1Qualcomm MSM8916 2================ 3The MSM8916 platform port in TF-A supports multiple similar Qualcomm SoCs: 4 5+-----------------------+----------------+-------------------+-----------------+ 6| System-on-Chip (SoC) | TF-A Platform | Application CPU | Supports | 7+=======================+================+===================+=================+ 8| `Snapdragon 410`_ |``PLAT=msm8916``| 4x ARM Cortex-A53 | AArch64/AArch32 | 9| (MSM8x16, APQ8016(E)) | | | | 10| (`DragonBoard 410c`_) | | | | 11+-----------------------+----------------+-------------------+-----------------+ 12| `Snapdragon 615`_ |``PLAT=msm8939``| 4x ARM Cortex-A53 | AArch64/AArch32 | 13| (MSM8x39, APQ8039) | | 4x ARM Cortex-A53 | | 14+-----------------------+----------------+-------------------+-----------------+ 15| `Snapdragon 210`_ |``PLAT=msm8909``| 4x ARM Cortex-A7 | AArch32 only | 16| (MSM8x09, APQ8009) | | | | 17+-----------------------+----------------+-------------------+-----------------+ 18| `Snapdragon X5 Modem`_|``PLAT=mdm9607``| 1x ARM Cortex-A7 | AArch32 only | 19| (MDM9x07) | | | | 20+-----------------------+----------------+-------------------+-----------------+ 21 22It provides a minimal, community-maintained EL3 firmware and PSCI implementation, 23based on information from the public `Snapdragon 410E Technical Reference Manual`_ 24combined with a lot of trial and error to actually make it work. 25 26.. note:: 27 Unlike the :doc:`QTI SC7180/SC7280 <qti>` ports, this port does **not** 28 make use of a proprietary binary components (QTISECLIB). It is fully 29 open-source but therefore limited to publicly documented hardware 30 components. 31 32Functionality 33------------- 34The TF-A port is much more minimal compared to the original firmware and 35therefore expects the non-secure world (e.g. Linux) to manage more hardware, 36such as the SMMUs and all remote processors (RPM, WCNSS, Venus, Modem). 37Everything except modem is currently functional with a slightly modified version 38of mainline Linux. 39 40.. warning:: 41 This port is **not secure**. There is no special secure memory and the 42 used DRAM is available from both the non-secure and secure worlds. 43 Unfortunately, the hardware used for memory protection is not described 44 in the APQ8016E documentation. 45 46The port is primarily intended as a minimal PSCI implementation (without a 47separate secure world) where this limitation is not a big problem. Booting 48secondary CPU cores (PSCI ``CPU_ON``) is supported. Basic CPU core power 49management (``CPU_SUSPEND``) is functional but still work-in-progress and 50will be added later once ready. 51 52Boot Flow 53--------- 54BL31 (AArch64) or BL32/SP_MIN (AArch32) replaces the original ``tz`` firmware 55in the boot flow:: 56 57 Boot ROM (PBL) -> SBL -> BL31 (EL3) -> U-Boot (EL2) -> Linux (EL2) 58 59After initialization the normal world starts at a fixed entry address in EL2/HYP 60mode, configured using ``PRELOADED_BL33_BASE``. At runtime, it is expected that 61the normal world bootloader was already loaded into RAM by a previous firmware 62component (usually SBL) and that it is capable of running in EL2/HYP mode. 63 64`U-Boot for DragonBoard 410c`_ is recommended if possible. The original Little 65Kernel-based bootloader from Qualcomm does not support EL2/HYP, but can be 66booted using an additional shim loader such as `tfalkstub`_. 67 68Build 69----- 70It is possible to build for either AArch64 or AArch32. Some platforms use 32-bit 71CPUs that only support AArch32 (see table above). For all others AArch64 is the 72preferred build option. 73 74AArch64 (BL31) 75^^^^^^^^^^^^^^ 76Setup the cross compiler for AArch64 and build BL31 for one of the platforms in 77the table above:: 78 79 $ make CROSS_COMPILE=aarch64-none-elf- PLAT=... 80 81The BL31 ELF image is generated in ``build/$PLAT/release/bl31/bl31.elf``. 82 83AArch32 (BL32/SP_MIN) 84^^^^^^^^^^^^^^^^^^^^^ 85Setup the cross compiler for AArch32 and build BL32 with SP_MIN for one of the 86platforms in the table above:: 87 88 $ make CROSS_COMPILE=arm-none-eabi- PLAT=... ARCH=aarch32 AARCH32_SP=sp_min 89 90The BL32 ELF image is generated in ``build/$PLAT/release/bl32/bl32.elf``. 91 92Build Options 93------------- 94Some options can be changed at build time by adding them to the make command line: 95 96 * ``QTI_UART_NUM``: Number of UART controller to use for debug output and crash 97 reports. This must be the same UART as used by earlier boot firmware since 98 the UART controller does not get fully initialized at the moment. Defaults to 99 the usual debug UART used for the platform (see ``platform.mk``). 100 * ``QTI_RUNTIME_UART``: By default (``0``) the UART is only used for the boot 101 process and critical crashes. If set to ``1`` it is also used for runtime 102 messages. Note that this option can only be used if the UART is reserved in 103 the normal world and the necessary clocks remain enabled. 104 105The memory region used for the different firmware components is not fixed and 106can be changed on the make command line. The default values match the addresses 107used by the original firmware (see ``platform.mk``): 108 109 * ``PRELOADED_BL33_BASE``: The entry address for the normal world. Usually 110 refers to the first bootloader (e.g. U-Boot). 111 * ``BL31_BASE``: Base address for the BL31 firmware component. Must point to 112 a 64K-aligned memory region with at least 128 KiB space that is permanently 113 reserved in the normal world. 114 * ``BL32_BASE``: Base address for the BL32 firmware component. 115 116 * **AArch32:** BL32 is used in place of BL31, so the option is equivalent to 117 ``BL31_BASE``. 118 * **AArch64:** Secure-EL1 Payload. Defaults to using 128 KiB of space 119 directly after BL31. For testing only, the port is primarily intended as 120 a minimal PSCI implementation without a separate secure world. 121 122Installation 123------------ 124The ELF image must be "signed" before flashing it, even if the board has secure 125boot disabled. In this case the signature does not provide any security, 126but it provides the firmware with required metadata. 127 128The `DragonBoard 410c`_ does not have secure boot enabled by default. In this 129case you can simply sign the ELF image using a randomly generated key. You can 130use e.g. `qtestsign`_:: 131 132 $ ./qtestsign.py tz build/msm8916/release/bl31/bl31.elf 133 134Then install the resulting ``build/msm8916/release/bl31/bl31-test-signed.mbn`` 135to the ``tz`` partition on the device. BL31 should be running after a reboot. 136 137.. note:: 138 On AArch32 the ELF image is called ``bl32.elf``. 139 The installation procedure is identical. 140 141.. warning:: 142 Do not flash incorrectly signed firmware on devices that have secure 143 boot enabled! Make sure that you have a way to recover the board in case 144 of problems (e.g. using EDL). 145 146Boot Trace 147---------- 148 149AArch64 (BL31) 150^^^^^^^^^^^^^^ 151BL31 prints some lines on the debug console, which will usually look like this 152(with ``DEBUG=1``, otherwise only the ``NOTICE`` lines are shown):: 153 154 ... 155 S - DDR Frequency, 400 MHz 156 NOTICE: BL31: v2.6(debug):v2.6 157 NOTICE: BL31: Built : 20:00:00, Dec 01 2021 158 INFO: BL31: Platform setup start 159 INFO: ARM GICv2 driver initialized 160 INFO: BL31: Platform setup done 161 INFO: BL31: Initializing runtime services 162 INFO: BL31: cortex_a53: CPU workaround for 819472 was applied 163 INFO: BL31: cortex_a53: CPU workaround for 824069 was applied 164 INFO: BL31: cortex_a53: CPU workaround for 826319 was applied 165 INFO: BL31: cortex_a53: CPU workaround for 827319 was applied 166 INFO: BL31: cortex_a53: CPU workaround for 835769 was applied 167 INFO: BL31: cortex_a53: CPU workaround for disable_non_temporal_hint was applied 168 INFO: BL31: cortex_a53: CPU workaround for 843419 was applied 169 INFO: BL31: cortex_a53: CPU workaround for 1530924 was applied 170 INFO: BL31: Preparing for EL3 exit to normal world 171 INFO: Entry point address = 0x8f600000 172 INFO: SPSR = 0x3c9 173 174 U-Boot 2021.10 (Dec 01 2021 - 20:00:00 +0000) 175 Qualcomm-DragonBoard 410C 176 ... 177 178AArch32 (BL32/SP_MIN) 179^^^^^^^^^^^^^^^^^^^^^ 180BL32/SP_MIN prints some lines on the debug console, which will usually look like 181this (with ``DEBUG=1``, otherwise only the ``NOTICE`` lines are shown):: 182 183 ... 184 S - DDR Frequency, 400 MHz 185 NOTICE: SP_MIN: v2.8(debug):v2.8 186 NOTICE: SP_MIN: Built : 23:03:31, Mar 31 2023 187 INFO: SP_MIN: Platform setup start 188 INFO: ARM GICv2 driver initialized 189 INFO: SP_MIN: Platform setup done 190 INFO: SP_MIN: Initializing runtime services 191 INFO: BL32: cortex_a53: CPU workaround for 819472 was applied 192 INFO: BL32: cortex_a53: CPU workaround for 824069 was applied 193 INFO: BL32: cortex_a53: CPU workaround for 826319 was applied 194 INFO: BL32: cortex_a53: CPU workaround for 827319 was applied 195 INFO: BL32: cortex_a53: CPU workaround for disable_non_temporal_hint was applied 196 INFO: SP_MIN: Preparing exit to normal world 197 INFO: Entry point address = 0x86400000 198 INFO: SPSR = 0x1da 199 Android Bootloader - UART_DM Initialized!!! 200 [0] welcome to lk 201 ... 202 203.. _Snapdragon 210: https://www.qualcomm.com/products/snapdragon-processors-210 204.. _Snapdragon 410: https://www.qualcomm.com/products/snapdragon-processors-410 205.. _Snapdragon 615: https://www.qualcomm.com/products/snapdragon-processors-615 206.. _Snapdragon X5 Modem: https://www.qualcomm.com/products/snapdragon-modems-4g-lte-x5 207.. _DragonBoard 410c: https://www.96boards.org/product/dragonboard410c/ 208.. _Snapdragon 410E Technical Reference Manual: https://developer.qualcomm.com/download/sd410/snapdragon-410e-technical-reference-manual.pdf 209.. _U-Boot for DragonBoard 410c: https://u-boot.readthedocs.io/en/latest/board/qualcomm/dragonboard410c.html 210.. _qtestsign: https://github.com/msm8916-mainline/qtestsign 211.. _tfalkstub: https://github.com/msm8916-mainline/tfalkstub 212