Linux/PROCESSOR-SDK-AM335X: Secure privileged mode

Nobody Nobodyless

Part Number: PROCESSOR-SDK-AM335X
Other Parts Discussed in Thread: AM3358

Tool/software: Linux

Hello,

I would like to ask yet another question: How to switch from Nonsecure privileged mode (supervisor mode) to Secure privileged mode (monitor mode)?

Since this code sequence shows how to determine if the processor was configured to include parity and ECC RAM:

MRC p15, 1, <Rd>, c9, c0, 2 ; Read L2 Cache Auxiliary Control Register
ORR <Rd>, <Rd>, #0x0020_0000; Set parity/ECC enable
MCR p15, 1, <Rd>, c9, c0, 2 ; Write L2 Cache Auxiliary Control Register
MRC p15, 1, <Rd>, c9, c0, 2 ; Read L2 Cache Auxiliary Control Register
TST <Rd>, #0x0020_0000 ;      Test for parity/ECC enableBEQ no_parity_ram_setup

which needs to be in Secure privileged mode to do write to L2 Cache Auxiliary Control Register?

TI am3358 does NOT have the following instruction:

smc #1; // secure monitor call SMC (previously SMI) - NOT implemented in armv7

Snippet of the code doing that will be an excellent example, I guess!

Thank you,

_nobody_

over 6 years ago

0 Nobody Nobodyless over 6 years ago

Prodigy 110 points

Anybody?

0 Hong Guan64 over 6 years ago in reply to Nobody Nobodyless

TI__Guru 70340 points

On making secure monitor calls on AM335x GP device, please refer to AM335x TRM (SPRUH73P) "3.1.4.2.2 Secure Monitor Calls to Access CP15 Registers"

0 Nobody Nobodyless over 6 years ago in reply to Hong Guan64

Prodigy 110 points

Hello Hong,

I already know about this paragraph, and the snippet represented there. As you will see, I know much more.

I exactly implemented this snippet (I can post basic code as a device driver), and here are the traces of make all:

root@beaglebone:~/projects/LKM/cp15_smc# make all
make -C /lib/modules/5.0.15-jumpnow/build M=/home/root/projects/LKM/cp15_smc modules
make[1]: Entering directory '/lib/modules/5.0.15-jumpnow/build'
  CC [M]  /home/root/projects/LKM/cp15_smc/cp15_smc.o
/home/root/projects/LKM/cp15_smc/cp15_smc.c: In function 'enable_L2_ECC':
/home/root/projects/LKM/cp15_smc/cp15_smc.c:39:1: warning: label '_set_L2_ECC' defined but not used [-Wunused-label]
 _set_L2_ECC:
 ^~~~~~~~~~~
/tmp/ccX6ID4V.s: Assembler messages:
/tmp/ccX6ID4V.s:178: Error: selected processor does not support `smc #1' in ARM mode
make[2]: *** [scripts/Makefile.build:283: /home/root/projects/LKM/cp15_smc/cp15_smc.o] Error 1
make[1]: *** [Makefile:1577: _module_/home/root/projects/LKM/cp15_smc] Error 2
make[1]: Leaving directory '/lib/modules/5.0.15-jumpnow/build'
make: *** [Makefile:4: all] Error 2

As you can see the message: /tmp/ccX6ID4V.s:178: Error: selected processor does not support `smc #1' in ARM mode

It does support it in T2 mode. But TI am3358 does NOT have T2 mode implemented.

/tmp/ccOn1xgb.s:131: Error: selected processor does not support `smc #1' in Thumb mode

To prove this, please, use this manual: infocenter.arm.com/.../IHI0053D_acle_2_1.pdf

And go to page 49: SMC supported by 8,6Z, T2

Any other suggestion?

Thank you,

_nobody_

0 Hong Guan64 over 6 years ago in reply to Nobody Nobodyless

TI__Guru 70340 points

Hello,

One good reference is AM335x Linux SDK downloadable from http://software-dl.ti.com/processor-sdk-linux/esd/AM335X/latest/index_FDS.html

Under u-boot, refer to “omap_smc1” ASM function in $u-boot/arch/arm/mach-omap2/lowlevel_init.S,

“omap_smc1” is built for u-boot for various EVMs based on AM335x SoC, refer to link below for building u-boot for AM335x based EVMs.

http://software-dl.ti.com/processor-sdk-linux/esd/docs/latest/linux/Foundational_Components_U-Boot.html

Best,

-Hong

0 Nobody Nobodyless over 6 years ago in reply to Hong Guan64

Prodigy 110 points

Hello Hong,

I exactly did what you have asked me to do. Under u-boot, I found “omap_smc1” ASM function in $u-boot/arch/arm/mach-omap2/lowlevel_init.S.

And I did it. I have created omap_smc.S . You can see it here: github.com/.../omap_smc.S

	.globl	omap_smc

omap_smc:
	push	{r4-r12, lr}	@ save registers - ROM code may pollute
				@ our registers
	mov	r12, r0		@ Service
	mov	r0, r1		@ Argument

	dsb
	dmb
	smc	0		@ SMC #0 to enter monitor mode
				@ call ROM Code API for the service requested
	pop	{r4-r12, pc}
movs	pc, lr @ return

I put it into the context of the kernel driver: https://github.com/nobbody/armv7_A8_Secire_Monitor_Mode/tree/master/cp15_Secure_Monitor_Calls

You can inspect the code and try it. Again, I have the same message, using smc 0 asm mnemonic to enter Monitor Mode!

	root@beaglebone:~/projects/LKM/cp15_smc# make all
	make -C /lib/modules/5.0.15-jumpnow/build M=/home/root/projects/LKM/cp15_smc modules
	make[1]: Entering directory '/lib/modules/5.0.15-jumpnow/build'
	  AS [M]  /home/root/projects/LKM/cp15_smc/omap_smc.o
	/home/root/projects/LKM/cp15_smc/omap_smc.S: Assembler messages:
	/home/root/projects/LKM/cp15_smc/omap_smc.S:11: Error: selected processor does not support `smc 0' in ARM mode
	make[2]: *** [scripts/Makefile.build:367: /home/root/projects/LKM/cp15_smc/omap_smc.o] Error 1
	make[1]: *** [Makefile:1577: _module_/home/root/projects/LKM/cp15_smc] Error 2
	make[1]: Leaving directory '/lib/modules/5.0.15-jumpnow/build'
	make: *** [Makefile:5: all] Error 2
	root@beaglebone:~/projects/LKM/cp15_smc#

What makes it to pass, while using cross-compiler (arm-linux-gnu-gcc (GCC) 8.1.1 20180626 (Red Hat Cross 8.1.1-3) on Fedora to compile and link the whole U-Boot?

Why this code does not compile on the native BBB platform with the native GCC compiler (gcc (GCC) 8.3.0)?

You can try this code both ways from the created git: github.com/.../armv7_A8_Secire_Monitor_Mode

Thank you,

_nobody_

0 Hong Guan64 over 6 years ago in reply to Nobody Nobodyless

TI__Guru 70340 points

This is most likely caused by the compiler tool chain or CPU flags passed to the compiler.

One option is to add <.arch_extension sec> in each *.S file.

Also you can google compilation error msg for solutions.

Processors

Processors forum

Linux/PROCESSOR-SDK-AM335X: Secure privileged mode