GitLab

This change implements platform services for stm32mp1 to expose clock
and reset controllers over SCMI clock and reset domain protocols
in sp_min firmware.

Requests execution use a fastcall SMC context using a SiP function ID.
The setup allows the create SCMI channels by assigning a specific
SiP SMC function ID for each channel/agent identifier defined. In this
change, stm32mp1 exposes a single channel and hence expects single
agent at a time.

The input payload in copied in secure memory before the message
in passed through the SCMI server drivers. BL32/sp_min is invoked
for a single SCMI message processing and always returns with a
synchronous response message passed back to the caller agent.

This change fixes and updates STM32_COMMON_SIP_NUM_CALLS that was
previously wrongly set 4 whereas only 1 SiP SMC function ID was to
be counted. STM32_COMMON_SIP_NUM_CALLS is now set to 3 since the
2 added SiP SMC function IDs for SCMI services.

Change-Id: Icb428775856b9aec00538172aea4cf11e609b033
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Introduce helper functions stm32mp_register_secure_gpio() and
stm32mp_register_non_secure_gpio() for drivers to register a
GPIO pin as secure or non-secure.

These functions are stubbed when shared resource driver is not
embedded in the BL image so that drivers do not bother whether they
shall register or not their resources.

Change-Id: I1fe98576c072ae31f75427c9ac5c9f6c4f1b6ed1
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Introduce helper functions stm32mp_register_secure_periph_iomem()
and stm32mp_register_non_secure_periph_iomem() for drivers to
register a resource as secure or non-secure based on its SoC
interface registers base address.

These functions are stubbed when shared resources driver is not
embedded (!STM32MP_SHARED_RESOURCES) so that drivers embedded
in other BL stages do not bother whether they shall register or
not their resources.

Change-Id: Icebd05a930afc5964bc4677357da5d1b23666066
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Update implementation of stm32mp_nsec_can_access_reset() based
on the registering of the shared resources.

Querying registering state locks further registration of
peripherals.

Change-Id: I5f38f2a3481780b9a71939d95984c4821c537aa4
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Update implementation of stm32mp_nsec_can_access_clock() based
on the registering of the shared resources.

Querying registering state locks further registration of peripherals.

Change-Id: If68f6d4a52c4742ba66244c6ea2d9afa08404137
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Define helper functions stm32mp_register_secure_periph() and
stm32mp_register_non_secure_periph() for platform drivers to
register a shared resource assigned to respectively secure
or non-secure world.

Some resources are related to clock resources. When a resource is
registered as secure, ensure its clock dependencies are also
registered as secure. Registering a non-secure resource does not
mandate its clock dependencies are also registered as non-secure.

Change-Id: I74975be8976b8d3bf18dcc807541a072803af6e3
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Define from helper functions to get a human readable string
identifier from a shared resource enumerated ID. Use them to
make debug traces more friendly peripheral registering functions.

Change-Id: I9e207b8ce1d1e9250e242ca7e15461b9a1532f40
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Embed Arch Architecture SMCCC services in stm32mp1 SP_MIN. This
service is needed by Linux kernel to setup the SMCCC conduit
used by its SCMI SMC transport driver.

Change-Id: I454a7ef3048a77ab73fff945e8115b60445d5841
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

SCMI shared memory is used to exchange message payloads between
secure SCMI services and non-secure SCMI agents. It is mapped
uncached (device) mainly to conform to existing support in
the Linux kernel. Note that executive messages are mostly short
(few 32bit words) hence not using cache will not penalize much
performances.

Platform stm32mp1 shall configure ETZPC to harden properly the
secure and non-secure areas of the SYSRAM address space, that before
CPU accesses the shared memory when mapped non-secure.

This change defines STM32MP_SEC_SYSRAM_BASE/STM32MP_SEC_SYSRAM_SIZE and
STM32MP_NS_SYSRAM_BASE/STM32MP_NS_SYSRAM_SIZE.

Change-Id: I71ff02a359b9668ae1c5a71b5f102cf3d310f289
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

When using SP_min as monitor, only sp_min_warm_entrypoint() is a valid
secure entry point.

Change-Id: I440cec798e901b11a34dd482c33b2e378a8328ab
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>

Disable use of Neon VFP support for platform stm32mp1 when
building with SP_MIN runtime services as these can conflict with
non-secure world use of NEON support. This is preferred over a
systematic backup/restore of NEON context when switching
between non-secure and secure worlds.

When NEON support is disabled, this is done for both BL2 and BL32 as
build process uses common libraries built once for both binaries.

Change-Id: I4e8808dcb6ef58fc839e6f85fd6e45cfbaa34be0
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

BL32/SP_MIN configures platform security hardening from the shared
resources driver.  At the end of SP_MIN initialization, all shared
resources shall be assigned to secure or non-secure world by
drivers. A lock prevent from further change on the resource
assignation. By definition, resources not registered are assign
to non-secure world since not claimed by any component on the BL.

No functional change as all resources are currently in state
SHRES_UNREGISTERED hence assigned to non-secure world as prior
this change in stm32mp1_etzpc_early_setup() and
sp_min_platform_setup().

Change-Id: Ic41fab47216c3b8b7a6a75b8358cfcec411ed941
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Get number of pins in the GPIOZ bank with helper function
fdt_get_gpio_bank_pin_count(). Save the value in RAM to prevent
parsing the FDT several time for the same information.

Change-Id: Ie68e300804461ffce09914100a7d2962116023b5
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Define enum stm32mp_shres for platform stm32mp1. The enumerated
type defines all resources that can be assigned to secure or
non-secure worlds at run time for the platform.

Change-Id: I5de20d72735856645f1efd0993643278e8d35bcb
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

STM32MP1 SoC includes peripheral interfaces that can be assigned to
the secure world, or that can be opened to the non-secure world.

This change introduces the basics of a driver that manages such
resources which assignation is done at run time. It currently offers
API functions that state whether a service exposed to non-secure
world has permission to access a targeted clock or reset controller.

Change-Id: Iff20028f41586bc501085488c03546ffe31046d8
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Use ETZPC driver to configure secure aware interfaces to assign
them to non-secure world. Sp_min also configures BootROM resources
and SYSRAM to assign both to secure world only.

Define stm32mp15 SoC identifiers for the platform specific DECPROT
instances.

Change-Id: I3bec9f47b04bcba3929e4df886ddb1d5ff843089
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Changes stm32mp1 reset driver to API to add a timeout argument
to stm32mp_reset_assert() and stm32mp_reset_deassert() and
a return value.

With a supplied timeout, the functions wait the target reset state
is reached before returning. With a timeout of zero, the functions
simply load target reset state in SoC interface and return without
waiting.

Helper functions stm32mp_reset_set() and stm32mp_reset_release()
use a zero timeout and return without a return code.

This change updates few stm32 drivers and plat/stm32mp1 blé_plat_setup.c
accordingly without any functional change.
functional change.

Change-Id: Ia1a73a15125d3055fd8739c125b70bcb9562c27f
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

New helper functions to get GPIO banks configuration from the FDT.

stm32_get_gpio_bank_pinctrl_node() allows stm32mp platforms to
differentiate specific GPIO banks when these are defined with a specific
path in the FDT.

fdt_get_gpio_bank_pin_count() returns the number of pins in a GPIO bank
as it depends on the SoC variant.

Change-Id: I4481774152b3c6bf35bf986f58e357c2f9c19176
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

Relation between GPIO banks and their base address and offset address
if platform dependent. This change moves helper functions
stm32_get_gpio_bank_base() and stm32_get_gpio_bank_offset() from
plat/st/common to plat/st/stm32mp1/.

Change-Id: Id3d03e585746aa5509c6fab7d88183a92d561e3f
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>

The device tree parsing code for the STM32 platform is using its own FDT
helper functions, some of them being rather generic.
In particular the existing fdt_read_uint32_array() implementation is now
almost identical to the new generic code in fdt_wrappers.c, so we can
remove the ST specific version and adjust the existing callers.

Compared to the original ST implementation the new version takes a
pointer to the DTB as the first argument, and also swaps the order of
the number of cells and the pointer.

Change-Id: Id06b0f1ba4db1ad1f733be40e82c34f46638551a
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

Instead of using dt_get_ddr_size() and withdrawing the secure and shared
memory areas, use stm32mp_get_ddr_ns_size() function.

Change-Id: I5608fd7873589ea0e1262ba7d2ee3e52b53d9a7d
Signed-off-by: Yann Gautier <yann.gautier@st.com>

DTB and BL32 area should not be set as executable in MMU during BL2
execution, hence set those areas as MT_RO_DATA.

Change-Id: I87c47a1e7fda761e541ec98a5b294588384d31db
Signed-off-by: Yann Gautier <yann.gautier@st.com>

A speculative accesses to DDR could be done whereas it was not reachable
and could lead to bus stall.
To correct this the dynamic mapping in MMU is used.
A first mapping is done for DDR tests with MT_NON_CACHEABLE attribute,
once DDR access is setup. It is then unmapped and a new mapping DDR is done
with cacheable attribute (through MT_MEMORY) to speed-up BL33 (or OP-TEE)
load.

The disabling of cache during DDR tests is also removed, as now useless.
A call to new functions stm32mp_{,un}map_ddr_non_cacheable() is done
instead.

PLAT_XLAT_TABLES_DYNAMIC is activated globally as used in BL2 and BL32.

BL33 max size is also updated to take into account the secure and shared
memory areas. Those are used in OP-TEE case.

Change-Id: I22c48b4a48255ee264991c34ecbb15bfe87e67c3
Signed-off-by: Yann Gautier <yann.gautier@st.com>

This function gets the DDR size from DT, and withdraws (if defined) the
sizes of secure DDR and shared memory areas.
This function also checks DT values fits the default DDR range.
This non-secure memory is available for BL33 and non-secure OS.

Change-Id: I162ae5e990a0f9b6b7d07e539de029f1d61a391b
Signed-off-by: Yann Gautier <yann.gautier@st.com>

Board Support for the stm32mp1 platform is contained in the device tree,
so if we remove hardcoding of board name from the Makefile, we can build
the intermediary objects once and generate one new tf-a-*.stm32 binary
for every device tree specified. All in one go.

With implicit rules implemented, we only need to change the top level
target to support multi-image builds on the stm32mp1.

Change-Id: I4cae7d32a4c03a3c29c559dc5332e002223902c1
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Board Support for the stm32mp1 platform is contained in the device tree,
so if we remove hardcoding of board name from the Makefile, we can build
the intermediary objects once and generate one new tf-a-*.stm32 binary
for every device tree specified. All in one go.

Prepare for this by employing implicit rules.

Change-Id: I5a022a89eb12696cd8cee7bf28ac6be54849901f
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Doing this allows us in the next commit to use implicit rules (%-patterns)
to cover all the images we generate during a stm32mp1 build.

Change-Id: Ibde59d10ccce42566f82820117d7fd0d77345e6c
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

The linker script has no board-specific information that necessitates it
having a name derived from the board name. Give it a fixed name, so we
can later reuse the same linker script for multiple boards.

Change-Id: Ie6650f00389f4ab8577ae82a36c620af9c64101e
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Currently, building TF-A for STM32MP1 triggers a full rebuild,
avoid this by removing the .PHONY: specification for the final image and
replace it by specifying PHONYness for the targets that don't actually
produce file output.

This will come in handy in follow-up commits, when implicit rules are
introduced, as implicit rule search is skipped for .PHONY targets.

Change-Id: Ib9966479032b081a54123b99f889760e85639f19
Fixes: f74cbc93

 ("stm32mp1: Link BL2, BL32 and DTB in one binary")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

Since now the generic console_t structure holds the UART base address as
well, let's use that generic location and drop the UART driver specific
data structure at all.

Change-Id: Iea6ca26ff4903c33f0fad27fec96fdbabd4e0a91
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

This flag warns if anything is declared more than once in the same
scope, even in cases where multiple declaration is valid and changes
nothing.

Consequently, this patch also fixes the issues reported by this
flag. Consider the following two lines of code from two different source
files(bl_common.h and bl31_plat_setup.c):

IMPORT_SYM(uintptr_t, __RO_START__, BL_CODE_BASE);
IMPORT_SYM(unsigned long, __RO_START__, BL2_RO_BASE);

The IMPORT_SYM macro which actually imports a linker symbol as a C expression.
The macro defines the __RO_START__ as an extern variable twice, one for each
instance. __RO_START__ symbol is defined by the linker script to mark the start
of the Read-Only area of the memory map.

Essentially, the platform code redefines the linker symbol with a different
(relevant) name rather than using the standard symbol. A simple solution to
fix this issue in the platform code for redundant declarations warning is
to remove the second IMPORT_SYM and replace it with following assignment

static const unsigned long BL2_RO_BASE = BL_CODE_BASE;

Change-Id: If4835d1ee462d52b75e5afd2a59b64828707c5aa
Signed-off-by: Madhukar Pappireddy <madhukar.pappireddy@arm.com>

PLATFORM_CORE_COUNT - Unsigned int
PLATFORM_CLUSTER_COUNT - Unsigned int
PLATFORM_MAX_CPUS_PER_CLUSTER - Unsigned int
PLATFORM_CORE_COUNT_PER_CLUSTER - Unsigned int
Signed-off-by: Deepika Bhavnani <deepika.bhavnani@arm.com>
Change-Id: I3421336230981d4cda301fa2cef24b94b08353b1

STM32MP1 platform is able to boot from SPI-NOR devices.
These modifications add this support using the new
SPI-NOR framework.

Change-Id: I75ff9eba4661f9fb87ce24ced2bacbf8558ebe44
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>

STM32MP1 platform is able to boot from SPI-NAND devices.
These modifications add this support using the new
SPI-NAND framework.

Change-Id: I0d5448bdc4bde153c1209e8043846c0f935ae5ba
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>

STM32MP1 platform is able to boot from raw NAND devices.
These modifications add this support using the new
raw NAND framework.

Change-Id: I9e9c2b03930f98a5ac23f2b6b41945bef43e5043
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>

For STM32MP1, the address space is 4GB, which can be first divided
in 4 parts of 1GB. This LVL1 table is already mapped regardless
of MAX_XLAT_TABLES.
Fixing typo: Replace Ko to KB.

BL2/sp_min for platform STM32MP1 requires 4 MMU translation tables:
  - a level2 table and a level3 table for identity mapped SYSRAM
  - a level2 table mapping 2MB of BootROM runtime resources
  - a level2 table mapping 2MB of secure DDR (case BL32 is OP-TEE)

Change-Id: If80cbd4fccc7689b39dd540d6649b1313557f326
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>

Adds compilation flags to specify which drivers will be
embedded in the generated firmware.

Change-Id: Ie9decc89c3f26cf17e7148a3a4cf337fd35940f7
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>

Change the return code in boot_api.h which impacts the
authentication result.
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Change-Id: I2c3aadb98dd261ae5ad73978fc74a8a8cfa59b82
Reviewed-by: Yann GAUTIER <yann.gautier@st.com>

This commit adds authentication binary support for STM32MP1.
It prints the bootrom authentication result if signed
image is used and authenticates the next loaded STM32 images.
It also enables the dynamic translation table support
(PLAT_XLAT_TABLES_DYNAMIC) to use bootrom services.
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Change-Id: Iba706519e0dc6b6fae1f3dd498383351f0f75f51

This BSEC service is a platform specific service. Implementation
moved to the platform part.
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Change-Id: I1f70ed48a446860498ed111acce01187568538c9