[PATCH v2 0/6] Armv8r64 + BASER_FVP board support

[PATCH v2 0/6] Armv8r64 + BASER_FVP board support

[Peter Hoyes]

From: Peter Hoyes <Peter.Hoyes@arm.com>

Add support for the Armv8r64 architecture and the BASER_FVP, which uses
the Armv8r64 architecture.

The Armv8r64 architecture has the following features:
 * No non-secure exception levels
 * Highest exception level is always S-EL2
 * There is only a PMSA at S-EL2, which requires new MPU initialization
   logic
 * The VMSA at S-EL1 may not be enabled by default
 * We boot Linux at S-EL1, so a mechanism is required to boot other
   systems (e.g. Xen) at S-EL2

The BASER_FVP board config is implemented on top of the BASE_FVP and
Juno "VExpress" board configs.

The Armv8-R64 architecture reference manual supplement can be found at
https://developer.arm.com/documentation/ddi0600/latest/

Peter Hoyes (6):
  armv8: Disable pointer authentication traps for EL1
  armv8: Ensure EL1&0 VMSA is enabled
  armv8: Add ARMv8 MPU configuration logic
  vexpress64: Add BASER_FVP vexpress board variant
  arm: Use armv8_switch_to_el1 env to switch to EL1
  doc: Add documentation for the Arm vexpress board configs

 arch/arm/Kconfig                              |  7 ++
 arch/arm/cpu/armv8/cache_v8.c                 | 96 ++++++++++++++++++-
 arch/arm/cpu/armv8/fsl-layerscape/spintable.S |  2 +-
 arch/arm/cpu/armv8/transition.S               |  2 +-
 arch/arm/include/asm/armv8/mpu.h              | 61 ++++++++++++
 arch/arm/include/asm/macro.h                  | 28 +++++-
 arch/arm/include/asm/system.h                 | 39 ++++++++
 arch/arm/lib/bootm.c                          | 40 +++++---
 board/armltd/vexpress64/Kconfig               |  5 +-
 board/armltd/vexpress64/vexpress64.c          | 22 +++++
 configs/vexpress_aemv8r_defconfig             | 18 ++++
 doc/README.semihosting                        |  2 +-
 doc/arch/arm64.rst                            |  3 +-
 doc/board/armltd/index.rst                    |  9 ++
 doc/board/armltd/vexpress64.rst               | 57 +++++++++++
 doc/board/index.rst                           |  1 +
 .../{vexpress_aemv8a.h => vexpress_aemv8.h}   | 63 ++++++++----
 17 files changed, 408 insertions(+), 47 deletions(-)
 create mode 100644 arch/arm/include/asm/armv8/mpu.h
 create mode 100644 configs/vexpress_aemv8r_defconfig
 create mode 100644 doc/board/armltd/index.rst
 create mode 100644 doc/board/armltd/vexpress64.rst
 rename include/configs/{vexpress_aemv8a.h => vexpress_aemv8.h} (83%)

-- 
2.25.1

[PATCH v2 1/6] armv8: Disable pointer authentication traps for EL1

[Peter Hoyes]

From: Peter Hoyes <Peter.Hoyes@arm.com>

The use of ARMv8.3 pointer authentication (PAuth) is governed by fields
in HCR_EL2, which trigger a 'trap to EL2' if not enabled. The reset
value of these fields is 'architecturally unknown' so we must ensure
that the fields are enabled (to disable the traps) if we are entering
the kernel at EL1.

The APK field disables PAuth instruction traps and the API field
disables PAuth register traps

Add code to disable the traps in armv8_switch_to_el1_m. Prior to doing
so, it checks fields in the ID_AA64ISAR1_EL1 register to ensure pointer
authentication is supported by the hardware.

The runtime checks require a second temporary register, so add this to
the EL1 transition macro signature and update 2 call sites.

Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
---
 arch/arm/cpu/armv8/fsl-layerscape/spintable.S |  2 +-
 arch/arm/cpu/armv8/transition.S               |  2 +-
 arch/arm/include/asm/macro.h                  | 11 +++++++++--
 arch/arm/include/asm/system.h                 | 15 +++++++++++++++
 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
index 363ded03e6..d6bd188459 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
+++ b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
@@ -93,7 +93,7 @@ __secondary_boot_func:
 4:
 #ifdef CONFIG_ARMV8_SWITCH_TO_EL1
 	switch_el x7, _dead_loop, 0f, _dead_loop
-0:	armv8_switch_to_el1_m x4, x6, x7
+0:	armv8_switch_to_el1_m x4, x6, x7, x9
 #else
 	switch_el x7, 0f, _dead_loop, _dead_loop
 0:	armv8_switch_to_el2_m x4, x6, x7
diff --git a/arch/arm/cpu/armv8/transition.S b/arch/arm/cpu/armv8/transition.S
index a31af4ffc8..9dbdff3a4f 100644
--- a/arch/arm/cpu/armv8/transition.S
+++ b/arch/arm/cpu/armv8/transition.S
@@ -40,7 +40,7 @@ ENTRY(armv8_switch_to_el1)
 	 * now, jump to the address saved in x4.
 	 */
 	br x4
-1:	armv8_switch_to_el1_m x4, x5, x6
+1:	armv8_switch_to_el1_m x4, x5, x6, x7
 ENDPROC(armv8_switch_to_el1)
 .popsection
 
diff --git a/arch/arm/include/asm/macro.h b/arch/arm/include/asm/macro.h
index 485310d660..e1eefc283f 100644
--- a/arch/arm/include/asm/macro.h
+++ b/arch/arm/include/asm/macro.h
@@ -256,7 +256,7 @@ lr	.req	x30
  * For loading 64-bit OS, x0 is physical address to the FDT blob.
  * They will be passed to the guest.
  */
-.macro armv8_switch_to_el1_m, ep, flag, tmp
+.macro armv8_switch_to_el1_m, ep, flag, tmp, tmp2
 	/* Initialize Generic Timers */
 	mrs	\tmp, cnthctl_el2
 	/* Enable EL1 access to timers */
@@ -306,7 +306,14 @@ lr	.req	x30
 	b.eq	1f
 
 	/* Initialize HCR_EL2 */
-	ldr	\tmp, =(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS)
+	/* Only disable PAuth traps if PAuth is supported */
+	mrs	\tmp, id_aa64isar1_el1
+	ldr	\tmp2, =(ID_AA64ISAR1_EL1_GPI | ID_AA64ISAR1_EL1_GPA | \
+		      ID_AA64ISAR1_EL1_API | ID_AA64ISAR1_EL1_APA)
+	tst	\tmp, \tmp2
+	mov	\tmp2, #(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS)
+	orr	\tmp, \tmp2, #(HCR_EL2_APK | HCR_EL2_API)
+	csel	\tmp, \tmp2, \tmp, eq
 	msr	hcr_el2, \tmp
 
 	/* Return to the EL1_SP1 mode from EL2 */
diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
index 8b3a54e64c..77aa18909e 100644
--- a/arch/arm/include/asm/system.h
+++ b/arch/arm/include/asm/system.h
@@ -75,10 +75,25 @@
 /*
  * HCR_EL2 bits definitions
  */
+#define HCR_EL2_API		(1 << 41) /* Trap pointer authentication
+				             instructions                     */
+#define HCR_EL2_APK		(1 << 40) /* Trap pointer authentication
+				             key access                       */
 #define HCR_EL2_RW_AARCH64	(1 << 31) /* EL1 is AArch64                   */
 #define HCR_EL2_RW_AARCH32	(0 << 31) /* Lower levels are AArch32         */
 #define HCR_EL2_HCD_DIS		(1 << 29) /* Hypervisor Call disabled         */
 
+/*
+ * ID_AA64ISAR1_EL1 bits definitions
+ */
+#define ID_AA64ISAR1_EL1_GPI	(0xF << 28) /* Implementation-defined generic
+				               code auth algorithm            */
+#define ID_AA64ISAR1_EL1_GPA	(0xF << 24) /* QARMA generic code auth
+				               algorithm                      */
+#define ID_AA64ISAR1_EL1_API	(0xF << 8)  /* Implementation-defined address
+				               auth algorithm                 */
+#define ID_AA64ISAR1_EL1_APA	(0xF << 4)  /* QARMA address auth algorithm   */
+
 /*
  * ID_AA64PFR0_EL1 bits definitions
  */
-- 
2.25.1

[PATCH v2 2/6] armv8: Ensure EL1&0 VMSA is enabled

[Peter Hoyes]

From: Peter Hoyes <Peter.Hoyes@arm.com>

On Armv8-R, the EL1&0 memory system architecture is configurable as a
VMSA or PMSA, and resets to an "architecturally unknown" value.

Add code to armv8_switch_to_el1_m which detects whether the MSA at
EL1&0 is configurable using the id_aa64mmfr0_el1 register MSA fields.
If it is we must ensure the VMSA is enabled so that a rich OS can boot.

The MSA and MSA_FRAC fields are described in the Armv8-R architecture
profile supplement (section G1.3.7):
https://developer.arm.com/documentation/ddi0600/latest/

Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
---
 arch/arm/include/asm/macro.h  | 17 +++++++++++++++++
 arch/arm/include/asm/system.h | 24 ++++++++++++++++++++++++
 2 files changed, 41 insertions(+)

diff --git a/arch/arm/include/asm/macro.h b/arch/arm/include/asm/macro.h
index e1eefc283f..ecd8221c0d 100644
--- a/arch/arm/include/asm/macro.h
+++ b/arch/arm/include/asm/macro.h
@@ -316,6 +316,23 @@ lr	.req	x30
 	csel	\tmp, \tmp2, \tmp, eq
 	msr	hcr_el2, \tmp
 
+	/*
+	 * Detect whether the system has a configurable memory system
+	 * architecture at EL1&0
+	 */
+	mrs	\tmp, id_aa64mmfr0_el1
+	lsr	\tmp, \tmp, #48
+	and	\tmp, \tmp, #((ID_AA64MMFR0_EL1_MSA_MASK | \
+			ID_AA64MMFR0_EL1_MSA_FRAC_MASK) >> 48)
+	cmp	\tmp, #((ID_AA64MMFR0_EL1_MSA_USE_FRAC | \
+			ID_AA64MMFR0_EL1_MSA_FRAC_VMSA) >> 48)
+	bne	2f
+
+	/* Ensure the EL1&0 VMSA is enabled */
+	mov	\tmp, #(VTCR_EL2_MSA)
+	msr	vtcr_el2, \tmp
+2:
+
 	/* Return to the EL1_SP1 mode from EL2 */
 	ldr	\tmp, =(SPSR_EL_DEBUG_MASK | SPSR_EL_SERR_MASK |\
 			SPSR_EL_IRQ_MASK | SPSR_EL_FIQ_MASK |\
diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
index 77aa18909e..e4c11e830a 100644
--- a/arch/arm/include/asm/system.h
+++ b/arch/arm/include/asm/system.h
@@ -83,6 +83,30 @@
 #define HCR_EL2_RW_AARCH32	(0 << 31) /* Lower levels are AArch32         */
 #define HCR_EL2_HCD_DIS		(1 << 29) /* Hypervisor Call disabled         */
 
+/*
+ * VTCR_EL2 bits definitions
+ */
+#define VTCR_EL2_MSA      	(1 << 31) /* EL1&0 memory architecture        */
+
+/*
+ * ID_AA64MMFR0_EL1 bits definitions
+ */
+#define ID_AA64MMFR0_EL1_MSA_FRAC_MASK		(0xFUL << 52) /* Memory system
+								 architecture
+								 frac         */
+#define ID_AA64MMFR0_EL1_MSA_FRAC_VMSA		(0x2UL << 52) /* EL1&0 supports
+								 VMSA         */
+#define ID_AA64MMFR0_EL1_MSA_FRAC_PMSA		(0x1UL << 52) /* EL1&0 only
+							         supports PMSA*/
+#define ID_AA64MMFR0_EL1_MSA_FRAC_NO_PMSA	(0x0UL << 52) /* No PMSA
+								 support      */
+#define ID_AA64MMFR0_EL1_MSA_MASK		(0xFUL << 48) /* Memory system
+								 architecture */
+#define ID_AA64MMFR0_EL1_MSA_USE_FRAC		(0xFUL << 48) /* Use MSA_FRAC */
+#define ID_AA64MMFR0_EL1_MSA_VMSA		(0x0UL << 48) /* Memory system
+								 architecture
+								 is VMSA      */
+
 /*
  * ID_AA64ISAR1_EL1 bits definitions
  */
-- 
2.25.1

[PATCH v2 3/6] armv8: Add ARMv8 MPU configuration logic

[Peter Hoyes]

From: Peter Hoyes <Peter.Hoyes@arm.com>

Armv8r64 is the first Armv8 platform that only has a PMSA at the
current exception level. The architecture supplement for Armv8r64
describes new fields in ID_AA64MMFR0_EL1 which can be used to detect
whether a VMSA or PMSA is present. These fields are RES0 on Armv8a.

Add logic to read these fields and, for the protection of the memory
used by U-Boot, initialize the MPU instead of the MMU during init, then
clear the MPU regions before transition to the next stage.

Provide a default (blank) MPU memory map, which can be overridden by
board configurations.

Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
---
 arch/arm/cpu/armv8/cache_v8.c    | 96 +++++++++++++++++++++++++++++++-
 arch/arm/include/asm/armv8/mpu.h | 61 ++++++++++++++++++++
 2 files changed, 154 insertions(+), 3 deletions(-)
 create mode 100644 arch/arm/include/asm/armv8/mpu.h

diff --git a/arch/arm/cpu/armv8/cache_v8.c b/arch/arm/cpu/armv8/cache_v8.c
index 3de18c7675..46625675bd 100644
--- a/arch/arm/cpu/armv8/cache_v8.c
+++ b/arch/arm/cpu/armv8/cache_v8.c
@@ -15,6 +15,7 @@
 #include <asm/global_data.h>
 #include <asm/system.h>
 #include <asm/armv8/mmu.h>
+#include <asm/armv8/mpu.h>
 
 DECLARE_GLOBAL_DATA_PTR;
 
@@ -365,6 +366,86 @@ __weak u64 get_page_table_size(void)
 	return size;
 }
 
+static void mpu_clear_regions(void)
+{
+	int i;
+
+	for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) {
+		setup_el2_mpu_region(i, 0, 0);
+	}
+}
+
+static struct mpu_region default_mpu_mem_map[] = {{0,}};
+__weak struct mpu_region *mpu_mem_map = default_mpu_mem_map;
+
+static void mpu_setup(void)
+{
+	int i;
+
+	if (current_el() != 2) {
+		panic("MPU configuration is only supported at EL2");
+	}
+
+	set_sctlr(get_sctlr() & ~(CR_M | CR_WXN));
+
+	asm volatile("msr MAIR_EL2, %0" : : "r" MEMORY_ATTRIBUTES);
+
+	for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) {
+		setup_el2_mpu_region(i,
+			PRBAR_ADDRESS(mpu_mem_map[i].start)
+				| PRBAR_OUTER_SH | PRBAR_AP_RW_ANY,
+			PRLAR_ADDRESS(mpu_mem_map[i].end)
+				| mpu_mem_map[i].attrs | PRLAR_EN_BIT
+			);
+	}
+
+	set_sctlr(get_sctlr() | CR_M);
+}
+
+static bool el_has_mmu(void)
+{
+	uint64_t id_aa64mmfr0;
+	asm volatile("mrs %0, id_aa64mmfr0_el1"
+			: "=r" (id_aa64mmfr0) : : "cc");
+	uint64_t msa = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_MASK;
+	uint64_t msa_frac = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_FRAC_MASK;
+
+	switch (msa) {
+		case ID_AA64MMFR0_EL1_MSA_VMSA:
+			/*
+			 * VMSA supported in all translation regimes.
+			 * No support for PMSA.
+			 */
+			return true;
+		case ID_AA64MMFR0_EL1_MSA_USE_FRAC:
+			/* See MSA_frac for the supported MSAs. */
+			switch (msa_frac) {
+				case ID_AA64MMFR0_EL1_MSA_FRAC_NO_PMSA:
+					/*
+					 * PMSA not supported in any translation
+					 * regime.
+					 */
+					return true;
+				case ID_AA64MMFR0_EL1_MSA_FRAC_VMSA:
+					/*
+					* PMSA supported in all translation
+					* regimes. No support for VMSA.
+					*/
+				case ID_AA64MMFR0_EL1_MSA_FRAC_PMSA:
+					/*
+					 * PMSA supported in all translation
+					 * regimes.
+					 */
+					return false;
+				default:
+					panic("Unsupported id_aa64mmfr0_el1 " \
+						"MSA_frac value");
+			}
+		default:
+			panic("Unsupported id_aa64mmfr0_el1 MSA value");
+	}
+}
+
 void setup_pgtables(void)
 {
 	int i;
@@ -479,8 +560,13 @@ void dcache_enable(void)
 	/* The data cache is not active unless the mmu is enabled */
 	if (!(get_sctlr() & CR_M)) {
 		invalidate_dcache_all();
-		__asm_invalidate_tlb_all();
-		mmu_setup();
+
+		if (el_has_mmu()) {
+			__asm_invalidate_tlb_all();
+			mmu_setup();
+		} else {
+			mpu_setup();
+		}
 	}
 
 	set_sctlr(get_sctlr() | CR_C);
@@ -499,7 +585,11 @@ void dcache_disable(void)
 	set_sctlr(sctlr & ~(CR_C|CR_M));
 
 	flush_dcache_all();
-	__asm_invalidate_tlb_all();
+
+	if (el_has_mmu())
+		__asm_invalidate_tlb_all();
+	else
+		mpu_clear_regions();
 }
 
 int dcache_status(void)
diff --git a/arch/arm/include/asm/armv8/mpu.h b/arch/arm/include/asm/armv8/mpu.h
new file mode 100644
index 0000000000..c6c8828325
--- /dev/null
+++ b/arch/arm/include/asm/armv8/mpu.h
@@ -0,0 +1,61 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0+
+ *
+ * (C) Copyright 2021 Arm Limited
+ */
+
+#ifndef _ASM_ARMV8_MPU_H_
+#define _ASM_ARMV8_MPU_H_
+
+#include <asm/armv8/mmu.h>
+#include <asm/barriers.h>
+#include <linux/stringify.h>
+
+#define PRSELR_EL2		S3_4_c6_c2_1
+#define PRBAR_EL2		S3_4_c6_c8_0
+#define PRLAR_EL2		S3_4_c6_c8_1
+#define MPUIR_EL2		S3_4_c0_c0_4
+
+#define PRBAR_ADDRESS(addr)	((addr) & ~(0x3fULL))
+
+/* Access permissions */
+#define PRBAR_AP(val)		(((val) & 0x3) << 2)
+#define PRBAR_AP_RW_HYP		PRBAR_AP(0x0)
+#define PRBAR_AP_RW_ANY		PRBAR_AP(0x1)
+#define PRBAR_AP_RO_HYP		PRBAR_AP(0x2)
+#define PRBAR_AP_RO_ANY		PRBAR_AP(0x3)
+
+/* Shareability */
+#define PRBAR_SH(val)		(((val) & 0x3) << 4)
+#define PRBAR_NON_SH		PRBAR_SH(0x0)
+#define PRBAR_OUTER_SH		PRBAR_SH(0x2)
+#define PRBAR_INNER_SH		PRBAR_SH(0x3)
+
+/* Memory attribute (MAIR idx) */
+#define PRLAR_ATTRIDX(val)	(((val) & 0x7) << 1)
+#define PRLAR_EN_BIT		(0x1)
+#define PRLAR_ADDRESS(addr)	((addr) & ~(0x3fULL))
+
+#ifndef __ASSEMBLY__
+
+static inline void setup_el2_mpu_region(uint8_t region, uint64_t base, uint64_t limit)
+{
+	asm volatile("msr " __stringify(PRSELR_EL2) ", %0" : : "r" (region));
+	isb();
+	asm volatile("msr " __stringify(PRBAR_EL2) ", %0" : : "r" (base));
+	asm volatile("msr " __stringify(PRLAR_EL2) ", %0" : : "r" (limit));
+	dsb();
+	isb();
+}
+
+#endif
+
+struct mpu_region {
+	u64 start;
+	u64 end;
+	u64 attrs;
+};
+
+extern struct mpu_region *mpu_mem_map;
+
+#endif /* _ASM_ARMV8_MPU_H_ */
-- 
2.25.1

[PATCH v2 4/6] vexpress64: Add BASER_FVP vexpress board variant

[Peter Hoyes]

From: Peter Hoyes <Peter.Hoyes@arm.com>

The BASER_FVP board variant is implemented on top of the BASE_FVP board
config (which, in turn, is based on the Juno Versatile Express board
config). They all share a similar memory map - for BASER_FVP the map is
inverted from the BASE_FVP
(https://developer.arm.com/documentation/100964/1114/Base-Platform/Base---memory/BaseR-Platform-memory-map)

 * Create new TARGET_VEXPRESS64_BASER_FVP target, which uses the same
   board config as BASE_FVP and JUNO
 * Adapt vexpress_aemv8a.h header file to support BASER_FVP (and rename
   to vexpress_aemv8.h)
 * Enable config to switch to EL1 for the BASER_FVP
 * Create vexpress_aemv8r defconfig
 * Provide an MPU memory map for the BASER_FVP

For now, only single core boot is supported.

Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
---
 arch/arm/Kconfig                              |  7 +++
 board/armltd/vexpress64/Kconfig               |  5 +-
 board/armltd/vexpress64/vexpress64.c          | 22 +++++++
 configs/vexpress_aemv8r_defconfig             | 18 ++++++
 doc/README.semihosting                        |  2 +-
 .../{vexpress_aemv8a.h => vexpress_aemv8.h}   | 63 ++++++++++++-------
 6 files changed, 93 insertions(+), 24 deletions(-)
 create mode 100644 configs/vexpress_aemv8r_defconfig
 rename include/configs/{vexpress_aemv8a.h => vexpress_aemv8.h} (83%)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index e935c60bd7..c96d89b655 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1168,6 +1168,13 @@ config TARGET_VEXPRESS64_BASE_FVP
 	select PL01X_SERIAL
 	select SEMIHOSTING
 
+config TARGET_VEXPRESS64_BASER_FVP
+	bool "Support Versatile Express ARMv8r64 FVP BASE model"
+	select ARM64
+	select DM
+	select DM_SERIAL
+	select PL01X_SERIAL
+
 config TARGET_VEXPRESS64_JUNO
 	bool "Support Versatile Express Juno Development Platform"
 	select ARM64
diff --git a/board/armltd/vexpress64/Kconfig b/board/armltd/vexpress64/Kconfig
index 1d13f542e6..1f0c7ad969 100644
--- a/board/armltd/vexpress64/Kconfig
+++ b/board/armltd/vexpress64/Kconfig
@@ -1,4 +1,5 @@
-if TARGET_VEXPRESS64_BASE_FVP || TARGET_VEXPRESS64_JUNO
+if TARGET_VEXPRESS64_BASE_FVP || TARGET_VEXPRESS64_JUNO || \
+	TARGET_VEXPRESS64_BASER_FVP
 
 config SYS_BOARD
 	default "vexpress64"
@@ -7,7 +8,7 @@ config SYS_VENDOR
 	default "armltd"
 
 config SYS_CONFIG_NAME
-	default "vexpress_aemv8a"
+	default "vexpress_aemv8"
 
 config JUNO_DTB_PART
 	string "NOR flash partition holding DTB"
diff --git a/board/armltd/vexpress64/vexpress64.c b/board/armltd/vexpress64/vexpress64.c
index 2e4260286b..eb4951d07c 100644
--- a/board/armltd/vexpress64/vexpress64.c
+++ b/board/armltd/vexpress64/vexpress64.c
@@ -18,6 +18,7 @@
 #include <dm/platform_data/serial_pl01x.h>
 #include "pcie.h"
 #include <asm/armv8/mmu.h>
+#include <asm/armv8/mpu.h>
 
 DECLARE_GLOBAL_DATA_PTR;
 
@@ -54,6 +55,27 @@ static struct mm_region vexpress64_mem_map[] = {
 
 struct mm_region *mem_map = vexpress64_mem_map;
 
+static struct mpu_region vexpress64_aemv8r_mem_map[] = {
+	{
+		.start = 0x0UL,
+		.end = 0x7fffffffUL,
+		.attrs = PRLAR_ATTRIDX(MT_NORMAL)
+	}, {
+		.start = 0x80000000UL,
+		.end = 0xffffffffUL,
+		.attrs = PRLAR_ATTRIDX(MT_DEVICE_NGNRNE)
+	}, {
+		.start = 0x100000000UL,
+		.end = 0xffffffffffUL,
+		.attrs = PRLAR_ATTRIDX(MT_NORMAL)
+	}, {
+		/* List terminator */
+		0,
+	}
+};
+
+struct mpu_region *mpu_mem_map = vexpress64_aemv8r_mem_map;
+
 /* This function gets replaced by platforms supporting PCIe.
  * The replacement function, eg. on Juno, initialises the PCIe bus.
  */
diff --git a/configs/vexpress_aemv8r_defconfig b/configs/vexpress_aemv8r_defconfig
new file mode 100644
index 0000000000..9b4cd1aa2b
--- /dev/null
+++ b/configs/vexpress_aemv8r_defconfig
@@ -0,0 +1,18 @@
+CONFIG_ARM=y
+CONFIG_TARGET_VEXPRESS64_BASER_FVP=y
+CONFIG_SYS_TEXT_BASE=0x00001000
+CONFIG_SYS_MALLOC_F_LEN=0x2000
+CONFIG_NR_DRAM_BANKS=2
+CONFIG_SYS_MEMTEST_START=0x80000000
+CONFIG_SYS_MEMTEST_END=0xff000000
+CONFIG_ENV_SIZE=0x40000
+CONFIG_ENV_SECT_SIZE=0x40000
+CONFIG_IDENT_STRING=" vexpress_aemv8r64"
+CONFIG_DISTRO_DEFAULTS=y
+CONFIG_BOOTDELAY=3
+CONFIG_USE_BOOTARGS=y
+CONFIG_BOOTARGS="console=ttyAMA0 earlycon=pl011,0x9c090000 rootfstype=ext4 root=/dev/vda1 rw rootwait"
+# CONFIG_USE_BOOTCOMMAND is not set
+# CONFIG_DISPLAY_CPUINFO is not set
+CONFIG_SYS_PROMPT="VExpress64# "
+CONFIG_OF_LIBFDT=y
diff --git a/doc/README.semihosting b/doc/README.semihosting
index c019999bed..f382d0131e 100644
--- a/doc/README.semihosting
+++ b/doc/README.semihosting
@@ -25,7 +25,7 @@ or turning on CONFIG_BASE_FVP for the more full featured model.
 Rather than create a new armv8 board similar to armltd/vexpress64, add
 semihosting calls to the existing one, enabled with CONFIG_SEMIHOSTING
 and CONFIG_BASE_FVP both set. Also reuse the existing board config file
-vexpress_aemv8a.h but differentiate the two models by the presence or
+vexpress_aemv8.h but differentiate the two models by the presence or
 absence of CONFIG_BASE_FVP. This change is tested and works on both the
 Foundation and Base fastmodel simulators.
 
diff --git a/include/configs/vexpress_aemv8a.h b/include/configs/vexpress_aemv8.h
similarity index 83%
rename from include/configs/vexpress_aemv8a.h
rename to include/configs/vexpress_aemv8.h
index 54b5967a89..a51bb29e8a 100644
--- a/include/configs/vexpress_aemv8a.h
+++ b/include/configs/vexpress_aemv8.h
@@ -10,30 +10,36 @@
 #define CONFIG_REMAKE_ELF
 
 /* Link Definitions */
-#ifdef CONFIG_TARGET_VEXPRESS64_BASE_FVP
+#ifdef CONFIG_TARGET_VEXPRESS64_JUNO
+#define CONFIG_SYS_INIT_SP_ADDR         (CONFIG_SYS_SDRAM_BASE + 0x7fff0)
+#else
 /* ATF loads u-boot here for BASE_FVP model */
 #define CONFIG_SYS_INIT_SP_ADDR         (CONFIG_SYS_SDRAM_BASE + 0x03f00000)
-#elif CONFIG_TARGET_VEXPRESS64_JUNO
-#define CONFIG_SYS_INIT_SP_ADDR         (CONFIG_SYS_SDRAM_BASE + 0x7fff0)
 #endif
 
 #define CONFIG_SYS_BOOTM_LEN (64 << 20)      /* Increase max gunzip size */
 
 /* CS register bases for the original memory map. */
-#define V2M_PA_CS0			0x00000000
-#define V2M_PA_CS1			0x14000000
-#define V2M_PA_CS2			0x18000000
-#define V2M_PA_CS3			0x1c000000
-#define V2M_PA_CS4			0x0c000000
-#define V2M_PA_CS5			0x10000000
+#ifdef CONFIG_TARGET_VEXPRESS64_BASER_FVP
+#define V2M_BASE			0x00000000
+#define V2M_PA_BASE			0x80000000
+#else
+#define V2M_BASE			0x80000000
+#define V2M_PA_BASE			0x00000000
+#endif
+
+#define V2M_PA_CS0			(V2M_PA_BASE + 0x00000000)
+#define V2M_PA_CS1			(V2M_PA_BASE + 0x14000000)
+#define V2M_PA_CS2			(V2M_PA_BASE + 0x18000000)
+#define V2M_PA_CS3			(V2M_PA_BASE + 0x1c000000)
+#define V2M_PA_CS4			(V2M_PA_BASE + 0x0c000000)
+#define V2M_PA_CS5			(V2M_PA_BASE + 0x10000000)
 
 #define V2M_PERIPH_OFFSET(x)		(x << 16)
 #define V2M_SYSREGS			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(1))
 #define V2M_SYSCTL			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(2))
 #define V2M_SERIAL_BUS_PCI		(V2M_PA_CS3 + V2M_PERIPH_OFFSET(3))
 
-#define V2M_BASE			0x80000000
-
 /* Common peripherals relative to CS7. */
 #define V2M_AACI			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(4))
 #define V2M_MMCI			(V2M_PA_CS3 + V2M_PERIPH_OFFSET(5))
@@ -68,20 +74,20 @@
 #define V2M_SYS_CFGSTAT			(V2M_SYSREGS + 0x0a8)
 
 /* Generic Timer Definitions */
-#define COUNTER_FREQUENCY		24000000	/* 24MHz */
+#define COUNTER_FREQUENCY		100000000	/* 100MHz */
 
 /* Generic Interrupt Controller Definitions */
 #ifdef CONFIG_GICV3
-#define GICD_BASE			(0x2f000000)
-#define GICR_BASE			(0x2f100000)
+#define GICD_BASE			(V2M_PA_BASE + 0x2f000000)
+#define GICR_BASE			(V2M_PA_BASE + 0x2f100000)
 #else
 
-#ifdef CONFIG_TARGET_VEXPRESS64_BASE_FVP
-#define GICD_BASE			(0x2f000000)
-#define GICC_BASE			(0x2c000000)
-#elif CONFIG_TARGET_VEXPRESS64_JUNO
+#ifdef CONFIG_TARGET_VEXPRESS64_JUNO
 #define GICD_BASE			(0x2C010000)
 #define GICC_BASE			(0x2C02f000)
+#else
+#define GICD_BASE			(V2M_PA_BASE + 0x2f000000)
+#define GICC_BASE			(V2M_PA_BASE + 0x2c000000)
 #endif
 #endif /* !CONFIG_GICV3 */
 
@@ -91,7 +97,7 @@
 #ifndef CONFIG_TARGET_VEXPRESS64_JUNO
 /* The Vexpress64 simulators use SMSC91C111 */
 #define CONFIG_SMC91111			1
-#define CONFIG_SMC91111_BASE		(0x01A000000)
+#define CONFIG_SMC91111_BASE		(V2M_PA_BASE + 0x01A000000)
 #endif
 
 /* PL011 Serial Configuration */
@@ -117,7 +123,7 @@
 #ifdef CONFIG_TARGET_VEXPRESS64_JUNO
 #define PHYS_SDRAM_2			(0x880000000)
 #define PHYS_SDRAM_2_SIZE		0x180000000
-#elif CONFIG_TARGET_VEXPRESS64_BASE_FVP && CONFIG_NR_DRAM_BANKS == 2
+#elif CONFIG_NR_DRAM_BANKS == 2
 #define PHYS_SDRAM_2			(0x880000000)
 #define PHYS_SDRAM_2_SIZE		0x80000000
 #endif
@@ -204,6 +210,17 @@
 				"  booti $kernel_addr - $fdt_addr; " \
 				"fi"
 #endif
+
+#elif CONFIG_TARGET_VEXPRESS64_BASER_FVP
+#define CONFIG_EXTRA_ENV_SETTINGS	\
+				"kernel_addr=0x00800000\0"	\
+				"fdt_addr=0x03000000\0"		\
+				"boot_addr=0x0007f800\0"
+
+#ifndef CONFIG_BOOTCOMMAND
+#define CONFIG_BOOTCOMMAND	"fdt addr ${fdt_addr}; fdt resize; " \
+				"booti $kernel_addr - $fdt_addr; "
+#endif
 #endif
 
 /* Monitor Command Prompt */
@@ -217,7 +234,7 @@
 /* Store environment at top of flash in the same location as blank.img */
 /* in the Juno firmware. */
 #else
-#define CONFIG_SYS_FLASH_BASE		0x0C000000
+#define CONFIG_SYS_FLASH_BASE		(V2M_PA_BASE + 0x0C000000)
 /* 256 x 256KiB sectors */
 #define CONFIG_SYS_MAX_FLASH_SECT	256
 /* Store environment at top of flash */
@@ -234,4 +251,8 @@
 #define CONFIG_SYS_FLASH_EMPTY_INFO	/* flinfo indicates empty blocks */
 #define FLASH_MAX_SECTOR_SIZE		0x00040000
 
+#ifdef CONFIG_TARGET_VEXPRESS64_BASER_FVP
+#define CONFIG_ARMV8_SWITCH_TO_EL1
+#endif
+
 #endif /* __VEXPRESS_AEMV8A_H */
-- 
2.25.1

[PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Peter Hoyes]

From: Peter Hoyes <Peter.Hoyes@arm.com>

Use the environment variable armv8_switch_to_el1 to determine whether
to switch to EL1 at runtime. This is an alternative to the
CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.

The environment variable will be ineffective if the ARMV8_MULTIENTRY
config is used.

This is required by the Armv8r64 architecture, which must be able to
boot at S-EL1 for Linux but may need to boot at other ELs for other
systems.

Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
---
 arch/arm/lib/bootm.c | 40 +++++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
index f60ee3a7e6..ea9bfe7570 100644
--- a/arch/arm/lib/bootm.c
+++ b/arch/arm/lib/bootm.c
@@ -317,7 +317,6 @@ __weak void update_os_arch_secondary_cores(uint8_t os_arch)
 {
 }
 
-#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
 static void switch_to_el1(void)
 {
 	if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
@@ -332,7 +331,6 @@ static void switch_to_el1(void)
 				    ES_TO_AARCH64);
 }
 #endif
-#endif
 
 /* Subcommand: GO */
 static void boot_jump_linux(bootm_headers_t *images, int flag)
@@ -359,21 +357,33 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
 
 		update_os_arch_secondary_cores(images->os.arch);
 
-#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
-		armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
-				    (u64)switch_to_el1, ES_TO_AARCH64);
+#ifdef CONFIG_ARMV8_MULTIENTRY
+		int armv8_switch_to_el1 = -1;
 #else
-		if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
-		    (images->os.arch == IH_ARCH_ARM))
-			armv8_switch_to_el2(0, (u64)gd->bd->bi_arch_number,
-					    (u64)images->ft_addr, 0,
-					    (u64)images->ep,
-					    ES_TO_AARCH32);
-		else
-			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
-					    images->ep,
-					    ES_TO_AARCH64);
+		int armv8_switch_to_el1 = env_get_yesno("armv8_switch_to_el1");
 #endif
+#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
+		if (armv8_switch_to_el1 == -1) {
+			armv8_switch_to_el1 = 1;
+		}
+#endif
+		if (armv8_switch_to_el1 == 1) {
+			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
+					    (u64)switch_to_el1, ES_TO_AARCH64);
+		} else {
+			if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
+					(images->os.arch == IH_ARCH_ARM))
+				armv8_switch_to_el2(0,
+						    (u64)gd->bd->bi_arch_number,
+						    (u64)images->ft_addr, 0,
+						    (u64)images->ep,
+						    ES_TO_AARCH32);
+			else
+				armv8_switch_to_el2((u64)images->ft_addr,
+						    0, 0, 0,
+						    images->ep,
+						    ES_TO_AARCH64);
+		}
 	}
 #else
 	unsigned long machid = gd->bd->bi_arch_number;
-- 
2.25.1

[PATCH v2 6/6] doc: Add documentation for the Arm vexpress board configs

[Peter Hoyes]

From: Peter Hoyes <Peter.Hoyes@arm.com>

Create a new documentation section for Arm Ltd boards with a sub-page
for the vexpress board (FVP-A, FVP-R and Juno).

Document how the armv8_switch_to_el1 environment variable can be used
to switch between booting from S-EL2/S-EL1 at runtime on the BASER_FVP.

Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
---
 doc/arch/arm64.rst              |  3 +-
 doc/board/armltd/index.rst      |  9 ++++++
 doc/board/armltd/vexpress64.rst | 57 +++++++++++++++++++++++++++++++++
 doc/board/index.rst             |  1 +
 4 files changed, 69 insertions(+), 1 deletion(-)
 create mode 100644 doc/board/armltd/index.rst
 create mode 100644 doc/board/armltd/vexpress64.rst

diff --git a/doc/arch/arm64.rst b/doc/arch/arm64.rst
index 80498f6f6b..f20eb8f1b2 100644
--- a/doc/arch/arm64.rst
+++ b/doc/arch/arm64.rst
@@ -18,7 +18,8 @@ Notes
    classical firmware (like initial hardware setup, CPU errata workarounds
    or SMP bringup). U-Boot can be entered in EL2 when its main purpose is
    that of a boot loader. It can drop to lower exception levels before
-   entering the OS.
+   entering the OS. For ARMv8-R it is recommened to enter at S-EL2, as for this
+   architecture there is no S-EL3.
 
 2. U-Boot for arm64 is compiled with AArch64-gcc. AArch64-gcc
    use rela relocation format, a tool(tools/relocate-rela) by Scott Wood
diff --git a/doc/board/armltd/index.rst b/doc/board/armltd/index.rst
new file mode 100644
index 0000000000..b6786c114f
--- /dev/null
+++ b/doc/board/armltd/index.rst
@@ -0,0 +1,9 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+Arm Ltd
+=============
+
+.. toctree::
+   :maxdepth: 2
+
+   vexpress64.rst
diff --git a/doc/board/armltd/vexpress64.rst b/doc/board/armltd/vexpress64.rst
new file mode 100644
index 0000000000..23cf6aec88
--- /dev/null
+++ b/doc/board/armltd/vexpress64.rst
@@ -0,0 +1,57 @@
+.. SPDX-License-Identifier: GPL-2.0+
+
+Arm Versatile Express
+=====================
+
+The vexpress_* board configuration supports the following platforms:
+
+ * FVP_Base_RevC-2xAEMvA
+ * FVP_BaseR_AEMv8R
+ * Juno development board
+
+Fixed Virtual Platforms
+-----------------------
+
+The Fixed Virtual Platforms (FVP) are complete simulations of an Arm system,
+including processor, memory and peripherals. They are set out in a "programmer's
+view", which gives a comprehensive model on which to build and test software.
+
+The supported FVPs are available free of charge and can be downloaded from the
+Arm developer site [1]_ (user registration might be required).
+
+Supported features:
+
+ * GICv3
+ * Generic timer
+ * PL011 UART
+ * SMC91111 network interface
+
+The default configuration assumes that U-Boot is boostrapped from the start of
+the DRAM (address 0x80000000 for AEMvA; 0x00000000 for AEMv8R) using a suitable
+bootloader. Alternatively, U-Boot can be launched directly by mapping the binary
+to the same address (using the FVP's --data argument).
+
+The FVPs can be debugged using Arm Development Studio [2]_.
+
+FVP_BaseR
+^^^^^^^^^
+
+On Armv8r64 platforms (such as the FVP_BaseR), U-Boot runs at S-EL2, so
+CONFIG_ARMV8_SWITCH_TO_EL1 is defined so that the next stage boots at S-EL1. If
+S-EL2 is desired instead, the *armv8_switch_to_el1* environment variable is
+available. This can be set to *n* to override the config flag and boot the next
+stage at S-EL2 instead.
+
+Juno
+----
+
+The Juno development board is an open, vendor-neutral Armv8-A development
+platform that supports an out-of-the-box Linux software package. A range of
+plug-in expansion options enables hardware and software applications to be
+developped and debugged.
+
+References
+----------
+
+.. [1] https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual-platforms
+.. [2] https://developer.arm.com/tools-and-software/embedded/arm-development-studio
diff --git a/doc/board/index.rst b/doc/board/index.rst
index 9e90978891..cd4f273b4d 100644
--- a/doc/board/index.rst
+++ b/doc/board/index.rst
@@ -10,6 +10,7 @@ Board-specific doc
    advantech/index
    AndesTech/index
    amlogic/index
+   armltd/index
    atmel/index
    congatec/index
    coreboot/index
-- 
2.25.1

Re: [PATCH v2 1/6] armv8: Disable pointer authentication traps for EL1

[Andre Przywara]

On 8/19/21 4:53 PM, Peter Hoyes wrote:
> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> The use of ARMv8.3 pointer authentication (PAuth) is governed by fields
> in HCR_EL2, which trigger a 'trap to EL2' if not enabled. The reset
> value of these fields is 'architecturally unknown' so we must ensure
> that the fields are enabled (to disable the traps) if we are entering
> the kernel at EL1.
> 
> The APK field disables PAuth instruction traps and the API field
> disables PAuth register traps
> 
> Add code to disable the traps in armv8_switch_to_el1_m. Prior to doing
> so, it checks fields in the ID_AA64ISAR1_EL1 register to ensure pointer
> authentication is supported by the hardware.
> 
> The runtime checks require a second temporary register, so add this to
> the EL1 transition macro signature and update 2 call sites.

                                                 ^^^^^^^^^^^^

So can we get rid of the rather fragile macro, and just have one normal 
function, in transition.S, which fsl-layerscape/spintable.S calls? The 
code does not seem to return, and also the FSL call site does not seem 
to be in some special section or so, so not sure why this was a macro in 
the first place?

Cheers,
Andre

> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
> ---
>   arch/arm/cpu/armv8/fsl-layerscape/spintable.S |  2 +-
>   arch/arm/cpu/armv8/transition.S               |  2 +-
>   arch/arm/include/asm/macro.h                  | 11 +++++++++--
>   arch/arm/include/asm/system.h                 | 15 +++++++++++++++
>   4 files changed, 26 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
> index 363ded03e6..d6bd188459 100644
> --- a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
> +++ b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S
> @@ -93,7 +93,7 @@ __secondary_boot_func:
>   4:
>   #ifdef CONFIG_ARMV8_SWITCH_TO_EL1
>   	switch_el x7, _dead_loop, 0f, _dead_loop
> -0:	armv8_switch_to_el1_m x4, x6, x7
> +0:	armv8_switch_to_el1_m x4, x6, x7, x9
>   #else
>   	switch_el x7, 0f, _dead_loop, _dead_loop
>   0:	armv8_switch_to_el2_m x4, x6, x7
> diff --git a/arch/arm/cpu/armv8/transition.S b/arch/arm/cpu/armv8/transition.S
> index a31af4ffc8..9dbdff3a4f 100644
> --- a/arch/arm/cpu/armv8/transition.S
> +++ b/arch/arm/cpu/armv8/transition.S
> @@ -40,7 +40,7 @@ ENTRY(armv8_switch_to_el1)
>   	 * now, jump to the address saved in x4.
>   	 */
>   	br x4
> -1:	armv8_switch_to_el1_m x4, x5, x6
> +1:	armv8_switch_to_el1_m x4, x5, x6, x7
>   ENDPROC(armv8_switch_to_el1)
>   .popsection
>   
> diff --git a/arch/arm/include/asm/macro.h b/arch/arm/include/asm/macro.h
> index 485310d660..e1eefc283f 100644
> --- a/arch/arm/include/asm/macro.h
> +++ b/arch/arm/include/asm/macro.h
> @@ -256,7 +256,7 @@ lr	.req	x30
>    * For loading 64-bit OS, x0 is physical address to the FDT blob.
>    * They will be passed to the guest.
>    */
> -.macro armv8_switch_to_el1_m, ep, flag, tmp
> +.macro armv8_switch_to_el1_m, ep, flag, tmp, tmp2
>   	/* Initialize Generic Timers */
>   	mrs	\tmp, cnthctl_el2
>   	/* Enable EL1 access to timers */
> @@ -306,7 +306,14 @@ lr	.req	x30
>   	b.eq	1f
>   
>   	/* Initialize HCR_EL2 */
> -	ldr	\tmp, =(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS)
> +	/* Only disable PAuth traps if PAuth is supported */
> +	mrs	\tmp, id_aa64isar1_el1
> +	ldr	\tmp2, =(ID_AA64ISAR1_EL1_GPI | ID_AA64ISAR1_EL1_GPA | \
> +		      ID_AA64ISAR1_EL1_API | ID_AA64ISAR1_EL1_APA)
> +	tst	\tmp, \tmp2
> +	mov	\tmp2, #(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS)
> +	orr	\tmp, \tmp2, #(HCR_EL2_APK | HCR_EL2_API)
> +	csel	\tmp, \tmp2, \tmp, eq
>   	msr	hcr_el2, \tmp
>   
>   	/* Return to the EL1_SP1 mode from EL2 */
> diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
> index 8b3a54e64c..77aa18909e 100644
> --- a/arch/arm/include/asm/system.h
> +++ b/arch/arm/include/asm/system.h
> @@ -75,10 +75,25 @@
>   /*
>    * HCR_EL2 bits definitions
>    */
> +#define HCR_EL2_API		(1 << 41) /* Trap pointer authentication
> +				             instructions                     */
> +#define HCR_EL2_APK		(1 << 40) /* Trap pointer authentication
> +				             key access                       */
>   #define HCR_EL2_RW_AARCH64	(1 << 31) /* EL1 is AArch64                   */
>   #define HCR_EL2_RW_AARCH32	(0 << 31) /* Lower levels are AArch32         */
>   #define HCR_EL2_HCD_DIS		(1 << 29) /* Hypervisor Call disabled         */
>   
> +/*
> + * ID_AA64ISAR1_EL1 bits definitions
> + */
> +#define ID_AA64ISAR1_EL1_GPI	(0xF << 28) /* Implementation-defined generic
> +				               code auth algorithm            */
> +#define ID_AA64ISAR1_EL1_GPA	(0xF << 24) /* QARMA generic code auth
> +				               algorithm                      */
> +#define ID_AA64ISAR1_EL1_API	(0xF << 8)  /* Implementation-defined address
> +				               auth algorithm                 */
> +#define ID_AA64ISAR1_EL1_APA	(0xF << 4)  /* QARMA address auth algorithm   */
> +
>   /*
>    * ID_AA64PFR0_EL1 bits definitions
>    */
> 

Re: [PATCH v2 1/6] armv8: Disable pointer authentication traps for EL1

[Michael Walle]

Hi,

Am 2021-08-20 16:44, schrieb Andre Przywara:
> On 8/19/21 4:53 PM, Peter Hoyes wrote:
>> From: Peter Hoyes <Peter.Hoyes@arm.com>
>> 
>> The use of ARMv8.3 pointer authentication (PAuth) is governed by 
>> fields
>> in HCR_EL2, which trigger a 'trap to EL2' if not enabled. The reset
>> value of these fields is 'architecturally unknown' so we must ensure
>> that the fields are enabled (to disable the traps) if we are entering
>> the kernel at EL1.
>> 
>> The APK field disables PAuth instruction traps and the API field
>> disables PAuth register traps
>> 
>> Add code to disable the traps in armv8_switch_to_el1_m. Prior to doing
>> so, it checks fields in the ID_AA64ISAR1_EL1 register to ensure 
>> pointer
>> authentication is supported by the hardware.
>> 
>> The runtime checks require a second temporary register, so add this to
>> the EL1 transition macro signature and update 2 call sites.
> 
>                                                 ^^^^^^^^^^^^
> 
> So can we get rid of the rather fragile macro, and just have one
> normal function, in transition.S, which fsl-layerscape/spintable.S
> calls? The code does not seem to return, and also the FSL call site
> does not seem to be in some special section or so, so not sure why
> this was a macro in the first place?

The spin tables will be marked as reserved memory at
   
https://elixir.bootlin.com/u-boot/v2021.10-rc2/source/arch/arm/cpu/armv8/fsl-layerscape/fdt.c#L147
also the code will be moved around:
   
https://elixir.bootlin.com/u-boot/v2021.10-rc2/source/arch/arm/cpu/armv8/fsl-layerscape/mp.c#L97

-michael

Re: [PATCH v2 3/6] armv8: Add ARMv8 MPU configuration logic

[Andre Przywara]

On 8/19/21 4:53 PM, Peter Hoyes wrote:

Hi,

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> Armv8r64 is the first Armv8 platform that only has a PMSA at the
> current exception level. The architecture supplement for Armv8r64
> describes new fields in ID_AA64MMFR0_EL1 which can be used to detect
> whether a VMSA or PMSA is present. These fields are RES0 on Armv8a.
> 
> Add logic to read these fields and, for the protection of the memory
> used by U-Boot, initialize the MPU instead of the MMU during init, then
> clear the MPU regions before transition to the next stage.
> 
> Provide a default (blank) MPU memory map, which can be overridden by
> board configurations.

So while this MPU feature is indeed architecturally discoverable, and 
that works fine even on existing ARMv8-A cores, this adds some code to 
the generic ARMv8 code path, which almost no one needs. So to avoid code 
bloat, I was wondering if we should move this code to a separate file 
and only include it when a new Kconfig symbol (for v8-R64) is defined?
The new board can then select this symbol.
We can then have either weak functions or static inline versions of the 
new functions (el_has_mmu(), mpu_setup()), to keep the existing code path.

Cheers,
Andre

> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
> ---
>   arch/arm/cpu/armv8/cache_v8.c    | 96 +++++++++++++++++++++++++++++++-
>   arch/arm/include/asm/armv8/mpu.h | 61 ++++++++++++++++++++
>   2 files changed, 154 insertions(+), 3 deletions(-)
>   create mode 100644 arch/arm/include/asm/armv8/mpu.h
> 
> diff --git a/arch/arm/cpu/armv8/cache_v8.c b/arch/arm/cpu/armv8/cache_v8.c
> index 3de18c7675..46625675bd 100644
> --- a/arch/arm/cpu/armv8/cache_v8.c
> +++ b/arch/arm/cpu/armv8/cache_v8.c
> @@ -15,6 +15,7 @@
>   #include <asm/global_data.h>
>   #include <asm/system.h>
>   #include <asm/armv8/mmu.h>
> +#include <asm/armv8/mpu.h>
>   
>   DECLARE_GLOBAL_DATA_PTR;
>   
> @@ -365,6 +366,86 @@ __weak u64 get_page_table_size(void)
>   	return size;
>   }
>   
> +static void mpu_clear_regions(void)
> +{
> +	int i;
> +
> +	for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) {
> +		setup_el2_mpu_region(i, 0, 0);
> +	}
> +}
> +
> +static struct mpu_region default_mpu_mem_map[] = {{0,}};
> +__weak struct mpu_region *mpu_mem_map = default_mpu_mem_map;
> +
> +static void mpu_setup(void)
> +{
> +	int i;
> +
> +	if (current_el() != 2) {
> +		panic("MPU configuration is only supported at EL2");
> +	}
> +
> +	set_sctlr(get_sctlr() & ~(CR_M | CR_WXN));
> +
> +	asm volatile("msr MAIR_EL2, %0" : : "r" MEMORY_ATTRIBUTES);
> +
> +	for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) {
> +		setup_el2_mpu_region(i,
> +			PRBAR_ADDRESS(mpu_mem_map[i].start)
> +				| PRBAR_OUTER_SH | PRBAR_AP_RW_ANY,
> +			PRLAR_ADDRESS(mpu_mem_map[i].end)
> +				| mpu_mem_map[i].attrs | PRLAR_EN_BIT
> +			);
> +	}
> +
> +	set_sctlr(get_sctlr() | CR_M);
> +}
> +
> +static bool el_has_mmu(void)
> +{
> +	uint64_t id_aa64mmfr0;
> +	asm volatile("mrs %0, id_aa64mmfr0_el1"
> +			: "=r" (id_aa64mmfr0) : : "cc");
> +	uint64_t msa = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_MASK;
> +	uint64_t msa_frac = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_FRAC_MASK;
> +
> +	switch (msa) {
> +		case ID_AA64MMFR0_EL1_MSA_VMSA:
> +			/*
> +			 * VMSA supported in all translation regimes.
> +			 * No support for PMSA.
> +			 */
> +			return true;
> +		case ID_AA64MMFR0_EL1_MSA_USE_FRAC:
> +			/* See MSA_frac for the supported MSAs. */
> +			switch (msa_frac) {
> +				case ID_AA64MMFR0_EL1_MSA_FRAC_NO_PMSA:
> +					/*
> +					 * PMSA not supported in any translation
> +					 * regime.
> +					 */
> +					return true;
> +				case ID_AA64MMFR0_EL1_MSA_FRAC_VMSA:
> +					/*
> +					* PMSA supported in all translation
> +					* regimes. No support for VMSA.
> +					*/
> +				case ID_AA64MMFR0_EL1_MSA_FRAC_PMSA:
> +					/*
> +					 * PMSA supported in all translation
> +					 * regimes.
> +					 */
> +					return false;
> +				default:
> +					panic("Unsupported id_aa64mmfr0_el1 " \
> +						"MSA_frac value");
> +			}
> +		default:
> +			panic("Unsupported id_aa64mmfr0_el1 MSA value");
> +	}
> +}
> +
>   void setup_pgtables(void)
>   {
>   	int i;
> @@ -479,8 +560,13 @@ void dcache_enable(void)
>   	/* The data cache is not active unless the mmu is enabled */
>   	if (!(get_sctlr() & CR_M)) {
>   		invalidate_dcache_all();
> -		__asm_invalidate_tlb_all();
> -		mmu_setup();
> +
> +		if (el_has_mmu()) {
> +			__asm_invalidate_tlb_all();
> +			mmu_setup();
> +		} else {
> +			mpu_setup();
> +		}
>   	}
>   
>   	set_sctlr(get_sctlr() | CR_C);
> @@ -499,7 +585,11 @@ void dcache_disable(void)
>   	set_sctlr(sctlr & ~(CR_C|CR_M));
>   
>   	flush_dcache_all();
> -	__asm_invalidate_tlb_all();
> +
> +	if (el_has_mmu())
> +		__asm_invalidate_tlb_all();
> +	else
> +		mpu_clear_regions();
>   }
>   
>   int dcache_status(void)
> diff --git a/arch/arm/include/asm/armv8/mpu.h b/arch/arm/include/asm/armv8/mpu.h
> new file mode 100644
> index 0000000000..c6c8828325
> --- /dev/null
> +++ b/arch/arm/include/asm/armv8/mpu.h
> @@ -0,0 +1,61 @@
> +/*
> + * SPDX-License-Identifier: GPL-2.0+
> + *
> + * (C) Copyright 2021 Arm Limited
> + */
> +
> +#ifndef _ASM_ARMV8_MPU_H_
> +#define _ASM_ARMV8_MPU_H_
> +
> +#include <asm/armv8/mmu.h>
> +#include <asm/barriers.h>
> +#include <linux/stringify.h>
> +
> +#define PRSELR_EL2		S3_4_c6_c2_1
> +#define PRBAR_EL2		S3_4_c6_c8_0
> +#define PRLAR_EL2		S3_4_c6_c8_1
> +#define MPUIR_EL2		S3_4_c0_c0_4
> +
> +#define PRBAR_ADDRESS(addr)	((addr) & ~(0x3fULL))
> +
> +/* Access permissions */
> +#define PRBAR_AP(val)		(((val) & 0x3) << 2)
> +#define PRBAR_AP_RW_HYP		PRBAR_AP(0x0)
> +#define PRBAR_AP_RW_ANY		PRBAR_AP(0x1)
> +#define PRBAR_AP_RO_HYP		PRBAR_AP(0x2)
> +#define PRBAR_AP_RO_ANY		PRBAR_AP(0x3)
> +
> +/* Shareability */
> +#define PRBAR_SH(val)		(((val) & 0x3) << 4)
> +#define PRBAR_NON_SH		PRBAR_SH(0x0)
> +#define PRBAR_OUTER_SH		PRBAR_SH(0x2)
> +#define PRBAR_INNER_SH		PRBAR_SH(0x3)
> +
> +/* Memory attribute (MAIR idx) */
> +#define PRLAR_ATTRIDX(val)	(((val) & 0x7) << 1)
> +#define PRLAR_EN_BIT		(0x1)
> +#define PRLAR_ADDRESS(addr)	((addr) & ~(0x3fULL))
> +
> +#ifndef __ASSEMBLY__
> +
> +static inline void setup_el2_mpu_region(uint8_t region, uint64_t base, uint64_t limit)
> +{
> +	asm volatile("msr " __stringify(PRSELR_EL2) ", %0" : : "r" (region));
> +	isb();
> +	asm volatile("msr " __stringify(PRBAR_EL2) ", %0" : : "r" (base));
> +	asm volatile("msr " __stringify(PRLAR_EL2) ", %0" : : "r" (limit));
> +	dsb();
> +	isb();
> +}
> +
> +#endif
> +
> +struct mpu_region {
> +	u64 start;
> +	u64 end;
> +	u64 attrs;
> +};
> +
> +extern struct mpu_region *mpu_mem_map;
> +
> +#endif /* _ASM_ARMV8_MPU_H_ */
> 

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Andre Przywara]

On 8/19/21 4:53 PM, Peter Hoyes wrote:

Hi,

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> Use the environment variable armv8_switch_to_el1 to determine whether
> to switch to EL1 at runtime. This is an alternative to the
> CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.

This might be useful outside of the v8-R64 FVP. I cannot find 
CONFIG_ARMV8_SWITCH_TO_EL1 being set anywhere, which makes me wonder how 
this is used? Are there certain custom builds which define this somehow?

In any case forcing "kernel" entry in either EL1 or EL2, and deciding 
this at runtime sounds useful for certain scenarios in general, and be 
it for debugging and testing. So shall we get rid of this compile time 
option at all, or shall this be retained to avoid extra code?

> The environment variable will be ineffective if the ARMV8_MULTIENTRY
> config is used.
> 
> This is required by the Armv8r64 architecture, which must be able to
> boot at S-EL1 for Linux but may need to boot at other ELs for other
> systems.
> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
> ---
>   arch/arm/lib/bootm.c | 40 +++++++++++++++++++++++++---------------
>   1 file changed, 25 insertions(+), 15 deletions(-)
> 
> diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
> index f60ee3a7e6..ea9bfe7570 100644
> --- a/arch/arm/lib/bootm.c
> +++ b/arch/arm/lib/bootm.c
> @@ -317,7 +317,6 @@ __weak void update_os_arch_secondary_cores(uint8_t os_arch)
>   {
>   }
>   
> -#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
>   static void switch_to_el1(void)
>   {
>   	if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
> @@ -332,7 +331,6 @@ static void switch_to_el1(void)
>   				    ES_TO_AARCH64);
>   }
>   #endif
> -#endif
>   
>   /* Subcommand: GO */
>   static void boot_jump_linux(bootm_headers_t *images, int flag)
> @@ -359,21 +357,33 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
>   
>   		update_os_arch_secondary_cores(images->os.arch);
>   
> -#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
> -		armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
> -				    (u64)switch_to_el1, ES_TO_AARCH64);
> +#ifdef CONFIG_ARMV8_MULTIENTRY
> +		int armv8_switch_to_el1 = -1;
>   #else
> -		if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
> -		    (images->os.arch == IH_ARCH_ARM))
> -			armv8_switch_to_el2(0, (u64)gd->bd->bi_arch_number,
> -					    (u64)images->ft_addr, 0,
> -					    (u64)images->ep,
> -					    ES_TO_AARCH32);
> -		else
> -			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
> -					    images->ep,
> -					    ES_TO_AARCH64);
> +		int armv8_switch_to_el1 = env_get_yesno("armv8_switch_to_el1");
>   #endif
> +#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
> +		if (armv8_switch_to_el1 == -1) {
> +			armv8_switch_to_el1 = 1;
> +		}
> +#endif
> +		if (armv8_switch_to_el1 == 1) {

This looks confusing. Can't we use CONFIG_IS_ENABLED() and override 
armv8_switch_to_el1, then use this one variable to trigger the action?

Cheers,
Andre

> +			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
> +					    (u64)switch_to_el1, ES_TO_AARCH64);
> +		} else {
> +			if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
> +					(images->os.arch == IH_ARCH_ARM))
> +				armv8_switch_to_el2(0,
> +						    (u64)gd->bd->bi_arch_number,
> +						    (u64)images->ft_addr, 0,
> +						    (u64)images->ep,
> +						    ES_TO_AARCH32);
> +			else
> +				armv8_switch_to_el2((u64)images->ft_addr,
> +						    0, 0, 0,
> +						    images->ep,
> +						    ES_TO_AARCH64);
> +		}
>   	}
>   #else
>   	unsigned long machid = gd->bd->bi_arch_number;
> 

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 3925 bytes --]

On Fri, Aug 20, 2021 at 05:57:51PM +0100, Andre Przywara wrote:
> On 8/19/21 4:53 PM, Peter Hoyes wrote:
> 
> Hi,
> 
> > From: Peter Hoyes <Peter.Hoyes@arm.com>
> > 
> > Use the environment variable armv8_switch_to_el1 to determine whether
> > to switch to EL1 at runtime. This is an alternative to the
> > CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.
> 
> This might be useful outside of the v8-R64 FVP. I cannot find
> CONFIG_ARMV8_SWITCH_TO_EL1 being set anywhere, which makes me wonder how
> this is used? Are there certain custom builds which define this somehow?

Adding Michal and asking for a Kconfig migration too :)

> 
> In any case forcing "kernel" entry in either EL1 or EL2, and deciding this
> at runtime sounds useful for certain scenarios in general, and be it for
> debugging and testing. So shall we get rid of this compile time option at
> all, or shall this be retained to avoid extra code?
> 
> > The environment variable will be ineffective if the ARMV8_MULTIENTRY
> > config is used.
> > 
> > This is required by the Armv8r64 architecture, which must be able to
> > boot at S-EL1 for Linux but may need to boot at other ELs for other
> > systems.
> > 
> > Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
> > ---
> >   arch/arm/lib/bootm.c | 40 +++++++++++++++++++++++++---------------
> >   1 file changed, 25 insertions(+), 15 deletions(-)
> > 
> > diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
> > index f60ee3a7e6..ea9bfe7570 100644
> > --- a/arch/arm/lib/bootm.c
> > +++ b/arch/arm/lib/bootm.c
> > @@ -317,7 +317,6 @@ __weak void update_os_arch_secondary_cores(uint8_t os_arch)
> >   {
> >   }
> > -#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
> >   static void switch_to_el1(void)
> >   {
> >   	if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
> > @@ -332,7 +331,6 @@ static void switch_to_el1(void)
> >   				    ES_TO_AARCH64);
> >   }
> >   #endif
> > -#endif
> >   /* Subcommand: GO */
> >   static void boot_jump_linux(bootm_headers_t *images, int flag)
> > @@ -359,21 +357,33 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
> >   		update_os_arch_secondary_cores(images->os.arch);
> > -#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
> > -		armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
> > -				    (u64)switch_to_el1, ES_TO_AARCH64);
> > +#ifdef CONFIG_ARMV8_MULTIENTRY
> > +		int armv8_switch_to_el1 = -1;
> >   #else
> > -		if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
> > -		    (images->os.arch == IH_ARCH_ARM))
> > -			armv8_switch_to_el2(0, (u64)gd->bd->bi_arch_number,
> > -					    (u64)images->ft_addr, 0,
> > -					    (u64)images->ep,
> > -					    ES_TO_AARCH32);
> > -		else
> > -			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
> > -					    images->ep,
> > -					    ES_TO_AARCH64);
> > +		int armv8_switch_to_el1 = env_get_yesno("armv8_switch_to_el1");
> >   #endif
> > +#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
> > +		if (armv8_switch_to_el1 == -1) {
> > +			armv8_switch_to_el1 = 1;
> > +		}
> > +#endif
> > +		if (armv8_switch_to_el1 == 1) {
> 
> This looks confusing. Can't we use CONFIG_IS_ENABLED() and override
> armv8_switch_to_el1, then use this one variable to trigger the action?
> 
> Cheers,
> Andre
> 
> > +			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
> > +					    (u64)switch_to_el1, ES_TO_AARCH64);
> > +		} else {
> > +			if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
> > +					(images->os.arch == IH_ARCH_ARM))
> > +				armv8_switch_to_el2(0,
> > +						    (u64)gd->bd->bi_arch_number,
> > +						    (u64)images->ft_addr, 0,
> > +						    (u64)images->ep,
> > +						    ES_TO_AARCH32);
> > +			else
> > +				armv8_switch_to_el2((u64)images->ft_addr,
> > +						    0, 0, 0,
> > +						    images->ep,
> > +						    ES_TO_AARCH64);
> > +		}
> >   	}
> >   #else
> >   	unsigned long machid = gd->bd->bi_arch_number;
> > 
> 

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Andre Przywara]

On 8/20/21 6:05 PM, Tom Rini wrote:
> On Fri, Aug 20, 2021 at 05:57:51PM +0100, Andre Przywara wrote:
>> On 8/19/21 4:53 PM, Peter Hoyes wrote:

Hi,

>>> From: Peter Hoyes <Peter.Hoyes@arm.com>
>>>
>>> Use the environment variable armv8_switch_to_el1 to determine whether
>>> to switch to EL1 at runtime. This is an alternative to the
>>> CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.
>>
>> This might be useful outside of the v8-R64 FVP. I cannot find
>> CONFIG_ARMV8_SWITCH_TO_EL1 being set anywhere, which makes me wonder how
>> this is used? Are there certain custom builds which define this somehow?
> 
> Adding Michal ...

Michal, I see that Xilinx Versal and ZynqMP have a commented "define 
CONFIG_ARMV8_SWITCH_TO_EL1" in their include headers. Can you say what 
is the use case here?
 From an architectural point of view it sounds useful to have this 
feature in general and the dynamic switch-ability on top of that for all 
ARM64 platforms, but I would first like to understand how this is used 
with those Xilink platforms.

> asking for a Kconfig migration too :)

That sounds reasonable. I will have a stab once we agree how to address 
this feature in general.

Cheers,
Andre

> 
>>
>> In any case forcing "kernel" entry in either EL1 or EL2, and deciding this
>> at runtime sounds useful for certain scenarios in general, and be it for
>> debugging and testing. So shall we get rid of this compile time option at
>> all, or shall this be retained to avoid extra code?
>>
>>> The environment variable will be ineffective if the ARMV8_MULTIENTRY
>>> config is used.
>>>
>>> This is required by the Armv8r64 architecture, which must be able to
>>> boot at S-EL1 for Linux but may need to boot at other ELs for other
>>> systems.
>>>
>>> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
>>> ---
>>>    arch/arm/lib/bootm.c | 40 +++++++++++++++++++++++++---------------
>>>    1 file changed, 25 insertions(+), 15 deletions(-)
>>>
>>> diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
>>> index f60ee3a7e6..ea9bfe7570 100644
>>> --- a/arch/arm/lib/bootm.c
>>> +++ b/arch/arm/lib/bootm.c
>>> @@ -317,7 +317,6 @@ __weak void update_os_arch_secondary_cores(uint8_t os_arch)
>>>    {
>>>    }
>>> -#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
>>>    static void switch_to_el1(void)
>>>    {
>>>    	if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
>>> @@ -332,7 +331,6 @@ static void switch_to_el1(void)
>>>    				    ES_TO_AARCH64);
>>>    }
>>>    #endif
>>> -#endif
>>>    /* Subcommand: GO */
>>>    static void boot_jump_linux(bootm_headers_t *images, int flag)
>>> @@ -359,21 +357,33 @@ static void boot_jump_linux(bootm_headers_t *images, int flag)
>>>    		update_os_arch_secondary_cores(images->os.arch);
>>> -#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
>>> -		armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
>>> -				    (u64)switch_to_el1, ES_TO_AARCH64);
>>> +#ifdef CONFIG_ARMV8_MULTIENTRY
>>> +		int armv8_switch_to_el1 = -1;
>>>    #else
>>> -		if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
>>> -		    (images->os.arch == IH_ARCH_ARM))
>>> -			armv8_switch_to_el2(0, (u64)gd->bd->bi_arch_number,
>>> -					    (u64)images->ft_addr, 0,
>>> -					    (u64)images->ep,
>>> -					    ES_TO_AARCH32);
>>> -		else
>>> -			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
>>> -					    images->ep,
>>> -					    ES_TO_AARCH64);
>>> +		int armv8_switch_to_el1 = env_get_yesno("armv8_switch_to_el1");
>>>    #endif
>>> +#ifdef CONFIG_ARMV8_SWITCH_TO_EL1
>>> +		if (armv8_switch_to_el1 == -1) {
>>> +			armv8_switch_to_el1 = 1;
>>> +		}
>>> +#endif
>>> +		if (armv8_switch_to_el1 == 1) {
>>
>> This looks confusing. Can't we use CONFIG_IS_ENABLED() and override
>> armv8_switch_to_el1, then use this one variable to trigger the action?
>>
>> Cheers,
>> Andre
>>
>>> +			armv8_switch_to_el2((u64)images->ft_addr, 0, 0, 0,
>>> +					    (u64)switch_to_el1, ES_TO_AARCH64);
>>> +		} else {
>>> +			if ((IH_ARCH_DEFAULT == IH_ARCH_ARM64) &&
>>> +					(images->os.arch == IH_ARCH_ARM))
>>> +				armv8_switch_to_el2(0,
>>> +						    (u64)gd->bd->bi_arch_number,
>>> +						    (u64)images->ft_addr, 0,
>>> +						    (u64)images->ep,
>>> +						    ES_TO_AARCH32);
>>> +			else
>>> +				armv8_switch_to_el2((u64)images->ft_addr,
>>> +						    0, 0, 0,
>>> +						    images->ep,
>>> +						    ES_TO_AARCH64);
>>> +		}
>>>    	}
>>>    #else
>>>    	unsigned long machid = gd->bd->bi_arch_number;
>>>
>>
> 

Re: [PATCH v2 1/6] armv8: Disable pointer authentication traps for EL1

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 974 bytes --]

On Thu, Aug 19, 2021 at 04:53:09PM +0100, Peter Hoyes wrote:

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> The use of ARMv8.3 pointer authentication (PAuth) is governed by fields
> in HCR_EL2, which trigger a 'trap to EL2' if not enabled. The reset
> value of these fields is 'architecturally unknown' so we must ensure
> that the fields are enabled (to disable the traps) if we are entering
> the kernel at EL1.
> 
> The APK field disables PAuth instruction traps and the API field
> disables PAuth register traps
> 
> Add code to disable the traps in armv8_switch_to_el1_m. Prior to doing
> so, it checks fields in the ID_AA64ISAR1_EL1 register to ensure pointer
> authentication is supported by the hardware.
> 
> The runtime checks require a second temporary register, so add this to
> the EL1 transition macro signature and update 2 call sites.
> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 2/6] armv8: Ensure EL1&0 VMSA is enabled

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 752 bytes --]

On Thu, Aug 19, 2021 at 04:53:10PM +0100, Peter Hoyes wrote:

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> On Armv8-R, the EL1&0 memory system architecture is configurable as a
> VMSA or PMSA, and resets to an "architecturally unknown" value.
> 
> Add code to armv8_switch_to_el1_m which detects whether the MSA at
> EL1&0 is configurable using the id_aa64mmfr0_el1 register MSA fields.
> If it is we must ensure the VMSA is enabled so that a rich OS can boot.
> 
> The MSA and MSA_FRAC fields are described in the Armv8-R architecture
> profile supplement (section G1.3.7):
> https://developer.arm.com/documentation/ddi0600/latest/
> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 3/6] armv8: Add ARMv8 MPU configuration logic

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 808 bytes --]

On Thu, Aug 19, 2021 at 04:53:11PM +0100, Peter Hoyes wrote:

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> Armv8r64 is the first Armv8 platform that only has a PMSA at the
> current exception level. The architecture supplement for Armv8r64
> describes new fields in ID_AA64MMFR0_EL1 which can be used to detect
> whether a VMSA or PMSA is present. These fields are RES0 on Armv8a.
> 
> Add logic to read these fields and, for the protection of the memory
> used by U-Boot, initialize the MPU instead of the MMU during init, then
> clear the MPU regions before transition to the next stage.
> 
> Provide a default (blank) MPU memory map, which can be overridden by
> board configurations.
> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 4/6] vexpress64: Add BASER_FVP vexpress board variant

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 992 bytes --]

On Thu, Aug 19, 2021 at 04:53:12PM +0100, Peter Hoyes wrote:

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> The BASER_FVP board variant is implemented on top of the BASE_FVP board
> config (which, in turn, is based on the Juno Versatile Express board
> config). They all share a similar memory map - for BASER_FVP the map is
> inverted from the BASE_FVP
> (https://developer.arm.com/documentation/100964/1114/Base-Platform/Base---memory/BaseR-Platform-memory-map)
> 
>  * Create new TARGET_VEXPRESS64_BASER_FVP target, which uses the same
>    board config as BASE_FVP and JUNO
>  * Adapt vexpress_aemv8a.h header file to support BASER_FVP (and rename
>    to vexpress_aemv8.h)
>  * Enable config to switch to EL1 for the BASER_FVP
>  * Create vexpress_aemv8r defconfig
>  * Provide an MPU memory map for the BASER_FVP
> 
> For now, only single core boot is supported.
> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 654 bytes --]

On Thu, Aug 19, 2021 at 04:53:13PM +0100, Peter Hoyes wrote:

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> Use the environment variable armv8_switch_to_el1 to determine whether
> to switch to EL1 at runtime. This is an alternative to the
> CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.
> 
> The environment variable will be ineffective if the ARMV8_MULTIENTRY
> config is used.
> 
> This is required by the Armv8r64 architecture, which must be able to
> boot at S-EL1 for Linux but may need to boot at other ELs for other
> systems.
> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 6/6] doc: Add documentation for the Arm vexpress board configs

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 490 bytes --]

On Thu, Aug 19, 2021 at 04:53:14PM +0100, Peter Hoyes wrote:

> From: Peter Hoyes <Peter.Hoyes@arm.com>
> 
> Create a new documentation section for Arm Ltd boards with a sub-page
> for the vexpress board (FVP-A, FVP-R and Juno).
> 
> Document how the armv8_switch_to_el1 environment variable can be used
> to switch between booting from S-EL2/S-EL1 at runtime on the BASER_FVP.
> 
> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>

Applied to u-boot/next, thanks!

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Andre Przywara]

On Thu, 2 Sep 2021 18:42:05 -0400
Tom Rini <trini@konsulko.com> wrote:

Hi Tom,

> On Thu, Aug 19, 2021 at 04:53:13PM +0100, Peter Hoyes wrote:
> 
> > From: Peter Hoyes <Peter.Hoyes@arm.com>
> > 
> > Use the environment variable armv8_switch_to_el1 to determine whether
> > to switch to EL1 at runtime. This is an alternative to the
> > CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.
> > 
> > The environment variable will be ineffective if the ARMV8_MULTIENTRY
> > config is used.
> > 
> > This is required by the Armv8r64 architecture, which must be able to
> > boot at S-EL1 for Linux but may need to boot at other ELs for other
> > systems.
> > 
> > Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>  
> 
> Applied to u-boot/next, thanks!

Sorry for keeping silent on this, we had some internal discussions
here, and we don't think this is the right approach.

This whole CONFIG_ARMV8_SWITCH_TO_EL1 solution is actually already
questionable, as it goes somewhat against the PSCI spec, which requires
secondaries to enter in the highest non-secure exception level (Section
6.1.3: "... As described in Figure 6, the return Exception level for a
CPU_ON call is the highest Non secure Exception level implemented.")

In any case the primary core must enter an the same exception level as
the secondaries, or all hell breaks loose. The current code violates
this bluntly when the dynamic method is used (as the spin table code
doesn't know about this variable).

So can you please revert this patch? We are looking into a different
solution for getting into EL2, which wouldn't involve U-Boot at all.
The other patches and the next one are fine, however we would need one
small change in the next patch to live with this patch removed.
If you like, I can send an amended version of 6/6 to accommodate this.

Thanks!
Andre

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 1818 bytes --]

On Fri, Sep 03, 2021 at 12:07:20AM +0100, Andre Przywara wrote:
> On Thu, 2 Sep 2021 18:42:05 -0400
> Tom Rini <trini@konsulko.com> wrote:
> 
> Hi Tom,
> 
> > On Thu, Aug 19, 2021 at 04:53:13PM +0100, Peter Hoyes wrote:
> > 
> > > From: Peter Hoyes <Peter.Hoyes@arm.com>
> > > 
> > > Use the environment variable armv8_switch_to_el1 to determine whether
> > > to switch to EL1 at runtime. This is an alternative to the
> > > CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.
> > > 
> > > The environment variable will be ineffective if the ARMV8_MULTIENTRY
> > > config is used.
> > > 
> > > This is required by the Armv8r64 architecture, which must be able to
> > > boot at S-EL1 for Linux but may need to boot at other ELs for other
> > > systems.
> > > 
> > > Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>  
> > 
> > Applied to u-boot/next, thanks!
> 
> Sorry for keeping silent on this, we had some internal discussions
> here, and we don't think this is the right approach.

Well, oops on my part too.

> This whole CONFIG_ARMV8_SWITCH_TO_EL1 solution is actually already
> questionable, as it goes somewhat against the PSCI spec, which requires
> secondaries to enter in the highest non-secure exception level (Section
> 6.1.3: "... As described in Figure 6, the return Exception level for a
> CPU_ON call is the highest Non secure Exception level implemented.")
> 
> In any case the primary core must enter an the same exception level as
> the secondaries, or all hell breaks loose. The current code violates
> this bluntly when the dynamic method is used (as the spin table code
> doesn't know about this variable).
> 
> So can you please revert this patch? We are looking into a different

Should I undo just this, or the whole vexpress_aemv8r series?

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Peter Hoyes]

Hi,

On 03/09/2021 00:49, Tom Rini wrote:
> On Fri, Sep 03, 2021 at 12:07:20AM +0100, Andre Przywara wrote:
>> On Thu, 2 Sep 2021 18:42:05 -0400
>> Tom Rini <trini@konsulko.com> wrote:
>>
>> Hi Tom,
>>
>>> On Thu, Aug 19, 2021 at 04:53:13PM +0100, Peter Hoyes wrote:
>>>
>>>> From: Peter Hoyes <Peter.Hoyes@arm.com>
>>>>
>>>> Use the environment variable armv8_switch_to_el1 to determine whether
>>>> to switch to EL1 at runtime. This is an alternative to the
>>>> CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.
>>>>
>>>> The environment variable will be ineffective if the ARMV8_MULTIENTRY
>>>> config is used.
>>>>
>>>> This is required by the Armv8r64 architecture, which must be able to
>>>> boot at S-EL1 for Linux but may need to boot at other ELs for other
>>>> systems.
>>>>
>>>> Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
>>> Applied to u-boot/next, thanks!
>> Sorry for keeping silent on this, we had some internal discussions
>> here, and we don't think this is the right approach.
> Well, oops on my part too.
Oops here too.
>
>> This whole CONFIG_ARMV8_SWITCH_TO_EL1 solution is actually already
>> questionable, as it goes somewhat against the PSCI spec, which requires
>> secondaries to enter in the highest non-secure exception level (Section
>> 6.1.3: "... As described in Figure 6, the return Exception level for a
>> CPU_ON call is the highest Non secure Exception level implemented.")
>>
>> In any case the primary core must enter an the same exception level as
>> the secondaries, or all hell breaks loose. The current code violates
>> this bluntly when the dynamic method is used (as the spin table code
>> doesn't know about this variable).
>>
>> So can you please revert this patch? We are looking into a different
> Should I undo just this, or the whole vexpress_aemv8r series?
>
We are still discussing how to support v8-R internally and it'll probably
take a while to resolve.

Please can you revert the wholeseries apart from patch 1, which isn't
actually specific to the v8-R. (If preferable,I can submit a "v3" to
clarify this).

Peter
IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

Re: [PATCH v2 5/6] arm: Use armv8_switch_to_el1 env to switch to EL1

[Tom Rini]

[-- Attachment #1: Type: text/plain, Size: 2593 bytes --]

On Fri, Sep 03, 2021 at 11:19:28AM +0100, Peter Hoyes wrote:
> 
> Hi,
> 
> On 03/09/2021 00:49, Tom Rini wrote:
> > On Fri, Sep 03, 2021 at 12:07:20AM +0100, Andre Przywara wrote:
> > > On Thu, 2 Sep 2021 18:42:05 -0400
> > > Tom Rini <trini@konsulko.com> wrote:
> > > 
> > > Hi Tom,
> > > 
> > > > On Thu, Aug 19, 2021 at 04:53:13PM +0100, Peter Hoyes wrote:
> > > > 
> > > > > From: Peter Hoyes <Peter.Hoyes@arm.com>
> > > > > 
> > > > > Use the environment variable armv8_switch_to_el1 to determine whether
> > > > > to switch to EL1 at runtime. This is an alternative to the
> > > > > CONFIG_ARMV8_SWITCH_TO_EL1 compile-time option.
> > > > > 
> > > > > The environment variable will be ineffective if the ARMV8_MULTIENTRY
> > > > > config is used.
> > > > > 
> > > > > This is required by the Armv8r64 architecture, which must be able to
> > > > > boot at S-EL1 for Linux but may need to boot at other ELs for other
> > > > > systems.
> > > > > 
> > > > > Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com>
> > > > Applied to u-boot/next, thanks!
> > > Sorry for keeping silent on this, we had some internal discussions
> > > here, and we don't think this is the right approach.
> > Well, oops on my part too.
> Oops here too.
> > 
> > > This whole CONFIG_ARMV8_SWITCH_TO_EL1 solution is actually already
> > > questionable, as it goes somewhat against the PSCI spec, which requires
> > > secondaries to enter in the highest non-secure exception level (Section
> > > 6.1.3: "... As described in Figure 6, the return Exception level for a
> > > CPU_ON call is the highest Non secure Exception level implemented.")
> > > 
> > > In any case the primary core must enter an the same exception level as
> > > the secondaries, or all hell breaks loose. The current code violates
> > > this bluntly when the dynamic method is used (as the spin table code
> > > doesn't know about this variable).
> > > 
> > > So can you please revert this patch? We are looking into a different
> > Should I undo just this, or the whole vexpress_aemv8r series?
> > 
> We are still discussing how to support v8-R internally and it'll probably
> take a while to resolve.
> 
> Please can you revert the wholeseries apart from patch 1, which isn't
> actually specific to the v8-R. (If preferable,I can submit a "v3" to
> clarify this).

OK, I'll revert everything except the first patch.  For the next
go-round, I had fixed up that the defconfig wasn't listed in the board
MAINTAINERS, and there was a typo in the docs that checkpatch also
spotted.

-- 
Tom

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]