Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-19 03:08:31 +00:00
Code Issues Projects Releases Packages Wiki Activity
u-boot/arch/powerpc/include/asm/fsl_secure_boot.h

91 lines
2.3 KiB
C
Raw Normal View History

powerpc/p4080: Add support for secure boot flow Pre u-boot Flow: 1. User loads the u-boot image in flash 2. PBL/Configuration word is used to create LAW for Flash at 0xc0000000 (Please note that ISBC expects all these addresses, images to be validated, entry point etc within 0 - 3.5G range) 3. ISBC validates the u-boot image, and passes control to u-boot at 0xcffffffc. Changes in u-boot: 1. Temporarily map CONFIG_SYS_MONITOR_BASE to the 1M CONFIG_SYS_PBI_FLASH_WINDOW in AS=1. (The CONFIG_SYS_PBI_FLASH_WINDOW is the address map for the flash created by PBL/configuration word within 0 - 3.5G memory range. The u-boot image at this address has been validated by ISBC code) 2. Remove TLB entries for 0 - 3.5G created by ISBC code 3. Remove the LAW entry for the CONFIG_SYS_PBI_FLASH_WINDOW created by PBL/configuration word after switch to AS = 1 Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Kuldip Giroh <kuldip.giroh@freescale.com> Acked-by: Wood Scott-B07421 <B07421@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2010-12-15 17:02:08 +00:00
/*
* Copyright 2010-2011 Freescale Semiconductor, Inc.
*
Add GPL-2.0+ SPDX-License-Identifier to source files Signed-off-by: Wolfgang Denk <wd@denx.de> [trini: Fixup common/cmd_io.c] Signed-off-by: Tom Rini <trini@ti.com>
2013-07-08 07:37:19 +00:00
* SPDX-License-Identifier: GPL-2.0+
powerpc/p4080: Add support for secure boot flow Pre u-boot Flow: 1. User loads the u-boot image in flash 2. PBL/Configuration word is used to create LAW for Flash at 0xc0000000 (Please note that ISBC expects all these addresses, images to be validated, entry point etc within 0 - 3.5G range) 3. ISBC validates the u-boot image, and passes control to u-boot at 0xcffffffc. Changes in u-boot: 1. Temporarily map CONFIG_SYS_MONITOR_BASE to the 1M CONFIG_SYS_PBI_FLASH_WINDOW in AS=1. (The CONFIG_SYS_PBI_FLASH_WINDOW is the address map for the flash created by PBL/configuration word within 0 - 3.5G memory range. The u-boot image at this address has been validated by ISBC code) 2. Remove TLB entries for 0 - 3.5G created by ISBC code 3. Remove the LAW entry for the CONFIG_SYS_PBI_FLASH_WINDOW created by PBL/configuration word after switch to AS = 1 Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Kuldip Giroh <kuldip.giroh@freescale.com> Acked-by: Wood Scott-B07421 <B07421@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2010-12-15 17:02:08 +00:00
*/
#ifndef __FSL_SECURE_BOOT_H
#define __FSL_SECURE_BOOT_H
SECURE_BOOT : enable esbc_validate command for powerpc and arm platforms. esbc_validate command uses various IP Blocks: Security Monitor, CAAM block and SFP registers. Hence the respective CONFIG's are enabled. Apart from these CONFIG_SHA_PROG_HW_ACCEL and CONFIG_RSA are also enabled. Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2015-02-27 04:16:17 +00:00
#include <asm/config_mpc85xx.h>
#ifdef CONFIG_SECURE_BOOT
#define CONFIG_CMD_ESBC_VALIDATE
#define CONFIG_FSL_SEC_MON
#define CONFIG_SHA_PROG_HW_ACCEL
#define CONFIG_DM
#define CONFIG_RSA
#define CONFIG_RSA_FREESCALE_EXP
#ifndef CONFIG_FSL_CAAM
#define CONFIG_FSL_CAAM
#endif
#endif
powerpc/p4080: Add support for secure boot flow Pre u-boot Flow: 1. User loads the u-boot image in flash 2. PBL/Configuration word is used to create LAW for Flash at 0xc0000000 (Please note that ISBC expects all these addresses, images to be validated, entry point etc within 0 - 3.5G range) 3. ISBC validates the u-boot image, and passes control to u-boot at 0xcffffffc. Changes in u-boot: 1. Temporarily map CONFIG_SYS_MONITOR_BASE to the 1M CONFIG_SYS_PBI_FLASH_WINDOW in AS=1. (The CONFIG_SYS_PBI_FLASH_WINDOW is the address map for the flash created by PBL/configuration word within 0 - 3.5G memory range. The u-boot image at this address has been validated by ISBC code) 2. Remove TLB entries for 0 - 3.5G created by ISBC code 3. Remove the LAW entry for the CONFIG_SYS_PBI_FLASH_WINDOW created by PBL/configuration word after switch to AS = 1 Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Kuldip Giroh <kuldip.giroh@freescale.com> Acked-by: Wood Scott-B07421 <B07421@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2010-12-15 17:02:08 +00:00
powerpc: add CONFIG_SECURE_BOOT condition into fsl_secure_boot.h This patch is for board config file not to add CONFIG_SECURE_BOOT condition for include the asm/fsl_secure_boot.h. Signed-off-by: Po Liu <Po.Liu@freescale.com>
2013-08-21 06:20:21 +00:00
#ifdef CONFIG_SECURE_BOOT
powerpc/p4080: Add support for secure boot flow Pre u-boot Flow: 1. User loads the u-boot image in flash 2. PBL/Configuration word is used to create LAW for Flash at 0xc0000000 (Please note that ISBC expects all these addresses, images to be validated, entry point etc within 0 - 3.5G range) 3. ISBC validates the u-boot image, and passes control to u-boot at 0xcffffffc. Changes in u-boot: 1. Temporarily map CONFIG_SYS_MONITOR_BASE to the 1M CONFIG_SYS_PBI_FLASH_WINDOW in AS=1. (The CONFIG_SYS_PBI_FLASH_WINDOW is the address map for the flash created by PBL/configuration word within 0 - 3.5G memory range. The u-boot image at this address has been validated by ISBC code) 2. Remove TLB entries for 0 - 3.5G created by ISBC code 3. Remove the LAW entry for the CONFIG_SYS_PBI_FLASH_WINDOW created by PBL/configuration word after switch to AS = 1 Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Kuldip Giroh <kuldip.giroh@freescale.com> Acked-by: Wood Scott-B07421 <B07421@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2010-12-15 17:02:08 +00:00
#if defined(CONFIG_FSL_CORENET)
#define CONFIG_SYS_PBI_FLASH_BASE 0xc0000000
powerpc/mpc85xx: SECURE BOOT- Add secure boot target for BSC9132QDS Add NOR, SPI and SD secure boot targets for BSC9132QDS. Changes: - Debug TLB entry is not required for Secure Boot Target. Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-03-11 18:37:27 +00:00
#elif defined(CONFIG_BSC9132QDS)
#define CONFIG_SYS_PBI_FLASH_BASE 0xc8000000
powerpc/mpc85xx: Define PBI Flash Base for C29XPCIE Secure Boot CONFIG_SYS_PBI_FLASH_BASE is defined for Secure Boot on C29X Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-12-12 10:05:04 +00:00
#elif defined(CONFIG_C29XPCIE)
#define CONFIG_SYS_PBI_FLASH_BASE 0xcc000000
powerpc/p4080: Add support for secure boot flow Pre u-boot Flow: 1. User loads the u-boot image in flash 2. PBL/Configuration word is used to create LAW for Flash at 0xc0000000 (Please note that ISBC expects all these addresses, images to be validated, entry point etc within 0 - 3.5G range) 3. ISBC validates the u-boot image, and passes control to u-boot at 0xcffffffc. Changes in u-boot: 1. Temporarily map CONFIG_SYS_MONITOR_BASE to the 1M CONFIG_SYS_PBI_FLASH_WINDOW in AS=1. (The CONFIG_SYS_PBI_FLASH_WINDOW is the address map for the flash created by PBL/configuration word within 0 - 3.5G memory range. The u-boot image at this address has been validated by ISBC code) 2. Remove TLB entries for 0 - 3.5G created by ISBC code 3. Remove the LAW entry for the CONFIG_SYS_PBI_FLASH_WINDOW created by PBL/configuration word after switch to AS = 1 Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Kuldip Giroh <kuldip.giroh@freescale.com> Acked-by: Wood Scott-B07421 <B07421@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2010-12-15 17:02:08 +00:00
#else
#define CONFIG_SYS_PBI_FLASH_BASE 0xce000000
#endif
#define CONFIG_SYS_PBI_FLASH_WINDOW 0xcff80000
powerpc/mpc85xx: SECURE BOOT- Add secure boot target for T2080QDS Secure Boot Target is added for T2080QDS Changes: For Secure boot, CPC is configured as SRAM and used as house keeping area which needs to be disabled. So CONFIG_SYS_CPC_REINIT_F is defined for CONFIG_T2080QDS. Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-03-18 18:10:59 +00:00
#if defined(CONFIG_B4860QDS) || \
defined(CONFIG_T4240QDS) || \
powerpc/mpc85xx: SECURE BOOT- Add secure boot target for T1040QDS and T1040RDB Secure Boot Target is added for T1040QDS and T1040RDB Changes: For Secure boot, CPC is configured as SRAM and used as house keeping area which needs to be disabled. So CONFIG_SYS_CPC_REINIT_F is defined for CONFIG_T1040QDS and CONFIG_T1040RDB Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com> Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-03-18 18:11:14 +00:00
defined(CONFIG_T2080QDS) || \
powerpc/mpc85xx: SECURE BOOT- Add secure boot target for T2080RDB Secure Boot Target is added for T2080RDB Changes: For Secure boot, CPC is configured as SRAM and used as house keeping area which needs to be disabled. So CONFIG_SYS_CPC_REINIT_F is defined for CONFIG_T2080RDB. Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
2014-04-22 09:47:06 +00:00
defined(CONFIG_T2080RDB) || \
powerpc/mpc85xx: SECURE BOOT- Add secure boot target for T1040QDS and T1040RDB Secure Boot Target is added for T1040QDS and T1040RDB Changes: For Secure boot, CPC is configured as SRAM and used as house keeping area which needs to be disabled. So CONFIG_SYS_CPC_REINIT_F is defined for CONFIG_T1040QDS and CONFIG_T1040RDB Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com> Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-03-18 18:11:14 +00:00
defined(CONFIG_T1040QDS) || \
powerpc/mpc85xx: Add T1024/T1023 SoC support Add support for Freescale T1024/T1023 SoC. The T1024 SoC includes the following function and features: - Two 64-bit Power architecture e5500 cores, up to 1.4GHz - private 256KB L2 cache each core and shared 256KB CoreNet platform cache (CPC) - 32-/64-bit DDR3L/DDR4 SDRAM memory controller with ECC and interleaving support - Data Path Acceleration Architecture (DPAA) incorporating acceleration - Four MAC for 1G/2.5G/10G network interfaces (RGMII, SGMII, QSGMII, XFI) - High-speed peripheral interfaces - Three PCI Express 2.0 controllers - Additional peripheral interfaces - One SATA 2.0 controller - Two USB 2.0 controllers with integrated PHY - Enhanced secure digital host controller (SD/eSDHC/eMMC) - Enhanced serial peripheral interface (eSPI) - Four I2C controllers - Four 2-pin UARTs or two 4-pin UARTs - Integrated Flash Controller supporting NAND and NOR flash - Two 8-channel DMA engines - Multicore programmable interrupt controller (PIC) - LCD interface (DIU) with 12 bit dual data rate - QUICC Engine block supporting TDM, HDLC, and UART - Deep Sleep power implementaion (wakeup from GPIO/Timer/Ethernet/USB) - Support for hardware virtualization and partitioning enforcement - QorIQ Platform's Trust Architecture 2.0 Differences between T1024 and T1023: Feature T1024 T1023 QUICC Engine: yes no DIU: yes no Deep Sleep: yes no I2C controller: 4 3 DDR: 64-bit 32-bit IFC: 32-bit 28-bit Signed-off-by: Shengzhou Liu <Shengzhou.Liu@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-11-24 09:11:54 +00:00
defined(CONFIG_T104xRDB) || \
defined(CONFIG_PPC_T1023) || \
defined(CONFIG_PPC_T1024)
powerpc/mpc85xx: SECURE BOOT- Add secure boot target for B4860QDS Changes: 1. L2 cache is being invalidated by Boot ROM code for e6500 core. So removing the invalidation from start.S 2. Clear the LAW and corresponding configuration for CPC. Boot ROM code uses it as hosekeeping area. 3. For Secure boot, CPC is configured as SRAM and used as house keeping area. This configuration is to be disabled once in uboot. Earlier this disabling of CPC as SRAM was happening in cpu_init_r. As a result cache invalidation function was getting skipped in case CPC is configured as SRAM.This was causing random crashes. Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-03-18 18:10:26 +00:00
#define CONFIG_SYS_CPC_REINIT_F
SECURE_BOOT : enable esbc_validate command for powerpc and arm platforms. esbc_validate command uses various IP Blocks: Security Monitor, CAAM block and SFP registers. Hence the respective CONFIG's are enabled. Apart from these CONFIG_SHA_PROG_HW_ACCEL and CONFIG_RSA are also enabled. Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2015-02-27 04:16:17 +00:00
#define CONFIG_KEY_REVOCATION
powerpc/mpc85xx: SECURE BOOT- Add secure boot target for B4860QDS Changes: 1. L2 cache is being invalidated by Boot ROM code for e6500 core. So removing the invalidation from start.S 2. Clear the LAW and corresponding configuration for CPC. Boot ROM code uses it as hosekeeping area. 3. For Secure boot, CPC is configured as SRAM and used as house keeping area. This configuration is to be disabled once in uboot. Earlier this disabling of CPC as SRAM was happening in cpu_init_r. As a result cache invalidation function was getting skipped in case CPC is configured as SRAM.This was causing random crashes. Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2014-03-18 18:10:26 +00:00
#undef CONFIG_SYS_INIT_L3_ADDR
#define CONFIG_SYS_INIT_L3_ADDR 0xbff00000
#endif
SECURE_BOOT : enable esbc_validate command for powerpc and arm platforms. esbc_validate command uses various IP Blocks: Security Monitor, CAAM block and SFP registers. Hence the respective CONFIG's are enabled. Apart from these CONFIG_SHA_PROG_HW_ACCEL and CONFIG_RSA are also enabled. Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2015-02-27 04:16:17 +00:00
#if defined(CONFIG_C29XPCIE)
#define CONFIG_KEY_REVOCATION
#endif
#if defined(CONFIG_PPC_P3041) || \
defined(CONFIG_PPC_P4080) || \
defined(CONFIG_PPC_P5020) || \
defined(CONFIG_PPC_P5040) || \
defined(CONFIG_PPC_P2041)
#define CONFIG_FSL_TRUST_ARCH_v1
#endif
#if defined(CONFIG_FSL_CORENET)
/* The key used for verification of next level images
* is picked up from an Extension Table which has
* been verified by the ISBC (Internal Secure boot Code)
* in boot ROM of the SoC
*/
#define CONFIG_FSL_ISBC_KEY_EXT
#endif
Add bootscript support to esbc_validate. 1. Default environment will be used for secure boot flow which can't be edited or saved. 2. Command for secure boot is predefined in the default environment which will run on autoboot (and autoboot is the only option allowed in case of secure boot) and it looks like this: #define CONFIG_SECBOOT \ "setenv bs_hdraddr 0xe8e00000;" \ "esbc_validate $bs_hdraddr;" \ "source $img_addr;" \ "esbc_halt;" #endif 3. Boot Script can contain esbc_validate commands and bootm command. Uboot source command used in default secure boot command will run the bootscript. 4. Command esbc_halt added to ensure either bootm executes after validation of images or core should just spin. Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
2015-03-10 08:38:50 +00:00
#ifndef CONFIG_FIT_SIGNATURE
/* The bootscript header address is different for B4860 because the NOR
* mapping is different on B4 due to reduced NOR size.
*/
#if defined(CONFIG_B4860QDS)
#define CONFIG_BOOTSCRIPT_HDR_ADDR 0xecc00000
#elif defined(CONFIG_FSL_CORENET)
#define CONFIG_BOOTSCRIPT_HDR_ADDR 0xe8e00000
#elif defined(CONFIG_BSC9132QDS)
#define CONFIG_BOOTSCRIPT_HDR_ADDR 0x88020000
#elif defined(CONFIG_C29XPCIE)
#define CONFIG_BOOTSCRIPT_HDR_ADDR 0xec020000
#else
#define CONFIG_BOOTSCRIPT_HDR_ADDR 0xee020000
#endif
#include <config_fsl_secboot.h>
#endif
powerpc/p4080: Add support for secure boot flow Pre u-boot Flow: 1. User loads the u-boot image in flash 2. PBL/Configuration word is used to create LAW for Flash at 0xc0000000 (Please note that ISBC expects all these addresses, images to be validated, entry point etc within 0 - 3.5G range) 3. ISBC validates the u-boot image, and passes control to u-boot at 0xcffffffc. Changes in u-boot: 1. Temporarily map CONFIG_SYS_MONITOR_BASE to the 1M CONFIG_SYS_PBI_FLASH_WINDOW in AS=1. (The CONFIG_SYS_PBI_FLASH_WINDOW is the address map for the flash created by PBL/configuration word within 0 - 3.5G memory range. The u-boot image at this address has been validated by ISBC code) 2. Remove TLB entries for 0 - 3.5G created by ISBC code 3. Remove the LAW entry for the CONFIG_SYS_PBI_FLASH_WINDOW created by PBL/configuration word after switch to AS = 1 Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Kuldip Giroh <kuldip.giroh@freescale.com> Acked-by: Wood Scott-B07421 <B07421@freescale.com> Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
2010-12-15 17:02:08 +00:00
#endif
powerpc: add CONFIG_SECURE_BOOT condition into fsl_secure_boot.h This patch is for board config file not to add CONFIG_SECURE_BOOT condition for include the asm/fsl_secure_boot.h. Signed-off-by: Po Liu <Po.Liu@freescale.com>
2013-08-21 06:20:21 +00:00
#endif
Reference in a new issue Copy permalink