How to load a bare metal EL3 program onto the hardware?

In order to load a baremetal EL3 program onto the FVP, first you create your program and then build it so that the image base is at 0x14000000 (--image-base = 0x14000000) and then set the FVP option when running, -C soc.scc.boot_gpr_2=0x14000000 -C soc.scc.boot_gpr_3=0. To download EL3 bare metal to the FVP from Development Studio, you make sure the program at 0x14000000 is a branch to self loop first.

When running these two scenarios on the Hardware how do I set the AP reset address to 14000000 to run the EL3 program? Do I need to modify io_V010f.txt file on the SD card?

SOCCON: 0x118c 0x00000000; SOC SCC BOOT_GPR3


SOCCON: 0x118c 0x14000000; SOC SCC BOOT_GPR3

Also when I copy the el3prog.bin file to the SOFTWARE directory will it pick it up or does it need to have a recognised name/format?. For example, for the TFA payload baremetal (EL2 program), this needs to be fip.bin

Many thanks

  • Hi Jen,

    On the Morello board, to let SCP boot custom AP binary you have to set BOOT_GPR2 & BOOT_GPR3 registers in io_v010f.txt file as you mentioned.

    In this case the BOOT_GPR2 has to be set to 0x14000000 and BOOT_GPR3 left to 0x0 as below:

    SOCCON: 0x1188 0x14000000   ;SoC SCC BOOT_GPR2
    SOCCON: 0x118C 0x00000000   ;SoC SCC BOOT_GPR3

    Also after copying your binary into micro SD card SOFTWARE folder, you need to edit the images.txt file under MB/HBI0364B directory in micro SD card.

    Add an entry as below and set the TOTALIMAGES to 4

    IMAGE3ADDRESS: 0x60000000              ;Please select the required executable program
    IMAGE3FILE: \SOFTWARE\image.bin          ;Image for test

    This will let MCC to copy your image into address 0x14000000 so that AP core can boot from it.

    However things get tricky at this point when trying out in Morello board as compared to FVP. The ECC enabled DDR4 memory has to be initialized before it can be accessed. There are two steps involved in this process.

    1. Zeroing out the whole DDR4 space.

    2. Enabling the ECC bits.

    In a normal release stack this is done using trusted firmware (

    So for the Morello board, the 'branch to self' binary that runs at 0x14000000 should perform the above initialization before going into branch to self condition for proper operation of the memory space accesses.