ext qmsi: Update QMSI to 1.4 RC4

No major fixes since RC3 were made, and mostly the security fixes
for the Quark Bootloader were the main driver behind this new QMSI
Release Candidate.

There are no changes to shim drivers at this moment.

JIRA: ZEP-1572

Change-Id: I68d2b0ee90863d3def909de556314bd86712a059
Signed-off-by: Jesus Sanchez-Palencia <jesus.sanchez-palencia@intel.com>

4 files changed, 38 insertions, 11 deletions

diff --git a/ext/hal/qmsi/README b/ext/hal/qmsi/README
index 7f6dcb3bf..4c0245e88 100644
--- a/ext/hal/qmsi/README
+++ b/ext/hal/qmsi/README
@@ -8,7 +8,7 @@ Microcontroller products. It currently supports the following SoCs:
 - Intel® Quark™ D2000 Microcontroller
 - Intel® Quark™ SE Microcontroller
 
-The current version supported in Zephyr is QMSI 1.4 Release Candidate 3.
+The current version supported in Zephyr is QMSI 1.4 Release Candidate 4.
 See:
 
    https://github.com/quark-mcu/qmsi/releases
diff --git a/ext/hal/qmsi/soc/quark_d2000/include/qm_soc_regs.h b/ext/hal/qmsi/soc/quark_d2000/include/qm_soc_regs.h
index dbf81be5f..962a6a1a9 100644
--- a/ext/hal/qmsi/soc/quark_d2000/include/qm_soc_regs.h
+++ b/ext/hal/qmsi/soc/quark_d2000/include/qm_soc_regs.h
@@ -1340,13 +1340,13 @@ qm_mpr_reg_t test_mpr;
 
 #endif
 
-#define QM_MPR_RD_EN_OFFSET (20)
-#define QM_MPR_RD_EN_MASK 0x700000
-#define QM_MPR_WR_EN_OFFSET (24)
-#define QM_MPR_WR_EN_MASK 0x7000000
+#define QM_MPR_UP_BOUND_OFFSET (10)
+#define QM_MPR_WR_EN_OFFSET (20)
+#define QM_MPR_WR_EN_MASK 0x700000
+#define QM_MPR_RD_EN_OFFSET (24)
+#define QM_MPR_RD_EN_MASK 0x7000000
 #define QM_MPR_EN_LOCK_OFFSET (30)
 #define QM_MPR_EN_LOCK_MASK 0xC0000000
-#define QM_MPR_UP_BOUND_OFFSET (10)
 #define QM_MPR_VSTS_VALID BIT(31)
 
 /** @} */
diff --git a/ext/hal/qmsi/soc/quark_se/drivers/ss_init.c b/ext/hal/qmsi/soc/quark_se/drivers/ss_init.c
index 10d5834fc..d421b18c5 100644
--- a/ext/hal/qmsi/soc/quark_se/drivers/ss_init.c
+++ b/ext/hal/qmsi/soc/quark_se/drivers/ss_init.c
@@ -28,6 +28,7 @@
  */
 
 #include "ss_init.h"
+#include "qm_mpr.h"
 
 /* Sensor Subsystem application's pointer to the entry point (Flash0) */
 #define SS_APP_PTR_ADDR (0x40000000)
@@ -38,6 +39,26 @@ uint32_t __sensor_reset_vector[1];
 extern uint32_t __sensor_reset_vector[];
 #endif
 
+/* Set-up an MPR to protect ARC IVT (only ARC will have access to it). */
+static void sensor_vectors_protect(void)
+{
+	/*
+	 * MPR config:
+	 * - Enable and lock MPR
+	 * - Allow R/W access to ARC only
+	 * - Protect first kB of SRAM (i.e., where ARC IVT is located)
+	 */
+	static const qm_mpr_config_t cfg = {
+	    .en_lock_mask =
+		QM_SRAM_MPR_EN_MASK_ENABLE | QM_SRAM_MPR_EN_MASK_LOCK,
+	    .agent_read_en_mask = QM_SRAM_MPR_AGENT_MASK_SS,
+	    .agent_write_en_mask = QM_SRAM_MPR_AGENT_MASK_SS,
+	    .up_bound = 0,
+	    .low_bound = 0,
+	};
+	qm_mpr_set_config(QM_MPR_1, &cfg);
+}
+
 void sensor_activation(void)
 {
 	/* Write the ARC reset vector.
@@ -53,6 +74,9 @@ void sensor_activation(void)
 
 	*ss_reset_vector = *sensor_startup;
 
+	/* Set up an MPR to protect ARC IVT from other agents. */
+	sensor_vectors_protect();
+
 	/* Request ARC Run */
 	QM_SCSS_SS->ss_cfg |= QM_SS_CFG_ARC_RUN_REQ_A;
 }
diff --git a/ext/hal/qmsi/soc/quark_se/include/qm_soc_regs.h b/ext/hal/qmsi/soc/quark_se/include/qm_soc_regs.h
index 764db3262..33e01c88d 100644
--- a/ext/hal/qmsi/soc/quark_se/include/qm_soc_regs.h
+++ b/ext/hal/qmsi/soc/quark_se/include/qm_soc_regs.h
@@ -518,6 +518,9 @@ qm_scss_peripheral_reg_t test_scss_peripheral;
 #define QM_SCSS_PERIPHERAL ((qm_scss_peripheral_reg_t *)QM_SCSS_PERIPHERAL_BASE)
 #endif
 
+/* SS code protection region Lock bit. */
+#define QM_SCSS_CFG_LOCK_PROT_RANGE_LOCK BIT(10)
+
 /** @} */
 
 /**
@@ -1667,13 +1670,13 @@ qm_mpr_reg_t test_mpr;
 
 #endif
 
-#define QM_MPR_RD_EN_OFFSET (20)
-#define QM_MPR_RD_EN_MASK 0x700000
-#define QM_MPR_WR_EN_OFFSET (24)
-#define QM_MPR_WR_EN_MASK 0x7000000
+#define QM_MPR_UP_BOUND_OFFSET (10)
+#define QM_MPR_WR_EN_OFFSET (20)
+#define QM_MPR_WR_EN_MASK 0x700000
+#define QM_MPR_RD_EN_OFFSET (24)
+#define QM_MPR_RD_EN_MASK 0x7000000
 #define QM_MPR_EN_LOCK_OFFSET (30)
 #define QM_MPR_EN_LOCK_MASK 0xC0000000
-#define QM_MPR_UP_BOUND_OFFSET (10)
 #define QM_MPR_VSTS_VALID BIT(31)
 /** @} */