Tuesday, February 15, 2011

qemu with Z2 support

I spent some days getting qemu to emulate some Z2 hardware, and got some results :)
Almost all hw is emulated, it lacks only voltage regulator and WiFi, but it's not easy to implement Marvell's WiFi chip, because there's no datasheet, and anyway it makes no sense. Also screen rotation is not supported (yet).

Stock bootloader - blob - (with slight modification) and stock kernel works. Blob puts Z2 into deepsleep on reset, so I hacked it not to do this.

How to compile qemu:

So, how to hack blob:
  • put your blob image (first 64kb of NOR) somewhere
  • convert it to hex representation with xxd: xxd mtdblock1.bin >mtdblock1.hex
  • apply patch onto mtdblock1.hex
  • convert hex back to bin: mv mtdblock1.bin mtdblock1.bin.bak; xxd -r mtdblock1.hex >mtdblock1.bin
I don't put modified nor original blob binary anywhere, as I doubt it's legal.

How to run stock sw:
  • cd qemu-z2; mkdir z2; wget http://downloads.tuxfamily.org/linuxrx1950/tmp/z2_start.sh
  • Combine mtdblocks into one flash image: cat mtdblock1.bin >z2_flash; cat mtdblock2.bin >>z2_flash; cat mtdblock3.bin >>z2_flash
  • So, z2 directory contains following files: z2_start.sh, z2_flash
  • Now just start z2_start.sh script
How to run latest kernel:
  • Use same z2_flash and z2_start.sh files from z2 directory
  • You'll also need kernel image - zImage (not uImage!)
  • Start z2_start.sh as follows: ./z2_start.sh -kernel zImage -append console=tty0
You can also use SD card image, just specify -sd image.filename as argument to z2_start.sh script

Update (2013-Nov-27): link to blob patch is updated!


tyler roberts said...

do you need to clone the thing to somewhere special?
or can it go just about anywhere

anarsoul said...

Actually, now you can just use qemu from your distro repository. My changes were merged ~year ago or so

tyler roberts said...

where? I cant seem to do anything software related lately

anarsoul said...

Install qemu from yours distro repo:
apt-get install qemu or pacman -S qemu or emerge qemu, then check qemu version with 'qemu-system-arm --version', you don't need to compile qemu by yourself if it's 1.1.0 or newer. You can check that Z2 emulation is here by invoking 'qemu-system-arm -M ?', it's last in list for qemu-1.2.0

tyler roberts said...

one last question; where do you get the mtdblockx.bin files?
if you get them off a stock zipit then is there a alternative?

anarsoul said...

You don't need them to test mainline firmware (openwrt?), just do 'dd if=/dev/zero of=z2_flash bs=1k count=8k' to prepare empty flash image.

tyler roberts said...

i lied; one more question; how do you get u-boot to stay awake?
qemu keeps giving me this: "machine entered Deep-sleep mode"

tyler roberts said...

how do you make the zImage of openwrt?

anarsoul said...

You can use uImage, qemu recognizes it aswell

anarsoul said...

And just pass kernel to qemu, don't try to boot via u-boot

Unknown said...
This comment has been removed by the author.
dukzcry said...

> qemu keeps giving me this: "machine entered Deep-sleep mode"

The patch is reversed by a mistake. Just open an mtdblock1.hex with editor and do a reversive operation by a hand, i.e. change 001a to 00ea.

tycho said...

I tried running this and get:


Qemu jumps to 100% cpu, i left it for 30 minutes and then killed it ; nothing happens, on any of the machines.

Any way to debug this? It's 1.2.0 and it does have z2 support etc.

bobthebear said...
This comment has been removed by the author.
bobthebear said...

> where do you get the mtdblockx.bin files?
Here they are: https://drive.google.com/file/d/0ByyEP_2OsyDfSjl4MnRSN0tjQlU/edit?usp=sharing