1Qualcomm Snapdragon 410 (MSM8916/APQ8016) 2========================================= 3 4The `Qualcomm Snapdragon 410`_ is Qualcomm's first 64-bit SoC, released in 2014 5with four ARM Cortex-A53 cores. There are differents variants (MSM8916, 6APQ8016(E), ...) that are all very similar. A popular device based on APQ8016E 7is the `DragonBoard 410c`_ single-board computer, but the SoC is also used in 8various mid-range smartphones/tablets. 9 10The TF-A/BL31 port for MSM8916 provides a minimal, community-maintained 11EL3 firmware. It is primarily based on information from the public 12`Snapdragon 410E Technical Reference Manual`_ combined with a lot of 13trial and error to actually make it work. 14 15.. note:: 16 Unlike the :doc:`QTI SC7180/SC7280 <qti>` ports, this port does **not** 17 make use of a proprietary binary components (QTISECLIB). It is fully 18 open-source but therefore limited to publicly documented hardware 19 components. 20 21Functionality 22------------- 23 24The BL31 port is much more minimal compared to the original firmware and 25therefore expects the non-secure world (e.g. Linux) to manage more hardware, 26such as the SMMUs and all remote processors (RPM, WCNSS, Venus, Modem). 27Everything except modem is currently functional with a slightly modified version 28of mainline Linux. 29 30.. warning:: 31 This port is **not secure**. There is no special secure memory and the 32 used DRAM is available from both the non-secure and secure worlds. 33 Unfortunately, the hardware used for memory protection is not described 34 in the APQ8016E documentation. 35 36The port is primarily intended as a minimal PSCI implementation (without a 37separate secure world) where this limitation is not a big problem. Booting 38secondary CPU cores (PSCI ``CPU_ON``) is supported. Basic CPU core power 39management (``CPU_SUSPEND``) is functional but still work-in-progress and 40will be added later once ready. 41 42Boot Flow 43--------- 44BL31 replaces the original ``tz`` firmware in the boot flow:: 45 46 Boot ROM (PBL) -> SBL -> BL31 (EL3) -> U-Boot (EL2) -> Linux (EL2) 47 48By default, BL31 enters the non-secure world in EL2 AArch64 state at address 49``0x8f600000``. The original hypervisor firmware (``hyp``) is not used, you can 50use KVM or another hypervisor. The entry address is fixed in the BL31 binary 51but can be changed using the ``PRELOADED_BL33_BASE`` make file parameter. 52 53Using an AArch64 bootloader (such as `U-Boot for DragonBoard 410c`_) is 54recommended. AArch32 bootloaders (such as the original Little Kernel bootloader 55from Qualcomm) are not directly supported, although it is possible to use an EL2 56shim loader to temporarily switch to AArch32 state. 57 58Installation 59------------ 60First, setup the cross compiler for AArch64 and build TF-A for ``msm8916``:: 61 62 $ make CROSS_COMPILE=aarch64-linux-gnu- PLAT=msm8916 63 64The BL31 ELF image is generated in ``build/msm8916/release/bl31/bl31.elf``. 65This image must be "signed" before flashing it, even if the board has secure 66boot disabled. In this case the signature does not provide any security, 67but it provides the firmware with required metadata. 68 69The `DragonBoard 410c`_ does not have secure boot enabled by default. In this 70case you can simply sign the ELF image using a randomly generated key. You can 71use e.g. `qtestsign`_:: 72 73 $ ./qtestsign.py tz build/msm8916/release/bl31/bl31.elf 74 75Then install the resulting ``build/msm8916/release/bl31/bl31-test-signed.mbn`` 76to the ``tz`` partition on the device. BL31 should be running after a reboot. 77 78.. warning:: 79 Do not flash incorrectly signed firmware on devices that have secure 80 boot enabled! Make sure that you have a way to recover the board in case 81 of problems (e.g. using EDL). 82 83Boot Trace 84---------- 85BL31 prints some lines on the debug console UART2, which will usually look like 86this (with ``DEBUG=1``, otherwise only the ``NOTICE`` lines are shown):: 87 88 ... 89 S - DDR Frequency, 400 MHz 90 NOTICE: BL31: v2.6(debug):v2.6 91 NOTICE: BL31: Built : 20:00:00, Dec 01 2021 92 INFO: BL31: Platform setup start 93 INFO: ARM GICv2 driver initialized 94 INFO: BL31: Platform setup done 95 INFO: BL31: Initializing runtime services 96 INFO: BL31: cortex_a53: CPU workaround for 819472 was applied 97 INFO: BL31: cortex_a53: CPU workaround for 824069 was applied 98 INFO: BL31: cortex_a53: CPU workaround for 826319 was applied 99 INFO: BL31: cortex_a53: CPU workaround for 827319 was applied 100 INFO: BL31: cortex_a53: CPU workaround for 835769 was applied 101 INFO: BL31: cortex_a53: CPU workaround for disable_non_temporal_hint was applied 102 INFO: BL31: cortex_a53: CPU workaround for 843419 was applied 103 INFO: BL31: cortex_a53: CPU workaround for 1530924 was applied 104 INFO: BL31: Preparing for EL3 exit to normal world 105 INFO: Entry point address = 0x8f600000 106 INFO: SPSR = 0x3c9 107 108 U-Boot 2021.10 (Dec 01 2021 - 20:00:00 +0000) 109 Qualcomm-DragonBoard 410C 110 ... 111 112.. _Qualcomm Snapdragon 410: https://www.qualcomm.com/products/snapdragon-processors-410 113.. _DragonBoard 410c: https://www.96boards.org/product/dragonboard410c/ 114.. _Snapdragon 410E Technical Reference Manual: https://developer.qualcomm.com/download/sd410/snapdragon-410e-technical-reference-manual.pdf 115.. _U-Boot for DragonBoard 410c: https://u-boot.readthedocs.io/en/latest/board/qualcomm/dragonboard410c.html 116.. _qtestsign: https://github.com/msm8916-mainline/qtestsign 117