Have you ever succeeded in performing a Stage-1 MMU translation using
LPAE (Long Physical Address Extension) on the FVP_Base_RevC-2xAEMvA
platform model running in AArch32 Hyp mode (CONFIG64=0) into any other
Memory but Strongly-Ordered?
My environment is
- FVP_Base_RevC-2xAEMvA booting SW stack from bullet point below
- SW stack from Yocto, 'meta-arm'. I use 'fvp-base-arm32' that builds
bl1, bl2, bl32, bl33, Linux kernel and rootfs.
The only component that works there at PL2 HYP mode is u-boot (bl33).
Whichever attributes I assign there Normal Memory with Inner or Outer
Cacheability, Write-Through, or Write-Back, or Non-cacheable I always
end up with Strongly-Ordered.
To me it looks like it doesn't read the MAIR correctly and/or ignores
the Cachability in HCTR.
I inspected the MMU code thoroughly there, compared with the other
codes for MMU, from trusted-firmware-a, xen, and Linux kernel and it
seems u-boot does it correct. U-boot sets there identity-mapping for
all 4GB with 0GB through 2GB Strongly-Ordered, 3G - 4G Normal Memory,
Cachable Write-Back Write-Allocate, Non-Shareable and the last 1GB
also Strongly-Ordered. Here is a brief execution steps it goes
through:
#1 Sets up the 2M-block at the 2nd level table with attributes.
- sample block descriptor for translating from 0x8000_0000 virt to
phys: 0x8000044d
- bits[1:0] = 0b01 -> valid descriptor, descriptor type: block
- bits[4:2] = 0b011 -> AttrIndx[2:0] points to MAIR0[3] . MAIR0[3] is 0xff
- bits[5] = 0b0 - Non-secure
- bits[7:6] = 0b01 - Access Permission: Read/write
- bits[9:8] = 0b00 -> Shareability: non-shareable
#2 Sets up 1st level table descriptor pointing to the descriptor shown
above. It sets bits[1:0] to 0b11 meaning it is a table descriptor and
valid.
#3 Set control registers as follows
HTCR is: 0x80000500 so
- bits[9:8] = 0b01 -> Inner Cacheability to Normal memory, Outer
Write-Back Write-Allocate Cacheable
- bits[11:10] = 0b01 -> Outer Cacheability to Normal memory, Outer
Write-Back Write-Allocate Cacheable
- bits[13:12] = 0b00 -> Non-shareable
HTTBR is: 0x00000000feff4000 -> points to 1st lavel table set in #2
HMAIR0 is: 0xffeeaa00 -> as shown above AttrIndx[2:0] points to MAIR0
and the four nibble being 0xff. 0xff is Normal memory, Inner
Write-Back Cacheablea, Non-transientb
HMAIR1 is: 0x00000000 - I set it to zero there as not used.
#4 Finally it sets the M and C bits in HSCTLR registers
Inspecting the page tables with amrds the region 3GB through 4GB that
should be Normal and Cachable is Strongly-Ordered
- 0x80000000 | L2 Block | NP:0x0000000080000000 | XN=0, PXN=0,
Contiguous=0, nG=0, AF=1, SH=0x0, AP=0x1, AttrIndx=0x3
- H:0x80000000-0xFEFFFFFF | NP:0x80000000-0xFEFFFFFF |
Strongly-ordered | NA | False | True | True
Least not last are the parameters I pass to the model:
FVP_Base_RevC-2xAEMvA --parameter bp.ve_sysregs.exit_on_shutdown=1
--parameter bp.virtio_net.enabled=1 --parameter
bp.virtio_net.hostbridge.userNetworking=1 --parameter
bp.virtio_net.hostbridge.userNetPorts=8022=22 --parameter
cache_state_modelled=0 --parameter
bp.secureflashloader.fname=/home/ubuntu/yocto/poky/arm32-aem-build/tmp/deploy/images/fvp-base-arm32/bl1-fvp.bin
--parameter bp.flashloader0.fname=/home/ubuntu/yocto/poky/arm32-aem-build/tmp/deploy/images/fvp-base-arm32/fip-fvp.bin
--parameter bp.virtioblockdevice.image_path=/home/ubuntu/yocto/poky/arm32-aem-build/tmp/deploy/images/fvp-base-arm32/core-image-minimal-fvp-base-arm32-20250630100348.rootfs.wic
--parameter cluster0.has_arm_v8-4=1 --parameter
cluster1.has_arm_v8-4=1 --parameter cluster0.cpu0.CONFIG64=0
--parameter cluster0.cpu1.CONFIG64=0 --parameter
cluster0.cpu2.CONFIG64=0 --parameter cluster0.cpu3.CONFIG64=0
--parameter cluster1.cpu0.CONFIG64=0 --parameter
cluster1.cpu1.CONFIG64=0 --parameter cluster1.cpu2.CONFIG64=0
--parameter cluster1.cpu3.CONFIG64=0 --data
cluster0.cpu0=/home/ubuntu/yocto/poky/arm32-aem-build/tmp/deploy/images/fvp-base-arm32/zImage@0x80080000
--data cluster0.cpu0=/home/ubuntu/yocto/poky/arm32-aem-build/tmp/deploy/images/fvp-base-arm32/fvp-base-revc.dtb@0x8fc00000
--parameter 'bp.terminal_0.terminal_command=tmux new-window -n
"%title" "telnet localhost %port"' --parameter
bp.terminal_1.start_telnet=0 --parameter bp.terminal_2.start_telnet=0
--parameter bp.terminal_3.start_telnet=0 --iris-server --iris-port
7102 --iris-allow-remote
And an interrupted (not full for longevity) console log:
NOTICE: Booting Trusted Firmware
NOTICE: BL1: v2.8(debug):dd37aa5be-dirty
NOTICE: BL1: Built : 20:04:50, Aug 4 2025
NOTICE: BL1: Booting BL2
NOTICE: BL2: v2.8(debug):dd37aa5be-dirty
NOTICE: BL2: Built : 20:04:50, Aug 4 2025
NOTICE: BL1: Booting BL32
WARNING: FCONF: Invalid config id 26
INFO: SP_MIN FCONF: HW_CONFIG address = 0x7f00000
INFO: FCONF: Reading HW_CONFIG firmware configuration file from: 0x7f00000
INFO: FCONF: Reading firmware configuration information for: cpu_timer
INFO: FCONF: Reading firmware configuration information for: uart_config
INFO: FCONF: Reading firmware configuration information for: topology
INFO: FCONF: Reading firmware configuration information for: gicv3_config
NOTICE: SP_MIN: v2.8(debug):dd37aa5be-dirty
NOTICE: SP_MIN: Built : 20:04:50, Aug 4 2025
U-Boot 2022.04 (Aug 06 2025 - 16:41:21 +0000) vexpress_aemv8a fvp aarch32
DRAM: 2 GiB
WARNING: Caches not enabled
Core: 2 devices, 2 uclasses
Flash: 64 MiB
MMC:
Loading Environment from nowhere... OK
In: serial_pl01x
Out: serial_pl01x
Err: serial_pl01x
Net: SMC91111-0
Error: SMC91111-0 address not set.
Hit any key to stop autoboot: 0
fvp32# dcache on
fvp32# run bootcmd
OTE: Dereference aliases by omitting the leading '/', e.g. fdt print ethernet0.
Kernel image @ 0x80080000 [ 0x000000 - 0x687970 ]
## Flattened Device Tree blob at 8fc00000
Booting using the fdt blob at 0x8fc00000
Loading Device Tree to feb8b000, end feb90fff ... OK
Starting kernel ...
Booting Linux on physical CPU 0x0
Linux version 6.1.57-yocto-standard (oe-user@oe-host)
(arm-poky-linux-gnueabi-gcc (GCC) 12.3.0, GNU ld (GNU Binutils)
2.40.0.20230703) #1 SMP PREEMPT Wed Oct 11 23:03:27 UTC 2023
CPU: ARMv7 Processor [410fd0f0] revision 0 (ARMv7), cr=10c5387d
CPU: div instructions available: patching division code
CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
OF: fdt: Machine model: FVP Base RevC
earlycon: pl11 at MMIO 0x1c090000 (options '')
amba 1c1f0000.clcd: deferred probe pending
Poky (Yocto Project Reference Distro) 4.2.4 fvp-base-arm32 /dev/ttyAMA0
fvp-base-arm32 login: root
root@fvp-base-arm32:~# random: crng init done
random: 1 urandom warning(s) missed due to ratelimiting
root@fvp-base-arm32:~#
Is there a chance FVP_Base_RevC-2xAEMvA doesn't support the 1-stage
MMU translation for anything else but Strongly-Ordered?
Thanks,
Marek
