September 2016 - U-Boot

[U-Boot] "_ENTRY" is both a struct and a typedef?
by Robert P. J. Day 09 Sep '16

09 Sep '16

from lib/hashtable.c: typedef struct _ENTRY { int used; ENTRY entry; } _ENTRY; ok, that's just kind of creepy ... defining a typedef over top of a struct of the same name. does anyone else find that strange? rday -- ======================================================================== Robert P. J. Day Ottawa, Ontario, CANADA http://crashcourse.ca Twitter: http://twitter.com/rpjday LinkedIn: http://ca.linkedin.com/in/rpjday ========================================================================

3 2

[U-Boot] [PATCH 1/3] sunxi: Sync h3-orangepi dts files with kernel
by Hans de Goede 09 Sep '16

09 Sep '16

This adds an emac node to the orangepi-2 dts (not yet merged upstream, but in u-boot we already have emac support); fixes the alphetically sorting of nodes in sun8i-h3-orangepi-plus.dts and disables some usb controllers in sun8i-h3-orangepi-plus.dts which are only used on the plus2e, as upstream has decided to do a separate dts files for the plus2e. Signed-off-by: Hans de Goede <hdegoede(a)redhat.com> --- arch/arm/dts/sun8i-h3-orangepi-2.dts | 11 +++++ arch/arm/dts/sun8i-h3-orangepi-pc.dts | 1 + arch/arm/dts/sun8i-h3-orangepi-plus.dts | 72 ++++++++++++--------------------- 3 files changed, 37 insertions(+), 47 deletions(-) diff --git a/arch/arm/dts/sun8i-h3-orangepi-2.dts b/arch/arm/dts/sun8i-h3-orangepi-2.dts index f89fe00..caa1a69 100644 --- a/arch/arm/dts/sun8i-h3-orangepi-2.dts +++ b/arch/arm/dts/sun8i-h3-orangepi-2.dts @@ -109,6 +109,17 @@ status = "okay"; }; +&emac { + phy = <&phy1>; + phy-mode = "mii"; + allwinner,use-internal-phy; + allwinner,leds-active-low; + status = "okay"; + phy1: ethernet-phy@1 { + reg = <1>; + }; +}; + &ir { pinctrl-names = "default"; pinctrl-0 = <&ir_pins_a>; diff --git a/arch/arm/dts/sun8i-h3-orangepi-pc.dts b/arch/arm/dts/sun8i-h3-orangepi-pc.dts index 24f8e97..b8340f7 100644 --- a/arch/arm/dts/sun8i-h3-orangepi-pc.dts +++ b/arch/arm/dts/sun8i-h3-orangepi-pc.dts @@ -169,6 +169,7 @@ &emac { phy = <&phy1>; phy-mode = "mii"; + allwinner,use-internal-phy; allwinner,leds-active-low; status = "okay"; phy1: ethernet-phy@1 { diff --git a/arch/arm/dts/sun8i-h3-orangepi-plus.dts b/arch/arm/dts/sun8i-h3-orangepi-plus.dts index 4f4bb0f..e7079b2 100644 --- a/arch/arm/dts/sun8i-h3-orangepi-plus.dts +++ b/arch/arm/dts/sun8i-h3-orangepi-plus.dts @@ -44,21 +44,9 @@ #include "sun8i-h3-orangepi-2.dts" / { - model = "Xunlong Orange Pi Plus / Plus 2 / Plus 2E"; + model = "Xunlong Orange Pi Plus / Plus 2"; compatible = "xunlong,orangepi-plus", "allwinner,sun8i-h3"; - reg_usb3_vbus: usb3-vbus { - compatible = "regulator-fixed"; - pinctrl-names = "default"; - pinctrl-0 = <&usb3_vbus_pin_a>; - regulator-name = "usb3-vbus"; - regulator-min-microvolt = <5000000>; - regulator-max-microvolt = <5000000>; - regulator-boot-on; - enable-active-high; - gpio = <&pio 6 11 GPIO_ACTIVE_HIGH>; - }; - reg_gmac_3v3: gmac-3v3 { compatible = "regulator-fixed"; pinctrl-names = "default"; @@ -70,16 +58,33 @@ enable-active-high; gpio = <&pio 3 6 GPIO_ACTIVE_HIGH>; }; -}; -&ehci2 { - status = "okay"; + reg_usb3_vbus: usb3-vbus { + compatible = "regulator-fixed"; + pinctrl-names = "default"; + pinctrl-0 = <&usb3_vbus_pin_a>; + regulator-name = "usb3-vbus"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + regulator-boot-on; + enable-active-high; + gpio = <&pio 6 11 GPIO_ACTIVE_HIGH>; + }; }; &ehci3 { status = "okay"; }; +&emac { + /* The Orange Pi Plus uses an external phy */ + pinctrl-names = "default"; + pinctrl-0 = <&emac_rgmii_pins>; + phy-supply = <&reg_gmac_3v3>; + phy-mode = "rgmii"; + /delete-property/allwinner,use-internal-phy; +}; + &mmc2 { pinctrl-names = "default"; pinctrl-0 = <&mmc2_8bit_pins>; @@ -97,28 +102,16 @@ allwinner,pull = <SUN4I_PINCTRL_PULL_UP>; }; -&ohci1 { - status = "okay"; -}; - -&ohci2 { - status = "okay"; -}; - -&ohci3 { - status = "okay"; -}; - &pio { - usb3_vbus_pin_a: usb3_vbus_pin@0 { - allwinner,pins = "PG11"; + gmac_power_pin_orangepi: gmac_power_pin@0 { + allwinner,pins = "PD6"; allwinner,function = "gpio_out"; allwinner,drive = <SUN4I_PINCTRL_10_MA>; allwinner,pull = <SUN4I_PINCTRL_NO_PULL>; }; - gmac_power_pin_orangepi: gmac_power_pin@0 { - allwinner,pins = "PD6"; + usb3_vbus_pin_a: usb3_vbus_pin@0 { + allwinner,pins = "PG11"; allwinner,function = "gpio_out"; allwinner,drive = <SUN4I_PINCTRL_10_MA>; allwinner,pull = <SUN4I_PINCTRL_NO_PULL>; @@ -128,18 +121,3 @@ &usbphy { usb3_vbus-supply = <&reg_usb3_vbus>; }; - -&emac { - pinctrl-names = "default"; - pinctrl-0 = <&emac_rgmii_pins>; - phy-supply = <&reg_gmac_3v3>; - phy = <&phy1>; - phy-mode = "rgmii"; - - allwinner,leds-active-low; - status = "okay"; - - phy1: ethernet-phy@1 { - reg = <0>; - }; -}; -- 2.9.3

2 4

[U-Boot] [PATCH] armv8/fsl-layerscape: print SoC revsion number
by Wenbin song 09 Sep '16

09 Sep '16

The exact SoC revsion number can be recognized from U-Boot log. Signed-off-by: Wenbin Song <wenbin.song(a)nxp.com> Signed-off-by: Mingkai Hu <mingkai.hu(a)nxp.com> --- arch/arm/cpu/armv8/fsl-layerscape/cpu.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c index 340d9f9..5cada6d 100644 --- a/arch/arm/cpu/armv8/fsl-layerscape/cpu.c +++ b/arch/arm/cpu/armv8/fsl-layerscape/cpu.c @@ -40,6 +40,8 @@ void cpu_name(char *name) for (i = 0; i < ARRAY_SIZE(cpu_type_list); i++) if ((cpu_type_list[i].soc_ver & SVR_WO_E) == ver) { strcpy(name, cpu_type_list[i].name); + sprintf(name + strlen(name), " Rev%d.%d\n", + SVR_MAJ(svr), SVR_MIN(svr)); if (IS_E_PROCESSOR(svr)) strcat(name, "E"); -- 2.1.0.27.g96db324

1 0

[U-Boot] [PATCH v3 7/7] configs: Adds a defconfig for K2E High Security EVM
by Srinivas, Madan 09 Sep '16

09 Sep '16

Add a new defconfig file for the K2E High Security EVM. This defconfig is the same as for the non-secure part, except for: CONFIG_TI_SECURE_DEVICE option set to 'y' CONFIG_FIT option set to 'y' CONFIG_FIT_IMAGE_POST_PROCESS option set to 'y' Enables the platform-specific post-processing of FIT-extracted blobs such as Kernel, DTB, and initramfs on TI K2E high-security (HS) devices which will ultimately invokes TI proprietary secure functions that performs secure processing such as blob authentication and decryption. Signed-off-by: Vitaly Andrianov <vitalya(a)ti.com> Signed-off-by: Madan Srinivas <madans(a)ti.com> Reviewed-by: Tom Rini <trini(a)konsulko.com> --- Changes in v3: None Changes in v2: - Updates k2e_hs_evm_defconfig to reduce the delta seen if one regenerates it using savedefconfig or similar tools. configs/k2e_hs_evm_defconfig | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 configs/k2e_hs_evm_defconfig diff --git a/configs/k2e_hs_evm_defconfig b/configs/k2e_hs_evm_defconfig new file mode 100644 index 0000000..fc8f22a --- /dev/null +++ b/configs/k2e_hs_evm_defconfig @@ -0,0 +1,43 @@ +CONFIG_ARM=y +CONFIG_ARCH_KEYSTONE=y +CONFIG_TARGET_K2E_EVM=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_DM_SERIAL=y +CONFIG_DEFAULT_DEVICE_TREE="k2e-evm" +CONFIG_SPL=y +CONFIG_FIT=y +CONFIG_OF_BOARD_SETUP=y +CONFIG_FIT_IMAGE_POST_PROCESS=y +CONFIG_HUSH_PARSER=y +CONFIG_SYS_PROMPT="K2E EVM # " +CONFIG_CMD_BOOTZ=y +# CONFIG_CMD_IMLS is not set +CONFIG_CMD_ASKENV=y +# CONFIG_CMD_FLASH is not set +CONFIG_CMD_NAND=y +CONFIG_CMD_SF=y +CONFIG_CMD_SPI=y +CONFIG_CMD_I2C=y +CONFIG_CMD_USB=y +# CONFIG_CMD_SETEXPR is not set +CONFIG_CMD_DHCP=y +CONFIG_CMD_MII=y +CONFIG_CMD_PING=y +CONFIG_CMD_EXT2=y +CONFIG_CMD_EXT4=y +CONFIG_CMD_EXT4_WRITE=y +CONFIG_CMD_FAT=y +CONFIG_CMD_FS_GENERIC=y +CONFIG_OF_CONTROL=y +CONFIG_NET_RANDOM_ETHADDR=y +CONFIG_DM=y +CONFIG_TI_AEMIF=y +CONFIG_DM_SPI_FLASH=y +CONFIG_SPI_FLASH=y +CONFIG_SPI_FLASH_STMICRO=y +CONFIG_DM_ETH=y +CONFIG_SYS_NS16550=y +CONFIG_DM_SPI=y +CONFIG_USB=y +CONFIG_USB_XHCI_HCD=y +CONFIG_USB_XHCI_DWC3=y -- 2.7.4

1 0

[U-Boot] [PATCH v3 6/7] doc: Updates info on using keystone secure devices, from TI
by Srinivas, Madan 09 Sep '16

09 Sep '16

Add a section describing the secure boot image used on keystone secure devices. This patch applies on top of the patch doc: Update info on using AM33xx secure devices from TI submitted by Andrew Davis Signed-off-by: Madan Srinivas <madans(a)ti.com> Reviewed-by: Tom Rini <trini(a)konsulko.com> --- Changes in v3: None Changes in v2: - Updates the secure keystone image name to u-boot_HS_MLO in README.ti-secure to match with the changes made to config.mk in this series version. doc/README.ti-secure | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/doc/README.ti-secure b/doc/README.ti-secure index 9b0fbf9..84c7206 100644 --- a/doc/README.ti-secure +++ b/doc/README.ti-secure @@ -133,6 +133,26 @@ Booting of U-Boot SPL u-boot-spl_HS_X-LOADER - boot image for all other flash memories including QSPI and NOR flash + Invoking the script for Keystone Secure Devices + ============================================= + + create-boot-image.sh \ + <UNUSED> <INPUT_FILE> <OUTPUT_FILE> <UNUSED> + + <UNUSED> is currently ignored and reserved for future use. + + <INPUT_FILE> is the full path and filename of the public world boot + loader binary file (only u-boot.bin is currently supported on + keystone devices, u-boot-spl.bin is not currently supported). + + <OUTPUT_FILE> is the full path and filename of the final secure + image. The output binary images should be used in place of the standard + non-secure binary images (see the platform-specific user's guides and + releases notes for how the non-secure images are typically used) + u-boot_HS_MLO - signed and encrypted boot image that can + be used to boot from all media. Secure boot from SPI NOR + flash is not currently supported. + Booting of Primary U-Boot (u-boot.img) ====================================== -- 2.7.4

1 0

[U-Boot] [PATCH v3 5/7] arm: mach-keystone: config.mk: Adds support for secure, images on K2
by Srinivas, Madan 09 Sep '16

09 Sep '16

Adds an additional image type needed for supporting secure keystone devices. The build generates u-boot_HS_MLO which can be used to boot from all media on secure keystone devices. Signed-off-by: Madan Srinivas <madans(a)ti.com> Cc: Andrew F. Davis <afd(a)ti.com> --- Changes in v3: - Corrects commit message in patch 5/7 in this series to refer to u-boot_HS_MLO Changes in v2: - Changes the target for secure keystone devices in config.mk to u-boot_HS_MLO to keep it in line with the MLO target that is built for non-secure keystone devices. arch/arm/mach-keystone/config.mk | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm/mach-keystone/config.mk b/arch/arm/mach-keystone/config.mk index 9ae1e9a..32fef42 100644 --- a/arch/arm/mach-keystone/config.mk +++ b/arch/arm/mach-keystone/config.mk @@ -5,9 +5,15 @@ # SPDX-License-Identifier: GPL-2.0+ # +include $(srctree)/$(CPUDIR)/omap-common/config_secure.mk + ifndef CONFIG_SPL_BUILD +ifeq ($(CONFIG_TI_SECURE_DEVICE),y) +ALL-y += u-boot_HS_MLO +else ALL-y += MLO endif +endif MKIMAGEFLAGS_u-boot-spl.gph = -A $(ARCH) -T gpimage -C none \ -a $(CONFIG_SPL_TEXT_BASE) -e $(CONFIG_SPL_TEXT_BASE) -n SPL -- 2.7.4

1 0

[U-Boot] [PATCH v3 4/7] arm: omap-common: Enable support for K2 HS devices in, u-boot
by Srinivas, Madan 09 Sep '16

09 Sep '16

Like the OMAP54xx, AM43xx & AM33xx family SoCs, the keystone family of SoCs also have high security enabled models. Allow K2E devices to be built with HS Device Type Support. This patch applies on top of the patch ti: omap-common: Allow AM33xx devices to be built securely submitted by Andrew Davis Signed-off-by: Vitaly Andrianov <vitalya(a)ti.com> Signed-off-by: Madan Srinivas <madans(a)ti.com> Acked-by: Andrew F. Davis <afd(a)ti.com> Reviewed-by: Tom Rini <trini(a)konsulko.com> --- Changes in v3: None Changes in v2: None arch/arm/cpu/armv7/omap-common/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm/cpu/armv7/omap-common/Kconfig b/arch/arm/cpu/armv7/omap-common/Kconfig index 4daccd9..91d6b2c 100644 --- a/arch/arm/cpu/armv7/omap-common/Kconfig +++ b/arch/arm/cpu/armv7/omap-common/Kconfig @@ -1,6 +1,6 @@ config TI_SECURE_DEVICE bool "HS Device Type Support" - depends on OMAP54XX || AM43XX || AM33XX + depends on OMAP54XX || AM43XX || AM33XX || ARCH_KEYSTONE help If a high secure (HS) device type is being used, this config must be set. This option impacts various aspects of the -- 2.7.4

1 0

[U-Boot] [PATCH v3 3/7] arm: omap-common: adds secure image name common to, OMAP and keystone
by Srinivas, Madan 09 Sep '16

09 Sep '16

As K2 can directly boot u-boot, add u-boot_HS_MLO as the secure image while booting secure K2 devicesr, for all boot modes other than SPI flash. Signed-off-by: Madan Srinivas <madans(a)ti.com> Reviewed-by: Tom Rini <trini(a)konsulko.com> --- Changes in v3: None Changes in v2: - Adds a new name for the signed output image in config_secure.mk to keep it in line with the image name used by non-secure keystone devices. arch/arm/cpu/armv7/omap-common/config_secure.mk | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/arm/cpu/armv7/omap-common/config_secure.mk b/arch/arm/cpu/armv7/omap-common/config_secure.mk index 1122439..0ece3f8 100644 --- a/arch/arm/cpu/armv7/omap-common/config_secure.mk +++ b/arch/arm/cpu/armv7/omap-common/config_secure.mk @@ -76,6 +76,12 @@ u-boot-spl_HS_ISSW: $(obj)/u-boot-spl.bin u-boot-spl_HS_SPI_X-LOADER: $(obj)/u-boot-spl.bin $(call if_changed,mkomapsecimg) +# For supporting single stage boot on keystone, the image is a full u-boot +# file, not an SPL. This will work for all boot devices, other than SPI +# flash +u-boot_HS_MLO: $(obj)/u-boot.bin + $(call if_changed,mkomapsecimg) + # For supporting single stage XiP QSPI on AM43xx, the image is a full u-boot # file, not an SPL. In this case the mkomapsecimg command looks for a # u-boot-HS_* prefix -- 2.7.4

1 0

[U-Boot] [PATCH RESEND v3 2/7] arm: mach-keystone: Implements FIT post-processing, call for keystone SoCs
by Srinivas, Madan 09 Sep '16

09 Sep '16

This commit implements the board_fit_image_post_process() function for the keystone architecture. Unlike OMAP class devices, security functions in keystone are not handled in the ROM. The interface to the secure functions is TI proprietary and depending on the keystone platform, the security functions like encryption, decryption and authentication might even be offloaded to other secure processing elements in the SoC. The boot monitor acts as the gateway to these secure functions and the boot monitor for secure devices is available as part of the SECDEV package for KS2. For more details refer doc/README.ti-secure Signed-off-by: Vitaly Andrianov <vitalya(a)ti.com> Signed-off-by: Madan Srinivas <madans(a)ti.com> Cc: Lokesh Vutla <lokeshvutla(a)ti.com> Cc: Dan Murphy <dmurphy(a)ti.com> --- Changes in v3: None Changes in v2: - The following changes are made to mon.c based on review comments Adds NULL pointer check before calling authentication interface Removes an unnecessary printf Updates size of signed FIT blob after post processing removes header arch/arm/mach-keystone/mon.c | 55 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/arch/arm/mach-keystone/mon.c b/arch/arm/mach-keystone/mon.c index 256f630..a952ed2 100644 --- a/arch/arm/mach-keystone/mon.c +++ b/arch/arm/mach-keystone/mon.c @@ -12,10 +12,31 @@ #include <mach/mon.h> asm(".arch_extension sec\n\t"); +#ifdef CONFIG_TI_SECURE_DEVICE +#define KS2_HS_AUTH_FN_OFFSET 8 +#define KS2_HS_SEC_HEADER_LEN 0x60 +#define KS2_AUTH_CMD "2" +/** + * (*fn_auth)() - Invokes security functions using a + * proprietary TI interface. This binary and source for + * this is available in the secure development package or + * SECDEV. For details on how to access this please refer + * doc/README.ti-secure + * + * @first param: no. of parameters + * @second param: parameter list + * @return non-zero value on success, zero on error + */ +static unsigned int (*fn_auth)(int, char * const []); +#endif + int mon_install(u32 addr, u32 dpsc, u32 freq) { int result; +#ifdef CONFIG_TI_SECURE_DEVICE + fn_auth = (void *)(addr + KS2_HS_AUTH_FN_OFFSET); +#endif __asm__ __volatile__ ( "stmfd r13!, {lr}\n" "mov r0, %1\n" @@ -61,3 +82,37 @@ int mon_power_off(int core_id) : "cc", "r0", "r1", "memory"); return result; } + +#ifdef CONFIG_TI_SECURE_DEVICE +static void k2_hs_auth(void *addr) +{ + char *argv1 = KS2_AUTH_CMD; + char argv2[32]; + char *argv[3] = {NULL, argv1, argv2}; + int ret = 0; + + sprintf(argv2, "0x%08x", (u32)addr); + + if (fn_auth) + ret = fn_auth(3, argv); + + if (ret == 0) + hang(); +} + +void board_fit_image_post_process(void **p_image, size_t *p_size) +{ + void *dst = *p_image; + void *src = dst + KS2_HS_SEC_HEADER_LEN; + + k2_hs_auth(*p_image); + + /* + * Overwrite the image headers after authentication + * and decryption. Update size to relect removal + * of header. + */ + *p_size -= KS2_HS_SEC_HEADER_LEN; + memcpy(dst, src, *p_size); +} +#endif -- 2.7.4

1 0

[U-Boot] [PATCH v3 1/7] include: image.h: Fixes build warning with, CONFIG_FIT_IMAGE_POST_PROCESS
by Srinivas, Madan 09 Sep '16

09 Sep '16

The function board_fit_image_post_process is defined only when the config CONFIG_FIT_IMAGE_POST_PROCESS is enabled. For secure systems that do not use SPL but use FIT kernel images, only CONFIG_FIT_IMAGE_POST_PROCESS will be defined, which will result in an implicit declaration of function 'board_fit_image_post_process' warning while building u-boot. This patch fixes this warning. Signed-off-by: Madan Srinivas <madans(a)ti.com> Acked-by: Andrew F. Davis <afd(a)ti.com> Reviewed-by: Tom Rini <trini(a)konsulko.com> --- Changes in v3: None Changes in v2: - Corrects typo in commit message for PATCH 1/7 in this series include/image.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/image.h b/include/image.h index 64da722..6884421 100644 --- a/include/image.h +++ b/include/image.h @@ -1245,7 +1245,8 @@ void android_print_contents(const struct andr_img_hdr *hdr); */ int board_fit_config_name_match(const char *name); -#ifdef CONFIG_SPL_FIT_IMAGE_POST_PROCESS +#if defined(CONFIG_SPL_FIT_IMAGE_POST_PROCESS) || \ + defined(CONFIG_FIT_IMAGE_POST_PROCESS) /** * board_fit_image_post_process() - Do any post-process on FIT binary data * -- 2.7.4

1 0