Hi Jun,

On top of what Gyorgy suggested, please find specific answers to your queries

I am trying to enable SPM on iMX8MP platform, which is cortex-A53. The
BL2 is already enabled and the dts file is needed. But I am not sure how to write below dts information when I referencing fvp_spmc_manifest.dts. Could you help to give some suggestion or where should I find the anwsers?

1. Is fvp_spmc_manifest.dts enough to enable SPM? I see there are dts files, such as fvp_fw_config.dts. What's necessary dts nodes to enable SPM?

Arm's FVP platform use fconf mechanism to load different dts files, the first dts file which keeps information about all the dt files is "fw_config.dts", these dt files are consumed by different SW components.

They are loaded(by BL2) at base address provided in their fw_config.dts entry and x0 register is used to pass dt address to SW component.

HW_CONFIG dt consumed by Linux, TOS_FW_CONFIG consumed by trusted OS(BL32), NT_FW_CONFIG consumed by non-secure FW(BL33)

I will explain you through example of one of the configurations which is present in CI https://review.trustedfirmware.org/plugins/gitiles/ci/tf-a-ci-scripts/+/refs/heads/master/run_config/fvp-spm.linux

In this configuration, BL33 : NS Hypervisor, BL32: Secure hypervisor (SPM)

TOS_FW_CONFIG in this case is fvp_spmc_manifest.dts (plat/arm/board/fvp/platform.mk +271), which is loaded 0x04001500 by BL2 and when BL31 fills x0 register with this address when jumping to BL32.

To avoid going through fconf for now, you can quickly test it by loading and passing base address of fvp_spmc_manifest.dts.

2. Does vcpu_count means CPU number?

Yes

3. I see load_address of attribute is optee-os load address. But I do not know how should I decide the load addresses of hypervisors.  Is this address decided by virtual machine, or it is decided in runtime?
I cannot find the 0x7100000 in trusted-services project.

If i take spmc example again then, BL2 loads BL32 image at BL32_BASE which is Trusted DRAM base (0x6000000, include/plat/arm/common/arm_def.h +500), So when BL31 prepare to run BL32 it jumps to BL32_BASE with x0 populated with TOS_FW_CONFIG base(mentioned earlier).

4. I am confused on "Secure Partitions are bundled as independent package files" in below link. Does this bundle package means fip image, or into another file by jason file? Could you help point to the files and image generation command? https://github.com/ARM-software/arm-trusted-firmware/blob/master/docs/components/secure-partition-manager.rst#secure-partition-packages

Secure partitions are packaged as SP package which in turn are embedded into FIP as blobs. The json file is a human readable form to provide SP packages by platform (max  8 supported now). TF-A build expects a json file SP_LAYOUT_FILE (docs/getting_started/build-options.rst +608).

In our current setup we have 3 Secure partitions (named cactus) are exported from TF-A test repository

script to generate json file https://git.trustedfirmware.org/TF-A/tf-a-tests.git/tre​e/tools/generate_json/generate_json.sh (can be manually created as well)

And the fvp json file looks like below

{

        "cactus-primary" : {

                "image": "cactus.bin",

                "pm": "cactus.dts",

                "owner": "SiP"

        },

        "cactus-sec​ondary" : {

                "image": "cactus.bin",

                "pm": "cactus-secondary.dts",

                "owner": "Plat"

        },

        "cactus-tertiary" : {

                "image": "cactus.bin",

                "pm": "cactus-tertiary.dts"

        }

}

From: Gyorgy Szing <Gyorgy.Szing@arm.com>
Sent: 19 April 2021 16:48
To: Jun Nie <jun.nie@linaro.org>; Manish Pandey2 <Manish.Pandey2@arm.com>; tf-a@lists.trustedfirmware.org <tf-a@lists.trustedfirmware.org>
Cc: Olivier Deprez <Olivier.Deprez@arm.com>; Achin Gupta <Achin.Gupta@arm.com>; Shebu Varghese Kuriakose <Shebu.VargheseKuriakose@arm.com>; nd <nd@arm.com>; nd <nd@arm.com>
Subject: RE: Question on how enable TF-A SPM on iMX8M