RubikPi as a development platform

Technical Sharing
1

I would like to use this device as a development platform and will require a way to sign and load images directly on the Hexagon DSP. Typically I would use a program called sectools along with a device security profile file to sign images. If they are already provided please let me know where to find them, otherwise please add them to a existing repo or create a new one.

I will also require the devcfg.mbn without access controls, named devcfg_noac.mbn.

Having a technical reference manual that describes the address ranges within the SOC would also be very helpful.

2

You need to ask Qualcomm for the QCM6490 (will work on QCS, because the soc is just a APQ variant. source is entirely compatible) BSPs (specifically trustzone_images for devcfg) and sectools.
It is not allowed to be shared

3

Hey Qualcomm where are these things? Is this the official position of the device vendor?

4

Qualcomm is the SoC vendor who also distributes the BSPs (board support package) to device vendors, vendors usually modify the bsps to some extent, but the rubik seems to be rather clean.

5

We can build the devcfg.mbn without access controls for you, named devcfg_noac.mbn.
Due to license restrictions, the image signing-related content is not yet open-sourced. If you are an enterprise-level user, please leave your email, and we will continue the discussion via email.

6

Limiting devcfg_noac.mbn to enterprise users isn’t ideal for the community at large. I acknowledge that poor choices in memory access with noac will result in system crashes but the role of a development target is to grant users willing to experiment that option.

With respect to signing (sectools) please take note that Qualcomm has recently released H2, see: GitHub - qualcomm/hexagon-hypervisor: Hexagon Hypervisor (AKA h2) is a light weight OS / Hypervisor for the Qualcomm Hexagon processor family · GitHub My only experience loading custom firmware is by using sectools and the device security profile to create the mbn.

When the above is available on RubikPI, getting linux to run on the device might be possible given the recent updates seen here: https://git.kernel.org/pub/scm/linux/kernel/git/bcain/linux.git/

No good deed goes unpunished, and if the the above is made public the next ask will be for a technical reference so developers can understand the memory layout and MMIO spaces of the SOC.

7

Regarding the devcfg_noac.mbn image, we can build and provide a version with access controls disabled for you.
Thank you as well for your response and suggestions. We are currently aligning internally and will carefully review and consider the items raised.

8

I noticed that Qualcomm has release sectools here: https://softwarecenter.qualcomm.com/api/download/software/tools/Qualcomm_Security_Tools/All/1.45.0/1.45.zip
I’ve only used sectools with the SOC’s security profile.

Without this file I’m not able to produce images that will run on the DSP. Is there an option that doesn’t require the security profile?

9

Following up here, I recently learned how to sign a binary using publicly available resources.

WARNING The following can jeopardize your target so be careful.

  • Locate and backup the existing firmware. On my rubikpi the DSP firmware files are here: /usr/lib/firmware/updates/qcom/qcs6490:
cdsp.b00 cdsp.b01 cdsp.b02 cdsp.b03 cdsp.b04 cdsp.b05 cdsp.b06
cdsp.b07 cdsp.b08 cdsp.b09 cdsp.b10 cdsp.b11 cdsp.b12 cdsp.b13
cdsp.b14 cdsp.b15 cdsp.mdt

  • Basically all the cdsp.* files need to be backed up.

  • Now make an sample program to verify DSP control.

.section .entry, "awx", @progbits
r0 = #0
1:
r0 = add(r0, #1)
memw (##0x88f01000) = r0
jump 1b

Makefile might might contain a rule like this to build:

cdsp.elf: main.S Makefile
        hexagon-clang  -mv68 main.S -nostartfiles \
                -Wl,-Ttext,0x88f00000 \
                -Wl,-entry,0x88f00000 \
                -o $@

Notice the start address, 0x88f00000. It is critical that you verify this matches with the original cdsp.mdt in the firmware directory, use readelf -h and verify the Entry point address matches.

  • Signing the image
cdsp.mdt: cdsp.elf
        ../qtestsign/qtestsign.py -v 6 cdsp cdsp.elf -o cdsp.mdt

At this point you have a program that will increment a value stored at 0x88f01000. Once copied to the target you can use devmem2 to view the memory. Because this program does not respond the way the default firmware does the kernel will disable the DSP after a few seconds, to prevent this you must tweak the host kernel.

Assume you have the kernel sources and are comfortable rebuilding and installing your own kernel, locate qcom_q6v5.c and the function qcom_q6v5_wait_for_start. Just return 0 instead. The change would resemble this:

int qcom_q6v5_wait_for_start(struct qcom_q6v5 *q6v5, int timeout)
{
/**
 * This will allow the remote processor to continue to run.
 * Non-standard software may not correctly signal back.
 **/
	return 0;

	int ret;

	ret = wait_for_completion_timeout(&q6v5->start_done, timeout);

See: Comparing rubikpi-ai:main...atx0x200:hexagon · rubikpi-ai/linux · GitHub

Once you have control of the DSP you are now free to learn and destabilize your target all you want. Take a look at the documentation: https://docs.qualcomm.com/doc/80-N2040-50/80-N2040-50_REV_AA_Qualcomm_Hexagon_V69_ProgrammerS_Reference_Manual.pdf

Check out chapter 11.9 for the system insns, these are monitor mode system instructions that will be important if you want to really dig into the low-level DSP programming.

Another interesting resource is this: GitHub - qualcomm/hexagon-hypervisor: Hexagon Hypervisor (AKA h2) is a light weight OS / Hypervisor for the Qualcomm Hexagon processor family · GitHub

Building the hypervisor to run on the RubikPi would be a fun and interesting project but will require some finesse.

10

Thank you for sharing.

11

Having a copy of devcfg_noac.mbn would be extremely helpful. Can you place a copy in github?

12

Any update on the availability of devcfg_noac.mbn? The default access controls are very limiting when doing new development.

13

Please download devcfg.noac through the link and verify if it meets the requirements.
Share file: devcfd_noac.mbn
Cloud disk link: 查看分享
Extract password: 03tp