Adds doc/README.ti-secure file to explain in generic terms how boot images need to be created for secure devices from Texas Instruments.

Specific details for creating secure boot images for the AM43xx, DRA7xx and AM57xx secure devices from Texas Instruments are also provided in the README file.

Secure devices require a security development package (SECDEV) package that can be downloaded from:

http://www.ti.com/mysecuresoftware

Login is required and access is granted under appropriate NDA and export control restrictions.

Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Daniel Allred d-allred@ti.com --- doc/README.ti-secure | 92 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 doc/README.ti-secure

diff --git a/doc/README.ti-secure b/doc/README.ti-secure new file mode 100644 index 0000000..fa818ae --- /dev/null +++ b/doc/README.ti-secure @@ -0,0 +1,92 @@ +README on how boot images are created for secure TI devices + +CONFIG_TI_SECURE_DEVICE: +Secure TI devices require a boot image that is authenticated by ROM +code to function. Without this, even JTAG remains locked and the +device is essentially useless. In order to create a valid boot image for +a secure device from TI, the initial public software image must be signed +and combined with various headers, certificates, and other binary images. + +Information on the details on the complete boot image format can be obtained +from Texas Instruments. The tools used to generate boot images for secure +devices are part of a secure development package (SECDEV) that can be +downloaded from: + + http://www.ti.com/mysecuresoftware (login required) + +The secure development package is access controlled due to NDA and export +control restrictions. Access must be requested and granted by TI before the +package is viewable and downloadable. Contact TI, either online or by way +of a local TI representative, to request access. + +When CONFIG_TI_SECURE_DEVICE is set, the U-Boot SPL build process requires +the presence and use of these tools in order to create a viable boot image. +The build process will look for the environment variable TI_SECURE_DEV_PKG, +which should be the path of the installed SECDEV package. If the +TI_SECURE_DEV_PKG variable is not defined or if it is defined but doesn't +point to a valid SECDEV package, a warning is issued during the build to +indicate that a final secure bootable image was not created. + +Within the SECDEV package exists an image creation script: + +${TI_SECURE_DEV_PKG}/scripts/create-boot-image.sh + +This is called as part of the SPL/u-boot build process. As the secure boot +image formats and requirements differ between secure SOC from TI, the +purpose of this script is to abstract these details as much as possible. + +The script is basically the only required interface to the TI SECDEV package +for secure TI devices. + +Invoking the script for AM43xx Secure Devices +============================================= + +create-boot-image.sh <IMAGE_FLAG> <INPUT_FILE> <OUTPUT_FILE> <SPL_LOAD_ADDR> + +<IMAGE_FLAG> is a value that specifies the type of the image to generate OR +the action the image generation tool will take. Valid values are: + SPI_X-LOADER - Generates an image for SPI flash (byte swapped) + XIP_X-LOADER - Generates a single stage u-boot for NOR/QSPI XiP + ISSW - Generates an image for all other boot modes + +<INPUT_FILE> is the full path and filename of the public world boot loader +binary file (depending on the boot media, this is usually either +u-boot-spl.bin or u-boot.bin). + +<OUTPUT_FILE> is the full path and filename of the final secure image. The +output binary images should be used in place of the standard non-secure +binary images (see the platform-specific user's guides and releases notes +for how the non-secure images are typically used) + u-boot-spl_HS_SPI_X-LOADER - byte swapped boot image for SPI flash + u-boot_HS_XIP_X-LOADER - boot image for NOR or QSPI flash + u-boot-spl_HS_ISSW - boot image for all other boot media + +<SPL_LOAD_ADDR> is the address at which SOC ROM should load the <INPUT_FILE> + +Invoking the script for DRA7xx/AM57xx Secure Devices +==================================================== + +create-boot-image.sh <IMAGE_TYPE> <INPUT_FILE> <OUTPUT_FILE> + +<IMAGE_TYPE> is a value that specifies the type of the image to generate OR +the action the image generation tool will take. Valid values are: + X-LOADER - Generates an image for NOR or QSPI boot modes + MLO - Generates an image for SD/MMC/eMMC boot modes + ULO - Generates an image for USB/UART peripheral boot modes + Note: ULO is not yet used by the u-boot build process + +<INPUT_FILE> is the full path and filename of the public world boot loader +binary file (for this platform, this is always u-boot-spl.bin). + + +<OUTPUT_FILE> is the full path and filename of the final secure image. The +output binary images should be used in place of the standard non-secure +binary images (see the platform-specific user's guides and releases notes +for how the non-secure images are typically used) + u-boot-spl_HS_MLO - boot image for SD/MMC/eMMC.This image is + copied to a file named MLO, which is the name that + the device ROM bootloader requires for loading from + the FAT partition of an SD card (same as on + non-secure devices) + u-boot-spl_HS_X-LOADER - boot image for all other flash memories + including QSPI and NOR flash

From: Madan Srinivas madans@ti.com

Adds a new Kconfig file for AM33xx class devices. We need a common place to define CONFIG parameters for these SOCs, especially for adding support for secure devices.

a) Adds a definition for ISW_ENTRY_ADDR. This is the address to which the ROM branches when the SOC ROM hands off execution to the boot loader. CONFIG_SYS_TEXT_BASE and CONFIG_SPL_TEXT_BASE are set to this value for AM43xx devices.

b) Adds CONFIG_PUB_ROM_DATA_SIZE which is used to calculate CONFIG_SPL_MAX_SIZE. This value indicates the amount of memory needed by the ROM to store data during the boot process.

Currently, these CONFIG options are used only by AM43xx, but in future other AM33xx class SOCs will also use them.

Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Daniel Allred d-allred@ti.com --- arch/arm/cpu/armv7/am33xx/Kconfig | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 arch/arm/cpu/armv7/am33xx/Kconfig

diff --git a/arch/arm/cpu/armv7/am33xx/Kconfig b/arch/arm/cpu/armv7/am33xx/Kconfig new file mode 100644 index 0000000..39759cd --- /dev/null +++ b/arch/arm/cpu/armv7/am33xx/Kconfig @@ -0,0 +1,27 @@ +config ISW_ENTRY_ADDR + hex "Address in memory or XIP flash of bootloader entry point" + help + After any reset, the boot ROM on the AM43XX SOC + searches the boot media for a valid boot image. + For non-XIP devices, the ROM then copies the + image into internal memory. + For all boot modes, after the ROM processes the + boot image it eventually computes the entry + point address depending on the device type + (secure/non-secure), boot media (xip/non-xip) and + image headers. + default 0x402F4000 + +config PUB_ROM_DATA_SIZE + hex "Size in bytes of the L3 SRAM reserved by ROM to store data" + help + During the device boot, the public ROM uses the top of + the public L3 OCMC RAM to store r/w data like stack, + heap, globals etc. When the ROM is copying the boot + image from the boot media into memory, the image must + not spill over into this area. This value can be used + during compile time to determine the maximum size of a + boot image. Once the ROM transfers control to the boot + image, this area is no longer used, and can be reclaimed + for run time use by the boot image. + default 0x8400

From: Madan Srinivas madans@ti.com

Adding support for AM43xx secure devices require the addition of some SOC specific config options like the amount of memory used by public ROM and the address of the entry point of u-boot or SPL, as seen by the ROM code, for the image to be built correctly.

This mandates the addition of am AM43xx CONFIG option and the ARM Kconfig file has been modified to source this SOC Kconfig file. Moving the TARGET_AM43XX_EVM config option to the SOC KConfig and out of the arch/arm/Kconfig.

Updating defconfigs to add the CONFIG_AM43XX=y statement and removing the #define CONFIG_AM43XX from the header file.

Signed-off-by: Madan Srinivas madans@ti.com Signed-off-by: Daniel Allred d-allred@ti.com --- arch/arm/Kconfig | 19 +++++++++++++------ arch/arm/cpu/armv7/am33xx/Kconfig | 13 +++++++++++++ configs/am43xx_evm_defconfig | 1 + configs/am43xx_evm_ethboot_defconfig | 1 + configs/am43xx_evm_qspiboot_defconfig | 1 + configs/am43xx_evm_usbhost_boot_defconfig | 1 + include/configs/am43xx_evm.h | 2 -- 7 files changed, 30 insertions(+), 8 deletions(-)

diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig index f18dbe6..088d6e0 100644 --- a/arch/arm/Kconfig +++ b/arch/arm/Kconfig @@ -381,12 +381,6 @@ config TARGET_AM335X_SL50 select DM select DM_SERIAL

-config TARGET_AM43XX_EVM - bool "Support am43xx_evm" - select CPU_V7 - select SUPPORT_SPL - select TI_I2C_BOARD_DETECT - config TARGET_BAV335X bool "Support bav335x" select CPU_V7 @@ -507,6 +501,17 @@ config OMAP54XX select CPU_V7 select SUPPORT_SPL

+config AM43XX + bool "AM43XX SoC" + select CPU_V7 + select SUPPORT_SPL + help + Support for AM43xx SOC from Texas Instruments. + The AM43xx high performance SOC features a Cortex-A9 + ARM core, a quad core PRU-ICSS for industrial Ethernet + protocols, dual camera support, optional 3D graphics + and an optional customer programmable secure boot. + config RMOBILE bool "Renesas ARM SoCs" select CPU_V7 @@ -776,6 +781,8 @@ source "arch/arm/cpu/armv7/omap4/Kconfig"

source "arch/arm/cpu/armv7/omap5/Kconfig"

+source "arch/arm/cpu/armv7/am33xx/Kconfig" + source "arch/arm/mach-orion5x/Kconfig"

source "arch/arm/cpu/armv7/rmobile/Kconfig" diff --git a/arch/arm/cpu/armv7/am33xx/Kconfig b/arch/arm/cpu/armv7/am33xx/Kconfig index 39759cd..68bcc64 100644 --- a/arch/arm/cpu/armv7/am33xx/Kconfig +++ b/arch/arm/cpu/armv7/am33xx/Kconfig @@ -1,3 +1,15 @@ +if AM43XX +config TARGET_AM43XX_EVM + bool "Support am43xx_evm" + select CREATE_BOARD_SYMLINK + help + This option specifies support for the AM43xx + GP and HS EVM development platforms.The AM437x + GP EVM is a standalone test, development, and + evaluation module system that enables developers + to write software and develop hardware around + an AM43xx processor subsystem. + config ISW_ENTRY_ADDR hex "Address in memory or XIP flash of bootloader entry point" help @@ -25,3 +37,4 @@ config PUB_ROM_DATA_SIZE image, this area is no longer used, and can be reclaimed for run time use by the boot image. default 0x8400 +endif diff --git a/configs/am43xx_evm_defconfig b/configs/am43xx_evm_defconfig index cc83006..4b0a188 100644 --- a/configs/am43xx_evm_defconfig +++ b/configs/am43xx_evm_defconfig @@ -1,4 +1,5 @@ CONFIG_ARM=y +CONFIG_AM43XX=y CONFIG_TARGET_AM43XX_EVM=y CONFIG_SPL=y CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND" diff --git a/configs/am43xx_evm_ethboot_defconfig b/configs/am43xx_evm_ethboot_defconfig index a720c14..20001ca 100644 --- a/configs/am43xx_evm_ethboot_defconfig +++ b/configs/am43xx_evm_ethboot_defconfig @@ -1,4 +1,5 @@ CONFIG_ARM=y +CONFIG_AM43XX=y CONFIG_TARGET_AM43XX_EVM=y CONFIG_SPL=y CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND,SPL_ETH_SUPPORT" diff --git a/configs/am43xx_evm_qspiboot_defconfig b/configs/am43xx_evm_qspiboot_defconfig index 6db389b..2170a68 100644 --- a/configs/am43xx_evm_qspiboot_defconfig +++ b/configs/am43xx_evm_qspiboot_defconfig @@ -1,4 +1,5 @@ CONFIG_ARM=y +CONFIG_AM43XX=y CONFIG_TARGET_AM43XX_EVM=y CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,QSPI,QSPI_BOOT" # CONFIG_CMD_IMLS is not set diff --git a/configs/am43xx_evm_usbhost_boot_defconfig b/configs/am43xx_evm_usbhost_boot_defconfig index cbaf5a5..14343a9 100644 --- a/configs/am43xx_evm_usbhost_boot_defconfig +++ b/configs/am43xx_evm_usbhost_boot_defconfig @@ -1,4 +1,5 @@ CONFIG_ARM=y +CONFIG_AM43XX=y CONFIG_TARGET_AM43XX_EVM=y CONFIG_SPL=y CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND,SPL_USB_HOST_SUPPORT" diff --git a/include/configs/am43xx_evm.h b/include/configs/am43xx_evm.h index fd3f6a7..b98f7a1 100644 --- a/include/configs/am43xx_evm.h +++ b/include/configs/am43xx_evm.h @@ -9,8 +9,6 @@ #ifndef __CONFIG_AM43XX_EVM_H #define __CONFIG_AM43XX_EVM_H

-#define CONFIG_AM43XX - #define CONFIG_CMD_FAT

#define CONFIG_BOARD_LATE_INIT

From: Madan Srinivas madans@ti.com

Adds new defconfig files for AM43xx secure devices. These are the same as the non-secure parts, except for CONFIG_TI_SECURE_DEVICE option set to 'y' CONFIG_ISW_ENTRY_ADDR updated for secure images.

Signed-off-by: Daniel Allred d-allred@ti.com Signed-off-by: Madan Srinivas madans@ti.com --- configs/am43xx_hs_evm_defconfig | 12 ++++++++++++ configs/am43xx_hs_evm_ethboot_defconfig | 11 +++++++++++ configs/am43xx_hs_evm_qspiboot_defconfig | 10 ++++++++++ configs/am43xx_hs_evm_rtconly_defconfig | 12 ++++++++++++ configs/am43xx_hs_evm_usbhost_boot_defconfig | 11 +++++++++++ configs/am43xx_hs_evm_usbspl_defconfig | 12 ++++++++++++ 6 files changed, 68 insertions(+) create mode 100644 configs/am43xx_hs_evm_defconfig create mode 100644 configs/am43xx_hs_evm_ethboot_defconfig create mode 100644 configs/am43xx_hs_evm_qspiboot_defconfig create mode 100644 configs/am43xx_hs_evm_rtconly_defconfig create mode 100644 configs/am43xx_hs_evm_usbhost_boot_defconfig create mode 100644 configs/am43xx_hs_evm_usbspl_defconfig

diff --git a/configs/am43xx_hs_evm_defconfig b/configs/am43xx_hs_evm_defconfig new file mode 100644 index 0000000..a79a82b --- /dev/null +++ b/configs/am43xx_hs_evm_defconfig @@ -0,0 +1,12 @@ +CONFIG_ARM=y +CONFIG_AM43XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_AM43XX_EVM=y +CONFIG_SPL=y +CONFIG_ISW_ENTRY_ADDR=0x40302ae0 +CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND" +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +# CONFIG_CMD_SETEXPR is not set +CONFIG_SPI_FLASH_BAR=y +CONFIG_SPI_FLASH=y diff --git a/configs/am43xx_hs_evm_ethboot_defconfig b/configs/am43xx_hs_evm_ethboot_defconfig new file mode 100644 index 0000000..06729fd --- /dev/null +++ b/configs/am43xx_hs_evm_ethboot_defconfig @@ -0,0 +1,11 @@ +CONFIG_ARM=y +CONFIG_AM43XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_AM43XX_EVM=y +CONFIG_SPL=y +CONFIG_ISW_ENTRY_ADDR=0x40302ae0 +CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND,SPL_ETH_SUPPORT" +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +# CONFIG_CMD_SETEXPR is not set +CONFIG_SPI_FLASH=y diff --git a/configs/am43xx_hs_evm_qspiboot_defconfig b/configs/am43xx_hs_evm_qspiboot_defconfig new file mode 100644 index 0000000..8ae4672 --- /dev/null +++ b/configs/am43xx_hs_evm_qspiboot_defconfig @@ -0,0 +1,10 @@ +CONFIG_ARM=y +CONFIG_AM43XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_AM43XX_EVM=y +CONFIG_ISW_ENTRY_ADDR=0x30002ae0 +CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,QSPI,QSPI_BOOT" +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +# CONFIG_CMD_SETEXPR is not set +CONFIG_SPI_FLASH=y diff --git a/configs/am43xx_hs_evm_rtconly_defconfig b/configs/am43xx_hs_evm_rtconly_defconfig new file mode 100644 index 0000000..25c2db2 --- /dev/null +++ b/configs/am43xx_hs_evm_rtconly_defconfig @@ -0,0 +1,12 @@ +CONFIG_ARM=y +CONFIG_AM43XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_AM43XX_EVM=y +CONFIG_SPL=y +CONFIG_ISW_ENTRY_ADDR=0x40302ae0 +CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND,SPL_RTC_ONLY_SUPPORT" +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +# CONFIG_CMD_SETEXPR is not set +CONFIG_SPI_FLASH_BAR=y +CONFIG_SPI_FLASH=y diff --git a/configs/am43xx_hs_evm_usbhost_boot_defconfig b/configs/am43xx_hs_evm_usbhost_boot_defconfig new file mode 100644 index 0000000..776f669 --- /dev/null +++ b/configs/am43xx_hs_evm_usbhost_boot_defconfig @@ -0,0 +1,11 @@ +CONFIG_ARM=y +CONFIG_AM43XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_AM43XX_EVM=y +CONFIG_SPL=y +CONFIG_ISW_ENTRY_ADDR=0x40302ae0 +CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND,SPL_USB_HOST_SUPPORT" +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +# CONFIG_CMD_SETEXPR is not set +CONFIG_SPI_FLASH=y diff --git a/configs/am43xx_hs_evm_usbspl_defconfig b/configs/am43xx_hs_evm_usbspl_defconfig new file mode 100644 index 0000000..5a3f566 --- /dev/null +++ b/configs/am43xx_hs_evm_usbspl_defconfig @@ -0,0 +1,12 @@ +CONFIG_ARM=y +CONFIG_AM43XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_AM43XX_EVM=y +CONFIG_SPL=y +CONFIG_ISW_ENTRY_ADDR=0x40302ae0 +CONFIG_SYS_EXTRA_OPTIONS="SERIAL1,CONS_INDEX=1,NAND,SPL_USBETH_SUPPORT" +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +# CONFIG_CMD_SETEXPR is not set +CONFIG_SPI_FLASH_BAR=y +CONFIG_SPI_FLASH=y

Adds an fdt.c file in that defines the ft_cpu_setup() function, which should be called from a board-specific ft_board_setup()). This ft_cpu_setup() will currently do nothing for non-secure (GP) devices but contains pertinent updates for booting on secure (HS) devices.

Update the omap5 Makefile to include the fdt.c in the build.

Signed-off-by: Daniel Allred d-allred@ti.com Signed-off-by: Madan Srinivas madans@ti.com --- arch/arm/cpu/armv7/omap5/Makefile | 1 + arch/arm/cpu/armv7/omap5/fdt.c | 183 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 184 insertions(+) create mode 100644 arch/arm/cpu/armv7/omap5/fdt.c

diff --git a/arch/arm/cpu/armv7/omap5/Makefile b/arch/arm/cpu/armv7/omap5/Makefile index f2930d5..3caba86 100644 --- a/arch/arm/cpu/armv7/omap5/Makefile +++ b/arch/arm/cpu/armv7/omap5/Makefile @@ -12,4 +12,5 @@ obj-y += sdram.o obj-y += prcm-regs.o obj-y += hw_data.o obj-y += abb.o +obj-y += fdt.o obj-$(CONFIG_IODELAY_RECALIBRATION) += dra7xx_iodelay.o diff --git a/arch/arm/cpu/armv7/omap5/fdt.c b/arch/arm/cpu/armv7/omap5/fdt.c new file mode 100644 index 0000000..f2f40f0 --- /dev/null +++ b/arch/arm/cpu/armv7/omap5/fdt.c @@ -0,0 +1,183 @@ +/* + * Copyright 2016 Texas Instruments, Inc. + * + * SPDX-License-Identifier: GPL-2.0+ + */ + +#include <common.h> +#include <libfdt.h> +#include <fdt_support.h> +#include <malloc.h> + +#include <asm/omap_common.h> +#include <asm/arch-omap5/sys_proto.h> + +#ifdef CONFIG_TI_SECURE_DEVICE + +/* Give zero values if not already defined */ +#ifndef CONFIG_SECURE_BOOT_SRAM +#define CONFIG_SECURE_BOOT_SRAM (0) +#endif +#ifndef CONFIG_SECURE_RUN_SRAM +#define CONFIG_SECURE_RUN_SRAM (0) +#endif + +static u32 hs_irq_skip[] = { + 8, /* Secure violation reporting interrupt */ + 15, /* One interrupt for SDMA by secure world */ + 118 /* One interrupt for Crypto DMA by secure world */ +}; + +static int ft_hs_fixup_crossbar(void *fdt, bd_t *bd) +{ + const char *path; + int offs; + int ret; + int len, i, old_cnt, new_cnt; + u32 *temp; + const u32 *p_data; + + /* + * Increase the size of the fdt + * so we have some breathing room + */ + ret = fdt_increase_size(fdt, 512); + if (ret < 0) { + printf("Could not increase size of device tree: %s\n", + fdt_strerror(ret)); + return ret; + } + + /* Reserve IRQs that are used/needed by secure world */ + path = "/ocp/crossbar"; + offs = fdt_path_offset(fdt, path); + if (offs < 0) { + debug("Node %s not found.\n", path); + return 0; + } + + /* Get current entries */ + p_data = fdt_getprop(fdt, offs, "ti,irqs-skip", &len); + if (p_data) + old_cnt = len / sizeof(u32); + else + old_cnt = 0; + + new_cnt = sizeof(hs_irq_skip) / + sizeof(hs_irq_skip[0]); + + /* Create new/updated skip list for HS parts */ + temp = malloc(sizeof(u32) * (old_cnt + new_cnt)); + for (i = 0; i < new_cnt; i++) + temp[i] = cpu_to_fdt32(hs_irq_skip[i]); + for (i = 0; i < old_cnt; i++) + temp[i + new_cnt] = p_data[i]; + + /* Blow away old data and set new data */ + fdt_delprop(fdt, offs, "ti,irqs-skip"); + ret = fdt_setprop(fdt, offs, "ti,irqs-skip", + temp, + (old_cnt + new_cnt) * sizeof(u32)); + free(temp); + + /* Check if the update worked */ + if (ret < 0) { + printf("Could not add ti,irqs-skip property to node %s: %s\n", + path, fdt_strerror(ret)); + return ret; + } + + return 0; +} + +static int ft_hs_disable_rng(void *fdt, bd_t *bd) +{ + const char *path; + int offs; + int ret; + + /* Make HW RNG reserved for secure world use */ + path = "/ocp/rng"; + offs = fdt_path_offset(fdt, path); + if (offs < 0) { + debug("Node %s not found.\n", path); + return 0; + } + ret = fdt_setprop_string(fdt, offs, + "status", "disabled"); + if (ret < 0) { + printf("Could not add status property to node %s: %s\n", + path, fdt_strerror(ret)); + return ret; + } + return 0; +} + +#if (CONFIG_SECURE_BOOT_SRAM != 0) || (CONFIG_SECURE_RUN_SRAM != 0) +static int ft_hs_fixup_sram(void *fdt, bd_t *bd) +{ + const char *path; + int offs; + int ret; + u32 temp[2]; + + /* + * Update SRAM reservations on secure devices. The OCMC RAM + * is always reserved for secure use from the start of that + * memory region + */ + path = "/ocp/ocmcram@40300000/sram-hs"; + offs = fdt_path_offset(fdt, path); + if (offs < 0) { + debug("Node %s not found.\n", path); + return 0; + } + + /* relative start offset */ + temp[0] = cpu_to_fdt32(0); + /* reservation size */ + temp[1] = cpu_to_fdt32(max(CONFIG_SECURE_BOOT_SRAM, + CONFIG_SECURE_RUN_SRAM)); + fdt_delprop(fdt, offs, "reg"); + ret = fdt_setprop(fdt, offs, "reg", temp, 2 * sizeof(u32)); + if (ret < 0) { + printf("Could not add reg property to node %s: %s\n", + path, fdt_strerror(ret)); + return ret; + } + + return 0; +} +#else +static int ft_hs_fixup_sram(void *fdt, bd_t *bd) { return 0; } +#endif + +static void ft_hs_fixups(void *fdt, bd_t *bd) +{ + /* Check we are running on an HS/EMU device type */ + if (GP_DEVICE != get_device_type()) { + if ((ft_hs_fixup_crossbar(fdt, bd) == 0) && + (ft_hs_disable_rng(fdt, bd) == 0) && + (ft_hs_fixup_sram(fdt, bd) == 0)) + return; + } else { + printf("ERROR: Incorrect device type (GP) detected!"); + } + /* Fixup failed or wrong device type */ + hang(); +} +#else +static void ft_hs_fixups(void *fdt, bd_t *bd) +{ +} +#endif + +/* + * Place for general cpu/SoC FDT fixups. Board specific + * fixups should remain in the board files which is where + * this function should be called from. + */ +void ft_cpu_setup(void *fdt, bd_t *bd) +{ + ft_hs_fixups(fdt, bd); +}

Adds the board specific ft_board_setup() functions that are called when CONFIG_OF_BOARD_SETUP is defined. These functions will currently just call the ft_cpu_setup() function.

Signed-off-by: Daniel Allred d-allred@ti.com Signed-off-by: Madan Srinivas madans@ti.com --- board/ti/am57xx/board.c | 9 +++++++++ board/ti/dra7xx/evm.c | 9 +++++++++ 2 files changed, 18 insertions(+)

diff --git a/board/ti/am57xx/board.c b/board/ti/am57xx/board.c index 18416ef..4d06362 100644 --- a/board/ti/am57xx/board.c +++ b/board/ti/am57xx/board.c @@ -657,3 +657,12 @@ int board_early_init_f(void) return 0; } #endif + +#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP) +int ft_board_setup(void *blob, bd_t *bd) +{ + ft_cpu_setup(blob, bd); + + return 0; +} +#endif diff --git a/board/ti/dra7xx/evm.c b/board/ti/dra7xx/evm.c index 9bd71d8..d01c785 100644 --- a/board/ti/dra7xx/evm.c +++ b/board/ti/dra7xx/evm.c @@ -718,3 +718,12 @@ int board_early_init_f(void) return 0; } #endif + +#if defined(CONFIG_OF_LIBFDT) && defined(CONFIG_OF_BOARD_SETUP) +int ft_board_setup(void *blob, bd_t *bd) +{ + ft_cpu_setup(blob, bd); + + return 0; +} +#endif

Adds CONFIG_OF_BOARD_SETUP to the config header files for dra7xx_evm and am57xx_evm.

Signed-off-by: Daniel Allred d-allred@ti.com Signed-off-by: Madan Srinivas madans@ti.com --- include/configs/am57xx_evm.h | 3 +++ include/configs/dra7xx_evm.h | 3 +++ 2 files changed, 6 insertions(+)

diff --git a/include/configs/am57xx_evm.h b/include/configs/am57xx_evm.h index 1fffdb1..5e629a6 100644 --- a/include/configs/am57xx_evm.h +++ b/include/configs/am57xx_evm.h @@ -20,6 +20,9 @@

#define CONFIG_BOARD_EARLY_INIT_F

+/* Linux interfacing, DTB/FDT fixups */ +#define CONFIG_OF_BOARD_SETUP + #define CONFIG_NR_DRAM_BANKS 2

#define CONFIG_ENV_SIZE (64 << 10) diff --git a/include/configs/dra7xx_evm.h b/include/configs/dra7xx_evm.h index 7734e8d..25b03b3 100644 --- a/include/configs/dra7xx_evm.h +++ b/include/configs/dra7xx_evm.h @@ -15,6 +15,9 @@ #define CONFIG_DRA7XX #define CONFIG_BOARD_EARLY_INIT_F

+/* Linux interfacing, DTB/FDT fixups */ +#define CONFIG_OF_BOARD_SETUP + #ifdef CONFIG_SPL_BUILD #define CONFIG_IODELAY_RECALIBRATION #endif

Adds new defconfig files for DRA7xx and AM57xx secure devices. These are the same as the non-secure parts, but with the addition of the CONFIG_TI_SECURE_DEVICE option set to 'y'.

Signed-off-by: Daniel Allred d-allred@ti.com Signed-off-by: Madan Srinivas madans@ti.com --- configs/am57xx_hs_evm_defconfig | 20 ++++++++++++++++++++ configs/dra72_hs_evm_defconfig | 28 ++++++++++++++++++++++++++++ configs/dra74_hs_evm_defconfig | 27 +++++++++++++++++++++++++++ 3 files changed, 75 insertions(+) create mode 100644 configs/am57xx_hs_evm_defconfig create mode 100644 configs/dra72_hs_evm_defconfig create mode 100644 configs/dra74_hs_evm_defconfig

diff --git a/configs/am57xx_hs_evm_defconfig b/configs/am57xx_hs_evm_defconfig new file mode 100644 index 0000000..062471e --- /dev/null +++ b/configs/am57xx_hs_evm_defconfig @@ -0,0 +1,20 @@ +CONFIG_ARM=y +CONFIG_OMAP54XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_BEAGLE_X15=y +CONFIG_DM_SERIAL=y +CONFIG_DM_GPIO=y +CONFIG_SPL_STACK_R_ADDR=0x82000000 +CONFIG_DEFAULT_DEVICE_TREE="am57xx-beagle-x15" +CONFIG_SPL=y +CONFIG_SPL_STACK_R=y +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +CONFIG_CMD_GPIO=y +# CONFIG_CMD_SETEXPR is not set +CONFIG_OF_CONTROL=y +CONFIG_DM=y +CONFIG_DM_MMC=y +CONFIG_SPI_FLASH=y +CONFIG_SPI_FLASH_BAR=y +CONFIG_SYS_NS16550=y diff --git a/configs/dra72_hs_evm_defconfig b/configs/dra72_hs_evm_defconfig new file mode 100644 index 0000000..49f2b49 --- /dev/null +++ b/configs/dra72_hs_evm_defconfig @@ -0,0 +1,28 @@ +CONFIG_ARM=y +CONFIG_OMAP54XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_SYS_MALLOC_F_LEN=0x2000 +CONFIG_TARGET_DRA7XX_EVM=y +CONFIG_DM_SERIAL=y +CONFIG_DM_SPI=y +CONFIG_DM_SPI_FLASH=y +CONFIG_DM_GPIO=y +CONFIG_SPL_STACK_R_ADDR=0x82000000 +CONFIG_DEFAULT_DEVICE_TREE="dra72-evm" +CONFIG_SPL=y +CONFIG_SPL_STACK_R=y +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +CONFIG_CMD_GPIO=y +# CONFIG_CMD_SETEXPR is not set +CONFIG_OF_CONTROL=y +CONFIG_DM=y +CONFIG_SPI_FLASH=y +CONFIG_SPI_FLASH_BAR=y +CONFIG_SPI_FLASH_SPANSION=y +CONFIG_SYS_NS16550=y +CONFIG_TI_QSPI=y +CONFIG_TIMER=y +CONFIG_OMAP_TIMER=y +CONFIG_USB=y +CONFIG_USB_GADGET=y diff --git a/configs/dra74_hs_evm_defconfig b/configs/dra74_hs_evm_defconfig new file mode 100644 index 0000000..0339d7f --- /dev/null +++ b/configs/dra74_hs_evm_defconfig @@ -0,0 +1,27 @@ +CONFIG_ARM=y +CONFIG_OMAP54XX=y +CONFIG_TI_SECURE_DEVICE=y +CONFIG_TARGET_DRA7XX_EVM=y +CONFIG_DM_SERIAL=y +CONFIG_DM_SPI=y +CONFIG_DM_SPI_FLASH=y +CONFIG_DM_GPIO=y +CONFIG_SPL_STACK_R_ADDR=0x82000000 +CONFIG_DEFAULT_DEVICE_TREE="dra7-evm" +CONFIG_SPL=y +CONFIG_SPL_STACK_R=y +# CONFIG_CMD_IMLS is not set +# CONFIG_CMD_FLASH is not set +CONFIG_CMD_GPIO=y +# CONFIG_CMD_SETEXPR is not set +CONFIG_OF_CONTROL=y +CONFIG_DM=y +CONFIG_SPI_FLASH=y +CONFIG_SPI_FLASH_BAR=y +CONFIG_SPI_FLASH_SPANSION=y +CONFIG_SYS_NS16550=y +CONFIG_TI_QSPI=y +CONFIG_TIMER=y +CONFIG_OMAP_TIMER=y +CONFIG_USB=y +CONFIG_USB_GADGET=y