repk / gxlimg

gxlimg
======

Gxlimg is an amlogic s905x boot image creation tools. This has been made by
reverse engineering the aml_encrypt_gxl binary used to create boot image as
well as the BL2 arm binary that reads FIP header and loads BL3* and u-boot
images.

Some reverse engineering notes can be found in reveng directory, please note
that because I decompiled aml_encrypt_gxl by hand (not using a tool like IDA),
some mistakes could have slept in those notes. The purpose was first to
familiarized myself with subject such as ARM assembly and Arm Trust Firmware
(ATF).


I - Build instructions
----------------------

In order to build this tool just use the following:

 $ make

If you want some debug information and print use the following instead:

 $ make DEBUG=1

II.A - Create a boot image - automated version
----------------------------------------------

1) Compile u-boot:

  Compile mainline u-boot from http://git.denx.de/

   $ make CROSS_COMPILE=aarch64-elf- libretech-cc_defconfig
   $ make CROSS_COMPILE=aarch64-elf- all

  Replace aarch64-elf- with the prefix of your aarch64 toolchain.
  This should produce a u-boot-dtb.bin file.

2) Generate image

  Use the image target to generate the build/gxl-boot.bin image.

  $ make image UBOOT=<path/to/u-boot-dtb.bin>

II.B - Create a boot image - manual version
-------------------------------------------

In order to create a boot image for s905x board such as lepotato board, you
can follow those steps below.


1) Get BL* binaries:

  Follow instructions from here https://github.com/BayLibre/u-boot that build
  vendor u-boot in order to get BL* binaries.

2) Sign BL2:

  Use gxlimg as below to sign BL2 binary along with its DDR initialization
  datas:

   $ ./fip/blx_fix.sh fip/gxl/bl2_acs.bin zero_tmp fip/gxl/bl2_zero.bin \
     fip/gxl/bl21.bin fip/gxl/bl21_zero.bin bl2_new.bin bl2
   $ gxlimg -t bl2 -s bl2_new.bin bl2.bin.enc

3) Encrypt BL3*:

  Use the following to encrypt BL3* binary

   $ gxlimg -t bl3x -c ./fip/gxl/bl30_new.bin bl30.bin.enc
   $ gxlimg -t bl3x -c ./fip/gxl/bl31.img bl31.img.enc

4) Compile u-boot:

  Compile mainline u-boot from http://git.denx.de/

   $ make CROSS_COMPILE=aarch64-elf- libretech-cc_defconfig
   $ make CROSS_COMPILE=aarch64-elf- all

  Replace aarch64-elf- with the prefix of your aarch64 toolchain.
  This should produce a u-boot-dtb.bin file.

5) Encrypt u-boot:

  Encrypt the previously built u-boot image:

   $ gxlimg -t bl3x -c u-boot.bin u-boot.bin.enc

6) Create the final boot image:

  To create the final image issue the command below:

   $ gxlimg -t fip --bl2 ./bl2.bin.enc --bl30 ./bl30.bin.enc \
     --bl31 ./bl31.img.enc --bl33 ./u-boot.bin.enc ./gxl-boot.bin

II.c - Create USB boot files
----------------------------

The ROM USB Boot mode on GXL, GXM & AXG uses .usb.bl2 and .usb.tpl files to boot,
as used by pyamlboot (https://github.com/superna9999/pyamlboot)

The first binary contains the encrypted BL2 and the second the rest of the gxl-boot.bin

To generate:

$ dd if=gxl-boot.bin of=u-boot.bin.usb.bl2 bs=49152 count=1
$ dd if=gxl-boot.bin of=u-boot.bin.usb.tpl skip=49152 bs=1

Then copy them into files/<boardname>/u-boot.bin.usb.bl2 & files/<boardname>/u-boot.bin.usb.tpl
in the checkout source of pyamlboot, then follow instructions at:
https://github.com/superna9999/pyamlboot#booting-full-system-from-usb

III - Write the image to the SD card
------------------------------------

1) Prepare the SD card:

  First compute how many sectors gxl-boot.bin uses by getting its size and
  dividing it by 512.

  Let's say your gxl-boot.bin is 653312 Bytes thus you need 1276 sectors you
  can give you a little bit margin and choose a gap of 2048 sectors for your
  first partion.

  Then create the partition:

   $ sudo fdisk /dev/mmcpblk0
   $ n
   $ p
   $ 1
   $ 2048 # <- enter the number of sectors previously computed
   $ # <- take the whole remaining space for the partition
   $ w

  Then create a fs on it:

   $ mkfs.ext3 /dev/mmcblk0p1

  And copy or install a linux ARM file system.

2) Copy boot image to SD:

  The copy image to SD being careful to not erase the first 512 block (holding
  the MBR partition table)

   $ dd if=./gxl-boot.bin of=/dev/mmcblk0 bs=512 seek=1