ASPEED AST2050
The AST2050 chipset is an Integrated Remote Management Processor introduced by ASPEED Technology Inc. It is a high performance and highly integrated SOC device designed to support various management functions required for server platforms which require baseboard management, virtual storage functions, and/or KVM-over-IP functions.
Open source support for the AST2050's VGA output (text-mode only) was implemented in coreboot by Raptor Engineering[1]. Full VGA output support requires ASPEED's closed source VGABIOS to be included in the coreboot rom. A rudimentary port of OpenBMC was also developed by Raptor Engineering[2].
Official Documentation
OpenBMC
OpenBMC was developed by Raptor Engineering for the KGPE-D16 and KCMA-D8 motherboards[3] as an open source replacement to the closed source BMC firmware.
This version of OpenBMC for the AST2050 has had various components updated, removed, or reconfigured. Broken links to fetch dependencies have been fixed (as of 20251208). Review the git commits for more details.
Updated Components
- OpenSSH (from 6.7p1 to 8.7p1)
- OpenSSL (from 1.0.2d to 1.0.2r)
Removed Components
- fan-ctrl (inferior to native fan control)
- rest-api (insecure HTTP access to the BMC)
- ipmid (unsupported)
- sms-kcsd (unsupported)
- lmsensors (unsupported)
- flashrom (unsupported)
Configuration Changes
- ast2050-yocto-poky/meta/recipes-connectivity/openssh/openssh/sshd_config
- Password Authentication Disabled
- ast2050-yocto-poky/meta/recipes-core/base-files/base-files_3.0.14.bb
- Configured to install ast2050-yocto-poky/build/downloads/root_authorized_keys to /home/root/.ssh/authorized_keys
- ast2050-yocto-openbmc/meta-raptor/meta-asus/recipes-utils/openbmc-utils/openbmc-utils_%.bbappend
- Disabled autostarting the mainboard
- ast2050-yocto-openbmc/common/recipes-connectivity/dhcp/files/dhclient.conf
- Set the networking hostname to 'openbmc'
Compiling from source
Compilation has been tested on Debian 9.
Debian 9 Dependencies
apt-get install gawk wget git-core diffstat unzip texinfo gcc-multilib autotools-dev build-essential chrpath socat libsdl1.2-dev xterm python cpio
Create the missing /etc/perl/find.pl file[4]
warn "Legacy library @{[(caller(0))[6]]} will be removed from the Perl core distribution in the next major release. Please install it from the CPAN distribution Perl4::CoreLibs. It is being used at @{[(caller)[1]]}, line @{[(caller)[2]]}.\n";
# This library is deprecated and unmaintained. It is included for
# compatibility with Perl 4 scripts which may use it, but it will be
# removed in a future version of Perl. Please use the File::Find module
# instead.
# Usage:
# require "find.pl";
#
# &find('/foo','/bar');
#
# sub wanted { ... }
# where wanted does whatever you want. $dir contains the
# current directory name, and $_ the current filename within
# that directory. $name contains "$dir/$_". You are cd'ed
# to $dir when the function is called. The function may
# set $prune to prune the tree.
#
# For example,
#
# find / -name .nfs\* -mtime +7 -exec rm -f {} \; -o -fstype nfs -prune
#
# corresponds to this
#
# sub wanted {
# /^\.nfs.*$/ &&
# (($dev,$ino,$mode,$nlink,$uid,$gid) = lstat($_)) &&
# int(-M _) > 7 &&
# unlink($_)
# ||
# ($nlink || (($dev,$ino,$mode,$nlink,$uid,$gid) = lstat($_))) &&
# $dev < 0 &&
# ($prune = 1);
# }
#
# Set the variable $dont_use_nlink if you're using AFS, since AFS cheats.
use File::Find ();
*name = *File::Find::name;
*prune = *File::Find::prune;
*dir = *File::Find::dir;
*topdir = *File::Find::topdir;
*topdev = *File::Find::topdev;
*topino = *File::Find::topino;
*topmode = *File::Find::topmode;
*topnlink = *File::Find::topnlink;
sub find {
&File::Find::find(\&wanted, @_);
}
1;
/etc/perl/find.pl md5sum: 129bb8ba7bd008f350f1863a49034b7e
Configuring and Compiling
### Fetch Sources git clone -b fido https://git.15h.org/mrothfuss/ast2050-yocto-poky.git ast2050-yocto-poky cd ast2050-yocto-poky git clone -b fido https://git.15h.org/mrothfuss/ast2050-yocto-openembedded.git meta-openembedded git clone https://git.15h.org/mrothfuss/ast2050-yocto-openbmc.git meta-openbmc ### Setup Build export TEMPLATECONF=meta-openbmc/meta-raptor/meta-asus/conf source oe-init-build-env cp -Rp ../local-aspeed.conf conf/local.conf touch conf/sanity.conf ### Optional: Set root password # The default root password is 0penBmc. # Generate a new encrypted password string: printf "%q\n" $(openssl passwd -1) # Edit the config file (EXTRA_USERS_PARAMS), replace the password hash with the one you generated. vim conf/local.conf ### Optional: Set the networking hostname # The default is openbmc vim ../meta-openbmc/common/recipes-connectivity/dhcp/files/dhclient.conf ### Required: Add your SSH key(s) vim ./downloads/root_authorized_keys ### Build. Your ROM will be at tmp/deploy/images/asus/flash-asus-DATETIME bitbake asus-image
Flashing the BMC
The BMC module can be flashed either internally or externally. Users report mixed results when flashing internally using Raptor Engineering's method.
External Flashing
Connect the BMC module's S25FL128P chip to an external flasher using the 8 pins that are shared between the SOIC16 and other SOIC8 chips (CS, DO, WP, GND, VCC, HOLD, CLK, and DI). Make sure your flasher is set to output 3.3V when flashing the BMC module.
flashrom --programmer=ch341a_spi -c "S25FL128P......0" --verbose -w flash-asus-DATETIME
Internal Flashing
Raptor Engineering released a custom version of flashrom that can flash the BMC module from an operating system running on the KGPE-D16 or KCMA-D8 motherboard.
flashrom --programmer="ast1100:spibus=2" -c "S25FL128P......0" --verbose -w flash-asus-DATETIME
Using the BMC
Scan your network for a new device listening on port 22, then login with ssh. It can take up to 7 minutes for sshd to start on the first boot.
nmap -p 22 10.0.0.1/24 ssh root@IPADDR
You can set the ethernet MAC address to match the one printed on the BMC module. The BMC IP will likely change after setting the MAC address and rebooting.
fw_setenv ethaddr 01:23:45:67:89:ab reboot
You can access COM2 with screen:
screen -h 0 /dev/ttyS0 115200
You can use the asus_power.sh command to view/change power states.
asus_power.sh status asus_power.sh on asus_power.sh reset asus_power.sh off
Development Tips
Delete a previously built recipe
bitbake -c cleansstate <recipe>
Delete all previously built components
rm -rf sstate-cache/ tmp/
DIY Modules
The ASUS ASMB4 and ASMB5 modules are simply breakout boards for SPI flash. You can make these yourself.
Some PCB schematics are available here.
PCBs are available for purchase here.
OEM Firmware
The ASMB4 and ASMB5 BMC firmware modules come with some OEM firmware.
Source Code
Partial source code for the OEM firmware is available as of writing from ASUS. It includes the source for some IPMI command handlers, so you can construct some raw OEM commands for ipmitool.
SSH Access
The OEM firmware includes SSH access, which is apparently undocumented.
The firmware's OpenSSH version is ancient. Modern SSH clients need to enable some deprecated options to connect.
ssh -o KexAlgorithms=+diffie-hellman-group-exchange-sha1,diffie-hellman-group1-sha1 -o HostKeyAlgorithms=+ssh-rsa admin@bmc
On my firmware, the shell is busybox instead of smash. Some OEM binaries are around:
$ ls /usr/local/bin/ IPMB LAN Timer cdserver discovery gpiotool peciapp smash webgo IPMIMain MsgHndlr adviserd cpConf fdserver mkMiniMe pwmtachtool snmpd KCS SOL adviserd_capture defaulthost flasher ncsiapp rtcapp ssmtp
There also appears to be a backdoor root password, distinct from the default "admin" account:
$ cat /etc/shadow root:$1$A17c6z5w$5OsdHjBn1pjvN6xXKDckq0:2:0:99999:7:0:99999:0 anonymous:$1$A17c6z5w$Ec7by585G3BAPJHK5dFCq.:2:0:99999:7:0:99999:2147482704
Serial-over-LAN
On the KCMA-D8 and KGPE-D16, the SuperIO's second serial port is normally routed to the rectangular connector on the board. When any BMC firmware module is connected, this serial port is instead routed to the AST2050 for BMC access. The rectangular connector is disabled.
Coreboot-15h can be configured to use this second serial port. This allows serial-over-lan access to coreboot output and the SeaBIOS boot menu. SeaBIOS in turn sets up a VGA BIOS which redirects input and output to the serial port. "Text mode" payloads like iPXE can thus be via serial-over-LAN, with no extra configuration in the payload.
You may need to change the BMC's baud rate. Under OEM BMC firmware, the best way is ipmitool:
ipmitool -H bmcip -I lanplus sol set non-volatile-bit-rate 115.2 ipmitool -H bmcip -I lanplus sol set volatile-bit-rate 115.2
The following coreboot build config can be used for serial-over-LAN access:
--- configs/config.asus_kcma-d8_seabios_ucode_no-oproms_2mb 2026-06-17 19:41:00.108813619 +0000 +++ .config 2026-07-03 07:50:20.433551464 +0000 @@ -89,7 +89,7 @@ CONFIG_MAINBOARD_PART_NUMBER="KCMA-D8" CONFIG_MAX_CPUS=16 CONFIG_CBFS_SIZE=0x200000 -CONFIG_UART_FOR_CONSOLE=0 +CONFIG_UART_FOR_CONSOLE=1 CONFIG_PAYLOAD_CONFIGFILE="" CONFIG_MAINBOARD_VENDOR="ASUS" CONFIG_HW_MEM_HOLE_SIZEK=0x200000 @@ -212,7 +212,7 @@ # CONFIG_PCIEXP_ASPM is not set # CONFIG_PCIEXP_COMMON_CLOCK is not set # CONFIG_PCIEXP_CLK_PM is not set -CONFIG_TTYS0_BASE=0x3f8 +CONFIG_TTYS0_BASE=0x2f8 CONFIG_HPET_MIN_TICKS=0x37EE CONFIG_UART_PCI_ADDR=0x0 # CONFIG_SOC_MEDIATEK_MT8173 is not set @@ -548,7 +548,7 @@ # # -# Serial port base address = 0x3f8 +# Serial port base address = 0x2f8 # # CONFIG_CONSOLE_SERIAL_921600 is not set # CONFIG_CONSOLE_SERIAL_460800 is not set @@ -629,7 +629,8 @@ # CONFIG_SEABIOS_OPROM_VGAONLY is not set # CONFIG_SEABIOS_OPROM_ALL is not set CONFIG_SEABIOS_BOOTORDER_FILE="" -# CONFIG_SEABIOS_ADD_SERCON_PORT_FILE is not set +CONFIG_SEABIOS_ADD_SERCON_PORT_FILE=y +CONFIG_SEABIOS_SERCON_PORT_ADDR=0x2f8 CONFIG_PAYLOAD_VGABIOS_FILE="payloads/external/SeaBIOS/seabios/out/vgabios.bin" CONFIG_SEABIOS_DEBUG_LEVEL=-1
Quirks
- Shared-LAN interferes with remote functions: If the OEM BMC firmware is in "shared LAN" mode (the host and BMC share the LAN port), then any time the host (re-)initializes the ethernet controller, the BMC's network connectivity is momentarily disrupted. In particular when coreboot/SeaBIOS initialize devices, a serial-over-LAN session may get disrupted, and not come back. Remote media functions are similarly disrupted long enough that SeaBIOS will not see them, making it impossible to boot from remote media. Using the separate "management LAN" interface fixes these problems. It may be that the OEM BMC firmware interacts better with OEM BIOS than it does with coreboot for this case.