diff --git a/docs/firmware-design.md b/docs/firmware-design.md
index 5b7d70a2e9314b473613f10cb6b01751c9799e6d..41aaf7f2dc5c76d63414adb542bb086f4c395073 100644
--- a/docs/firmware-design.md
+++ b/docs/firmware-design.md
@@ -1270,9 +1270,40 @@ diagrams.
Loading the TSP image in Trusted DRAM doesn't change the memory layout of the
other boot loader images in Trusted SRAM.
+
#### Memory layout on Juno ARM development platform
-**TSP in Trusted SRAM (default option):**
+The following list describes the memory layout on Juno:
+
+* Trusted SRAM at 0x04000000 contains the MHU page, BL1 r/w section, BL2
+ image, BL3-1 image and, optionally, the BL3-2 image.
+
+* The MHU 4 KB page is used as communication channel between SCP and AP. It
+ also contains the entrypoint mailboxes for the AP. Mailboxes are stored in
+ the first 128 bytes of the MHU page.
+
+* BL1 resides in flash memory at address `0x0BEC0000`. Its read-write data
+ section is relocated to the top of the Trusted SRAM at runtime.
+
+* BL3-1 is loaded at the top of the Trusted SRAM, such that its NOBITS
+ sections will overwrite BL1 R/W data. This implies that BL1 global variables
+ will remain valid only until execution reaches the BL3-1 entry point during
+ a cold boot.
+
+* BL2 is loaded below BL3-1.
+
+* BL3-0 is loaded temporarily into the BL3-1 memory region and transfered to
+ the SCP before being overwritten by BL3-1.
+
+* The BL3-2 image is optional and can be loaded into one of these two
+ locations: Trusted SRAM (right after the MHU page) or DRAM (14 MB starting
+ at 0xFF000000 and secured by the TrustZone controller). When loaded into
+ Trusted SRAM, its NOBITS sections are allowed to overlap BL2.
+
+Depending on the location of the BL3-2 image, it will result in different memory
+maps, illustrated by the following diagrams.
+
+**BL3-2 in Trusted SRAM (default option):**
Flash0
0x0C000000 +----------+
@@ -1281,30 +1312,30 @@ other boot loader images in Trusted SRAM.
| BL1 (ro) |
0x0BEC0000 |----------|
: :
- | Bypass |
- 0x08000000 +----------+
-
- Trusted SRAM
- 0x04040000 +----------+
- | BL2 | BL3-1 is loaded
- 0x04033000 |----------| after BL3-0 has
- | BL3-2 | been sent to SCP
- 0x04023000 |----------| ------------------
- | BL3-0 | <<<<<<<<<<<<< | BL3-1 |
- 0x04009000 |----------| ------------------
- | BL1 (rw) |
- 0x04001000 |----------|
+ 0x08000000 +----------+ BL3-1 is loaded
+ after BL3-0 has
+ Trusted SRAM been sent to SCP
+ 0x04040000 +----------+ loaded by BL2 ------------------
+ | BL1 (rw) | <<<<<<<<<<<<< | BL3-1 NOBITS |
+ |----------| <<<<<<<<<<<<< |----------------|
+ | BL3-0 | <<<<<<<<<<<<< | BL3-1 PROGBITS |
+ |----------| ------------------
+ | BL2 | <<<<<<<<<<<<< | BL3-2 NOBITS |
+ |----------| <<<<<<<<<<<<< |----------------|
+ | | <<<<<<<<<<<<< | BL3-2 PROGBITS |
+ 0x04001000 +----------+ ------------------
| MHU |
0x04000000 +----------+
-**TSP in the secure region of DRAM:**
+
+**BL3-2 in the secure region of DRAM:**
DRAM
0xFFE00000 +----------+
- | BL3-2 |
+ | BL3-2 | (secure)
0xFF000000 |----------|
| |
- : :
+ : : (non-secure)
| |
0x80000000 +----------+
@@ -1315,29 +1346,23 @@ other boot loader images in Trusted SRAM.
| BL1 (ro) |
0x0BEC0000 |----------|
: :
- | Bypass |
- 0x08000000 +----------+
-
- Trusted SRAM
- 0x04040000 +----------+
- | BL2 | BL3-1 is loaded
- 0x04033000 |----------| after BL3-0 has
- | | been sent to SCP
- 0x04023000 |----------| ------------------
- | BL3-0 | <<<<<<<<<<<<< | BL3-1 |
- 0x04009000 |----------| ------------------
- | BL1 (rw) |
- 0x04001000 |----------|
+ 0x08000000 +----------+ BL3-1 is loaded
+ after BL3-0 has
+ Trusted SRAM been sent to SCP
+ 0x04040000 +----------+ loaded by BL2 ------------------
+ | BL1 (rw) | <<<<<<<<<<<<< | BL3-1 NOBITS |
+ |----------| <<<<<<<<<<<<< |----------------|
+ | BL3-0 | <<<<<<<<<<<<< | BL3-1 PROGBITS |
+ |----------| ------------------
+ | BL2 |
+ |----------|
+ | |
+ 0x04001000 +----------+
| MHU |
0x04000000 +----------+
-The Message Handling Unit (MHU) page contains the entrypoint mailboxes and a
-shared memory area. This shared memory is used as a communication channel
-between the AP and the SCP.
-
-BL1 code starts at `0x0BEC0000`. The BL1 data section is copied to trusted SRAM
-at `0x04001000`, right after the MHU page. Entrypoint mailboxes are stored in
-the first 128 bytes of the MHU page.
+Loading the BL3-2 image in DRAM doesn't change the memory layout of the other
+images in Trusted SRAM.
9. Firmware Image Package (FIP)
diff --git a/plat/juno/include/platform_def.h b/plat/juno/include/platform_def.h
index e746d0287341dc2fb9a30755402a1404511c2b6a..ee77b83237fdf2977393ce7cd576f559d55549ed 100644
--- a/plat/juno/include/platform_def.h
+++ b/plat/juno/include/platform_def.h
@@ -75,24 +75,6 @@
#define MAX_IO_DEVICES 3
#define MAX_IO_HANDLES 4
-/*******************************************************************************
- * Platform memory map related constants
- ******************************************************************************/
-#define FLASH_BASE 0x08000000
-#define FLASH_SIZE 0x04000000
-
-/* Bypass offset from start of NOR flash */
-#define BL1_ROM_BYPASS_OFFSET 0x03EC0000
-
-#ifndef TZROM_BASE
-/* Use the bypass address */
-#define TZROM_BASE FLASH_BASE + BL1_ROM_BYPASS_OFFSET
-#endif
-#define TZROM_SIZE 0x00010000
-
-#define TZRAM_BASE 0x04001000
-#define TZRAM_SIZE 0x0003F000
-
/*******************************************************************************
* BL1 specific defines.
* BL1 RW data is relocated from ROM to RAM at runtime so we need 2 base
@@ -100,14 +82,23 @@
******************************************************************************/
#define BL1_RO_BASE TZROM_BASE
#define BL1_RO_LIMIT (TZROM_BASE + TZROM_SIZE)
-#define BL1_RW_BASE TZRAM_BASE
-#define BL1_RW_LIMIT BL31_BASE
+
+/*
+ * Put BL1 RW at the top of the Trusted SRAM. BL1_RW_BASE is calculated using
+ * the current BL1 RW debug size plus a little space for growth.
+ */
+#define BL1_RW_BASE (TZRAM_BASE + TZRAM_SIZE - 0x6000)
+#define BL1_RW_LIMIT (TZRAM_BASE + TZRAM_SIZE)
/*******************************************************************************
* BL2 specific defines.
******************************************************************************/
-#define BL2_BASE (TZRAM_BASE + TZRAM_SIZE - 0xd000)
-#define BL2_LIMIT (TZRAM_BASE + TZRAM_SIZE)
+/*
+ * Put BL2 just below BL3-1. BL2_BASE is calculated using the current BL2 debug
+ * size plus a little space for growth.
+ */
+#define BL2_BASE (BL31_BASE - 0xC000)
+#define BL2_LIMIT BL31_BASE
/*******************************************************************************
* Load address of BL3-0 in the Juno port
@@ -119,8 +110,13 @@
/*******************************************************************************
* BL3-1 specific defines.
******************************************************************************/
-#define BL31_BASE (TZRAM_BASE + 0x8000)
-#define BL31_LIMIT BL32_BASE
+/*
+ * Put BL3-1 at the top of the Trusted SRAM. BL31_BASE is calculated using the
+ * current BL3-1 debug size plus a little space for growth.
+ */
+#define BL31_BASE (TZRAM_BASE + TZRAM_SIZE - 0x1D000)
+#define BL31_PROGBITS_LIMIT BL1_RW_BASE
+#define BL31_LIMIT (TZRAM_BASE + TZRAM_SIZE)
/*******************************************************************************
* BL3-2 specific defines.
@@ -128,8 +124,9 @@
#if (PLAT_TSP_LOCATION_ID == PLAT_TRUSTED_SRAM_ID)
# define TSP_SEC_MEM_BASE TZRAM_BASE
# define TSP_SEC_MEM_SIZE TZRAM_SIZE
-# define BL32_BASE (TZRAM_BASE + TZRAM_SIZE - 0x1d000)
-# define BL32_LIMIT BL2_BASE
+# define BL32_BASE TZRAM_BASE
+# define BL32_LIMIT BL31_BASE
+# define BL32_PROGBITS_LIMIT BL2_BASE
#elif (PLAT_TSP_LOCATION_ID == PLAT_DRAM_ID)
# define TSP_SEC_MEM_BASE DRAM_SEC_BASE
# define TSP_SEC_MEM_SIZE (DRAM_SEC_SIZE - DRAM_SCP_SIZE)
diff --git a/plat/juno/juno_def.h b/plat/juno/juno_def.h
index e205498d543e8de95fb5426b06deb038a71e31b8..8e1a83df8f87250e40bc278c17cea374695636f3 100644
--- a/plat/juno/juno_def.h
+++ b/plat/juno/juno_def.h
@@ -37,6 +37,21 @@
/*******************************************************************************
* Juno memory map related constants
******************************************************************************/
+#define FLASH_BASE 0x08000000
+#define FLASH_SIZE 0x04000000
+
+/* Bypass offset from start of NOR flash */
+#define BL1_ROM_BYPASS_OFFSET 0x03EC0000
+
+#ifndef TZROM_BASE
+/* Use the bypass address */
+#define TZROM_BASE FLASH_BASE + BL1_ROM_BYPASS_OFFSET
+#endif
+#define TZROM_SIZE 0x00010000
+
+#define TZRAM_BASE 0x04001000
+#define TZRAM_SIZE 0x0003F000
+
#define PLAT_TRUSTED_SRAM_ID 0
#define PLAT_DRAM_ID 1