Add the support of the TRUSTED_BOARD_BOOT to authenticate the loaded
FIP using platform CoT management.
It adds TBB platform definition, redefining the standard image ID in
order to decrease requested size in BL2 binary.
Authentication will use mbedTLS library for parsing certificate
configured with a platform configuration.
Change-Id: I9da66b915c5e9e9293fccfce92bef2434da1e430
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Add the new definition field for authentication used in header V2
on STM32MP13.
Change-Id: Id8f0c2584ca9b74b0d21d82c9a98d286500548c4
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Remove old library access from ROM library that is no more
used.
Change-Id: I9b91f1efd6ff9d311b69ca36f60474f01268c221
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Remove deprecated authentication mode to use the FIP authentication
based on TBBR requirements. It will use the new crypto library.
Change-Id: I95c7baa64ba42c370ae136f59781f2a7a4c7f507
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Initialize RNG driver at platform level for STM32MP13.
Change-Id: I64832de43e5f6559a12e26680142db54c88f0b9e
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@foss.st.com>
Add the crypto library for STM32MP1 to use STM32 hardware
accelerators.
Change-Id: I0bbb941001242a6fdc47514ab3efe07b12249285
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Introduce new flag to manage hardware version.
STM32MP15 currently uses the HASH_V2 and STM32MP13 uses the HASH_V4.
For STM32_HASH_V4: remove MD5 algorithm (no more supported) and
add SHA384 and SHA512.
For STM32_HASH_V2: no change.
Change-Id: I3a9ae9e38249a2421c657232cb0877004d04dae1
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
The new helpers are created in STM32MP1 platform for prefetch and data
aborts.
While at it, put plat_report_exception() under DEBUG flag. If DEBUG is
not set, the weak function which does the same will be used.
This plat_report_exception() function can also be simplified, as it will
no more be used to report aborts.
Change-Id: Ibe989b28e236693f317cffb0545ea0611b7bdde4
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Allow early console to be used at the beginning of SP_min, before
the clocks and UART have been reconfigured.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I53d66938d42fcec830d9b81e5ef62b3790d0c3b3
The new flag STM32MP_RECONFIGURE_CONSOLE is managed in platform.mk.
It is used in stm32mp_setup_early_console() when calling
plat_crash_console_init(). This call is also under:
"#if defined(IMAGE_BL2)"
as this crash console init shouldn't be done by default in BL32.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: Ib6b89db83d80095b662a2016e18ceb3fa8668435
When a FIQ occurs and is trapped by SP_min, it is an unrecoverable
error. As kernel may have switched the UART console off, we should
re-enable it with plat_crash_console_init() for those failing states.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: Ib02e1271b6213f8e383a062b74494abf8826188f
Move the definition of DT_UART_COMPAT in stm32mp1_def.h to be used
in several files.
Change-Id: I74d0350bcd971df9b15697f2b9ec04061d6a7656
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
For product with 128MB DDR size, the OP-TEE is located at the end
of the DDR and the FIP can't be loaded at the default location
because it overlap the OP-TEE final location. So the default value
for DWL_BUFFER_BASE is invalid.
To avoid this conflict the serial boot load address = DWL_BUFFER_BASE
can be modified with a configuration flags.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Change-Id: Ie27b87c10c57fea5d4c6200ce4f624e775b9a080
Update the FIP load address and size for serial boot to support
product with a DDR size = 128MB
1/ Move the FIP location at the end of the first 128MB
2/ Reduce the DWL_BUFFER_SIZE to 16MB, to be coherent with the value
indicated in USB enumeration
- for STM32MP13x: "@SSBL /0x03/1*16Me"
- for STM32MP15x: "@Partition3 /0x03/1*16Me"
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Change-Id: Id93bf00c64832c17426bfd78e060861275677ecc
This patch adds two helper functions:
- plat_ic_raise_ns_sgi to raise a NS SGI
- plat_ic_raise_s_el1_sgi to raise a S-EL1 SGI
Signed-off-by: Florian Lugou <florian.lugou@provenrun.com>
Change-Id: I6f262dd1da1d77fec3f850eb74189e726b8e24da
Add an external parameter STM32MP_FORCE_MTD_START_OFFSET that allows to
override the default FIP offset used to read the first programmed image.
It can be used for NOR, RAW_NAND or SPI_NAND boot device.
Signed-off-by: Lionel Debieve <lionel.debieve@st.com>
Change-Id: Ibe664aae0e5ee90dd6629e544c9e034d751fffed
On STM32MP13, 2 OTP fuses can be used to configure NAND devices.
By default OTP CFG9 is used for sNAND. A new OTP (CFG10) is used
to configure raw NAND. Thanks to bit 0 of CFG10 OTP, this default
configuration can be switched.
For sNAND on STM32MP13, the NAND_PARAM_STORED_IN_OTP is not used.
The sNAND parameters have to be taken from OTP bits.
Change-Id: Ib95e0f9b9e66179a58b07f723ea01dce68b96475
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Override the default platform function to use an external buffer
on STM32MP13 platform.
It allows to use a temporary buffer located at the SRAM1 memory end.
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Change-Id: Ibd84bb336c60af24608268916b3a18bb5a0fa3db
The new SoC version for STM32MP13 is the revision Y. The register
SYSCFG_IDC is updated for this new version with the value 0x1003.
The function stm32mp_get_soc_name() should also be updated to manage
this new SoC revision.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I4f2fa5f1503f17db93d8413c79c2b7a18d279f9b
* changes:
feat(stm32mp1): retrieve FIP partition by type UUID
feat(guid-partition): allow to find partition by type UUID
refactor(stm32mp1): update PLAT_PARTITION_MAX_ENTRIES
On STM32MP13, USART1 and USART2 addresses are 0x4C000000 and 0x4C001000.
Whereas on STM32MP15, the addresses were 0x5C000000 and 0x4000E000.
Use dedicated flags to choose the correct address, that could be use
for early or crash console.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I98bd97a0ac8b0408a50376801e2a1961b241a3d6
U-Boot is loaded at the beginning of the DDR:
STM32MP_DDR_BASE = 0xC0000000.
This patch remove the need to use the 0x100000 offset, reserved
on STM32MP15 for flashlayout.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Change-Id: I8d0a93f4db411cf59838e635a315c729cccee269
Fix the maximum partition number to a default value. It must
also take care of the extra partition when FWU feature is enabled.
Change-Id: Ib64b1f19f1f0514f7e89d35fc367facd6df54bed
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>
On STM32MP15, there is currently an OP-TEE shared memory area at the end
of the DDR. But this area will in term be removed. To allow a smooth
transition, a new flag is added (STM32MP15_OPTEE_RSV_SHM). It reflects
the OP-TEE flag: CFG_CORE_RESERVED_SHM. The flag is enabled by default
(no behavior change). It will be set to 0 when OP-TEE is aligned, and
then later be removed.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I91146cd8a26a24be22143c212362294c1e880264
Introduce a functionality for saving/restoring boot auth status
and partition used for booting (FSBL partition on which the boot
was successful).
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
Change-Id: I4d7f153b70dfc49dad8c1c3fa71111a350caf1ee
STM32MP13 can encrypt the DDR. OP-TEE is then fully in DDR, and there
is no need for paged image on STM32MP13. The management of the paged
OP-TEE is made conditional, and will be kept only for STM32MP15.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I85ac7aaf6a172c4ee529736113ed40fe66835fd7
* changes:
feat(stm32mp1): extend STM32MP_EMMC_BOOT support to FIP format
refactor(mmc): replace magic value with new PART_CFG_BOOT_PARTITION_NO_ACCESS
refactor(mmc): export user/boot partition switch functions
Instead of searching pinctrl node with its name, search with its
compatible. This will be necessary before pin-controller name changes
to pinctrl due to kernel yaml changes.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I00590414fa65e193c6a72941a372bcecac673f60
STM32MP_EMMC_BOOT allowed placing SSBL into the eMMC boot
partition along with FSBL. This allows atomic update of both
FSBL and SSBL at the same time. Previously, this was only
possible for the FSBL, as the eMMC layout expected by TF-A
had a single SSBL GPT partition in the eMMC user area.
TEE binaries remained in dedicated GPT partitions whether
STM32MP_EMMC_BOOT was on or off.
The new FIP format collects SSBL and TEE partitions into
a single binary placed into a GPT partition.
Extend STM32MP_EMMC_BOOT, so eMMC-booted TF-A first uses
a FIP image placed at offset 256K into the active eMMC boot
partition. If no FIP magic is detected at that offset or if
STM32MP_EMMC_BOOT is disabled, the GPT on the eMMC user area
will be consulted as before.
This allows power fail-safe update of all firmware using the
built-in eMMC boot selector mechanism, provided it fits into
the boot partition - SZ_256K. SZ_256K was chosen because it's
the same offset used with the legacy format and because it's
the size of the on-chip SRAM, where the STM32MP15x BootROM
loads TF-A into. As such, TF-A may not exceed this size limit
for existing SoCs.
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Change-Id: Id7bec45652b3a289ca632d38d4b51316c5efdf8d
This change makes the necessary additions to makefile of
platforms using partition driver.
Signed-off-by: Rohit Ner <rohitner@google.com>
Change-Id: I66f6daaa0deac984b0aa5f2a182385410189ba8a
stm32mp1 platform build failed with the error [1] in the coverity, to
fix it included assert.h file.
Including bl32/sp_min/sp_min.mk
plat/st/stm32mp1/plat_image_load.c: In function
'plat_get_bl_image_load_info':
plat/st/stm32mp1/plat_image_load.c:30:2: error: implicit declaration of
function 'assert' [-Werror=implicit-function-declaration]
30 | assert(bl33 != NULL);
| ^~~~~~
plat/st/stm32mp1/plat_image_load.c:9:1: note: 'assert' is defined in
header '<assert.h>'; did you forget to '#include <assert.h>'?
8 | #include <plat/common/platform.h>
+++ |+#include <assert.h>
9 |
cc1: all warnings being treated as errors
Signed-off-by: Manish V Badarkhe <manish.badarkhe@arm.com>
Change-Id: I486bd695298798c05008158545668020babb3eca
The get_bl_mem_params_node() function could return NULL. Add asserts to
check the return value is not NULL.
This corrects coverity issues:
pager_mem_params = get_bl_mem_params_node(BL32_EXTRA1_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "pager_mem_params", which is known to be "NULL".
paged_mem_params = get_bl_mem_params_node(BL32_EXTRA2_IMAGE_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "paged_mem_params", which is known to be "NULL".
tos_fw_mem_params = get_bl_mem_params_node(TOS_FW_CONFIG_ID);
>>> CID 378360: (NULL_RETURNS)
>>> Dereferencing "tos_fw_mem_params", which is known to be "NULL".
Do the same for other occurrences of get_bl_mem_params_node() return not
checked, in the functions plat_get_bl_image_load_info() and
bl2_plat_handle_pre_image_load().
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I79165b1628fcee3da330f2db4ee5e1dafcb1b21f
Pass NS-load address as ~0UL to the 'set_config_info' function while
updating FW_CONFIG device tree information since it is always loaded
into secure memory.
Change-Id: Ieeaf9c97085128d7b7339d34495bdd58cd9fcf8a
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
Depending on the shell used, the grep command can fail, leading to
a wrong dtc version detection. Correct that by adding quotes.
Signed-off-by: Yann Gautier <yann.gautier@foss.st.com>
Change-Id: I329ec929559c94bf1bf99b127662c9d978e067cf
* changes:
refactor(stm32mp1-fdts): remove nvmem_layout node
refactor(stm32mp1): drop the "st,stm32-nvmem-layout" node
refactor(st): remove useless includes
In some implementations of dtc tool (e.g. with yocto), there can be a 'v'
at the beginning of the version, and a '+' at the end. Just keep numbers
then, with a grep -o.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I180e97ab75ba3e5ceacb4b1961a1f22788b428a3
If we reboot 3 times in trial mode, BL2 will select previous boot image.
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
Change-Id: I82b423cc84f0471fdb6fa7c393fc5fe411d25c06
Change the backup register used to store FWU parameters from 21 to 10.
This is chosen to have a Read/Write secure and Read non-secure register.
The mapping is also changed: only the first 4 bits will be used to store
the FWU index. The 4 next bits will be used to store count info. The
other bits are reserved.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@foss.st.com>
Change-Id: I9249768287ec5688ba2d8711ce04d429763543d7
Simplify the DT parsing by removing the parsing of the nvmem layout node
with "st,stm32-nvmem-layout" compatible.
The expected OTP NAME can directly be found in a sub-node named
NAME@ADDRESS of the BSEC node, the NVMEM provider node.
This patch also removes this specific binding introduced for TF-A.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Change-Id: Ic703385fad1bec5bef1cee583fbe9fbbf6aea216
To choose either STM32MP13 or STM32MP15, one of the two flags can be
set to 1 in the make command line. Or the platform selection can be
done with device tree name, if it begins with stm32mp13 or stm32mp15.
Change-Id: I72f42665c105b71a84b4952ef3fcd6c06ae4598c
Signed-off-by: Lionel Debieve <lionel.debieve@foss.st.com>
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Add dedicated device tree files for STM32MP13.
Add new DDR compatible for STM32MP13x.
Signed-off-by: Patrick Delaunay <patrick.delaunay@foss.st.com>
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
Change-Id: Ib1bb9ad8cb2ab9f5f81549635d6604093aeb99d3
Add new APIs to enter and exit "boot mode".
In this mode a potential tamper won't block access or reset
the secure IPs needed while boot, without this mode a dead
lock may occurs.
Change-Id: Iad60d4a0420ec125b842a285f73a20eb54cd1828
Signed-off-by: Nicolas Toromanoff <nicolas.toromanoff@st.com>
On STM32MP13, the high speed mode for pads in low voltage is different
from STM32MP15. Each peripheral supporting the feature has its own
register.
Special care is taken for SDMMC peripherals. The HSLV mode is enabled
only if the max voltage for the pads is lower or equal to 1.8V.
Change-Id: Id94d2cca17dd4aca4d764230a643b2bb9a5f3342
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Add DT_SDMMC2_COMPAT define in stm32mp1_def.h file in platform.
It allows the use of the compatible in platform code.
Change-Id: I535ad67dd133bab59cf81881adaef42d8e88632c
Signed-off-by: Yann Gautier <yann.gautier@st.com>
On STM32MP13, two new SD1 and SD2 IO compensations cells are added,
for SDMMC1 and SDMMC2. They have to be managed the same way as the
main compensation cell.
Change-Id: Ib7aa648d65fc98e1613bfb46b0e7dd568fd21002
Signed-off-by: Yann Gautier <yann.gautier@st.com>
The nominal voltage for VDDCPU when Cortex-A7 runs at 650MHz is 1.25V
on STM32MP13. VDDCORE should be set at 1.25V as well.
This is necessary, as the PMIC values in its NVMEM are 1.2V.
Signed-off-by: Yann Gautier <yann.gautier@st.com>
Change-Id: I3c24fe4cd68c7bf143cf9318ab38a15d6d41b5d2
This field is now declared on the 10 LSB bits on STM32MP13.
Several possible values are specified in the Reference Manual, and
indicate an open or closed device. Other values lead to a system panic.
Change-Id: I697124a21db66a56e7e223d601aa7cf44bb183c4
Signed-off-by: Nicolas Le Bayon <nicolas.le.bayon@st.com>
