00:08
dlan has quit [Quit: leaving]
00:08
dlan has joined #linux-amlogic
00:32
vagrantc has quit [Quit: leaving]
00:38
ffhguy has quit [Ping timeout: 268 seconds]
01:05
naoki has joined #linux-amlogic
01:48
camus has joined #linux-amlogic
03:19
buzzmarshall has quit [Quit: Konversation terminated!]
04:03
ffhguy has joined #linux-amlogic
05:01
naoki has quit [Quit: naoki]
06:00
camus has quit [*.net *.split]
06:00
gis has quit [*.net *.split]
06:00
iprusov has quit [*.net *.split]
06:00
adema has quit [*.net *.split]
06:00
narmstrong has quit [*.net *.split]
06:00
paddymahoney has quit [*.net *.split]
06:00
shoragan has quit [*.net *.split]
06:00
khilman has quit [*.net *.split]
06:00
gis has joined #linux-amlogic
06:00
khilman has joined #linux-amlogic
06:01
paddymahoney has joined #linux-amlogic
06:01
shoragan has joined #linux-amlogic
06:01
narmstrong has joined #linux-amlogic
06:01
shoragan has joined #linux-amlogic
06:01
shoragan has quit [Changing host]
06:02
camus has joined #linux-amlogic
06:02
adema has joined #linux-amlogic
06:04
iprusov has joined #linux-amlogic
07:24
Daanct12 has joined #linux-amlogic
08:15
Daanct12 has quit [Ping timeout: 240 seconds]
08:15
Daanct12 has joined #linux-amlogic
10:12
f_ has joined #linux-amlogic
10:14
f_[xmpp] has quit [Ping timeout: 246 seconds]
10:14
<
f_ >
I guess let's first try to load an SCP firmware.
11:22
<
narmstrong >
f_: loading an scp fw would make the system ready for Linux
11:23
Daanct12 has quit [Ping timeout: 265 seconds]
11:23
Daanct12 has joined #linux-amlogic
11:32
anessen976 has joined #linux-amlogic
11:34
anessen97 has quit [Ping timeout: 246 seconds]
11:34
anessen976 is now known as anessen97
11:40
Daanct12 has quit [Ping timeout: 250 seconds]
11:42
Daanct12 has joined #linux-amlogic
12:04
Daanct12 has quit [Quit: WeeChat 3.8]
12:17
<
f_ >
And that would also be the next thing I'll be reverse-engineering.
12:18
<
f_ >
But meh. For now let's try loading the proprietary one.
12:18
<
f_ >
Still. BL31 still doesn't want to get loaded.
12:18
<
f_ >
Or...BL2 still doesn't want to load BL31.
12:18
<
f_ >
But meh. Let's shelf that and try loading the SCP fw instead.
12:18
<
f_ >
SCP firmware/SCP_BL2/BL30 =)
12:36
<
f_ >
narmstrong: What is the SCP firmware supposed to do, though?
12:36
buzzmarshall has joined #linux-amlogic
12:37
<
narmstrong >
f_: is does the cpu clock and power management
12:37
<
narmstrong >
Bl31 passes scpi commands to it
12:38
<
f_ >
So it is required.
12:38
<
f_ >
Thought it was optional.
12:39
<
f_ >
What's weird, still, is the fact that BL31 doesn't want to load..at the very least it should output errors.
13:40
jacobk has joined #linux-amlogic
13:41
JohnnyonFlame has quit [Ping timeout: 240 seconds]
14:14
cottsay has quit [Ping timeout: 265 seconds]
14:14
dlan has quit [Ping timeout: 265 seconds]
14:14
cottsay has joined #linux-amlogic
14:14
kilobyte_ch has quit [Ping timeout: 265 seconds]
14:15
dlan has joined #linux-amlogic
14:15
kilobyte_ch has joined #linux-amlogic
14:56
<
f_ >
narmstrong: Does TF-A BL31 also pass SCPI commands to SCP?
14:57
<
narmstrong >
f_: yes
14:57
<
f_ >
Let's get SCP_BL2 to run then!
14:58
<
f_ >
I've seen though that Amlogic's old BL2 sources load SCP_BL2 inside mailbox.c
15:00
<
f_ >
Speaking of BL30...
15:06
<
f_ >
BTW narmstrong: do you think I'm spamming too much in here?
15:10
<
f_ >
Hope I'm not but if you think I am then I'll try lowering the volume of my messages :P
15:12
<
narmstrong >
f_: not at all, continue :-)
15:13
<
f_ >
So the fact that they load BL30 inside plat/gxb/mailbox.c makes me think they use a mailbox for that..looking at BL31 code I see Antonio implemented some sort of mailbox, too!
15:14
<
f_ >
Well. I guess the mailbox is required to talk to the SCP.
15:15
<
f_ >
Well. At least Amlogic did sort of a good job at trying to load BL30 -- their code is understandable at the very least.
15:30
<
f_ >
Now is time to study that code. I hope they didn't do spaghetti code on that one.
15:30
<
f_ >
112 │ memcpy((void *)MB_SRAM_BASE, (const void *)sha2, sha2_length);
15:31
<
f_ >
I think that MB_SRAM_BASE is a constant defined using #define..
15:31
<
f_ >
97 │ *(unsigned int *)MB_SRAM_BASE = size;
15:31
<
f_ >
What is up with their coding style?
15:32
<
f_ >
And I see that send_bl30x is called inside common/fip.c
15:33
<
f_ >
(which is amlogic code, as in, no ARM Limited copyright)
15:33
JohnnyonFlame has joined #linux-amlogic
15:33
<
f_ >
They didn't even limit their lines to 80 chars.
15:34
<
f_ >
narmstrong: But wait a second
15:34
<
f_ >
81 │ #if (NEED_BL301)
15:34
<
f_ >
82 │ /*load and process bl301*/
15:34
<
f_ >
Is BL301 supposed to be loaded separately?
15:36
<
narmstrong >
Yep bl301 needs to be loaded into the scp after the scp fW is loaded
15:36
<
narmstrong >
Is contains « platforms specific » scp code
15:37
<
f_ >
Yeah I know..but was BL301 intended to be loaded separately? Because in the amlogic-boot-fip repo we embed BL301 into BL30.
15:37
<
f_ >
And let BL2 load the BL30 binary (right?)
15:40
<
f_ >
In their outdated code BL2 is supposed to print out when it's loading BL301
15:41
<
f_ >
(this is by using the WeTek Play2 BL2)
15:41
<
f_ >
It just mentions BL30.
15:43
<
f_ >
Now that I think about it...afaerber's BL2 is dated Nov 25 2015, but mine is dated Oct 11 2016..
15:46
<
f_ >
Assuming afaerber's BL2 is an untouched ODROID-C2 BL2, it seems like BL2 originally loaded BL301 separately from BL30, or NEED_BL301 was disabled in my binary.
15:46
<
f_ >
I need to know if:
15:47
<
f_ >
if BL30 can live on without BL301, and if not, if it loads BL301 itself or if BL2 loads it.
15:47
<
f_ >
It could still be possible that Amlogic chose the silently load BL301, too...
15:48
<
f_ >
Anyway....let's find the entry point of SCP_BL2/BL30
15:48
<
f_ >
89 │ process_bl30x(&bl301_image_info, &bl301_ep_info, "bl301");
15:48
<
f_ >
It's used right here.
15:48
<
f_ >
84 │ entry_point_info_t bl301_ep_info;
15:48
<
f_ >
And defined 4 lines earler.
15:49
<
f_ >
Let's look at process_bl30x.
15:50
<
f_ >
Basically runs what I assume is SHA256/SHA224 checksumming and passes that, along with the rest of its arguments to send_bl30x().
15:50
<
f_ >
188 │ /*process bl30x, transfer to m3, etc..*/
15:50
<
f_ >
189 │ void process_bl30x(image_info_t *image_data,
15:50
<
f_ >
190 │ entry_point_info_t *entry_point_info, const char * name)
15:51
<
f_ >
^~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~ this is unused
15:51
<
f_ >
Argh. I was close.
15:51
<
f_ >
But yeah, this argument is unused in that function!
15:52
<
f_ >
It just passes img_data->base and img_data->size
15:52
<
f_ >
212 │ send_bl30x(image_data->image_base, image_data->image_size, \
15:52
<
f_ >
213 │ _sha2, sizeof(_sha2), name);
15:53
<
f_ >
Along with the name (presumabely equal to string "bl30" or "bl301") and the result of the checksum as well as its size.
15:53
<
f_ >
Going back to send_bl30x.
15:57
<
f_ >
97 │ *(unsigned int *)MB_SRAM_BASE = size;
15:57
<
f_ >
remember that? they set MB_SRAM_BASE to image_data->image_site..
15:58
<
f_ >
I wonder why they wrote it in all caps though...but I think MB means MailBox.
15:58
<
f_ >
So it might be the Mailbox base in secure RAM?
15:59
<
f_ >
But they set it to the size of the image, which doesn't make much sense to me..
16:18
<
f_ >
110 │ mb_send_data(CMD_DATA_LEN, 3);
16:18
<
f_ >
Going to mb_send_data
16:20
<
f_ >
30 │ void mb_send_data(uint32_t val, uint32_t port)
16:21
<
f_ >
And let's see what CMD_DATA_LEN is.
16:22
<
f_ >
git grep is my friend here
16:22
<
f_ >
git[master] ~thelinuxmacbook:amlogic-bl2 -mksh$ git grep CMD_DATA_LEN
16:22
<
f_ >
plat/gxb/include/mailbox.h:#define CMD_DATA_LEN 0xc0dec0d0
16:25
<
f_ >
Maybe Amlogic documented the mailbox in their public datasheets?
16:30
<
f_ >
I'm just trying to get the entry point
16:32
<
f_ >
74 │ entry_point_info_t bl30_ep_info;
16:32
<
f_ >
75 │ nBL3XLoadAddr = nSecFlag ? FM_FIP_BL3X_TEMP_LOAD_ADDR : FM_BL30_LOAD_ADDR;
16:32
<
f_ >
76 │ storage_load(BL2_SIZE + (fip_header->bl30_entry.offset),nBL3XLoadAddr, (fip_header->bl30_entry.size), "bl30");
16:32
<
f_ >
77 │ parse_blx(&bl30_image_info, &bl30_ep_info,nBL3XLoadAddr, FM_BL30_LOAD_ADDR, (fip_header->bl30_entry.size),nAESFlag);
16:32
<
f_ >
git[master] ~thelinuxmacbook:amlogic-bl2 -mksh$ git grep FM_BL30_LOAD_ADDR
16:32
<
f_ >
include/common/fip.h:#define FM_BL30_LOAD_ADDR CONFIG_SYS_TEXT_BASE
16:33
<
f_ >
git[master] ~thelinuxmacbook:amlogic-bl2 -mksh$ git grep FM_FIP_BL3X_TEMP_LOAD_ADDR
16:33
<
f_ >
include/common/fip.h:#define FM_FIP_BL3X_TEMP_LOAD_ADDR (BL2_SEC_BOOT_BUF_BASE) /*tmp addr for bl3x load & process for secure boot*/
16:34
<
f_ >
I guess "nSecFlag" means secure boot flag?
16:34
<
f_ >
So it is really = to CONFIG_SYS_TEXT_BASE
16:35
<
f_ >
CONFIG_SYS_TEXT_BASE is a U-Boot configuration value.
16:36
<
f_ >
Looking at their U-Boot fork...
16:36
<
f_ >
arch/arm/include/asm/arch-gxb/cpu.h:#define CONFIG_SYS_TEXT_BASE 0x01000000 /*16MB rsv*/
16:37
<
f_ >
So the load address is 0x01000000
16:37
<
f_ >
If I recall correctly it's the same value as in CONFIG_TEXT_BASE in modern U-Boot, right?
16:37
<
f_ >
I didn't have to look for that much time....see reference UART logs:
16:37
<
f_ >
Load bl30 from SD, src: 0x00010000, des: 0x01000000, size: 0x0000d460
16:50
<
f_ >
I need to set the SCP_BL2 UUID as well.
16:51
<
f_ >
12 #define UUID_SCP_FIRMWARE_SCP_BL2 \¬
16:51
<
f_ >
11 ﲒ {{0x97, 0x66, 0xfd, 0x3d}, {0x89, 0xbe}, {0xe8, 0x49}, 0xae, 0x5d, {0x78, 0xa1, 0x40, 0x60, 0x82, 0x13} }¬
16:51
<
f_ >
Let's use this UUID.
16:53
<
f_ >
Oh..image id != UUID
17:21
<
f_ >
VERBOSE: FIP header looks OK.
17:21
<
f_ >
VERBOSE: Using FIP
17:21
<
f_ >
INFO: Loading image id=2 at address 0x1000000
17:21
<
f_ >
GXBB:BL1:08dafd:0a8993;FEAT:EDFC318C;POC:3;RCY:0;EMMC:0;READ:0;CHK:F3;SD:0;READ:0;
17:22
<
f_ >
Will push what I have though.
17:26
<
f_ >
I don't know why it doesn't want to load
*any* image at all though...feedback welcome
17:31
<
f_ >
Any TF-A experts here? lol
17:45
<
f_ >
Might as well send them a email to their mailing list.
17:46
<
f_ >
(just telling them that I'm porting gxbb to TF-A BL2 and the status and all that..)
19:31
tetrakist has joined #linux-amlogic
19:34
f_ has quit [Quit: disconnecting ·_· oh hi By the way.]
21:02
JohnnyonF has joined #linux-amlogic
21:06
JohnnyonFlame has quit [Ping timeout: 250 seconds]
21:23
vagrantc has joined #linux-amlogic