Lines Matching refs:the
7 The following instructions explain how to use this port of the TF-A with the
8 default distribution of `Raspbian`_ because that's the distribution officially
9 supported by the Raspberry Pi Foundation. At the moment of writing this, the
12 the Foundation can be compiled for AArch64 by following the steps in
15 **IMPORTANT NOTE**: This port isn't secure. All of the memory used is DRAM,
16 which is available from both the Non-secure and Secure worlds. This port
18 elements like PSCI to support the Linux kernel.
23 The SoC used by the Raspberry Pi 3 is the Broadcom BCM2837. It is a SoC with a
24 VideoCore IV that acts as primary processor (and loads everything from the SD
25 card) and is located between all Arm cores and the DRAM. Check the `Raspberry Pi
28 This explains why it is possible to change the execution state (AArch64/AArch32)
29 depending on a few files on the SD card. We only care about the cases in which
30 the cores boot in AArch64 mode.
34 - If a file called ``kernel8.img`` is located on the ``boot`` partition of the
36 a `default AArch64 stub`_ at address **0x0** that jumps to the kernel.
39 **0x0** (instead of the default stub) and execute it in EL3 in AArch64. All
40 the cores are powered on at the same time and start at address **0x0**.
42 This means that we can use the default AArch32 kernel provided in the official
44 anything else we need is in ``armstub8.bin``. This way we can forget about the
46 sure that the name on the SD card is ``kernel8.img``.
48 Ideally, we want to load the kernel and have all cores available, which means
49 that we need to make the secondary cores work in the way the kernel expects, as
51 between TF-A and the kernel.
53 To get the most out of a AArch32 kernel, we want to boot it in Hypervisor mode
61 The file ``armstub8.bin`` contains BL1 and the FIP. It is needed to add padding
62 between them so that the addresses they are loaded to match the ones specified
63 when compiling TF-A. This is done automatically by the build system.
65 The device tree block is loaded by the VideoCore loader from an appropriate
66 file, but we can specify the address it is loaded to in ``config.txt``.
68 The file ``kernel8.img`` contains a kernel image that is loaded to the address
75 kernel should be placed in the first 128MiB of RAM. It is recommended
76 that it is loaded above 32MiB in order to avoid the need to relocate
77 prior to decompression, which will make the boot process slightly
80 There are no similar restrictions for AArch64 kernels, as specified in the file
83 This means that we need to avoid the first 128 MiB of RAM when placing the
84 TF-A images (and specially the first 32 MiB, as they are directly used to
85 place the uncompressed AArch32 kernel image. This way, both AArch32 and
86 AArch64 kernels can be placed at the same address.
88 In the end, the images look like the following diagram when placed in memory.
89 All addresses are Physical Addresses from the point of view of the Arm cores.
90 Again, note that this is all just part of the same DRAM that goes from
105 | DTB | (Loaded by the VideoCore)
111 | Kernel | (Loaded by the VideoCore)
131 so that the kernel doesn't use it. The current port tries to modify the live DTB
132 to add a memreserve region that reserves the previously mentioned area.
134 If this is not possible, the user may manually add ``memmap=16M$256M`` to the
135 command line passed to the kernel in ``cmdline.txt``. See the `Setup SD card`_
138 The last 16 MiB of DRAM can only be accessed by the VideoCore, that has
139 different mappings than the Arm cores in which the I/O addresses don't overlap
140 the DRAM. The memory reserved to be used by the VideoCore is always placed at
141 the end of the DRAM, so this space isn't wasted.
143 Considering the 128 MiB allocated to the GPU and the 16 MiB allocated for
149 The boot sequence of TF-A is the usual one except when booting an AArch32
151 can jump to the kernel in the same mode and let it take over that privilege
152 level. If BL33 was running in EL2 in AArch64 (as in the default bootflow of
153 TF-A) it could only jump to the kernel in AArch32 in Supervisor mode.
155 The `Linux kernel tree`_ has instructions on how to jump to the Linux kernel
159 This port support a direct boot of the Linux kernel from the firmware (as a BL33
165 This port of the Trusted Firmware-A supports ``PSCI_CPU_ON``,
167 the system off, it simply reboots it and asks the VideoCore firmware to keep it
171 use mailboxes to trap the secondary cores until they are ready to jump to the
172 kernel. This mailbox is located at a different address in the AArch32 default
173 kernel than in the AArch64 kernel.
175 Kernels with PSCI support can use the PSCI calls instead for a cleaner boot.
181 Once BL31 has finished and the primary core has jumped to the BL33 payload, it
182 has to call ``PSCI_CPU_ON`` to release the secondary CPUs from the wait loop.
184 from the kernel. When the primary CPU jumps into the kernel, it will send an
185 address to the mailbox so that the secondary CPUs jump to it and are recognised
186 by the kernel.
191 To boot a AArch64 kernel, only the AArch64 toolchain is required.
194 AArch32 toolchain is needed for the AArch32 bootstrap needed to load a 32-bit
197 The build system concatenates BL1 and the FIP so that the addresses match the
198 ones in the memory map. The resulting file is ``armstub8.bin``, located in the
200 file, follow the instructions in `Setup SD card`_.
209 - ``PRELOADED_BL33_BASE``: Used to specify the address of a BL33 binary that has
210 been preloaded by any other system than using the firmware. ``BL33`` isn't
211 needed in the build command line if this option is used. Specially useful
212 because the file ``kernel8.img`` can be loaded anywhere by modifying the file
216 - ``RPI3_DIRECT_LINUX_BOOT``: Disabled by default. Set to 1 to enable the direct
217 boot of the Linux kernel from the firmware. Option ``RPI3_PRELOADED_DTB_BASE``
218 is mandatory when the direct Linux kernel boot is used. Options
220 unlikely that the kernel image will fit in the space reserved for BL33 images.
222 32-bit kernel. The only thing this option does is to set the arguments in
223 registers x0-x3 or r0-r2 as expected by the kernel.
226 ``RPI3_DIRECT_LINUX_BOOT=1``. This option allows to specify the location of a
229 - ``RPI3_RUNTIME_UART``: Indicates whether the UART should be used at runtime
230 or disabled. ``-1`` (default) disables the runtime UART. Any other value
231 enables the default UART (currently UART1) for runtime messages.
233 - ``RPI3_USE_UEFI_MAP``: Set to 1 to build ATF with the altername memory
236 default, results in the following memory mappings:
243 | DTB | (Loaded by the VideoCore)
268 Please use the code from `here <https://github.com/OP-TEE/optee_os>`__.
269 Build the Trusted Firmware with option ``BL32=tee-header_v2.bin
271 to put the binaries into the FIP.
274 If OP-TEE is used it may be needed to add the following options to the
275 Linux command line so that the USB driver doesn't use FIQs:
277 This will unfortunately reduce the performance of the USB driver. It is
281 it. In order to use TBB, you might want to set ``GENERATE_COT=1`` to let the
282 contents of the FIP automatically signed by the build process. The ROT key
283 will be generated and output to ``rot_key.pem`` in the build directory. It is
286 ``MBEDTLS_DIR`` must point at the mbed TLS source directory.
288 - ``ENABLE_STACK_PROTECTOR``: Disabled by default. It uses the hardware RNG of
289 the board.
296 address by changing the file ``armstub8.bin``, so there's no point in using
299 Building the firmware for kernels that don't support PSCI
302 This is the case for the 32-bit image of Raspbian, for example. 64-bit kernels
303 always support PSCI, but they may not know that the system understands PSCI due
306 First, clone and compile the 32-bit version of the `Raspberry Pi 3 TF-A
307 bootstrap`_. Choose the one needed for the architecture of your kernel.
309 Then compile TF-A. For a 32-bit kernel, use the following command line:
324 However, enabling PSCI support in a 64-bit kernel is really easy. In the
326 to the Linux kernel tree maintained by the Raspberry Pi foundation. It modifes
327 the DTS to tell the kernel to use PSCI. Once this patch is applied, follow the
331 Building the firmware for kernels that support PSCI
357 using a SD card with the default `Raspbian`_ install as base. Skip them if you
358 want to use the default 32-bit kernel.
360 Note that this system won't be fully 64-bit because all the tools in the
362 allows the user to run 64-bit binaries in addition to 32-bit binaries.
364 1. Clone the `Linux tree fork`_ maintained by the Raspberry Pi Foundation. To
365 speed things up, do a shallow clone of the desired branch.
372 2. Configure and compile the kernel. Adapt the number after ``-j`` so that it is
373 1.5 times the number of CPUs in your computer. This may take some time to
381 3. Copy the kernel image and the device tree to the SD card. Replace the path
382 by the corresponding path in your computers to the ``boot`` partition of the
391 4. Install the kernel modules. Replace the path by the corresponding path to the
392 filesystem partition of the SD card on your computer.
399 5. Follow the instructions in `Setup SD card`_ except for the step of renaming
400 the existing ``kernel7.img`` (we have already copied a AArch64 kernel).
406 `Raspbian`_ (or that, at least, the ``boot`` partition is untouched, or nearly
407 untouched). They have been tested with the image available in 2018-03-13.
409 1. Insert the SD card and open the ``boot`` partition.
411 2. Rename ``kernel7.img`` to ``kernel8.img``. This tricks the VideoCore
412 bootloader into booting the Arm cores in AArch64 mode, like TF-A needs,
413 even though the kernel is not compiled for AArch64.
419 4. To enable the serial port "Mini UART" in Linux, open ``cmdline.txt`` and add
422 5. Open ``config.txt`` and add the following lines at the end (``enable_uart=1``
423 is only needed to enable debugging through the Mini UART):
431 If you connect a serial cable to the Mini UART and your computer, and connect
433 text. In the case of an AArch32 kernel, you should see something like this:
451 Just enter your credentials, everything should work as expected. Note that the