1Booting Firmware Update images 2------------------------------ 3 4When Firmware Update (FWU) is enabled there are at least 2 new images 5that have to be loaded, the Non-Secure FWU ROM (NS-BL1U), and the 6FWU FIP. 7 8The additional fip images must be loaded with: 9 10:: 11 12 --data cluster0.cpu0="<path_to>/ns_bl1u.bin"@0x0beb8000 [ns_bl1u_base_address] 13 --data cluster0.cpu0="<path_to>/fwu_fip.bin"@0x08400000 [ns_bl2u_base_address] 14 15The address ns_bl1u_base_address is the value of NS_BL1U_BASE. 16In the same way, the address ns_bl2u_base_address is the value of 17NS_BL2U_BASE. 18 19Booting an EL3 payload 20---------------------- 21 22The EL3 payloads boot flow requires the CPU's mailbox to be cleared at reset for 23the secondary CPUs holding pen to work properly. Unfortunately, its reset value 24is undefined on the FVP platform and the FVP platform code doesn't clear it. 25Therefore, one must modify the way the model is normally invoked in order to 26clear the mailbox at start-up. 27 28One way to do that is to create an 8-byte file containing all zero bytes using 29the following command: 30 31.. code:: shell 32 33 dd if=/dev/zero of=mailbox.dat bs=1 count=8 34 35and pre-load it into the FVP memory at the mailbox address (i.e. ``0x04000000``) 36using the following model parameters: 37 38:: 39 40 --data cluster0.cpu0=mailbox.dat@0x04000000 [Base FVPs] 41 42To provide the model with the EL3 payload image, the following methods may be 43used: 44 45#. If the EL3 payload is able to execute in place, it may be programmed into 46 flash memory. On Base Cortex and AEM FVPs, the following model parameter 47 loads it at the base address of the NOR FLASH1 (the NOR FLASH0 is already 48 used for the FIP): 49 50 :: 51 52 -C bp.flashloader1.fname="<path-to>/<el3-payload>" 53 54#. When using the ``SPIN_ON_BL1_EXIT=1`` loading method, the following DS-5 55 command may be used to load the EL3 payload ELF image over JTAG: 56 57 :: 58 59 load <path-to>/el3-payload.elf 60 61#. The EL3 payload may be pre-loaded in volatile memory using the following 62 model parameters: 63 64 :: 65 66 --data cluster0.cpu0="<path-to>/el3-payload>"@address [Base FVPs] 67 68 The address provided to the FVP must match the ``EL3_PAYLOAD_BASE`` address 69 used when building TF-A. 70 71Booting a kernel image in BL33 72------------------------------ 73 74TF-A can boot a Linux kernel, which uses a ramdisk as a filesystem. The 75required initrd properties are injected in to the device tree blob (DTB) at 76build time. 77 78Kernel image packaged in fip as a BL33 image 79^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 80 81A Linux kernel image can be packaged in the fip as a BL33 image and then 82booted in TF-A. 83 84For example, the firmware can be built as: 85 86.. code:: shell 87 88 make PLAT=fvp DEBUG=1 \ 89 ARM_LINUX_KERNEL_AS_BL33 \ 90 BL33=<path-to-kernel-binary> \ 91 INITRD_SIZE=0x8000000 \ 92 all fip 93 94The options ``INITRD_SIZE`` or ``INITRD_PATH`` triggers the insertion of initrd 95properties in to the DTB. ``INITRD_BASE`` is also required but a default value 96is set by the FVP platform. 97 98The options available here are: 99 100:: 101 102 INITRD_BASE: Set the initrd base address in memory. Defaults to 0x90000000 in FVP. 103 INITRD_SIZE: Set the initrd size in dec or hex format. Hex format must precede with '0x'. 104 INITRD_PATH: Provide an initrd path for the build time to determine its exact size. 105 106Users can provide either ``INITRD_SIZE`` or ``INITRD_PATH`` to set the initrd 107size value. ``INITRD_SIZE`` takes prioty over ``INITRD_PATH``. 108 109Now the fvp binary can be run as: 110 111.. code:: shell 112 113 <path-to>/FVP_Base_AEMv8A-AEMv8A \ 114 -C bp.secureflashloader.fname=<path-to>/bl1.bin \ 115 -C bp.flashloader0.fname=<path-to>/fip.bin \ 116 --data cluster0.cpu0="<path-to>/<initrd.bin>"@0x90000000 117 118.. note:: 119 Providing a higher value for an initrd size than the actual size of the file 120 is supported but it will trigger a non-breaking "Initramfs unpacking failed" 121 error by the kernel at runtime. This error can be ignored because initrd's 122 can be stacked one after another, when the kernel unpacks the first initrd it 123 looks for another in the extra space which it won't find, hence the error. 124 125Preloaded kernel image - Normal flow 126^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 127 128The following example uses a simplified boot flow to boot a Linux kernel 129using TF-A. This can be useful if the kernel is already present in memory 130(like in FVP). 131 132For example, if the kernel is loaded at ``0x80080000`` the firmware can be 133built like this: 134 135.. code:: shell 136 137 make PLAT=fvp DEBUG=1 \ 138 ARM_LINUX_KERNEL_AS_BL33=1 \ 139 PRELOADED_BL33_BASE=0x80080000 \ 140 INITRD_SIZE=0x8000000 \ 141 all fip 142 143Now the FVP binary can be run with the following command: 144 145.. code:: shell 146 147 <path-to>/FVP_Base_AEMv8A-AEMv8A \ 148 -C bp.secureflashloader.fname=<path-to>/bl1.bin \ 149 -C bp.flashloader0.fname=<path-to>/fip.bin \ 150 --data cluster0.cpu0="<path-to>/<kernel-binary>"@0x80080000 \ 151 --data cluster0.cpu0="<path-to>/<initrd.bin>"@0x90000000 152 153Preloaded kernel image - Reset to BL31 154^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 155 156We can also boot a Linux kernel by jumping directly to BL31 ``RESET_TO_BL31=1``. 157This requires preloading a DTB into memory. We can inject the initrd start and 158end properties into the DTB (HW_CONFIG) at build time which is then stored by 159TF-A in ``build/fvp/<build-type>/fdts/`` directory. 160 161For example, we can build the firmware as: 162 163.. code:: shell 164 165 make PLAT=fvp DEBUG=1 \ 166 RESET_TO_BL31=1 \ 167 ARM_LINUX_KERNEL_AS_BL33=1 \ 168 PRELOADED_BL33_BASE=0x80080000 \ 169 ARM_PRELOADED_DTB_BASE=0x87F00000 \ 170 INITRD_BASE=0x88000000 \ 171 INITRD_PATH=<path-to>/initrd.bin 172 173Now we can run the binary as: 174 175.. code:: shell 176 177 <path-to>/FVP_Base_AEMv8A-AEMv8A \ 178 -C cluster0.NUM_CORES=4 \ 179 -C cluster0.cpu0.RVBAR=0x04001000 \ 180 -C cluster0.cpu1.RVBAR=0x04001000 \ 181 -C cluster0.cpu2.RVBAR=0x04001000 \ 182 -C cluster0.cpu3.RVBAR=0x04001000 \ 183 --data cluster0.cpu0="<path-to>/bl31.bin"@0x04001000 \ 184 --data cluster0.cpu0="<path-to>/<kernel-binary>"@0x80080000 \ 185 --data cluster0.cpu0="<path-to>/<initrd.bin>"@0x88000000 \ 186 --data cluster0.cpu0="<path-to>/fdts/fvp-base-gicv3-psci.dtb"@87F00000 187 188Obtaining the Flattened Device Trees 189^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 190 191Depending on the FVP configuration and Linux configuration used, different 192FDT files are required. 193 194.. note:: 195 It is not recommended to use the FDTs built along the kernel because not 196 all FDTs are available from there. 197 198The dynamic configuration capability is enabled in the firmware for FVPs. 199This means that the firmware can authenticate and load the FDT if present in 200FIP. A default FDT is packaged into FIP during the build based on 201the build configuration. This can be overridden by using the ``FVP_HW_CONFIG`` 202or ``FVP_HW_CONFIG_DTS`` build options (refer to 203:ref:`build_options_arm_fvp_platform` for details on the options). 204 205- ``fvp-base-gicv2-psci.dts`` 206 207 For use with models such as the Cortex-A57-A53 or Cortex-A32 Base FVPs 208 without shifted affinities and with Base memory map configuration. 209 210- ``fvp-base-gicv3-psci.dts`` 211 212 For use with models such as the Cortex-A57-A53 or Cortex-A32 Base FVPs 213 without shifted affinities and with Base memory map configuration and 214 Linux GICv3 support. 215 216- ``fvp-base-gicv3-psci-1t.dts`` 217 218 For use with models such as the AEMv8-RevC Base FVP with shifted affinities, 219 single threaded CPUs, Base memory map configuration and Linux GICv3 support. 220 221- ``fvp-base-gicv3-psci-dynamiq.dts`` 222 223 For use with models as the Cortex-A55-A75 Base FVPs with shifted affinities, 224 single cluster, single threaded CPUs, Base memory map configuration and Linux 225 GICv3 support. 226 227GICv5 Support 228^^^^^^^^^^^^^ 229 230GICv5 support in TF-A is currently **experimental** and provided only for early 231development and testing purposes. A simplified build configuration is available 232to allow booting the Linux kernel as a BL33 payload on the FVP platform. 233 234Key notes: 235 236- The support is **not production-ready** and is intended to assist with 237 upstream kernel development and validation. 238- The device tree bindings are **not finalized** 239- Use this configuration at your own discretion, understanding that the design 240 and register usage may change in future revisions. 241 242This configuration is **temporary** and may be removed once full GICv5 support 243is integrated upstream. 244 245.. code:: shell 246 247 make PLAT=fvp DEBUG=1 \ 248 CTX_INCLUDE_AARCH32_REGS=0 \ 249 FVP_USE_GIC_DRIVER=FVP_GICV5 \ 250 ARM_LINUX_KERNEL_AS_BL33=1 \ 251 PRELOADED_BL33_BASE=0x84000000 \ 252 FVP_HW_CONFIG_DTS=<PROVIDE_YOUR_OWN_DT> \ 253 254-------------- 255 256*Copyright (c) 2019-2025, Arm Limited. All rights reserved.* 257