[PATCH 2/3] image: Add support for starting TFA BL31 as fitImage loadables

[Tom Rini]

On Sun, Jan 12, 2025 at 11:36:58PM +0100, Marek Vasut wrote:

> Add support for starting TFA from U-Boot running in EL3 as part of
> fitImage boot, so the user can start U-Boot in the highest privilege
> level on the platform, bundle TFA, Linux, DT into a single fitImage
> and boot such a bundle as a whole.
> 
> There are two main benefits of this approach. First is the ability
> to run U-Boot in EL3, where it has unrestricted access to the entire
> system and can act as a useful debug tool, as it was always intended
> to be used. Second is the ability to easily and safely update of any
> component in the fitImage, be it TFA, Linux or DT.
> 
> The boot process is similar to regular Linux with DT fitImage boot
> process, except the TFA has to be bundled into the fitImage. For the
> bundling instructions, see below. The TFA is started as a 'loadables'
> with custom U_BOOT_FIT_LOADABLE_HANDLER and armv8_switch_to_el2_prep()
> handling implemented in board code, and performing the handoff and
> boot in case the TFA was loaded.
> 
> The loadables handler is optional and meant to set up any sort of
> handoff structures used by the TFA BL31 or perform any other setup
> that is needed by the blob. The custom armv8_switch_to_el2_prep()
> has to implement the jump to TFA BL31 with return to U-Boot just
> before booting the Linux kernel.
> 
> Example fitImage image and configuration section:
> 
> /dts-v1/;
> 
> / {
>     description = "Linux kernel with FDT blob and TFA BL31";
> 
>     images {
>         kernel-1 { ... };
>         fdt-1 { ... };
>         atf-1 {                  /* This is the TFA BL31 image */
>             description = "TFA BL31";
>             data = /incbin/("../build/plat/release/bl31.bin");
>             type = "tfa-bl31";
>             arch = "arm64";
>             os = "arm-trusted-firmware";
>             compression = "none";
>             load = <0x46400000>;
>             entry = <0x46400000>;
>         };
>     };
> 
>     configurations {
>         default = "conf-1";
>         conf-1 {
>             description = "Boot Linux";
>             kernel = "kernel-1";
>             fdt = "fdt-1";
>             loadables = "atf-1"; /* This is the TFA BL31 loadable */
>         };
>     };
> };
> 
> Signed-off-by: Marek Vasut <marek.vasut+renesas at mailbox.org>

Reviewed-by: Tom Rini <trini at konsulko.com>

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 659 bytes
Desc: not available
URL: <https://lists.denx.de/pipermail/u-boot/attachments/20250114/3fb933ca/attachment.sig>