Archive for February, 2015

TIVA C Series TM4C1294 Connected LaunchPad Eval Kit programming via Energia



1. Host environment: Ubuntu 14.04 LTS 64-bit. Connect the debug port of Launchpad to the host machine via USB cable. Check “dmesg” and identify /dev/ttyACM0 as being automatically configured.

2. Download Energia (and untar it into a directory):

3. Go to the Energia download directory, and enter “sudo ./energia”. Then File->Example->Basic->Blink to load the Blinker source code (as the example code). Then goto “Tool->Board” to select TM4C129 as the board. And next “Tool->Serial Port” to select /dev/ttyACM0 as the port, which is discovered through “dmesg”.

4. Compile and upload the example code, which will go to the TM4C1294 board automatically.

5. Looking into the console output you can see Energia executing under the hood:

[/home/tthtlc/Downloads/energia-0101E0014/hardware/tools/lm4f/bin/arm-none-eabi-g++, -Os, -nostartfiles, -nostdlib, -Wl,–gc-sections, -T, /home/tthtlc/Downloads/energia-0101E0014/hardware/lm4f/cores/lm4f/lm4fcpp_snowflake.ld, -Wl,–entry=ResetISR, -mthumb, -mcpu=cortex-m4, -mfloat-abi=hard, -mfpu=fpv4-sp-d16, -fsingle-precision-constant, -o, /tmp/build6614371312095748777.tmp/Blink.cpp.elf, /tmp/build6614371312095748777.tmp/Blink.cpp.o, /tmp/build6614371312095748777.tmp/core.a, -L/tmp/build6614371312095748777.tmp, /home/tthtlc/Downloads/energia-0101E0014/hardware/lm4f/cores/lm4f/driverlib/libdriverlib.a, -lm, -lc, -lgcc, -L/tmp/build6614371312095748777.tmp, -lm]

[/home/tthtlc/Downloads/energia-0101E0014/hardware/tools/lm4f/bin/arm-none-eabi-objcopy, -O, binary, /tmp/build6614371312095748777.tmp/Blink.cpp.elf, /tmp/build6614371312095748777.tmp/Blink.cpp.bin]

Binary sketch size: 2,380 bytes (of a 1,048,576 byte maximum)
Found ICDI device with serial: 0F000CFF
ICDI version: 12245

6. Now disassemble the binary (based on the console output above) using the following command:

/home/tthtlc/Downloads/energia-0101E0014/hardware/tools/lm4f/bin>./arm-none-eabi-objdump -d /tmp/build6614371312095748777.tmp/Blink.cpp.elf

The output is here:

7. The disassembled codes can be read off as for example:

00000208 :
208: b508 push {r3, lr}
20a: 2101 movs r1, #1
20c: 2051 movs r0, #81 ; 0x51
20e: f000 f867 bl 2e0
212: f44f 707a mov.w r0, #1000 ; 0x3e8
216: f000 f8a9 bl 36c
21a: 2051 movs r0, #81 ; 0x51
21c: 2100 movs r1, #0
21e: f000 f85f bl 2e0
222: f44f 707a mov.w r0, #1000 ; 0x3e8
226: e8bd 4008 ldmia.w sp!, {r3, lr}
22a: f000 b89f b.w 36c

00000230 :
230: 4b26 ldr r3, [pc, #152] ; (2cc <pinMode+0x9c>)
232: 4a27 ldr r2, [pc, #156] ; (2d0 <pinMode+0xa0>)
234: b570 push {r4, r5, r6, lr}
236: 5c1d ldrb r5, [r3, r0]
238: 4b26 ldr r3, [pc, #152] ; (2d4 <pinMode+0xa4>)
23a: 5c1b ldrb r3, [r3, r0]
23c: f852 4023 ldr.w r4, [r2, r3, lsl #2]
240: 2b00 cmp r3, #0
242: d042 beq.n 2ca <pinMode+0x9a> 244: 4e24 ldr r6, [pc, #144] ; (2d8 <pinMode+0xa8>)
246: b911 cbnz r1, 24e <pinMode+0x1e> 248: 6833 ldr r3, [r6, #0]
24a: 6b9b ldr r3, [r3, #56] ; 0x38
24c: e03a b.n 2c4 <pinMode+0x94> 24e: 2902 cmp r1, #2
250: d116 bne.n 280 <pinMode+0x50> 252: 4b22 ldr r3, [pc, #136] ; (2dc <pinMode+0xac>)
254: f8c4 3520 str.w r3, [r4, #1312] ; 0x520



Getting Genode with TrustZone on the i.MX53 Quick Start Board


First download the toolchain for ARM compilation, and then the Genode OS itself, all listed here:

Details description of Genode and its installation are found here:

Install all the necessary packages for Ubuntu 14.04 (present host):

apt-get install libSDL-dev
apt-get install libsdl1.2-dev -> shows it is already newest version
apt-get install tk8.5 tcl8.5
apt-get install expect
apt-get install byacc
apt-get install qemu
apt-get install genisoimage
sudo apt-get install expect
sudo apt-get install udisks

After untarring the genode toolchain /usr/local/genode-gcc directory, next is to untar the Genode OS download to “genode-14.11”.

With some assistance as documented here:

cd genode-14.11/
cd tool/

Listing all the hardware:



Now we set the hardware to be imx53:

./create_builddir hw_imx53_tz BUILD_DIR=build_imx53
cd build_imx53/

Setting up it for uboot as the bootloader:

echo "SPECS += trustzone" >> etc/specs.conf
echo "RUN_OPT = --target uboot" >> etc/build.conf
make run/tz_vmm

After this “uImage” is generated in the build_imx53/var/run.

Now, to download u-boot bootloader (and its ARM gcc compiler):

git clone uboot_stein

cd uboot_stein/


Extract out the config file:

make ARCH=arm CROSS_COMPILE=/opt/gcc-linaro-arm-none-eabi-4.9-2014.09_linux/bin/arm-none-eabi- usbarmory_config

Now start the make process:

make ARCH=arm CROSS_COMPILE=/opt/gcc-linaro-arm-none-eabi-4.9-2014.09_linux/bin/arm-none-eabi- V=1

Notice a “u-boot.imx” is created. But first we need to format the sdcard.

(from hence onwards my sdcard is detected as /dev/sdg???):

Aim: make a sdcard from uImage, which will require uboot bootloader:

sudo parted /dev/sdg –script mklabel msdos

sudo parted /dev/sdg –script mkpart primary ext4 5M 100%

Upon completion, “dd” the u-boot.imx (which is meant for imx53 as the target) to the sdcard’s 3rd 512-block:

sudo dd if=./u-boot.imx of=/dev/sdg seek=2 bs=512 conv=fsync

Take a look at the partition:

sudo fdisk -l /dev/sdg

sudo mkfs.ext4 /dev/sdg1

Now /dev/sdg1 is ext4-formatted, mount it:

udisks –mount /dev/sdg1

Copy the uImage there to the rootfs:

cp uImage /media/371a8dd7-58c1-4beb-aed3-cb18fb40f7eb/

And umount it:

sudo udisks –umount /dev/sdg1

Now insert the sdcard into i.MX53QSB and connect via serial port, bootup message as follows:

U-Boot 2014.07-g0ca0b0f (Feb 20 2015 – 09:14:08)

Board: USB armory
I2C: ready
DRAM: 256 MiB
*** Warning – bad CRC, using default environment

In: serial
Out: serial
Err: serial
Net: CPU Net Initialization Failed
No ethernet found.
Hit any key to stop autoboot: 0

=> ext2ls
ext2ls – list files in a directory (default /)

ext2ls <interface> <dev[:part]> [directory]
– list files from ‘dev’ on ‘interface’ in a ‘directory’

=> ext2ls mmc 0:1
<DIR> 4096 .
<DIR> 4096 ..
<DIR> 16384 lost+found
7860111 uImage

=> ext2load mmc 0:1 0x70200000 uImage
7860111 bytes read in 583 ms (12.9 MiB/s)

=> bootm 0x70200000
## Booting kernel from Legacy Image at 70200000 …
Image Name:
Image Type: ARM Linux Kernel Image (gzip compressed)
Data Size: 7860047 Bytes = 7.5 MiB
Load Address: 70010000
Entry Point: 70010000
Verifying Checksum … OK
Uncompressing Kernel Image … OK

Starting kernel …

kernel initialized
Genode 14.11
int main(): — create local services —
int main(): — start init —
int main(): transferred 246 MB to init
int main(): — init created, waiting for exit condition —
[init] Could not open file “
[init] parent provides
[init] service “ROM”
[init] service “RAM”
[init] service “IRQ”
[init] service “IO_MEM”
[init] service “CAP”
[init] service “PD”
[init] service “RM”
[init] service “CPU”
[init] service “LOG”
[init] service “SIGNAL”
[init] service “VM”
[init] child “tz_vmm”
[init] RAM quota: 3932160
[init] ELF binary: tz_vmm
[init] priority: 0
[init -> tz_vmm] Start virtual machine …
undefined instruction

More debugging needed……

Doing Yoctoproject development on the i.MX53 Quick Start Board

Starting with:

Doing this on my Ubuntu 14.04 (64-bit LTS):

sudo apt-get install gawk wget git-core diffstat unzip texinfo build-essential chrpath libsdl1.2-dev xterm curl

Next is to get the latest yocto source code:

$ git clone git://  yocto_latest
$ cd yocto_latest
$ git clone git://
$ git clone git:// meta-oe
$ git checkout -b dizzy origin/dizzy
$ source oe-init-build-env

This additional layer also needs to be added to your bblayers.conf file:

/path/to/yocto_latest/meta \
/path/to/yocto_latest/meta-yocto \
/path/to/yocto_latest/meta-oe/meta-oe \
/path/to/yocto_latest/meta-fsl-arm \

$ Edit conf/local.conf user config file and set imx53 Quick start board machine and enable parallel build features:

MACHINE ?= “imx53qsb”



$ bitbake core-image-minimal$ cd tmp/deploy/images:

└── imx53qsb
├── core-image-minimal-imx53qsb-20150216155950.rootfs.ext3
├── core-image-minimal-imx53qsb-20150216155950.rootfs.manifest
├── core-image-minimal-imx53qsb-20150216155950.rootfs.sdcard
├── core-image-minimal-imx53qsb-20150216155950.rootfs.tar.bz2
├── core-image-minimal-imx53qsb.ext3 -> core-image-minimal-imx53qsb-20150216155950.rootfs.ext3
├── core-image-minimal-imx53qsb.manifest -> core-image-minimal-imx53qsb-20150216155950.rootfs.manifest
├── core-image-minimal-imx53qsb.sdcard -> core-image-minimal-imx53qsb-20150216155950.rootfs.sdcard
├── core-image-minimal-imx53qsb.tar.bz2 -> core-image-minimal-imx53qsb-20150216155950.rootfs.tar.bz2
├── modules–
├── modules-imx53qsb.tgz -> modules–
├── u-boot.imx -> u-boot-imx53qsb-v2015.01+gitAUTOINC+4dab988b9c-r0.imx
├── u-boot-imx53qsb.imx -> u-boot-imx53qsb-v2015.01+gitAUTOINC+4dab988b9c-r0.imx
├── u-boot-imx53qsb-v2015.01+gitAUTOINC+4dab988b9c-r0.imx
├── zImage -> zImage–
├── zImage–
└── zImage-imx53qsb.bin -> zImage–

$ sudo dd if=./core-image-minimal-imx53qsb.sdcard of=<partition of sdcard> bs=1M

where <partition of sdcard> is usually /dev/mmcblk0

Next is to get the latest yocto source code:

$ git clone git://  yocto_latest

Now booting up the sdcard inside i.MX53QSB:

U-Boot 2015.01+fslc+g4dab988 (Feb 17 2015 – 01:03:23)

Board: MX53 LOCO
I2C:   ready
DRAM:  1 GiB
*** Warning – bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   FEC
Hit any key to stop autoboot:  0
switch to partitions #0, OK
mmc0 is current device
reading boot.scr
** Unable to read file boot.scr **
reading zImage
3110704 bytes read in 234 ms (12.7 MiB/s)
Booting from mmc …
reading imx53-qsb.dtb
** Unable to read file imx53-qsb.dtb **
Kernel image @ 0x72000000 [ 0x000000 – 0x2f7730 ]

Starting kernel …

Initializing cgroup subsys cpuset
Initializing cgroup subsys cpu
Linux version (tthtlc@mamapapa) (gcc version 4.9.1 (5
CPU: ARMv7 Processor [412fc085] revision 5 (ARMv7), cr=10c53c7d
CPU: VIPT nonaliasing data cache, VIPT nonaliasing instruction cache
Machine: Freescale MX53 LOCO Board
Memory policy: ECC disabled, Data cache writeback
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 250880
Kernel command line: console=ttymxc0,115200 root=/dev/mmcblk0p2 rw rootwait
PID hash table entries: 4096 (order: 2, 16384 bytes)
Dentry cache hash table entries: 131072 (order: 7, 524288 bytes)
Inode-cache hash table entries: 65536 (order: 6, 262144 bytes)
Memory: 480MB 512MB = 992MB total
Memory: 998016k/998016k available, 17792k reserved, 0K highmem
Virtual kernel memory layout:
vector  : 0xffff0000 – 0xffff1000   (   4 kB)
fixmap  : 0xfff00000 – 0xfffe0000   ( 896 kB)
DMA     : 0xf8e00000 – 0xffe00

References: (a little bit out of date)

ARM TrustZone technology for iMX53

How TrustZone is used at runtime?

Image result for trustzone iMX53

How it integrate with virtualization:

Related image

How does TrustZone interact with untrusted interrupt handler? (TZIC, or TrustZone aware Interrupt Controller)

Related image

Or the sequence flow can be enumerated as follows:

Image result for flow interrupt controller trustzone imx53

Here is how signalling of secure device events to the guest OS via IRQ injection is done:

Here is how transfer between TZ VMM and normal world memory:

Genode – An Exploration of ARM TrustZone Technology

What are the Attacks possible against Trustzone?

Rowhammer Attack:

How to enable the TrustZone?

This kernel is the only code except the mode transition PIC, that runs in privileged CPU mode. It has two tasks. First it initializes the process ‘core’, enriches it with the whole identically mapped address range, joins and applies it, assigns one thread to it with a userdefined entrypoint (the core main thread) and starts this thread in userland. Afterwards it is called each time an exception occurs in userland to do a minimum of appropriate exception handling. Thus it holds a CPU context for itself as for any other thread. But due to the fact that it never relies on prior kernel runs this context only holds some constant pointers such as SP and IP. a set of codes for iMX53

This is the bare metal program running on i.MX53 QSB to test the TrustZone Secure-Normal World Transition.

If you want to use your own mkimage in your u-boot code, please change MKIMAGE in Makefile.

MMU registers:

Learning Javascript Object Model

Loop through JavaScript object – Stack Overflow

Javascript HTML DOM:



Getting LED strips to work with Raspberry Pi


Notice the 50Ohm: or you may be buroning off the LED/.

Running a 32-LED strip:

To quote from above:

Instead of supplying power to the Raspberry Pi’s Micro USB connector, a 5 Volt DC power supply is required because the LED strip draws significantly more current than the USB input can provide. A 2 Amp power supply is sufficient for a 1 meter LED strip, while our larger 10 Amp supply can power up to 5 meters of LED strip (plus the Raspberry Pi board, in both situations).

+5V and ground from the power supply connect to the 5V and GND pins on both the LED strip and the Raspberry Pi GPIO header.

Learning Raspberry Pi Bare Metal Programming

Following the previous blog:

Now we will explore the wrting to the UART for Raspberry PI:

For references:

But still I would like to repeat here for future references purposes:

First starting with rpi_bare_metal.S:

// To keep this in the first portion of the binary.
.section “.text.boot”

// Make _start global.
.globl _start

// Entry point for the kernel.
// r15 -> should begin execution at 0x8000.
// r0 -> 0x00000000
// r1 -> 0x00000C42
// r2 -> 0x00000100 – start of ATAGS
// preserve these registers as argument for kernel_main
// Setup the stack.
mov sp, #0x8000

// Clear out bss.
ldr r4, =__bss_start
ldr r9, =__bss_end
mov r5, #0
mov r6, #0
mov r7, #0
mov r8, #0
b       2f

// store multiple at r4.
stmia r4!, {r5-r8}

// If we are still below bss_end, loop.
cmp r4, r9
blo 1b

// Call kernel_main
ldr r3, =kernel_main
blx r3

// halt
b halt

Compiling the above boot routine for Raspberry PI:

 arm-none-eabi-gcc -mcpu=arm1176jzf-s -fpic -ffreestanding -c rpi_bare_metal.S -o rpi_bare_metal.o

The detail bootup sequence is explained here:

Next is to write the "kernel_main" routine which is called from the assembly bootup routine as above:
#if !defined(__cplusplus)
#include <stdbool.h>
#include <stddef.h>
#include <stdint.h>
static inline void mmio_write(uint32_t reg, uint32_t data)
	uint32_t *ptr = (uint32_t*) reg;
	asm volatile("str %[data], [%[reg]]" : : [reg]"r"(ptr), [data]"r"(data));
static inline uint32_t mmio_read(uint32_t reg)
	uint32_t *ptr = (uint32_t*)reg;
	uint32_t data;
	asm volatile("ldr %[data], [%[reg]]" : [data]"=r"(data) : [reg]"r"(ptr));
	return data;
/* Loop <delay> times in a way that the compiler won't optimize away. */
static inline void delay(int32_t count)
	asm volatile("__delay_%=: subs %[count], %[count], #1; bne __delay_%=\n"
		 : : [count]"r"(count) : "cc");
size_t strlen(const char* str)
	size_t ret = 0;
	while ( str[ret] != 0 )
	return ret;
    // The GPIO registers base address.
    GPIO_BASE = 0x20200000,
    // The offsets for reach register.
    // Controls actuation of pull up/down to ALL GPIO pins.
    GPPUD = (GPIO_BASE + 0x94),
    // Controls actuation of pull up/down for specific GPIO pin.
    GPPUDCLK0 = (GPIO_BASE + 0x98),
    // The base address for UART.
    UART0_BASE = 0x20201000,
    // The offsets for reach register for the UART.
    UART0_DR     = (UART0_BASE + 0x00),
    UART0_RSRECR = (UART0_BASE + 0x04),
    UART0_FR     = (UART0_BASE + 0x18),
    UART0_ILPR   = (UART0_BASE + 0x20),
    UART0_IBRD   = (UART0_BASE + 0x24),
    UART0_FBRD   = (UART0_BASE + 0x28),
    UART0_LCRH   = (UART0_BASE + 0x2C),
    UART0_CR     = (UART0_BASE + 0x30),
    UART0_IFLS   = (UART0_BASE + 0x34),
    UART0_IMSC   = (UART0_BASE + 0x38),
    UART0_RIS    = (UART0_BASE + 0x3C),
    UART0_MIS    = (UART0_BASE + 0x40),
    UART0_ICR    = (UART0_BASE + 0x44),
    UART0_DMACR  = (UART0_BASE + 0x48),
    UART0_ITCR   = (UART0_BASE + 0x80),
    UART0_ITIP   = (UART0_BASE + 0x84),
    UART0_ITOP   = (UART0_BASE + 0x88),
    UART0_TDR    = (UART0_BASE + 0x8C),
void uart_init()
	// Disable UART0.
	mmio_write(UART0_CR, 0x00000000);
	// Setup the GPIO pin 14 && 15.
	// Disable pull up/down for all GPIO pins & delay for 150 cycles.
	mmio_write(GPPUD, 0x00000000);
	// Disable pull up/down for pin 14,15 & delay for 150 cycles.
	mmio_write(GPPUDCLK0, (1 << 14) | (1 << 15));
	// Write 0 to GPPUDCLK0 to make it take effect.
	mmio_write(GPPUDCLK0, 0x00000000);
	// Clear pending interrupts.
	mmio_write(UART0_ICR, 0x7FF);
	// Set integer & fractional part of baud rate.
	// Divider = UART_CLOCK/(16 * Baud)
	// Fraction part register = (Fractional part * 64) + 0.5
	// UART_CLOCK = 3000000; Baud = 115200.
	// Divider = 3000000 / (16 * 115200) = 1.627 = ~1.
	// Fractional part register = (.627 * 64) + 0.5 = 40.6 = ~40.
	mmio_write(UART0_IBRD, 1);
	mmio_write(UART0_FBRD, 40);
	// Enable FIFO & 8 bit data transmissio (1 stop bit, no parity).
	mmio_write(UART0_LCRH, (1 << 4) | (1 << 5) | (1 << 6));
	// Mask all interrupts.
	mmio_write(UART0_IMSC, (1 << 1) | (1 << 4) | (1 << 5) | (1 << 6) |
	                       (1 << 7) | (1 << 8) | (1 << 9) | (1 << 10));
	// Enable UART0, receive & transfer part of UART.
	mmio_write(UART0_CR, (1 << 0) | (1 << 8) | (1 << 9));
void uart_putc(unsigned char byte)
	// Wait for UART to become ready to transmit.
	while ( mmio_read(UART0_FR) & (1 << 5) ) { }
	mmio_write(UART0_DR, byte);
unsigned char uart_getc()
    // Wait for UART to have recieved something.
    while ( mmio_read(UART0_FR) & (1 << 4) ) { }
    return mmio_read(UART0_DR);
void uart_write(const unsigned char* buffer, size_t size)
	for ( size_t i = 0; i < size; i++ )
void uart_puts(const char* str)
	uart_write((const unsigned char*) str, strlen(str));
#if defined(__cplusplus)
extern "C" /* Use C linkage for kernel_main. */
void kernel_main(uint32_t r0, uint32_t r1, uint32_t atags)
	(void) r0;
	(void) r1;
	(void) atags;
	uart_puts("Hello, kernel World!\r\n");
	while ( true )
Compiling the C routine:
arm-none-eabi-gcc -mcpu=arm1176jzf-s -fpic -ffreestanding -std=gnu99 -c rpi_kernel.c -o rpi_kernel.o -O2 -Wall -Wextra

Next is to define a linker script, which will specify how the two files above are linked together:

    /* Starts at LOADER_ADDR. */
    . = 0x8000;
    __start = .;
    __text_start = .;
    .text :
    . = ALIGN(4096); /* align to page size */
    __text_end = .;
    __rodata_start = .;
    .rodata :
    . = ALIGN(4096); /* align to page size */
    __rodata_end = .;
    __data_start = .;
    .data :
    . = ALIGN(4096); /* align to page size */
    __data_end = .;
    __bss_start = .;
    .bss :
        bss = .;
    . = ALIGN(4096); /* align to page size */
    __bss_end = .;
    __end = .;
Compile the above linker file:

arm-none-eabi-gcc -T rpi_kernel.ld -o myos.elf -ffreestanding -O2 -nostdlib rpi_bare_metal.o rpi_kernel.o

After compilation, copy out the “.text” section as a binary blob for direct CPU execution:

arm-none-eabi-objcopy myos.elf -O binary myos.bin
mv kernel.img kernel.img.orig
cp myos.bin kernel.img

The above “kernel.img” will replace the “kernel.img” found on the microSD used to bootup the Raspberry PI.

Finally upon booting up, the “Hello World” message will appear on the minicom connected to the serial console of RPi.

%d bloggers like this: