GitLab

This patch enables Trusted Board Boot for warp7. A subsequent patch
contains build/run instructions.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Jun Nie <jun.nie@linaro.org>

This patch defines the expected DTB overlay address in the memory map for
this platform. Its important that all points in the boot process agree on
this memory map even if not all elements utilize it.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

Recently upstreamed changes to OP-TEE mean that it is possible for OP-TEE
to provide a DTB overlay directly to subsequent boot stages thus negating
the requirement to bundle a DTB in the FIP.

This patch switches off the dependency on the DTB in the FIP descriptor
instead we will provide the necessary data as an overlay from OP-TEE.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

On i.MX8QM/i.MX8QX with system controller inside, the CPU's clock
rate is managed by SCFW(system controller firmware) and can ONLY be
changed from secure world, so SIP runtime service is needed for
setting CPU's clock rate, this patch adds cpu-freq SIP runtime service
support.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>

On i.MX8QM/i.MX8QX with system controller inside, the SRTC is
managed by SCFW(system controller firmware) and some functions
like setting SRTC's time etc. can ONLY be requested from secure
world, so SIP runtime service is needed for such kind of operations,
this patch adds SRTC SIP runtime service support for i.MX8QM and
i.MX8QX.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>

NXP's i.MX8 SoCs have system controller (M4 core) which takes
control of timer management, including watchdog, srtc and system
counter etc., other clusters like Cortex-A35 can send out command
via MU (Message Unit) to system controller for timer operation.

This patch adds timer IPC(inter-processor communication) support.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>

With DEBUG_CONSOLE enabled, build will fail for imx8mq platform:

./build/imx8mq/release/bl31/imx8mq_bl31_setup.o:
In function `bl31_early_platform_setup2':
imx8mq_bl31_setup.c:(.text.bl31_early_platform_setup2+0x40):
	undefined reference to `console_uart_register'
Makefile:741: recipe for target 'build/imx8mq/release/bl31/bl31.elf' failed
make: *** [build/imx8mq/release/bl31/bl31.elf] Error 1

Besides, the .console_flush callback needs to be added to avoid
panic when debug mode is enabled, since the console_flush() will
call it without checking whether the function callback is valid.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>

Current lpuart driver does NOT implement .console_flush callback,
if debug console is enabled, the console_flush() will call the
undefined .console_flush callback(NULL) for lpuart and leak to
panic, this patch adds .console_flush callback to make lpuart work
for debug mode.
Signed-off-by: Anson Huang <Anson.Huang@nxp.com>

Enforce full include path for includes. Deprecate old paths.

The following folders inside include/lib have been left unchanged:

- include/lib/cpus/${ARCH}
- include/lib/el3_runtime/${ARCH}

The reason for this change is that having a global namespace for
includes isn't a good idea. It defeats one of the advantages of having
folders and it introduces problems that are sometimes subtle (because
you may not know the header you are actually including if there are two
of them).

For example, this patch had to be created because two headers were
called the same way: e0ea0928 ("Fix gpio includes of mt8173 platform
to avoid collision."). More recently, this patch has had similar
problems: 46f9b2c3 ("drivers: add tzc380 support").

This problem was introduced in commit 4ecca339

 ("Move include and
source files to logical locations"). At that time, there weren't too
many headers so it wasn't a real issue. However, time has shown that
this creates problems.

Platforms that want to preserve the way they include headers may add the
removed paths to PLAT_INCLUDES, but this is discouraged.

Change-Id: I39dc53ed98f9e297a5966e723d1936d6ccf2fc8f
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

This is used as a table index, and already compared with an unsigned int:
block_dev_count.
Signed-off-by: Yann Gautier <yann.gautier@st.com>

This patch makes the build system link the console framework code by
default, like it already does with other common libraries (e.g. cache
helpers). This should not make a difference in practice since TF is
linked with --gc-sections, so the linker will garbage collect all
functions and data that are not referenced by any other code. Thus, if a
platform doesn't want to include console code for size reasons and
doesn't make any references to console functions, the code will not be
included in the final binary.

To avoid compatibility issues with older platform ports, only make this
change for the MULTI_CONSOLE_API.

Change-Id: I153a9dbe680d57aadb860d1c829759ba701130d3
Signed-off-by: Julius Werner <jwerner@chromium.org>

i.MX8MQ is new SOC of NXP's i.MX8M family based on
A53. It can provide industry-leading audio, voice
and video processing for applications that scale
from consumer home audio to industrial building
automation and mobile computers

this patchset add the basic supoort to boot up
the 4 X A53. more feature will be added later.
Signed-off-by: Bai Ping <ping.bai@nxp.com>

All identifiers, regardless of use, that start with two underscores are
reserved. This means they can't be used in header guards.

The style that this project is now to use the full name of the file in
capital letters followed by 'H'. For example, for a file called
"uart_example.h", the header guard is UART_EXAMPLE_H.

The exceptions are files that are imported from other projects:

- CryptoCell driver
- dt-bindings folders
- zlib headers

Change-Id: I50561bf6c88b491ec440d0c8385c74650f3c106e
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

include/plat/arm/common isn't needed by them, and is removed to avoid
dependency on Arm platform code.

Change-Id: Id9fccba33326fd075b3d1029bf1e4b012dfa0483
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Even though at this point plat_crash_console_flush is optional, it will
stop being optional in a following patch.

The console driver of warp7 doesn't support flush, so the implementation
is a placeholder.

TI had ``plat_crash_console_init`` and ``plat_crash_console_putc``, but
they weren't global so they weren't actually used. Also, they were
calling the wrong functions.

imx8_helpers.S only has placeholders for all of the functions.

Change-Id: I8d17bbf37c7dad74e134c61ceb92acb9af497718
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

The `finish_console_register` macro is used by the multi console
framework to register the `console_t` driver callbacks. It relied
on weak references to the `ldr` instruction to populate 0 to the
callback in case the driver has not defined the appropriate
function. Use of `ldr` instruction to load absolute address to a
reference makes the binary position dependant. These instructions
should be replaced with adrp/adr instruction for position independant
executable(PIE). But adrp/adr instructions don't work well with weak
references as described in GNU ld bugzilla issue 22589.

This patch defines a new version of `finish_console_register` macro
which can spcify which driver callbacks are valid and deprecates the
old one. If any of the argument is not specified, then the macro
populates 0 for that callback. Hence the functionality of the previous
deprecated macro is preserved. The USE_FINISH_CONSOLE_REG_2 define
is used to select the new variant of the macro and will be removed
once the deprecated variant is removed.

All the upstream console drivers have been migrated to use the new
macro in this patch.

NOTE: Platforms be aware that the new variant of the
`finish_console_register` should be used and the old variant is
deprecated.

Change-Id: Ia6a67aaf2aa3ba93932992d683587bbd0ad25259
Signed-off-by: Soby Mathew <soby.mathew@arm.com>

- Migrate to new GIC interfaces.
- Migrate to bl31_early_platform_setup2().
- Remove references to removed build options.

Change-Id: Ia7c63f75325ea4b41e32a9de3f01b0007d0ae210
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

- Fix reference to bl2_el3_early_platform_setup()
- Remove references to removed build options.

Change-Id: I9733bec64fc28db15716ddf481c05bdc30700b4a
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Acked-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Antonio Nino Diaz <antonio.ninodiaz@arm.com>

Previous changes in this series made the necessary driver additions and
updates. With those changes in-place we can add the platform.mk and
bl2_el3_setup.c to drive the boot process.

After this commit its possible to build a fully-functional TF-A for the
WaRP7 and boot from the BootROM to the Linux command prompt in secure or
non-secure mode.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch adds a callback into the BootROM's provided High Assurance Boot
(HAB) failsafe function when panicking i.e. the call is done without making
use of stack.

The HAB failsafe function allows a piece of software to call into the
BootROM and place the processor into failsafe mode.

Failsafe mode is a special mode which presents a serial download protocol
interface over UART or USB at the time of writing.

If the board has been set into secure mode, then only a signed binary can
be used to recover the board.

Thus failsafe gives a putatively secure method of performing a secure
recovery over UART or USB.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Ryan Harkin <ryan.harkin@linaro.org>

This patch adds entries to the mem params array for

- BL32
- BL32_EXTRA1
- BL32_EXTRA2
- BL33
- HW_CONFIG_ID

BL32 is marked as bootable to indicate that OPTEE is the thing that should
be booted next.

In our model OPTEE chain-loads onto u-boot so only BL32 is bootable.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This commit adds support for parsing a FIP pre-loaded by a previous
boot-phase such as u-boot or via ATF reading directly from eMMC.

[bod: squashing several patches from Rui, Jun and bod]
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch defines a platform_def.h describing

- FIP layout and location
- eMMC device select
- UART identity select
- System clock frequency
- Operational memory map
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
Signed-off-by: Jun Nie <jun.nie@linaro.org>
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

In order to link even a basic image we need to declare
REGISTER_BL_IMAGE_DESCS. This patch declares an empty structure which is
passed to REGISTER_BL_IMAGE_DESCS(). Later patches will add in some
meaningful data.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

Internal declarations for the WaRP7 port will go here. For now just include
sys/types.h.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This commit adds warp7_image_load.c with the functions

- plat_flush_next_bl_params()
- plat_get_bl_image_load_info()
- plat_get_next_bl_params()
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This commit adds a warp7_helpers.S which contains a implementation of:

- platform_mem_init
- plat_get_my_entrypoint
- plat_crash_console_init
- plat_crash_console_putc
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

The watchdog block on the IMX is mercifully simple. This patch maps the
various registers and bits associated with the block.

We are mostly only really interested in the power-down-enable (PDE) bits in
the block for the purposes of ATF.

The i.MX7 Solo Applications Processor Reference Manual details the PDE bit
as follows:

"Power Down Enable bit. Reset value of this bit is 1, which means the power
down counter inside the WDOG is enabled after reset. The software must
write 0 to this bit to disable the counter within 16 seconds of reset
de-assertion. Once disabled this counter cannot be enabled again. See
Power-down counter event for operation of this counter."

This patch does that zero write in-lieu of later phases in the boot
no-longer have the necessary permissions to rewrite the PDE bit directly.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch defines the most basic part of the CAAM and the only piece of
the CAAM silicon we are really interested in, in ATF, the CAAM control
structure.

The CAAM itself is a huge address space of some 32k, way out of scope for
the purpose we have in ATF.

This patch adds a simple CAAM init function that assigns ownership of the
CAAM job-rings to the non-secure MID with the ownership bit set to
non-secure.

This will allow later logic in the boot process such as OPTEE, u-boot and
Linux to assign job-rings as appropriate, restricting if necessary but
leaving open the main functionality of the CAAM to the Linux NS runtime.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

The High Assurance Boot or HAB is an on-chip method of providing a
root-of-trust from the reset vector to subsequent stages in the bootup
flow of the Cortex-A7 on the i.MX series of processors.

This patch adds a simple header file with pointer offsets of the provided
set of HAH API callbacks in the BootROM.

The relative offset of the function pointers is a constant and known
quantum, a software-contract between NXP and an implementation which is
defined in the NXP HAB documentation.

All we need is the correct base offset and then we can map the set of
function pointers relative to that offset.

imx_hab_arch.h provides the correct offset and the imx_hab.h hooks the
offset to the pre-determined callbacks.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Ryan Harkin <ryan.harkin@linaro.org>

In order to enable compile time differences in HAB interaction, we should
split out the definition of the base address of the HAB API.

Some version of the i.MX series have different offsets from the BootROM
base for the HAB callback table.

This patch defines the header into which we will define the i.MX7 specific
offset. The offset of the i.MX7 function-callback table is simultaneously
defined.

Once done, we can latch a set of common function pointer locations from the
offset given here and if necessary change the offset for different
processors without any other code-change.

For now all we support is i.MX7 so the only offset being defined is that
for the i.MX7.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Ryan Harkin <ryan.harkin@linaro.org>

This patch adds snvs.c with a imx_snvs_init() function.

imx_snvs_init() sets up permissions of the RTC via the SNVS HPCOMR.

During previous work with OPTEE on the i.MX7 part we discovered that prior
to switching from secure-world to normal-world it is required to apply more
permissive permissions than are defaulted to in order for Linux to be able
to access the RTC and CAAM functionality in general.

This patch pertains to fixing the RTC permissions by way of the
HPCOMR.NPSWA_EN bit.

Once set non-privileged code aka Linux-kernel code has permissions to
access the SNVS where the RTC resides.

Perform that permissions fix in imx_snvs_init() now, with a later patch making
the call from our platform setup code.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This commit defines two things.

- The basic SNVS memory map. At the moment that is total overkill for the
  permission bits we need to set inside the SNVS but, for the sake of
  completeness define the whole SNVS area as a struct.

- The bits of the HPCOMR register

  A permission fix will need to be applied to the SNVS block prior to
  switching on TrustZone. All we need to do is waggle a bit in the HPCOMR
  register. To do that waggle we first need to define the bits of the
  HPCOMR register.

- A imx_snvs_init() function definition

  Declare the snvs_init() function so that it can be called from our
  platform setup code.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

- Add a header to define imx_csu_init().
- Defines the Central Security Unit's Config Security Level
  permission bits.
- Define CSU_CSL_OPEN_ACCESS permission bitmask
- Run a loop to setup peripheral CSU permissions
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch adds an initial AHB-to-IP TrustZone (AIPS-TZ) initialization
routine. Setting up the AIPSTZ controller is required to inform the SoC
interconnect fabric which bus-masters can read/write and if the read/writes
are buffered.

For our purposes the initial configuration is for everything to be open. We
can lock-down later on as necessary.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch defines:

- The full range of IO-mux register offsets relative to the base address of
  the IO-mux block base address.

- The bits for muxing the UART1 TX/RX lines.

- The bits for muxing the UART6 TX/RX lines.

- The pad control pad bits for the UART

Two functions are provided to configure pad muxes:

- void io_muxc_set_pad_alt_function(pad_mux_offset, alt_function)
  Takes a pad_mux_offset and sets the alt_function bit-mask supplied.
  This will have the effect of switching the pad into one of its defined
  peripheral functions. These peripheral function modes are defined in the
  NXP documentation and need to be referred to in order to correctly
  configure a new alternative-function.

- void io_muxc_set_pad_features(pad_feature_offset, pad_features)
  Takes a pad_feature_offset and applies a pad_features bit-mask to the
  indicated pad.
  This function allows the setting of PAD drive-strength, pull-up values,
  hysteresis glitch filters and slew-rate settings.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch initializes USB core clocks for the i.MX7.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch initializes the watchdog clocks for the i.MX7.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This patch adds an internal UART init routine that gets called from the
external facing clock init function.

In the first pass this call does an explicit disable of all UART
clock-gates. Later changes will enable only the UART clock-gates we care
about.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>

This set of patches adds a very minimal layer of USB enabling patches to
clock.c. Unlike the watchdog or UART blocks the USB clocks pertain to PHYs,
the main USB clock etc, not to different instances of the same IP block.

As a result this patch-set takes the clock CCGR clock identifier directly
rather than as an index of an instance of blocks of the same type.
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>