On Mon, Apr 27, 2026 at 6:48 PM Steven Lee via qemu development
wrote:
>
> The ASPEED AST2700fc SoC integrates the Caliptra Root of Trust
> (Caliptra 1.2 core). Moving forward, we expect more SoCs to adopt
> Caliptra cores (e.g., Caliptra 2.x). Currently, QEMU does not have
> a native Caliptra emulator.
>
> The official `caliptra-sw` project provides a fully functional
> emulator with C-bindings. As a Proof of Concept, this RFC integrates
> the external `caliptra-sw` C-binding model into QEMU to enable booting
> the AST2700fc machine.
>
> This RFC does not propose merging the current PoC design as-is.
> Instead, it is intended to explore possible approaches for adding
> Caliptra support in QEMU and to gather early feedback from the
> community on architecture and integration strategy.
What about a socket approach instead? That's what QEMU currently uses
for TPM and SPDM support. It means there are no build time
dependencies, you can just launch the Caliptra "server" and have QEMU
connect to it.
Then the "server" will be a simple translation layer between requests
on the socket and the C-bindings you talk about above.
>
> In this PoC, the `caliptra-sw` emulator is used as a reference model
> to enable early bring-up and validation of the AST2700fc secure boot
> flow, rather than as a final implementation choice. The integration is
> based on the `caliptra-1.2` branch of the official repository:
> https://github.com/chipsalliance/caliptra-sw/tree/caliptra-1.2
>
> To avoid making normal ASPEED/AArch64 builds depend on a local external
> checkout, the c-binding backend is compiled only when the PoC detects
> the generated `caliptra-sw` c-binding header and static library in the
> expected sibling source tree. A mergeable version would need an
> explicit configure option and a proper dependency integration.
This sounds tricky to get distros to pick up this dependency.
>
> For context, the actual hardware boot flow on the AST2700fc relies on a
> dedicated RISC-V core (bootmcu) to orchestrate the secure boot:
>
> 1. bootmcu executes its ROM code.
> 2. bootmcu releases the Caliptra core from reset.
> 3. Caliptra requests its FMC and Runtime (RT) firmware.
> 4. bootmcu loads the Caliptra FMC/RT images into Caliptra's mailbox.
> 5. Caliptra ROM verifies the signature of the Caliptra FMC/RT images.
> 6. Caliptra boots into its FMC and RT environments.
> 7. bootmcu requests Caliptra RT to verify the bootmcu's own FMC.
> 8. bootmcu executes its FMC.
> 9. bootmcu requests Caliptra to verify the BMC (Cortex-A35) firmware.
In the server model this would all happen outside QEMU, QEMU would
just wait for reset to be released
Alistair
> 10. BMC (Cortex-A35) firmware begins execution.
>
> Since QEMU currently lacks a `bootmcu` model and the associated mailbox
> interactions with Caliptra, this PoC simplifies the boot flow by using
> a background thread and the `caliptra_model_boot_default` C-binding to
> simulate steps 1 through 6.
>
> To approximate the hardware behavior where the Cortex-A35 CPUs remain
> in reset until secure boot is completed, this PoC uses
> `vm_stop_force_state()` as a temporary approximation.
>
> This approach is intentionally simplified and not intended to reflect
> the final QEMU design. In particular, the use of a background thread
> and global VM control APIs may not align with QEMU device model
> expectations, and alternative approaches are encouraged.
>
> Signed-off-by: Steven Lee
> ---
> MAINTAINERS | 2 +
> docs/system/arm/aspeed.rst | 20 +++
> include/hw/arm/aspeed_caliptra_emu.h | 17 ++
> hw/arm/aspeed_ast27x0-fc.c | 60 +++
> hw/arm/aspeed_caliptra_emu.c | 259 +++
> hw/arm/meson.build | 31 +++-
> 6 files changed, 388 insertions(+), 1 deletion(-)
> create mode 100644 include/hw/arm/aspeed_caliptra_emu.h
> create mode 100644 hw/arm/aspeed_caliptra_emu.c
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index ad215eced8..376959dfd2 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -1254,6 +1254,8 @@ L: [email protected]
> S: Maintained
> F: hw/*/*aspeed*
> F: include/hw/*/*aspeed*
> +F: hw/arm/aspeed_caliptra_emu.c
> +F: include/hw/arm/aspeed_caliptra_emu.h
> F: hw/net/ftgmac100.c
> F: include/hw/net/ftgmac100.h
> F: docs/system/arm/aspeed.rst
> diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
> index d0054a7dbb..656924262b 100644
> --- a/docs/system/arm/aspeed.rst
> +++ b/docs/system/arm/aspeed.rst
> @@ -423,6 +423,26 @@ Steps to boot the AST2700fc machine:
> -snapshot \
> -S -nographic
>
> +The ``ast2700fc`` machine can also boot a Caliptra emulator through the
> +``caliptra-sw`` c-binding before starting the Cortex-A35 processors. The ROM
> +and firmware bundle are configured with the ``caliptra-rom`` and
> +``caliptra-firmware`` machine properties.
> +
> +This RFC PoC backend is built only when a local ``../cal
