The get_bl_mem_params_node() function could return NULL. Add asserts to
check the return value is not NULL.
This corrects coverity issues:
pager_mem_params = get_bl_mem_params_node(BL32_EXTRA1_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "pager_mem_params", which is known to be "NULL".
paged_mem_params = get_bl_mem_params_node(BL32_EXTRA2_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "paged_mem_params", which is known to be "NULL".
tos_fw_mem_params = get_bl_mem_params_node(TOS_FW_CONFIG_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "tos_fw_mem_params", which is known to be "NULL".
Do the same for other occurrences of get_bl_mem_params_node() return not
checked, in the functions plat_get_bl_image_load_info() and
bl2_plat_handle_pre_image_load().
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I79165b1628fcee3da330f2db4ee5e1dafcb1b21f
Pass NS-load address as ~0UL to the 'set_config_info' function while
updating FW_CONFIG device tree information since it is always loaded
into secure memory.
Change-Id: Ieeaf9c97085128d7b7339d34495bdd58cd9fcf8a
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
The nominal voltage for VDDCPU when Cortex-A7 runs at 650MHz is 1.25V
on STM32MP13. VDDCORE should be set at 1.25V as well.
This is necessary, as the PMIC values in its NVMEM are 1.2V.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I3c24fe4cd68c7bf143cf9318ab38a15d6d41b5d2
* GPIO: On STM32MP13, there are no banks GPIOJ, GPIOK and GPIOZ.
* STM32MP13 is a single Cortex-A7 CPU: remove reset from MPU1
and reset from MCU traces
* There is no MCU on STM32MP13. Put MCU security management
under STM32MP15 flag.
* The authentication feature is not supported yet on STM32MP13,
put the code under SPM32MP15 flag.
* On STM32MP13, the monotonic counter is managed in ROM code, keep
the monotonic counter update just for STM32MP15.
* SYSCFG: put registers not present on STM32MP13 under STM32MP15
flag, as the code that manages them.
* PMIC: use ldo3 during DDR configuration only for STM32MP15
* Reset UART pins on USB boot is no more required.
Change-Id: Iceba59484a9bb02828fe7e99f3ecafe69c837bc7
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Gabriel Fernandez <gabriel.fernandez@st.com>
Add an early UART console to ease debug before UART is fully configured.
This is done under flag STM32MP_EARLY_CONSOLE in the first STM32MP1
platform function called (bl2_el3_early_platform_setup()). It uses the
parameters defined for crash console: STM32MP_DEBUG_USART* macros.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: Id6be62368723a0499e97bbf56fb52c166fcbdfad
Add a banner that inform user that debug is enabled
on a secure chip.
Change-Id: Ib618ac1332b40a1af72d0b60750eea4fc36a8014
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>
STM32MP15xA and STM32MP15xD chip part numbers don't
support the secure boot.
All functions linked to secure boot must not be used
and signed binaries are not allowed on such chip.
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Change-Id: I5b85f322f5eb3b64415e1819bd00fb2c99f20695
The monotonic counter is stored in an OTP fuse.
A check is done in TF-A.
If the TF-A version is incremented, then the counter will be updated
in the corresponding OTP.
Change-Id: I6e7831300ca9efbb35b4c87706f2dcab35affacb
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Mathieu Belou <mathieu.belou@st.com>
Rename driver file to BSEC2.
Split header file in IP and feature parts.
Add functions to access BSEC scratch register.
Several corrections and improvements.
Probe the driver earlier, especially to check debug features.
Change-Id: I1981536398d598d67a19d2d7766dacc18de72ec1
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>
With the FWU Multi Bank update feature, the platform can boot from one
of multiple banks(partitions). Pass the value of bank from which the
platform has booted as boot index to the Update Agent. The Update
Agent will match this boot index value against the active_index field
in the metadata, and update the metadata if there is a mismatch.
Fow now, the mechanism to pass the boot index is platform specific. On
the STM32MP1 platform, the boot index value is passed through a
memorey mapped TAMP register on the SoC.
Signed-off-by: Sughosh Ganu <sughosh.ganu@linaro.org>
Change-Id: I0aa665ff9c1db95be8ae19ed8de6d866587d6850
Add enable_io_comp_cell and disable_io_comp_cell local helpers
to enable or disable an IO compensation cell.
Change-Id: I65295298a7ece572ae939e2db93d10b188de0f9e
Signed-off-by: Yann Gautier <yann.gautier@st.com>
On closed chips, it is not allowed to open debug. The BSEC debug
register can not be rewritten.
On open chips, the debug is already open, no need to rewrite this
register. This part of code is just removed.
An INFO message is displayed if debug is disabled.
The freeze of the watchdog during debug is also removed.
In case of debug, this must be managed by the software that enables
the debugger.
Change-Id: I19fbd3c487bb1018db30fd599cfa94fe5090899f
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
According to ST Application note AN5256 [1], the minimum reset pulse
duration should be set to 31ms on boards powered with discrete
regulators.
[1] https://www.st.com/resource/en/application_note/dm00561921.pdf
Change-Id: Ib6ed029ee8a4b95f75a80948fdd2154b4ebe484f
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
print_pmic_info_and_debug() prints the PMIC version ID and displays
regulator information if debug is enabled.
It is under DEBUG flag and called after initialize_pmic() in BL2.
Change-Id: Ib81a625740b7ec6abb49cfca05e44c69efaa4718
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
SYSCFG can be initialized later, after console is up, to display the
warnings or messages it could issue.
PMIC should be initialized earlier, before SYSCFG init.
Change-Id: Icc3a1366083a1b1fde7f0e173645449b4c04c49b
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Warnings about header files include order were triggered by CI.
Correct the include order to mathc CI requirements.
Change-Id: Iaca959add924e0e1fa2e56fab2348f0ee36e5fa7
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Protect the UART instance used for serial boot
with UART used for console.
Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com>
Change-Id: Ieee1557b34e7baa81594c3fbf0513191737027bf
Use newly created function stm32mp_uart_console_setup().
And remove now useless code.
Change-Id: Ib8d0319d3f4f54309848bc225b58608cea73bad9
Signed-off-by: Yann Gautier <yann.gautier@st.com>
The function stm32_save_boot_interface()is moved to stm32mp1_private.c
file. The files stm32mp1_context.{c,h} are removed.
As return is always 0, change the function to return void.
Call it earlier, to be able to use it when configuring console.
Change-Id: I8986e1257dc8e8708eab044a51ea1f2426b16597
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Those pins are configured by ROM code, for serial boot use cases.
Their configs are reset if the boot is done on UART, but not on USB.
This should then be done in TF-A. This has to be done after clock
init, and before console is configured.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I29a9694e25fcf1665360dd71f73937f769c43b52
Thanks to dyn_cfg_dtb_info_get_index(), we can check if TOS_FW_CONFIG
is inside the FIP partition. If not we can skip its treatment when
populating FIP images.
Change-Id: If5623eabd1ba484549d4a908d4a6f43325b36875
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Handle boot from UART with STM32CubeProgammer based on mmap io
for STM32MP15.
Depends-On: Iba84e8dfd67b9f30416efb0f6778e48ba1f75dad
Signed-off-by: Patrick Delaunay <patrick.delaunay@st.com>
Change-Id: Ibd719dd46a11da78633728675ef6639635b6cf67
Add a support of USB as serial boot devices for STM32MP15x platform:
the FIP file is provide by STM32CubeProgrammer with the DFU protocol,
loaded in DDR at DWL_BUFFER_BASE address and then the io memmap is used.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Change-Id: I272c17c458ff1e9d0780f8fa22330c8a35533d19
Add required code to support FCONF on STM32MP1 platform.
The new FW_CONFIG DT file will be inside the FIP, and loaded by BL2.
It will be used to configure the addresses where to load other binaries.
BL2 should be agnostic of which BL32 is in the FIP (OP-TEE or SP_min),
so optee_utils.c is always compiled, and some OP-TEE flags are removed.
Change-Id: Id957b49b0117864136250bfc416664f815043ada
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Instead of using a scratch buffer of 512 bytes, we can directly use the
image address and max size. The mmc_block_dev_spec struct info is then
overwritten for each image with this info, except FW_CONFIG and GPT
table which will still use the scratch buffer.
This allows using multiple blocks read on MMC, and so improves the boot
time.
A cache invalidate is required for the remaining data not used from the
first and last blocks read. It is not required for FW_CONFIG_ID,
as it is in scratch buffer in SYSRAM, and also because bl_mem_params
struct is overwritten in this case. This should also not be done if
the image is not found (OP-TEE extra binaries when using SP_min).
Change-Id: If3ecfdfe35bb9db66284036ca49c4bd1be4fd121
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
BL2 still uses the STM32 header binary format to be loaded from ROM code.
BL32 and BL33 and their respective device tree files are now put together
in a FIP file.
One DTB is created for each BL. To reduce their sizes, 2 new dtsi file are
in charge of removing useless nodes for a given BL. This is done because
BL2 and BL32 share the same device tree files base.
The previous way of booting is still available, the compilation flag
STM32MP_USE_STM32IMAGE has to be set to 1 in the make command. Some files
are duplicated and their names modified with _stm32_ to avoid too much
switches in the code.
Change-Id: I1ffada0af58486d4cf6044511b51e56b52269817
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Protect BL32 (SP_min) with MMU if OP-TEE is not used.
Validate OP-TEE header with optee_header_is_valid().
Use default values in bl2_mem_params_descs[]. They will be overwritten
in bl2_plat_handle_post_image_load() if OP-TEE is used.
Change-Id: I8614f3a17caa827561614d0f25f30ee90c4ec3fe
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Now that the DDR is mapped secured, the security settings (TZC400
firewall) have to be applied at the end of BL2 for the OP-TEE case.
This is required to avoid checskum computation error on U-Boot binary,
for which MMU and TZC400 would not be aligned.
Change-Id: I4a364f7117960e8fae1b579f341b9f140b766ea6
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
In BL2, the DDR can be mapped as secured in MMU, as no other SW
has access to it during its execution.
The TZC400 configuration is also updated to reflect this. When using
OP-TEE, the TZC400 is reconfigured at the end of BL2, to match OP-TEE
mapping. Else, SP_min will be in charge to reconfigure TZC400 to set
DDR non-secure.
Change-Id: Ic5ec614b218f733796feeab1cdc425d28cc7c103
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Device Tree address is now a parameter for dt_open_and_check() function.
This will allow better flexibility when introducing PIE and FIP.
The fdt pointer is now only assigned if the given address holds
a valid device tree file. This allows removing the fdt_checked variable,
as we now check fdt is not null.
Change-Id: I04cbb2fc05c9c711ae1c77d56368dbeb6dd4b01a
Signed-off-by: Yann Gautier <yann.gautier@st.com>
In order to prepare future support of FIP, BL32 (SP_min) is compiled
as Position Independent Executable.
Change-Id: I15e7cc433fb03e1833002f4fe2eaecb6ed42eb47
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Changes stm32mp1 reset driver to API to add a timeout argument
to stm32mp_reset_assert() and stm32mp_reset_deassert() and
a return value.
With a supplied timeout, the functions wait the target reset state
is reached before returning. With a timeout of zero, the functions
simply load target reset state in SoC interface and return without
waiting.
Helper functions stm32mp_reset_set() and stm32mp_reset_release()
use a zero timeout and return without a return code.
This change updates few stm32 drivers and plat/stm32mp1 blé_plat_setup.c
accordingly without any functional change.
functional change.
Change-Id: Ia1a73a15125d3055fd8739c125b70bcb9562c27f
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Instead of using dt_get_ddr_size() and withdrawing the secure and shared
memory areas, use stm32mp_get_ddr_ns_size() function.
Change-Id: I5608fd7873589ea0e1262ba7d2ee3e52b53d9a7d
Signed-off-by: Yann Gautier <yann.gautier@st.com>
DTB and BL32 area should not be set as executable in MMU during BL2
execution, hence set those areas as MT_RO_DATA.
Change-Id: I87c47a1e7fda761e541ec98a5b294588384d31db
Signed-off-by: Yann Gautier <yann.gautier@st.com>
A speculative accesses to DDR could be done whereas it was not reachable
and could lead to bus stall.
To correct this the dynamic mapping in MMU is used.
A first mapping is done for DDR tests with MT_NON_CACHEABLE attribute,
once DDR access is setup. It is then unmapped and a new mapping DDR is done
with cacheable attribute (through MT_MEMORY) to speed-up BL33 (or OP-TEE)
load.
The disabling of cache during DDR tests is also removed, as now useless.
A call to new functions stm32mp_{,un}map_ddr_non_cacheable() is done
instead.
PLAT_XLAT_TABLES_DYNAMIC is activated globally as used in BL2 and BL32.
BL33 max size is also updated to take into account the secure and shared
memory areas. Those are used in OP-TEE case.
Change-Id: I22c48b4a48255ee264991c34ecbb15bfe87e67c3
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Since now the generic console_t structure holds the UART base address as
well, let's use that generic location and drop the UART driver specific
data structure at all.
Change-Id: Iea6ca26ff4903c33f0fad27fec96fdbabd4e0a91
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
This commit adds authentication binary support for STM32MP1.
It prints the bootrom authentication result if signed
image is used and authenticates the next loaded STM32 images.
It also enables the dynamic translation table support
(PLAT_XLAT_TABLES_DYNAMIC) to use bootrom services.
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Change-Id: Iba706519e0dc6b6fae1f3dd498383351f0f75f51
The STM32 console driver was pre-pending '\r' before '\n'.
It is now managed by the framework with the flag:
CONSOLE_FLAG_TRANSLATE_CRLF.
Remove the code in driver, and add the flag for STM32MP1.
Change-Id: I5d0d5d5c4abee0b7dc11c2f8707b1b5cf10149ab
Signed-off-by: Yann Gautier <yann.gautier@st.com>
On STMicroelectronics boards, the board information is stored in OTP.
This OTP is described in device tree, in BSEC board_id node.
Change-Id: Ieccbdcb048343680faac8dc577b75c67ac106f5b
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
This information is located in DBGMCU registers.
Change-Id: I480aa046fed9992e3d9665b1f0520bc4b6cfdf30
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Introduce driver for STM32 IWDG peripheral (Independent Watchdog).
It is configured according to device tree content and should be enabled
from there.
The watchdog is not started by default. It can be started after an HW
reset if the dedicated OTP is fused.
The watchdog also needs to be frozen if a debugger is attached.
This is done by configuring the correct bits in DBGMCU.
This configuration is allowed by checking BSEC properties.
An increase of BL2 size is also required when adding this new code.
Change-Id: Ide7535d717885ce2f9c387cf17afd8b5607f3e7f
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
The system configuration controller is mainly used to manage
the compensation cell and other IOs and system related settings.
The SYSCFG driver is in charge of configuring masters on the interconnect,
IO compensation, low voltage boards, or pull-ups for boot pins.
All other configurations should be handled in Linux drivers requiring it.
Device tree files are also updated to manage vdd-supply regulator.
Change-Id: I10fb513761a7d1f2b7afedca9c723ad9d1bccf42
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Support booting OP-TEE as BL32 boot stage and secure runtime
service.
OP-TEE executes in internal RAM and uses a secure DDR area to store
the pager pagestore. Memory mapping and TZC are configured accordingly
prior OP-TEE boot. OP-TEE image is expected in OP-TEE v2 format where
a header file describes the effective boot images. This change
post processes header file content to get OP-TEE load addresses
and set OP-TEE boot arguments.
Change-Id: I02ef8b915e4be3e95b27029357d799d70e01cd44
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
STM32MP1 chip embeds a dual Cortex-A7 and a Cortex-M4.
The support for Cortex-M4 clocks is added when configuring the clock tree.
Some minimal security features to allow communications between A7 and M4
are also added.
Change-Id: I60417e244a476f60a2758f4969700b2684056665
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Remove useless private structure in function prototypes.
Add a reference counter on clocks.
Prepare for future secured/shared/non-secured clocks.
Change-Id: I3dbed81721da5ceff5e10b2c4155b1e340c036ee
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Signed-off-by: Nicolas LE BAYON <nicolas.le.bayon@st.com>
PWR, RCC, DDRPHYC & DDRCTRL addresses can be retrieved from device tree.
Platform asserts the value read from the DT are the SoC addresses.
Change-Id: I43f0890b51918a30c87ac067d3780ab27a0f59de
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Nicolas LE BAYON <nicolas.le.bayon@st.com>
Yann Gautier
Manish V Badarkhe
Lionel Debieve
Nicolas Le Bayon
Sughosh Ganu
Manish Pandey
Yann Gautier
Pascal Paillet
Madhukar Pappireddy
Patrick Delaunay
Etienne Carriere
Andre Przywara