refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A

refactor(console): disable getc() by default

The ability to read a character from the console constitutes an attack
vector into TF-A, as it gives attackers a means to inject arbitrary
data into TF-A. It is dangerous to keep that feature enabled if not
strictly necessary, especially in production firmware builds.

Thus, we need a way to disable this feature. Moreover, when it is
disabled, all related code should be eliminated from the firmware
binaries, such that no remnant/dead getc() code remains in memory,
which could otherwise be used as a gadget as part of a bigger security
attack.

This patch disables getc() feature by default. For legitimate getc()
use cases [1], it can be explicitly enabled by building TF-A with
ENABLE_CONSOLE_GETC=1.

The following changes are introduced when getc() is disabled:

- The multi-console framework no longer provides the console_getc()
function.

- If the console driver selected by the platform attempts to register
a getc() callback into the multi-console framework then TF-A will
now fail to build.

If registered through the assembly function finish_console_register():
- On AArch64, you'll get:
Error: undefined symbol CONSOLE_T_GETC used as an immediate value.
- On AArch32, you'll get:
Error: internal_relocation (type: OFFSET_IMM) not fixed up

If registered through the C function console_register(), this requires
populating a struct console with a getc field, which will trigger:
error: 'console_t' {aka 'struct console'} has no member named 'getc'

- All console drivers which previously registered a getc() callback
have been modified to do so only when ENABLE_CONSOLE_GETC=1.

[1] Example of such use cases would be:
- Firmware recovery: retrieving a golden BL2 image over the console in
order to repair a broken firmware on a bricked board.
- Factory CLI tool: Drive some soak tests through the console.

Discussed on TF-A mailing list here:
https://lists.trustedfirmware.org/archives/list/tf-a@lists.trustedfirmware.org/thread/YS7F6RCNTWBTEOBLAXIRTXWIOYINVRW7/

Change-Id: Icb412304cd23dbdd7662df7cf8992267b7975cc5
Signed-off-by: Sandrine Bailleux <sandrine.bailleux@arm.com>
Acked-by: Baruch Siach <baruch@tkos.co.il>

show more ...

fix(imx8m): map BL32 memory only if SPD_opteed or SPD_trusty is enabled

Always map the BL32 memory can interfere with the BL33 mapping if the
BL33 is not aware of the mapping, e.g. different memory

fix(imx8m): map BL32 memory only if SPD_opteed or SPD_trusty is enabled

Always map the BL32 memory can interfere with the BL33 mapping if the
BL33 is not aware of the mapping, e.g. different memory tagging
secure/non-secure. Therefore map the memory only if BL32 (opteed,
trusty) is enabled and BL33 is aware of this memory mapping.

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Change-Id: I9c2bf78aa6e88c93e749a9248724186fee9df864

show more ...

feat(imx8mn): add workaround for errata ERR050362

Port the workaround from the downstream imx-atf [1]:

| commit 1990081264f40822d1564f4562f05bbbc0c2941b
| Author: Ji Luo <ji.luo@nxp.com>
| Date:

feat(imx8mn): add workaround for errata ERR050362

Port the workaround from the downstream imx-atf [1]:

| commit 1990081264f40822d1564f4562f05bbbc0c2941b
| Author: Ji Luo <ji.luo@nxp.com>
| Date: Thu May 20 16:26:55 2021 +0800
|
| MA-19071 imx8mn: workaround for errata ERR050362
|
| Configure the force_incr programmable bit in GPV_5 of PL301_display,
| which fixes partial write issue. This workaround was done in MCU FW
| before, move it to TF-A now as MCU should not touch secure world.
|
| Change-Id: I2e5bbc764640afeab6ac2f4b202939b59bd3b3f2
| Signed-off-by: Ji Luo <ji.luo@nxp.com>

[1] https://github.com/nxp-imx/imx-atf.git

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Change-Id: Iaff5f1faa143204d64c075b288f8dd13eb2902d8

show more ...

feat(imx8m): enable snvs privileged registers access

Allow non-privileged access to all SNVS registers in case of no TEE is
available.

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Change-I

feat(imx8m): enable snvs privileged registers access

Allow non-privileged access to all SNVS registers in case of no TEE is
available.

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Change-Id: I44686a3639a68c72c7eacc80691c294d5c32c9ae

show more ...

chore: remove MULTI_CONSOLE_API references

MULTI_CONSOLE_API have been removed long time ago by commit 5b6ebeec9c99
("Remove MULTI_CONSOLE_API flag and references to it") that's why remove
reference

chore: remove MULTI_CONSOLE_API references

MULTI_CONSOLE_API have been removed long time ago by commit 5b6ebeec9c99
("Remove MULTI_CONSOLE_API flag and references to it") that's why remove
references in platform.mk files and also in one rst which is not valid
anymore.

Change-Id: I45f8e7db0a14ce63de62509100d8159b7aca2657
Signed-off-by: Michal Simek <michal.simek@amd.com>

show more ...

Merge "feat(imx8m): move the gpc reg & macro to a separate header file" into integration

feat(imx8m): move the gpc reg & macro to a separate header file

move the gpc reg offset, bit define & macro to a separate header
file for code reuse.

This fixes suspend to mem on i.MX8M Plus too, s

feat(imx8m): move the gpc reg & macro to a separate header file

move the gpc reg offset, bit define & macro to a separate header
file for code reuse.

This fixes suspend to mem on i.MX8M Plus too, since the register
layout is different there.

Change-Id: Ibec60c3a68ffa8c378de5334577a7b0e463ca875
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Signed-off-by: Marek Vasut <marex@denx.de> # Upgrade to latest, update commit message

show more ...

feat(imx8m): add more dram pll setting

Add DRAM PLL frequency setting for 3732mts & 3733mts.

Change-Id: I74feab2185376bbb84826d7ee79b5e25cbc4d263
Signed-off-by: Marek Vasut <marex@denx.de>

build(bl32): added check for AARCH32_SP

If AACRH32_SP is not specified, it causes the DEFAULT_LINKER_SCRIPT
variable to be empty, and then the linker takes the variable following
it as if it was the

build(bl32): added check for AARCH32_SP

If AACRH32_SP is not specified, it causes the DEFAULT_LINKER_SCRIPT
variable to be empty, and then the linker takes the variable following
it as if it was the linker script, which is not one. This patch
addresses that issue by requiring the AARCH32_SP variable to be set
before continuing.

Change-Id: I21db7d5bd86b98faaa1a1cd3f985daa592556a2d
Signed-off-by: Juan Pablo Conde <juanpablo.conde@arm.com>

show more ...

Merge changes from topic "mb/mb-signer-id" into integration

* changes:
feat(qemu): add dummy plat_mboot_measure_key() function
docs(rss): update RSS doc for signer-ID
feat(imx): add dummy 'pla

Merge changes from topic "mb/mb-signer-id" into integration

* changes:
feat(qemu): add dummy plat_mboot_measure_key() function
docs(rss): update RSS doc for signer-ID
feat(imx): add dummy 'plat_mboot_measure_key' function
feat(tc): implement platform function to measure and publish Public Key
feat(auth): measure and publicise the Public Key
feat(fvp): implement platform function to measure and publish Public Key
feat(fvp): add public key-OID information in RSS metadata structure
feat(auth): add explicit entries for key OIDs
feat(rss): set the signer-ID in the RSS metadata
feat(auth): create a zero-OID for Subject Public Key
docs: add details about plat_mboot_measure_key function
feat(measured-boot): introduce platform function to measure and publish Public Key

show more ...

fix(imx8m): make IMX_BOOT_UART_BASE autodetection option more obvious

Switch from IMX_BOOT_UART_BASE=0 to IMX_BOOT_UART_BASE=auto to make it
more obvious that the detection is based on the runtime a

fix(imx8m): make IMX_BOOT_UART_BASE autodetection option more obvious

Switch from IMX_BOOT_UART_BASE=0 to IMX_BOOT_UART_BASE=auto to make it
more obvious that the detection is based on the runtime autodetection.

In addition this moves the evaluation of IMX_BOOT_UART_BASE into the
makefile which removes the ugly conditional compilation as well.

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Change-Id: I92c13607bf81c6267f4b6aee829d74902b7f72d2

show more ...

feat(imx): add dummy 'plat_mboot_measure_key' function

Added dummy implementation of 'plat_mboot_measure_key'
function for IMX platform.

Change-Id: Ib41fd86a9da330f62561707bda7d16f2825c0a7f
Signed-

feat(imx): add dummy 'plat_mboot_measure_key' function

Added dummy implementation of 'plat_mboot_measure_key'
function for IMX platform.

Change-Id: Ib41fd86a9da330f62561707bda7d16f2825c0a7f
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>

show more ...

feat(imx8m): detect console base address during runtime

Provide a helper to detect the enabled UART device during runtime. This
lower the integration effort and make it more straight forward for
'si

feat(imx8m): detect console base address during runtime

Provide a helper to detect the enabled UART device during runtime. This
lower the integration effort and make it more straight forward for
'simple' use-cases with a single UART enabled. If multiple UARTs are
enabled the first enabled is returned.

The auto-detection is enabled by setting IMX_BOOT_UART_BASE=0 to keep
the backward compatibility. For more advanced use-cases (multiple UARTs
are enabled) the user still has to provide the correct base address.

Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Change-Id: I300a167e1a10f9aa991c8d1c3efe2c6b23f56c47

show more ...

feat(imx93): add OPTEE support

Add OPTEE support for imx93 platform.
Add support for the device tree overlay.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Signed-off-by: Jacky Bai <ping.bai

feat(imx93): add OPTEE support

Add OPTEE support for imx93 platform.
Add support for the device tree overlay.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Change-Id: I99c7819665f8f746b0dd7941fb83dbec9d8651de

show more ...

feat(imx93): protect OPTEE memory to secure access only

Configure TRDC_NIC MRC0 to protect OPTEE DDR memory to secure
access only from A55 cores and other peripherals' masters.

Signed-off-by: Ye Li

feat(imx93): protect OPTEE memory to secure access only

Configure TRDC_NIC MRC0 to protect OPTEE DDR memory to secure
access only from A55 cores and other peripherals' masters.

Signed-off-by: Ye Li <ye.li@nxp.com>
Reviewed-by: Jacky Bai <ping.bai@nxp.com>
Change-Id: Ie5363ecff67e3183fbde998a0bba93df4c099e1f

show more ...

feat(imx93): add cpuidle and basic suspend support

Add cpuidle and basic suspend support. For now only
core & cluster will be put into low power mode when
system suspend.

Signed-off-by: Jacky Bai <

feat(imx93): add cpuidle and basic suspend support

Add cpuidle and basic suspend support. For now only
core & cluster will be put into low power mode when
system suspend.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Change-Id: Ife0b6dc48738ae7a2322d6a7f6342ffe15d35342

show more ...

feat(imx93): add reset & poweroff support

Add system reset & system power off support on i.MX93.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Change-Id: Id180461541a1b3f73b2dc00c9cad33f484c145e6

feat(imx93): allow SoC masters access to system TCM

SoC masters should be allowed to access to system TCM. For example,
This makes it possible for M core to run ENET/ENET_QOS examples whose
DMA acce

feat(imx93): allow SoC masters access to system TCM

SoC masters should be allowed to access to system TCM. For example,
This makes it possible for M core to run ENET/ENET_QOS examples whose
DMA accesses system TCM in single boot mode.

Signed-off-by: Yangbo Lu <yangbo.lu@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Change-Id: I4149e047e49a66699015f92c25a7f5334a972835

show more ...

feat(imx93): update the ocram trdc config for did10

Update the ocram trdc config for DID10 to make sure NPU
can access the OCRAM. Need to fine tune the OCRAM config
in the future.

Signed-off-by: Ja

feat(imx93): update the ocram trdc config for did10

Update the ocram trdc config for DID10 to make sure NPU
can access the OCRAM. Need to fine tune the OCRAM config
in the future.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Change-Id: Iaa8518e0bea2c3939292202c116bd08444e07698

show more ...

feat(imx93): add the basic support

Add the basic boot support for i.MX93.

Signed-off-by: Jacky Bai <ping.bai@nxp.com>
Change-Id: I48bac2fd8bf2145133edf101a315908266c3f50a

fix(tree): correct some typos

found using codespell (https://github.com/codespell-project/codespell).

Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Change-Id: I1bfa797e3460adddeefa916bb68e22beddaf6

fix(tree): correct some typos

found using codespell (https://github.com/codespell-project/codespell).

Signed-off-by: Elyes Haouas <ehaouas@noos.fr>
Change-Id: I1bfa797e3460adddeefa916bb68e22beddaf6373

show more ...

feat(imx8): add support for debug uart on lpuart1

Needed for TQMa8Xx on MBa8Xx. With this changes it is
possible to build:

$ make PLAT=imx8qx IMX_DEBUG_UART=1 DEBUG_CONSOLE=1 bl31

Signed-off-by: M

feat(imx8): add support for debug uart on lpuart1

Needed for TQMa8Xx on MBa8Xx. With this changes it is
possible to build:

$ make PLAT=imx8qx IMX_DEBUG_UART=1 DEBUG_CONSOLE=1 bl31

Signed-off-by: Markus Niebel <Markus.Niebel@tq-group.com>
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Change-Id: If380845b254f30fe919ebb33c86130597c4b8ad3

show more ...

fix(imx8mq): fix compilation with gcc >= 12.x

Starting with GCC >= 12.x the -Wall option includes -Werror=array-bounds
checks. Per default GCC treats all memory accesses below 4096 as NULL,
so acces

fix(imx8mq): fix compilation with gcc >= 12.x

Starting with GCC >= 12.x the -Wall option includes -Werror=array-bounds
checks. Per default GCC treats all memory accesses below 4096 as NULL,
so access to ROMAPI causes the following warning:

------------
In file included from plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c:20:
In function 'mmio_read_8',
inlined from 'imx8mq_soc_info_init' at plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c:70:16,
inlined from 'bl31_platform_setup' at plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c:206:2:
include/lib/mmio.h:19:16: error: array subscript 0 is outside array bounds of 'volatile uint8_t[0]' {aka 'volatile unsigned char[]'} [-Werror=array-bounds]
19 | return *(volatile uint8_t*)addr;
| ^~~~~~~~~~~~~~~~~~~~~~~~
In function 'mmio_read_8',
inlined from 'imx8mq_soc_info_init' at plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c:74:16,
inlined from 'bl31_platform_setup' at plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c:206:2:
include/lib/mmio.h:19:16: error: array subscript 0 is outside array bounds of 'volatile uint8_t[0]' {aka 'volatile unsigned char[]'} [-Werror=array-bounds]
19 | return *(volatile uint8_t*)addr;
| ^~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
------------

This comes arguably from us somewhat abusing pointers to access MMIO
memory regions, which is not really covered by the C language.

Replace the pointer-dereferencing mmio_read_8() with an implementation
that uses inline assembly, to directly generate an 8-bit load
instruction. This avoids the compiler thinking that this access is using
a pointer it needs to jealously look after.

Change-Id: Iab39f6f615d51d3e8a1c54a1262d1e6ec208811d
Reported-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Andre Przywara <andre.przywara@arm.com>

show more ...

refactor(build): distinguish BL2 as TF-A entry point and BL2 running at EL3

BL2_AT_EL3 is an overloaded macro which has two uses:
1. When BL2 is entry point into TF-A(no BL1)
2. When BL2 is runnin

refactor(build): distinguish BL2 as TF-A entry point and BL2 running at EL3

BL2_AT_EL3 is an overloaded macro which has two uses:
1. When BL2 is entry point into TF-A(no BL1)
2. When BL2 is running at EL3 exception level
These two scenarios are not exactly same even though first implicitly
means second to be true. To distinguish between these two use cases we
introduce new macros.
BL2_AT_EL3 is renamed to RESET_TO_BL2 to better convey both 1. and 2.
Additional macro BL2_RUNS_AT_EL3 is added to cover all scenarious where
BL2 runs at EL3 (including four world systems).

BREAKING CHANGE: BL2_AT_EL3 renamed to RESET_TO_BL2 across the
repository.

Change-Id: I477e1d0f843b44b799c216670e028fcb3509fb72
Signed-off-by: Arvind Ram Prakash <arvind.ramprakash@arm.com>
Signed-off-by: Maksims Svecovs <maksims.svecovs@arm.com>

show more ...

Merge changes from topic "imx8m_misc_changes" into integration

* changes:
feat(imx8mq): enable dram dvfs support on imx8mq
feat(imx8m): use non-fast wakeup stop mode for system suspend
feat(im

Merge changes from topic "imx8m_misc_changes" into integration

* changes:
feat(imx8mq): enable dram dvfs support on imx8mq
feat(imx8m): use non-fast wakeup stop mode for system suspend
feat(imx8mq): correct the slot ack setting for STOP mode
feat(imx8mq): add anamix pll override setting for DSM mode
feat(imx8mq): add workaround code for ERR11171 on imx8mq
feat(imx8mq): add the dram retention support for imx8mq
feat(imx8mq): add version for B2
fix(imx8m): backup mr12/14 value from lpddr4 chip
fix(imx8m): add ddr4 dvfs sw workaround for ERR050712
fix(imx8m): fix coverity out of bound access issue
fix(imx8m): fix the dram retention random hang on some imx8mq Rev2.0
feat(imx8m): add more dram pll setting
fix(imx8m): fix the current fsp init
fix(imx8m): fix the rank to rank space issue
fix(imx8m): fix the dfiphymaster setting after dvfs
feat(imx8m): update the ddr4 dvfs flow to include ddr3l support
fix(imx8m): correct the rank info get fro mstr
feat(imx8m): fix the ddr4 dvfs random hang on imx8m

show more ...