diff --git a/Makefile b/Makefile
index 6ad4b4d7b605ea1e07065af83a1555d449263099..c59cdb490927cd8dce714cfe4490895df36f2ea0 100644
--- a/Makefile
+++ b/Makefile
@@ -363,7 +363,7 @@ $(eval PREREQUISITES := $(1).d)
$(1) : $(2)
@echo " PP $$<"
- $$(Q)$$(AS) $$(ASFLAGS) -P -E -o $$@ $$<
+ $$(Q)$$(AS) $$(ASFLAGS) -P -E -D__LINKER__ -o $$@ $$<
$(PREREQUISITES) : $(2)
@echo " DEPS $$@"
diff --git a/docs/firmware-design.md b/docs/firmware-design.md
index 96e4b4ca8b76e5988b21ce8f177ac8af74bedc77..4a50a7b7895339cc93674a4d161212210170a4a5 100644
--- a/docs/firmware-design.md
+++ b/docs/firmware-design.md
@@ -1269,14 +1269,19 @@ The following list describes the memory layout on the FVP:
* BL2 is loaded below BL3-1.
-* The TSP is loaded as the BL3-2 image at the base of either the Trusted
- SRAM or Trusted DRAM. When loaded into Trusted SRAM, its NOBITS sections
- are allowed to overlay BL2.
+* BL3-2 can be loaded in one of the following locations:
-This memory layout is designed to give the BL3-2 image as much memory as
-possible when it is loaded into Trusted SRAM. Depending on the location of the
-TSP, it will result in different memory maps, illustrated by the following
-diagrams.
+ * Trusted SRAM
+ * Trusted DRAM
+ * Secure region of DRAM (top 16MB of DRAM configured by the TrustZone
+ controller)
+
+When BL3-2 is loaded into Trusted SRAM, its NOBITS sections are allowed to
+overlay BL2. This memory layout is designed to give the BL3-2 image as much
+memory as possible when it is loaded into Trusted SRAM.
+
+The location of the BL3-2 image will result in different memory maps. This is
+illustrated in the following diagrams using the TSP as an example.
**TSP in Trusted SRAM (default option):**
@@ -1324,8 +1329,37 @@ diagrams.
| BL1 (ro) |
0x00000000 +----------+
-Loading the TSP image in Trusted DRAM doesn't change the memory layout of the
-other boot loader images in Trusted SRAM.
+**TSP in the TZC-Secured DRAM:**
+
+ DRAM
+ 0xffffffff +----------+
+ | BL3-2 | (secure)
+ 0xff000000 +----------+
+ | |
+ : : (non-secure)
+ | |
+ 0x80000000 +----------+
+
+ Trusted SRAM
+ 0x04040000 +----------+ loaded by BL2 ------------------
+ | BL1 (rw) | <<<<<<<<<<<<< | BL3-1 NOBITS |
+ |----------| <<<<<<<<<<<<< |----------------|
+ | | <<<<<<<<<<<<< | BL3-1 PROGBITS |
+ |----------| ------------------
+ | BL2 |
+ |----------|
+ | |
+ 0x04001000 +----------+
+ | Shared |
+ 0x04000000 +----------+
+
+ Trusted ROM
+ 0x04000000 +----------+
+ | BL1 (ro) |
+ 0x00000000 +----------+
+
+Moving the TSP image out of the Trusted SRAM doesn't change the memory layout
+of the other boot loader images in Trusted SRAM.
#### Memory layout on Juno ARM development platform
diff --git a/docs/user-guide.md b/docs/user-guide.md
index b07dd5f7dc7726a1078379c70835c2d319389894..4209be7ec0a62348ae127b17d89e33bc8cd8d6d6 100644
--- a/docs/user-guide.md
+++ b/docs/user-guide.md
@@ -259,8 +259,9 @@ performed.
#### FVP specific build options
* `FVP_TSP_RAM_LOCATION`: location of the TSP binary. Options:
- - `tsram` (default) : Trusted SRAM
+ - `tsram` : Trusted SRAM (default option)
- `tdram` : Trusted DRAM
+ - `dram` : Secure region in DRAM (configured by the TrustZone controller)
For a better understanding of FVP options, the FVP memory map is explained in
the [Firmware Design].
diff --git a/plat/fvp/aarch64/fvp_common.c b/plat/fvp/aarch64/fvp_common.c
index e20fe7d900131c64c59e4484104ee49f713c1bed..55c2cbbd3aab6e5442a081618bbc6c6d0277616a 100644
--- a/plat/fvp/aarch64/fvp_common.c
+++ b/plat/fvp/aarch64/fvp_common.c
@@ -66,8 +66,8 @@ plat_config_t plat_config;
DEVICE1_SIZE, \
MT_DEVICE | MT_RW | MT_SECURE)
-#define MAP_DRAM1 MAP_REGION_FLAT(DRAM1_BASE, \
- DRAM1_SIZE, \
+#define MAP_DRAM1_NS MAP_REGION_FLAT(DRAM1_NS_BASE, \
+ DRAM1_NS_SIZE, \
MT_MEMORY | MT_RW | MT_NS)
#define MAP_TSP_SEC_MEM MAP_REGION_FLAT(TSP_SEC_MEM_BASE, \
@@ -94,7 +94,7 @@ const mmap_region_t fvp_mmap[] = {
MAP_FLASH0,
MAP_DEVICE0,
MAP_DEVICE1,
- MAP_DRAM1,
+ MAP_DRAM1_NS,
MAP_TSP_SEC_MEM,
{0}
};
diff --git a/plat/fvp/bl2_fvp_setup.c b/plat/fvp/bl2_fvp_setup.c
index 71bd8c2a40051daa47a7efd2bf1897d0c01e5cdf..5764b6a98d5fe510e373378458b1beec32356777 100644
--- a/plat/fvp/bl2_fvp_setup.c
+++ b/plat/fvp/bl2_fvp_setup.c
@@ -284,8 +284,8 @@ void bl2_plat_get_bl32_meminfo(meminfo_t *bl32_meminfo)
******************************************************************************/
void bl2_plat_get_bl33_meminfo(meminfo_t *bl33_meminfo)
{
- bl33_meminfo->total_base = DRAM_BASE;
- bl33_meminfo->total_size = DRAM_SIZE - DRAM1_SEC_SIZE;
- bl33_meminfo->free_base = DRAM_BASE;
- bl33_meminfo->free_size = DRAM_SIZE - DRAM1_SEC_SIZE;
+ bl33_meminfo->total_base = DRAM1_NS_BASE;
+ bl33_meminfo->total_size = DRAM1_NS_SIZE;
+ bl33_meminfo->free_base = DRAM1_NS_BASE;
+ bl33_meminfo->free_size = DRAM1_NS_SIZE;
}
diff --git a/plat/fvp/fvp_def.h b/plat/fvp/fvp_def.h
index 06f2a649a8363f3e7a2a1e2b9596a1ea442374a0..d1d9adb60d0e7b1d67ba3eea887d00daf0ee047e 100644
--- a/plat/fvp/fvp_def.h
+++ b/plat/fvp/fvp_def.h
@@ -36,8 +36,29 @@
#define FVP_PRIMARY_CPU 0x0
/* Memory location options for TSP */
-#define FVP_IN_TRUSTED_SRAM 0
-#define FVP_IN_TRUSTED_DRAM 1
+#define FVP_TRUSTED_SRAM_ID 0
+#define FVP_TRUSTED_DRAM_ID 1
+#define FVP_DRAM_ID 2
+
+/*
+ * Some of the definitions in this file use the 'ull' suffix in order to avoid
+ * subtle integer overflow errors due to implicit integer type promotion when
+ * working with 32-bit values.
+ *
+ * The TSP linker script includes some of these definitions to define the BL3-2
+ * memory map, but the GNU LD does not support the 'ull' suffix, causing the
+ * build process to fail. To solve this problem, the auxiliary macro MAKE_ULL(x)
+ * will add the 'ull' suffix only when the macro __LINKER__ is not defined
+ * (__LINKER__ is defined in the command line to preprocess the linker script).
+ * Constants in the linker script will not have the 'ull' suffix, but this is
+ * not a problem since the linker evaluates all constant expressions to 64 bit
+ * (assuming the target architecture is 64 bit).
+ */
+#ifndef __LINKER__
+ #define MAKE_ULL(x) x##ull
+#else
+ #define MAKE_ULL(x) x
+#endif
/*******************************************************************************
* FVP memory map related constants
@@ -79,16 +100,24 @@
#define NSRAM_BASE 0x2e000000
#define NSRAM_SIZE 0x10000
-#define DRAM1_BASE 0x80000000ull
-#define DRAM1_SIZE 0x80000000ull
+#define DRAM1_BASE MAKE_ULL(0x80000000)
+#define DRAM1_SIZE MAKE_ULL(0x80000000)
#define DRAM1_END (DRAM1_BASE + DRAM1_SIZE - 1)
-#define DRAM1_SEC_SIZE 0x01000000ull
+
+/* Define the top 16 MB of DRAM1 as secure */
+#define DRAM1_SEC_SIZE MAKE_ULL(0x01000000)
+#define DRAM1_SEC_BASE (DRAM1_BASE + DRAM1_SIZE - DRAM1_SEC_SIZE)
+#define DRAM1_SEC_END (DRAM1_SEC_BASE + DRAM1_SEC_SIZE - 1)
+
+#define DRAM1_NS_BASE DRAM1_BASE
+#define DRAM1_NS_SIZE (DRAM1_SIZE - DRAM1_SEC_SIZE)
+#define DRAM1_NS_END (DRAM1_NS_BASE + DRAM1_NS_SIZE - 1)
#define DRAM_BASE DRAM1_BASE
#define DRAM_SIZE DRAM1_SIZE
-#define DRAM2_BASE 0x880000000ull
-#define DRAM2_SIZE 0x780000000ull
+#define DRAM2_BASE MAKE_ULL(0x880000000)
+#define DRAM2_SIZE MAKE_ULL(0x780000000)
#define DRAM2_END (DRAM2_BASE + DRAM2_SIZE - 1)
#define PCIE_EXP_BASE 0x40000000
diff --git a/plat/fvp/fvp_security.c b/plat/fvp/fvp_security.c
index 06ab5754d782d41cc525ff53c9cc093c098f947d..62bde085a52b1b67e3cdd4f575fb1b976359f3d7 100644
--- a/plat/fvp/fvp_security.c
+++ b/plat/fvp/fvp_security.c
@@ -89,16 +89,17 @@ void fvp_security_setup(void)
* Allow only non-secure access to all DRAM to supported devices.
* Give access to the CPUs and Virtio. Some devices
* would normally use the default ID so allow that too. We use
- * two regions to cover the blocks of physical memory in the FVPs.
+ * two regions to cover the blocks of physical memory in the FVPs
+ * plus one region to reserve some memory as secure.
*
* Software executing in the secure state, such as a secure
* boot-loader, can access the DRAM by using the NS attributes in
* the MMU translation tables and descriptors.
*/
- /* Set to cover the first block of DRAM */
+ /* Region 1 set to cover the Non-Secure DRAM */
tzc_configure_region(FILTER_SHIFT(0), 1,
- DRAM1_BASE, DRAM1_END - DRAM1_SEC_SIZE,
+ DRAM1_NS_BASE, DRAM1_NS_END,
TZC_REGION_S_NONE,
TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) |
TZC_REGION_ACCESS_RDWR(FVP_NSAID_PCI) |
@@ -106,14 +107,14 @@ void fvp_security_setup(void)
TZC_REGION_ACCESS_RDWR(FVP_NSAID_VIRTIO) |
TZC_REGION_ACCESS_RDWR(FVP_NSAID_VIRTIO_OLD));
- /* Set to cover the secure reserved region */
- tzc_configure_region(FILTER_SHIFT(0), 3,
- (DRAM1_END - DRAM1_SEC_SIZE) + 1 , DRAM1_END,
+ /* Region 2 set to cover the Secure DRAM */
+ tzc_configure_region(FILTER_SHIFT(0), 2,
+ DRAM1_SEC_BASE, DRAM1_SEC_END,
TZC_REGION_S_RDWR,
0x0);
- /* Set to cover the second block of DRAM */
- tzc_configure_region(FILTER_SHIFT(0), 2,
+ /* Region 3 set to cover the second block of DRAM */
+ tzc_configure_region(FILTER_SHIFT(0), 3,
DRAM2_BASE, DRAM2_END, TZC_REGION_S_NONE,
TZC_REGION_ACCESS_RDWR(FVP_NSAID_DEFAULT) |
TZC_REGION_ACCESS_RDWR(FVP_NSAID_PCI) |
diff --git a/plat/fvp/include/platform_def.h b/plat/fvp/include/platform_def.h
index e3c48e67193f4f21b9e67fadf6f449d94144e123..b0460e08fb4e0d811de76ce5d1617523acdf6e72 100644
--- a/plat/fvp/include/platform_def.h
+++ b/plat/fvp/include/platform_def.h
@@ -128,19 +128,25 @@
* BL32 specific defines.
******************************************************************************/
/*
- * On FVP, the TSP can execute either from Trusted SRAM or Trusted DRAM.
+ * On FVP, the TSP can execute from Trusted SRAM, Trusted DRAM or the DRAM
+ * region secured by the TrustZone controller.
*/
-#if FVP_TSP_RAM_LOCATION_ID == FVP_IN_TRUSTED_SRAM
+#if FVP_TSP_RAM_LOCATION_ID == FVP_TRUSTED_SRAM_ID
# define TSP_SEC_MEM_BASE FVP_TRUSTED_SRAM_BASE
# define TSP_SEC_MEM_SIZE FVP_TRUSTED_SRAM_SIZE
# define TSP_PROGBITS_LIMIT BL2_BASE
# define BL32_BASE FVP_TRUSTED_SRAM_BASE
# define BL32_LIMIT BL31_BASE
-#elif FVP_TSP_RAM_LOCATION_ID == FVP_IN_TRUSTED_DRAM
+#elif FVP_TSP_RAM_LOCATION_ID == FVP_TRUSTED_DRAM_ID
# define TSP_SEC_MEM_BASE FVP_TRUSTED_DRAM_BASE
# define TSP_SEC_MEM_SIZE FVP_TRUSTED_DRAM_SIZE
# define BL32_BASE FVP_TRUSTED_DRAM_BASE
# define BL32_LIMIT (FVP_TRUSTED_DRAM_BASE + (1 << 21))
+#elif FVP_TSP_RAM_LOCATION_ID == FVP_DRAM_ID
+# define TSP_SEC_MEM_BASE DRAM1_SEC_BASE
+# define TSP_SEC_MEM_SIZE DRAM1_SEC_SIZE
+# define BL32_BASE DRAM1_SEC_BASE
+# define BL32_LIMIT (DRAM1_SEC_BASE + DRAM1_SEC_SIZE)
#else
# error "Unsupported FVP_TSP_RAM_LOCATION_ID value"
#endif
@@ -154,7 +160,21 @@
* Platform specific page table and MMU setup constants
******************************************************************************/
#define ADDR_SPACE_SIZE (1ull << 32)
-#define MAX_XLAT_TABLES 2
+
+#if IMAGE_BL1
+# define MAX_XLAT_TABLES 2
+#elif IMAGE_BL2
+# define MAX_XLAT_TABLES 3
+#elif IMAGE_BL31
+# define MAX_XLAT_TABLES 2
+#elif IMAGE_BL32
+# if FVP_TSP_RAM_LOCATION_ID == FVP_DRAM_ID
+# define MAX_XLAT_TABLES 3
+# else
+# define MAX_XLAT_TABLES 2
+# endif
+#endif
+
#define MAX_MMAP_REGIONS 16
/*******************************************************************************
diff --git a/plat/fvp/platform.mk b/plat/fvp/platform.mk
index fdcee50b454dce909cbbdc6bd08fae235184048c..892e43caeaa03c08bcbd57e858ebed7e048fc4d8 100644
--- a/plat/fvp/platform.mk
+++ b/plat/fvp/platform.mk
@@ -32,9 +32,11 @@
# Trusted SRAM is the default.
FVP_TSP_RAM_LOCATION := tsram
ifeq (${FVP_TSP_RAM_LOCATION}, tsram)
- FVP_TSP_RAM_LOCATION_ID := FVP_IN_TRUSTED_SRAM
+ FVP_TSP_RAM_LOCATION_ID := FVP_TRUSTED_SRAM_ID
else ifeq (${FVP_TSP_RAM_LOCATION}, tdram)
- FVP_TSP_RAM_LOCATION_ID := FVP_IN_TRUSTED_DRAM
+ FVP_TSP_RAM_LOCATION_ID := FVP_TRUSTED_DRAM_ID
+else ifeq (${FVP_TSP_RAM_LOCATION}, dram)
+ FVP_TSP_RAM_LOCATION_ID := FVP_DRAM_ID
else
$(error "Unsupported FVP_TSP_RAM_LOCATION value")
endif