meta-nuvoton: npcm8xx-bootloader: update IGPS to 04.02.03HEADmaster

IGPS 04.02.03 - Oct 6th 2024
============
- TIP_FW 0.7.4 L0 0.6.3 L1:
  * BMC_DIRECT: add command BMC_DIRECT_COMMAND_FL_READ_PARMAS.
    If flash not connected return error.
  * WD1 init before uboot: currently disabled till uboot upgrade.
  * WD1 init before bootblock run.
  * When BMC reset - reload same FW (and not active image).
  * Skip FIU1 CS1 in flash init.
    Not supported as a valid boot address in TIP_ROM.
  * Disable LMS support.
  * Restore flash protection.
  * Clear alias key from PCI mailbox and shared attestation area.
  * Dismiss verify fail in non-secure device.
  * Temp: disable WD1 till uboot is ready.
  * Bug fix: set CS1 drive strength to support 50MHz (merge issue).

- bootblock 0.5.2
  * Bug fix: Errata fix: 1.7 eSPI FATAL_ERROR: Set ESPI_ESPI_ENG to 0x40
    (remove RMW to set bit 6).
  * Update CP init code (disabled by default, under SEARCH_CP_ON_FLASH_0 flag).
  * In case of traps and unexpected IRQs and FIQ: clear GIC registers.
  * In case of TRAP: notify TIP (TIP mode), or FSW (NO_TIP mode).
  * Update GIC driver and GIC table.

- Uboot:
  * Clear all gpio events
  * Change env and uImage flash address
  * Add stopwdt command in default environment

- LMS: changed (only for A2) that all images will be signed (if wanted)
  with skmt_lms_key2.

- OTP_Programmer_Monitor : 1.1.3 that can print the LMS keys full info
  (fix is needed for LMS users only).

- L0 version increment to 1.

Tested:
Build pass and boot up successful with correct BB/TIP FW latest version.

Signed-off-by: Tim Lee <timlee660101@gmail.com>
Change-Id: I2d88a964ceef71a55d04b0d483d0bfd258c1b1b4

1 files changed, 93 insertions, 0 deletions

diff --git a/meta-nuvoton/recipes-bsp/images/npcm8xx-bootloader_04.02.03.bb b/meta-nuvoton/recipes-bsp/images/npcm8xx-bootloader_04.02.03.bb
new file mode 100644
index 0000000000..60fe402b48
--- /dev/null
+++ b/meta-nuvoton/recipes-bsp/images/npcm8xx-bootloader_04.02.03.bb
@@ -0,0 +1,93 @@
+SUMMARY = "Nuvoton NPCM8XX bootloader"
+DESCRIPTION = "This is front end recipe for NPCM8XX IGPS. It replace \
+original IGPS recipe which need implement many redundant function in \
+recipe or class. After we add some hook in IGPS, now we can generate \
+full bootbloader by IGPS script. We only need collect all built images \
+from deploy folder, put them to IGPS input folder, and run script."
+HOMEPAGE = "https://github.com/Nuvoton-Israel/igps-npcm8xx"
+LICENSE = "GPL-2.0-only"
+LIC_FILES_CHKSUM = "file://LICENSE;md5=b234ee4d69f5fce4486a80fdaf4a4263"
+
+IGPS_BRANCH ?= "main"
+SRC_URI = " \
+    git://github.com/Nuvoton-Israel/igps-npcm8xx;branch=${IGPS_BRANCH};protocol=https \
+"
+SRCREV = "c36a02060f9f1cdb1382629bd1f54e43676bdebb"
+
+S = "${WORKDIR}/git"
+
+DEPENDS = "npcm7xx-bingo-native openssl-native"
+inherit obmc-phosphor-utils
+inherit python3native deploy
+FILE_FMT = "file://{}"
+
+# Sign keys, replace them for production
+IGPS_KEYS = ""
+# Configuration files, clean them if no need
+IGPS_CSVS = ""
+IGPS_SETTINGS = "settings.json"
+IGPS_CONFS = "${IGPS_KEYS} ${IGPS_CSVS} ${IGPS_SETTINGS}"
+SRC_URI += "${@compose_list(d, 'FILE_FMT', 'IGPS_CONFS')}"
+
+IGPS_SCRIPT_BASE = "${S}/py_scripts/ImageGeneration"
+BB_BIN = "arbel_a35_bootblock"
+BB_BIN .= "${@'_no_tip.bin' if d.getVar("TIP_IMAGE") != 'True' else '.bin'}"
+
+do_configure[dirs] = "${WORKDIR}"
+do_configure() {
+    KEY_FOLDER=${IGPS_SCRIPT_BASE}/keys/openssl
+    CSV_FOLDER=${IGPS_SCRIPT_BASE}/inputs/registers
+    # keys
+    install -d ${KEY_FOLDER}
+    if [ -n "${IGPS_KEYS}" ];then
+        cp -v ${IGPS_KEYS} ${KEY_FOLDER}
+    fi
+
+    # csv files
+    install -d ${CSV_FOLDER}
+    if [ -n "${IGPS_CSVS}" ];then
+        cp -v ${IGPS_CSVS} ${CSV_FOLDER}
+    fi
+
+    # change customized settings for XML and key setting
+    if [ -n "${IGPS_SETTINGS}" ];then
+        cd ${S}
+        python3 ${IGPS_SCRIPT_BASE}/config_replacer.py ${WORKDIR}/${IGPS_SETTINGS}
+    fi
+}
+
+do_compile[depends] += " \
+    npcm8xx-tip-fw:do_deploy npcm8xx-bootblock:do_deploy \
+    trusted-firmware-a:do_deploy optee-os:do_deploy \
+    u-boot-nuvoton:do_deploy"
+do_compile() {
+    # copy Openbmc built images
+    cd ${DEPLOY_DIR_IMAGE}
+    cp -v ${BB_BIN} bl31.bin tee.bin u-boot.bin ${IGPS_SCRIPT_BASE}/inputs
+
+    cd ${IGPS_SCRIPT_BASE}
+    install -d output_binaries/tmp
+    install -d inputs/key_input
+    if [ "${TIP_IMAGE}" = "True" ] || [ "${SA_TIP_IMAGE}" = "True" ];then
+      # Do not sign combo0 image again
+      python3 ${S}/py_scripts/GenerateAll.py openssl ${DEPLOY_DIR_IMAGE}
+    else
+      # for No TIP, we can run IGPS script directly
+      python3 ${S}/py_scripts/GenerateAll.py openssl
+    fi
+}
+
+do_deploy() {
+    OUT=${IGPS_SCRIPT_BASE}/output_binaries
+    BOOTLOADER=u-boot.bin.merged
+    install -d ${DEPLOYDIR}
+    if [ "${SA_TIP_IMAGE}" = "True" ];then
+        install -m 644 ${OUT}/Secure/image_no_tip_SA.bin ${DEPLOYDIR}/${BOOTLOADER}
+    elif [ "${TIP_IMAGE}" = "True" ];then
+        install -m 644 ${OUT}/Secure/Kmt_TipFwL0_Skmt_TipFwL1_BootBlock_BL31_Tee_uboot.bin ${DEPLOYDIR}/${BOOTLOADER}
+    else
+        install -m 644 ${OUT}/Basic/image_no_tip.bin ${DEPLOYDIR}/${BOOTLOADER}
+    fi
+}
+addtask deploy before do_build after do_compile
+PACKAGE_ARCH = "${MACHINE_ARCH}"