From: Peter Hoyes Peter.Hoyes@arm.com

The use of ARMv8.3 pointer authentication (PAuth) is governed by fields in HCR_EL2, which trigger a 'trap to EL2' if not enabled. The reset value of these fields is 'architecturally unknown' so we must ensure that the fields are enabled (to disable the traps) if we are entering the kernel at EL1.

The APK field disables PAuth instruction traps and the API field disables PAuth register traps

Add code to disable the traps in armv8_switch_to_el1_m. Prior to doing so, it checks fields in the ID_AA64ISAR1_EL1 register to ensure pointer authentication is supported by the hardware.

The runtime checks require a second temporary register, so add this to the EL1 transition macro signature and update 2 call sites.

Signed-off-by: Peter Hoyes Peter.Hoyes@arm.com --- arch/arm/cpu/armv8/fsl-layerscape/spintable.S | 2 +- arch/arm/cpu/armv8/transition.S | 2 +- arch/arm/include/asm/macro.h | 11 +++++++++-- arch/arm/include/asm/system.h | 15 +++++++++++++++ 4 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S index 363ded03e6..d6bd188459 100644 --- a/arch/arm/cpu/armv8/fsl-layerscape/spintable.S +++ b/arch/arm/cpu/armv8/fsl-layerscape/spintable.S @@ -93,7 +93,7 @@ __secondary_boot_func: 4: #ifdef CONFIG_ARMV8_SWITCH_TO_EL1 switch_el x7, _dead_loop, 0f, _dead_loop -0: armv8_switch_to_el1_m x4, x6, x7 +0: armv8_switch_to_el1_m x4, x6, x7, x9 #else switch_el x7, 0f, _dead_loop, _dead_loop 0: armv8_switch_to_el2_m x4, x6, x7 diff --git a/arch/arm/cpu/armv8/transition.S b/arch/arm/cpu/armv8/transition.S index a31af4ffc8..9dbdff3a4f 100644 --- a/arch/arm/cpu/armv8/transition.S +++ b/arch/arm/cpu/armv8/transition.S @@ -40,7 +40,7 @@ ENTRY(armv8_switch_to_el1) * now, jump to the address saved in x4. */ br x4 -1: armv8_switch_to_el1_m x4, x5, x6 +1: armv8_switch_to_el1_m x4, x5, x6, x7 ENDPROC(armv8_switch_to_el1) .popsection

diff --git a/arch/arm/include/asm/macro.h b/arch/arm/include/asm/macro.h index 485310d660..e1eefc283f 100644 --- a/arch/arm/include/asm/macro.h +++ b/arch/arm/include/asm/macro.h @@ -256,7 +256,7 @@ lr .req x30 * For loading 64-bit OS, x0 is physical address to the FDT blob. * They will be passed to the guest. */ -.macro armv8_switch_to_el1_m, ep, flag, tmp +.macro armv8_switch_to_el1_m, ep, flag, tmp, tmp2 /* Initialize Generic Timers */ mrs \tmp, cnthctl_el2 /* Enable EL1 access to timers */ @@ -306,7 +306,14 @@ lr .req x30 b.eq 1f

/* Initialize HCR_EL2 */ - ldr \tmp, =(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS) + /* Only disable PAuth traps if PAuth is supported */ + mrs \tmp, id_aa64isar1_el1 + ldr \tmp2, =(ID_AA64ISAR1_EL1_GPI | ID_AA64ISAR1_EL1_GPA | \ + ID_AA64ISAR1_EL1_API | ID_AA64ISAR1_EL1_APA) + tst \tmp, \tmp2 + mov \tmp2, #(HCR_EL2_RW_AARCH64 | HCR_EL2_HCD_DIS) + orr \tmp, \tmp2, #(HCR_EL2_APK | HCR_EL2_API) + csel \tmp, \tmp2, \tmp, eq msr hcr_el2, \tmp

/* Return to the EL1_SP1 mode from EL2 */ diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h index 8b3a54e64c..77aa18909e 100644 --- a/arch/arm/include/asm/system.h +++ b/arch/arm/include/asm/system.h @@ -75,10 +75,25 @@ /* * HCR_EL2 bits definitions */ +#define HCR_EL2_API (1 << 41) /* Trap pointer authentication + instructions */ +#define HCR_EL2_APK (1 << 40) /* Trap pointer authentication + key access */ #define HCR_EL2_RW_AARCH64 (1 << 31) /* EL1 is AArch64 */ #define HCR_EL2_RW_AARCH32 (0 << 31) /* Lower levels are AArch32 */ #define HCR_EL2_HCD_DIS (1 << 29) /* Hypervisor Call disabled */

+/* + * ID_AA64ISAR1_EL1 bits definitions + */ +#define ID_AA64ISAR1_EL1_GPI (0xF << 28) /* Implementation-defined generic + code auth algorithm */ +#define ID_AA64ISAR1_EL1_GPA (0xF << 24) /* QARMA generic code auth + algorithm */ +#define ID_AA64ISAR1_EL1_API (0xF << 8) /* Implementation-defined address + auth algorithm */ +#define ID_AA64ISAR1_EL1_APA (0xF << 4) /* QARMA address auth algorithm */ + /* * ID_AA64PFR0_EL1 bits definitions */

From: Peter Hoyes Peter.Hoyes@arm.com

On Armv8-R, the EL1&0 memory system architecture is configurable as a VMSA or PMSA, and resets to an "architecturally unknown" value.

Add code to armv8_switch_to_el1_m which detects whether the MSA at EL1&0 is configurable using the id_aa64mmfr0_el1 register MSA fields. If it is we must ensure the VMSA is enabled so that a rich OS can boot.

The MSA and MSA_FRAC fields are described in the Armv8-R architecture profile supplement (section G1.3.7): https://developer.arm.com/documentation/ddi0600/latest/

Signed-off-by: Peter Hoyes Peter.Hoyes@arm.com --- arch/arm/include/asm/macro.h | 17 +++++++++++++++++ arch/arm/include/asm/system.h | 24 ++++++++++++++++++++++++ 2 files changed, 41 insertions(+)

diff --git a/arch/arm/include/asm/macro.h b/arch/arm/include/asm/macro.h index e1eefc283f..ecd8221c0d 100644 --- a/arch/arm/include/asm/macro.h +++ b/arch/arm/include/asm/macro.h @@ -316,6 +316,23 @@ lr .req x30 csel \tmp, \tmp2, \tmp, eq msr hcr_el2, \tmp

+ /* + * Detect whether the system has a configurable memory system + * architecture at EL1&0 + */ + mrs \tmp, id_aa64mmfr0_el1 + lsr \tmp, \tmp, #48 + and \tmp, \tmp, #((ID_AA64MMFR0_EL1_MSA_MASK | \ + ID_AA64MMFR0_EL1_MSA_FRAC_MASK) >> 48) + cmp \tmp, #((ID_AA64MMFR0_EL1_MSA_USE_FRAC | \ + ID_AA64MMFR0_EL1_MSA_FRAC_VMSA) >> 48) + bne 2f + + /* Ensure the EL1&0 VMSA is enabled */ + mov \tmp, #(VTCR_EL2_MSA) + msr vtcr_el2, \tmp +2: + /* Return to the EL1_SP1 mode from EL2 */ ldr \tmp, =(SPSR_EL_DEBUG_MASK | SPSR_EL_SERR_MASK |\ SPSR_EL_IRQ_MASK | SPSR_EL_FIQ_MASK |\ diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h index 77aa18909e..e4c11e830a 100644 --- a/arch/arm/include/asm/system.h +++ b/arch/arm/include/asm/system.h @@ -83,6 +83,30 @@ #define HCR_EL2_RW_AARCH32 (0 << 31) /* Lower levels are AArch32 */ #define HCR_EL2_HCD_DIS (1 << 29) /* Hypervisor Call disabled */

+/* + * VTCR_EL2 bits definitions + */ +#define VTCR_EL2_MSA (1 << 31) /* EL1&0 memory architecture */ + +/* + * ID_AA64MMFR0_EL1 bits definitions + */ +#define ID_AA64MMFR0_EL1_MSA_FRAC_MASK (0xFUL << 52) /* Memory system + architecture + frac */ +#define ID_AA64MMFR0_EL1_MSA_FRAC_VMSA (0x2UL << 52) /* EL1&0 supports + VMSA */ +#define ID_AA64MMFR0_EL1_MSA_FRAC_PMSA (0x1UL << 52) /* EL1&0 only + supports PMSA*/ +#define ID_AA64MMFR0_EL1_MSA_FRAC_NO_PMSA (0x0UL << 52) /* No PMSA + support */ +#define ID_AA64MMFR0_EL1_MSA_MASK (0xFUL << 48) /* Memory system + architecture */ +#define ID_AA64MMFR0_EL1_MSA_USE_FRAC (0xFUL << 48) /* Use MSA_FRAC */ +#define ID_AA64MMFR0_EL1_MSA_VMSA (0x0UL << 48) /* Memory system + architecture + is VMSA */ + /* * ID_AA64ISAR1_EL1 bits definitions */

From: Peter Hoyes Peter.Hoyes@arm.com

Armv8r64 is the first Armv8 platform that only has a PMSA at the current exception level. The architecture supplement for Armv8r64 describes new fields in ID_AA64MMFR0_EL1 which can be used to detect whether a VMSA or PMSA is present. These fields are RES0 on Armv8a.

Add logic to read these fields and, for the protection of the memory used by U-Boot, initialize the MPU instead of the MMU during init, then clear the MPU regions before transition to the next stage.

Provide a default (blank) MPU memory map, which can be overridden by board configurations.

Signed-off-by: Peter Hoyes Peter.Hoyes@arm.com --- arch/arm/cpu/armv8/cache_v8.c | 96 +++++++++++++++++++++++++++++++- arch/arm/include/asm/armv8/mpu.h | 61 ++++++++++++++++++++ 2 files changed, 154 insertions(+), 3 deletions(-) create mode 100644 arch/arm/include/asm/armv8/mpu.h

diff --git a/arch/arm/cpu/armv8/cache_v8.c b/arch/arm/cpu/armv8/cache_v8.c index 3de18c7675..46625675bd 100644 --- a/arch/arm/cpu/armv8/cache_v8.c +++ b/arch/arm/cpu/armv8/cache_v8.c @@ -15,6 +15,7 @@ #include <asm/global_data.h> #include <asm/system.h> #include <asm/armv8/mmu.h> +#include <asm/armv8/mpu.h>

DECLARE_GLOBAL_DATA_PTR;

@@ -365,6 +366,86 @@ __weak u64 get_page_table_size(void) return size; }

+static void mpu_clear_regions(void) +{ + int i; + + for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) { + setup_el2_mpu_region(i, 0, 0); + } +} + +static struct mpu_region default_mpu_mem_map[] = {{0,}}; +__weak struct mpu_region *mpu_mem_map = default_mpu_mem_map; + +static void mpu_setup(void) +{ + int i; + + if (current_el() != 2) { + panic("MPU configuration is only supported at EL2"); + } + + set_sctlr(get_sctlr() & ~(CR_M | CR_WXN)); + + asm volatile("msr MAIR_EL2, %0" : : "r" MEMORY_ATTRIBUTES); + + for (i = 0; mpu_mem_map[i].end || mpu_mem_map[i].attrs; i++) { + setup_el2_mpu_region(i, + PRBAR_ADDRESS(mpu_mem_map[i].start) + | PRBAR_OUTER_SH | PRBAR_AP_RW_ANY, + PRLAR_ADDRESS(mpu_mem_map[i].end) + | mpu_mem_map[i].attrs | PRLAR_EN_BIT + ); + } + + set_sctlr(get_sctlr() | CR_M); +} + +static bool el_has_mmu(void) +{ + uint64_t id_aa64mmfr0; + asm volatile("mrs %0, id_aa64mmfr0_el1" + : "=r" (id_aa64mmfr0) : : "cc"); + uint64_t msa = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_MASK; + uint64_t msa_frac = id_aa64mmfr0 & ID_AA64MMFR0_EL1_MSA_FRAC_MASK; + + switch (msa) { + case ID_AA64MMFR0_EL1_MSA_VMSA: + /* + * VMSA supported in all translation regimes. + * No support for PMSA. + */ + return true; + case ID_AA64MMFR0_EL1_MSA_USE_FRAC: + /* See MSA_frac for the supported MSAs. */ + switch (msa_frac) { + case ID_AA64MMFR0_EL1_MSA_FRAC_NO_PMSA: + /* + * PMSA not supported in any translation + * regime. + */ + return true; + case ID_AA64MMFR0_EL1_MSA_FRAC_VMSA: + /* + * PMSA supported in all translation + * regimes. No support for VMSA. + */ + case ID_AA64MMFR0_EL1_MSA_FRAC_PMSA: + /* + * PMSA supported in all translation + * regimes. + */ + return false; + default: + panic("Unsupported id_aa64mmfr0_el1 " \ + "MSA_frac value"); + } + default: + panic("Unsupported id_aa64mmfr0_el1 MSA value"); + } +} + void setup_pgtables(void) { int i; @@ -479,8 +560,13 @@ void dcache_enable(void) /* The data cache is not active unless the mmu is enabled */ if (!(get_sctlr() & CR_M)) { invalidate_dcache_all(); - __asm_invalidate_tlb_all(); - mmu_setup(); + + if (el_has_mmu()) { + __asm_invalidate_tlb_all(); + mmu_setup(); + } else { + mpu_setup(); + } }

set_sctlr(get_sctlr() | CR_C); @@ -499,7 +585,11 @@ void dcache_disable(void) set_sctlr(sctlr & ~(CR_C|CR_M));

flush_dcache_all(); - __asm_invalidate_tlb_all(); + + if (el_has_mmu()) + __asm_invalidate_tlb_all(); + else + mpu_clear_regions(); }

int dcache_status(void) diff --git a/arch/arm/include/asm/armv8/mpu.h b/arch/arm/include/asm/armv8/mpu.h new file mode 100644 index 0000000000..c6c8828325 --- /dev/null +++ b/arch/arm/include/asm/armv8/mpu.h @@ -0,0 +1,61 @@ +/* + * SPDX-License-Identifier: GPL-2.0+ + * + * (C) Copyright 2021 Arm Limited + */ + +#ifndef _ASM_ARMV8_MPU_H_ +#define _ASM_ARMV8_MPU_H_ + +#include <asm/armv8/mmu.h> +#include <asm/barriers.h> +#include <linux/stringify.h> + +#define PRSELR_EL2 S3_4_c6_c2_1 +#define PRBAR_EL2 S3_4_c6_c8_0 +#define PRLAR_EL2 S3_4_c6_c8_1 +#define MPUIR_EL2 S3_4_c0_c0_4 + +#define PRBAR_ADDRESS(addr) ((addr) & ~(0x3fULL)) + +/* Access permissions */ +#define PRBAR_AP(val) (((val) & 0x3) << 2) +#define PRBAR_AP_RW_HYP PRBAR_AP(0x0) +#define PRBAR_AP_RW_ANY PRBAR_AP(0x1) +#define PRBAR_AP_RO_HYP PRBAR_AP(0x2) +#define PRBAR_AP_RO_ANY PRBAR_AP(0x3) + +/* Shareability */ +#define PRBAR_SH(val) (((val) & 0x3) << 4) +#define PRBAR_NON_SH PRBAR_SH(0x0) +#define PRBAR_OUTER_SH PRBAR_SH(0x2) +#define PRBAR_INNER_SH PRBAR_SH(0x3) + +/* Memory attribute (MAIR idx) */ +#define PRLAR_ATTRIDX(val) (((val) & 0x7) << 1) +#define PRLAR_EN_BIT (0x1) +#define PRLAR_ADDRESS(addr) ((addr) & ~(0x3fULL)) + +#ifndef __ASSEMBLY__ + +static inline void setup_el2_mpu_region(uint8_t region, uint64_t base, uint64_t limit) +{ + asm volatile("msr " __stringify(PRSELR_EL2) ", %0" : : "r" (region)); + isb(); + asm volatile("msr " __stringify(PRBAR_EL2) ", %0" : : "r" (base)); + asm volatile("msr " __stringify(PRLAR_EL2) ", %0" : : "r" (limit)); + dsb(); + isb(); +} + +#endif + +struct mpu_region { + u64 start; + u64 end; + u64 attrs; +}; + +extern struct mpu_region *mpu_mem_map; + +#endif /* _ASM_ARMV8_MPU_H_ */

From: Peter Hoyes Peter.Hoyes@arm.com

Create a new documentation section for Arm Ltd boards with a sub-page for the vexpress board (FVP-A, FVP-R and Juno).

Document how the armv8_switch_to_el1 environment variable can be used to switch between booting from S-EL2/S-EL1 at runtime on the BASER_FVP.

Signed-off-by: Peter Hoyes Peter.Hoyes@arm.com --- doc/arch/arm64.rst | 3 +- doc/board/armltd/index.rst | 9 ++++++ doc/board/armltd/vexpress64.rst | 57 +++++++++++++++++++++++++++++++++ doc/board/index.rst | 1 + 4 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 doc/board/armltd/index.rst create mode 100644 doc/board/armltd/vexpress64.rst

diff --git a/doc/arch/arm64.rst b/doc/arch/arm64.rst index 80498f6f6b..f20eb8f1b2 100644 --- a/doc/arch/arm64.rst +++ b/doc/arch/arm64.rst @@ -18,7 +18,8 @@ Notes classical firmware (like initial hardware setup, CPU errata workarounds or SMP bringup). U-Boot can be entered in EL2 when its main purpose is that of a boot loader. It can drop to lower exception levels before - entering the OS. + entering the OS. For ARMv8-R it is recommened to enter at S-EL2, as for this + architecture there is no S-EL3.

2. U-Boot for arm64 is compiled with AArch64-gcc. AArch64-gcc use rela relocation format, a tool(tools/relocate-rela) by Scott Wood diff --git a/doc/board/armltd/index.rst b/doc/board/armltd/index.rst new file mode 100644 index 0000000000..b6786c114f --- /dev/null +++ b/doc/board/armltd/index.rst @@ -0,0 +1,9 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +Arm Ltd +============= + +.. toctree:: + :maxdepth: 2 + + vexpress64.rst diff --git a/doc/board/armltd/vexpress64.rst b/doc/board/armltd/vexpress64.rst new file mode 100644 index 0000000000..23cf6aec88 --- /dev/null +++ b/doc/board/armltd/vexpress64.rst @@ -0,0 +1,57 @@ +.. SPDX-License-Identifier: GPL-2.0+ + +Arm Versatile Express +===================== + +The vexpress_* board configuration supports the following platforms: + + * FVP_Base_RevC-2xAEMvA + * FVP_BaseR_AEMv8R + * Juno development board + +Fixed Virtual Platforms +----------------------- + +The Fixed Virtual Platforms (FVP) are complete simulations of an Arm system, +including processor, memory and peripherals. They are set out in a "programmer's +view", which gives a comprehensive model on which to build and test software. + +The supported FVPs are available free of charge and can be downloaded from the +Arm developer site [1]_ (user registration might be required). + +Supported features: + + * GICv3 + * Generic timer + * PL011 UART + * SMC91111 network interface + +The default configuration assumes that U-Boot is boostrapped from the start of +the DRAM (address 0x80000000 for AEMvA; 0x00000000 for AEMv8R) using a suitable +bootloader. Alternatively, U-Boot can be launched directly by mapping the binary +to the same address (using the FVP's --data argument). + +The FVPs can be debugged using Arm Development Studio [2]_. + +FVP_BaseR +^^^^^^^^^ + +On Armv8r64 platforms (such as the FVP_BaseR), U-Boot runs at S-EL2, so +CONFIG_ARMV8_SWITCH_TO_EL1 is defined so that the next stage boots at S-EL1. If +S-EL2 is desired instead, the *armv8_switch_to_el1* environment variable is +available. This can be set to *n* to override the config flag and boot the next +stage at S-EL2 instead. + +Juno +---- + +The Juno development board is an open, vendor-neutral Armv8-A development +platform that supports an out-of-the-box Linux software package. A range of +plug-in expansion options enables hardware and software applications to be +developped and debugged. + +References +---------- + +.. [1] https://developer.arm.com/tools-and-software/simulation-models/fixed-virtual... +.. [2] https://developer.arm.com/tools-and-software/embedded/arm-development-studio diff --git a/doc/board/index.rst b/doc/board/index.rst index 9e90978891..cd4f273b4d 100644 --- a/doc/board/index.rst +++ b/doc/board/index.rst @@ -10,6 +10,7 @@ Board-specific doc advantech/index AndesTech/index amlogic/index + armltd/index atmel/index congatec/index coreboot/index