1*75685d3cSSumit GargDragonwing RB3 Gen 2 development platform 2*75685d3cSSumit Garg========================================= 3*75685d3cSSumit Garg 4*75685d3cSSumit GargTrusted Firmware-A (TF-A) platform port for Kodiak SoC based RB3Gen2 platform. 5*75685d3cSSumit GargFor details about RB3Gen2 platform, refer to this 6*75685d3cSSumit Garg`link <https://www.qualcomm.com/developer/hardware/rb3-gen-2-development-kit>`__ 7*75685d3cSSumit Garg 8*75685d3cSSumit GargBoot flow 9*75685d3cSSumit Garg------------- 10*75685d3cSSumit Garg 11*75685d3cSSumit GargThe boot flow on RB3Gen2 with TF-A BL2 replacing the TZ firmware binary and 12*75685d3cSSumit GargFIP payload replcacing UEFI binary as:: 13*75685d3cSSumit Garg 14*75685d3cSSumit Garg PBL (ROM) -> XBL -> TF-A BL2 -> TF-A BL31 -> BL33 -> Linux kernel 15*75685d3cSSumit Garg | 16*75685d3cSSumit Garg --> OP-TEE as BL32 17*75685d3cSSumit Garg 18*75685d3cSSumit GargBL33 can either be edk2, U-Boot, Coreboot + Depthcharge etc. 19*75685d3cSSumit Garg 20*75685d3cSSumit GargSummary: 21*75685d3cSSumit Garg 22*75685d3cSSumit Garg- PBL authenticates and loads XBL on on-chip RAM (IMEM) which is responsible 23*75685d3cSSumit Garg to initializing DRAM and has the flash storage driver. 24*75685d3cSSumit Garg- XBL/XBL_SEC authenticates and loads TF-A BL2 from `tz_a/b` partition and 25*75685d3cSSumit Garg FIP payload from `uefi_a/b` partition on flash to DRAM. 26*75685d3cSSumit Garg- TF-A BL2 parses the FIP payload on DRAM and loads BL31, BL32 and BL33 27*75685d3cSSumit Garg components in corresponding locations as specified in FIP metadata. 28*75685d3cSSumit Garg 29*75685d3cSSumit GargHow to build 30*75685d3cSSumit Garg------------ 31*75685d3cSSumit Garg 32*75685d3cSSumit GargSteps to build TF-A BL2 and FIP payload:: 33*75685d3cSSumit Garg 34*75685d3cSSumit Garg $ make CROSS_COMPILE=aarch64-none-elf- PLAT=rb3gen2 SPD=opteed \ 35*75685d3cSSumit Garg QTISECLIB_PATH=<qtiseclib-path> BL32=<path-to-optee-bin> \ 36*75685d3cSSumit Garg BL33=<path-to-os-bootloader-bin> fip all 37*75685d3cSSumit Garg 38*75685d3cSSumit Garg $ ./tools/qti/generate_fip_elf.sh build/rb3gen2/release/fip.bin \ 39*75685d3cSSumit Garg 0x9fc00000 40*75685d3cSSumit Garg 41*75685d3cSSumit GargQTISELIB for Kodiak/SC7280 is available at 42*75685d3cSSumit Garg`link <https://github.com/coreboot/qc_blobs/blob/master/sc7280/qtiseclib/libqtisec.a?raw=true>`__ 43*75685d3cSSumit Garg 44*75685d3cSSumit GargNote that the bl2.elf generated here is required to be signed as TZ image with 45*75685d3cSSumit GargQTI signing involved. Also, the fip.elf generated above is signed using 46*75685d3cSSumit Garg`qtestsign <https://github.com/msm8916-mainline/qtestsign>`__ which just puts 47*75685d3cSSumit Gargthe OEM test signature to allow it to work on devices in non-secure mode. In 48*75685d3cSSumit Gargsecure mode, it is required to be signed using 49*75685d3cSSumit Garg`sectools v2 <https://docs.qualcomm.com/bundle/publicresource/topics/80-70020-11/tools.html>`__ 50*75685d3cSSumit Garg 51*75685d3cSSumit GargHow to flash 52*75685d3cSSumit Garg------------ 53*75685d3cSSumit Garg 54*75685d3cSSumit GargGenerate a Yocto BSP image for RB3Gen2 following instructions from meta-qcom 55*75685d3cSSumit Garg`here <https://github.com/qualcomm-linux/meta-qcom?tab=readme-ov-file#quick-build>`__ 56*75685d3cSSumit Garg 57*75685d3cSSumit GargIt will generate a tar ball in the build folder for RB3Gen2 something like: 58*75685d3cSSumit Garg`qcom-multimedia-image-qcs6490-rb3gen2-core-kit.rootfs.qcomflash.tar.gz`. Untar 59*75685d3cSSumit Gargit and replace `tz.mbn` with `bl2.mbn` and `uefi.elf` with `fip.elf` that you 60*75685d3cSSumit Garghave generated by yourself. 61*75685d3cSSumit Garg 62*75685d3cSSumit GargThen flash the board following the meta-qcom instructions 63*75685d3cSSumit Garg`here <https://github.com/qualcomm-linux/meta-qcom?tab=readme-ov-file#flash-images>`__ 64*75685d3cSSumit Garg 65*75685d3cSSumit GargBoot Trace 66*75685d3cSSumit Garg------------- 67*75685d3cSSumit Garg 68*75685d3cSSumit GargBoot logs on RB3Gen2:: 69*75685d3cSSumit Garg 70*75685d3cSSumit Garg Format: Log Type - Time(microsec) - Message - Optional Info 71*75685d3cSSumit Garg Log Type: B - Since Boot(Power On Reset), D - Delta, S - Statistic 72*75685d3cSSumit Garg <snip-XBL-logs> 73*75685d3cSSumit Garg NOTICE: BL2: v2.13.0(release):v2.13.0-825-gc17b22110 74*75685d3cSSumit Garg NOTICE: BL2: Built : 15:54:07, Sep 25 2025 75*75685d3cSSumit Garg NOTICE: BL2: Booting BL31 76*75685d3cSSumit Garg NOTICE: BL31: v2.13.0(release):v2.13.0-825-gc17b22110 77*75685d3cSSumit Garg NOTICE: BL31: Built : 15:58:59, Sep 25 2025 78*75685d3cSSumit Garg QTISECLIB [0019dc805]QC_IMAGE_VERSION_STRING=QTISECLIB.CB.1.0-00069-SC7280AAAAAANAZT-1 79*75685d3cSSumit Garg QTISECLIB [001a0817c]IMAGE_VARIANT_STRING=SC7180LC 80*75685d3cSSumit Garg QTISECLIB [001a221d8]OEM_IMAGE_VERSION_STRING=crm-ubuntu54 81*75685d3cSSumit Garg QTISECLIB [001a40244]QC_IMAGE_TS_STRING=23:42:01, Aug 31 2022 82*75685d3cSSumit Garg I/TC: 83*75685d3cSSumit Garg I/TC: OP-TEE version: 4.7.0-79-g8a8fab26c (gcc version 14.2.0 (Ubuntu 14.2.0-19ubuntu2)) #7 Thu Sep 25 10:28:22 UTC 2025 aarch64 84*75685d3cSSumit Garg I/TC: WARNING: This OP-TEE configuration might be insecure! 85*75685d3cSSumit Garg I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html 86*75685d3cSSumit Garg I/TC: Primary CPU initializing 87*75685d3cSSumit Garg I/TC: Primary CPU switching to normal world boot 88*75685d3cSSumit Garg <snip> 89