,format=raw,if=sd,index=2 \ 210 -nographic 211 212It should be noted that in this case the eMMC device must not have 213boot partitions, otherwise the contents will not be accessible to the 214machine. This limitation is due to the use of the ``-drive`` 215interface. 216 217Ideally, one should be able to define the eMMC device and the 218associated backend directly on the command line, such as : 219 220.. code-block:: bash 221 222 -blockdev node-name=emmc0,driver=file,filename=mmc.img \ 223 -device emmc,bus=sdhci-bus.2,drive=emmc0,boot-partition-size=1048576,boot-config=8 224 225This is not yet supported (as of QEMU-10.0). Work is needed to 226refactor the sdhci bus model. 227 228Other booting options 229^^^^^^^^^^^^^^^^^^^^^ 230 231Other machine options specific to Aspeed machines are : 232 233 * ``bmc-console`` to change the default console device. Most of the 234 machines use the ``UART5`` device for a boot console, which is 235 mapped on ``/dev/ttyS4`` under Linux, but it is not always the 236 case. 237 238To change the boot console and use device ``UART3`` (``/dev/ttyS2`` 239under Linux), use : 240 241.. code-block:: bash 242 243 -M ast2500-evb,bmc-console=uart3 244 245Aspeed 2700 family boards (``ast2700-evb``) 246================================================================== 247 248The QEMU Aspeed machines model BMCs of Aspeed evaluation boards. 249They are based on different releases of the Aspeed SoC : 250the AST2700 with quad cores ARM Cortex-A35 64 bits CPUs (1.6GHz). 251 252The SoC comes with RAM, Gigabit ethernet, USB, SD/MMC, USB, SPI, I2C, 253etc. 254 255AST2700 SoC based machines : 256 257- ``ast2700-evb`` Aspeed AST2700 Evaluation board (Cortex-A35) 258- ``ast2700fc`` Aspeed AST2700 Evaluation board (Cortex-A35 + Cortex-M4) 259 260Supported devices 261----------------- 262 * Interrupt Controller 263 * Timer Controller 264 * RTC Controller 265 * I2C Controller 266 * System Control Unit (SCU) 267 * SRAM mapping 268 * X-DMA Controller (basic interface) 269 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 270 * SPI Memory Controller 271 * USB 2.0 Controller 272 * SD/MMC storage controllers 273 * SDRAM controller (dummy interface for basic settings and training) 274 * Watchdog Controller 275 * GPIO Controller (Master only) 276 * UART 277 * Ethernet controllers 278 * Front LEDs (PCA9552 on I2C bus) 279 * LPC Peripheral Controller (a subset of subdevices are supported) 280 * Hash/Crypto Engine (HACE) - Hash support only. TODO: Crypto 281 * ADC 282 * eMMC Boot Controller (dummy) 283 * PECI Controller (minimal) 284 * I3C Controller 285 * Internal Bridge Controller (SLI dummy) 286 287Missing devices 288--------------- 289 * PWM and Fan Controller 290 * Slave GPIO Controller 291 * Super I/O Controller 292 * PCI-Express 1 Controller 293 * Graphic Display Controller 294 * MCTP Controller 295 * Mailbox Controller 296 * Virtual UART 297 * eSPI Controller 298 299Boot options 300------------ 301 302Images can be downloaded from the ASPEED Forked OpenBMC GitHub release repository : 303 304 https://github.com/AspeedTech-BMC/openbmc/releases 305 306Booting the ast2700-evb machine 307^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 308 309Boot the AST2700 machine from the flash image. 310 311There are two supported methods for booting the AST2700 machine with a flash image: 312 313Manual boot using ``-device loader``: 314 315It causes all 4 CPU cores to start execution from address ``0x430000000``, which 316corresponds to the BL31 image load address. 317 318.. code-block:: bash 319 320 IMGDIR=ast2700-default 321 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 322 323 $ qemu-system-aarch64 -M ast2700-evb \ 324 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 325 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 326 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 327 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 328 -device loader,cpu-num=0,addr=0x430000000 \ 329 -device loader,cpu-num=1,addr=0x430000000 \ 330 -device loader,cpu-num=2,addr=0x430000000 \ 331 -device loader,cpu-num=3,addr=0x430000000 \ 332 -smp 4 \ 333 -drive file=${IMGDIR}/image-bmc,format=raw,if=mtd \ 334 -nographic 335 336Boot using a virtual boot ROM (``-bios``): 337 338If users do not specify the ``-bios option``, QEMU will attempt to load the 339default vbootrom image ``ast27x0_bootrom.bin`` from either the current working 340directory or the ``pc-bios`` directory within the QEMU source tree. 341 342.. code-block:: bash 343 344 $ qemu-system-aarch64 -M ast2700-evb \ 345 -drive file=image-bmc,format=raw,if=mtd \ 346 -nographic 347 348The ``-bios`` option allows users to specify a custom path for the vbootrom 349image to be loaded during boot. This will load the vbootrom image from the 350specified path in the ${HOME} directory. 351 352.. code-block:: bash 353 354 -bios ${HOME}/ast27x0_bootrom.bin 355 356Booting the ast2700fc machine 357^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 358 359AST2700 features four Cortex-A35 primary processors and two Cortex-M4 coprocessors. 360**ast2700-evb** machine focuses on emulating the four Cortex-A35 primary processors, 361**ast2700fc** machine extends **ast2700-evb** by adding support for the two Cortex-M4 coprocessors. 362 363Steps to boot the AST2700fc machine: 364 3651. Ensure you have the following AST2700A1 binaries available in a directory 366 367 * u-boot-nodtb.bin 368 * u-boot.dtb 369 * bl31.bin 370 * optee/tee-raw.bin 371 * image-bmc 372 * zephyr-aspeed-ssp.elf (for SSP firmware, CPU 5) 373 * zephyr-aspeed-tsp.elf (for TSP firmware, CPU 6) 374 3752. Execute the following command to start ``ast2700fc`` machine: 376 377.. code-block:: bash 378 379 IMGDIR=ast2700-default 380 UBOOT_SIZE=$(stat --format=%s -L ${IMGDIR}/u-boot-nodtb.bin) 381 382 $ qemu-system-aarch64 -M ast2700fc \ 383 -device loader,force-raw=on,addr=0x400000000,file=${IMGDIR}/u-boot-nodtb.bin \ 384 -device loader,force-raw=on,addr=$((0x400000000 + ${UBOOT_SIZE})),file=${IMGDIR}/u-boot.dtb \ 385 -device loader,force-raw=on,addr=0x430000000,file=${IMGDIR}/bl31.bin \ 386 -device loader,force-raw=on,addr=0x430080000,file=${IMGDIR}/optee/tee-raw.bin \ 387 -device loader,cpu-num=0,addr=0x430000000 \ 388 -device loader,cpu-num=1,addr=0x430000000 \ 389 -device loader,cpu-num=2,addr=0x430000000 \ 390 -device loader,cpu-num=3,addr=0x430000000 \ 391 -drive file=${IMGDIR}/image-bmc,if=mtd,format=raw \ 392 -device loader,file=${IMGDIR}/zephyr-aspeed-ssp.elf,cpu-num=4 \ 393 -device loader,file=${IMGDIR}/zephyr-aspeed-tsp.elf,cpu-num=5 \ 394 -serial pty -serial pty -serial pty \ 395 -snapshot \ 396 -S -nographic 397 398After launching QEMU, serial devices will be automatically redirected. 399Example output: 400 401.. code-block:: bash 402 403 char device redirected to /dev/pts/55 (label serial0) 404 char device redirected to /dev/pts/56 (label serial1) 405 char device redirected to /dev/pts/57 (label serial2) 406 407- serial0: Console for the four Cortex-A35 primary processors. 408- serial1 and serial2: Consoles for the two Cortex-M4 coprocessors. 409 410Use ``tio`` or another terminal emulator to connect to the consoles: 411 412.. code-block:: bash 413 414 $ tio /dev/pts/55 415 $ tio /dev/pts/56 416 $ tio /dev/pts/57 417 418 419Aspeed minibmc family boards (``ast1030-evb``) 420================================================================== 421 422The QEMU Aspeed machines model mini BMCs of various Aspeed evaluation 423boards. They are based on different releases of the 424Aspeed SoC : the AST1030 integrating an ARM Cortex M4F CPU (200MHz). 425 426The SoC comes with SRAM, SPI, I2C, etc. 427 428AST1030 SoC based machines : 429 430- ``ast1030-evb`` Aspeed AST1030 Evaluation board (Cortex-M4F) 431 432Supported devices 433----------------- 434 435 * SMP (for the AST1030 Cortex-M4F) 436 * Interrupt Controller (VIC) 437 * Timer Controller 438 * I2C Controller 439 * System Control Unit (SCU) 440 * SRAM mapping 441 * Static Memory Controller (SMC or FMC) - Only SPI Flash support 442 * SPI Memory Controller 443 * USB 2.0 Controller 444 * Watchdog Controller 445 * GPIO Controller (Master only) 446 * UART 447 * LPC Peripheral Controller (a subset of subdevices are supported) 448 * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA 449 * ADC 450 * Secure Boot Controller 451 * PECI Controller (minimal) 452 453 454Missing devices 455--------------- 456 457 * PWM and Fan Controller 458 * Slave GPIO Controller 459 * Mailbox Controller 460 * Virtual UART 461 * eSPI Controller 462 * I3C Controller 463 464Boot options 465------------ 466 467The Aspeed machines can be started using the ``-kernel`` to load a 468Zephyr OS or from a firmware. Images can be downloaded from the 469ASPEED GitHub release repository : 470 471 https://github.com/AspeedTech-BMC/zephyr/releases 472 473To boot a kernel directly from a Zephyr build tree: 474 475.. code-block:: bash 476 477 $ qemu-system-arm -M ast1030-evb -nographic \ 478 -kernel zephyr.elf 479