This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How is a signed TF-M image loaded into memory with FVP_MPS2_AEMv8M?

/usr/local/DS-5_v5.27.1/bin/FVP_MPS2_AEMv8M \
--parameter fvp_mps2.platform_type=2 \
--parameter cpu0.baseline=0 \
--parameter cpu0.INITVTOR_S=0x10000000 \
--parameter cpu0.semihosting-enable=0 \
--parameter fvp_mps2.DISABLE_GATING=0 \
--parameter fvp_mps2.telnetterminal0.start_telnet=1 \
--parameter fvp_mps2.telnetterminal1.start_telnet=0 \
--parameter fvp_mps2.telnetterminal2.start_telnet=0 \
--parameter fvp_mps2.telnetterminal0.quiet=0 \
--parameter fvp_mps2.telnetterminal1.quiet=1 \
--parameter fvp_mps2.telnetterminal2.quiet=1 \
--application cpu0=~/TF-M/trusted-firmware-m/cmake_build/bl2/ext/mcuboot/mcuboot.axf \
--data cpu0=~/TF-M/trusted-firmware-m/cmake_build/tfm_sign.bin@0x10080000

This will load tfm_sign.bin to 0x10080000. 

The 1MB tfm_sign.bin has such a layout:

<1024B header><512K tfm_s.bin + pad><511K tfm_ns.bin + TLV + pad> 

Therefore, we know tfm_s.bin is loaded to 0x10080400, and tfm_ns.bin is loaded to 0x10100400.

 From trusted-firmware-m/platform/ext/target/mps2/an521/partition/region_defs.h, we know

NS_CODE_START = 0x100400, 

and comparing the memory starts from 0x10100400 and the memory starts from 0x100400, we know these two ranges have the same content. In other word, after start the FVP_MPS2_AEMv8M, tfm_ns.bin, which should locate at 0x10100400, is loaded/mapped to address 0x100400. My question is how is this implemented. 

Another observation is the memory content of 0x100400 and 0x10100400 are always the same. If I change the data stored at 0x100400, the data at 0x10100400 also changes, and vice versa. How to explain this? Thanks.