Hi,

I haven't worked on this code so I might not be 100% correct, but this looks like the model trying to warn that it's writing into reserved memory. The TZC spec certainly corroborates that address 0x220 (for example) is reserved.

Now, looking into why, in plat/arm/board/fvp/fvp_security.c ARM_TZC_REGIONS_DEF is concatenated with a few more regions. The TZC spec says it only supports 8 regions and that adds up to some more. Then arm_tzc400_setup() seems to blindly loop over the resulting list. I'd suppose that would produce what you're seeing. Dropping some of the regions and/or adding a size assert should help.

Boyan

On 29/10/2024 07:21, 钱非凡 via TF-A wrote:

I tried to add two new tzc regions in ATF's source code, and test the memory access in the new region.

#define ARM_TZC_REGIONS_DEF \
    {ARM_AP_TZC_DRAM1_BASE,    ARM_EL3_TZC_DRAM1_END +
ARM_L1_GPT_SIZE,    TZC_REGION_S_RDWR,
0},                                \
    {ARM_NS_DRAM1_BASE, 0xA0000000-1, ARM_TZC_NS_DRAM_S_ACCESS,   
PLAT_ARM_TZC_NS_DEV_ACCESS},    \
    {0xA0000000, 0xB0000000-1, ARM_TZC_NS_DRAM_S_ACCESS,   
PLAT_ARM_TZC_NS_DEV_ACCESS},    \
    {0xB0000000, 0xC0000000-1, ARM_TZC_NS_DRAM_S_ACCESS,   
PLAT_ARM_TZC_NS_DEV_ACCESS},    \
    {0xC0000000, ARM_NS_DRAM1_END, ARM_TZC_NS_DRAM_S_ACCESS,   
PLAT_ARM_TZC_NS_DEV_ACCESS},    \
    {ARM_DRAM2_BASE, ARM_DRAM2_END, ARM_TZC_NS_DRAM_S_ACCESS,   
PLAT_ARM_TZC_NS_DEV_ACCESS}

But FVP throws some warnings:

Info: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
common_reset starts

Info: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400: build
config register value 0x3003f08
4 filters, 9 regions, address width 64

Info: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.flashloader0:
FlashLoader: Loaded 3164 kB from file
'/home/bea1e/functionality-prototype/build/../trusted-firmware-a/build/fvp/release/fip.bin'

Info: FVP_Base_RevC_2xAEMvA:
FVP_Base_RevC_2xAEMvA.bp.secureflashloader: FlashLoader: Loaded 25 kB
from file
'/home/bea1e/functionality-prototype/build/../trusted-firmware-a/build/fvp/release/bl1.bin'

Info: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
common_reset starts

Info: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400: build
config register value 0x3003f08
4 filters, 9 regions, address width 64

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 220
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5126760 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 224
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5126760 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 228
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5126760 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 22c
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5126760 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 230
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5126760 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 234
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5126760 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 240
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5127800 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 244
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5127800 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 248
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5127800 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 24c
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5127800 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 250
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5127800 ns

Warning: FVP_Base_RevC_2xAEMvA: FVP_Base_RevC_2xAEMvA.bp.tzc_400:
attempt to write invalid address 254
In file: (unknown):0
In process: FVP_Base_RevC_2xAEMvA.thread_p_32 @ 5127800 ns

It seems the configuration registers for the two new regions are invalid. But I dont know how to solve this problem.

Here are the arguments of FVP:

-C bp.ve_sysregs.exit_on_shutdown=1 \
-C cache_state_modelled=0 \
-C pctl.startup=0.0.0.0 \
-C cluster0.NUM_CORES=4 \
-C cluster1.NUM_CORES=4 \
-C bp.secure_memory=1 \
-C bp.dram_size=8 \
-C bp.tzc_400.diagnostics=1 \
-C
bp.secureflashloader.fname=$(TF_A_PATH)/build/fvp/$(TF_A_BUILD)/bl1.bin \
-C bp.flashloader0.fname=$(TF_A_PATH)/build/fvp/$(TF_A_BUILD)/fip.bin \
-C bp.virtioblockdevice.image_path=$(BOOT_IMG)

Should I add more arguments while booting FVP? Is there any other advice for me to test the TZASC configurations?