From: Madan Srinivas madans@ti.com

The function 'board_fit_image_post_process' is defined only when the config option CONFIG_FIT_IMAGE_POST_PROCESS is enabled. For secure systems that do not use SPL but do use FIT kernel images, only CONFIG_FIT_IMAGE_POST_PROCESS will be defined, which will result in an implicit declaration of function 'board_fit_image_post_process' warning while building u-boot. Fix this warning.

Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Andrew F. Davis afd@ti.com Reviewed-by: Tom Rini trini@konsulko.com --- include/image.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/image.h b/include/image.h index 2372518960..3f26f9bd1f 100644 --- a/include/image.h +++ b/include/image.h @@ -1256,7 +1256,8 @@ void android_print_contents(const struct andr_img_hdr *hdr); */ int board_fit_config_name_match(const char *name);

-#ifdef CONFIG_SPL_FIT_IMAGE_POST_PROCESS +#if defined(CONFIG_SPL_FIT_IMAGE_POST_PROCESS) || \ + defined(CONFIG_FIT_IMAGE_POST_PROCESS) /** * board_fit_image_post_process() - Do any post-process on FIT binary data *

From: Vitaly Andrianov vitalya@ti.com

This commit implements the board_fit_image_post_process() function for the keystone architecture. This function calls into the secure boot monitor for secure authentication/decryption of the image. All needed work is handled by the boot monitor and, depending on the keystone platform, the security functions may be offloaded to other secure processing elements in the SoC.

The boot monitor acts as the gateway to these secure functions and the boot monitor for secure devices is available as part of the SECDEV package for KS2. For more details refer doc/README.ti-secure

Signed-off-by: Vitaly Andrianov vitalya@ti.com Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Andrew F. Davis afd@ti.com Reviewed-by: Tom Rini trini@konsulko.com --- arch/arm/mach-keystone/mon.c | 73 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+)

diff --git a/arch/arm/mach-keystone/mon.c b/arch/arm/mach-keystone/mon.c index 256f6300ed..81009848d0 100644 --- a/arch/arm/mach-keystone/mon.c +++ b/arch/arm/mach-keystone/mon.c @@ -10,6 +10,7 @@ #include <common.h> #include <command.h> #include <mach/mon.h> +#include <spl.h> asm(".arch_extension sec\n\t");

int mon_install(u32 addr, u32 dpsc, u32 freq) @@ -61,3 +62,75 @@ int mon_power_off(int core_id) : "cc", "r0", "r1", "memory"); return result; } + +#ifdef CONFIG_TI_SECURE_DEVICE +#define KS2_HS_SEC_HEADER_LEN 0x60 +#define KS2_HS_SEC_TAG_OFFSET 0x34 +#define KS2_AUTH_CMD 130 + +/** + * k2_hs_bm_auth() - Invokes security functions using a + * proprietary TI interface. This binary and source for + * this is available in the secure development package or + * SECDEV. For details on how to access this please refer + * doc/README.ti-secure + * + * @cmd: Secure monitor command + * @arg1: Argument for command + * + * returns non-zero value on success, zero on error + */ +static int k2_hs_bm_auth(int cmd, void *arg1) +{ + int result; + + asm volatile ( + "stmfd r13!, {r4-r12, lr}\n" + "mov r0, %1\n" + "mov r1, %2\n" + "smc #2\n" + "ldmfd r13!, {r4-r12, lr}\n" + : "=&r" (result) + : "r" (cmd), "r" (arg1) + : "cc", "r0", "r1", "memory"); + + return result; +} + +void board_fit_image_post_process(void **p_image, size_t *p_size) +{ + int result = 0; + void *image = *p_image; + + if (strncmp(image + KS2_HS_SEC_TAG_OFFSET, "KEYS", 4)) { + printf("No signature found in image!\n"); + hang(); + } + + result = k2_hs_bm_auth(KS2_AUTH_CMD, image); + if (result == 0) { + printf("Authentication failed!\n"); + hang(); + } + + /* + * Overwrite the image headers after authentication + * and decryption. Update size to reflect removal + * of header. + */ + memcpy(image, image + KS2_HS_SEC_HEADER_LEN, *p_size); + *p_size -= KS2_HS_SEC_HEADER_LEN; + + /* + * Output notification of successful authentication to re-assure the + * user that the secure code is being processed as expected. However + * suppress any such log output in case of building for SPL and booting + * via YMODEM. This is done to avoid disturbing the YMODEM serial + * protocol transactions. + */ + if (!(IS_ENABLED(CONFIG_SPL_BUILD) && + IS_ENABLED(CONFIG_SPL_YMODEM_SUPPORT) && + spl_boot_device() == BOOT_DEVICE_UART)) + printf("Authentication passed\n"); +} +#endif

From: Madan Srinivas madans@ti.com

As K2 can directly boot U-Boot, add u-boot_HS_MLO as the secure image name for secure K2 devices, for all boot modes other than SPI flash.

Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Andrew F. Davis afd@ti.com Reviewed-by: Tom Rini trini@konsulko.com --- arch/arm/mach-omap2/config_secure.mk | 6 ++++++ 1 file changed, 6 insertions(+)

diff --git a/arch/arm/mach-omap2/config_secure.mk b/arch/arm/mach-omap2/config_secure.mk index 0c843338d7..0346cb93ab 100644 --- a/arch/arm/mach-omap2/config_secure.mk +++ b/arch/arm/mach-omap2/config_secure.mk @@ -77,6 +77,12 @@ u-boot-spl_HS_ISSW: $(obj)/u-boot-spl.bin FORCE u-boot-spl_HS_SPI_X-LOADER: $(obj)/u-boot-spl.bin FORCE $(call if_changed,mkomapsecimg)

+# For supporting single stage boot on keystone, the image is a full u-boot +# file, not an SPL. This will work for all boot devices, other than SPI +# flash +u-boot_HS_MLO: $(obj)/u-boot.bin + $(call if_changed,mkomapsecimg) + # For supporting single stage XiP QSPI on AM43xx, the image is a full u-boot # file, not an SPL. In this case the mkomapsecimg command looks for a # u-boot-HS_* prefix

From: Madan Srinivas madans@ti.com

Add a section describing the secure boot image used on Keystone2 secure devices.

Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Andrew F. Davis afd@ti.com Reviewed-by: Tom Rini trini@konsulko.com --- doc/README.ti-secure | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)

diff --git a/doc/README.ti-secure b/doc/README.ti-secure index 9b0fbf9732..4b5380c0f3 100644 --- a/doc/README.ti-secure +++ b/doc/README.ti-secure @@ -133,6 +133,26 @@ Booting of U-Boot SPL u-boot-spl_HS_X-LOADER - boot image for all other flash memories including QSPI and NOR flash

+ Invoking the script for Keystone2 Secure Devices + ============================================= + + create-boot-image.sh \ + <UNUSED> <INPUT_FILE> <OUTPUT_FILE> <UNUSED> + + <UNUSED> is currently ignored and reserved for future use. + + <INPUT_FILE> is the full path and filename of the public world boot + loader binary file (only u-boot.bin is currently supported on + Keystone2 devices, u-boot-spl.bin is not currently supported). + + <OUTPUT_FILE> is the full path and filename of the final secure image. + The output binary images should be used in place of the standard + non-secure binary images (see the platform-specific user's guides + and releases notes for how the non-secure images are typically used) + u-boot_HS_MLO - signed and encrypted boot image that can be used to + boot from all media. Secure boot from SPI NOR flash is not + currently supported. + Booting of Primary U-Boot (u-boot.img) ======================================

From: Vitaly Andrianov vitalya@ti.com

TI K2E secure devices have to be built with TI_SECURE_DEVICE, FIT, and FIT_IMAGE_POST_PROCESS enabled. Add a dedicated defconfig for this.

Signed-off-by: Vitaly Andrianov vitalya@ti.com Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Andrew F. Davis afd@ti.com Reviewed-by: Simon Glass sjg@chromium.org --- configs/k2e_hs_evm_defconfig | 51 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 configs/k2e_hs_evm_defconfig

diff --git a/configs/k2e_hs_evm_defconfig b/configs/k2e_hs_evm_defconfig new file mode 100644 index 0000000000..d515cedaca --- /dev/null +++ b/configs/k2e_hs_evm_defconfig @@ -0,0 +1,51 @@ +CONFIG_ARM=y +CONFIG_ARCH_KEYSTONE=y +CONFIG_SYS_TEXT_BASE=0x0c000060 +CONFIG_TARGET_K2E_EVM=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_DEFAULT_DEVICE_TREE="keystone-k2e-evm" +CONFIG_FIT=y +CONFIG_FIT_IMAGE_POST_PROCESS=y +CONFIG_OF_BOARD_SETUP=y +CONFIG_SYS_CONSOLE_INFO_QUIET=y +CONFIG_VERSION_VARIABLE=y +CONFIG_HUSH_PARSER=y +CONFIG_SYS_PROMPT="K2E HS EVM # " +CONFIG_CMD_BOOTZ=y +# CONFIG_CMD_IMLS is not set +CONFIG_CMD_ASKENV=y +# CONFIG_CMD_FLASH is not set +CONFIG_CMD_NAND=y +CONFIG_CMD_PART=y +CONFIG_CMD_SF=y +CONFIG_CMD_SPI=y +CONFIG_CMD_I2C=y +CONFIG_CMD_USB=y +# CONFIG_CMD_SETEXPR is not set +CONFIG_CMD_DHCP=y +CONFIG_CMD_MII=y +CONFIG_CMD_PING=y +CONFIG_CMD_EXT2=y +CONFIG_CMD_EXT4=y +CONFIG_CMD_EXT4_WRITE=y +CONFIG_CMD_FAT=y +CONFIG_CMD_FS_GENERIC=y +CONFIG_CMD_UBI=y +CONFIG_ISO_PARTITION=y +CONFIG_EFI_PARTITION=y +CONFIG_OF_CONTROL=y +CONFIG_NET_RANDOM_ETHADDR=y +CONFIG_DM=y +CONFIG_TI_AEMIF=y +# CONFIG_MMC is not set +CONFIG_DM_SPI_FLASH=y +CONFIG_SPI_FLASH=y +CONFIG_SPI_FLASH_STMICRO=y +CONFIG_DM_ETH=y +CONFIG_DM_SERIAL=y +CONFIG_SYS_NS16550=y +CONFIG_DM_SPI=y +CONFIG_USB=y +CONFIG_USB_XHCI_HCD=y +CONFIG_USB_XHCI_DWC3=y +CONFIG_USB_STORAGE=y