- Add SD secure boot target for ls1043ardb. - Implement board specific spl_board_init() to setup CAAM stream ID and corresponding stream ID in SMMU. - Change the u-boot size defined by a macro for copying the main U-Boot by SPL to also include the u-boot Secure Boot header size as header is appended to u-boot image. So header will also be copied from SD to DDR. - CONFIG_MAX_SPL_SIZE is limited to 90K.SPL is copied to OCRAM (128K) where 32K are reserved for use by boot ROM and 6K for secure boto header - Error messages during SPL boot are limited to error code numbers instead of strings to reduce the size of SPL image
Signed-off-by: Vinitha Pillai-B57223 vinitha.pillai@nxp.com Signed-off-by: Sumit Garg sumit.garg@nxp.com Signed-off-by: Ruchika Gupta ruchika.gupta@nxp.com --- The patchset is dependent on the following patches: https://patchwork.ozlabs.org/patch/717614/ http://patchwork.ozlabs.org/patch/724332/ http://patchwork.ozlabs.org/patch/729932/ http://patchwork.ozlabs.org/patch/729980/
arch/arm/include/asm/fsl_secure_boot.h | 9 +++- board/freescale/common/fsl_validate.c | 4 ++ board/freescale/ls1043ardb/ls1043ardb.c | 19 +++++++++ configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig | 57 +++++++++++++++++++++++++ include/configs/ls1043a_common.h | 16 ++++++- 5 files changed, 101 insertions(+), 4 deletions(-) create mode 100644 configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig
diff --git a/arch/arm/include/asm/fsl_secure_boot.h b/arch/arm/include/asm/fsl_secure_boot.h index 8d9de45..a1474eb 100644 --- a/arch/arm/include/asm/fsl_secure_boot.h +++ b/arch/arm/include/asm/fsl_secure_boot.h @@ -32,10 +32,11 @@ #define CONFIG_SPL_UBOOT_KEY_HASH NULL #endif /* ifdef CONFIG_SPL_BUILD */
+#define CONFIG_KEY_REVOCATION + #ifndef CONFIG_SPL_BUILD #define CONFIG_CMD_BLOB #define CONFIG_CMD_HASH -#define CONFIG_KEY_REVOCATION #ifndef CONFIG_SYS_RAMBOOT /* The key used for verification of next level images * is picked up from an Extension Table which has @@ -91,7 +92,11 @@ /* For SD boot address and size are assigned in terms of sector * offset and no. of sectors respectively. */ -#define CONFIG_BS_HDR_ADDR_DEVICE 0x00000900 +#if defined(CONFIG_LS1043A) +#define CONFIG_BS_HDR_ADDR_DEVICE 0x00000920 +#else +#define CONFIG_BS_HDR_ADDR_DEVICE 0x00000900 +#endif #define CONFIG_BS_ADDR_DEVICE 0x00000940 #define CONFIG_BS_HDR_SIZE 0x00000010 #define CONFIG_BS_SIZE 0x00000008 diff --git a/board/freescale/common/fsl_validate.c b/board/freescale/common/fsl_validate.c index 2b723a4..235c6ab 100644 --- a/board/freescale/common/fsl_validate.c +++ b/board/freescale/common/fsl_validate.c @@ -356,6 +356,7 @@ static void fsl_secboot_bootscript_parse_failure(void) */ void fsl_secboot_handle_error(int error) { +#ifndef CONFIG_SPL_BUILD const struct fsl_secboot_errcode *e;
for (e = fsl_secboot_errcodes; e->errcode != ERROR_ESBC_CLIENT_MAX; @@ -363,6 +364,9 @@ void fsl_secboot_handle_error(int error) if (e->errcode == error) printf("ERROR :: %x :: %s\n", error, e->name); } +#else + printf("ERROR :: %x\n", error); +#endif
/* If Boot Mode is secure, transition the SNVS state and issue * reset based on type of failure and ITS setting. diff --git a/board/freescale/ls1043ardb/ls1043ardb.c b/board/freescale/ls1043ardb/ls1043ardb.c index 5a76742..0b3840d 100644 --- a/board/freescale/ls1043ardb/ls1043ardb.c +++ b/board/freescale/ls1043ardb/ls1043ardb.c @@ -43,6 +43,25 @@ int board_early_init_f(void) return 0; }
+#if defined(CONFIG_SPL_BUILD) +void spl_board_init(void) +{ +#ifdef CONFIG_SECURE_BOOT + /* + * In case of Secure Boot, the IBR configures the SMMU + * to allow only Secure transactions. + * SMMU must be reset in bypass mode. + * Set the ClientPD bit and Clear the USFCFG Bit + */ + u32 val; + val = (in_le32(SMMU_SCR0) | SCR0_CLIENTPD_MASK) & ~(SCR0_USFCFG_MASK); + out_le32(SMMU_SCR0, val); + val = (in_le32(SMMU_NSCR0) | SCR0_CLIENTPD_MASK) & ~(SCR0_USFCFG_MASK); + out_le32(SMMU_NSCR0, val); +#endif +} +#endif + #ifndef CONFIG_SPL_BUILD
int checkboard(void) diff --git a/configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig b/configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig new file mode 100644 index 0000000..3f35d64 --- /dev/null +++ b/configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig @@ -0,0 +1,57 @@ +CONFIG_ARM=y +CONFIG_TARGET_LS1043ARDB=y +CONFIG_SPL_LIBCOMMON_SUPPORT=y +CONFIG_SPL_LIBGENERIC_SUPPORT=y +CONFIG_SPL_MMC_SUPPORT=y +CONFIG_SPL_SERIAL_SUPPORT=y +CONFIG_SPL_ENV_SUPPORT=y +CONFIG_SPL_DRIVERS_MISC_SUPPORT=y +CONFIG_SPL_WATCHDOG_SUPPORT=y +CONFIG_DEFAULT_DEVICE_TREE="fsl-ls1043a-rdb" +CONFIG_FIT=y +CONFIG_FIT_VERBOSE=y +CONFIG_OF_BOARD_SETUP=y +CONFIG_SYS_EXTRA_OPTIONS="RAMBOOT_PBL,SPL_FSL_PBL,SD_BOOT" +CONFIG_SECURE_BOOT=y +CONFIG_SD_BOOT=y +CONFIG_BOOTDELAY=10 +CONFIG_SPL=y +CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_USE_SECTOR=y +CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_SECTOR=0x110 +CONFIG_SPL_MPC8XXX_INIT_DDR_SUPPORT=y +CONFIG_HUSH_PARSER=y +CONFIG_CMD_GPT=y +CONFIG_CMD_MMC=y +CONFIG_CMD_SF=y +CONFIG_CMD_I2C=y +CONFIG_CMD_USB=y +CONFIG_CMD_DHCP=y +CONFIG_CMD_PXE=y +CONFIG_CMD_MII=y +CONFIG_CMD_PING=y +CONFIG_CMD_CACHE=y +CONFIG_CMD_EXT2=y +CONFIG_CMD_FAT=y +# CONFIG_SPL_EFI_PARTITION is not set +CONFIG_OF_CONTROL=y +CONFIG_DM=y +CONFIG_SPL_DM=y +CONFIG_MTD_NOR_FLASH=y +CONFIG_SPI_FLASH=y +CONFIG_NETDEVICES=y +CONFIG_E1000=y +CONFIG_PCI=y +CONFIG_DM_PCI=y +CONFIG_DM_PCI_COMPAT=y +CONFIG_PCIE_LAYERSCAPE=y +CONFIG_SYS_NS16550=y +CONFIG_DM_SPI=y +CONFIG_USB=y +CONFIG_DM_USB=y +CONFIG_USB_XHCI_HCD=y +CONFIG_USB_XHCI_DWC3=y +CONFIG_USB_STORAGE=y +CONFIG_RSA=y +CONFIG_SPL_RSA=y +CONFIG_SPL_CRYPTO_SUPPORT=y +CONFIG_SPL_HASH_SUPPORT=y diff --git a/include/configs/ls1043a_common.h b/include/configs/ls1043a_common.h index e8ba031..70099f6 100644 --- a/include/configs/ls1043a_common.h +++ b/include/configs/ls1043a_common.h @@ -52,7 +52,7 @@ #define CONFIG_SPL_TARGET "u-boot-with-spl.bin"
#define CONFIG_SPL_TEXT_BASE 0x10000000 -#define CONFIG_SPL_MAX_SIZE 0x1d000 +#define CONFIG_SPL_MAX_SIZE 0x17000 #define CONFIG_SPL_STACK 0x1001e000 #define CONFIG_SPL_PAD_TO 0x1d000
@@ -61,7 +61,19 @@ #define CONFIG_SYS_SPL_MALLOC_SIZE 0x100000 #define CONFIG_SPL_BSS_START_ADDR 0x80100000 #define CONFIG_SPL_BSS_MAX_SIZE 0x80000 -#define CONFIG_SYS_MONITOR_LEN 0xa0000 + +#ifdef CONFIG_SECURE_BOOT +#define CONFIG_U_BOOT_HDR_SIZE (16 << 10) +/* + * HDR would be appended at end of image and copied to DDR along + * with U-Boot image. Here u-boot max. size is 512K. So if binary + * size increases then increase this size in case of secure boot as + * it uses raw u-boot image instead of fit image. + */ +#define CONFIG_SYS_MONITOR_LEN (0x100000 + CONFIG_U_BOOT_HDR_SIZE) +#else +#define CONFIG_SYS_MONITOR_LEN 0x100000 +#endif /* ifdef CONFIG_SECURE_BOOT */ #endif
/* NAND SPL */