Re: How to start an armv8 machine in EL3?

[Alex Bennée]

ckim@etri.re.kr writes:

> Found out how to do it! (I needed secure=true).

Hmm I would hope true and on are synonyms... might have to poke that. I
forgot about the gic-version, we should make that easier to get right.

> ${QEMU_DIR}/qemu-system-aarch64 -machine type=virt,gic-version=3,secure=true 
> -cpu cortex-a72 -nographic -smp 1 -m 2048 -drive 
> if=pflash,file=pflash.img,format=raw,readonly=on -s -S
> https://lists.gnu.org/archive/html/qemu-devel/2017-05/msg06622.html
> Thanks!
> Chan Kim
>
>> -----Original Message-----
>> From: ckim@etri.re.kr <ckim@etri.re.kr>
>> Sent: Wednesday, March 3, 2021 11:04 PM
>> To: 'Alex Bennée' <alex.bennee@linaro.org>
>> Cc: 'qemu-discuss@nongnu.org' <qemu-discuss@nongnu.org>
>> Subject: RE: How to start an armv8 machine in EL3?
>> 
>> Hi Alex Bennée,
>> 
>> Sorry, machine ab21q is just the copy of machine virt.
>> I found the pflash.img contained all zero in the beginning so it cause
>> invalid instruction trap.
>> (thanks for the -d int,exec,in_asm option, I have to first learn more
>> about the qemu usage than the internal.) So I did 'cp test.bin pflash.img;
>> truncate -s 67108864 pflash.img' to cut it to 64MB.
>> (The test.bin was almost 67MB, I was confused by the small sized test.elf
>> which was only 776KB).
>> Now with the ' ${QEMU_DIR}/qemu-system-aarch64 -M virt -cpu cortex-a72 -
>> nographic -smp 1 -m 2048 -drive
>> if=pflash,file=pflash.img,format=raw,readonly=on -s -S' command, And after
>> attaching gdb, I can see the original assembly code is being executed.
>> But with this method, it still is in EL1 (I can see with 'mrs x8,
>> currentel' shortly after the start), And the 'msr sp_el1, x0' instruction
>> causes trap to 0x200.
>> Could you give me more advice on this?
>> Thank you very much.
>> 
>> Chan Kim
>> 
>> > -----Original Message-----
>> > From: Alex Bennée <alex.bennee@linaro.org>
>> > Sent: Wednesday, March 3, 2021 9:01 PM
>> > To: ckim@etri.re.kr
>> > Cc: qemu-discuss@nongnu.org
>> > Subject: Re: How to start an armv8 machine in EL3?
>> >
>> >
>> > ckim@etri.re.kr writes:
>> >
>> > > Hello Alex Bennée,
>> > >
>> > > Thank you for the help!
>> > > I didn't know "-kernel xxx.elf" method makes it start at EL1 by the
>> > > loader stub, and doing "--machine virtualization=on" makes it start
>> > > at
>> > EL2. I checked these using gdb.
>> > >
>> > > And then I tested your suggestion :
>> > > ${QEMU_DIR}/qemu-system-aarch64 -M ab21q -cpu cortex-a72 -nographic
>> > > -smp 1 -m 2048 -drive
>> > > if=pflash,file=${KER_DIR}/ab21s_test.bin,format=raw,readonly=on -s
>> > > -S
>> >
>> > Hold on you've just switched from -M virt to -M ab21q? I don't even
>> > recognise that model.
>> >
>> > > And it gave me :
>> > > qemu-system-aarch64: device requires 67108864 bytes, block backend
>> > > provides 776704 bytes
>> > >
>> > > Looks like the pflash device size is 64MB and my .bin file (which I
>> > > made
>> > with objcopy from .elf file) is not big enough to fill the device.
>> > > I made the .bin file inside the pflash.img file by doing
>> > > (https://xnand.netlify.app/2019/10/03/armv8-qemu-efi-aarch64.html )
>> > >
>> > >     cp ${KER_DIR}/ab21s_test.bin pflash.img
>> > >     dd if=/dev/zero of=pflash.img bs=1c count=1 seek=67108863
>> > >
>> > > and tried
>> > > ${QEMU_DIR}/qemu-system-aarch64 -M virt -cpu cortex-a72 -nographic
>> > > -smp 1 -m 2048 -drive
>> > > if=pflash,file=pflash.img,format=raw,readonly=on -
>> > s -S To see how the code works, but it traps from the first instruction.
>> >
>> > Is it the instruction you expect? Try single stepping with gdbstub
>> > while using -d int,exec,in_asm on your command line for more details.
>> >
>> > >
>> > > Can you tell me what's wrong with my command? (BTW I made .bin file
>> > > by aarch64-elf-objcopy -O binary test.elf test.bin )
>> > >
>> > > Again thanks for the kind explanation!
>> > > Best regards,
>> > >
>> > > Chan Kim
>> > >
>> > >> -----Original Message-----
>> > >> From: Alex Bennée <alex.bennee@linaro.org>
>> > >> Sent: Wednesday, March 3, 2021 7:05 PM
>> > >> To: ckim@etri.re.kr
>> > >> Cc: qemu-discuss@nongnu.org
>> > >> Subject: Re: How to start an armv8 machine in EL3?
>> > >>
>> > >>
>> > >> ckim@etri.re.kr writes:
>> > >>
>> > >> > Hello all,
>> > >> >
>> > >> > I found out in a baremetal program I run for qemu aarch64 'virt'
>> > >> > machine (cpu is cortex-a72),
>> > >> >
>> > >> > the "msr sp_el1, x0" instruction causes trap making PC jump to
>> > >> > 0x200 which is the vector address for synchronous exception, from
>> > >> > current EL while using SP_ELx (if the vector base address was 0,
>> > which is the case).
>> > >> >
>> > >> > (Ref :
>> > >> > https://developer.arm.com/documentation/102412/0100/The-vector-ta
>> > >> > bl
>> > >> > es
>> > >> > )
>> > >> >
>> > >> > When I read the 'EL' value by 'msr x8, currentel', x8 became '0x4'
>> > >> > so it is
>> > >> > EL1
>> > >> > (https://community.arm.com/developer/ip-products/processors/f/cor
>> > >> > te
>> > >> > x-a
>> > >> > -forum
>> > >> > /10303/armv8-a-currentel-register-definition)
>> > >> >
>> > >> > How come cortex-a72 machines started at EL1?
>> > >>
>> > >> Are you booting a kernel directly? In this case the kernel will
>> > >> boot into
>> > >> EL1 unless you specify -machine type=virt,virtualization=on in
>> > >> which case it will boot into EL2 and allow the kernel to utilise
>> > >> the virtualisation extensions.
>> > >>
>> > >> > And if I want to make the virtual machine start at EL3 (this
>> > >> > baremetal code assumes it should be in EL3 after reset, and it
>> > >> > runs ok in rtl sim.), what should I do?
>> > >>
>> > >> Generally as only firmware deals with EL3 you would have it running
>> > >> on some sort of flash device which the model would boot to directly
>> > >> in EL3 rather than running the stub loader we have for the kernel.
>> > >> For example to load the EDK firmware you would have:
>> > >>
>> > >>    -drive
>> > >> if=pflash,file=/usr/share/AAVMF/AAVMF_CODE.fd,format=raw,readonly=on
>> \
>> > >>    -drive
>> > >> if=pflash,file=/home/alex/models/qemu-arm64-efivars,format=raw
>> > >>
>> > >> as part of your command line. You also need to enable secure mode
>> > >> in the machine options (-machine type=virt,secure=on).
>> > >>
>> > >> >
>> > >> > Thank you very much for reading.
>> > >> >
>> > >> > Chan Kim
>> > >> >
>> > >> >
>> > >>
>> > >>
>> > >> --
>> > >> Alex Bennée
>> >
>> >
>> > --
>> > Alex Bennée


-- 
Alex Bennée