1Booting Firmware Update images 2------------------------------ 3 4When Firmware Update (FWU) is enabled there are at least 2 new images 5that have to be loaded, the Non-Secure FWU ROM (NS-BL1U), and the 6FWU FIP. 7 8The additional fip images must be loaded with: 9 10:: 11 12 --data cluster0.cpu0="<path_to>/ns_bl1u.bin"@0x0beb8000 [ns_bl1u_base_address] 13 --data cluster0.cpu0="<path_to>/fwu_fip.bin"@0x08400000 [ns_bl2u_base_address] 14 15The address ns_bl1u_base_address is the value of NS_BL1U_BASE. 16In the same way, the address ns_bl2u_base_address is the value of 17NS_BL2U_BASE. 18 19Booting an EL3 payload 20---------------------- 21 22The EL3 payloads boot flow requires the CPU's mailbox to be cleared at reset for 23the secondary CPUs holding pen to work properly. Unfortunately, its reset value 24is undefined on the FVP platform and the FVP platform code doesn't clear it. 25Therefore, one must modify the way the model is normally invoked in order to 26clear the mailbox at start-up. 27 28One way to do that is to create an 8-byte file containing all zero bytes using 29the following command: 30 31.. code:: shell 32 33 dd if=/dev/zero of=mailbox.dat bs=1 count=8 34 35and pre-load it into the FVP memory at the mailbox address (i.e. ``0x04000000``) 36using the following model parameters: 37 38:: 39 40 --data cluster0.cpu0=mailbox.dat@0x04000000 [Base FVPs] 41 --data=mailbox.dat@0x04000000 [Foundation FVP] 42 43To provide the model with the EL3 payload image, the following methods may be 44used: 45 46#. If the EL3 payload is able to execute in place, it may be programmed into 47 flash memory. On Base Cortex and AEM FVPs, the following model parameter 48 loads it at the base address of the NOR FLASH1 (the NOR FLASH0 is already 49 used for the FIP): 50 51 :: 52 53 -C bp.flashloader1.fname="<path-to>/<el3-payload>" 54 55 On Foundation FVP, there is no flash loader component and the EL3 payload 56 may be programmed anywhere in flash using method 3 below. 57 58#. When using the ``SPIN_ON_BL1_EXIT=1`` loading method, the following DS-5 59 command may be used to load the EL3 payload ELF image over JTAG: 60 61 :: 62 63 load <path-to>/el3-payload.elf 64 65#. The EL3 payload may be pre-loaded in volatile memory using the following 66 model parameters: 67 68 :: 69 70 --data cluster0.cpu0="<path-to>/el3-payload>"@address [Base FVPs] 71 --data="<path-to>/<el3-payload>"@address [Foundation FVP] 72 73 The address provided to the FVP must match the ``EL3_PAYLOAD_BASE`` address 74 used when building TF-A. 75 76Booting a preloaded kernel image (Base FVP) 77------------------------------------------- 78 79The following example uses a simplified boot flow by directly jumping from the 80TF-A to the Linux kernel, which will use a ramdisk as filesystem. This can be 81useful if both the kernel and the device tree blob (DTB) are already present in 82memory (like in FVP). 83 84For example, if the kernel is loaded at ``0x80080000`` and the DTB is loaded at 85address ``0x82000000``, the firmware can be built like this: 86 87.. code:: shell 88 89 CROSS_COMPILE=aarch64-none-elf- \ 90 make PLAT=fvp DEBUG=1 \ 91 RESET_TO_BL31=1 \ 92 ARM_LINUX_KERNEL_AS_BL33=1 \ 93 PRELOADED_BL33_BASE=0x80080000 \ 94 ARM_PRELOADED_DTB_BASE=0x82000000 \ 95 all fip 96 97Now, it is needed to modify the DTB so that the kernel knows the address of the 98ramdisk. The following script generates a patched DTB from the provided one, 99assuming that the ramdisk is loaded at address ``0x84000000``. Note that this 100script assumes that the user is using a ramdisk image prepared for U-Boot, like 101the ones provided by Linaro. If using a ramdisk without this header,the ``0x40`` 102offset in ``INITRD_START`` has to be removed. 103 104.. code:: bash 105 106 #!/bin/bash 107 108 # Path to the input DTB 109 KERNEL_DTB=<path-to>/<fdt> 110 # Path to the output DTB 111 PATCHED_KERNEL_DTB=<path-to>/<patched-fdt> 112 # Base address of the ramdisk 113 INITRD_BASE=0x84000000 114 # Path to the ramdisk 115 INITRD=<path-to>/<ramdisk.img> 116 117 # Skip uboot header (64 bytes) 118 INITRD_START=$(printf "0x%x" $((${INITRD_BASE} + 0x40)) ) 119 INITRD_SIZE=$(stat -Lc %s ${INITRD}) 120 INITRD_END=$(printf "0x%x" $((${INITRD_BASE} + ${INITRD_SIZE})) ) 121 122 CHOSEN_NODE=$(echo \ 123 "/ { \ 124 chosen { \ 125 linux,initrd-start = <${INITRD_START}>; \ 126 linux,initrd-end = <${INITRD_END}>; \ 127 }; \ 128 };") 129 130 echo $(dtc -O dts -I dtb ${KERNEL_DTB}) ${CHOSEN_NODE} | \ 131 dtc -O dtb -o ${PATCHED_KERNEL_DTB} - 132 133And the FVP binary can be run with the following command: 134 135.. code:: shell 136 137 <path-to>/FVP_Base_AEMv8A-AEMv8A \ 138 -C pctl.startup=0.0.0.0 \ 139 -C bp.secure_memory=1 \ 140 -C cluster0.NUM_CORES=4 \ 141 -C cluster1.NUM_CORES=4 \ 142 -C cache_state_modelled=1 \ 143 -C cluster0.cpu0.RVBAR=0x04001000 \ 144 -C cluster0.cpu1.RVBAR=0x04001000 \ 145 -C cluster0.cpu2.RVBAR=0x04001000 \ 146 -C cluster0.cpu3.RVBAR=0x04001000 \ 147 -C cluster1.cpu0.RVBAR=0x04001000 \ 148 -C cluster1.cpu1.RVBAR=0x04001000 \ 149 -C cluster1.cpu2.RVBAR=0x04001000 \ 150 -C cluster1.cpu3.RVBAR=0x04001000 \ 151 --data cluster0.cpu0="<path-to>/bl31.bin"@0x04001000 \ 152 --data cluster0.cpu0="<path-to>/<patched-fdt>"@0x82000000 \ 153 --data cluster0.cpu0="<path-to>/<kernel-binary>"@0x80080000 \ 154 --data cluster0.cpu0="<path-to>/<ramdisk.img>"@0x84000000 155 156Obtaining the Flattened Device Trees 157^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 158 159Depending on the FVP configuration and Linux configuration used, different 160FDT files are required. FDT source files for the Foundation and Base FVPs can 161be found in the TF-A source directory under ``fdts/``. The Foundation FVP has 162a subset of the Base FVP components. For example, the Foundation FVP lacks 163CLCD and MMC support, and has only one CPU cluster. 164 165.. note:: 166 It is not recommended to use the FDTs built along the kernel because not 167 all FDTs are available from there. 168 169The dynamic configuration capability is enabled in the firmware for FVPs. 170This means that the firmware can authenticate and load the FDT if present in 171FIP. A default FDT is packaged into FIP during the build based on 172the build configuration. This can be overridden by using the ``FVP_HW_CONFIG`` 173or ``FVP_HW_CONFIG_DTS`` build options (refer to 174:ref:`build_options_arm_fvp_platform` for details on the options). 175 176- ``fvp-base-gicv2-psci.dts`` 177 178 For use with models such as the Cortex-A57-A53 or Cortex-A32 Base FVPs 179 without shifted affinities and with Base memory map configuration. 180 181- ``fvp-base-gicv3-psci.dts`` 182 183 For use with models such as the Cortex-A57-A53 or Cortex-A32 Base FVPs 184 without shifted affinities and with Base memory map configuration and 185 Linux GICv3 support. 186 187- ``fvp-base-gicv3-psci-1t.dts`` 188 189 For use with models such as the AEMv8-RevC Base FVP with shifted affinities, 190 single threaded CPUs, Base memory map configuration and Linux GICv3 support. 191 192- ``fvp-base-gicv3-psci-dynamiq.dts`` 193 194 For use with models as the Cortex-A55-A75 Base FVPs with shifted affinities, 195 single cluster, single threaded CPUs, Base memory map configuration and Linux 196 GICv3 support. 197 198- ``fvp-foundation-gicv2-psci.dts`` 199 200 For use with Foundation FVP with Base memory map configuration. 201 202- ``fvp-foundation-gicv3-psci.dts`` 203 204 (Default) For use with Foundation FVP with Base memory map configuration 205 and Linux GICv3 support. 206 207-------------- 208 209*Copyright (c) 2019-2024, Arm Limited. All rights reserved.* 210