February 2015 - U-Boot

[U-Boot] [PATCH v1 1/1] fastboot: oem format command implementation
by Dileep Katta 09 Feb '15

09 Feb '15

This is the Modified version of http://patchwork.ozlabs.org/patch/388084/ - As flash support is already in mainline, it is removed - 'oem' command support is present - 'oem format' command is implemented - Handled review comments of the original patch Signed-off-by: Dileep Katta <dileep.katta(a)linaro.org> --- common/cmd_fastboot.c | 4 + common/cmd_mmc.c | 2 +- disk/Makefile | 1 + disk/part_fastboot.c | 363 ++++++++++++++++++++++++++++++++++++++++ doc/README.android-fastboot | 5 +- drivers/usb/gadget/f_fastboot.c | 85 ++++++++++ include/usb/fastboot.h | 108 ++++++++++++ 7 files changed, 564 insertions(+), 4 deletions(-) create mode 100644 disk/part_fastboot.c create mode 100644 include/usb/fastboot.h diff --git a/common/cmd_fastboot.c b/common/cmd_fastboot.c index b72f4f3..efdf461 100644 --- a/common/cmd_fastboot.c +++ b/common/cmd_fastboot.c @@ -10,12 +10,16 @@ #include <common.h> #include <command.h> #include <g_dnl.h> +#include <usb/fastboot.h> static int do_fastboot(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[]) { int ret; g_dnl_clear_detach(); +#ifdef CONFIG_FASTBOOT_FLASH_MMC_DEV + board_partition_init(); +#endif ret = g_dnl_register("usb_dnl_fastboot"); if (ret) return ret; diff --git a/common/cmd_mmc.c b/common/cmd_mmc.c index 4e28c9d..0ce747b 100644 --- a/common/cmd_mmc.c +++ b/common/cmd_mmc.c @@ -809,7 +809,7 @@ static cmd_tbl_t cmd_mmc[] = { U_BOOT_CMD_MKENT(setdsr, 2, 0, do_mmc_setdsr, "", ""), }; -static int do_mmcops(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) +int do_mmcops(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { cmd_tbl_t *cp; diff --git a/disk/Makefile b/disk/Makefile index 6970cec..4969656 100644 --- a/disk/Makefile +++ b/disk/Makefile @@ -13,3 +13,4 @@ obj-$(CONFIG_DOS_PARTITION) += part_dos.o obj-$(CONFIG_ISO_PARTITION) += part_iso.o obj-$(CONFIG_AMIGA_PARTITION) += part_amiga.o obj-$(CONFIG_EFI_PARTITION) += part_efi.o +obj-$(CONFIG_FASTBOOT_FLASH_MMC_DEV) +=part_fastboot.o diff --git a/disk/part_fastboot.c b/disk/part_fastboot.c new file mode 100644 index 0000000..adf37af --- /dev/null +++ b/disk/part_fastboot.c @@ -0,0 +1,363 @@ +/* + * Copyright (C) 2013 Texas Instruments + * + * Author : Pankaj Bharadiya <pankaj.bharadiya(a)ti.com> + * + * Tom Rix <Tom.Rix(a)windriver.com> and Sitara 2011 u-boot by + * Mohammed Afzal M A <afzal(a)ti.com> + * + * Copyright (C) 2008 The Android Open Source Project + * All rights reserved. + * + * Copyright 2014 Linaro, Ltd. + * Dileep Katta <dileep.katta(a)linaro.org> + * + * SPDX-License-Identifier: GPL-2.0+ + */ + +#include <common.h> +#include <command.h> +#include <usb/fastboot.h> +#include <linux/usb/ch9.h> +#include <linux/usb/gadget.h> +#include <environment.h> +#include <mmc.h> +#include <dfu.h> +#include <asm/arch/mmc_host_def.h> + +#define EFI_VERSION 0x00010000 +#define EFI_ENTRIES 128 +#define EFI_NAMELEN 36 + +struct partition_emmc { + const char *name; + unsigned size_kb; +}; + +/* eMMC partition layout (All sizes are in kB) + * Modify the below partition table to change the GPT configuration. + * The entry for each partition can be modified as per the requirement. + */ +static struct partition_emmc partitions[] = { + { "-", 128 }, /* Master Boot Record and GUID Partition Table */ + { "spl", 128 }, /* First stage bootloader */ + { "bootloader", 512 }, /* Second stage bootloader */ + { "misc", 128 }, /* Rserved for internal purpose */ + { "-", 128 }, /* Reserved */ + { "recovery", 8*1024 }, /* Recovery partition */ + { "boot", 8*1024 }, /* Partition contains kernel + ramdisk images */ + { "system", 256*1024 }, /* Android file system */ + { "cache", 256*1024 }, /* Store Application Cache */ + { "userdata", 256*1024 }, /* User data */ + { "media", 0 }, /* Media files */ + { 0, 0 }, +}; + + +static const u8 partition_type[16] = { + 0xa2, 0xa0, 0xd0, 0xeb, 0xe5, 0xb9, 0x33, 0x44, + 0x87, 0xc0, 0x68, 0xb6, 0xb7, 0x26, 0x99, 0xc7, +}; + +static const u8 random_uuid[16] = { + 0xff, 0x1f, 0xf2, 0xf9, 0xd4, 0xa8, 0x0e, 0x5f, + 0x97, 0x46, 0x59, 0x48, 0x69, 0xae, 0xc3, 0x4e, +}; + +struct efi_entry { + u8 type_uuid[16]; + u8 uniq_uuid[16]; + u64 first_lba; + u64 last_lba; + u64 attr; + u16 name[EFI_NAMELEN]; +}; + +struct efi_header { + u8 magic[8]; + + u32 version; + u32 header_sz; + + u32 crc32; + u32 reserved; + + u64 header_lba; + u64 backup_lba; + u64 first_lba; + u64 last_lba; + + u8 volume_uuid[16]; + + u64 entries_lba; + + u32 entries_count; + u32 entries_size; + u32 entries_crc32; +} __packed; + +struct ptable { + u8 mbr[512]; + union { + struct efi_header header; + u8 block[512]; + }; + struct efi_entry entry[EFI_ENTRIES]; +}; + +static void init_mbr(u8 *mbr, u32 blocks) +{ + mbr[0x1be] = 0x00; /* nonbootable */ + mbr[0x1bf] = 0xFF; /* bogus CHS */ + mbr[0x1c0] = 0xFF; + mbr[0x1c1] = 0xFF; + + mbr[0x1c2] = 0xEE; /* GPT partition */ + mbr[0x1c3] = 0xFF; /* bogus CHS */ + mbr[0x1c4] = 0xFF; + mbr[0x1c5] = 0xFF; + + mbr[0x1c6] = 0x01; /* start */ + mbr[0x1c7] = 0x00; + mbr[0x1c8] = 0x00; + mbr[0x1c9] = 0x00; + + memcpy(mbr + 0x1ca, &blocks, sizeof(u32)); + + mbr[0x1fe] = 0x55; + mbr[0x1ff] = 0xaa; +} + + +static void start_ptbl(struct ptable *ptbl, unsigned blocks) +{ + struct efi_header *hdr = &ptbl->header; + + memset(ptbl, 0, sizeof(*ptbl)); + + init_mbr(ptbl->mbr, blocks - 1); + + memcpy(hdr->magic, "EFI PART", 8); + hdr->version = EFI_VERSION; + hdr->header_sz = sizeof(struct efi_header); + hdr->header_lba = 1; + hdr->backup_lba = blocks - 1; + hdr->first_lba = 34; + hdr->last_lba = blocks - 1; + memcpy(hdr->volume_uuid, random_uuid, 16); + hdr->entries_lba = 2; + hdr->entries_count = EFI_ENTRIES; + hdr->entries_size = sizeof(struct efi_entry); +} + +static void end_ptbl(struct ptable *ptbl) +{ + struct efi_header *hdr = &ptbl->header; + u32 n; + + /* Get the initial checksum by passing buf as NULL */ + n = crc32(0, NULL, 0); + n = crc32(n, (void *)ptbl->entry, sizeof(ptbl->entry)); + hdr->entries_crc32 = n; + + n = crc32(0, (void *)&ptbl->header, sizeof(ptbl->header)); + hdr->crc32 = n; +} + +int add_ptn(struct ptable *ptbl, u64 first, u64 last, const char *name) +{ + struct efi_header *hdr = &ptbl->header; + struct efi_entry *entry = ptbl->entry; + unsigned n; + + if (first < 34) { + printf("partition '%s' overlaps partition table\n", name); + return -1; + } + + if (last > hdr->last_lba) { + printf("partition '%s' does not fit\n", name); + return -1; + } + for (n = 0; n < EFI_ENTRIES; n++, entry++) { + if (entry->last_lba) + continue; + memcpy(entry->type_uuid, partition_type, 16); + memcpy(entry->uniq_uuid, random_uuid, 16); + entry->uniq_uuid[0] = n; + entry->first_lba = first; + entry->last_lba = last; + for (n = 0; (n < EFI_NAMELEN) && *name; n++) + entry->name[n] = *name++; + return 0; + } + printf("out of partition table entries\n"); + return -1; +} + +void import_efi_partition(struct efi_entry *entry) +{ + struct fastboot_ptentry e; + int n; + if (memcmp(entry->type_uuid, partition_type, sizeof(partition_type))) + return; + for (n = 0; n < (sizeof(e.name)-1); n++) + e.name[n] = entry->name[n]; + e.name[n] = 0; + e.start = entry->first_lba; + e.length = (entry->last_lba - entry->first_lba + 1) * 512; + e.flags = 0; + + if (!strcmp(e.name, "environment")) + e.flags |= FASTBOOT_PTENTRY_FLAGS_WRITE_ENV; + fastboot_flash_add_ptn(&e); + + if (e.length > 0x100000) + printf("%8d %7dM %s\n", e.start, e.length/0x100000, e.name); + else + printf("%8d %7dK %s\n", e.start, e.length/0x400, e.name); +} + +static int load_ptbl(void) +{ + u64 ptbl_sectors = 0; + int i = 0, r = 0; + + struct ptable gpt[sizeof(struct ptable)]; + struct mmc *mmc = NULL; + + mmc = find_mmc_device(CONFIG_FASTBOOT_FLASH_MMC_DEV); + if (mmc == NULL) { + printf("No MMC in slot 1\n"); + return -1; + } + + int gpt_size = sizeof(struct ptable); + + ptbl_sectors = (u64)(gpt_size / MMCSD_SECTOR_SIZE); + + r = mmc->block_dev.block_read(1, 0, ptbl_sectors, (void *)gpt); + if (r == -1) { + printf("error reading GPT\n"); + goto fail; + } + + if (memcmp(gpt->header.magic, "EFI PART", 8)) { + printf("efi partition table not found\n"); + r = -1; + goto fail; + } + + for (i = 0; i < EFI_ENTRIES; i++) + import_efi_partition(&gpt->entry[i]); + +fail: + return r; +} + +int board_mmc_fbtptn_init(void) +{ + char *mmc_init[2] = {"mmc", "rescan",}; + char dev[2]; + char *mmc_dev[3] = {"mmc", "dev", dev}; + unsigned fb_mmcdev = CONFIG_FASTBOOT_FLASH_MMC_DEV; + + sprintf(dev, "0x%x", fb_mmcdev); + + if (do_mmcops(NULL, 0, 3, mmc_dev)) { + printf("MMC DEV: %d selection FAILED!\n", fb_mmcdev); + return -1; + } + + if (do_mmcops(NULL, 0, 2, mmc_init)) { + printf("FAIL:Init of MMC card\n"); + return -1; + } + + return load_ptbl(); +} + + +static struct ptable the_ptable; + +int do_format(void) +{ + struct ptable *ptbl = &the_ptable; + struct mmc *mmc = NULL; + unsigned blocks; + unsigned next; + unsigned sz; + int n; + unsigned fb_mmcdev = CONFIG_FASTBOOT_FLASH_MMC_DEV; + + /* get mmc info */ + mmc = find_mmc_device(fb_mmcdev); + if (mmc == 0) { + printf("no mmc device at slot %d", fb_mmcdev); + return -1; + } + + mmc->has_init = 0; + if (mmc_init(mmc)) { + printf("\n mmc init FAILED"); + return -1; + } + + printf("\nmmc capacity is: %llu", mmc->capacity); + printf("\nmmc: number of blocks:0x%lx", mmc->block_dev.lba); + printf("\nmmc: block size:0x%lx", mmc->block_dev.blksz); + + blocks = mmc->block_dev.lba; + + start_ptbl(ptbl, blocks); + n = 0; + next = 0; + for (n = 0, next = 0; partitions[n].name; n++) { + /* below line change size from KB to no of blocks */ + sz = partitions[n].size_kb*2; + if (!strcmp(partitions[n].name, "-")) { + next += sz; + continue; + } + if (sz == 0) + sz = blocks - next; + if (add_ptn(ptbl, next, next + sz - 1, partitions[n].name)) + return -1; + next += sz; + } + end_ptbl(ptbl); + + fastboot_flash_reset_ptn(); + + char *mmc_write[5] = {"mmc", "write", NULL, NULL, NULL}; + char source[32], dest[32], length[32]; + + char dev[2]; + char *mmc_dev[3] = {"mmc", "dev", NULL}; + + mmc_dev[2] = dev; + sprintf(dev, "0x%x", fb_mmcdev); + + if (do_mmcops(NULL, 0, 3, mmc_dev)) { + printf("MMC DEV: %d selection FAILED!\n", fb_mmcdev); + return -1; + } + + mmc_write[2] = source; + mmc_write[3] = dest; + mmc_write[4] = length; + + sprintf(source, "%p", (void *)ptbl); + sprintf(dest, "0x%x", 0x00); + sprintf(length, "0x%x", (sizeof(struct ptable)/512)+1); + + if (do_mmcops(NULL, 0, 5, mmc_write)) { + printf("mbr write FAILED!\n"); + return -1; + } + + printf("\nnew partition table:\n"); + load_ptbl(); + + return 0; +} diff --git a/doc/README.android-fastboot b/doc/README.android-fastboot index 1677609..77cce8e 100644 --- a/doc/README.android-fastboot +++ b/doc/README.android-fastboot @@ -6,9 +6,8 @@ Overview The protocol that is used over USB is described in README.android-fastboot-protocol in same directory. -The current implementation does not yet support the erase command or the -"oem format" command, and there is minimal support for the flash command; -it only supports eMMC devices. +The current implementation does not yet support the erase command, and +there is minimal support for the flash command;it only supports eMMC devices. Client installation =================== diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c index 310175a..76ccc55 100644 --- a/drivers/usb/gadget/f_fastboot.c +++ b/drivers/usb/gadget/f_fastboot.c @@ -23,6 +23,8 @@ #ifdef CONFIG_FASTBOOT_FLASH_MMC_DEV #include <fb_mmc.h> #endif +#include <usb/fastboot.h> +#include <command.h> #define FASTBOOT_VERSION "0.4" @@ -39,6 +41,12 @@ #define EP_BUFFER_SIZE 4096 +/* To support the Android-style naming of flash */ +#define MAX_PTN 16 +static struct fastboot_ptentry ptable[MAX_PTN]; +static unsigned int pcount; +/* static int static_pcount = -1; */ + struct f_fastboot { struct usb_function usb_function; @@ -123,6 +131,33 @@ static struct usb_gadget_strings *fastboot_strings[] = { static void rx_handler_command(struct usb_ep *ep, struct usb_request *req); +/* Android style flash utilties */ +void fastboot_flash_reset_ptn(void) +{ +#ifdef DEBUG + printf("fastboot flash reset partition..!!"); +#endif + pcount = 0; +} + +void fastboot_flash_add_ptn(struct fastboot_ptentry *ptn) +{ + if (pcount < MAX_PTN) { + memcpy((ptable + pcount), ptn, sizeof(*ptn)); + pcount++; + } +} + +void fastboot_flash_dump_ptn(void) +{ + unsigned int n; + for (n = 0; n < pcount; n++) { + struct fastboot_ptentry *ptn = ptable + n; + printf("ptn %d name='%s'", n, ptn->name); + printf(" start=%d len=%d\n", ptn->start, ptn->length); + } +} + static void fastboot_complete(struct usb_ep *ep, struct usb_request *req) { int status = req->status; @@ -312,6 +347,21 @@ static int fastboot_tx_write_str(const char *buffer) return fastboot_tx_write(buffer, strlen(buffer)); } +struct fastboot_ptentry *fastboot_flash_find_ptn(const char *name) +{ + unsigned int n; + + for (n = 0; n < pcount; n++) { + /* Make sure a substring is not accepted */ + if (strlen(name) == strlen(ptable[n].name)) { + if (0 == strcmp(ptable[n].name, name)) + return ptable + n; + } + } + return 0; +} + + static void compl_do_reset(struct usb_ep *ep, struct usb_request *req) { do_reset(NULL, 0, 0, NULL); @@ -513,6 +563,27 @@ static void cb_flash(struct usb_ep *ep, struct usb_request *req) } #endif +#ifdef CONFIG_FASTBOOT_FLASH_MMC_DEV +int fastboot_oem(const char *cmd) +{ + if (!strcmp(cmd, "format")) + return do_format(); + return -1; +} + +static void cb_oem(struct usb_ep *ep, struct usb_request *req) +{ + char *cmd = req->buf; + + int r = fastboot_oem(cmd + 4); + if (r < 0) { + fastboot_tx_write_str("FAIL"); + } else { + fastboot_tx_write_str("OKAY"); + } +} +#endif + struct cmd_dispatch_info { char *cmd; void (*cb)(struct usb_ep *ep, struct usb_request *req); @@ -541,6 +612,12 @@ static const struct cmd_dispatch_info cmd_dispatch_info[] = { .cb = cb_flash, }, #endif +#ifdef CONFIG_FASTBOOT_FLASH_MMC_DEV + { + .cmd = "oem", + .cb = cb_oem, + }, +#endif }; static void rx_handler_command(struct usb_ep *ep, struct usb_request *req) @@ -576,3 +653,11 @@ static void rx_handler_command(struct usb_ep *ep, struct usb_request *req) usb_ep_queue(ep, req, 0); } } + +#ifdef CONFIG_FASTBOOT_FLASH_MMC_DEV +int board_partition_init(void) +{ + board_mmc_fbtptn_init(); + return 1; +} +#endif diff --git a/include/usb/fastboot.h b/include/usb/fastboot.h new file mode 100644 index 0000000..8fee6fc --- /dev/null +++ b/include/usb/fastboot.h @@ -0,0 +1,108 @@ +/* + * (C) Copyright 2008 - 2009 + * Windriver, <www.windriver.com> + * Tom Rix <Tom.Rix(a)windriver.com> + * + * Copyright (c) 2011 Sebastian Andrzej Siewior <bigeasy(a)linutronix.de> + * + * + * Copyright (C) 2008 The Android Open Source Project + * All rights reserved. + * + * Copyright 2014 Linaro, Ltd. + * Dileep Katta <dileep.katta(a)linaro.org> + * + * SPDX-License-Identifier: GPL-2.0+ + */ + +#ifndef FASTBOOT_H +#define FASTBOOT_H + +#include <common.h> +#include <command.h> +#include <environment.h> +#include <linux/usb/ch9.h> +#include <linux/usb/gadget.h> + +#ifdef CONFIG_CMD_FASTBOOT + +/* Android-style flash naming */ + +/* flash partitions are defined in blocks (flash erase units) */ +struct fastboot_ptentry { + /* The logical name for this partition, null terminated */ + char name[16]; + /* start wrt the nand part, must be multiple of nand block size */ + unsigned int start; + /* length of the partition, must be multiple of nand block size */ + unsigned int length; + /* + * Controls the details of how operations are done on the partition + * See the FASTBOOT_PTENTRY_FLAGS_*'s defined below + */ + unsigned int flags; +}; + +/* + * Lower byte shows if the read/write/erase operation is repeated. + * The base address is incremented. Either 0 or 1 is ok for a default + */ + +#define FASTBOOT_PTENTRY_FLAGS_REPEAT_MASK(n) (n & 0x0f) +#define FASTBOOT_PTENTRY_FLAGS_REPEAT_4 0x00000004 + +/* + * Writes happen a block at a time. If the write fails, go to next block + * NEXT_GOOD_BLOCK and CONTIGOUS_BLOCK can not both be set + */ +#define FASTBOOT_PTENTRY_FLAGS_WRITE_NEXT_GOOD_BLOCK 0x00000010 + +/* + * Find a contiguous block big enough for a the whole file + * NEXT_GOOD_BLOCK and CONTIGOUS_BLOCK can not both be set + */ +#define FASTBOOT_PTENTRY_FLAGS_WRITE_CONTIGUOUS_BLOCK 0x00000020 + +/* + * Following definitions are to set the ECC to software/Hardware + * before writing. HW and SW ECC should not both be set. + */ + + +#define FASTBOOT_PTENTRY_FLAGS_WRITE_SW_ECC 0x00000040 +#define FASTBOOT_PTENTRY_FLAGS_WRITE_HW_ECC 0x00000080 +#define FASTBOOT_PTENTRY_FLAGS_WRITE_HW_BCH4_ECC 0x00000100 +#define FASTBOOT_PTENTRY_FLAGS_WRITE_HW_BCH8_ECC 0x00000200 +#define FASTBOOT_PTENTRY_FLAGS_WRITE_HW_BCH16_ECC 0x00000400 + +/* Write the file with write.i */ +#define FASTBOOT_PTENTRY_FLAGS_WRITE_I 0x00000800 + +/* Write the file with write.jffs2 */ +#define FASTBOOT_PTENTRY_FLAGS_WRITE_JFFS2 0x00001000 + +/* + * Write the file as a series of variable/value pairs + * using the setenv and saveenv commands + */ +#define FASTBOOT_PTENTRY_FLAGS_WRITE_ENV 0x00002000 + + +/* The Android-style flash handling */ + +/* tools to populate and query the partition table */ +void fastboot_flash_add_ptn(struct fastboot_ptentry *ptn); +struct fastboot_ptentry *fastboot_flash_find_ptn(const char *name); +struct fastboot_ptentry *fastboot_flash_get_ptn(unsigned n); +unsigned int fastboot_flash_get_ptn_count(void); +void fastboot_flash_dump_ptn(void); +int fastboot_oem(const char *cmd); +int do_format(void); +int board_mmc_fbtptn_init(void); +void fastboot_flash_reset_ptn(void); +int board_partition_init(void); + +int do_mmcops(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]); + +#endif +#endif -- 1.8.3.2

2 2

[U-Boot] [PATCH] mx53loco: Fix boot hang during reboot stress test
by Fabio Estevam 09 Feb '15

09 Feb '15

From: Fabio Estevam <fabio.estevam(a)freescale.com> Currently by running the following test: => setenv bootcmd reset => save => reset , we observe a hang after approximately 20-30 minutes of stress reboot test. Investigation of this issue revealed that when a single DDR chip select is used, the hang does not happen. It only happens when the two chip selects are active. MX53 reference manual states at "28.6.2 Memory ZQ calibration sequence": "The controller must keep the memory lines quiet (except for CK) for the ZQ calibration time as defined in the Jedec (512 cycles for ZQCL after reset, 256 for other ZQCL and 64 for ZQCS)." According to the SDE_0 and SDE_1 bit descriptions from register ESDCTL_ESDCTL: "Writing 1 to SDE0 or SDE1 will initiate power up delays as JEDEC defines. Power up delays are a function of the configured memory type (DDR2/DDR3/LPDDR2)" So make sure to activate one chip select at time (CS0 first and then CS1 later), so that the required JEDEC delay is respected for each chip select. With this change applied the board has gone through three days of reboot stress test without any hang. Signed-off-by: Fabio Estevam <fabio.estevam(a)freescale.com> --- board/freescale/mx53loco/imximage.cfg | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/board/freescale/mx53loco/imximage.cfg b/board/freescale/mx53loco/imximage.cfg index d1c1931..a5f1d98 100644 --- a/board/freescale/mx53loco/imximage.cfg +++ b/board/freescale/mx53loco/imximage.cfg @@ -59,7 +59,7 @@ DATA 4 0x63fd9090 0x4d444c44 DATA 4 0x63fd907c 0x01370138 DATA 4 0x63fd9080 0x013b013c DATA 4 0x63fd9018 0x00011740 -DATA 4 0x63fd9000 0xc3190000 +DATA 4 0x63fd9000 0x83190000 DATA 4 0x63fd900c 0x9f5152e3 DATA 4 0x63fd9010 0xb68e8a63 DATA 4 0x63fd9014 0x01ff00db @@ -72,6 +72,7 @@ DATA 4 0x63fd901c 0x00008033 DATA 4 0x63fd901c 0x00028031 DATA 4 0x63fd901c 0x052080b0 DATA 4 0x63fd901c 0x04008040 +DATA 4 0x63fd9000 0xc3190000 DATA 4 0x63fd901c 0x0000803a DATA 4 0x63fd901c 0x0000803b DATA 4 0x63fd901c 0x00028039 -- 1.9.1

2 1

[U-Boot] [PATCH] imx6: Added DEK blob generator command
by Ulises.Cardenas＠freescale.com 09 Feb '15

09 Feb '15

From: Raul Cardenas <Ulises.Cardenas(a)freescale.com> Freescale's SEC block has built-in Data Encryption Key(DEK) Blob Protocol which provides a method for protecting a DEK for non-secure memory storage. SEC block protects data in a data structure called a Secret Key Blob, which provides both confidentiality and integrity protection. Every time the blob encapsulation is executed, a SHA-256 key is randomly generated to encrypt the DEK. This key is itself encrypted with the OTP Secret key from SoC. The ending blob consists of the encrypted SHA-256 key, the encrypted DEK, and a 16-bit MAC. During decapsulation, the reverse process is performed to get back the original DEK. A caveat to the blob decapsulation process, is that the DEK is decrypted in secure-memory and can only be read by FSL SEC HW. The DEK is used to decrypt data during encrypted boot. Commands added -------------- dek_blob - encapsulating DEK as a cryptgraphic blob Commands Syntax --------------- dek_blob src dst len Encapsulate and create blob of a len-bits DEK at address src and store the result at address dst. Signed-off-by: Raul Cardenas <Ulises.Cardenas(a)freescale.com> Signed-off-by: Nitin Garg <nitin.garg(a)freescale.com> --- arch/arm/imx-common/Makefile | 1 + arch/arm/imx-common/cmd_dek.c | 89 +++++++++++++++++++ arch/arm/imx-common/timer.c | 17 ++++ arch/arm/include/asm/arch-mx6/imx-regs.h | 4 + doc/README.mxc_hab | 48 ++++++++++ drivers/crypto/fsl/Makefile | 2 +- drivers/crypto/fsl/desc.h | 15 ++++ drivers/crypto/fsl/fsl_blob.c | 50 +++++++++++ drivers/crypto/fsl/jobdesc.c | 142 +++++++++++++++++++++++++++++- drivers/crypto/fsl/jobdesc.h | 5 ++ drivers/crypto/fsl/jr.c | 24 ++++- include/fsl_sec.h | 60 +++++++++++++ 12 files changed, 451 insertions(+), 6 deletions(-) create mode 100644 arch/arm/imx-common/cmd_dek.c diff --git a/arch/arm/imx-common/Makefile b/arch/arm/imx-common/Makefile index 25a9d4c..606482f 100644 --- a/arch/arm/imx-common/Makefile +++ b/arch/arm/imx-common/Makefile @@ -24,6 +24,7 @@ obj-$(CONFIG_IMX_VIDEO_SKIP) += video.o endif obj-$(CONFIG_CMD_BMODE) += cmd_bmode.o obj-$(CONFIG_CMD_HDMIDETECT) += cmd_hdmidet.o +obj-$(CONFIG_CMD_DEKBLOB) += cmd_dek.o quiet_cmd_cpp_cfg = CFGS $@ cmd_cpp_cfg = $(CPP) $(cpp_flags) -x c -o $@ $< diff --git a/arch/arm/imx-common/cmd_dek.c b/arch/arm/imx-common/cmd_dek.c new file mode 100644 index 0000000..e3748d2 --- /dev/null +++ b/arch/arm/imx-common/cmd_dek.c @@ -0,0 +1,89 @@ +/* + * Command for encapsulating DEK blob + * + * SPDX-License-Identifier: GPL-2.0+ + */ + +#include <common.h> +#include <command.h> +#include <environment.h> +#include <malloc.h> +#include <asm/byteorder.h> +#include <linux/compiler.h> +#include <fsl_sec.h> +#include <asm/arch/clock.h> + +DECLARE_GLOBAL_DATA_PTR; + +/** +* blob_dek() - Encapsulate the DEK as a blob using CAM's Key +* @src: - Address of data to be encapsulated +* @dst: - Address of data to be encapsulated +* @len: - Size of data to be encapsulated +* +* Returns zero on success,and negative on error. +*/ +__weak int blob_encap_dek(u8 *src, u8 *dst, u32 len) +{ + int ret = 0; + u32 jr_size = 4; + + u32 out_jr_size = sec_in32(CONFIG_SYS_FSL_JR0_ADDR + 0x102c); + if (out_jr_size != jr_size) { + hab_caam_clock_enable(1); + sec_init(); + } + + if (!((len == 128)|(len == 192)|(len == 256))) { + debug("Invalid DEK size. Valid sizes are 128, 192 and 256b\n"); + return -1; + } + + len /= 8; + ret = blob_dek(src, dst, len); + + return ret; +} + +/** + * do_dek_blob() - Handle the "dek_blob" command-line command + * @cmdtp: Command data struct pointer + * @flag: Command flag + * @argc: Command-line argument count + * @argv: Array of command-line arguments + * + * Returns zero on success, CMD_RET_USAGE in case of misuse and negative + * on error. + */ +static int do_dek_blob(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[]) +{ + uint32_t src_addr, dst_addr, len; + uint8_t *src_ptr, *dst_ptr; + int ret = 0; + + if (argc != 4) + return CMD_RET_USAGE; + + src_addr = simple_strtoul(argv[1], NULL, 16); + dst_addr = simple_strtoul(argv[2], NULL, 16); + len = simple_strtoul(argv[3], NULL, 10); + + src_ptr = (uint8_t *)src_addr; + dst_ptr = (uint8_t *)dst_addr; + + ret = blob_encap_dek(src_ptr, dst_ptr, len); + + return ret; +} + +/***************************************************/ +static char dek_blob_help_text[] = + "src dst len - Encapsulate and create blob of data\n" + " $len bits long at address $src and\n" + " store the result at address $dst.\n"; + +U_BOOT_CMD( + dek_blob, 4, 1, do_dek_blob, + "Data Encryption Key blob encapsulation", + dek_blob_help_text +); diff --git a/arch/arm/imx-common/timer.c b/arch/arm/imx-common/timer.c index 65ef60b..e522990 100644 --- a/arch/arm/imx-common/timer.c +++ b/arch/arm/imx-common/timer.c @@ -176,3 +176,20 @@ ulong get_tbclk(void) { return gpt_get_clk(); } + +/* + * This function is intended for SHORT delays only. + * It will overflow at around 10 seconds @ 400MHz, + * or 20 seconds @ 200MHz. + */ +unsigned long usec2ticks(unsigned long usec) +{ + ulong ticks; + + if (usec < 1000) + ticks = ((usec * (get_tbclk()/1000)) + 500) / 1000; + else + ticks = ((usec / 10) * (get_tbclk() / 100000)); + + return ticks; +} diff --git a/arch/arm/include/asm/arch-mx6/imx-regs.h b/arch/arm/include/asm/arch-mx6/imx-regs.h index c968600..8642021 100644 --- a/arch/arm/include/asm/arch-mx6/imx-regs.h +++ b/arch/arm/include/asm/arch-mx6/imx-regs.h @@ -215,6 +215,10 @@ #define AIPS2_OFF_BASE_ADDR (ATZ2_BASE_ADDR + 0x80000) #define CAAM_BASE_ADDR (ATZ2_BASE_ADDR) #define ARM_BASE_ADDR (ATZ2_BASE_ADDR + 0x40000) + +#define CONFIG_SYS_FSL_SEC_ADDR (CAAM_BASE_ADDR) +#define CONFIG_SYS_FSL_JR0_ADDR (CAAM_BASE_ADDR + 0x1000) + #define USB_PL301_BASE_ADDR (AIPS2_OFF_BASE_ADDR + 0x0000) #define USB_BASE_ADDR (AIPS2_OFF_BASE_ADDR + 0x4000) diff --git a/doc/README.mxc_hab b/doc/README.mxc_hab index 43e64a2..46ed0df 100644 --- a/doc/README.mxc_hab +++ b/doc/README.mxc_hab @@ -46,3 +46,51 @@ cat u-boot.imx U-Boot_CSF_pad.bin > u-boot-signed.imx NOTE: U-Boot_CSF.bin needs to be padded to the value specified in the imximage.cfg file. + +Setup U-Boot Image for Encrypted Boot +------------------------------------- +An authenticated U-boot image is used as starting point for +Encrypted Boot. The image is encrypted by Freescale's Code +Signing Tool (CST). The CST replaces only the image data of +u-boot.imx with the encrypted data. The Initial Vector Table, +DCD, and Boot data, remains in plaintext. + +The image data is encrypted with a Encryption Key (DEK). +Therefore, this key is needed to decrypt the data during the +booting process. The DEK is protected by wrapping it in a Blob, +which needs to be appended to the U-boot image and specified in +the CSF file. + +The DEK blob is generated by an authenticated U-boot image with +the dek_blob cmd enabled. The image used for DEK blob generation +needs to have the following configurations enabled: + +CONFIG_SECURE_BOOT +CONFIG_SYS_FSL_SEC_COMPAT 4 /* HAB version */ +CONFIG_FSL_CAAM +CONFIG_CMD_DEKBLOB + +Note: The encrypted boot feature is only supported by HABv4 or +greater. + +The dek_blob command then can be used to generate the DEK blob of +a DEK previously loaded in memory. The command is used as follows: + +dek_blob <DEK address> <Output Address> <Key Size in Bits> +example: dek_blob 0x10800000 0x10801000 192 + +The resulting DEK blob then is used to construct the encrypted +U-boot image. Note that the blob needs to be transfered back +to the host.Then the following commands are used to construct +the final image. + +objcopy -I binary -O binary --pad-to 0x2000 --gap-fill=0x00 \ + U-Boot_CSF.bin U-Boot_CSF_pad.bin +cat u-boot.imx U-Boot_CSF_pad.bin > u-boot-signed.imx +objcopy -I binary -O binary --pad-to <blob_dst> --gap-fill=0x00 \ + u-boot-signed.imx u-boot-signed-pad.bin +cat u-boot-signed-pad.imx DEK_blob.bin > u-boot-encrypted.imx + + NOTE: u-boot-signed.bin needs to be padded to the value + equivalent to the address in which the DEK blob is specified + in the CSF. diff --git a/drivers/crypto/fsl/Makefile b/drivers/crypto/fsl/Makefile index c0cf642..4aa91e4 100644 --- a/drivers/crypto/fsl/Makefile +++ b/drivers/crypto/fsl/Makefile @@ -8,5 +8,5 @@ obj-y += sec.o obj-$(CONFIG_FSL_CAAM) += jr.o fsl_hash.o jobdesc.o error.o -obj-$(CONFIG_CMD_BLOB) += fsl_blob.o +obj-$(CONFIG_CMD_BLOB)$(CONFIG_CMD_DEKBLOB) += fsl_blob.o obj-$(CONFIG_RSA_FREESCALE_EXP) += fsl_rsa.o diff --git a/drivers/crypto/fsl/desc.h b/drivers/crypto/fsl/desc.h index 504f2b0..bb82734 100644 --- a/drivers/crypto/fsl/desc.h +++ b/drivers/crypto/fsl/desc.h @@ -12,11 +12,18 @@ #ifndef DESC_H #define DESC_H +#define KEY_BLOB_SIZE 32 +#define MAC_SIZE 16 + /* Max size of any CAAM descriptor in 32-bit words, inclusive of header */ #define MAX_CAAM_DESCSIZE 64 +/* Size of DEK Blob descriptor, inclusive of header */ +#define DEK_BLOB_DESCSIZE 9 + /* Block size of any entity covered/uncovered with a KEK/TKEK */ #define KEK_BLOCKSIZE 16 + /* * Supported descriptor command types as they show up * inside a descriptor command word. @@ -273,6 +280,13 @@ #define LDLEN_SET_OFIFO_OFFSET_MASK (3 << LDLEN_SET_OFIFO_OFFSET_SHIFT) /* + * AAD Definitions + */ +#define AES_KEY_SHIFT 8 +#define LD_CCM_MODE (0x66) +#define KEY_AES_SRC (0x55 << AES_KEY_SHIFT) + +/* * FIFO_LOAD/FIFO_STORE/SEQ_FIFO_LOAD/SEQ_FIFO_STORE * Command Constructs */ @@ -418,6 +432,7 @@ #define OP_PCLID_MASK (0xff << 16) /* Assuming OP_TYPE = OP_TYPE_UNI_PROTOCOL */ +#define OP_PCLID_SECMEM (0x08) #define OP_PCLID_BLOB (0x0d << OP_PCLID_SHIFT) #define OP_PCLID_SECRETKEY (0x11 << OP_PCLID_SHIFT) #define OP_PCLID_PUBLICKEYPAIR (0x14 << OP_PCLID_SHIFT) diff --git a/drivers/crypto/fsl/fsl_blob.c b/drivers/crypto/fsl/fsl_blob.c index bc01075..f9dc85a 100644 --- a/drivers/crypto/fsl/fsl_blob.c +++ b/drivers/crypto/fsl/fsl_blob.c @@ -7,6 +7,7 @@ #include <common.h> #include <malloc.h> +#include <fsl_sec.h> #include "jobdesc.h" #include "desc.h" #include "jr.h" @@ -59,3 +60,52 @@ int blob_encrypt(u8 *key_mod, u8 *src, u8 *dst, u8 len) free(desc); return ret; } + +#ifdef CONFIG_CMD_DEKBLOB +int blob_dek(u8 *src, u8 *dst, u8 len) +{ + int ret, size, i = 0; + u32 *desc; + + int out_sz = WRP_HDR_SIZE + len + KEY_BLOB_SIZE + MAC_SIZE; + + puts("\nEncapsulating provided DEK to form blob\n"); + desc = memalign(ARCH_DMA_MINALIGN, + sizeof(uint32_t) * DEK_BLOB_DESCSIZE); + if (!desc) { + debug("Not enough memory for descriptor allocation\n"); + return -1; + } + + ret = inline_cnstr_jobdesc_blob_dek(desc, src, dst, len); + if (ret) { + debug("Error in Job Descriptor Construction: %d\n", ret); + } else { + size = roundup(sizeof(uint32_t) * DEK_BLOB_DESCSIZE, + ARCH_DMA_MINALIGN); + flush_dcache_range((unsigned long)desc, + (unsigned long)desc + size); + size = roundup(sizeof(uint8_t) * out_sz, ARCH_DMA_MINALIGN); + flush_dcache_range((unsigned long)dst, + (unsigned long)dst + size); + + ret = run_descriptor_jr(desc); + } + + if (ret) + debug("Error in Encapsulation %d\n", ret); + + size = roundup(out_sz, ARCH_DMA_MINALIGN); + invalidate_dcache_range((unsigned long)dst, (unsigned long)dst+size); + + /* Print DEK Blob */ + puts("DEK Blob\n"); + for (i = 0; i < out_sz; i++) + printf("%02X", ((uint8_t *)dst)[i]); + + puts("\n\n"); + + free(desc); + return ret; +} +#endif diff --git a/drivers/crypto/fsl/jobdesc.c b/drivers/crypto/fsl/jobdesc.c index cc0dced..4dc73ae 100644 --- a/drivers/crypto/fsl/jobdesc.c +++ b/drivers/crypto/fsl/jobdesc.c @@ -9,12 +9,150 @@ */ #include <common.h> +#include <fsl_sec.h> #include "desc_constr.h" #include "jobdesc.h" #include "rsa_caam.h" -#define KEY_BLOB_SIZE 32 -#define MAC_SIZE 16 +#ifdef CONFIG_MX6 +/*! + * Secure memory run command. + * + * @param sec_mem_cmd Secure memory command register + * @return cmd_status Secure memory command status register + */ +uint32_t secmem_set_cmd(uint32_t sec_mem_cmd) +{ + uint32_t temp_reg; + + sec_out32(CAAM_SMCJR0, sec_mem_cmd); + + do { + temp_reg = sec_in32(CAAM_SMCSJR0); + } while (temp_reg & CMD_COMPLETE); + + return temp_reg; +} + +/*! + * CAAM page allocation. + * + * @param page Number of the page to allocate. + * @param partition Number of the partition to allocate. + */ +uint32_t caam_page_alloc(uint8_t page_num, uint8_t partition_num) +{ + uint32_t temp_reg; + + /* + * De-Allocate partition_num if already allocated to ARM core + */ + if (sec_in32(CAAM_SMPO_0) & PARTITION_OWNER(partition_num)) { + temp_reg = secmem_set_cmd(PARTITION(partition_num) | + CMD_PART_DEALLOC); + if (temp_reg & SMCSJR_AERR) { + printf("Error: De-allocation status 0x%X\n", temp_reg); + return ERROR_IN_PAGE_ALLOC; + } + } + + /* set the access rights to allow full access */ + sec_out32(CAAM_SMAG1JR0(partition_num), 0xF); + sec_out32(CAAM_SMAG2JR0(partition_num), 0xF); + sec_out32(CAAM_SMAPJR0(partition_num), 0xFF); + + /* Now need to allocate partition_num of secure RAM. */ + /* De-Allocate page_num by starting with a page inquiry command */ + temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_INQUIRY); + + /* if the page is owned, de-allocate it */ + if ((temp_reg & SMCSJR_PO) == PAGE_OWNED) { + temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_PAGE_DEALLOC); + if (temp_reg & SMCSJR_AERR) { + printf("Error: Allocation status 0x%X\n", temp_reg); + return ERROR_IN_PAGE_ALLOC; + } + } + + /* Allocate page_num to partition_num */ + temp_reg = secmem_set_cmd(PAGE(page_num) | PARTITION(partition_num) + | CMD_PAGE_ALLOC); + if (temp_reg & SMCSJR_AERR) { + printf("Error: Allocation status 0x%X\n", temp_reg); + return ERROR_IN_PAGE_ALLOC; + } + /* page inquiry command to ensure that the page was allocated */ + temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_INQUIRY); + + /* if the page is not owned => problem */ + if ((temp_reg & SMCSJR_PO) != PAGE_OWNED) { + printf("Allocation of page %d in partition %d failed 0x%X\n", + temp_reg, page_num, partition_num); + + return ERROR_IN_PAGE_ALLOC; + } + + return 0; +} + +uint32_t inline_cnstr_jobdesc_blob_dek(uint32_t *desc, uint8_t *plain_txt, + uint8_t *dek_blob, uint32_t in_sz) +{ + uint32_t ret = 0; + u32 aad_w1, aad_w2; + /* output blob will have 32 bytes key blob in beginning and + * 16 byte HMAC identifier at end of data blob */ + uint32_t out_sz = in_sz + KEY_BLOB_SIZE + MAC_SIZE; + /* Setting HDR for blob */ + uint8_t wrapped_key_hdr[8] = {HDR_TAG, 0x00, WRP_HDR_SIZE + out_sz, + HDR_PAR, HAB_MOD, HAB_ALG, in_sz, HAB_FLG}; + + /* initialize the blob array */ + memset(dek_blob, 0, out_sz + 8); + /* Copy the header into the DEK blob buffer */ + memcpy((uint32_t *)dek_blob, wrapped_key_hdr, sizeof(wrapped_key_hdr)); + + /* allocating secure memory */ + ret = caam_page_alloc(PAGE_1, PARTITION_1); + if (ret) + return ret; + + /* Write DEK to secure memory */ + memcpy((uint32_t *)SEC_MEM_PAGE1, (uint32_t *)plain_txt, in_sz); + + unsigned long start = (unsigned long)SEC_MEM_PAGE1 & + ~(ARCH_DMA_MINALIGN - 1); + unsigned long end = ALIGN(start + 0x1000, ARCH_DMA_MINALIGN); + flush_dcache_range(start, end); + + /* Now configure the access rights of the partition */ + sec_out32(CAAM_SMAG1JR0(PARTITION_1), KS_G1); /* set group 1 */ + sec_out32(CAAM_SMAG2JR0(PARTITION_1), 0); /* clear group 2 */ + sec_out32(CAAM_SMAPJR0(PARTITION_1), PERM); /* set perm & locks */ + + /* construct aad for AES */ + aad_w1 = (in_sz << OP_ALG_ALGSEL_SHIFT) | KEY_AES_SRC | LD_CCM_MODE; + aad_w2 = 0x0; + + init_job_desc(desc, 0); + + append_cmd(desc, CMD_LOAD | CLASS_2 | KEY_IMM | KEY_ENC | + (0x0c << LDST_OFFSET_SHIFT) | 0x08); + + append_u32(desc, aad_w1); + + append_u32(desc, aad_w2); + + append_cmd_ptr(desc, (dma_addr_t)SEC_MEM_PAGE1, in_sz, CMD_SEQ_IN_PTR); + + append_cmd_ptr(desc, (dma_addr_t)dek_blob + 8, out_sz, CMD_SEQ_OUT_PTR); + + append_operation(desc, OP_TYPE_ENCAP_PROTOCOL | OP_PCLID_BLOB | + OP_PCLID_SECMEM); + + return ret; +} +#endif void inline_cnstr_jobdesc_hash(uint32_t *desc, const uint8_t *msg, uint32_t msgsz, uint8_t *digest, diff --git a/drivers/crypto/fsl/jobdesc.h b/drivers/crypto/fsl/jobdesc.h index 84b3edd..d20c18c 100644 --- a/drivers/crypto/fsl/jobdesc.h +++ b/drivers/crypto/fsl/jobdesc.h @@ -14,6 +14,11 @@ #define KEY_IDNFR_SZ_BYTES 16 +#ifdef CONFIG_CMD_DEKBLOB +uint32_t inline_cnstr_jobdesc_blob_dek(uint32_t *desc, uint8_t *plain_txt, + uint8_t *enc_blob, uint32_t in_sz); +#endif + void inline_cnstr_jobdesc_hash(uint32_t *desc, const uint8_t *msg, uint32_t msgsz, uint8_t *digest, u32 alg_type, uint32_t alg_size, int sg_tbl); diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c index f9d4938..8b76c1b 100644 --- a/drivers/crypto/fsl/jr.c +++ b/drivers/crypto/fsl/jr.c @@ -90,11 +90,13 @@ static int jr_init(void) jr.liodn = DEFAULT_JR_LIODN; #endif jr.size = JR_SIZE; - jr.input_ring = (dma_addr_t *)malloc(JR_SIZE * sizeof(dma_addr_t)); + jr.input_ring = (dma_addr_t *)memalign(ARCH_DMA_MINALIGN, + JR_SIZE * sizeof(dma_addr_t)); if (!jr.input_ring) return -1; jr.output_ring = - (struct op_ring *)malloc(JR_SIZE * sizeof(struct op_ring)); + (struct op_ring *)memalign(ARCH_DMA_MINALIGN, + JR_SIZE * sizeof(struct op_ring)); if (!jr.output_ring) return -1; @@ -163,13 +165,22 @@ static int jr_enqueue(uint32_t *desc_addr, CIRC_SPACE(jr.head, jr.tail, jr.size) <= 0) return -1; - jr.input_ring[head] = desc_phys_addr; jr.info[head].desc_phys_addr = desc_phys_addr; jr.info[head].desc_addr = (uint32_t)desc_addr; jr.info[head].callback = (void *)callback; jr.info[head].arg = arg; jr.info[head].op_done = 0; + unsigned long start = (unsigned long)jr.info & ~(ARCH_DMA_MINALIGN - 1); + unsigned long end = ALIGN(start + sizeof(struct jr_info) * JR_SIZE , + ARCH_DMA_MINALIGN); + flush_dcache_range(start, end); + + jr.input_ring[head] = desc_phys_addr; + start = (unsigned long)jr.input_ring & ~(ARCH_DMA_MINALIGN - 1); + end = ALIGN(start + sizeof(dma_addr_t)*JR_SIZE , ARCH_DMA_MINALIGN); + flush_dcache_range(start, end); + jr.head = (head + 1) & (jr.size - 1); sec_out32(&regs->irja, 1); @@ -187,6 +198,13 @@ static int jr_dequeue(void) void *arg = NULL; while (sec_in32(&regs->orsf) && CIRC_CNT(jr.head, jr.tail, jr.size)) { + unsigned long start = (unsigned long)jr.output_ring & + ~(ARCH_DMA_MINALIGN - 1); + unsigned long end = ALIGN(start + + sizeof(struct op_ring)*JR_SIZE, + ARCH_DMA_MINALIGN); + invalidate_dcache_range(start, end); + found = 0; dma_addr_t op_desc = jr.output_ring[jr.tail].desc; diff --git a/include/fsl_sec.h b/include/fsl_sec.h index aa850a3..95fbb6b 100644 --- a/include/fsl_sec.h +++ b/include/fsl_sec.h @@ -11,6 +11,13 @@ #include <common.h> #include <asm/io.h> +#ifdef CONFIG_ARM +#define sec_in32(a) __raw_readl(a) +#define sec_out32(a, v) __raw_writel(v, a) +#define sec_in16(a) __raw_readw(a) +#define sec_clrbits32 clrbits_le32 +#define sec_setbits32 setbits_le32 +#elif CONFIG_PPC #ifdef CONFIG_SYS_FSL_SEC_LE #define sec_in32(a) in_le32(a) #define sec_out32(a, v) out_le32(a, v) @@ -26,6 +33,7 @@ #else #error Neither CONFIG_SYS_FSL_SEC_LE nor CONFIG_SYS_FSL_SEC_BE is defined #endif +#endif /* ARCHITECURE */ /* Security Engine Block (MS = Most Sig., LS = Least Sig.) */ #if CONFIG_SYS_FSL_SEC_COMPAT >= 4 @@ -175,7 +183,59 @@ struct jr_regs { u32 jrcr; }; +#ifdef CONFIG_MX6 + +#define SMCSJR_PO (3 << 6) +#define SMCSJR_AERR (3 << 12) +#define SMCSJR_CERR (3 << 14) +#define CAAM_SMPO_0 CONFIG_SYS_FSL_SEC_ADDR + 0x1FBC +#define CAAM_SMCJR0 CONFIG_SYS_FSL_SEC_ADDR + 0x10f4 +#define CAAM_SMCSJR0 CONFIG_SYS_FSL_SEC_ADDR + 0x10fc +#define CAAM_SMAPJR0(y) (CONFIG_SYS_FSL_SEC_ADDR + 0x1104 + y*16) +#define CAAM_SMAG2JR0(y) (CONFIG_SYS_FSL_SEC_ADDR + 0x1108 + y*16) +#define CAAM_SMAG1JR0(y) (CONFIG_SYS_FSL_SEC_ADDR + 0x110C + y*16) + +#define ERROR_IN_PAGE_ALLOC (1) +#define CMD_PAGE_ALLOC 0x1 +#define CMD_PAGE_DEALLOC 0x2 +#define CMD_PART_DEALLOC 0x3 +#define CMD_INQUIRY 0x5 +#define CMD_COMPLETE (3 << 14) +#define PAGE_AVAILABLE 0 +#define PAGE_OWNED (3 << 6) +#define PAGE(x) (x << 16) +#define PARTITION(x) (x << 8) +#define PARTITION_OWNER(x) (0x3 << (x*2)) + +/* 4kbyte pages */ +#define SEC_MEM_PAGE0 CAAM_ARB_BASE_ADDR +#define SEC_MEM_PAGE1 (CAAM_ARB_BASE_ADDR + 0x1000) +#define SEC_MEM_PAGE2 (CAAM_ARB_BASE_ADDR + 0x2000) +#define SEC_MEM_PAGE3 (CAAM_ARB_BASE_ADDR + 0x3000) + +#define JR_MID 2 /* Matches ROM configuration */ +#define KS_G1 (1 << JR_MID) /* CAAM only */ +#define PERM 0x0000B008 /* Clear on release, lock SMAP + * lock SMAG group 1 Blob */ + +/* HAB WRAPPED KEY header */ +#define WRP_HDR_SIZE 0x08 +#define HDR_TAG 0x81 +#define HDR_PAR 0x41 +/* HAB WRAPPED KEY Data */ +#define HAB_MOD 0x66 +#define HAB_ALG 0x55 +#define HAB_FLG 0x00 + +#define PARTITION_1 1 +#define PAGE_1 1 + +#endif + int sec_init(void); + +int blob_dek(u8 *src, u8 *dst, u8 len); + #endif #endif /* __FSL_SEC_H */ -- 1.7.9.5

2 1

[U-Boot] [PATCH][v3] powerpc/mpc85xx: SECURE BOOT- NAND secure boot target for P3041
by Aneesh Bansal 09 Feb '15

09 Feb '15

Secure Boot Target is added for NAND for P3041. Changes: In PowerPC, the core begins execution from address 0xFFFFFFFC. In case of secure boot, this default address maps to Boot ROM. The Boot ROM code requires that the bootloader(U-boot) must lie in 0 to 3.5G address space i.e. 0x0 - 0xDFFFFFFF. In case of NAND Secure Boot, CONFIG_SYS_RAMBOOT is enabled and CPC is configured as SRAM. U-Boot binary will be located on this SRAM at location 0xBFF40000 with entry point as 0xBFFFFFFC. Signed-off-by: Ruchika Gupta <ruchika.gupta(a)freescale.com> Signed-off-by: Aneesh Bansal <aneesh.bansal(a)freescale.com> --- Changes in v3: - Updated MAINTAINERS file - In cpu_init_r, TLB for L3 is to be disabled only in case of SECURE_BOOT and CONFIG_SYS_RAMBOOT Makefile | 4 ++++ arch/powerpc/cpu/mpc85xx/cpu_init.c | 17 +++++++++++++++++ board/freescale/common/p_corenet/tlb.c | 18 +++++++++++++++++- board/freescale/corenet_ds/MAINTAINERS | 5 +++++ configs/P3041DS_NAND_SECURE_BOOT_defconfig | 4 ++++ include/configs/corenet_ds.h | 9 +++++++++ 6 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 configs/P3041DS_NAND_SECURE_BOOT_defconfig diff --git a/Makefile b/Makefile index 92faed6..4bc83d6 100644 --- a/Makefile +++ b/Makefile @@ -714,8 +714,12 @@ ALL-$(CONFIG_ONENAND_U_BOOT) += u-boot-onenand.bin ifeq ($(CONFIG_SPL_FSL_PBL),y) ALL-$(CONFIG_RAMBOOT_PBL) += u-boot-with-spl-pbl.bin else +ifneq ($(CONFIG_SECURE_BOOT), y) +# For Secure Boot The Image needs to be signed and Header must also +# be included. So The image has to be built explicitly ALL-$(CONFIG_RAMBOOT_PBL) += u-boot.pbl endif +endif ALL-$(CONFIG_SPL) += spl/u-boot-spl.bin ALL-$(CONFIG_SPL_FRAMEWORK) += u-boot.img ALL-$(CONFIG_TPL) += tpl/u-boot-tpl.bin diff --git a/arch/powerpc/cpu/mpc85xx/cpu_init.c b/arch/powerpc/cpu/mpc85xx/cpu_init.c index 4cf8853..ef56cc0 100644 --- a/arch/powerpc/cpu/mpc85xx/cpu_init.c +++ b/arch/powerpc/cpu/mpc85xx/cpu_init.c @@ -843,6 +843,23 @@ int cpu_init_r(void) setup_mp(); #endif +#if defined(CONFIG_SYS_RAMBOOT) && defined(CONFIG_SYS_INIT_L3_ADDR) && \ + defined(CONFIG_SECURE_BOOT) + /* Disable the TLB Created for L3 and create the TLB required for + * PCIE (CONFIG_SYS_PCIE1_MEM_VIRT) which was not created earlier. + */ + int tlb_index; + tlb_index = find_tlb_idx((void *)CONFIG_BPTR_VIRT_ADDR, 1); + if (tlb_index != -1) { + disable_tlb(tlb_index); + + set_tlb(1, CONFIG_SYS_PCIE1_MEM_VIRT, + CONFIG_SYS_PCIE1_MEM_PHYS, + MAS3_SW|MAS3_SR, MAS2_I|MAS2_G, + 0, tlb_index, BOOKE_PAGESZ_1G, 1); + } +#endif + #ifdef CONFIG_SYS_FSL_ERRATUM_ESDHC13 { if (SVR_MAJ(svr) < 3) { diff --git a/board/freescale/common/p_corenet/tlb.c b/board/freescale/common/p_corenet/tlb.c index 8148e46..1b60cfb 100644 --- a/board/freescale/common/p_corenet/tlb.c +++ b/board/freescale/common/p_corenet/tlb.c @@ -42,7 +42,9 @@ struct fsl_e_tlb_entry tlb_table[] = { /* TLB 1 */ /* *I*** - Covers boot page */ -#if defined(CONFIG_SYS_RAMBOOT) && defined(CONFIG_SYS_INIT_L3_ADDR) + /* In Case of Secure RAM Boot L3 address is defined at 0xbff00000 */ +#if defined(CONFIG_SYS_RAMBOOT) && defined(CONFIG_SYS_INIT_L3_ADDR) && \ + !defined(CONFIG_SECURE_BOOT) /* * *I*G - L3SRAM. When L3 is used as 1M SRAM, the address of the * SRAM is at 0xfff00000, it covered the 0xfffff000. @@ -76,11 +78,25 @@ struct fsl_e_tlb_entry tlb_table[] = { MAS3_SX|MAS3_SR, MAS2_W|MAS2_G, 0, 2, BOOKE_PAGESZ_256M, 1), +#if defined(CONFIG_SYS_RAMBOOT) && defined(CONFIG_SYS_INIT_L3_ADDR) && \ + defined(CONFIG_SECURE_BOOT) + /* In case of Secure Boot, L3 is used as 1M SRAM + * and the address of the SRAM is at 0xbff00000. + * The PCIE TLB entry conflicts with the above entry. + * So, the entry for PCIE is not created at this point of time. + * It will be created later on in cpu_init_r() + * when U-Boot has relocated to DDR + */ + SET_TLB_ENTRY(1, CONFIG_SYS_INIT_L3_ADDR, CONFIG_SYS_INIT_L3_ADDR, + MAS3_SX|MAS3_SW|MAS3_SR, MAS2_I|MAS2_G, + 0, 3, BOOKE_PAGESZ_1M, 1), +#else /* *I*G* - PCI */ SET_TLB_ENTRY(1, CONFIG_SYS_PCIE1_MEM_VIRT, CONFIG_SYS_PCIE1_MEM_PHYS, MAS3_SW|MAS3_SR, MAS2_I|MAS2_G, 0, 3, BOOKE_PAGESZ_1G, 1), +#endif /* *I*G* - PCI */ SET_TLB_ENTRY(1, CONFIG_SYS_PCIE1_MEM_VIRT + 0x40000000, CONFIG_SYS_PCIE1_MEM_PHYS + 0x40000000, diff --git a/board/freescale/corenet_ds/MAINTAINERS b/board/freescale/corenet_ds/MAINTAINERS index 745847c..6855446 100644 --- a/board/freescale/corenet_ds/MAINTAINERS +++ b/board/freescale/corenet_ds/MAINTAINERS @@ -28,3 +28,8 @@ F: configs/P5040DS_NAND_defconfig F: configs/P5040DS_SDCARD_defconfig F: configs/P5040DS_SPIFLASH_defconfig F: configs/P5040DS_SECURE_BOOT_defconfig + +CORENET_DS_SECURE_BOOT BOARD +M: Aneesh Bansal <aneesh.bansal(a)freescale.com> +S: Maintained +F: configs/P3041DS_NAND_SECURE_BOOT_defconfig diff --git a/configs/P3041DS_NAND_SECURE_BOOT_defconfig b/configs/P3041DS_NAND_SECURE_BOOT_defconfig new file mode 100644 index 0000000..e810b1c --- /dev/null +++ b/configs/P3041DS_NAND_SECURE_BOOT_defconfig @@ -0,0 +1,4 @@ +CONFIG_SYS_EXTRA_OPTIONS="RAMBOOT_PBL,NAND,SECURE_BOOT,SYS_TEXT_BASE=0xBFF40000" +CONFIG_PPC=y +CONFIG_MPC85xx=y +CONFIG_TARGET_P3041DS=y diff --git a/include/configs/corenet_ds.h b/include/configs/corenet_ds.h index 225ffdd..64c6890 100644 --- a/include/configs/corenet_ds.h +++ b/include/configs/corenet_ds.h @@ -16,6 +16,14 @@ #include "../board/freescale/common/ics307_clk.h" #ifdef CONFIG_RAMBOOT_PBL +#ifdef CONFIG_SECURE_BOOT +#define CONFIG_RAMBOOT_TEXT_BASE CONFIG_SYS_TEXT_BASE +#define CONFIG_RESET_VECTOR_ADDRESS 0xbffffffc +#define CONFIG_BPTR_VIRT_ADDR 0xbffff000 +#ifdef CONFIG_NAND +#define CONFIG_RAMBOOT_NAND +#endif +#else #define CONFIG_RAMBOOT_TEXT_BASE CONFIG_SYS_TEXT_BASE #define CONFIG_RESET_VECTOR_ADDRESS 0xfffffffc #define CONFIG_SYS_FSL_PBL_PBI board/freescale/corenet_ds/pbi.cfg @@ -29,6 +37,7 @@ #define CONFIG_SYS_FSL_PBL_RCW board/freescale/corenet_ds/rcw_p5040ds.cfg #endif #endif +#endif #ifdef CONFIG_SRIO_PCIE_BOOT_SLAVE /* Set 1M boot space */ -- 1.8.1.4

1 0

[U-Boot] [Q] SPL uses uImage load address as entry point
by Phil Edworthy 09 Feb '15

09 Feb '15

Hi, I'm doing some work with U-Boot SPL, and noticed the following code in the spl_parse_image_header function (common/spl/spl.c): if (image_get_magic(header) == IH_MAGIC) { if (spl_image.flags & SPL_COPY_PAYLOAD_ONLY) { ... } else { spl_image.entry_point = image_get_load(header); /* Load including the header */ spl_image.load_addr = spl_image.entry_point - header_size; ... } Could anyone tell me why SPL uses the load address from the header as the entry point address, and then calculates the entry point? Thanks Phil

1 0

[U-Boot] [PATCH sunxi-tools] WIP: fel: Add a command for loading U-Boot SPL binaries in eGON format
by Siarhei Siamashka 09 Feb '15

09 Feb '15

!!! Works only on Allwinner A20 so far and needs a bit more !!! debugging. And even on A20, the transition from the SPL to !!! the main U-boot binary has some glitches. Now it should be possible to load and execute the same U-Boot SPL, as used for booting from SD cards. The only argument for this new command is the name of the SPL binary file (with eGON header). It can be run as: fel spl u-boot-sunxi-with-spl.bin The free space in SRAM is scattered in the FEL mode across multiple locations. We just split SPL into individual chunks, upload them to the free locations in SRAM and also upload a small startup code, which is responsible for harvesting and gluing the pieces of SPL together. Additionally, the eGON checksum is verified to ensure that no data corruption has happened due to some unexpected clash with the FEL protocol code from the BROM. After this is done, it is not possible to return back to FEL anymore (both IRQ and normal stacks of the BROM are overwritten). However it is still possible to transfer control to the FEL init code (so that it re-initializes the USB hardware and all the other things): /* Jump to the FEL entry point in BROM */ movw r0, #0x20 movt r0, #0xffff bx r0 This unifies the FEL and SD card SPL binaries. And also removes the FEL SPL size limit (now it can be as large as ~30 KiB). This work had been inspired by the recent FEL mode support u-boot patches from Simon Glass and Hans de Goede. Signed-off-by: Siarhei Siamashka <siarhei.siamashka(a)gmail.com> --- fel.c | 211 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 189 insertions(+), 22 deletions(-) diff --git a/fel.c b/fel.c index c21d6ec..c0f28d8 100644 --- a/fel.c +++ b/fel.c @@ -41,6 +41,17 @@ struct aw_usb_request { char pad[10]; } __attribute__((packed)); +struct aw_fel_version { + char signature[8]; + uint32_t soc_id; /* 0x00162300 */ + uint32_t unknown_0a; /* 1 */ + uint16_t protocol; /* 1 */ + uint8_t unknown_12; /* 0x44 */ + uint8_t unknown_13; /* 0x08 */ + uint32_t scratchpad; /* 0x7e00 */ + uint32_t pad[2]; /* unused */ +} __attribute__((packed)); + static const int AW_USB_READ = 0x11; static const int AW_USB_WRITE = 0x12; @@ -136,32 +147,27 @@ void aw_read_fel_status(libusb_device_handle *usb) aw_usb_read(usb, &buf, sizeof(buf)); } -void aw_fel_get_version(libusb_device_handle *usb) +void aw_fel_get_version(libusb_device_handle *usb, struct aw_fel_version *buf) { - struct aw_fel_version { - char signature[8]; - uint32_t soc_id; /* 0x00162300 */ - uint32_t unknown_0a; /* 1 */ - uint16_t protocol; /* 1 */ - uint8_t unknown_12; /* 0x44 */ - uint8_t unknown_13; /* 0x08 */ - uint32_t scratchpad; /* 0x7e00 */ - uint32_t pad[2]; /* unused */ - } __attribute__((packed)) buf; - aw_send_fel_request(usb, AW_FEL_VERSION, 0, 0); - aw_usb_read(usb, &buf, sizeof(buf)); + aw_usb_read(usb, buf, sizeof(*buf)); aw_read_fel_status(usb); - buf.soc_id = le32toh(buf.soc_id); - buf.unknown_0a = le32toh(buf.unknown_0a); - buf.protocol = le32toh(buf.protocol); - buf.scratchpad = le16toh(buf.scratchpad); - buf.pad[0] = le32toh(buf.pad[0]); - buf.pad[1] = le32toh(buf.pad[1]); + buf->soc_id = (le32toh(buf->soc_id) >> 8) & 0xFFFF; + buf->unknown_0a = le32toh(buf->unknown_0a); + buf->protocol = le32toh(buf->protocol); + buf->scratchpad = le16toh(buf->scratchpad); + buf->pad[0] = le32toh(buf->pad[0]); + buf->pad[1] = le32toh(buf->pad[1]); +} + +void aw_fel_print_version(libusb_device_handle *usb) +{ + struct aw_fel_version buf; + aw_fel_get_version(usb, &buf); const char *soc_name="unknown"; - switch ((buf.soc_id >> 8) & 0xFFFF) { + switch (buf.soc_id) { case 0x1623: soc_name="A10";break; case 0x1625: soc_name="A13";break; case 0x1633: soc_name="A31";break; @@ -170,7 +176,10 @@ void aw_fel_get_version(libusb_device_handle *usb) case 0x1639: soc_name="A80";break; } - printf("%.8s soc=%08x(%s) %08x ver=%04x %02x %02x scratchpad=%08x %08x %08x\n", buf.signature, buf.soc_id, soc_name, buf.unknown_0a, buf.protocol, buf.unknown_12, buf.unknown_13, buf.scratchpad, buf.pad[0], buf.pad[1]); + printf("%.8s soc=%08x(%s) %08x ver=%04x %02x %02x scratchpad=%08x %08x %08x\n", + buf.signature, buf.soc_id, soc_name, buf.unknown_0a, + buf.protocol, buf.unknown_12, buf.unknown_13, + buf.scratchpad, buf.pad[0], buf.pad[1]); } void aw_fel_read(libusb_device_handle *usb, uint32_t offset, void *buf, size_t len) @@ -285,6 +294,158 @@ void aw_fel_fill(libusb_device_handle *usb, uint32_t offset, size_t size, unsign aw_fel_write(usb, buf, offset, size); } +/* + * Information about usable areas in SRAM, which are not clashing with + * the FEL support code from BROM. + */ + +typedef struct { uint32_t addr; uint32_t size; } sram_data_chunk; + +sram_data_chunk a10_a13_a20_sram_layout[] = { + { .addr = 0x00000, .size = 0x1800 }, /* Part of the IRQ handler stack */ + { .addr = 0x02000, .size = 0x3D00 }, /* Part of the normal stack */ + { .addr = 0x08000, .size = 0x3000 }, /* SRAM section A3 */ + { 0, 0 } +}; + +sram_data_chunk a31_sram_layout[] = { + { .addr = 0x00000, .size = 0x1800 }, /* Part of the IRQ handler stack */ + { .addr = 0x02000, .size = 0x3D00 }, /* Part of the normal stack */ + { .addr = 0x44000, .size = 0x3000 }, /* SRAM section A2 */ + { 0, 0 } +}; + +sram_data_chunk default_sram_layout[] = { + { .addr = 0x00000, .size = 0x1800 }, /* Part of the IRQ handler stack */ + { .addr = 0x02000, .size = 0x3D00 }, /* Part of the normal stack */ + { 0, 0 } +}; + +struct { + uint32_t soc_id; + sram_data_chunk *sram_layout; +} soc_sram_layout[] = { + { .soc_id = 0x1623, .sram_layout = a10_a13_a20_sram_layout }, + { .soc_id = 0x1625, .sram_layout = a10_a13_a20_sram_layout }, + { .soc_id = 0x1651, .sram_layout = a10_a13_a20_sram_layout }, + { .soc_id = 0x1633, .sram_layout = a31_sram_layout }, + { 0, 0 } +}; + +sram_data_chunk *aw_fel_get_sram_layout(libusb_device_handle *usb) +{ + int i; + struct aw_fel_version buf; + + aw_fel_get_version(usb, &buf); + + for (i = 0; soc_sram_layout[i].sram_layout; i++) + if (soc_sram_layout[i].soc_id == buf.soc_id) + return soc_sram_layout[i].sram_layout; + + return default_sram_layout; +} + +static uint32_t spl_loader[] = { + /* Disable IRQ and FIQ */ + 0xe10f0000, /* 0: mrs r0, CPSR */ + 0xe38000c0, /* 4: orr r0, r0, #192 */ + 0xe121f000, /* 8: msr CPSR_c, r0 */ + + /* Collect and glue pieces of SPL */ + 0xe3066c39, /* c: movw r6, #27705 */ + 0xe3456f0a, /* 10: movt r6, #24330 */ + 0xe3a02010, /* 14: mov r2, #16 */ + 0xe5924000, /* 18: ldr r4, [r2] */ + 0xe3a00000, /* 1c: mov r0, #0 */ + 0xe28f3068, /* 20: add r3, pc, #104 */ + 0xe4931004, /* 24: ldr r1, [r3], #4 */ + 0xe4935004, /* 28: ldr r5, [r3], #4 */ + 0xe1550004, /* 2c: cmp r5, r4 */ + 0xa1a05004, /* 30: movge r5, r4 */ + 0xe0444005, /* 34: sub r4, r4, r5 */ + 0xe3550000, /* 38: cmp r5, #0 */ + 0x0a000006, /* 3c: beq 5c <entry_point+0x5c> */ + 0xe4912004, /* 40: ldr r2, [r1], #4 */ + 0xe2555004, /* 44: subs r5, r5, #4 */ + 0xe4802004, /* 48: str r2, [r0], #4 */ + 0xe0866002, /* 4c: add r6, r6, r2 */ + 0x1afffffa, /* 50: bne 40 <entry_point+0x40> */ + 0xe3540000, /* 54: cmp r4, #0 */ + 0x1afffff1, /* 58: bne 24 <entry_point+0x24> */ + 0xe3a0200c, /* 5c: mov r2, #12 */ + 0xe5922000, /* 60: ldr r2, [r2] */ + + /* Verify the checksum */ + 0xe0566082, /* 64: subs r6, r6, r2, lsl #1 */ + 0x1a000003, /* 68: bne 7c <entry_point+0x7c> */ + + /* The checksum is good - jump to SPL */ + 0xf57ff04f, /* 6c: dsb sy */ + 0xf57ff06f, /* 70: isb sy */ + 0xe3a00000, /* 74: mov r0, #0 */ + 0xe12fff10, /* 78: bx r0 */ + + /* The checksum is bad - jump to FEL mode init in BROM */ + 0xf57ff04f, /* 7c: dsb sy */ + 0xf57ff06f, /* 80: isb sy */ + 0xe3000020, /* 84: movw r0, #32 */ + 0xe34f0fff, /* 88: movt r0, #65535 */ + 0xe12fff10, /* 8c: bx r0 */ +}; + +void aw_fel_write_and_execute_spl(libusb_device_handle *usb, + uint8_t *buf, size_t len) +{ + sram_data_chunk *sram_layout = aw_fel_get_sram_layout(usb); + size_t i; + uint32_t spl_checksum, spl_len; + uint32_t *buf32 = (uint32_t *)buf; + + if (len < 32 || memcmp(buf + 4, "eGON.BT0", 8) != 0) { + fprintf(stderr, "Invalid file format: eGON header not found\n"); + return; + } + + spl_checksum = 2 * le32toh(buf32[3]) - 0x5F0A6C39; + spl_len = le32toh(buf32[4]); + + if (spl_len > len || (spl_len % 4) != 0) { + fprintf(stderr, "Invalid file format: bad length\n"); + return; + } + + len = spl_len; + for (i = 0; i < len / 4; i++) + spl_checksum -= le32toh(buf32[i]); + + + if (spl_checksum != 0) { + fprintf(stderr, "Invalid file format: bad checksum\n"); + return; + } + + for (i = 0; len > 0 && sram_layout[i].size; i++) { + uint32_t chunk_addr = sram_layout[i].addr; + size_t chunk_size = sram_layout[i].size; + if (chunk_size > len) + chunk_size = len; + aw_fel_write(usb, buf, chunk_addr, chunk_size); + buf += chunk_size; + len -= chunk_size; + } + + if (len > 0) { + printf("The SPL size (%d) is too large\n", spl_len); + return; + } + + aw_fel_write(usb, spl_loader, 0x7e00, sizeof(spl_loader)); + aw_fel_write(usb, sram_layout, 0x7e00 + sizeof(spl_loader), + (i + 1) * sizeof(*sram_layout)); + aw_fel_execute(usb, 0x7e00); +} + static int aw_fel_get_endpoint(libusb_device_handle *usb) { struct libusb_device *dev = libusb_get_device(usb); @@ -343,6 +504,7 @@ int main(int argc, char **argv) " ver[sion] Show BROM version\n" " clear address length Clear memory\n" " fill address length value Fill memory\n" + " spl file Load and execute U-Boot SPL\n" , argv[0] ); } @@ -387,7 +549,7 @@ int main(int argc, char **argv) aw_fel_execute(handle, strtoul(argv[2], NULL, 0)); skip=3; } else if (strncmp(argv[1], "ver", 3) == 0 && argc > 1) { - aw_fel_get_version(handle); + aw_fel_print_version(handle); skip=1; } else if (strcmp(argv[1], "write") == 0 && argc > 3) { size_t size; @@ -408,6 +570,11 @@ int main(int argc, char **argv) } else if (strcmp(argv[1], "fill") == 0 && argc > 3) { aw_fel_fill(handle, strtoul(argv[2], NULL, 0), strtoul(argv[3], NULL, 0), (unsigned char)strtoul(argv[4], NULL, 0)); skip=4; + } else if (strcmp(argv[1], "spl") == 0 && argc > 2) { + size_t size; + uint8_t *buf = load_file(argv[2], &size); + aw_fel_write_and_execute_spl(handle, buf, size); + skip=2; } else { fprintf(stderr,"Invalid command %s\n", argv[1]); exit(1); -- 2.0.5

3 7

[U-Boot] [PATCH 0/3] lsxl: fix and rework boot scripts
by Michael Walle 08 Feb '15

08 Feb '15

This fixes an issue which prevents newer kernels from booting. Also add support for the bootz command. I know I'm too late for the merge window (again, really sorry). But these changes are short and only affect one board and only the environment settings. I hope, these can still make it into the 2015.04 release. Michael Walle (3): lsxl: use default load addresses for legacy boot lsxl: place the dtb below the inital ramdisk lsxl: switch from bootm to bootz for boot commands include/configs/lsxl.h | 42 +++++++++++++++++++++++++----------------- 1 file changed, 25 insertions(+), 17 deletions(-) -- 2.1.4

2 4

[U-Boot] MACB TX timeout
by Jason Fu 08 Feb '15

08 Feb '15

Hi, I'm working on sama5d36 evaluation kit. From u-boot, I have set mac, ip. When I try to ping a ip address on LAN. I get "TX timeout". I can ping the ip successful with gmac0, but couldn't with macb0. Did anyone find this issue before? Log: U-Boot> ping 192.168.10.11 macb0: PHY present at 0 macb0: Starting autonegotiation... macb0: Autonegotiation complete macb0: link up, 100Mbps full-duplex (lpa: 0xcd81) Using macb0 device macb0: TX timeout macb0: TX timeout ping failed; host 192.168.10.11 is not alive U-Boot> ping 192.168.10.11 macb0: PHY present at 0 macb0:0 is connected to macb0. Reconnecting to macb0 macb0: Starting autonegotiation... macb0: Autonegotiation timed out (status=0x7849) macb0: link down (status: 0x7849) gmac0: PHY present at 7 gmac0: Starting autonegotiation... gmac0: Autonegotiation complete gmac0: link up, 100Mbps full-duplex (lpa: 0xcd81) Using gmac0 device host 192.168.10.11 is alive Thanks, Jason

2 1

[U-Boot] [PATCH] arm, at91: taurus remove MACH_TYPE definitions in config file
by Heiko Schocher 07 Feb '15

07 Feb '15

remove MACH_TYPE definitions in config file, as they come from the defconfig. Signed-off-by: Heiko Schocher <hs(a)denx.de> --- include/configs/taurus.h | 3 --- 1 file changed, 3 deletions(-) diff --git a/include/configs/taurus.h b/include/configs/taurus.h index b61dc2d..2cf4558 100644 --- a/include/configs/taurus.h +++ b/include/configs/taurus.h @@ -21,9 +21,6 @@ */ #include <asm/hardware.h> -#define MACH_TYPE_TAURUS 2067 -#define MACH_TYPE_AXM 2068 - #define CONFIG_SYS_GENERIC_BOARD #if defined(CONFIG_SPL_BUILD) -- 2.1.0

2 1

[U-Boot] [PATCH] arm, at91: add reset controller status register
by Heiko Schocher 07 Feb '15

07 Feb '15

add reset controller status register Signed-off-by: Heiko Schocher <hs(a)denx.de> --- arch/arm/include/asm/arch-at91/at91_rstc.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/include/asm/arch-at91/at91_rstc.h b/arch/arm/include/asm/arch-at91/at91_rstc.h index a942342..e4eb3da 100644 --- a/arch/arm/include/asm/arch-at91/at91_rstc.h +++ b/arch/arm/include/asm/arch-at91/at91_rstc.h @@ -13,6 +13,8 @@ #ifndef AT91_RSTC_H #define AT91_RSTC_H +/* Reset Controller Status Register */ +#define AT91_ASM_RSTC_SR (ATMEL_BASE_RSTC + 0x04) #define AT91_ASM_RSTC_MR (ATMEL_BASE_RSTC + 0x08) #ifndef __ASSEMBLY__ -- 2.1.0

3 2