Differences
This shows you the differences between two versions of the page.
|
ass:laboratoare:01:tasks:02 [2023/07/10 23:09] radu.mantu |
ass:laboratoare:01:tasks:02 [2024/08/04 22:07] (current) florin.stancu [02. Creating the Firmware Image Package] |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ==== 01. [??p] Creating the Firmware Image Package ==== | + | ==== 02. Creating the Firmware Image Package ==== |
| - | This package will contain **bl2**, **bl31** and **bl33**. The Secure OS (**bl32**) is outside the scope of this lab; even if we did bother to include it, it would just //be there//, doing nothing. | + | This package will contain **BL2**, **BL31** and **BL33**. The Secure OS (**BL32**) is outside the scope of this lab; even if we did bother to include it, it would just //be there//, doing nothing. |
| - | Following this exercise, we should be able to reach the first step of the booting sequence that //can// be interactive; meaning that we'll be able to interact with a shell implemented in **bl33**. | + | Following this exercise, we should be able to reach the first step of the booting sequence that //can// be interactive; meaning that we'll be able to interact with a shell implemented in **BL33**. |
| - | === [??p] Task A - bl31: the Runtime Software === | + | === 02-A. Trusted Firmware-A (BL31) === |
| - | For this component we'll be using the [[https://github.com/nxp-imx/imx-atf|Trusted Firmware-A]] project. Although it contains reference implementations for the other bootloaders as well, we are going to use it strictly for **bl31**. The other have more complete and widely recognized alternatives available. | + | Never mind the fact that we begin with **BL31**, you can consider it a warmup. |
| - | We recommend reading [[https://trustedfirmware-a.readthedocs.io/en/latest/getting_started/initial-build.html|the documentation]] moving forward. Take a close look at [[https://trustedfirmware-a.readthedocs.io/en/latest/getting_started/build-options.html|the build options]] in particular. | + | For this, we'll be using the [[https://github.com/nxp-imx/imx-atf|Trusted Firmware-A]] project. |
| + | Although it contains reference implementations for the other bootloader components as well, we are going to use it strictly for **BL31**. The others have more complete and widely recognized alternatives available. | ||
| - | <note warning> | + | We recommend reading [[https://trustedfirmware-a.readthedocs.io/en/latest/getting_started/initial-build.html|the documentation]] before moving forward. |
| - | Normally, we'd be using the [[https://www.trustedfirmware.org/projects/tf-a/|official TF-A]] but at the moment it seems to have a linker script bug for our platform. Reason why we use the NXP fork of TF-A. | + | Also use [[https://trustedfirmware-a.readthedocs.io/en/latest/getting_started/build-options.html|the build options]] as reference. |
| + | |||
| + | In particular, search for the keys to specifying the platform, cross compiler, the secure payload dispatcher (we will need to tell it that we need none, also read below); additionally, controlling logging levels and specifying console device (UART) is always useful for when you run into problems! | ||
| + | |||
| + | <note info> | ||
| + | The most challenging part is finding the right platform. | ||
| + | |||
| + | But remember: when the documentation lacks form, you can always read [[https://github.com/nxp-imx/imx-atf/tree/lf_v2.6/plat/imx/imx8m|the source code]] ;) | ||
| </note> | </note> | ||
| + | |||
| + | == Step 1. Build ARM Trusted Firmware-A (ATF / TF-A) == | ||
| + | |||
| + | Following a successful build process, you should obtain a **bl31.bin** file (take note if its location, for you will need it later). | ||
| <note tip> | <note tip> | ||
| - | * The default target platform is ARM's Fixed Virtual Platform (FVP), a simulator. That is not our platform... | + | The default target platform is ARM's Fixed Virtual Platform (FVP), a simulator. \\ |
| - | * To specify that we don't have a **bl32** for it to initialize, pass it ''SPD=none''. | + | To specify that we don't have a **BL32** for it to initialize, pass it ''SPD=none''. \\ |
| - | * You don't have to build everything. Just ''make ... bl31''. | + | You don't have to build everything. Just ''make ... bl31''. |
| </note> | </note> | ||
| + | |||
| + | <note> | ||
| + | Normally, we'd be using the [[https://www.trustedfirmware.org/projects/tf-a/|official TF-A]] but at the moment it seems to have a linker script bug for our platform. Reason why we use the NXP fork of TF-A instead. | ||
| + | </note> | ||
| + | |||
| + | === 02-B. Download the firmware === | ||
| + | |||
| + | With **BL31** out of the way, we are going to tackle **BL2** next (of course, **BL1** is the first one to be loaded, but, fortunately, it comes carved inside our chip -- into Read Only Memory). | ||
| + | |||
| + | **BL1** is actually loaded from the SoC's ROM in the first half of the available Static RAM (the On-Chip RAM). | ||
| + | This SRAM is just 128KB in size (remember, SRAM is quite expensive, similar to a cache memory), so there's not much space left for loading additional software. | ||
| + | |||
| + | Afterwards, **BL1** loads **BL2** in the upper half of SRAM and it stops here! the remainder of the firmware image is ignored. | ||
| + | At this point it's up to **BL2** to enable the rest of the memory (2GB of DRAM) and finish loading the rest of the FIP in main memory. | ||
| + | |||
| + | However, . So **BL2** is to initialize the hardware using the proprietary firmware offered by the chip manufacturer. | ||
| + | Without this firmware, we don't even have access to the DRAM memory. | ||
| + | |||
| + | == Step 2. Fetch the NXP IMX proprietary firmware == | ||
| + | |||
| + | Simply go [[http://sources.buildroot.net/firmware-imx/|here]] and download the self-extracting archive. | ||
| + | After this, run it and accept the license agreement in order for it to extract its contents | ||
| + | (oh, and since we're on Linux, don't forget to apply to executable bit -- ''chmod +x <filename>''). | ||
| + | |||
| + | What we're actually interested in are the following files: | ||
| + | * ''lpddr4_pmu_train_1d_dmem.bin'' | ||
| + | * ''lpddr4_pmu_train_1d_imem.bin'' | ||
| + | * ''lpddr4_pmu_train_2d_dmem.bin'' | ||
| + | * ''lpddr4_pmu_train_2d_imem.bin'' | ||
| + | * ''signed_hdmi_imx8m.bin'' | ||
| + | |||
| + | |||
| + | === 02-C. Build U-Boot (both BL2 and BL33) === | ||
| + | |||
| + | For the last two components of our Firmware Package we'll be using [[https://github.com/TechNexion/u-boot-tn-imx|this U-Boot fork]] (clone it!). | ||
| + | Each of them has a very specific purpose. | ||
| + | |||
| + | At first, **BL1** will //start// downloading the FIP (Firmware Image Package, which we'll generate later) using the Serial Download Protocol, running on top of a USB connection. | ||
| + | Once it finishes receiving **BL2** (together with the firmware binaries from Task B), it cedes control to it instead. **BL2** will initialize the DRAM using said firmware and then continue where **BL1** left off, finishing the download of the FIP. | ||
| + | |||
| + | <note warning> | ||
| + | The more astute will notice that, **once again**, we're not using the [[https://github.com/u-boot/u-boot|official U-Boot]] project, but instead TechNexion's (i.e. the board's manufacturer) fork. | ||
| + | As we've mentioned before, **BL2** will have to take over the serial download over USB from **BL1**. | ||
| + | However, it can not reuse the drivers that **BL1** was using. | ||
| + | Mainly because it overrides **BL1** in SRAM with **BL31**. | ||
| + | |||
| + | So... what's the problem? | ||
| + | Since the release of our board, U-Boot has seen some improvements with respect to certain drivers that are necessary to us. | ||
| + | These improvements increased the size of **BL2** to the point that it no longer fits in the board's SRAM (''128KB :( ''). | ||
| + | |||
| + | Even with Link Time Optimizations which usually help in this regard, and with some attempts at removing useless drivers (we've wasted 1 day trying to do it), it's still <del>a pain in the ass</del> challenging to make everything fit. | ||
| + | The TechNexion fork has the advantage of being slightly outdated and having been tested at some point by one of their developers. | ||
| + | </note> | ||
| + | |||
| + | When **BL31** runs its course, **BL33** will be called upon. During this phase we'll finally have an interactive shell and multiple drivers to help interact with the board. With this, we can investigate the board's hardware, read and potentially override the partitions in the persistent storage and most importantly, boot Linux from any number of sources. | ||
| + | |||
| + | == Step 3: Generate the configuration == | ||
| + | |||
| + | Alright, let's get to it! | ||
| + | U-Boot is based on the same build system as the Linux kernel, namely [[https://www.kernel.org/doc/html/latest/kbuild/index.html|Kbuild]]. To get an idea of what functionality it provides, try to run: | ||
| + | |||
| + | <code bash> | ||
| + | $ make help | ||
| + | </code> | ||
| + | |||
| + | If you check the ''configs/'' directory, you will find a number of board-specific configuration files. These serve as templates, containing the minimal necessary configuration. By running ''make some_defconfig'' the Kbuild system will determine what other unspecified options need to be enabled in order for these features to be functional. The result will be saved in a file called ''.config''. | ||
| + | |||
| + | Generate a ''.config'' for your board by running the ''make <board's name>_defconfig''. | ||
| + | |||
| + | Also, don't forget the ''CROSS_COMPILE'' variable from **BL31** (you've exported it, right? if not, pass it as ''KEY=VALUE''' argument to make). | ||
| + | It's very common across such projects and Kbuild will actually complain if it sees that you're trying to use a x86 compiler. | ||
| + | |||
| + | == Step 4: Modify the configuration == | ||
| + | |||
| + | The default configuration that you chose (correctly, hopefully) contains a few erroneous values for the USB driver. | ||
| + | Normally these would take some time to dig up from the board's / processor's documentation / source code; we took them from the debug prints of the firmware that was pre-configured on the eMMC :P | ||
| + | |||
| + | Open a ncurses-based interface for editing the ''.config'' file: | ||
| + | <code bash> | ||
| + | $ make CROSS_COMPILE=... menuconfig | ||
| + | </code> | ||
| + | |||
| + | The interface should be fairly intuitive. Use the Arrow keys to navigate the entries, Space to toggle options on or off, Enter to dive into a submenu or open a prompt, and the ''?'' key to get more information about the currently selected entry. If you see a letter highlighted in a different color, pressing the corresponding key will take you to that option. Note that multiple options can have the same keybind; pressing it will cycle you through to the next occurrence. | ||
| + | |||
| + | The search function for a specific option (by name) is the exact same as in **less** or **vim**: ''/[CONFIG_]MY_OPTION <Enter>''. This will generate a list of potential matches, each bearing a numeric index. Press the key corresponding to that index in order to jump to the search result. | ||
| + | |||
| + | For now, change the following config variables and save the changes to ''.config'': | ||
| + | * **USB_GADGET_MANUFACTURER:** ASS | ||
| + | * **USB_GADGET_VENDOR_NUM:** 0x1fc9 | ||
| + | * **USB_GADGET_PRODUCT_NUM:** 0x012b | ||
| + | |||
| + | == Step 5: Build it! == | ||
| + | |||
| + | Run the make command (again, don't forget the cross compiler argument, if you haven't exported it already)! | ||
| + | |||
| + | The three files you should obtain are: | ||
| + | |||
| + | * **spl/u-boot-spl.bin:** aka. **BL2**. | ||
| + | * **u-boot-nodtb.bin:** aka. **BL33**. | ||
| + | * **arch/arm/dts/imx8mq-pico-pi.dtb:** a Device Tree Blob (DTB) which we'll also require; see details below. | ||
| + | |||
| + | <note> | ||
| + | You may be wondering what is up with the //.dtb// file. This file is a Device Tree Blob (DTB) and represents the hardware available on the board. | ||
| + | |||
| + | On most ARM platforms this is required since there is no Device Enumeration method, unlike on most x86 systems (e.g.: [[https://kernel.org/doc/html/v5.18/firmware-guide/acpi/enumeration.html|ACPI]]). | ||
| + | |||
| + | Without it, Linux would have no idea how to identify or interact with its devices or what drivers to put in charge of managing them. We are going to discuss this topic more in-depth next session. For now, if you are curious, you can decompile the DTB into a human-readable Device Tree Source (DTS): | ||
| + | |||
| + | <code bash> | ||
| + | # press Q to exit the paginator :p | ||
| + | $ dtc -I dtb -O dts imx8mq-pico-pi.dtb | less | ||
| + | </code> | ||
| + | Of course, you could find the original code by [[https://github.com/TechNexion/u-boot-tn-imx/blob/tn-imx_v2022.04_5.15.71_2.2.0-stable/arch/arm/dts/imx8mq-pico-pi.dts|exploring u-boot's source code]]! | ||
| + | </note> | ||
| + | |||
| + | === Task D - Generate the firmware package === | ||
| + | |||
| + | Now that we have all necessary binaries either downloaded or compiled ourselves, all that is left is to combine them in a manner that can be understood by the processor's first boot stage (**BL1**). | ||
| + | |||
| + | Since 2022, U-Boot's tool of choice for this task is [[https://u-boot.readthedocs.io/en/latest/develop/package/binman.html|binman]]. This tool uses a platform-specific config file that specifies what components should be included and where they should be placed in memory. For our platform (i.e.: i.MX8M Quad) this file would be ''arch/arm/dts/imx8mq-u-boot.dtsi''. | ||
| + | |||
| + | **However**, since the U-Boot version that we are using is older and [[https://github.com/TechNexion/u-boot-tn-imx/commit/ca11907c0e7b7efd22f037793295fb0427e05ecb|the board manufacturer did not add proper support for binman]], **we are going to use the older method**, based on [[https://linux.die.net/man/1/mkimage|mkimage]] (part of the U-Boot repo or as a package on most distros). In order to spare ourselves some pain, we are going to use NXP's [[https://github.com/nxp-imx/imx-mkimage/tree/lf-5.15.32_2.0.0|imx-mkimage]] implementation which knows the proper offsets where the images should be loaded. | ||
| + | |||
| + | In their source tree you will find a number of subdirectories corresponding to different versions of the i.MX platform. Select the one which corresponds to our board (remember, the base model is called //iMX8M//). | ||
| + | When you get there, you will have to copy all the bootloaders you compiled so far, as well as the downloaded firmware (trust us here: **make a script to do this automatically**! you'll need to do it tens -- probably hundreds -- of times!). | ||
| + | |||
| + | In addition to these, you will have to copy the base **mkimage** tool (generated in the U-Boot directory, see if you can ''find'' it '';)'' ); rename it as **mkimage_uboot**. | ||
| + | |||
| + | Once you have all these, run make with the ''flash_evk'' target, while specifying the platform in the ''SOC='' make argument, and the name of the DTB copied over from U-Boot in the ''dtbs='' argument. The output firmware image should be called **flash.bin**. | ||
| + | |||
| + | <note> | ||
| + | Alongside **flash.bin**, you may also notice a **u-boot.itb**, another DTB file. This file was generated based on the **imx8mq-pico-pi.dtb** that we specified in the ''dtbs'' argument, and contains the configuration of each bootloader in memory: | ||
| + | |||
| + | <code bash> | ||
| + | $ dtc -I dtb -O dts u-boot.itb | less | ||
| + | </code> | ||
| + | |||
| + | The last two sub-tasks demonstrate that the DTB format is very versatile. On one hand, it is used to describe the available hardware to the Linux kernel. On the other hand, image packaging tools rely on them to determine the layout of different binaries in memory. | ||
| + | </note> | ||
| + | |||
