readme.txt 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136
  1. Board qemu_arm_vexpress_tz builds a QEMU ARMv7-A target system with
  2. OP-TEE running in the TrustZone secure world and a Linux based
  3. OS running in the non-secure world. The board configuration enables
  4. builds of the QEMU host ARM target emulator.
  5. make qemu_arm_vexpress_tz_defconfig
  6. make
  7. The BIOS used in the QEMU host is the ARM Trusted Firmware-A (TF-A). TF-A
  8. uses QEMU semihosting file access to access boot image files. The
  9. QEMU platform is quite specific for that in TF-A and one needs to
  10. run the emulation from the image directory for TF-A to boot the
  11. secure and non-secure worlds.
  12. cd output/images && ../host/bin/qemu-system-arm \
  13. -machine virt -machine secure=on -cpu cortex-a15 \
  14. -smp 1 -s -m 1024 -d unimp \
  15. -serial stdio \
  16. -netdev user,id=vmnic -device virtio-net-device,netdev=vmnic \
  17. -semihosting-config enable,target=native \
  18. -bios bl1.bin # qemu_arm_vexpress_tz_defconfig
  19. The boot stage traces (if any) followed by the login prompt will appear
  20. in the terminal that started QEMU.
  21. If you want to emulate more cores, use "-smp {1|2|3|4}" to select the
  22. number of cores.
  23. Note: "-netdev user,id=vmnic -device virtio-net-device,netdev=vmnic"
  24. brings network support that is used i.e. in OP-TEE regression tests.
  25. -- Boot Details --
  26. TF-A is used as QEMU BIOS. Its BL1 image boots and load its BL2 image. In turn,
  27. this image loads the OP-TEE secure world (ARMv7-A BL32 stage) and the U-boot as
  28. non-secure bootloader (BL33 stage).
  29. QEMU natively hosts and loads in RAM the QEMU ARM target device tree. OP-TEE
  30. reads and modifies its content according to OP-TEE configuration.
  31. Enable TF-A traces from LOG_LEVEL (I.e LOG_LEVEL=40) from
  32. BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES.
  33. -- OP-TEE Traces --
  34. Secure boot stages and/or secure runtime services may use a serial link for
  35. their traces.
  36. The ARM Trusted Firmware outputs its traces on the QEMU standard (first)
  37. serial interface.
  38. The OP-TEE OS uses the QEMU second serial interface.
  39. To get the OP-TEE OS traces, append a second -serial argument after
  40. -serial stdio in the QEMU command line. I.e, the following enables 2 serial
  41. consoles over telnet connections:
  42. cd output/images && ../host/bin/qemu-system-arm \
  43. -machine virt -machine secure=on -cpu cortex-a15 \
  44. -smp 1 -s -m 1024 -d unimp \
  45. -serial telnet:127.0.0.1:1235,server \
  46. -serial telnet:127.0.0.1:1236,server \
  47. -netdev user,id=vmnic -device virtio-net-device,netdev=vmnic \
  48. -semihosting-config enable,target=native \
  49. -bios bl1.bin
  50. QEMU is now waiting for the telnet connection. From another shell, open a
  51. telnet connection on the port for the U-boot and Linux consoles:
  52. telnet 127.0.0.1 1235
  53. and again for the secure console
  54. telnet 127.0.0.1 1236
  55. -- Using gdb --
  56. One can debug the OP-TEE secure world using GDB through the QEMU host.
  57. To do so, simply run the qemu-system-arm emulation, then run a GDB client
  58. and connect the QEMU internal GDB server.
  59. The example below assumes we run QEMU and the GDB client from the same
  60. host computer. We use option -S of qemu-system-arm to make QEMU
  61. waiting for the GDB continue instruction before booting the images.
  62. From a first shell:
  63. cd output/images && ../host/bin/qemu-system-arm \
  64. -machine virt -machine secure=on -cpu cortex-a15 \
  65. -smp 1 -s -m 1024 -d unimp \
  66. -serial stdio \
  67. -netdev user,id=vmnic -device virtio-net-device,netdev=vmnic \
  68. -semihosting-config enable,target=native \
  69. -bios bl1.bin \
  70. -S
  71. From a second shell:
  72. ./output/host/bin/arm-linux-gdb
  73. GNU gdb (GNU Toolchain for the A-profile Architecture 8.2-2018-08 (arm-rel-8.23)) 8.1.1.20180704-git
  74. Copyright (C) 2018 Free Software Foundation, Inc.
  75. ...
  76. For help, type "help".
  77. Type "apropos word" to search for commands related to "word".
  78. (gdb)
  79. From this GDB console, connect to the target, load the OP-TEE core symbols,
  80. set a breakpoint to its entry point (__text_start) and start emulation:
  81. (gdb) target remote 127.0.0.1:1234
  82. (gdb) symbol-file ./output/build/optee-os-<reference>/out/arm/core/tee.elf
  83. (gdb) hbreak __text_start
  84. Hardware assisted breakpoint 1 at 0xe100000: file core/arch/arm/kernel/generic_entry_a32.S, line 246.
  85. (gdb) cont
  86. Continuing.
  87. Thread 1 hit Breakpoint 1, _start () at core/arch/arm/kernel/generic_entry_a32.S:246
  88. 246 bootargs_entry
  89. (gdb)
  90. Emulation has started, TF-A has loaded OP-TEE and U-boot images in memory and
  91. has booted OP-TEE. Emulation stopped at OP-TEE core entry.
  92. Note: QEMU hosts a GDB service listening to TCP port 1234, as set through
  93. qemu-system-arm command line option -s.
  94. Note: To build the GDB server, the following extra options have to be added to
  95. the Buildroot configuration:
  96. BR2_ENABLE_DEBUG=y
  97. BR2_PACKAGE_GDB=y
  98. BR2_PACKAGE_HOST_GDB=y
  99. BR2_TOOLCHAIN_BUILDROOT_CXX=y
  100. BR2_TOOLCHAIN_BUILDROOT_GLIBC=y