narmstrong changed the topic of #linux-amlogic to: Amlogic mainline kernel development discussion - our wiki http://linux-meson.com/ - ml linux-amlogic@lists.infradead.org - official channel moved from Freenode - publicly logged on https://libera.irclog.whitequark.org/linux-amlogic
dlan has quit [Quit: leaving]
dlan has joined #linux-amlogic
vagrantc has quit [Quit: leaving]
ffhguy has quit [Ping timeout: 268 seconds]
naoki has joined #linux-amlogic
camus has joined #linux-amlogic
buzzmarshall has quit [Quit: Konversation terminated!]
ffhguy has joined #linux-amlogic
naoki has quit [Quit: naoki]
camus has quit [*.net *.split]
gis has quit [*.net *.split]
iprusov has quit [*.net *.split]
adema has quit [*.net *.split]
narmstrong has quit [*.net *.split]
paddymahoney has quit [*.net *.split]
shoragan has quit [*.net *.split]
khilman has quit [*.net *.split]
gis has joined #linux-amlogic
khilman has joined #linux-amlogic
paddymahoney has joined #linux-amlogic
shoragan has joined #linux-amlogic
narmstrong has joined #linux-amlogic
shoragan has joined #linux-amlogic
shoragan has quit [Changing host]
camus has joined #linux-amlogic
adema has joined #linux-amlogic
iprusov has joined #linux-amlogic
Daanct12 has joined #linux-amlogic
Daanct12 has quit [Ping timeout: 240 seconds]
Daanct12 has joined #linux-amlogic
f_ has joined #linux-amlogic
f_[xmpp] has quit [Ping timeout: 246 seconds]
<f_> I guess let's first try to load an SCP firmware.
<f_> Hi BTW!
<narmstrong> f_: loading an scp fw would make the system ready for Linux
Daanct12 has quit [Ping timeout: 265 seconds]
Daanct12 has joined #linux-amlogic
anessen976 has joined #linux-amlogic
anessen97 has quit [Ping timeout: 246 seconds]
anessen976 is now known as anessen97
Daanct12 has quit [Ping timeout: 250 seconds]
Daanct12 has joined #linux-amlogic
Daanct12 has quit [Quit: WeeChat 3.8]
<f_> Yup.
<f_> And that would also be the next thing I'll be reverse-engineering.
<f_> But meh. For now let's try loading the proprietary one.
<f_> Still. BL31 still doesn't want to get loaded.
<f_> Or...BL2 still doesn't want to load BL31.
<f_> But meh. Let's shelf that and try loading the SCP fw instead.
<f_> SCP firmware/SCP_BL2/BL30 =)
<f_> narmstrong: What is the SCP firmware supposed to do, though?
buzzmarshall has joined #linux-amlogic
<narmstrong> f_: is does the cpu clock and power management
<narmstrong> Bl31 passes scpi commands to it
<f_> Oh ok.
<f_> So it is required.
<f_> Thought it was optional.
<f_> What's weird, still, is the fact that BL31 doesn't want to load..at the very least it should output errors.
jacobk has joined #linux-amlogic
JohnnyonFlame has quit [Ping timeout: 240 seconds]
cottsay has quit [Ping timeout: 265 seconds]
dlan has quit [Ping timeout: 265 seconds]
cottsay has joined #linux-amlogic
kilobyte_ch has quit [Ping timeout: 265 seconds]
dlan has joined #linux-amlogic
kilobyte_ch has joined #linux-amlogic
<f_> narmstrong: Does TF-A BL31 also pass SCPI commands to SCP?
<narmstrong> f_: yes
<f_> Ok
<f_> ¯\_(ツ)_/¯
<f_> Let's get SCP_BL2 to run then!
<f_> I've seen though that Amlogic's old BL2 sources load SCP_BL2 inside mailbox.c
<f_> Speaking of BL30...
<f_> lol
<f_> BTW narmstrong: do you think I'm spamming too much in here?
<f_> Hope I'm not but if you think I am then I'll try lowering the volume of my messages :P
<narmstrong> f_: not at all, continue :-)
<f_> Thanks! =)
<f_> So the fact that they load BL30 inside plat/gxb/mailbox.c makes me think they use a mailbox for that..looking at BL31 code I see Antonio implemented some sort of mailbox, too!
<f_> Well. I guess the mailbox is required to talk to the SCP.
<f_> Well. At least Amlogic did sort of a good job at trying to load BL30 -- their code is understandable at the very least.
<f_> Ok no
<f_> Now is time to study that code. I hope they didn't do spaghetti code on that one.
<f_> But I see:
<f_> 112 │ memcpy((void *)MB_SRAM_BASE, (const void *)sha2, sha2_length);
<f_> I think that MB_SRAM_BASE is a constant defined using #define..
<f_> Nope.
<f_> 97 │ *(unsigned int *)MB_SRAM_BASE = size;
<f_> What is up with their coding style?
<f_> Anyways.
<f_> And I see that send_bl30x is called inside common/fip.c
<f_> (which is amlogic code, as in, no ARM Limited copyright)
JohnnyonFlame has joined #linux-amlogic
<f_> They didn't even limit their lines to 80 chars.
<f_> narmstrong: But wait a second
<f_> 81 │ #if (NEED_BL301)
<f_> 82 │ /*load and process bl301*/
<f_> Is BL301 supposed to be loaded separately?
<narmstrong> Yep bl301 needs to be loaded into the scp after the scp fW is loaded
<narmstrong> Is contains « platforms specific » scp code
<f_> Yeah I know..but was BL301 intended to be loaded separately? Because in the amlogic-boot-fip repo we embed BL301 into BL30.
<f_> And let BL2 load the BL30 binary (right?)
<f_> In their outdated code BL2 is supposed to print out when it's loading BL301
<f_> https://wiki.postmarketos.org/wiki/Videostrong_KII_Pro_(videostrong-kii-pro)/U-Boot_as_primary_bootloader#Boot_log but in the logs I sort of use as a reference sometimes, it doesn't mention BL301
<f_> (this is by using the WeTek Play2 BL2)
<f_> It just mentions BL30.
<f_> https://github.com/afaerber/meson-tools/issues/3#issuecomment-296251575 but in afaerber's logs BL301 is mentionned
<f_> Now that I think about it...afaerber's BL2 is dated Nov 25 2015, but mine is dated Oct 11 2016..
<f_> Assuming afaerber's BL2 is an untouched ODROID-C2 BL2, it seems like BL2 originally loaded BL301 separately from BL30, or NEED_BL301 was disabled in my binary.
<f_> I need to know if:
<f_> if BL30 can live on without BL301, and if not, if it loads BL301 itself or if BL2 loads it.
<f_> It could still be possible that Amlogic chose the silently load BL301, too...
<f_> Anyway....let's find the entry point of SCP_BL2/BL30
<f_> 89 │ process_bl30x(&bl301_image_info, &bl301_ep_info, "bl301");
<f_> It's used right here.
<f_> 84 │ entry_point_info_t bl301_ep_info;
<f_> And defined 4 lines earler.
<f_> *earlier
<f_> Let's look at process_bl30x.
<f_> Basically runs what I assume is SHA256/SHA224 checksumming and passes that, along with the rest of its arguments to send_bl30x().
<f_> But wait.
<f_> 188 │ /*process bl30x, transfer to m3, etc..*/
<f_> 189 │ void process_bl30x(image_info_t *image_data,
<f_> 190 │ entry_point_info_t *entry_point_info, const char * name)
<f_> ^~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~ this is unused
<f_> Argh. I was close.
<f_> But yeah, this argument is unused in that function!
<f_> It just passes img_data->base and img_data->size
<f_> 212 │ send_bl30x(image_data->image_base, image_data->image_size, \
<f_> 213 │ _sha2, sizeof(_sha2), name);
<f_> Along with the name (presumabely equal to string "bl30" or "bl301") and the result of the checksum as well as its size.
<f_> Going back to send_bl30x.
<f_> 97 │ *(unsigned int *)MB_SRAM_BASE = size;
<f_> remember that? they set MB_SRAM_BASE to image_data->image_site..
<f_> *image:size
<f_> *image_size
<f_> I wonder why they wrote it in all caps though...but I think MB means MailBox.
<f_> So it might be the Mailbox base in secure RAM?
<f_> But they set it to the size of the image, which doesn't make much sense to me..
<f_> 110 │ mb_send_data(CMD_DATA_LEN, 3);
<f_> Going to mb_send_data
<f_> 30 │ void mb_send_data(uint32_t val, uint32_t port)
<f_> And let's see what CMD_DATA_LEN is.
<f_> git grep is my friend here
<f_> git[master] ~thelinuxmacbook:amlogic-bl2 -mksh$ git grep CMD_DATA_LEN
<f_> plat/gxb/include/mailbox.h:#define CMD_DATA_LEN 0xc0dec0d0
<f_> Maybe Amlogic documented the mailbox in their public datasheets?
<f_> Actually
<f_> I'm just trying to get the entry point
<f_> 74 │ entry_point_info_t bl30_ep_info;
<f_> 75 │ nBL3XLoadAddr = nSecFlag ? FM_FIP_BL3X_TEMP_LOAD_ADDR : FM_BL30_LOAD_ADDR;
<f_> 76 │ storage_load(BL2_SIZE + (fip_header->bl30_entry.offset),nBL3XLoadAddr, (fip_header->bl30_entry.size), "bl30");
<f_> 77 │ parse_blx(&bl30_image_info, &bl30_ep_info,nBL3XLoadAddr, FM_BL30_LOAD_ADDR, (fip_header->bl30_entry.size),nAESFlag);
<f_> ~~~
<f_> git[master] ~thelinuxmacbook:amlogic-bl2 -mksh$ git grep FM_BL30_LOAD_ADDR
<f_> <..>
<f_> include/common/fip.h:#define FM_BL30_LOAD_ADDR CONFIG_SYS_TEXT_BASE
<f_> git[master] ~thelinuxmacbook:amlogic-bl2 -mksh$ git grep FM_FIP_BL3X_TEMP_LOAD_ADDR
<f_> <...>
<f_> include/common/fip.h:#define FM_FIP_BL3X_TEMP_LOAD_ADDR (BL2_SEC_BOOT_BUF_BASE) /*tmp addr for bl3x load & process for secure boot*/
<f_> ~~~
<f_> I guess "nSecFlag" means secure boot flag?
<f_> So it is really = to CONFIG_SYS_TEXT_BASE
<f_> CONFIG_SYS_TEXT_BASE is a U-Boot configuration value.
<f_> Looking at their U-Boot fork...
<f_> arch/arm/include/asm/arch-gxb/cpu.h:#define CONFIG_SYS_TEXT_BASE 0x01000000 /*16MB rsv*/
<f_> So the load address is 0x01000000
<f_> If I recall correctly it's the same value as in CONFIG_TEXT_BASE in modern U-Boot, right?
<f_> Oh well
<f_> I didn't have to look for that much time....see reference UART logs:
<f_> Load bl30 from SD, src: 0x00010000, des: 0x01000000, size: 0x0000d460
<f_> ^~~~~~~~~~
<f_> Oh
<f_> I need to set the SCP_BL2 UUID as well.
<f_> 12 #define UUID_SCP_FIRMWARE_SCP_BL2 \¬
<f_> 11 ﲒ {{0x97, 0x66, 0xfd, 0x3d}, {0x89, 0xbe}, {0xe8, 0x49}, 0xae, 0x5d, {0x78, 0xa1, 0x40, 0x60, 0x82, 0x13} }¬
<f_> Let's use this UUID.
<f_> Oh..image id != UUID
<f_> Meh...
<f_> VERBOSE: FIP header looks OK.
<f_> VERBOSE: Using FIP
<f_> INFO: Loading image id=2 at address 0x1000000
<f_> GXBB:BL1:08dafd:0a8993;FEAT:EDFC318C;POC:3;RCY:0;EMMC:0;READ:0;CHK:F3;SD:0;READ:0;
<f_> Will push what I have though.
<f_> https://git.vitali64.duckdns.org/misc/trustedfirmware-a.git/commit/?h=wip/gxbb&id=969247f6a22a50aa3b8198c0b1b2cd3108cd1768 done
<f_> I don't know why it doesn't want to load *any* image at all though...feedback welcome
<f_> Any TF-A experts here? lol
<f_> Might as well send them a email to their mailing list.
<f_> (just telling them that I'm porting gxbb to TF-A BL2 and the status and all that..)
tetrakist has joined #linux-amlogic
f_ has quit [Quit: disconnecting ·_· oh hi By the way.]
JohnnyonF has joined #linux-amlogic
JohnnyonFlame has quit [Ping timeout: 250 seconds]
vagrantc has joined #linux-amlogic