January 22, 2026

Allwinner H5 chip - building U-boot - ATF revisited

I tried fetching the most current version of ATF (ARM trusted firmware) and building it. This worked fine for my RK3328 board, but the build was too big to fit into OCM (on chip memory) on the H5 chip. I then dropped the DEBUG=1 argument on the build. This worked (i.e. it yielded an executable that would fit), but it may suppress all informative messages. Maybe.

I downloaded a build of ATF and U-boot from the SD-images site, and it worked just fine. It indicates that it used specific versions of both ATF and U-boot, as follows: 

ATF - v2.9.0
U-boot - v2025.10
The current version of ATF is 2.14.0, so the trick is to get the source for a specific older version, namely 2.9.0.

Git and tags

Here are some interesting links related to branches, but we are really interested in tags. Git has branches of course, but it also has a feature called "tags" that works independent of branching. It is just what we need in this case and the good news is that the ATF repository is set up with tags for just what we want here. You find out what they are using the "git tag" command. Doing so yields a long list, part of which I show here: 
v2.9
v2.9-rc0
v2.9-rc1
v2.9.0
...
v2.10
v2.10-rc0
v2.10-rc1
v2.10.0
...
v2.14
v2.14-rc0
v2.14-rc1
v2.14.0
It is somewhat common to clone just the current (latest) version using a command like "git clone --depth 1". This creates a "shallow clone" with no history and no tags or branches. This is certainly faster and saves disk space, but will give you only the latest version (v2.14.0 in this case).

I find it useful to examine the file docs/change-log.md which will show the version you are working with (I see v2.14.0 on 2025-11-20 in my case).

Once you have a full clone, you can switch to any tag you like using one of: 

git checkout v2.9.0
git switch --detach v2.9.0
This puts you in "detached HEAD" stage, which will make you crazy if you try to do much of anything. To get out of this, use one of: 
git checkout master
git switch -

Let's try this for the h5 chip

export CROSS_COMPILE=aarch64-linux-gnu-
cd /Projects/ARM-sources/
cd arm-trusted-firmware
make clean
git checkout v2.9.0
make PLAT="sun50i_a64" DEBUG=1 bl31
I still get this error: 
BL31 image has exceeded its limit.
aarch64-linux-gnu-ld.bfd: region `RAM' overflowed by 224 bytes
This is disappointing and leaves me wondering how the SD-images guy built ATF for the h5. Perhaps the difference is the compiler.

Try turning off some things

I don't need encryption, and probably can ditch trusted boot also since this is not some product I am going to ship to countless customers.
Either of these build lines is worth trying: 
make PLAT="sun50i_a64" DECRYPTION_SUPPORT=none DEBUG=1 bl31
make PLAT="sun50i_a64" DECRYPTION_SUPPORT=none TRUSTED_BOARD_BOOT=0 DEBUG=1 bl31
Neither of these makes any difference (presumably these options were already off).

Try optimizing

This is suggested and can apparently be handled on the build line: 
make PLAT="sun50i_a64" DEBUG=1 CFLAGS="-Os" bl31
Typing "make clean" does not seen to work, so do this: 
rm -rf build/*
make PLAT="sun50i_a64" DEBUG=1 CFLAGS="-Os" bl31
Note -- what you want to do is make PLAT="sun50i_a64" clean. This will clean the build/sun50i_a64 directory I believe. The build system sets up separate build subdirectories for each platform and you can keep multiple builds side by side this way.

Enabling optimization makes no difference either. Apparently the -Os option is already built into the Makefile

I use the V=1 option to get full details of the compile options and decide to try this. I am assuming that "backtrace" is a debugging feature for when things go badly wrong. 

rm -rf build/*
make PLAT="sun50i_a64" ENABLE_BACKTRACE=0 DEBUG=1 bl31
And it works! Results are: 
cd build/sun50i_a64/debug
-rwxr-xr-x 1 tom tom 45277 Jan 22 22:40 bl31.bin
cd build/sun50i_a64/debug/bl31.elf
-rwxr-xr-x 1 tom tom 550712 Jan 22 22:40 bl31.elf

Have any comments? Questions? Drop me a line!

Tom's electronics pages / tom@mmto.org