使用QEMU模拟启动uboot

uboot的相关知识，可以参考：uboot基本概念。

一、环境配置

WSL: ubutu20.04
模拟开发板：vexpress-a9
uboot版本：u-boot-2023.10

二、安装QEMU

• 2.1、安装

  sudo apt install qemu
  

• 2.2、查看支持哪些开发板

  qemu-system-arm -M help
  

  结果如下：

  Supported machines are:
  akita                Sharp SL-C1000 (Akita) PDA (PXA270)
  ast2500-evb          Aspeed AST2500 EVB (ARM1176)
  ast2600-evb          Aspeed AST2600 EVB (Cortex A7)
  borzoi               Sharp SL-C3100 (Borzoi) PDA (PXA270)
  canon-a1100          Canon PowerShot A1100 IS
  cheetah              Palm Tungsten|E aka. Cheetah PDA (OMAP310)
  collie               Sharp SL-5500 (Collie) PDA (SA-1110)
  connex               Gumstix Connex (PXA255)
  cubieboard           cubietech cubieboard (Cortex-A8)
  emcraft-sf2          SmartFusion2 SOM kit from Emcraft (M2S010)
  highbank             Calxeda Highbank (ECX-1000)
  imx25-pdk            ARM i.MX25 PDK board (ARM926)
  integratorcp         ARM Integrator/CP (ARM926EJ-S)
  kzm                  ARM KZM Emulation Baseboard (ARM1136)
  lm3s6965evb          Stellaris LM3S6965EVB
  lm3s811evb           Stellaris LM3S811EVB
  mainstone            Mainstone II (PXA27x)
  mcimx6ul-evk         Freescale i.MX6UL Evaluation Kit (Cortex A7)
  mcimx7d-sabre        Freescale i.MX7 DUAL SABRE (Cortex A7)
  microbit             BBC micro:bit
  midway               Calxeda Midway (ECX-2000)
  mps2-an385           ARM MPS2 with AN385 FPGA image for Cortex-M3
  mps2-an505           ARM MPS2 with AN505 FPGA image for Cortex-M33
  mps2-an511           ARM MPS2 with AN511 DesignStart FPGA image for Cortex-M3
  mps2-an521           ARM MPS2 with AN521 FPGA image for dual Cortex-M33
  musca-a              ARM Musca-A board (dual Cortex-M33)
  musca-b1             ARM Musca-B1 board (dual Cortex-M33)
  musicpal             Marvell 88w8618 / MusicPal (ARM926EJ-S)
  n800                 Nokia N800 tablet aka. RX-34 (OMAP2420)
  n810                 Nokia N810 tablet aka. RX-44 (OMAP2420)
  netduino2            Netduino 2 Machine
  none                 empty machine
  nuri                 Samsung NURI board (Exynos4210)
  palmetto-bmc         OpenPOWER Palmetto BMC (ARM926EJ-S)
  raspi2               Raspberry Pi 2
  realview-eb          ARM RealView Emulation Baseboard (ARM926EJ-S)
  realview-eb-mpcore   ARM RealView Emulation Baseboard (ARM11MPCore)
  realview-pb-a8       ARM RealView Platform Baseboard for Cortex-A8
  realview-pbx-a9      ARM RealView Platform Baseboard Explore for Cortex-A9
  romulus-bmc          OpenPOWER Romulus BMC (ARM1176)
  sabrelite            Freescale i.MX6 Quad SABRE Lite Board (Cortex A9)
  smdkc210             Samsung SMDKC210 board (Exynos4210)
  spitz                Sharp SL-C3000 (Spitz) PDA (PXA270)
  swift-bmc            OpenPOWER Swift BMC (ARM1176)
  sx1                  Siemens SX1 (OMAP310) V2
  sx1-v1               Siemens SX1 (OMAP310) V1
  terrier              Sharp SL-C3200 (Terrier) PDA (PXA270)
  tosa                 Sharp SL-6000 (Tosa) PDA (PXA255)
  verdex               Gumstix Verdex (PXA270)
  versatileab          ARM Versatile/AB (ARM926EJ-S)
  versatilepb          ARM Versatile/PB (ARM926EJ-S)
  vexpress-a15         ARM Versatile Express for Cortex-A15
  vexpress-a9          ARM Versatile Express for Cortex-A9
  virt-2.10            QEMU 2.10 ARM Virtual Machine
  virt-2.11            QEMU 2.11 ARM Virtual Machine
  virt-2.12            QEMU 2.12 ARM Virtual Machine
  virt-2.6             QEMU 2.6 ARM Virtual Machine
  virt-2.7             QEMU 2.7 ARM Virtual Machine
  virt-2.8             QEMU 2.8 ARM Virtual Machine
  virt-2.9             QEMU 2.9 ARM Virtual Machine
  virt-3.0             QEMU 3.0 ARM Virtual Machine
  virt-3.1             QEMU 3.1 ARM Virtual Machine
  virt-4.0             QEMU 4.0 ARM Virtual Machine
  virt-4.1             QEMU 4.1 ARM Virtual Machine
  virt                 QEMU 4.2 ARM Virtual Machine (alias of virt-4.2)
  virt-4.2             QEMU 4.2 ARM Virtual Machine
  witherspoon-bmc      OpenPOWER Witherspoon BMC (ARM1176)
  xilinx-zynq-a9       Xilinx Zynq Platform Baseboard for Cortex-A9
  z2                   Zipit Z2 (PXA27x)
  

三、安装交叉编译链

sudo apt install arm-linux-gnueabi-gcc

注：此步非必须，也可自己从Arm GNU Toolchain下载，解压后添加到环境变量即可。

四、编译uboot

• 4.1、解压

tar -vxjf u-boot-2023.10.tar.bz2

• 4.2、编译

cd u-boot-2023.10/

make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabihf- vexpress_ca9x4_defconfig
make ARCH=arm CROSS_COMPILE=arm-none-linux-gnueabihf- -j`nproc`

• 4.3、生成的u-boot.bin文件
  

五、使用qemu工具运行uboot

• 5.1、启动uboot

qemu-system-arm -M vexpress-a9 -m 512M -kernel ./u-boot -nographic -no-reboot

运行结果如下：

U-Boot 2023.10 (Nov 02 2023 - 10:17:15 +0800)

DRAM:  512 MiB
WARNING: Caches not enabled
Core:  18 devices, 10 uclasses, devicetree: embed
Flash: 64 MiB
MMC:   mmci@5000: 0
Loading Environment from Flash... *** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   eth0: ethernet@3,02000000
Hit any key to stop autoboot:  0
MMC Device 1 not found
no mmc device at slot 1
Card did not respond to voltage select! : -110
smc911x: detected LAN9118 controller
smc911x: phy initialized
smc911x: MAC 52:54:00:12:34:56
BOOTP broadcast 1
DHCP client bound to address 10.0.2.15 (2 ms)
*** Warning: no boot file name; using '0A00020F.img'
Using ethernet@3,02000000 device
TFTP from server 10.0.2.2; our IP address is 10.0.2.15
Filename '0A00020F.img'.
Load address: 0x60100000
Loading: *
TFTP error: 'Access violation' (2)
Not retrying...
smc911x: MAC 52:54:00:12:34:56
missing environment variable: pxefile_addr_r
smc911x: detected LAN9118 controller
smc911x: phy initialized
smc911x: MAC 52:54:00:12:34:56
BOOTP broadcast 1
DHCP client bound to address 10.0.2.15 (0 ms)
Using ethernet@3,02000000 device
TFTP from server 10.0.2.2; our IP address is 10.0.2.15
Filename 'boot.scr.uimg'.
Load address: 0x60100000
Loading: *
TFTP error: 'Access violation' (2)
Not retrying...
smc911x: MAC 52:54:00:12:34:56
smc911x: detected LAN9118 controller
smc911x: phy initialized
smc911x: MAC 52:54:00:12:34:56
BOOTP broadcast 1
DHCP client bound to address 10.0.2.15 (0 ms)
Using ethernet@3,02000000 device
TFTP from server 10.0.2.2; our IP address is 10.0.2.15
Filename 'boot.scr.uimg'.
Load address: 0x60100000
Loading: *
TFTP error: 'Access violation' (2)
Not retrying...
smc911x: MAC 52:54:00:12:34:56
cp - memory copy

Usage:
cp [.b, .w, .l, .q] source target count
Wrong Image Format for bootm command
ERROR: can't get kernel image!
=>

说明uboot已经启动成功。

• 5.2、在uboot中输入help，查看uboot中的支持的命令：

=>
=> help
?         - alias for 'help'
base      - print or set address offset
bdinfo    - print Board Info structure
blkcache  - block cache diagnostics and control
bootefi   - Boots an EFI payload from memory
bootelf   - Boot from an ELF image in memory
bootflow  - Boot flows
bootm     - boot application image from memory
bootp     - boot image via network using BOOTP/TFTP protocol
bootvx    - Boot vxWorks from an ELF image
bootz     - boot Linux zImage image from memory
cmp       - memory compare
cp        - memory copy
crc32     - checksum calculation
dhcp      - boot image via network using DHCP/TFTP protocol
echo      - echo args to console
eficonfig - provide menu-driven UEFI variable maintenance interface
env       - environment handling commands
erase     - erase FLASH memory
exit      - exit script
ext2load  - load binary file from a Ext2 filesystem
ext2ls    - list files in a directory (default /)
ext4load  - load binary file from a Ext4 filesystem
ext4ls    - list files in a directory (default /)
ext4size  - determine a file's size
false     - do nothing, unsuccessfully
fatinfo   - print information about filesystem
fatload   - load binary file from a dos filesystem
fatls     - list files in a directory (default /)
fatmkdir  - create a directory
fatrm     - delete a file
fatsize   - determine a file's size
fatwrite  - write file into a dos filesystem
fdt       - flattened device tree utility commands
flinfo    - print FLASH memory information
fstype    - Look up a filesystem type
fstypes   - List supported filesystem types
go        - start application at address 'addr'
help      - print command description/usage
iminfo    - print header information for application image
ln        - Create a symbolic link
load      - load binary file from a filesystem
loop      - infinite loop on address range
ls        - list files in a directory (default /)
md        - memory display
mii       - MII utility commands
mm        - memory modify (auto-incrementing address)
mmc       - MMC sub system
mmcinfo   - display MMC info
mw        - memory write (fill)
net       - NET sub-system
nm        - memory modify (constant address)
panic     - Panic with optional message
part      - disk partition related commands
ping      - send ICMP ECHO_REQUEST to network host
printenv  - print environment variables
protect   - enable or disable FLASH write protection
pxe       - commands to get and boot from pxe files
To use IPv6 add -ipv6 parameter
random    - fill memory with random pattern
reset     - Perform RESET of the CPU
run       - run commands in an environment variable
save      - save file to a filesystem
saveenv   - save environment variables to persistent storage
setenv    - set environment variables
showvar   - print local hushshell variables
size      - determine a file's size
source    - run script from memory
sysboot   - command to get and boot from syslinux files
test      - minimal test like /bin/sh
tftpboot  - load file via network using TFTP protocol
true      - do nothing, successfully
ubi       - ubi commands
ubifsload - load file from an UBIFS filesystem
ubifsls   - list files in a directory
ubifsmount- mount UBIFS volume
ubifsumount- unmount UBIFS volume
version   - print monitor, compiler and linker version
=>

六、使用gdb调试uboot

• 6.1、输入如下启动命令：

qemu-system-arm -M vexpress-a9 -m 512M -kernel ./u-boot -nographic -no-reboot -S -s

其中：
-S 表示QEMU虚拟机会冻结CPU，直到远程的GDB输入相应的控制命令。
-s 表示在1234端口接收GDB调试连接。

• 6.2、gdb调试
  重新打开一个终端，进入到u-boot文件的目录下，输入以下命令开始gdb调试：

cd u-boot-2023.10
gdb-multiarch --tui u-boot

如下：

• 6.3、开始调试
  在gdb中输入以下命令，开始调试：

(gdb) set architecture arm
(gdb) target remote localhost:1234

以上，设置架构为arm架构，通过远程端口1234连接QEMU虚拟机。如下图：

上图显示，已经进入vectors.S文件中的_start程序入口。
接下来就可以单步跟踪调试了：