S 10 S C UEFI B U G · $ git checkout -t -b origin/socfpga_v1.4 6.2.3 BUILDING BL31 IMAGE In this section, you will learn how to build the Arm-Trusted-Firmware

STRATIX10 SOC UEFI BOOTLOADER USER GUIDE

Revision: C

Revision Date: 24th May 2018

Stratix10 SoC UEFI Bootloader User Guide Rev C

Page 2 of 45

1 TABLE OF CONTENTS 2 REVISIONS HISTORY ................................................................................................................ 4

3 OVERVIEW OF THE BOOT FLOW .......................................................................................... 5

4 SYSTEM REQUIREMENTS ........................................................................................................ 5

5 GETTING A WORKING ENVIRONMENT .............................................................................. 5

5.1 Download Software Components ............................................................................................................... 5

6 ARM-TRUSTED-FIRMWARE (SECURE MONITOR) .......................................................... 6

6.1 User Configuration ..................................................................................................................................... 6

6.2 Building Secure Monitor ............................................................................................................................. 7

6.2.1 Compiler Toolchain .................................................................................................................................... 7

6.2.2 Getting the Trusted Firmware source code ............................................................................................... 7

6.2.3 Building BL31 image ................................................................................................................................... 7

7 UEFI BOOTLOADER .................................................................................................................. 8

7.1 Building UEFI .............................................................................................................................................. 8

7.1.1 Pre-requisites in Window Environment ..................................................................................................... 9

7.1.2 Pre-requisites in Linux Environment .......................................................................................................... 9

7.1.3 Compiler ToolChain ................................................................................................................................... 9

7.1.4 Getting the UEFI Source Code.................................................................................................................... 9

7.1.5 Compile the UEFI ..................................................................................................................................... 10

8 RUNNING UEFI ON SOC VIRTUAL PLATFORM (SOCVP) .............................................. 14

8.1 Installing SOCVP ....................................................................................................................................... 14

8.2 Running SOCVP with Prebuilt Linux Kernel ............................................................................................... 15

8.3 Running SOCVP with ATF and UEFI bootloader images ............................................................................. 17

8.4 Ping and DHCP Test .................................................................................................................................. 19

8.4.1 Ping Test .................................................................................................................................................. 19

8.4.2 DHCP Test ................................................................................................................................................ 20

8.5 TFTP ......................................................................................................................................................... 21

8.5.1 Setup the TFTP server at the host machine Centos ................................................................................. 21

8.5.2 Run TFTP at client side ............................................................................................................................. 22

8.6 Boot linux ................................................................................................................................................. 23

8.6.1 From PitStop console ............................................................................................................................... 23

8.7 Boot vxWorks ........................................................................................................................................... 24

8.7.1 From DXE Console .................................................................................................................................... 24

9 PXE ............................................................................................................................................... 25

9.1 PXE Server - Ubuntu Machine .................................................................................................................. 26

9.1.1 Network Setup ......................................................................................................................................... 26

9.1.2 Prepare Bootimage .................................................................................................................................. 28

9.1.3 TFTP server in Ubuntu ............................................................................................................................. 28

9.1.4 Xinetd ....................................................................................................................................................... 29

9.1.5 Disable firewall ........................................................................................................................................ 30

9.1.6 DHCP server ............................................................................................................................................. 30

9.2 PXE client- UEFI ........................................................................................................................................ 31

9.2.1 SOCVP setting .......................................................................................................................................... 31

9.2.2 Boot UEFI ................................................................................................................................................. 32


Page 3 of 45

10 RUNNING UEFI ON SIMICS .................................................................................................... 32

10.1 Installing Simics ........................................................................................................................................ 32

10.2 Running Simics with ATF and UEFI bootloader images ............................................................................. 34

10.3 Ping Test ................................................................................................................................................... 36

10.4 DHCP Test ................................................................................................................................................. 37

10.5 TFTP Test .................................................................................................................................................. 38

10.5.1 Setup TFTP server at simics ..................................................................................................................... 38

10.5.2 Run TFTP at Client side ............................................................................................................................ 39

11 RUNNING UEFI ON PHYSICAL BOARD .............................................................................. 40

11.1 Running Physical Board with ATF and UEFI Bootloader ............................................................................ 40

11.1.1 Generate SOF file with ATF ...................................................................................................................... 40

11.1.2 Create SD card image with PEI.ROM and DXE.ROM ................................................................................ 41

11.1.3 Running Secure Monitor .......................................................................................................................... 41

11.1.4 Debug with DS-5 ...................................................................................................................................... 42

11.2 Booting Linux ........................................................................................................................................... 44

11.2.1 Boot From DXE Console ........................................................................................................................... 44


Page 4 of 45

2 REVISIONS HISTORY

Date Revision Modifications

21th March 2017 A Initial version.

8th September 2017 B Added Running UEFI in Simics Section 8.1 Installing Simics Section 8.2 Running Simics with UEFI bootloader images Section 8.3 Boot Linux Section 8.4 Ping test Section 8.5 DHCP test Section 8.6 TFTP test

24th May 2018 C Section 3 Overview of the boot flow – updated the figure and information about boot flow Added new Section 6 Arm-Trusted-Firmware (Secure Monitor) Section 7.1.5 Compile UEFI – Updated the information about files generated from building UEFI (Include SEC.ROM and remove PEI.256) Section 8 Running UEFI on SOCVP- Added information about ATF and remove information about PEI.256. Added steps to run ATF and UEFI on SoCVP Section 10 Running UEFI on Simics – Updated the package used to run UEFI and added information about ATF and remove information about PEI.256. Added steps to run ATF and UEFI on Simics Added new section 11 Running Physical Board with ATF and UEFI Bootloader Section 11 Running UEFI on physical board – Added steps to run UEFI on physical board and steps to boot Linux


Page 5 of 45

3 OVERVIEW OF THE BOOT FLOW The boot flow by stages of UEFI:

In Stratix 10, the arm-trusted-firmware is loaded directly by SDM on to the HPS onchip memory upon board power

on. After that, the UEFI Bootloader is loaded by arm-trusted-firmware onto the HPS DDR memory. The binary

image of the UEFI Bootloader is stored on QSPI flash device, NAND flash device or SD/MMC card.

The arm-trusted-firmware main tasks is to bring up the DDR SDRAM memory and configure most of low level

hardware such as PLL, IOs, pin muxing and others to enable normal world software to function correctly.

UEFI bootloader tasks include providing ethernet support and fetching subsequent boot software such as operating

system package or secure kernel. For non secure boot, the operating system package might include a kernel image,

device tree blob and filesystem. For secure boot, it might be a secure kernel.

4 SYSTEM REQUIREMENTS The following items will be required to be able to complete the task in this user guide successfully:

• Host Linux or Windows PC

o Serial terminal (for example minicom on Linux and Tera Term on Windows)

o Micro SD card slot or Micro SD card writer (or SD-capable writer + SD to micro SD converter)

• Altera SoC EDS 17.0 and Quartus II version 17.0 and above

• Stratix 10 SOC Virtual Platform v1.3

• Stratix 10 SoC Development Kits

5 GETTING A WORKING ENVIRONMENT

5.1 DOWNLOAD SOFTWARE COMPONENTS


Page 6 of 45

To build UEFI, make sure you have the SoC Embedded Design Suite (SoCEDS) version 17.0 and above installed on

your machine.

• Download the SoCEDS: http://dl.altera.com/soceds/

6 ARM-TRUSTED-FIRMWARE (SECURE MONITOR) As security is more and more important, secured boot solution becomes a requirement to embedded world. Secure

Boot is a technology where the system firmware checks that the system boot loader is signed with a cryptographic

key authorized by a database contained in the firmware. However, beside this authentication boot flow, to ensure

a comprehensive security and trusted platform, secure partitioning is required. Secure partitioning is referring as

TrustZone model. The TrustZone model splits the computing environment into two isolated worlds, the secure world

and normal world, which are linked by a software monitor called Secure Monitor. The two worlds have separated

logical address space and peripherals. Communication between the two worlds is only possible by calling the

privileged Secure Monitor Call (SMC) instruction.

For Stratix 10 device, the old boot flow (BootRom > Uboot/UEFI > OS) is no longer sufficient. Hence, the full secure

boot solution (BootRom > Secure Device Manager >Secure Monitor > Uboot/UEFI > Hypervisor > OS) is introduced.

Secure Monitor mode is a privileged mode and is always Secure regardless of the state of the NS bit. The Secure

Monitor is code that runs in Secure Monitor mode and processes switches to and from the Secure world. The overall

security of the software relies on the security of this code along with the Secure boot code.

6.1 USER CONFIGURATION

All the platform configurations can be found at /plat/intel/soc/stratix10/platform_def.h

For user configuration, only the 1st part of this file should be modified.

/**********************************************************************

User configuration

*********************************************************************/

//#define EMULATOR

//#define VIRTUAL_PLATFORM

#define ENABLE_HANDOFF

#define PLAT_SEMIHOSTING_ENABLE

#define PLAT_NS_IMAGE_OFFSET 0x50000

#define PLAT_HANDOFF_OFFSET 0xFFE3F000

#define BOOT_SOURCE BOOT_SOURCE_SDMMC

http://dl.altera.com/soceds/


Page 7 of 45

To change the boot filename or offset, you can change the #define here

6.2 BUILDING SECURE MONITOR

6.2.1 COMPILER TOOLCHAIN Secure monitor is using GNU Toolchain (EABI Release) for ARM Processors. The toolchain used is aarch64-linux-gnu-

gcc (gcc-linaro-aarch64-linux-gnu-4.8-2014.04)

6.2.2 GETTING THE TRUSTED FIRMWARE SOURCE CODE

The Arm Trusted Firmware (ATF) source is in https://github.com/altera-opensource/arm-trusted-firmware. To get

the ATF source code, simply run the following steps:

1. Open a Terminal

2. Create a new directory to check out the ATF source code from github

3. Change to this working directory and clone the ATF source from the git trees

$ git clone https://github.com/altera-opensource/arm-trusted-firmware

4. When completed, change to arm-trusted-firmware folder and perform a git check out

$ cd arm-trusted-firmware

$ git checkout -t -b <branch_name> origin/socfpga_v1.4

6.2.3 BUILDING BL31 IMAGE In this section, you will learn how to build the Arm-Trusted-Firmware with the Linaro GCC compiler.

To start building the Arm-Trusted-Firmware with the Linaro GCC compiler, simply run the following steps:

1. Change your directory to the ATF source code location

$ cd arm-trusted-firmware

2. Set the GCC path and environment variable CROSS COMPILE to Linaro cross compile

$ export PATH=<your gcc directory>/gcc-linaro-aarch64-linux-gnu-4.8-2014.04_linux/bin:$PATH

$ export CROSS_COMPILE=aarch64-linux-gnu-

3. Remove the build tree completely

$ make realclean

4. Build the Arm-Trusted-Firmware by using the following command

https://github.com/altera-opensource/arm-trusted-firmware


Page 8 of 45

$ make PLAT=stratix10 DEBUG=1

Debug must be enabled for GCC 4.8, else you will encounter the build error. Debug can be removed for GCC 4.9 and above

5. You will see the following messages once Arm-Trusted-Firmware is build successfully

6. The secure monitor generated output files details are shown in the table below

File names and extensions Explanation

\build\stratix10\release\bl31.bin Generated binary file

\build\stratix10\ release \bl31\bl31.elf Generated elf file

\build\stratix10\debug\bl31.bin Generated debug binary file

\build\stratix10\debug\bl31\bl31.elf Generated debug elf file

First two files stated in steps 6 are the files generated without DEBUG option in step 5.

7 UEFI BOOTLOADER

7.1 BUILDING UEFI

In this section, you will learn where to get the UEFI source code and how to compile the UEFI source with the

supported toolchain. You can choose to either compile the UEFI source code in a Windows or Linux environment


Page 9 of 45

7.1.1 PRE-REQUISITES IN WINDOW ENVIRONMENT If you are running on a Window environment, make sure you have the following components installed:

• Install Git for Windows (https://www.git-scm.com/download/win)

• Install SoC Embedded Design Suite (EDS) 17.0 for windows (http://dl.altera.com/soceds/). Python tool

will be available when SOCEDS is installed in your machine

7.1.2 PRE-REQUISITES IN LINUX ENVIRONMENT First, you will need to install some packages. The command line to install them depends on your Linux distribution:

On Ubuntu:

$ sudo apt-get install uuid-dev build-essential

On Fedora:

$ sudo yum install uuid-devel libuuid-devel

7.1.2.1 PYTHON TOOL

For building UEFI, python tool is required.

1. If your machine doesn’t have python, you can grab it from SOCEDS installation path. Run the following

commands:

$ export PATH=$SOCEDS_DEST_ROOT/host_tools/python/bin/:$PATH

7.1.3 COMPILER TOOLCHAIN Here is the supported toolchain can be used to build the UEFI:

1. Linaro Toolchain

▪ aarch64-linux-gnu-gcc (crosstool-NG linaro-1.13.1-4.8-2014.04 - Linaro GCC 4.8-2014.04) 4.8.3

20140401 (prerelease)

▪ You can download the toolchain from the link shown below

https://releases.linaro.org/archive/14.04/components/toolchain/binaries/

• For Linux environment, download the “gcc-linaro-aarch64-linux-gnu-4.8-2014.04_linux.tar”

• For Window environment, download the “gcc-linaro-aarch64-linux-gnu-4.8-2014.04_win32.zip”

7.1.4 GETTING THE UEFI SOURCE CODE The UEFI source code is in https://github.com/altera-opensource/uefi-socfpga. To get the UEFI source code, simply

run the following steps:

1. Open a Terminal

2. Create a new directory to check out the UEFI source code from the github. For example, the UEFI directory here

is :/data/twooi/

$ mkdir /data/twooi/

https://www.git-scm.com/download/win

http://dl.altera.com/soceds/

https://releases.linaro.org/archive/14.04/components/toolchain/binaries/

https://github.com/altera-opensource/uefi-socfpga


Page 10 of 45

3. Change to this UEFI working directory and clone the UEFI source from the git trees

$ git clone https://github.com/altera-opensource/uefi-socfpga

4. When completed, change to the uefi-socfpga folder and perform a git check out

$ cd uefi-socfpga

$ git checkout -b <branch_name> -- track origin/socvp_socfpga_udk2015

7.1.5 COMPILE THE UEFI In this section, you will learn how to compile the UEFI source code with the Linaro toolchain in both Windows and

Linux environments

To start compiling the UEFI source code with the Linaro toolchain, simply run the following steps:

7.1.5.1 IN WINDOWS ENVIRONMENT

1. Open the command prompt

2. Change your directory to your working directory and set the SOCEDS_DEST_ROOT to the location of your

SOCEDS

$ cd <your_working_directory>/uefi-socfpga

$ set SOCEDS_DEST_ROOT=<your_SOCEDS_location>

3. Set the GCC path to the location of the compiler toolchain

$ set PATH = <your_Linaro GCC Toolchain_location>:$PATH


Page 11 of 45

If you encountered GCC error when compile the UEFI source code after setting the PATH. You can edit the setup.bat file manually to use the full compiler path required for step 4.

4. Run the setup command

$ setup.bat

5. Build the UEFI

$ make device=s10


Page 12 of 45

6. You will see the following messages once UEFI is successfully compiled

7.1.5.2 IN LINUX ENVIRONMENT

1. Open a Terminal window and enter the following command:

$ cd <your_uefi_directory>/uefi-socfpga

$ export PATH=<your gcc directory>/gcc-linaro-aarch64-linux-gnu-4.8-2014.04_linux/bin:$PATH

2. Clean the entire <your_uefi_directory>/uefi-socfpga/Build/ folder and also clean the BaseTools.

$ make clean


Page 13 of 45

3. Compile the UEFI Bootloader for Stratix 10 device using the following command

$ make DEVICE=s10

4. When the build is successfully, you will see the build done message once the compilation is completed

This will create the following four important files in the <your_uefi_directory>/uefi-

socfpga/Build/Stratix10SoCPkg/RELEASE_GCC48 folder:

File Description

~/uefi-socfpga/Build/ Stratix10SoCPkg/RELEASE_GCC48/ SEC.ROM

This is the UEFI SEC phase image which act as a FSBL

~/uefi-socfpga/Build/ Stratix10SoCPkg/RELEASE_GCC48/PEI.ROM

This is the UEFI PEI phase image which act as SSBL. This file will be used to program into the Flash daughter card.

~/uefi-socfpga/Build/ Stratix10SoCPkg/RELEASE_GCC48/load_uefi_fw.ds

This is the DS-5 script template to be imported to DS-5 tool to load the UEFI firmware for debug and development purposes. This script will load the debug symbols for the user.


Page 14 of 45

~/uefi-socfpga/Build/ Stratix10SoCPkg/RELEASE_GCC48/DXE.ROM

This file load the optional 2nd phase of UEFI Bootloader when you want to boot to UEFI Shell and utilize the TFTP feature or run a UEFI application. The different between PEI.ROM and DXE.ROM is PEI.ROM load and run entirely in On-Chip RAM of the HPS while DXE.ROM required running on DDR SDRAM, also PEI.ROM does all the initialization for the HPS and DXE.ROM mainly initialize the Ethernet MAC and PHY with full network stack support.

8 RUNNING UEFI ON SOC VIRTUAL PLATFORM (SOCVP)

8.1 INSTALLING SOCVP

1. Download the Stratix 10 SoC Virtual Platform tar file (Stratix10_vp.tgz)

2. Uncompressed the file downloaded

$ tar zxvf Stratix10_vp.tgz

3. Install the SOCVP

$ cd Stratix10_vp

$ ./install_s10socvp.exe -install <installation directory>


Page 15 of 45

The installation directory should not exist before running the install command. Error might encounter if you specify a directory that is existed.

8.2 RUNNING SOCVP WITH PREBUILT LINUX KERNEL

Running SOCVP with prebuilt Linux Kernel can help to test up your SOCVP after installation

1. Go to the directory where the SOCVP is installed

$ cd <Path to SOCVP directory>

2. Download the prebuilt Linux kernel

$ wget --no-cache http://rocketboards.org/foswiki/pub/Documentation/Stratix10SoCVPLinux/linux-

stratix10swvp-socfpga-4.5-angstrom-v2014.12-swvp-1.2.tgz --no-check-certificate

3. Uncompressed the file

$ tar xvzf linux-stratix10swvp-socfpga-4.5-angstrom-v2014.12-swvp-1.2.tgz

4. Run the SOCVP with prebuilt Linux kernel

$ ./run.exe

http://rocketboards.org/foswiki/pub/Documentation/Stratix10SoCVPLinux/linux-stratix10swvp-socfpga-4.5-angstrom-v2014.12-swvp-1.2.tgz

http://rocketboards.org/foswiki/pub/Documentation/Stratix10SoCVPLinux/linux-stratix10swvp-socfpga-4.5-angstrom-v2014.12-swvp-1.2.tgz


Page 16 of 45

5. Two console will be appeared when successfully boot into Linux


Page 17 of 45

8.3 RUNNING SOCVP WITH ATF AND UEFI BOOTLOADER IMAGES

1. At SOCVP installation directory, edit parameters.txt to enable GDB session

# ----------------------------------

# Enable GDB session

# ----------------------------------

gdbstub_port=1234

2. Change to the directory where the SoCVP is installed and launch the run.exe

$ cd <your SoCVP directory>

$ ./run.exe


Page 18 of 45

3. Open a new terminal and launch debugger

$ cd <Path to linaro toolchain>/ gcc-linaro-aarch64-linux-gnu-4.8-2014.04_linux/bin

$ ./aarch64-linux-gnu-gdb


Page 19 of 45

4. At the GDB debugger, enter the following sequences:

$ target remote:1234

$ restore <Path to ATF source code>/build/stratix10/debug/bl31.bin binary 0xffe00000

$ set var $pc=0xffe00000

5. Run the SOCVP

$ continue

6. At the GDB debugger, interrupt the processor when memory initialization is done and load the UEFI PEI

phase image

$ restore <Path to UEFI source code>/Build/ Stratix10SoCPkg/RELEASE_GCC48/PEI.ROM binary

0x50000

$ continue

8.4 PING AND DHCP TEST

8.4.1 PING TEST

1. Complete the steps in section 8.1 if you did not install the SoCVP

2. Complete the steps 1-5 in section 8.3 to start SOCVP and debugger

3. At the debugger, interrupt the processor and enter the following commands:

$ restore <Path to UEFI source code>/Build/ Stratix10SoCPkg/RELEASE_GCC48/PEI.ROM binary

0x50000

$ restore <Path to UEFI source code>/Build/ Stratix10SoCPkg/RELEASE_GCC48/DXE.ROM binary

0x02000000

4. Run the SoCVP

$ continue

5. At the DXE console, type the following commands:

$ ifconfig -s eth0 static 192.168.0.9 255.255.255.0 192.168.0.1

$ ifconfig -l eth0

$ ping -n 2 192.169.0.1


Page 20 of 45

8.4.2 DHCP TEST

1. Complete the step 1-4 in section 8.4.1


$ ifconfig -s eth0 dhcp

$ ifconfig -l eth0

3. You will see the following expected output:


Page 21 of 45

A startup.nsh script has been compiled when you build the bootloader. This scripts will execute the commands automatically when DXE phase is loaded

8.5 TFTP

8.5.1 SETUP THE TFTP SERVER AT THE HOST MACHINE CENTOS 1. Install the necessary packages

$ sudo yum install httpd xinetd syslinux tftp-server

2. Edit the file located in /etc/xinetd.d/tftp


Page 22 of 45

$ vi /etc/xinetd.d/tftp

3. Enable the TFTP server by changing the “disable=yes” to “no”. You may change the server path to your

desired location

4. Edit the TFTP port from 69 to 70

$ sudo vi /etc/services

5. Start the TFTP server

$ sudo service xinetd stop

$ sudo service xinetd start

8.5.2 RUN TFTP AT CLIENT SIDE

1. Completed the steps 1-4 in section 8.4.1 to boot into DXE phase


Page 23 of 45

2. At the DXE console, execute the following command to use the static IPv4 address configuration for

Ethernet interface


$ ifconfig -l eth0

3. Run the following command to perform TFTP test

$ fs 1:

$ tftp -r 70 192.168.0.1 <file located in the based directory of TFTP server>

4. Once tftp is completed, list the directory to confirm that the file is successfully transferred

$ ls

8.6 BOOT LINUX

8.6.1 FROM PITSTOP CONSOLE


Page 24 of 45

8.6.1.1 FROM RAM

1. Enable Pitstop utility before compile the UEFI source code

2. Completed all the steps in section 8.1 if you did not install the SOCVP

3. Completed all the steps in section 8.3 to start SOCVP and debugger

4. Press any key in Console 0 whenever UEFI bootloader is loaded to enter PitStop utility

5. Type command “bootr” to boot Linux from RAM

$ bootr

8.7 BOOT VXWORKS

8.7.1 FROM DXE CONSOLE 1. Completed the steps 1-4 in section 8.4.1

2. At the DXE console, you would need to have vXworks image in your FAT partition. You can either transfer

the vXworks image using TFTP or include the vXworks image when creating a SD image. Here, the first


Page 25 of 45

method is used. Completed the steps in section 8.5 to set up TFTP server and run the TFTP in client side to

transfer the file

3. After the file transferred is done, run the following command in DXE console to boot VxWorks

$ runaxf vxWorks

4. You will see the VxWorks is booted up in console 1

9 PXE In this section, you will learn how to setup PXE boot for SOCVP in a dedicated Ubuntu machine.


Page 26 of 45

9.1 PXE SERVER - UBUNTU MACHINE

9.1.1 NETWORK SETUP

9.1.1.1 DEPENDENCIES

1. You need to install the dependencies:

$ sudo aptitude install bridge-utils iproute2

2. Make sure that “tun” kernel module is in place

$ sudo modprobe tun

9.1.1.2 SETUP INTERNET VIA ETH0 AND BRIDGE VIA DHCP

In this case, we have internet connection via WiFi (wlan0 interface), which is in external network (IP address obtained from external DHCP server). It shown on image below as separate subnetwork.

We also have local sub-network with local DHCP network. Local DHCP offers IP addresses to bridge interface "br0". PXE server (next-server) is bridge itself. UEFI talks to PXE server vi TAP interface "tap0". UEFI S10 obtains IP address for it's "eth0" interface (should've not be confused with laptop's "eth0" interface) from DHCP server on "br0" via "tap0".

All the stuff shown on the image above is on the same single laptop

9.1.1.3 CONFIGURATION

1. To configure the network, you can create a script with the following content. You need to make sure edit "user" variable appropriately:

user=your-user-name


Page 27 of 45

tap=tap0

bridge=br0

nic=eth0

echo "---> Creating taps..."

ip tuntap add dev $tap mode tap user $user

ip link set dev $tap up

echo "---> Creating bridge..."

brctl addbr $bridge

brctl setfd $bridge 0

brctl addif $bridge $nic

brctl addif $bridge $tap

echo "---> Bringing interfaces and bridge up..."

ifconfig $tap 192.168.0.4 promisc up

ifconfig $nic 192.168.0.9 promisc up

ifconfig $bridge 192.168.0.1 netmask 255.255.255.0 up

echo "---> Restart DHCP server"

service isc-dhcp-server restart

2. Run the next script (from root). Pay attention that we are using “192.168.0.1” as PXE Server IP address

If your "isc-dhcp-server" package wasn't installed correct (with error message "[FAIL] Starting ISC DHCP server: dhcpd[....] check syslog for diagnostics"), be sure to run next command after executing script above: $ sudo dpkg –configure isc-dhcp-server

9.1.1.4 REMOVING CONFIGURATION

1. You can create script with the following content to remove all the setup that was done in previous step

(this script requires some modifications though):

if ! brctl show | grep $bridge >/dev/null; then

echo -n "TAP Bridge $bridge does not exist "


Page 28 of 45

echo "and no FMNetwork to stop."

exit 1

fi

# take down the bridge

ifdown $bridge

# remove the interfaces from the bridge

for tap in $taps; do

brctl delif $bridge $tap

ifconfig $tap down

# tapctrl -n $tap -a delete -t tap

ip link set dev $tap down

ip tuntap del dev $tap mode tap

done

brctl delif $bridge $nic

# delete the bridge

ifconfig $bridge down

brctl delbr $bridge

# unset promiscuous mode

ifconfig $nic -promisc

ifup $nic

9.1.2 PREPARE BOOTIMAGE

For PXE test, a standard EFI application is required for bootimage. In our test, HelloWorld.efi is used. It is located at

Build\Stratix10SoCPkg\RELEASE_GCC48\AARCH64\HelloWorld.efi

1. Copy HelloWorld.efi to the TFTP boot file path which is /var/lib/tftpboot

$ cp HelloWorld.efi /var/lib/tftpboot

9.1.3 TFTP SERVER IN UBUNTU TFTP server provide files transfer over network


Page 29 of 45

1. Install the TFTP server

$ sudo apt-get install tftpd-hpa tftp

2. Edit the file in /etc/default/tftpd-hpa as follows

TFTP_USERNAME="tftp"

TFTP_DIRECTORY="/var/lib/tftpboot"

TFTP_ADDRESS="0.0.0.0:70"

TFTP_OPTIONS="--secure"

9.1.4 XINETD There are 2 approaches on how to run tftpd daemon:

1. Let tftpd to be always running (via specifying RUN_DAEMON="yes" in tftpd-hpa config file)

2. Let super-server handle tftpd starting

"xinetd" is super-server daemon. It listens for incoming requests over a network and launches the appropriate

service for that request. In our case, it will start tftpd service when it catches TFTP request over the network.

1. Install xinetd

$ sudo apt-get install xinetd

2. Create “/etc/xinetd.d/tftp” file with the following contents

service tftp

{

protocol = udp

port = 70

socket_type = dgram

wait = yes

user = root

server = /usr/sbin/in.tftpd

server_args = --secure /var/lib/tftpboot

disable = no

}


Page 30 of 45

Argument Description

Disable=no Enable spawning TFTPD process

Server_args=/var/lib/tftpboot Path to the TFTP files

Server_args= --secure Use relative (rather than absolute) patches.

You may see the “man tftpd” for more details

3. Once the config is modified, restart the xinetd

$ sudo service xinetd restart

9.1.5 DISABLE FIREWALL

1. Check that your firewall is not blocking DHCP/TFTP traffic (UDP) or alternatively, just turn off the firewall

together

$ iptables -F

$ iptables -X

$ iptables -P INPUT ACCEPT

$ iptables -P FORWARD ACCEPT

$ iptables -P OUTPUT ACCEPT

$ iptables -t mangle -F

$ iptables -t mangle -X

$ iptables -t nat -F

$ iptables -t nat -X

2. Check the iptables. If you turned it off, there should be no rules and the policy should be ACCEPT

$ iptables-save

9.1.6 DHCP SERVER DHCP server offers IP addresses to clients

1. Install the server

$ sudo apt-get install isc-dhcp-server


Page 31 of 45

If installation wasn't completed due to error. This can be fixed later (after bringing network bridge up). DHCP server can be started after network bridge is up and we can finish "isc-dhcp-server" package installation using "sudo dpkg --configure" command.

2. Edit the “etc/default/isc-dhcp-server” file to contain the line below because DHCP server will be offering

addresses to the network i.e. UEFI S10 model

INTERFACES=”br0”

3. Added these lines to the “/etc/dhcp/dhcpd.conf” file

allow booting;

allow bootp;

subnet 192.168.0.0 netmask 255.255.255.0 {

range 192.168.0.100 192.168.0.253;

}

next-server 192.168.01;

filename “HelloWorld.efi”;

Field Description

next-server IP address of PXE server (this PC)

filename Bootloader file to be offer via TFTP

9.2 PXE CLIENT- UEFI

9.2.1 SOCVP SETTING 1. Add the following setting into the parameter.txt for SOCVP

vlan:type = tap

#vlan:ifname = tap0 #This is default value

eth_mac = D0:67:E5:48:F4:49

multicast_passthrough = 1 #enable multicast messaging

eth_mac is the MAC address of bridge br0


Page 32 of 45

9.2.2 BOOT UEFI

1. Once booted into the DXE phase, press any key to choose the boot selection

2. In the DXE console, type the following command to boot from PXE

a. Press “3” to choose the “Boot Manager”

b. Press “1” to choose the “Add Boot Device Entry”

c. Press “3” to choose the boot device which is “PXE on MAC Address: 02:11:22:33:44:55”

d. Press “y” when you are being asked where is it an EFI application

e. Enter “pxe” as the description for the new entry

f. Press “7” to return to the main menu

g. Now you will see PXE appear in the boot selection menu. Select the option “pxe” in order to boot

from PXE

3. You will see “Hello World” when the board is successfully booted up from PXE

10 RUNNING UEFI ON SIMICS

10.1 INSTALLING SIMICS

To run UEFI on Simics environment, you would need to install the require packages.


Page 33 of 45

1. Download the package 1000 (Simics Base package) and package 7997 (Altera Stratix 10 model library)

• simics-pkg-1000-5.0.128-linux64.tar

• simics-pkg-7997-5.0.pre4-linux64.tar

2. Untar the package downloaded and a simics-5-install directory is created

$ tar xf simics-pkg-1000-5.0.128-linux64.tar

$ tar xf simics-pkg-7997-5.0.pre4-linux64.tar

3. Change the directory to simics-5-install directory and install simics using the installation script located in

this folder

$ cd simics-5-install

$ ./install-simics.pl

4. The installation process would ask for decryption code for the package. Please make sure that you have the

decryption code.

5. Choose to install all the packages available

6. You need to set the destination directory. The default is /opt/simics/simics5 and you can change to your

desired directory


Page 34 of 45

You may refer to the installation guide available in the simics-5-install directory

10.2 RUNNING SIMICS WITH ATF AND UEFI BOOTLOADER IMAGES

After the installation of Simics in your machine, now you can start to run UEFI bootloader on Simics. The steps below

show how to run UEFI in Simics

1. You need to create a user workspace which contain all the necessary Simics files

$ cd <Simics installation directory>/simics-5.0.128/bin

$ ./workspace-setup <Your desired directory for the workspace>


Page 35 of 45

2. Change to your workspace directory and you can use the command below to make sure you have installed

the packages mention in section 10.1

$ ./simics -v

3. Create a top-level script in the workspace to boot up arm-trusted-firmware. You will need to include the

bl31 image in the path <simics-workspace>/targets/s10-soc/images if you follow the script shown in below

$ vi run_uefi_shell.simics

4. Launch Simics and wait until all Simics window appear

5. Type “c” in Simics CLI to continue the boot up process

6. Interrupt the processor through simics console when the memory initialization is done


Page 36 of 45

7. Load the PEI phase and DXE phase image into the DDR memory

$ load-file filename=<Path to PEI.ROM> offset=0x50000

$ load-file filename=<Path to DXE.ROM> offset=0x02000000

8. Continue the boot up process by typing “c” in Simics CLI command

10.3 PING TEST

1. Complete the steps in section 10.2 to run UEFI in Simics environment. Skips the step 1-2 if you have already

set up your workspace



$ ifconfig -l eth0

$ ping -n 2 192.169.0.1


Page 37 of 45

10.4 DHCP TEST

1. Complete all the steps in section 10.2 to boot up UEFI into DXE phase in Simics. Skips the step 1-2 if you

have already set up your workspace


$ ifconfig -s eth0 dhcp

$ ifconfig -l eth0


Page 38 of 45

10.5 TFTP TEST

10.5.1 SETUP TFTP SERVER AT SIMICS

Simics provides an embedded TFTP server to transfer files between the host system and a simulated client. The files

to be transferred from the host system to the simulated client should be placed in a directory in the Simics path.

1. Create a directory that is used for TFTP and include the files that you wish to transfer to TFTP client

$ mkdir <your_ directory_for_TFTP>

2. Launch simics and add this directory into the embedded TFTP server search path

$ add-directory <your_directory_for_TFTP>


Page 39 of 45

10.5.2 RUN TFTP AT CLIENT SIDE

1. Launch Simics and boot up UEFI until DXE phase

2. At DXE console, execute the following command to use the static IPv4 address configuration for Ethernet

interface


$ ifconfig -l eth0

3. Run the following command to perform TFTP test

$ fs1:

$ tftp 192.168.0.1 <file located in the directory of TFTP server>


Page 40 of 45

4. Once the tftp is completed, list the directory to confirm that the file is successfully transferred

$ ls

11 RUNNING UEFI ON PHYSICAL BOARD

11.1 RUNNING PHYSICAL BOARD WITH ATF AND UEFI BOOTLOADER

In this section, you will learn how to run the secure monitor on a physical board.

11.1.1 GENERATE SOF FILE WITH ATF 1. Get a SOF file from SOCEDS installation directory

2. Convert the binary file “bl31.bin” generated from section 6.2.3

$ aarch64-linux-gnu-objcopy -I binary -O ihex - -change-addresses 0xffe00000 bl31.bin bl31.hex

3. Include the bootloader into the sof file

$ quartus_cpf - -bootloader=bl31.hex ghrd_1sx280lu3f50i3vg.sof ghrd_1sx280lu3f50i3vg_hps.sof


Page 41 of 45

11.1.2 CREATE SD CARD IMAGE WITH PEI.ROM AND DXE.ROM 1. Generate the PEI.ROM and DXE.ROM based on the section 7.1.5

2. Grab a prebuilt SD card image from Rocketboard [https://rocketboards.org/foswiki/Main/Stratix10EAPGSRD]

3. Program the prebuilt SD card image into SD card.

4. Copy the PEI.ROM and DXE.ROM to the FAT partition of the SD card

11.1.3 RUNNING SECURE MONITOR

1. Power up the board after SD card is inserted

2. Open Quartus programmer and program the board with the SOF file generated in Section 11.1.1


Page 42 of 45

3. The board will boot up from Arm-Trusted-Firmware and automatically loaded PEI.ROM and DXE.ROM from

SDMMC to boot to DXE phase

11.1.4 DEBUG WITH DS-5

In this section, you will learn how to load Arm-Trusted-Firmware and UEFI bootloader to the physical board through

DS-5 debugger.

1. Launch eclipse by using the following command

$ eclipse &

2. Switch to the DS-5 Debug perspective

3. Create a S10 Separate Jtag Dstream debug configuration


Page 43 of 45

4. Connect to the target once the configuration is done

5. At the DS-5 command console, run the following command

$ interrupt

$ restore <Path_to_bl31.bin> binary 0xffe00000

$ set var $pc=0xffe00000

$ continue

If semihosting is enabled in platform_def.h for building the bl31 image, DS-5 must enable it too with the command “set semihosting enable true” before the command “continue” to continue the boot up process

6. This will load the Arm-Trusted-Firmware to the board and continue the boot up process. It will load the PEI.ROM

and DXE.ROM from SDMMC automatically

7. If you would like to use debugger to load the PEI.ROM and DXE.ROM to memory, modify the configuration in

your platform_def.h file and bl31_plat_setup.c file before building bl31 image

8. Open the platform_def.h file located in <location-of-arm-trusted-firmware-source-

code>/plat/intel/soc/stratix10/platform_def.h and enable semihosting

# define PLAT_SEMIHOSTING_ENABLE

9. Open the bl31_plat_setup.c file located in <location-of-arm-trusted-firmware-source-

code>/plat/intel/soc/stratix10/bl31_plat_setup.c and commented out the line shown below

//LoadBootImageFile (PLAT_NS_IMAGE_NAME, PLAT_NS_IMAGE_OFFSET);

10. Regenerate the bl31 image and follow step 5 to load the arm-trusted-firmware to the physical board. Interrupt

the processor through DS-5 debugger once memory initialization is successful

$ interrupt


Page 44 of 45

11. Load the PEI.ROM and DXE.ROM to the physical board with DS-5 debugger by using the following command

$ restore <Path_to_PEI.ROM> binary 0x50000

$ restore <Path_to _DXE.ROM> binary 0x02000000

$ continue

11.2 BOOTING LINUX

This section shows you how to boot Linux after UEFI enter DXE phase

11.2.1 BOOT FROM DXE CONSOLE 1. Completed the steps in section 11.1.3 to boot the board until DXE phase

2. Once the DXE phase is loaded, enter the following command to boot Linux

$ Linuxloader fs1:Image -d fs1:socfpga_stratix10_socdk.dtb -c “console=ttyS0,115200

root=/dev/mmcblk0p2 rw rootwait”


Page 45 of 45

Please make sure that Linux image is stored in the SD card

Documents

S 10 S C UEFI B U G · $ git checkout -t -b origin/socfpga_v1.4 6.2.3 BUILDING BL31 IMAGE In this section, you will learn how to build the Arm-Trusted-Firmware