1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
|
Qualcomm MSM8916
================
The MSM8916 platform port in TF-A supports multiple similar Qualcomm SoCs:
+-----------------------+----------------+-------------------+-----------------+
| System-on-Chip (SoC) | TF-A Platform | Application CPU | Supports |
+=======================+================+===================+=================+
| `Snapdragon 410`_ |``PLAT=msm8916``| 4x ARM Cortex-A53 | AArch64/AArch32 |
| (MSM8x16, APQ8016(E)) | | | |
| (`DragonBoard 410c`_) | | | |
+-----------------------+----------------+-------------------+-----------------+
| `Snapdragon 615`_ |``PLAT=msm8939``| 4x ARM Cortex-A53 | AArch64/AArch32 |
| (MSM8x39, APQ8039) | | 4x ARM Cortex-A53 | |
+-----------------------+----------------+-------------------+-----------------+
| `Snapdragon 210`_ |``PLAT=msm8909``| 4x ARM Cortex-A7 | AArch32 only |
| (MSM8x09, APQ8009) | | | |
+-----------------------+----------------+-------------------+-----------------+
| `Snapdragon X5 Modem`_|``PLAT=mdm9607``| 1x ARM Cortex-A7 | AArch32 only |
| (MDM9x07) | | | |
+-----------------------+----------------+-------------------+-----------------+
It provides a minimal, community-maintained EL3 firmware and PSCI implementation,
based on information from the public `Snapdragon 410E Technical Reference Manual`_
combined with a lot of trial and error to actually make it work.
.. note::
Unlike the :doc:`QTI SC7180/SC7280 <qti>` ports, this port does **not**
make use of a proprietary binary components (QTISECLIB). It is fully
open-source but therefore limited to publicly documented hardware
components.
Functionality
-------------
The TF-A port is much more minimal compared to the original firmware and
therefore expects the non-secure world (e.g. Linux) to manage more hardware,
such as the SMMUs and all remote processors (RPM, WCNSS, Venus, Modem).
Everything except modem is currently functional with a slightly modified version
of mainline Linux.
.. warning::
This port is **not secure**. There is no special secure memory and the
used DRAM is available from both the non-secure and secure worlds.
Unfortunately, the hardware used for memory protection is not described
in the APQ8016E documentation.
The port is primarily intended as a minimal PSCI implementation (without a
separate secure world) where this limitation is not a big problem. Booting
secondary CPU cores (PSCI ``CPU_ON``) is supported. Basic CPU core power
management (``CPU_SUSPEND``) is functional but still work-in-progress and
will be added later once ready.
Boot Flow
---------
BL31 (AArch64) or BL32/SP_MIN (AArch32) replaces the original ``tz`` firmware
in the boot flow::
Boot ROM (PBL) -> SBL -> BL31 (EL3) -> U-Boot (EL2) -> Linux (EL2)
After initialization the normal world starts at a fixed entry address in EL2/HYP
mode, configured using ``PRELOADED_BL33_BASE``. At runtime, it is expected that
the normal world bootloader was already loaded into RAM by a previous firmware
component (usually SBL) and that it is capable of running in EL2/HYP mode.
`U-Boot for DragonBoard 410c`_ is recommended if possible. The original Little
Kernel-based bootloader from Qualcomm does not support EL2/HYP, but can be
booted using an additional shim loader such as `tfalkstub`_.
Build
-----
It is possible to build for either AArch64 or AArch32. Some platforms use 32-bit
CPUs that only support AArch32 (see table above). For all others AArch64 is the
preferred build option.
AArch64 (BL31)
^^^^^^^^^^^^^^
Setup the cross compiler for AArch64 and build BL31 for one of the platforms in
the table above::
$ make CROSS_COMPILE=aarch64-none-elf- PLAT=...
The BL31 ELF image is generated in ``build/$PLAT/release/bl31/bl31.elf``.
AArch32 (BL32/SP_MIN)
^^^^^^^^^^^^^^^^^^^^^
Setup the cross compiler for AArch32 and build BL32 with SP_MIN for one of the
platforms in the table above::
$ make CROSS_COMPILE=arm-none-eabi- PLAT=... ARCH=aarch32 AARCH32_SP=sp_min
The BL32 ELF image is generated in ``build/$PLAT/release/bl32/bl32.elf``.
Build Options
-------------
Some options can be changed at build time by adding them to the make command line:
* ``QTI_UART_NUM``: Number of UART controller to use for debug output and crash
reports. This must be the same UART as used by earlier boot firmware since
the UART controller does not get fully initialized at the moment. Defaults to
the usual debug UART used for the platform (see ``platform.mk``).
* ``QTI_RUNTIME_UART``: By default (``0``) the UART is only used for the boot
process and critical crashes. If set to ``1`` it is also used for runtime
messages. Note that this option can only be used if the UART is reserved in
the normal world and the necessary clocks remain enabled.
The memory region used for the different firmware components is not fixed and
can be changed on the make command line. The default values match the addresses
used by the original firmware (see ``platform.mk``):
* ``PRELOADED_BL33_BASE``: The entry address for the normal world. Usually
refers to the first bootloader (e.g. U-Boot).
* ``BL31_BASE``: Base address for the BL31 firmware component. Must point to
a 64K-aligned memory region with at least 128 KiB space that is permanently
reserved in the normal world.
* ``BL32_BASE``: Base address for the BL32 firmware component.
* **AArch32:** BL32 is used in place of BL31, so the option is equivalent to
``BL31_BASE``.
* **AArch64:** Secure-EL1 Payload. Defaults to using 128 KiB of space
directly after BL31. For testing only, the port is primarily intended as
a minimal PSCI implementation without a separate secure world.
Installation
------------
The ELF image must be "signed" before flashing it, even if the board has secure
boot disabled. In this case the signature does not provide any security,
but it provides the firmware with required metadata.
The `DragonBoard 410c`_ does not have secure boot enabled by default. In this
case you can simply sign the ELF image using a randomly generated key. You can
use e.g. `qtestsign`_::
$ ./qtestsign.py tz build/msm8916/release/bl31/bl31.elf
Then install the resulting ``build/msm8916/release/bl31/bl31-test-signed.mbn``
to the ``tz`` partition on the device. BL31 should be running after a reboot.
.. note::
On AArch32 the ELF image is called ``bl32.elf``.
The installation procedure is identical.
.. warning::
Do not flash incorrectly signed firmware on devices that have secure
boot enabled! Make sure that you have a way to recover the board in case
of problems (e.g. using EDL).
Boot Trace
----------
AArch64 (BL31)
^^^^^^^^^^^^^^
BL31 prints some lines on the debug console, which will usually look like this
(with ``DEBUG=1``, otherwise only the ``NOTICE`` lines are shown)::
...
S - DDR Frequency, 400 MHz
NOTICE: BL31: v2.6(debug):v2.6
NOTICE: BL31: Built : 20:00:00, Dec 01 2021
INFO: BL31: Platform setup start
INFO: ARM GICv2 driver initialized
INFO: BL31: Platform setup done
INFO: BL31: Initializing runtime services
INFO: BL31: cortex_a53: CPU workaround for 819472 was applied
INFO: BL31: cortex_a53: CPU workaround for 824069 was applied
INFO: BL31: cortex_a53: CPU workaround for 826319 was applied
INFO: BL31: cortex_a53: CPU workaround for 827319 was applied
INFO: BL31: cortex_a53: CPU workaround for 835769 was applied
INFO: BL31: cortex_a53: CPU workaround for disable_non_temporal_hint was applied
INFO: BL31: cortex_a53: CPU workaround for 843419 was applied
INFO: BL31: cortex_a53: CPU workaround for 1530924 was applied
INFO: BL31: Preparing for EL3 exit to normal world
INFO: Entry point address = 0x8f600000
INFO: SPSR = 0x3c9
U-Boot 2021.10 (Dec 01 2021 - 20:00:00 +0000)
Qualcomm-DragonBoard 410C
...
AArch32 (BL32/SP_MIN)
^^^^^^^^^^^^^^^^^^^^^
BL32/SP_MIN prints some lines on the debug console, which will usually look like
this (with ``DEBUG=1``, otherwise only the ``NOTICE`` lines are shown)::
...
S - DDR Frequency, 400 MHz
NOTICE: SP_MIN: v2.8(debug):v2.8
NOTICE: SP_MIN: Built : 23:03:31, Mar 31 2023
INFO: SP_MIN: Platform setup start
INFO: ARM GICv2 driver initialized
INFO: SP_MIN: Platform setup done
INFO: SP_MIN: Initializing runtime services
INFO: BL32: cortex_a53: CPU workaround for 819472 was applied
INFO: BL32: cortex_a53: CPU workaround for 824069 was applied
INFO: BL32: cortex_a53: CPU workaround for 826319 was applied
INFO: BL32: cortex_a53: CPU workaround for 827319 was applied
INFO: BL32: cortex_a53: CPU workaround for disable_non_temporal_hint was applied
INFO: SP_MIN: Preparing exit to normal world
INFO: Entry point address = 0x86400000
INFO: SPSR = 0x1da
Android Bootloader - UART_DM Initialized!!!
[0] welcome to lk
...
.. _Snapdragon 210: https://www.qualcomm.com/products/snapdragon-processors-210
.. _Snapdragon 410: https://www.qualcomm.com/products/snapdragon-processors-410
.. _Snapdragon 615: https://www.qualcomm.com/products/snapdragon-processors-615
.. _Snapdragon X5 Modem: https://www.qualcomm.com/products/snapdragon-modems-4g-lte-x5
.. _DragonBoard 410c: https://www.96boards.org/product/dragonboard410c/
.. _Snapdragon 410E Technical Reference Manual: https://developer.qualcomm.com/download/sd410/snapdragon-410e-technical-reference-manual.pdf
.. _U-Boot for DragonBoard 410c: https://u-boot.readthedocs.io/en/latest/board/qualcomm/dragonboard410c.html
.. _qtestsign: https://github.com/msm8916-mainline/qtestsign
.. _tfalkstub: https://github.com/msm8916-mainline/tfalkstub
|
