[PATCH] ARM: rockchip: atf: move PBL malloc space away from OP-TEE memory

[PATCH] ARM: rockchip: atf: move PBL malloc space away from OP-TEE memory

[Sascha Hauer]

We recently introduced initializing the PBL early memory pool which
might be needed for decompressing the BL31/BL32 firmware files. We
used the end of the first DRAM region for the pool and with this we
ended up exactly in the default OP-TEE memory region which is mapped
as faulting. Move the pool directly beneath the OP-TEE memory.

Fixes: 76b1f31275 ("ARM: rockchip: initialize PBL malloc")
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
---
 arch/arm/mach-rockchip/atf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm/mach-rockchip/atf.c b/arch/arm/mach-rockchip/atf.c
index 14797a1e06..96a891847b 100644
--- a/arch/arm/mach-rockchip/atf.c
+++ b/arch/arm/mach-rockchip/atf.c
@@ -173,7 +173,8 @@ static void rockchip_atf_load_bl31(void *fdt)
 	unsigned long bl31_ep;
 
 	mmu_early_enable(membase[0], memsize[0]);
-	pbl_malloc_init(membase[0] + memsize[0] - PBL_MALLOC_SIZE, PBL_MALLOC_SIZE);
+	pbl_malloc_init(membase[0] + memsize[0] - OPTEE_SIZE - PBL_MALLOC_SIZE,
+			PBL_MALLOC_SIZE);
 
 	bl31_ep = load_elf64_image_phdr(&bl31);
 
-- 
2.47.3

Re: [PATCH] ARM: rockchip: atf: move PBL malloc space away from OP-TEE memory

[Ahmad Fatoum]

Hello Sascha,

On 5/21/26 11:17 AM, Sascha Hauer wrote:
> We recently introduced initializing the PBL early memory pool which
> might be needed for decompressing the BL31/BL32 firmware files. We
> used the end of the first DRAM region for the pool and with this we
> ended up exactly in the default OP-TEE memory region which is mapped
> as faulting. Move the pool directly beneath the OP-TEE memory.
> 
> Fixes: 76b1f31275 ("ARM: rockchip: initialize PBL malloc")
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  arch/arm/mach-rockchip/atf.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm/mach-rockchip/atf.c b/arch/arm/mach-rockchip/atf.c
> index 14797a1e06..96a891847b 100644
> --- a/arch/arm/mach-rockchip/atf.c
> +++ b/arch/arm/mach-rockchip/atf.c
> @@ -173,7 +173,8 @@ static void rockchip_atf_load_bl31(void *fdt)
>  	unsigned long bl31_ep;
>  
>  	mmu_early_enable(membase[0], memsize[0]);
> -	pbl_malloc_init(membase[0] + memsize[0] - PBL_MALLOC_SIZE, PBL_MALLOC_SIZE);
> +	pbl_malloc_init(membase[0] + memsize[0] - OPTEE_SIZE - PBL_MALLOC_SIZE,
> +			PBL_MALLOC_SIZE);

This would overlap the scratch area and possibly corrupt things there,
wouldn't it?

I think this may need to move again...

Is it not possible to read input_data/input_data_end here and determine
barebox_base and reuse the same memory area that barebox_pbl_start()
would use when TF-A returns?

Thanks,
Ahmad

>  
>  	bl31_ep = load_elf64_image_phdr(&bl31);
>  

-- 
Pengutronix e.K.                  |                             |
Steuerwalder Str. 21              | http://www.pengutronix.de/  |
31137 Hildesheim, Germany         | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686  | Fax:   +49-5121-206917-5555 |

Re: [PATCH] ARM: rockchip: atf: move PBL malloc space away from OP-TEE memory

[Sascha Hauer]

On 2026-05-21 11:27, Ahmad Fatoum wrote:
> Hello Sascha,
> 
> On 5/21/26 11:17 AM, Sascha Hauer wrote:
> > We recently introduced initializing the PBL early memory pool which
> > might be needed for decompressing the BL31/BL32 firmware files. We
> > used the end of the first DRAM region for the pool and with this we
> > ended up exactly in the default OP-TEE memory region which is mapped
> > as faulting. Move the pool directly beneath the OP-TEE memory.
> > 
> > Fixes: 76b1f31275 ("ARM: rockchip: initialize PBL malloc")
> > Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> > ---
> >  arch/arm/mach-rockchip/atf.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> > 
> > diff --git a/arch/arm/mach-rockchip/atf.c b/arch/arm/mach-rockchip/atf.c
> > index 14797a1e06..96a891847b 100644
> > --- a/arch/arm/mach-rockchip/atf.c
> > +++ b/arch/arm/mach-rockchip/atf.c
> > @@ -173,7 +173,8 @@ static void rockchip_atf_load_bl31(void *fdt)
> >  	unsigned long bl31_ep;
> >  
> >  	mmu_early_enable(membase[0], memsize[0]);
> > -	pbl_malloc_init(membase[0] + memsize[0] - PBL_MALLOC_SIZE, PBL_MALLOC_SIZE);
> > +	pbl_malloc_init(membase[0] + memsize[0] - OPTEE_SIZE - PBL_MALLOC_SIZE,
> > +			PBL_MALLOC_SIZE);
> 
> This would overlap the scratch area and possibly corrupt things there,
> wouldn't it?

:(

> 
> I think this may need to move again...
> 
> Is it not possible to read input_data/input_data_end here and determine
> barebox_base and reuse the same memory area that barebox_pbl_start()
> would use when TF-A returns?

Unfortunately not as barebox_base depends on the handoff data size which
might change between calls.

We could move the PBL malloc pool above the barebox image at the cost of
losing 128KiB of usable space.

Sascha

--
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |