FWU: Add FWU Normal image(NS_BL1U) support to TFTF.

The Firmware Update(FWU) feature provides the capability to upgrade
a SoC firmware image from an external interface, such as NOR Flash,
to SoC NVM memories.

In order to carry on the above tasks both Normal and Secure world
FWU images co-operate with each other and complete the Firmware
Update process.

This patch adds support for FWU Normal image(NS_BL1U) to the TFTF
code base.

The tasks carried out by NS_BL1U are as following:
* Load FWU images from external NVM memory to NS RAM.
* Call SMC's to copy and authenticate images.
* Jump to NS_BL2U which carries out next FWU steps.

Change-Id: I59bc85e285cac523acd82706acf96a8f5f4360d6

4 files changed, 483 insertions, 0 deletions

diff --git a/fwu/ns_bl1u/aarch64/ns_bl1u_entrypoint.S b/fwu/ns_bl1u/aarch64/ns_bl1u_entrypoint.S
new file mode 100644
index 0000000..70048d8
--- /dev/null
+++ b/fwu/ns_bl1u/aarch64/ns_bl1u_entrypoint.S
@@ -0,0 +1,102 @@
+/*
+ * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <arch.h>
+#include <asm_macros.S>
+#include <tftf.h>
+
+
+	.globl	ns_bl1u_entrypoint
+
+func ns_bl1u_entrypoint
+	/* ---------------------------
+	 * Set the exception vectors
+	 * ---------------------------
+	 */
+	adr	x0, tftf_vector
+	asm_write_vbar_el1_or_el2 x1
+
+	/* --------------------------------------------------------------------
+	 * Enable the instruction cache, stack pointer and data access
+	 * alignment checks
+	 * --------------------------------------------------------------------
+	 */
+	mov	x1, #(SCTLR_I_BIT | SCTLR_A_BIT | SCTLR_SA_BIT)
+	asm_read_sctlr_el1_or_el2
+	orr	x0, x0, x1
+	asm_write_sctlr_el1_or_el2 x1
+	isb
+
+	/* ---------------------------------------------
+	 * Init C runtime environment.
+	 *   - Zero-initialise the NOBITS sections.
+	 *       - the .bss section;
+	 *   - Copy the data section from BL1 image
+	 *     (stored in ROM) to the correct location
+	 *     in RAM.
+	 * ---------------------------------------------
+	 */
+	ldr	x0, =__BSS_START__
+	ldr	x1, =__BSS_SIZE__
+	bl	zeromem16
+
+	ldr	x0, =__DATA_RAM_START__
+	ldr	x1, =__DATA_ROM_START__
+	ldr	x2, =__DATA_SIZE__
+	bl	memcpy16
+
+	/* --------------------------------------------
+	 * Allocate a stack whose memory will be marked
+	 * as Normal-IS-WBWA when the MMU is enabled.
+	 * There is no risk of reading stale stack
+	 * memory after enabling the MMU as only the
+	 * primary cpu is running at the moment.
+	 * --------------------------------------------
+	 */
+	mrs	x0, mpidr_el1
+	bl	platform_set_stack
+
+
+	/* ---------------------------------------------
+	* Perform early platform setup & platform
+	* specific early arch. setup e.g. mmu setup
+	* ---------------------------------------------
+	*/
+	bl	tftf_early_platform_setup
+	bl	tftf_plat_arch_setup
+
+	/* ---------------------------------------------
+	 * Jump to main function.
+	 * ---------------------------------------------
+	 */
+	bl	ns_bl1u_main
+dead:
+	b	dead
+endfunc ns_bl1u_entrypoint
diff --git a/fwu/ns_bl1u/ns_bl1u.ld.S b/fwu/ns_bl1u/ns_bl1u.ld.S
new file mode 100644
index 0000000..4f53eb4
--- /dev/null
+++ b/fwu/ns_bl1u/ns_bl1u.ld.S
@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <platform_def.h>
+
+OUTPUT_FORMAT(PLATFORM_LINKER_FORMAT)
+OUTPUT_ARCH(PLATFORM_LINKER_ARCH)
+ENTRY(ns_bl1u_entrypoint)
+
+MEMORY {
+    ROM (rx): ORIGIN = NS_BL1U_RO_BASE, LENGTH = NS_BL1U_RO_LIMIT - NS_BL1U_RO_BASE
+    RAM (rwx): ORIGIN = NS_BL1U_RW_BASE, LENGTH = NS_BL1U_RW_LIMIT - NS_BL1U_RW_BASE
+}
+
+SECTIONS
+{
+    . = NS_BL1U_RO_BASE;
+    ASSERT(. == ALIGN(4096),
+           "NS_BL1U_RO_BASE address is not aligned on a page boundary.")
+
+    ro . : {
+        __RO_START__ = .;
+        *ns_bl1u_entrypoint.o(.text*)
+        *(.text*)
+        *(.rodata*)
+        __RO_END__ = .;
+    } >ROM
+
+    /*
+     * The .data section gets copied from ROM to RAM at runtime.
+     * Its LMA must be 16-byte aligned.
+     * Its VMA must be page-aligned as it marks the first read/write page.
+     */
+    . = NS_BL1U_RW_BASE;
+    ASSERT(. == ALIGN(4096),
+           "NS_BL1U_RW_BASE address is not aligned on a page boundary.")
+    .data . : ALIGN(16) {
+        __DATA_RAM_START__ = .;
+        *(.data*)
+        __DATA_RAM_END__ = .;
+    } >RAM AT>ROM
+
+    stacks . (NOLOAD) : {
+        __STACKS_START__ = .;
+        *(ns_bl_normal_stacks)
+        __STACKS_END__ = .;
+    } >RAM
+
+    /*
+     * The .bss section gets initialised to 0 at runtime.
+     * Its base address must be 16-byte aligned.
+     */
+    .bss : ALIGN(16) {
+        __BSS_START__ = .;
+        *(SORT_BY_ALIGNMENT(.bss*))
+        *(COMMON)
+        __BSS_END__ = .;
+    } >RAM
+
+    /*
+     * The xlat_table section is for full, aligned page tables (4K).
+     * Removing them from .bss avoids forcing 4K alignment on
+     * the .bss section and eliminates the unecessary zero init
+     */
+    xlat_table (NOLOAD) : {
+        *(xlat_table)
+    } >RAM
+
+	/*
+	 * This is to avoid TFTF configuring
+	 * coherent memory for FWU BL images.
+	 */
+	__COHERENT_RAM_START__ = 0x0;
+	__COHERENT_RAM_END__ = 0x0;
+
+    __NS_BL1U_RAM_START__ = ADDR(.data);
+    __NS_BL1U_RAM_END__ = .;
+
+    __DATA_ROM_START__ = LOADADDR(.data);
+    __DATA_SIZE__ = SIZEOF(.data);
+
+    /*
+     * The .data section is the last PROGBITS section so its end marks the end
+     * of the read-only part of NS_BL1U's binary.
+     */
+    ASSERT(__DATA_ROM_START__ + __DATA_SIZE__ <= NS_BL1U_RO_LIMIT,
+           "NS_BL1U's RO section has exceeded its limit.")
+
+    __BSS_SIZE__ = SIZEOF(.bss);
+
+    ASSERT(. <= NS_BL1U_RW_LIMIT, "NS_BL1U's RW section has exceeded its limit.")
+}
diff --git a/fwu/ns_bl1u/ns_bl1u.mk b/fwu/ns_bl1u/ns_bl1u.mk
new file mode 100644
index 0000000..27fb377
--- /dev/null
+++ b/fwu/ns_bl1u/ns_bl1u.mk
@@ -0,0 +1,55 @@
+#
+# Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are met:
+#
+# Redistributions of source code must retain the above copyright notice, this
+# list of conditions and the following disclaimer.
+#
+# Redistributions in binary form must reproduce the above copyright notice,
+# this list of conditions and the following disclaimer in the documentation
+# and/or other materials provided with the distribution.
+#
+# Neither the name of ARM nor the names of its contributors may be used
+# to endorse or promote products derived from this software without specific
+# prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+# LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+# POSSIBILITY OF SUCH DAMAGE.
+#
+
+NS_BL1U_SOURCES	+=	drivers/io/io_fip.c			\
+			drivers/io/io_memmap.c				\
+			framework/aarch64/arch.c			\
+			framework/aarch64/asm_platform_weak.S		\
+			framework/aarch64/exceptions.S			\
+			framework/debug.c				\
+			fwu/ns_bl1u/aarch64/ns_bl1u_entrypoint.S	\
+			fwu/ns_bl1u/ns_bl1u_main.c			\
+			lib/aarch64/cache_helpers.S			\
+			lib/aarch64/misc_helpers.S			\
+			lib/aarch64/xlat_helpers.c			\
+			lib/aarch64/xlat_tables.c			\
+			lib/locks/spinlock.S				\
+			lib/smc/asm_smc.S				\
+			lib/smc/smc.c					\
+			lib/stdlib/std.c				\
+			lib/utils/mp_printf.c				\
+			lib/utils/uuid.c				\
+			plat/common/aarch64/plat_common.c		\
+			plat/common/aarch64/platform_helpers.S		\
+			plat/common/aarch64/platform_up_stack.S 	\
+			plat/common/arm_io_storage.c			\
+			plat/common/image_loader.c
+
+NS_BL1U_LINKERFILE	:=	fwu/ns_bl1u/ns_bl1u.ld.S
diff --git a/fwu/ns_bl1u/ns_bl1u_main.c b/fwu/ns_bl1u/ns_bl1u_main.c
new file mode 100644
index 0000000..42609bc
--- /dev/null
+++ b/fwu/ns_bl1u/ns_bl1u_main.c
@@ -0,0 +1,207 @@
+/*
+ * Copyright (c) 2015, ARM Limited and Contributors. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * Redistributions of source code must retain the above copyright notice, this
+ * list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of ARM nor the names of its contributors may be used
+ * to endorse or promote products derived from this software without specific
+ * prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <assert.h>
+#include <debug.h>
+#include <errno.h>
+#include <image_loader.h>
+#include <io_storage.h>
+#include <io_fip.h>
+#include <mmio.h>
+#include <nvm.h>
+#include <platform.h>
+#include <platform_def.h>
+#include <string.h>
+#include <tftf.h>
+#include <tftf_lib.h>
+
+#define FWU_NON_SECURE		(0x0)
+#define FWU_SECURE		(0x1)
+
+#define FWU_NON_EXEC		(0x0)
+#define FWU_EXEC		(0x1)
+
+/* This size is used to exercise partial copy */
+#define FWU_COPY_PARTIAL_SIZE		(0x10)
+
+extern const char version_string[];
+
+typedef void (*ns_bl2u_entrypoint_t)(unsigned long);
+
+/*
+ * This structure will be used for:
+ * 1. Assigning unique image identifier.
+ * 2. Assigning attribute to FWU image.
+ *    (FWU_NON_SECURE/FWU_SECURE)
+ *    (FWU_NON_EXEC/FWU_EXEC)
+ */
+typedef struct fwu_image_load_desc {
+	unsigned int image_id;
+	unsigned int secure;
+	unsigned int execute;
+} fwu_image_load_desc_t;
+
+static const fwu_image_load_desc_t ns_bl1u_desc[] = {
+	[0] = {
+		/* Initialize FWU_CERT image params */
+		.image_id = FWU_CERT_ID,
+		.secure = FWU_SECURE,
+	},
+	[1] = {
+		/*
+		 * Initialize SCP_BL2U image params
+		 * Not needed for FVP platform.
+		 */
+		.image_id = SCP_BL2U_IMAGE_ID,
+		.secure = FWU_SECURE,
+	},
+	[2] = {
+		/* Initialize BL2U image params */
+		.image_id = BL2U_IMAGE_ID,
+		.secure = FWU_SECURE,
+		.execute = FWU_EXEC
+	},
+	[3] = {
+		/* Initialize NS_BL2U image params */
+		.image_id = NS_BL2U_IMAGE_ID,
+	}
+};
+
+unsigned long smc_result;
+
+#define CHECK_SMC_RESULT(_r)		do {	\
+		if (smc_result != _r) {		\
+			ERROR("NS_BL1U: SMC call failed with result:%lu\n", smc_result);\
+			panic();		\
+		}		\
+	} while (0);
+
+void ns_bl1u_fwu_smc_call(unsigned int smc_id,
+			unsigned long x1,
+			unsigned long x2,
+			unsigned long x3,
+			unsigned long x4)
+{
+	smc64_ret_values fwu_result = {0};
+	smc64_args fwu_params = {smc_id, x1, x2, x3, x4};
+	fwu_result = tftf_smc64(&fwu_params);
+	smc_result = fwu_result.ret0;
+}
+
+/*******************************************************************************
+ * Following are the responsibilities of NS_BL1U image:
+ * Load FWU images from external NVM memory to NS RAM.
+ * Call SMC's to authenticate images.
+ * Jump to NS_BL2U which carries out next FWU steps.
+******************************************************************************/
+void ns_bl1u_main(void)
+{
+	int index;
+	unsigned int img_size;
+	int err;
+	unsigned long offset;
+	ns_bl2u_entrypoint_t ns_bl2u_entrypoint =
+			(ns_bl2u_entrypoint_t)NS_BL2U_BASE;
+	const fwu_image_load_desc_t *image_desc;
+
+	NOTICE("NS_BL1U: %s\n", version_string);
+	NOTICE("NS_BL1U: %s\n", build_message);
+
+	tftf_arch_setup();
+
+	plat_arm_io_setup();
+
+	for (index = 0; index < ARRAY_SIZE(ns_bl1u_desc); index++) {
+
+		image_desc = &ns_bl1u_desc[index];
+
+#if PLAT_fvp
+		/* Skip SCP_BL2U loading for FVP */
+		if (image_desc->image_id == SCP_BL2U_IMAGE_ID)
+			continue;
+#endif
+
+		INFO("NS_BL1U: Loading Image:%u\n", image_desc->image_id);
+
+		img_size = get_image_size(image_desc->image_id);
+		INFO("NS_BL1U: Image size = %d\n", img_size);
+
+		if (image_desc->secure == FWU_SECURE) {
+
+			offset = get_image_offset(image_desc->image_id);
+
+			INFO("NS_BL1U: Calling COPY SMC for partial copy\n");
+			ns_bl1u_fwu_smc_call(FWU_SMC_IMAGE_COPY, image_desc->image_id,
+				offset, FWU_COPY_PARTIAL_SIZE, img_size);
+			CHECK_SMC_RESULT(0);
+
+			ns_bl1u_fwu_smc_call(FWU_SMC_IMAGE_COPY, image_desc->image_id,
+				(offset + FWU_COPY_PARTIAL_SIZE),
+				(img_size - FWU_COPY_PARTIAL_SIZE), img_size);
+			CHECK_SMC_RESULT(0);
+		} else {
+			/* The only non-secure image in ns_bl1u_desc[] should be NS_BL2U */
+			assert(image_desc->image_id == NS_BL2U_IMAGE_ID);
+
+			err = load_image(image_desc->image_id, NS_BL2U_BASE);
+			if (err) {
+				ERROR("NS_BL1U: Failed to load NS_BL2U\n");
+				panic();
+			}
+			offset = NS_BL2U_BASE;
+		}
+
+		INFO("NS_BL1U: Calling AUTH SMC\n");
+		ns_bl1u_fwu_smc_call(FWU_SMC_IMAGE_AUTH, image_desc->image_id,
+				offset, img_size, 0);
+		CHECK_SMC_RESULT(0);
+
+		if (image_desc->execute == FWU_EXEC) {
+			INFO("NS_BL1U: Calling EXECUTE SMC\n");
+			ns_bl1u_fwu_smc_call(FWU_SMC_IMAGE_EXECUTE, image_desc->image_id,
+					0, 0, 0);
+			CHECK_SMC_RESULT(0);
+		}
+	}
+
+	/*
+	 * Clean and invalidate the caches.
+	 * And disable the MMU before jumping to NS_BL2U.
+	 */
+	disable_mmu_icache();
+
+	/*
+	 * The argument passed to NS_BL2U is not used currently.
+	 * But keeping the argument passing mechanism for future use.
+	 */
+	ns_bl2u_entrypoint(0);
+
+	panic();
+}