Hi,
in this PR, I propose a first change to the SPMD to better support Kinibi, the TEE from Trustonic.
https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/10235
The idea here is to pass the core linear id in the x3 register in the boot of secondary cores.
In the past, the Kinibi SPD was not public and so some requirements to TF-A were not visible to the wider community.
For Kinibi, one binary should run on a multitude of platforms.
For that reason, many platform-specific settings are shared by TF-A with Kinibi: at boot, in registers and in a boot datastructure, and at runtime.
In the line of work of making Kinibi compatible with FFA APIs, I moved some bits from the Kinibi SPD to the SPMD.
Instead of sharing such patches only with our customers, we would like to upstream the patches to the generic code.
For this particular patch, it is really simple and changes the interface SPMD-to-SPMC in a somewhat adhoc manner.
There is some discussion within ARM to standardize such behavior and to propose configuration options, i.e. within a manifest.
That way, you could change what register the linear id, if at all, should be transferred in.
A first tour of the CI showed that there seem to be no consequences to hafnium and optee.
I guess, question to the mailing list, is there something that this patch breaks?
Greetings,
Lukas
Trustonic SAS - 535 route de Lucioles, Les Aqueducs Batiment 2, Sophia Antipolis 06560 Valbonne, France - SAS au capital de 3 038 000EUR - RCS Grasse - SIRET 480 011 998 00055 - TVA intracommunautaire : FR02 480 011 998
Hi,
Can you try below steps, try with fresh pull?
1. Login with your github account on https://review.trustedfirmware.org/admin/repos/TF-A%2Ftrusted-firmware-a
2.
git clone "ssh://<user>@review.trustedfirmware.org:29418/TF-A/trusted-firmware-a
3. git push <remote-name> HEAD:refs/for/integration
4. While pushing if it complains about git hooks, run scp -p -P 29418 <user>@review.trustedfirmware.org:hooks/commit-msg "trusted-firmware-a/.git/hooks/" and amend your commit (it will give you this hint)
________________________________
From: TF-A <tf-a-bounces(a)lists.trustedfirmware.org> on behalf of Nicolas Boulenguez via TF-A <tf-a(a)lists.trustedfirmware.org>
Sent: 03 April 2021 13:02
To: raghu.ncstate(a)icloud.com <raghu.ncstate(a)icloud.com>
Cc: tf-a(a)lists.trustedfirmware.org <tf-a(a)lists.trustedfirmware.org>; 'Benjamin Copeland' <ben.copeland(a)linaro.org>
Subject: Re: [TF-A] please fix incomplete distclean Makefile target
raghu.ncstate(a)icloud.com:
> Are you pushing ssh://<username>@review.trustedfirmware.org:29418/TF-A/trusted-firmware-a HEAD:refs/for/integration?
> Note that 29418 port. That tripped me up initially. It is not clear from your earlier emails where you cloned from(review.trustedfirmware.org or git.trustedfirmware.org).
[α] links to [β] which recommends
# git clone "https://review.trustedfirmware.org/TF-A/trusted-firmware-a"
I had an existing repository (most contributors probably do) and used
'git add remote' and 'git fetch' instead.
[α] recommends
# git push <remote-name> HEAD:refs/for/integration%<topic-branch>
As expected, the host requires a password.
# git push ssh://<user>@review.trustedfirmware.org:29418/TF-A/trusted-firmware-a HEAD:refs/for/integration?
-> fatal: invalid refspec 'HEAD:refs/for/integration?'
Anyhow, the host would require an SSH key.
[α] https://developer.trustedfirmware.org/w/tf_a/gerrit-getting-started/
[β] https://review.trustedfirmware.org/admin/repos/TF-A%2Ftrusted-firmware-a
--
TF-A mailing list
TF-A(a)lists.trustedfirmware.org
https://lists.trustedfirmware.org/mailman/listinfo/tf-a
HI Hiren,
Can you please add more color to “even if I provide large enough string to hold the number, it does not print it”?
Are you saying that the library prints a partial value? If the calculation is off by 1, I assume, the library should at least print a partial value.
-Varun
From: TF-A <tf-a-bounces(a)lists.trustedfirmware.org> On Behalf Of Hiren Mehta via TF-A
Sent: Saturday, May 29, 2021 9:41 AM
To: tf-a(a)lists.trustedfirmware.org
Subject: [TF-A] issue with vsnprintf() and unsigned_num_print()
External email: Use caution opening links or attachments
Hi All,
We are using the snprintf() (which uses vsnprintf() and unsigned_num_print()) from libc of ATF version 2.4
and running into an issue for printing a number into a string where even if I provide large enough string to hold the
number, it does not print it. I don't see that issue with it when I try to print a string using the same snprintf().
I understand that, as per the documentation use of snprintf is "banned or discouraged". But for the use case,
that we are using for, it is safe enough to use it assuming that it does it what it is supposed to do.
I am not sure if this is a known bug or what, but upon a further inspection, I found that there seems be a small bug
in the unsigned_num_print() for one of the 'if' condition given below which is causing the issue in terms of calculating
the available space in the string.
if (*chars_printed < n) {
.... do the prinring....
}
I believe it is supposed to be
if (*chars_printed <= n) { ----------------->> Notice '<=' instead of '<'
}
Any comment on whether this is on purpose or really a small bug?
The calling routine (vsnprintf) is already reducing 'n' by 1 for the terminating null character.
Thank you very much for your support.
-hiren
Hi
food for thought for tomorrow's call:
Passing information on what is plugged into the DIMM slots may not be as
straightforward as it sounds. You can plug pure DRAM, NVDIMMs or pure flash
(from Diablo technologies, acquired by RAMBus in 2019). The pure flash is a
module where there is a few MB as bounce buffers to flash located on the
DIMM itself. The largest element was 1TB on a single DIMM.
So passing a C structure that details the size of the DIMM fails to fully
describe NVDIMM and Flash on DIMM. Those two things required complex
Passing a DT fragment that describes the plugged module is generic and can
describe both the bounce buffers and the registers needed to access the
flash on DIMM. In the future you may find associative memory or whatever AI
based modules.
Bottom line, using DT fragment to describe memory is flexible for the three
existing cases and future proof.
The document shows that for a 2 DIMM representation and associated SPDs,
the additional cost is 88 bytes. 32 are fixed cost, 56 are somewhat name
size dependent and some related to FDT format.
There is no need for a full libfdt to actually produce that serialized data
on a hob.
So in my view, the benefit of having an alignment, version and evolution
proof structure that comes with DT fragment by far exceeds the cost of a
few bytes saved, even in the context of SRAM size.
Cheers
FF
On Wed, 2 Jun 2021 at 17:33, Joanna Farley via TF-A <
tf-a(a)lists.trustedfirmware.org> wrote:
> Hi All,
>
>
>
> The next TF-A Tech Forum is scheduled for Thu 3rd June 2021 16:00 – 17:00
> (BST).
>
>
>
> Agenda:
>
> - Discussion Session: Static and Dynamic Information Handling in TF-A
> (Session 2)
> - Lead by Manish Pandy and Madhukar Pappireddy
> - On tech forum this week, we would like to continue discussions on
> HOB list design.
> - The topics which we would like to cover is
> 1. Evaluate different proposals of passing information through
> boot phases.
> 2. If we don't get an agreement on one solution fit for all then
> we would try to get consensus for Infra segment platform(to solve original
> problem mentioned by Harb)
> 3. Try to get an agreement on size of tags and how "hybrid and
> tag only" HOB list can co-exist together?
>
>
>
>
>
> Thanks
>
>
>
> Joanna
>
>
>
>
> *You have been invited to the following event.* TF-A Tech Forum
>
> *more details »
> <https://www.google.com/calendar/event?action=VIEW&eid=NWlub3Ewdm1tMmk1cTJrM…>*
>
>
>
> We run an open technical forum call for anyone to participate and it is
> not restricted to Trusted Firmware project members. It will operate under
> the guidance of the TF TSC.
>
>
>
> Feel free to forward this invite to colleagues. Invites are via the TF-A
> mailing list and also published on the Trusted Firmware website. Details
> are here: https://www.trustedfirmware.org/meetings/tf-a-technical-forum/
> <https://www.google.com/url?q=https%3A%2F%2Fwww.trustedfirmware.org%2Fmeetin…>
>
>
>
> Trusted Firmware is inviting you to a scheduled Zoom meeting.
>
>
>
> Join Zoom Meeting
>
> https://zoom.us/j/9159704974
> <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fj%2F9159704974&sa=D&us…>
>
>
>
> Meeting ID: 915 970 4974
>
>
>
> One tap mobile
>
> +16465588656,,9159704974# US (New York)
>
> +16699009128,,9159704974# US (San Jose)
>
>
>
> Dial by your location
>
> +1 646 558 8656 US (New York)
>
> When
>
> Every 2 weeks from 16:00 to 17:00 on Thursday United Kingdom Time
>
> Calendar
>
> tf-a(a)lists.trustedfirmware.org
>
> Who
>
> •
>
> Bill Fletcher- creator
>
> •
>
> tf-a(a)lists.trustedfirmware.org
>
> +1 669 900 9128 US (San Jose)
>
> 877 853 5247 US Toll-free
>
> 888 788 0099 US Toll-free
>
> Meeting ID: 915 970 4974
>
> Find your local number: https://zoom.us/u/ad27hc6t7h
> <https://www.google.com/url?q=https%3A%2F%2Fzoom.us%2Fu%2Fad27hc6t7h&sa=D&us…>
>
>
>
>
> Going (tf-a(a)lists.trustedfirmware.org)? All events in this series: *
> Yes
> <https://www.google.com/calendar/event?action=RESPOND&eid=NWlub3Ewdm1tMmk1cT…>**
> - **Maybe
> <https://www.google.com/calendar/event?action=RESPOND&eid=NWlub3Ewdm1tMmk1cT…>**
> - **No
> <https://www.google.com/calendar/event?action=RESPOND&eid=NWlub3Ewdm1tMmk1cT…>*
> more options »
> <https://www.google.com/calendar/event?action=VIEW&eid=NWlub3Ewdm1tMmk1cTJrM…>
>
> Invitation from Google Calendar <https://www.google.com/calendar/>
>
> You are receiving this courtesy email at the account
> tf-a(a)lists.trustedfirmware.org because you are an attendee of this event.
>
> To stop receiving future updates for this event, decline this event.
> Alternatively, you can sign up for a Google Account at
> https://www.google.com/calendar/ and control your notification settings
> for your entire calendar.
>
> Forwarding this invitation could allow any recipient to send a response to
> the organiser and be added to the guest list, invite others regardless of
> their own invitation status or to modify your RSVP. Learn more
> <https://support.google.com/calendar/answer/37135#forwarding>.
>
>
> --
> TF-A mailing list
> TF-A(a)lists.trustedfirmware.org
> https://lists.trustedfirmware.org/mailman/listinfo/tf-a
>
--
François-Frédéric Ozog | *Director Linaro Edge & Fog Computing Group*
T: +33.67221.6485
francois.ozog(a)linaro.org | Skype: ffozog
On Tue, 01 Jun 2021 14:34:05 +0100,
Dongjiu Geng <gengdongjiu1(a)gmail.com> wrote:
>
> Marc Zyngier <maz(a)kernel.org> 于2021年6月1日周二 下午6:09写道：
> >
> > On Tue, 01 Jun 2021 10:53:49 +0100,
> > Dongjiu Geng <gengdongjiu1(a)gmail.com> wrote:
> > >
> > > Mark Rutland <mark.rutland(a)arm.com> 于2021年6月1日周二 下午5:19写道：
> > > >
> > > > On Fri, May 28, 2021 at 05:26:51PM +0800, Dongjiu Geng wrote:
> > > > > Hi All,
> > > > > when Linux kernel boot from EL1, there is no method to let
> > > > > kernel to enter EL2 to enable hypervisor. so I want to add an SMC
> > > > > interface between kernel and EL3 ATF to let kernel can set the
> > > > > hypervisor vector table, then can enter EL2 to enable hypervisor, as
> > > > > shown in [1].
> > > > > Do you agree? Otherwise there is no method to enter EL2 hypervisor
> > > > > when kernel boot from EL1, because the hypervisor vector
> > > > > table(vbar_el2) is unknown.
> > > >
> > > > The kernel already supported being booted at EL2, where it will install
> > > > itself as the hypervisor (and will drop to EL1 if required). EL2 is the
> > > > preferred boot mode, as we document in:
> > > >
> > > > https://www.kernel.org/doc/html/latest/arm64/booting.html
> > > >
> > > > ... where we say:
> > > >
> > > > | The CPU must be in either EL2 (RECOMMENDED in order to have access to
> > > > | the virtualisation extensions) or non-secure EL1.
> > > >
> > > > We *strongly* prefer this over adding new ABIs to transition from EL1 to
> > > > EL2. Please boot the kernel at EL2 if you want to use KVM.
> > >
> > > Thanks for the answer.
> > > If use KVM, it should boot from EL2. But if the hypervisor is not
> > > KVM, such as Jailhouse hypervisor and some Chip manufacturer boot the
> > > host kernel from EL1(not follow above rule), it seems there is not way
> > > to enter the Jailhouse hypervisor.
> >
> > We only deal with two cases:
> > - either the kernel uses its own, built-in hypervisor: it boots at
> > EL2, and installs itself.
> >
> > - or there is a pre-existing hypervisor, and the kernel boots at EL1.
> >
> > In the past, Jailhouse used the exact same entry points as KVM. What
> > has changed?
>
> Jailhouse use the __hyp_stub_vectors vector table[1] in linux
> kernel arch/arm64/kernel/hyp-stub.S to re-set his own's hypervisor
> vector table, but if linux kernel is boot from EL1，it can not use the
> entry points(__hyp_stub_vectors). I agree Linux kernel is recommended
> boot from EL2, but some custer's boards not follow this rule.
So Jailhouse doesn't have this problem when used as intended.
>
> [1]:
> ENTRY(__hyp_stub_vectors)
> ventry el2_sync_invalid // Synchronous EL2t
> ventry el2_irq_invalid // IRQ EL2t
> ventry el2_fiq_invalid // FIQ EL2t
> ventry el2_error_invalid // Error EL2t
>
> ventry el2_sync_invalid // Synchronous EL2h
> ventry el2_irq_invalid // IRQ EL2h
> ventry el2_fiq_invalid // FIQ EL2h
> ventry el2_error_invalid // Error EL2h
>
> ventry el1_sync // Synchronous 64-bit EL1
> ventry el1_irq_invalid // IRQ 64-bit EL1
> ventry el1_fiq_invalid // FIQ 64-bit EL1
> ventry el1_error_invalid // Error 64-bit EL1
>
> ventry el1_sync_invalid // Synchronous 32-bit EL1
> ventry el1_irq_invalid // IRQ 32-bit EL1
> ventry el1_fiq_invalid // FIQ 32-bit EL1
> ventry el1_error_invalid // Error 32-bit EL1
> ENDPROC(__hyp_stub_vectors)
>
> >
> > Finally, if you can change the firmware to install the EL2 vectors,
> > you can also change it to enter the kernel at EL2. I suggest you do
> > that instead.
>
> I agree with you, but needs to change customer‘s board, I will try to
> discuess with customer.
In both cases, you'll need to change your customer's firmware.
It seems to me that there is no reason for the arm64 boot protocol to
change and adopt weird, wonderful and proprietary privilege escalation
methods.
Thanks,
M.
--
Without deviation from the norm, progress is not possible.
On Tue, 01 Jun 2021 10:53:49 +0100,
Dongjiu Geng <gengdongjiu1(a)gmail.com> wrote:
>
> Mark Rutland <mark.rutland(a)arm.com> 于2021年6月1日周二 下午5:19写道：
> >
> > On Fri, May 28, 2021 at 05:26:51PM +0800, Dongjiu Geng wrote:
> > > Hi All,
> > > when Linux kernel boot from EL1, there is no method to let
> > > kernel to enter EL2 to enable hypervisor. so I want to add an SMC
> > > interface between kernel and EL3 ATF to let kernel can set the
> > > hypervisor vector table, then can enter EL2 to enable hypervisor, as
> > > shown in [1].
> > > Do you agree? Otherwise there is no method to enter EL2 hypervisor
> > > when kernel boot from EL1, because the hypervisor vector
> > > table(vbar_el2) is unknown.
> >
> > The kernel already supported being booted at EL2, where it will install
> > itself as the hypervisor (and will drop to EL1 if required). EL2 is the
> > preferred boot mode, as we document in:
> >
> > https://www.kernel.org/doc/html/latest/arm64/booting.html
> >
> > ... where we say:
> >
> > | The CPU must be in either EL2 (RECOMMENDED in order to have access to
> > | the virtualisation extensions) or non-secure EL1.
> >
> > We *strongly* prefer this over adding new ABIs to transition from EL1 to
> > EL2. Please boot the kernel at EL2 if you want to use KVM.
>
> Thanks for the answer.
> If use KVM, it should boot from EL2. But if the hypervisor is not
> KVM, such as Jailhouse hypervisor and some Chip manufacturer boot the
> host kernel from EL1(not follow above rule), it seems there is not way
> to enter the Jailhouse hypervisor.
We only deal with two cases:
- either the kernel uses its own, built-in hypervisor: it boots at
EL2, and installs itself.
- or there is a pre-existing hypervisor, and the kernel boots at EL1.
In the past, Jailhouse used the exact same entry points as KVM. What
has changed?
Finally, if you can change the firmware to install the EL2 vectors,
you can also change it to enter the kernel at EL2. I suggest you do
that instead.
Thanks,
M.
--
Without deviation from the norm, progress is not possible.
On Fri, May 28, 2021 at 05:26:51PM +0800, Dongjiu Geng wrote:
> Hi All,
> when Linux kernel boot from EL1, there is no method to let
> kernel to enter EL2 to enable hypervisor. so I want to add an SMC
> interface between kernel and EL3 ATF to let kernel can set the
> hypervisor vector table, then can enter EL2 to enable hypervisor, as
> shown in [1].
> Do you agree? Otherwise there is no method to enter EL2 hypervisor
> when kernel boot from EL1, because the hypervisor vector
> table(vbar_el2) is unknown.
The kernel already supported being booted at EL2, where it will install
itself as the hypervisor (and will drop to EL1 if required). EL2 is the
preferred boot mode, as we document in:
https://www.kernel.org/doc/html/latest/arm64/booting.html
... where we say:
| The CPU must be in either EL2 (RECOMMENDED in order to have access to
| the virtualisation extensions) or non-secure EL1.
We *strongly* prefer this over adding new ABIs to transition from EL1 to
EL2. Please boot the kernel at EL2 if you want to use KVM.
Thanks,
Mark.
>
>
>
> [1]:
> el1_sync:
> cmp x0, #SMC_SET_VECTORS
> b.ne 2f
> msr vbar_el2, x1
> b 9f
>
> 2: cmp x0, #SMC_SOFT_RESTART
> b.ne 3f
> mov x0, x2
> mov x2, x4
> mov x4, x1
> mov x1, x3
> br x4 // no return
>
> 3: cmp x0, #SMC_RESET_VECTORS
> beq 9f // Nothing to reset!
>
> ldr x0, =SMC_STUB_ERR
> eret
>
> 9: mov x0, xzr
> eret
> ENDPROC(el1_sync)
>
> _______________________________________________
> linux-arm-kernel mailing list
> linux-arm-kernel(a)lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
Hi All,
We are using the snprintf() (which uses vsnprintf() and unsigned_num_print()) from libc of ATF version 2.4and running into an issue for printing a number into a string where even if I provide large enough string to hold the number, it does not print it. I don't see that issue with it when I try to print a string using the same snprintf().I understand that, as per the documentation use of snprintf is "banned or discouraged". But for the use case,that we are using for, it is safe enough to use it assuming that it does it what it is supposed to do.
I am not sure if this is a known bug or what, but upon a further inspection, I found that there seems be a small bugin the unsigned_num_print() for one of the 'if' condition given below which is causing the issue in terms of calculatingthe available space in the string.
if (*chars_printed < n) {
.... do the prinring....}
I believe it is supposed to be
if (*chars_printed <= n) { ----------------->> Notice '<=' instead of '<' }
Any comment on whether this is on purpose or really a small bug?
The calling routine (vsnprintf) is already reducing 'n' by 1 for the terminating null character.
Thank you very much for your support.-hiren
On 4/19/21 11:11 AM, Jan Kiszka via TF-A wrote:
> On 19.04.21 17:21, Michal Simek wrote:
>> On 4/18/21 8:44 PM, Jan Kiszka wrote:
>>> when SPD or DEBUG is enabled, TF-A is moved to RAM on the zynqmp (as it
>>> longer fits into OCM). U-Boot happens to avoid that region, but the
>>> kernel's DTB has no reservation entry, and Linux will trigger an
>>> exception when accessing that region during early boot.
>>>
>>> Can we improve this - without requiring the user to manually add a
>>> reservation to the DTB? Should we unconditionally reserve
>>> 0x1000..0x7ffff in all BL33 DTBs? Or is there a chance to communicate
>>> that need? Or some way to detect in BL33 whether it is needed?
>>
>> Normally this ddr region should be also protected by security IPs that
>> NS has no access there.
>> It means in Xilinx flow this can be (and should be) propagated via
>> device-tree generator to final DTS file that you don't need to touch it
>> by hand.
>> I am not aware about any way that NS can query secure world what memory
>> can be used. And not sure if there is any standard way to do so.
>>
>
> OK, understood. But then, to be safe, shouldn't the upstream "static"
> default DT contain an exclusion of that region so that it won't get
> stuck if it is in use? Would block half a meg, but when you have a
> custom platform that does not need that, you can and will provide your
> own DT anyway.
Ideally, the static DTS is a description of the hardware only, and not
of runtime constraints imposed by the firmware. If BL31 needs to reserve
some memory, it can add that reservation to the DTB at runtime. The
fdt_add_reserved_memory() function is available for this purpose. For an
example, see the code used by the rpi4[0] or sun50i_h616[1] platforms.
If you later load a DTB from disk for use by Linux, you will need to
copy the reserved-memory nodes from the U-Boot DTB to the loaded DTB.
Regards,
Samuel
[0]:
https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/tree/plat/rpi/r…
[1]:
https://git.trustedfirmware.org/TF-A/trusted-firmware-a.git/tree/plat/allwi…
