1*54fd6939SJiyong ParkAlternative Boot Flows 2*54fd6939SJiyong Park====================== 3*54fd6939SJiyong Park 4*54fd6939SJiyong ParkEL3 payloads alternative boot flow 5*54fd6939SJiyong Park---------------------------------- 6*54fd6939SJiyong Park 7*54fd6939SJiyong ParkOn a pre-production system, the ability to execute arbitrary, bare-metal code at 8*54fd6939SJiyong Parkthe highest exception level is required. It allows full, direct access to the 9*54fd6939SJiyong Parkhardware, for example to run silicon soak tests. 10*54fd6939SJiyong Park 11*54fd6939SJiyong ParkAlthough it is possible to implement some baremetal secure firmware from 12*54fd6939SJiyong Parkscratch, this is a complex task on some platforms, depending on the level of 13*54fd6939SJiyong Parkconfiguration required to put the system in the expected state. 14*54fd6939SJiyong Park 15*54fd6939SJiyong ParkRather than booting a baremetal application, a possible compromise is to boot 16*54fd6939SJiyong Park``EL3 payloads`` through TF-A instead. This is implemented as an alternative 17*54fd6939SJiyong Parkboot flow, where a modified BL2 boots an EL3 payload, instead of loading the 18*54fd6939SJiyong Parkother BL images and passing control to BL31. It reduces the complexity of 19*54fd6939SJiyong Parkdeveloping EL3 baremetal code by: 20*54fd6939SJiyong Park 21*54fd6939SJiyong Park- putting the system into a known architectural state; 22*54fd6939SJiyong Park- taking care of platform secure world initialization; 23*54fd6939SJiyong Park- loading the SCP_BL2 image if required by the platform. 24*54fd6939SJiyong Park 25*54fd6939SJiyong ParkWhen booting an EL3 payload on Arm standard platforms, the configuration of the 26*54fd6939SJiyong ParkTrustZone controller is simplified such that only region 0 is enabled and is 27*54fd6939SJiyong Parkconfigured to permit secure access only. This gives full access to the whole 28*54fd6939SJiyong ParkDRAM to the EL3 payload. 29*54fd6939SJiyong Park 30*54fd6939SJiyong ParkThe system is left in the same state as when entering BL31 in the default boot 31*54fd6939SJiyong Parkflow. In particular: 32*54fd6939SJiyong Park 33*54fd6939SJiyong Park- Running in EL3; 34*54fd6939SJiyong Park- Current state is AArch64; 35*54fd6939SJiyong Park- Little-endian data access; 36*54fd6939SJiyong Park- All exceptions disabled; 37*54fd6939SJiyong Park- MMU disabled; 38*54fd6939SJiyong Park- Caches disabled. 39*54fd6939SJiyong Park 40*54fd6939SJiyong Park.. _alt_boot_flows_el3_payload: 41*54fd6939SJiyong Park 42*54fd6939SJiyong ParkBooting an EL3 payload 43*54fd6939SJiyong Park~~~~~~~~~~~~~~~~~~~~~~ 44*54fd6939SJiyong Park 45*54fd6939SJiyong ParkThe EL3 payload image is a standalone image and is not part of the FIP. It is 46*54fd6939SJiyong Parknot loaded by TF-A. Therefore, there are 2 possible scenarios: 47*54fd6939SJiyong Park 48*54fd6939SJiyong Park- The EL3 payload may reside in non-volatile memory (NVM) and execute in 49*54fd6939SJiyong Park place. In this case, booting it is just a matter of specifying the right 50*54fd6939SJiyong Park address in NVM through ``EL3_PAYLOAD_BASE`` when building TF-A. 51*54fd6939SJiyong Park 52*54fd6939SJiyong Park- The EL3 payload needs to be loaded in volatile memory (e.g. DRAM) at 53*54fd6939SJiyong Park run-time. 54*54fd6939SJiyong Park 55*54fd6939SJiyong ParkTo help in the latter scenario, the ``SPIN_ON_BL1_EXIT=1`` build option can be 56*54fd6939SJiyong Parkused. The infinite loop that it introduces in BL1 stops execution at the right 57*54fd6939SJiyong Parkmoment for a debugger to take control of the target and load the payload (for 58*54fd6939SJiyong Parkexample, over JTAG). 59*54fd6939SJiyong Park 60*54fd6939SJiyong ParkIt is expected that this loading method will work in most cases, as a debugger 61*54fd6939SJiyong Parkconnection is usually available in a pre-production system. The user is free to 62*54fd6939SJiyong Parkuse any other platform-specific mechanism to load the EL3 payload, though. 63*54fd6939SJiyong Park 64*54fd6939SJiyong Park 65*54fd6939SJiyong ParkPreloaded BL33 alternative boot flow 66*54fd6939SJiyong Park------------------------------------ 67*54fd6939SJiyong Park 68*54fd6939SJiyong ParkSome platforms have the ability to preload BL33 into memory instead of relying 69*54fd6939SJiyong Parkon TF-A to load it. This may simplify packaging of the normal world code and 70*54fd6939SJiyong Parkimprove performance in a development environment. When secure world cold boot 71*54fd6939SJiyong Parkis complete, TF-A simply jumps to a BL33 base address provided at build time. 72*54fd6939SJiyong Park 73*54fd6939SJiyong ParkFor this option to be used, the ``PRELOADED_BL33_BASE`` build option has to be 74*54fd6939SJiyong Parkused when compiling TF-A. For example, the following command will create a FIP 75*54fd6939SJiyong Parkwithout a BL33 and prepare to jump to a BL33 image loaded at address 76*54fd6939SJiyong Park0x80000000: 77*54fd6939SJiyong Park 78*54fd6939SJiyong Park.. code:: shell 79*54fd6939SJiyong Park 80*54fd6939SJiyong Park make PRELOADED_BL33_BASE=0x80000000 PLAT=fvp all fip 81*54fd6939SJiyong Park 82*54fd6939SJiyong Park-------------- 83*54fd6939SJiyong Park 84*54fd6939SJiyong Park*Copyright (c) 2019, Arm Limited. All rights reserved.* 85