Re: [Buildroot] [PATCH v2 1/2] boot/arm-trusted-firmware: optional Linux as BL33

From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: Jakob Kastelic <kastelic.jakob@gmail.com>
Cc: buildroot@buildroot.org, Romain Naour <romain.naour@gmail.com>,
	 Sergey Matyukevich <geomatsi@gmail.com>,
	Dick Olsson <hi@senzilla.io>
Subject: Re: [Buildroot] [PATCH v2 1/2] boot/arm-trusted-firmware: optional Linux as BL33
Date: Tue, 3 Feb 2026 10:10:24 +0100	[thread overview]
Message-ID: <aYG5Tc4aQ4QHgWN-@windsurf> (raw)
In-Reply-To: <20250917024541.1480367-2-kastelic.jakob@gmail.com>

Hello Jakob,

Thanks for your patch, and sorry for the delay in getting back to you!

On Tue, Sep 16, 2025 at 07:45:40PM -0700, Jakob Kastelic wrote:
> Arm Trusted Firmware (TF-A) can be used to load U-Boot or another
> bootloader, which in turn loads the Linux kernel. However, TF-A is
> capable of loading the kernel directly. To this end, we need to define
> the BL33 and BL33_CFG compile options containing, respectively, the
> zImage and the DTB.
> 
> This config introduces a new config option,
> BR2_TARGET_ARM_TRUSTED_FIRMWARE_LINUX_AS_BL33, which sets the BL33 and
> BL33_CFG parameters, and ensures that the kernel is built before the
> TF-A by having linux as a _DEPENDENCY of the TF-A.
>

Your Signed-off-by should have been here. Indeed, anything after "---"
gets stripped when applying your patch.

> +config BR2_TARGET_ARM_TRUSTED_FIRMWARE_LINUX_AS_BL33
> +	bool "Linux kernel"
> +	depends on BR2_LINUX_KERNEL
> +	depends on (BR2_arm || BR2_armeb)
> +	depends on (BR2_LINUX_KERNEL_ZIMAGE || BR2_LINUX_KERNEL_APPENDED_ZIMAGE)
> +	help
> +	  This option allows to embed the Linux kernel as the BL33 part
> +	  of the ARM Trusted Firmware.
> +
> +	  Do not choose this option if you intend to use U-Boot or
> +	  another second-stage bootloader. With this option, TF-A starts
> +	  Linux directly.
> +
> +	  With this option chosen, whenever the Linux zImage changes,
> +	  TF-A may need need to be re-built to create the latest FIP
> +	  file. Since Buildroot does not track package dependencies,
> +	  this has to be done manually by invoking `make
> +	  arm-trusted-firmware-rebuild`. The final boot medium image may
> +	  need to be re-generated as well to include the latest FIP file
> +	  version.

I dropped this last paragraph, because this isn't specific to this
situation, it's also valid for any other BL33 payload.

> +ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_LINUX_AS_BL33),y)
> +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += BL33=$(BINARIES_DIR)/zImage
> +ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM),stm32mp1)

I've used

+ifeq ($(ARM_TRUSTED_FIRMWARE_PLATFORM),stm32mp1)

instead, where ARM_TRUSTED_FIRMWARE_PLATFORM is already
quote-stripped, while $(BR2_TARGET_ARM_TRUSTED_FIRMWARE_PLATFORM)
isn't.

> +ARM_TRUSTED_FIRMWARE_MAKE_OPTS += BL33_CFG=$(BINARIES_DIR)/$(LINUX_DTBS)

This is a bit "risky" as LINUX_DTBS can potentially contain multiple
entries. One option would be to add a check here that LINUX_DTBS only
contain one entry, like (untested)

ifneq ($(words $(LINUX_DTBS)),1)
$(error "Using BR2_TARGET_ARM_TRUSTED_FIRMWARE_LINUX_AS_BL33 only works when a single Linux DTB is used")
endif

If you think that's useful, you can send a follow-up patch adding
this. But I have applied your patch, with the other fixes mentioned in
this e-mail.

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot