GitLab

Migrate to mmc framework.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Functions provided by stdio.h such as printf and sprintf are available
in the codebase, but they add a lot of code to the final image if they
are used:

- AArch64: ~4KB
- AArch32: ~2KB in T32, ~3KB in A32

tf_printf and tf_snprintf are a lot more simple, but it is preferable
to use them when possible because they are also used in common code.

Change-Id: Id09fd2b486198fe3d79276e2c27931595b7ba60e
Acked-by: Haojian Zhuang <haojian.zhuang@linaro.org>
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

BL1 is used in recovery mode on HiKey. The TBB implementation
on HiKey is in BL2. It means that user need to build ATF BL2
with TBB and ATF BL1 with non-TBB. It's inconvenient.

So include TBB in BL1, too.
Signed-off-by: Teddy Reed <teddy@prosauce.org>
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Also change header guards to fix defects of MISRA C-2012 Rule 21.1.

Change-Id: Ied0d4b0e557ef6119ab669d106d2ac5d99620c57
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Acked-by: Anson Huang <Anson.Huang@nxp.com>
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

This patch adds experimental support for TRUSTED_BOARD_BOOT to the
Hikey. This is adapted from the RPi3 and QEMU implementations.

Since the Hikey starts from BL2 the TRUSTED_BOARD_BOOT ROT begins there
too. When TRUSTED_BOARD_BOOT is defined, the BL1 build is skipped.

See the following example:

make \
 PLAT=hikey \
 BL33=u-boot.bin \
 SCP_BL2=mcuimage.bin \
 TRUSTED_BOARD_BOOT=1 \
 MBEDTLS_DIR=../../mbedtls \
 GENERATE_COT=1 \
 all fip
Signed-off-by: Teddy Reed <teddy.reed@gmail.com>

RFC4122 defines that fields are stored in network order (big endian),
but TF-A stores them in machine order (little endian by default in TF-A).
We cannot change the future UUIDs that are already generated, but we can store
all the bytes using arrays and modify fiptool to generate the UUIDs with
the correct byte order.

Change-Id: I97be2d3168d91f4dee7ccfafc533ea55ff33e46f
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>

Since commit 031dbb12

 ("AArch32: Add essential Arch helpers"),
it is difficult to use consistent format strings for printf() family
between aarch32 and aarch64.

For example, uint64_t is defined as 'unsigned long long' for aarch32
and as 'unsigned long' for aarch64.  Likewise, uintptr_t is defined
as 'unsigned int' for aarch32, and as 'unsigned long' for aarch64.

A problem typically arises when you use printf() in common code.

One solution could be, to cast the arguments to a type long enough
for both architectures.  For example, if 'val' is uint64_t type,
like this:

  printf("val = %llx\n", (unsigned long long)val);

Or, somebody may suggest to use a macro provided by <inttypes.h>,
like this:

  printf("val = %" PRIx64 "\n", val);

But, both would make the code ugly.

The solution adopted in Linux kernel is to use the same typedefs for
all architectures.  The fixed integer types in the kernel-space have
been unified into int-ll64, like follows:

    typedef signed char           int8_t;
    typedef unsigned char         uint8_t;

    typedef signed short          int16_t;
    typedef unsigned short        uint16_t;

    typedef signed int            int32_t;
    typedef unsigned int          uint32_t;

    typedef signed long long      int64_t;
    typedef unsigned long long    uint64_t;

[ Linux commit: 0c79a8e29b5fcbcbfd611daf9d500cfad8370fcf ]

This gets along with the codebase shared between 32 bit and 64 bit,
with the data model called ILP32, LP64, respectively.

The width for primitive types is defined as follows:

                   ILP32           LP64
    int            32              32
    long           32              64
    long long      64              64
    pointer        32              64

'long long' is 64 bit for both, so it is used for defining uint64_t.
'long' has the same width as pointer, so for uintptr_t.

We still need an ifdef conditional for (s)size_t.

All 64 bit architectures use "unsigned long" size_t, and most 32 bit
architectures use "unsigned int" size_t.  H8/300, S/390 are known as
exceptions; they use "unsigned long" size_t despite their architecture
is 32 bit.

One idea for simplification might be to define size_t as 'unsigned long'
across architectures, then forbid the use of "%z" string format.
However, this would cause a distortion between size_t and sizeof()
operator.  We have unknowledge about the native type of sizeof(), so
we need a guess of it anyway.  I want the following formula to always
return 1:

  __builtin_types_compatible_p(size_t, typeof(sizeof(int)))

Fortunately, ARM is probably a majority case.  As far as I know, all
32 bit ARM compilers use "unsigned int" size_t.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Clean cache to flush parameters into SRAM before MCU using them.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Store those DDR parameters into SRAM. They may be used by MCU
firmware.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Fix that DDR can't work at 533MHz. Now step to set DDR frequency
from 150MHz to 800MHz. DDR could work among these frequency, 150MHz,
266MHz, 400MHz, 533MHz and 800MHz.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Void pointers have been used to access linker symbols, by declaring an
extern pointer, then taking the address of it. This limits symbols
values to aligned pointer values. To remove this restriction an
IMPORT_SYM macro has been introduced, which declares it as a char
pointer and casts it to the required type.

Change-Id: I89877fc3b13ed311817bb8ba79d4872b89bfd3b0
Signed-off-by: Joel Hutton <Joel.Hutton@Arm.com>

Ensure (where possible) that switch statements in plat comply with MISRA
rules 16.1 - 16.7.

Change-Id: Ie4a7d2fd10f6141c0cfb89317ea28a755391622f
Signed-off-by: Jonathan Wright <jonathan.wright@arm.com>

Boot memory layout is specific for a platform, but should not be
mixed up with other platform specific attributes. A separate file is
much cleaner and better to compare with other platforms. Take a look
at plat/poplar where it is done the same way.

Moved hikey_def.h to system include folder and moved includes from
hikey_def.h to more general platform_def.h.
Signed-off-by: Michael Brandl <git@fineon.pw>

plat/hisilicon/hikey/hikey_bl1_setup.c:565:47:
error: value size does not match register size specified by the
constraint and modifier [-Werror,-Wasm-operand-widths]
        __asm__ volatile ("mrs  %0, cpacr_el1" : "=r"(data));
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Create hikey_bl_common.c to store duplicated initialization
code in BL1 and BL2.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Since non-TF ROM is used in HiKey platform (Hisilicon Hi6220 SoC),
replace BL1 by BL2_EL3 in normal boot mode.

When we recovery images in recovery mode, keep to use BL1.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Although SRAM is initialized, DCACHE should be cleaned too.
Because MCU is a parrallel core to access SRAM. We need to make
sure that initialized value is really written to SRAM before
MCU using it.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Since LOAD_IMAGE_V2 is always enabled in HiKey platform. Drop
LOAD_IMAGE v1 to simplify code.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

MISRA C-2012 Rule 7.3 violation: lowercase l shall not be used as literal suffixes.

This patch resolves this for the ULL() macro by using ULL suffix instead
of the ull suffix.

Change-Id: Ia8183c399e74677e676956e8653e82375d0e0a01
Signed-off-by: David Cunado <david.cunado@arm.com>

Signed-off-by: Victor Chong <victor.chong@linaro.org>

In the next commit, I need the image name in lowercase because
output files are generally named in lowercase.

Unfortunately, TOOL_ADD_IMG takes the first argument in uppercase
since we generally use uppercase Make variables.

make_helpers/build_macros.mk provides 'uppercase' macro to convert
a string into uppercase, but 'lowercase' does not exist.  We can
implement it if we like, but it would be more straightforward to
change the argument of TOOL_ADD_IMG.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

Now FIP_ADD_IMG takes care of both fiptool and cert_create
symmetrically.  Rename it so that it matches the behavior.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>

MAP_TSP_MEM could be either in SRAM or DRAM. When MAP_TSP_MEM is in
DRAM, it's overlapped with MAP_DDR.

Since MAP_OPTEE_PAGEABLE isn't used in SRAM case, just remove it.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Change-Id: Ib67b841ab621ca1ace3280e44cf3e1d83052cb73
Signed-off-by: Dimitris Papastamos <dimitris.papastamos@arm.com>

`assert(e)` was used in place of `if (e) ERROR()` when sec_protect()
was ported from hikey fork so the logic should have been reversed.

Fixes: 3d5d9f5a ("hikey: configure the top 16MB of DRAM as secure")
Fixes: 52988b38

 ("hikey: configure 4 MB of secure DRAM for OP-TEE
Secure Data Path")
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Tested-by: Victor Chong <victor.chong@linaro.org>

Update the memory firewall configuration to reserve 4 MB of secure RAM
for use by the kernel and OP-TEE as the Secure Data Path pool.
Note that this address range (0x3E800000 - 0x3EC00000) falls in the
range already set aside by UEFI (which reserves the upper 32 MB of the
1GB DRAM for OP-TEE [1]) and was previously unused.

[1] https://github.com/96boards-hikey/edk2/blob/hikey/HisiPkg/HiKeyPkg/Library/HiKeyLib/HiKeyMem.c#L44

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Acked-by: Victor Chong <victor.chong@linaro.org>

DRAM region 0x3f000000 - 0x3fffffff is reserved for OP-TEE and should
therefore be accessible only from secure world.
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Acked-by: Victor Chong <victor.chong@linaro.org>

Pre-v8.2 platforms such as the Juno platform does not have
the Scalable Vector Extensions implemented and so the build
option ENABLE_SVE is set to zero.

This has a minor performance improvement with no functional
impact.

Change-Id: Ib072735db7a0247406f8b60e325b7e28b1e04ad1
Signed-off-by: David Cunado <david.cunado@arm.com>

Set alignment size to 512B so finally we can get fip.bin with 512B
alignment. This can avoid stuck issue for 'fastboot' downloading if
USB driver uses DMA for data transferring.
Signed-off-by: Leo Yan <leo.yan@linaro.org>

These macros are only defined for corresponding image,
and they are undefined for other images. It means that we have
to use ifdef or defined() instead of relying on being 0 by default.

Change-Id: Iad11efab9830ddf471599b46286e1c56581ef5a7
Signed-off-by: Roberto Vargas <roberto.vargas@arm.com>

Make RTC out of reset mode since it may be used in UEFI.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Init EDMA controller with non secure mode. A lot of peripherals are
depend on EDMA controller. But EDMA controller is in secure mode
by default. And this operation has to be executed in secure mode.
Signed-off-by: Haojian Zhuang <haojian.zhuang@linaro.org>

Otherwise, BL2 tries to load a BL32 image and triggers
assert(result == 0)
in
plat_get_image_source()
in hikey{960}_io_storage.c
in a debug build, or displays
ERROR:   BL2: Failed to load image
in a release build.
Signed-off-by: Victor Chong <victor.chong@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>

Every CPU has its own debug module and this module is used by JTAG
debugging and coresight tracing. If without enabling it, it's easily to
introduce lockup issue when we enable debugging features.

This patch is to enable CPU debug module when power on CPU; this allows
connecting to all cores through JTAG and used by kernel coresight
driver.
Signed-off-by: Matthias Welwarsky <maw@sysgo.com>
Signed-off-by: Leo Yan <leo.yan@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Signed-off-by: Leo Yan <leo.yan@linaro.org>

Constants named as *ACTLR* refer in fact to the CPUACTRL_EL1 register.
Since ACTLR and ACTRL_EL1 are different registers this patch renames
these constants for clarity.

Change-Id: I2a9e402dab7b0fcb6e481ee0d8a11eda943ed299
Signed-off-by: Eleanor Bonnici <Eleanor.bonnici@arm.com>

At the system boot time we need enable watchdog reset, otherwise after
the watchdog is timeout it cannot reset the SoC. We need set the bit 0
and bit 16 together, the bit 16 is mask bit so after set bit 16 we have
permission to operate bit 0 and bit 0 is watchdog reset enabling bit.
Signed-off-by: Leo Yan <leo.yan@linaro.org>

Assembler programmers are used to being able to define functions with a
specific aligment with a pattern like this:

    .align X
  myfunction:

However, this pattern is subtly broken when instead of a direct label
like 'myfunction:', you use the 'func myfunction' macro that's standard
in Trusted Firmware. Since the func macro declares a new section for the
function, the .align directive written above it actually applies to the
*previous* section in the assembly file, and the function it was
supposed to apply to is linked with default alignment.

An extreme case can be seen in Rockchip's plat_helpers.S which contains
this code:

  [...]
  endfunc plat_crash_console_putc

  .align 16
  func platform_cpu_warmboot
  [...]

This assembles into the following plat_helpers.o:

  Sections:
  Idx Name                             Size  [...]  Algn
   9 .text.plat_crash_console_putc 00010000  [...]  2**16
  10 .text.platform_cpu_warmboot   00000080  [...]  2**3

As can be seen, the *previous* function actually got the alignment
constraint, and it is also 64KB big even though it contains only two
instructions, because the .align directive at the end of its section
forces the assembler to insert a giant sled of NOPs. The function we
actually wanted to align has the default constraint. This code only
works at all because the linker just happens to put the two functions
right behind each other when linking the final image, and since the end
of plat_crash_console_putc is aligned the start of platform_cpu_warmboot
will also be. But it still wastes almost 64KB of image space
unnecessarily, and it will break under certain circumstances (e.g. if
the plat_crash_console_putc function becomes unused and its section gets
garbage-collected out).

There's no real way to fix this with the existing func macro. Code like

 func myfunc
 .align X

happens to do the right thing, but is still not really correct code
(because the function label is inserted before the .align directive, so
the assembler is technically allowed to insert padding at the beginning
of the function which would then get executed as instructions if the
function was called). Therefore, this patch adds a new parameter with a
default value to the func macro that allows overriding its alignment.

Also fix up all existing instances of this dangerous antipattern.

Change-Id: I5696a07e2fde896f21e0e83644c95b7b6ac79a10
Signed-off-by: Julius Werner <jwerner@chromium.org>