Commit graph

59 commits

Author SHA1 Message Date
Udit Agarwal
bef1845404 freescale/powerpc: Rename the config CONFIG_SECURE_BOOT name
Rename the CONFIG_SECURE_BOOT name to CONFIG_NXP_ESBC to avoid
conflicts with UEFI secure boot.

Signed-off-by: Udit Agarwal <udit.agarwal@nxp.com>
Signed-off-by: Priyanka Jain <priyanka.jain@nxp.com>
2019-11-08 16:32:08 +05:30
Tom Rini
83d290c56f SPDX: Convert all of our single license tags to Linux Kernel style
When U-Boot started using SPDX tags we were among the early adopters and
there weren't a lot of other examples to borrow from.  So we picked the
area of the file that usually had a full license text and replaced it
with an appropriate SPDX-License-Identifier: entry.  Since then, the
Linux Kernel has adopted SPDX tags and they place it as the very first
line in a file (except where shebangs are used, then it's second line)
and with slightly different comment styles than us.

In part due to community overlap, in part due to better tag visibility
and in part for other minor reasons, switch over to that style.

This commit changes all instances where we have a single declared
license in the tag as both the before and after are identical in tag
contents.  There's also a few places where I found we did not have a tag
and have introduced one.

Signed-off-by: Tom Rini <trini@konsulko.com>
2018-05-07 09:34:12 -04:00
Simon Glass
ea7971f705 Convert CONFIG_CMD_ESBC_VALIDATE to Kconfig
This converts the following to Kconfig:
   CONFIG_CMD_ESBC_VALIDATE

Signed-off-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Tom Rini <trini@konsulko.com>
2017-05-22 09:33:55 -04:00
Tom Rini
089df18bfe lib: move hash CONFIG options to Kconfig
Commit 94e3c8c4fd ("crypto/fsl - Add progressive hashing support
using hardware acceleration.") created entries for CONFIG_SHA1,
CONFIG_SHA256, CONFIG_SHA_HW_ACCEL, and CONFIG_SHA_PROG_HW_ACCEL.
However, no defconfig has migrated to it.  Complete the move by first
adding additional logic to various Kconfig files to select this when
required and then use the moveconfig tool.  In many cases we can select
these because they are required to implement other drivers.  We also
correct how we include the various hashing algorithms in SPL.

This commit was generated as follows (after Kconfig additions):

[1] tools/moveconfig.py -y SHA1 SHA256 SHA_HW_ACCEL
[2] tools/moveconfig.py -y SHA_PROG_HW_ACCEL

Note:
We cannot move SHA_HW_ACCEL and SHA_PROG_HW_ACCEL simultaneously
because there is dependency between them.

Cc: Poonam Aggrwal <poonam.aggrwal@freescale.com>
Cc: Naveen Burmi <NaveenBurmi@freescale.com>
Cc: Po Liu <po.liu@freescale.com>
Cc: Shengzhou Liu <Shengzhou.Liu@freescale.com>
Cc: Priyanka Jain <Priyanka.Jain@freescale.com>
Cc: Shaohui Xie <Shaohui.Xie@freescale.com>
Cc: Chunhe Lan <Chunhe.Lan@freescale.com>
Cc: Chander Kashyap <k.chander@samsung.com>
Cc: Steve Rae <steve.rae@raedomain.com>
Cc: Dirk Eibach <eibach@gdsys.de>
Cc: Feng Li <feng.li_2@nxp.com>
Cc: Alison Wang <alison.wang@freescale.com>
Cc: Sumit Garg <sumit.garg@nxp.com>
Cc: Mingkai Hu <Mingkai.Hu@freescale.com>
Cc: York Sun <york.sun@nxp.com>
Cc: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
Cc: Jaehoon Chung <jh80.chung@samsung.com>
Cc: Akshay Saraswat <akshay.s@samsung.com>
Cc: Heiko Schocher <hs@denx.de>
Cc: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Tom Rini <trini@konsulko.com>
2017-05-22 08:36:58 -04:00
Simon Glass
c04b9b3440 Convert CONFIG_CMD_BLOB to Kconfig
This converts the following to Kconfig:
   CONFIG_CMD_BLOB

Signed-off-by: Simon Glass <sjg@chromium.org>
[trini: Add imply CMD_BLOB under CHAIN_OF_TRUST]
Signed-off-by: Tom Rini <trini@konsulko.com>
2017-04-30 10:30:03 -04:00
VINITHA PILLAI
0645c23a7c powerpc: T1042RDB: SECURE BOOT: Remove CONFIG_CMD_BLOB from SPL compilation
BLOB feature is not required during SPL compilation.

Signed-off-by: Vinitha Pillai <vinitha.pillai@nxp.com>
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2017-04-17 09:03:30 -07:00
Tom Rini
285226785e Freescale/NXP: Migrate CONFIG_FSL_CAAM to defconfigs
In some cases this is absolutely required, so select this for some secure
features.  This also requires migration of RSA_FREESCALE_EXP

Cc: Ruchika Gupta <ruchika.gupta@nxp.com>
Cc: Poonam Aggrwal <poonam.aggrwal@freescale.com>
Cc: Naveen Burmi <NaveenBurmi@freescale.com>
Cc: Po Liu <po.liu@freescale.com>
Cc: Shengzhou Liu <Shengzhou.Liu@freescale.com>
Cc: Priyanka Jain <Priyanka.Jain@freescale.com>
Cc: Sumit Garg <sumit.garg@nxp.com>
Cc: Shaohui Xie <Shaohui.Xie@freescale.com>
Cc: Chunhe Lan <Chunhe.Lan@freescale.com>
Cc: Feng Li <feng.li_2@nxp.com>
Cc: Alison Wang <alison.wang@freescale.com>
Cc: Mingkai Hu <Mingkai.Hu@freescale.com>
Cc: York Sun <york.sun@nxp.com>
Cc: Saksham Jain <saksham.jain@nxp.freescale.com>
Cc: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
2017-03-09 11:37:24 -05:00
Tom Rini
88077715d8 NXP: Introduce board/freescale/common/Kconfig and migrate CHAIN_OF_TRUST
Introduce board/freescale/common/Kconfig so that we have a single place
for CONFIG options that are shared between ARM and PowerPC NXP platforms.

Cc: York Sun <york.sun@nxp.com>
Signed-off-by: Tom Rini <trini@konsulko.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2017-01-24 10:33:59 -05:00
Jagan Teki
3788b451e3 config: Move CONFIG_BOARD_LATE_INIT to defconfigs
Cc: Tom Rini <trini@konsulko.com>
Signed-off-by: Jagan Teki <jagan@openedev.com>
2017-01-21 15:12:33 -05:00
York Sun
a105503851 powerpc: T104xQDS: Remove macro CONFIG_T104xD4QDS
Remove this macro. It was added by e622d9ed but actually wasn't used.

Signed-off-by: York Sun <york.sun@nxp.com>
2017-01-04 19:40:29 -05:00
York Sun
86e0a31321 powerpc: T2080RDB: Remove macro CONFIG_T2080RDB
Use TARGET_T2080RDB from Kconfig instead.

Signed-off-by: York Sun <york.sun@nxp.com>
2017-01-04 19:40:27 -05:00
York Sun
80d261881f powerpc: T2080QDS: Remove macro T2080QDS
Use TARGET_T2080QDS from Kconfig instead.

Signed-off-by: York Sun <york.sun@nxp.com>
2017-01-04 19:40:26 -05:00
York Sun
f4f6694060 powerpc: T1040QDS: Remove macro CONFIG_T1040QDS
Use TARGET_T1040QDS from Kconfig instead.

Signed-off-by: York Sun <york.sun@nxp.com>
2017-01-04 19:40:24 -05:00
York Sun
673c01c708 powerpc: T4240QDS: Remove macro CONFIG_T4240QDS
Use CONFIG_TARGET_T4240QDS instead.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:15 -08:00
York Sun
9c21d06c67 powerpc: T4160QDS: Separate from T4240QDS in Kconfig
Use TARGET_T4160QDS to simplify Kconfig options.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:15 -08:00
York Sun
78e5699523 powerpc: T104xRDB: Remove macro CONFIG_T104xRDB and T104xD4RDB
CONFIG_T104xRDB is defined in T104xRDB.h, so it is always enabled for
all T1040RDB, T1040D4RDB, T1042RDB, T1042D4RDB, T1042RDB_PI.
CONFIG_T104XD4RDB is defined for all T1040D4RDB, T1042D4RDB.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:14 -08:00
York Sun
e5d5f5a8be powerpc: T1024: Remove macro CONFIG_PPC_T1024
Replace CONFIG_PPC_T1024 with ARCH_T1024 in Kconfig and clean up
existing macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:13 -08:00
York Sun
5ff3f41d04 powerpc: T1023: Remove macro CONFIG_PPC_T1023
Replace CONFIG_PPC_T1023 with ARCH_T1023 in Kconfig and clean up
existing macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:12 -08:00
York Sun
d46a4a1378 powerpc: B4860QDS: Remove macro CONFIG_B4860QDS
Use CONFIG_TARGET_B4860QDS instead.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:12 -08:00
York Sun
9539036012 powerpc: P5040: Remove macro CONFIG_P5040
Replace CONFIG_P5040 with ARCH_P5040 in Kconfig and clean up
existing macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:11 -08:00
York Sun
cefe11cdb2 powerpc: P5020: Remove macro CONFIG_PPC_P5020
Replace CONFIG_PPC_P5020 with ARCH_P5020 in Kconfig and clean up
existing macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:11 -08:00
York Sun
e71372cb63 powerpc: P4080: Remove macro CONFIG_PPC_P4080
Replace CONFIG_PPC_P4080 with ARCH_P4080 in Kconfig and clean up
existing macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:11 -08:00
York Sun
5e5fdd2d00 powerpc: P3041: Remove macro CONFIG_PPC_P3041
Replace CONFIG_PPC_P3041 with ARCH_P3041 in Kconfig and clean up
existing macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:10 -08:00
York Sun
ce040c83f1 powerpc: P2041: Remove macro CONFIG_PPC_P2041
Replace CONFIG_PPC_P2041 with ARCH_P2041 in Kconfig and clean up
existing macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:10 -08:00
York Sun
ebccf25518 powerpc: C29XPCIE: Remove macro CONFIG_C29XPCIE
Use CONFIG_TARGET_C29XPCIE instead.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:04 -08:00
York Sun
a202b9f802 powerpc: BSC9132QDS: Remove CONFIG_BSC9132QDS macro
Use CONFIG_TARGET_BSC9132QDS from Kconfig option, remove CONFIG_BSC9132QDS
macro.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:04 -08:00
Simon Glass
d3662dff78 Convert CONFIG_SPL_DRIVERS_MISC_SUPPORT to Kconfig
Move this option to Kconfig and tidy up existing uses.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-09-16 17:27:08 -04:00
Simon Glass
d3e7e2b2ce Convert CONFIG_SPL_HASH_SUPPORT to Kconfig
Move this option to Kconfig and tidy up existing uses.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-09-16 17:27:07 -04:00
Simon Glass
dbdaeee43c Convert CONFIG_SPL_CRYPTO_SUPPORT to Kconfig
Move this option to Kconfig and tidy up existing uses.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-09-16 17:27:07 -04:00
Simon Glass
d3c1f46737 Move existing use of CONFIG_SPL_RSA to Kconfig
A few boards define this in a header file which is incorrect. It means that
Kconfig options that rely on this cannot be used. Move it.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-09-16 17:03:45 -04:00
Simon Glass
3433a693a9 Move existing use of CONFIG_SPL_DM to Kconfig
A few boards define this in a header file which is incorrect. It means that
Kconfig options that rely on this cannot be used. Move it.

Note that quite a few boards defined this options but do not appear to
actually use SPL:

	BSC9132QDS_NOR_DDRCLK100_SECURE
	BSC9132QDS_NOR_DDRCLK133_SECURE
	BSC9132QDS_SDCARD_DDRCLK100_SECURE
	BSC9132QDS_SDCARD_DDRCLK133_SECURE
	BSC9132QDS_SPIFLASH_DDRCLK100_SECURE
	BSC9132QDS_SPIFLASH_DDRCLK133_SECURE
	C29XPCIE_NOR_SECBOOT
	P1010RDB-PA_36BIT_NAND_SECBOOT
	P1010RDB-PA_36BIT_SPIFLASH_SECBOOT
	P1010RDB-PA_NAND_SECBOOT
	P1010RDB-PA_NOR_SECBOOT
	P1010RDB-PB_36BIT_NOR_SECBOOT
	P1010RDB-PB_36BIT_SPIFLASH_SECBOOT
	P1010RDB-PB_NAND_SECBOOT
	P1010RDB-PB_NOR_SECBOOT
	P3041DS_SECURE_BOOT
	P4080DS_SECURE_BOOT
	P5020DS_NAND_SECURE_BOOT
	P5040DS_SECURE_BOOT
	T1023RDB_SECURE_BOOT
	T1024QDS_DDR4_SECURE_BOOT
	T1024QDS_SECURE_BOOT
	T1024RDB_SECURE_BOOT
	T1040RDB_SECURE_BOOT
	T1042D4RDB_SECURE_BOOT
	T1042RDB_SECURE_BOOT
	T2080QDS_SECURE_BOOT
	T2080RDB_SECURE_BOOT
	T4160QDS_SECURE_BOOT
	T4240QDS_SECURE_BOOT
	ls1021aqds_nor_SECURE_BOOT
	ls1021atwr_nor_SECURE_BOOT
	ls1043ardb_SECURE_BOOT

For these boards CONFIG_SPL_DM will no-longer be defined in SPL. But since
they apparently don't have an SPL, this should not matter.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-09-16 17:03:41 -04:00
Simon Glass
b63f8a4336 arm: fsl: Adjust ordering of #ifndef CONFIG_SPL_BUILD
The secure boot header files incorrectly define SPL options only if
CONFIG_SPL_BUILD is defined. This means that the options are only enabled
in an SPL build, and not with a normal 'make xxx_defconfig'. This means
that moveconfig.py cannot work, since it sees the options as disabled even
when they may be manually enabled in an SPL build.

Fix this by changing the order.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-09-16 17:03:37 -04:00
Sumit Garg
69d4b48c84 SECURE_BOOT: Enable SD as a source for bootscript
Add support for reading bootscript and bootscript header from SD. Also
renamed macros *_FLASH to *_DEVICE to represent SD alongwith NAND and
NOR flash.

Reviewed-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-07-26 09:01:43 -07:00
Sumit Garg
aa36c84edf powerpc/mpc85xx: T104x: Add nand secure boot target
For mpc85xx SoCs, the core begins execution from address 0xFFFFFFFC.
In non-secure boot scenario from NAND, this address will map to CPC
configured as SRAM. But in case of secure boot, this default address
always maps to IBR (Internal Boot ROM).
The IBR code requires that the bootloader(U-boot) must lie in 0 to 3.5G
address space i.e. 0x0 - 0xDFFFFFFF.

For secure boot target from NAND, the text base for SPL is kept same as
non-secure boot target i.e. 0xFFFx_xxxx but the SPL U-boot binary will
be copied to CPC configured as SRAM with address in 0-3.5G(0xBFFC_0000)
As a the virtual and physical address of CPC would be different. The
virtual address 0xFFFx_xxxx needs to be mapped to physical address
0xBFFx_xxxx.

Create a new PBI file to configure CPC as SRAM with address 0xBFFC0000
and update DCFG SCRTACH1 register with location of Header required for
secure boot.

The changes are similar to
commit 467a40dfe3
    powerpc/mpc85xx: SECURE BOOT- NAND secure boot target for P3041

While P3041 has a 1MB CPC and does not require SPL. On T104x, CPC
is only 256K and thus SPL framework is used.
The changes are only applicable for SPL U-Boot running out of CPC SRAM
and not the next level U-Boot loaded on DDR.

Reviewed-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-07-21 11:09:34 -07:00
Sumit Garg
8f01397ba7 powerpc/mpc85xx: SECURE BOOT- Enable chain of trust in SPL
As part of Chain of Trust for Secure boot, the SPL U-Boot will validate
the next level U-boot image. Add a new function spl_validate_uboot to
perform the validation.

Enable hardware crypto operations in SPL using SEC block.
In case of Secure Boot, PAMU is not bypassed. For allowing SEC block
access to CPC configured as SRAM, configure PAMU.

Reviewed-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-07-21 11:09:23 -07:00
Simon Glass
73223f0e1b Kconfig: Move CONFIG_FIT and related options to Kconfig
There are already two FIT options in Kconfig but the CONFIG options are
still in the header files. We need to do a proper move to fix this.

Move these options to Kconfig and tidy up board configuration:

   CONFIG_FIT
   CONFIG_OF_BOARD_SETUP
   CONFIG_OF_SYSTEM_SETUP
   CONFIG_FIT_SIGNATURE
   CONFIG_FIT_BEST_MATCH
   CONFIG_FIT_VERBOSE
   CONFIG_OF_STDOUT_VIA_ALIAS
   CONFIG_RSA

Unfortunately the first one is a little complicated. We need to make sure
this option is not enabled in SPL by this change. Also this option is
enabled automatically in the host builds by defining CONFIG_FIT in the
image.h file. To solve this, add a new IMAGE_USE_FIT #define which can
be used in files that are built on the host but must also build for U-Boot
and SPL.

Note: Masahiro's moveconfig.py script is amazing.

Signed-off-by: Simon Glass <sjg@chromium.org>
[trini: Add microblaze change, various configs/ re-applies]
Signed-off-by: Tom Rini <trini@konsulko.com>
2016-03-14 19:18:07 -04:00
Simon Glass
9e971632cd freescale: Remove CONFIG_DM from header files
Kconfig options must defined in the defconfig files. Since RSA_SOFTWARE_EXP
relies on CONFIG_DM, unless it is set in kconfig we cannot enable RSA.
Remove the hacks which enable CONFIG_DM in header files and update the
defconfig.

Signed-off-by: Simon Glass <sjg@chromium.org>
2016-03-14 14:21:27 -04:00
Aneesh Bansal
d0a6d7ce55 secure_boot: enable chain of trust for PowerPC platforms
Chain of Trust is enabled for PowerPC platforms for Secure Boot.
CONFIG_BOARD_LATE_INIT is defined.
In board_late_init(), fsl_setenv_chain_of_trust() is called which
will perform the following:
- If boot mode is non-secure, return (No Change)
- If boot mode is secure, set the following environmet variables:
   bootdelay = 0 (To disable Boot Prompt)
   bootcmd = CONFIG_CHAIN_BOOT_CMD (Validate and execute Boot script)

Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Acked-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-01-27 08:12:56 -08:00
Aneesh Bansal
bdc22074c5 secure_boot: split the secure boot functionality in two parts
There are two phases in Secure Boot
1. ISBC: In BootROM, validate the BootLoader (U-Boot).
2. ESBC: In U-Boot, continuing the Chain of Trust by
         validating and booting LINUX.

For ESBC phase, there is no difference in SoC's based on ARM or
PowerPC cores.

But the exit conditions after ISBC phase i.e. entry conditions for
U-Boot are different for ARM and PowerPC.
PowerPC:

If Secure Boot is executed, a separate U-Boot target is required
which must be compiled with a diffrent Text Base as compared to
Non-Secure Boot. There are some LAW and TLB settings which are
required specifically for Secure Boot scenario.

ARM:
ARM based SoC's have a fixed memory map and exit conditions from
BootROM are same irrespective of boot mode (Secure or Non-Secure).

Thus the current Secure Boot functionlity has been split into
two parts:
CONFIG_CHAIN_OF_TRUST
This will have the following functionality as part of U-Boot:
1. Enable commands like esbc_validate, esbc_halt
2. Change the environment settings based on bootmode, determined
   at run time:
     - If bootmode is non-secure, no change
     - If bootmode is secure, set the following:
         - bootdelay = 0 (Don't give boot prompt)
         - bootcmd = Validate and execute the bootscript.

CONFIG_SECURE_BOOT
This is defined only for creating a different compile time target
for secure boot.

Traditionally, both these functionalities were defined under
CONFIG_SECURE_BOOT. This patch is aimed at removing the requirement
for a separate Secure Boot target for ARM based SoC's.
CONFIG_CHAIN_OF_TRUST will be defined and boot mode will be
determine at run time.

Another Security Requirement for running CHAIN_OF_TRUST is that
U-Boot environemnt must not be picked from flash/external memory.
This cannot be done based on bootmode at run time in current U-Boot
architecture. Once this dependency is resolved, no separate
SECURE_BOOT target will be required for ARM based SoC's.

Currently, the only code under CONFIG_SECURE_BOOT for ARM SoC's is
defining CONFIG_ENV_IS_NOWHERE

Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Acked-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-01-27 08:12:32 -08:00
Aneesh Bansal
74eecd820f secure_boot: include/configs: move definition of CONFIG_CMD_BLOB
CONFIG_CMD_BLOB must be defined in case of Secure Boot. It was
earlier defined in all config files. The definition has been
moved to a common file which is included by all configs.

Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Acked-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-01-27 08:12:26 -08:00
Aneesh Bansal
2ed948f466 SECURE_BOOT: Disable IE Key feature for RAMBOOT
ISBC Key Extension feature is not applicable for RAMBOOT
as there is no way to retrieve the CSF Header and validated
IE Key table from SRAM once CPC has been disabled.
The feature is only applicable in case of NOR SECURE BOOT.
Code Cleanup:
The SECURE_BOOT specific defines have been moved from
arch-ls102xa/config.h to
arm/include/asm/fsl_secure_boot.h

Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-09-01 21:38:02 -05:00
Aneesh Bansal
5050f6f0e5 powerpc/mpc85xx: SECURE BOOT-Copy Boot Script on RAM
For running Chain of Trust when doing Secure Boot from NAND,
the Bootscript header and bootscript must be copied from NAND
to RAM(DDR).
The addresses and commands for the same have been defined.

Signed-off-by: Saksham Jain <saksham@freescale.com>
Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-07-31 08:50:18 -07:00
Aneesh Bansal
467a40dfe3 powerpc/mpc85xx: SECURE BOOT- NAND secure boot target for P3041
Secure Boot Target is added for NAND for P3041.
For mpc85xx SoCs, the core begins execution from address 0xFFFFFFFC.
In case of secure boot, this default address maps to Boot ROM.
The Boot ROM code requires that the bootloader(U-boot) must lie
in 0 to 3.5G address space i.e. 0x0 - 0xDFFFFFFF.

In case of NAND Secure Boot, CONFIG_SYS_RAMBOOT is enabled and CPC is
configured as SRAM. U-Boot binary will be located on SRAM configured
at address 0xBFF00000.
In the U-Boot code, TLB entries are created to map the virtual address
0xFFF00000 to physical address 0xBFF00000 of CPC configured as SRAM.

Signed-off-by: Saksham Jain <saksham@freescale.com>
Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-07-31 08:50:18 -07:00
gaurav rana
e622d9ed3b powerpc/T104xD4: Add Secure boot support for T104xD4RDB platforms
defconfig files are added and SFP version for these platforms
is updated.

Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-07-28 14:41:14 -07:00
gaurav rana
98cb0efde8 Add bootscript support to esbc_validate.
1. Default environment will be used for secure boot flow
 which can't be edited or saved.
2. Command for secure boot is predefined in the default
 environment which will run on autoboot (and autoboot is
 the only option allowed in case of secure boot) and it
 looks like this:
 #define CONFIG_SECBOOT \
 "setenv bs_hdraddr 0xe8e00000;"                 \
 "esbc_validate $bs_hdraddr;"                    \
 "source $img_addr;"                             \
 "esbc_halt;"
 #endif
3. Boot Script can contain esbc_validate commands and bootm command.
 Uboot source command used in default secure boot command will
 run the bootscript.
4. Command esbc_halt added to ensure either bootm executes
 after validation of images or core should just spin.

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-04-21 10:19:19 -07:00
gaurav rana
e04916a721 SECURE_BOOT : enable esbc_validate command for powerpc and arm platforms.
esbc_validate command uses various IP Blocks: Security Monitor, CAAM block
and SFP registers. Hence the respective CONFIG's are enabled.

Apart from these CONFIG_SHA_PROG_HW_ACCEL and CONFIG_RSA are also enabled.

Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-03-05 12:04:59 -08:00
Aneesh Bansal
b3f0f63223 powerpc/mpc85xx: Define PBI Flash Base for C29XPCIE Secure Boot
CONFIG_SYS_PBI_FLASH_BASE is defined for Secure Boot on C29X

Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-01-16 09:30:12 -08:00
Shengzhou Liu
f605079041 powerpc/mpc85xx: Add T1024/T1023 SoC support
Add support for Freescale T1024/T1023 SoC.

The T1024 SoC includes the following function and features:
- Two 64-bit Power architecture e5500 cores, up to 1.4GHz
- private 256KB L2 cache each core and shared 256KB CoreNet platform cache (CPC)
- 32-/64-bit DDR3L/DDR4 SDRAM memory controller with ECC and interleaving support
- Data Path Acceleration Architecture (DPAA) incorporating acceleration
- Four MAC for 1G/2.5G/10G network interfaces (RGMII, SGMII, QSGMII, XFI)
- High-speed peripheral interfaces
  - Three PCI Express 2.0 controllers
- Additional peripheral interfaces
  - One SATA 2.0 controller
  - Two USB 2.0 controllers with integrated PHY
  - Enhanced secure digital host controller (SD/eSDHC/eMMC)
  - Enhanced serial peripheral interface (eSPI)
  - Four I2C controllers
  - Four 2-pin UARTs or two 4-pin UARTs
  - Integrated Flash Controller supporting NAND and NOR flash
- Two 8-channel DMA engines
- Multicore programmable interrupt controller (PIC)
- LCD interface (DIU) with 12 bit dual data rate
- QUICC Engine block supporting TDM, HDLC, and UART
- Deep Sleep power implementaion (wakeup from GPIO/Timer/Ethernet/USB)
- Support for hardware virtualization and partitioning enforcement
- QorIQ Platform's Trust Architecture 2.0

Differences between T1024 and T1023:
  Feature         T1024  T1023
  QUICC Engine:   yes    no
  DIU:            yes    no
  Deep Sleep:     yes    no
  I2C controller: 4      3
  DDR:            64-bit 32-bit
  IFC:            32-bit 28-bit

Signed-off-by: Shengzhou Liu <Shengzhou.Liu@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2014-12-05 08:06:14 -08:00
Aneesh Bansal
e47c2a6851 powerpc/mpc85xx: SECURE BOOT- Add secure boot target for T2080RDB
Secure Boot Target is added for T2080RDB

Changes:
For Secure boot, CPC is configured as SRAM and used as house
keeping area which needs to be disabled.
So CONFIG_SYS_CPC_REINIT_F is defined for CONFIG_T2080RDB.

Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
2014-05-13 08:26:54 -07:00
Aneesh Bansal
4067815998 powerpc/mpc85xx: SECURE BOOT- secure boot target for t1040rdb
T1040RDB.h file is removed and a unified file T104xRDB.h is created.
Hence macro CONFIG_T1040 is renamed to CONFIG_T104x.

Signed-off-by: Gaurav Kumar Rana <gaurav.rana@freescale.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
2014-05-13 08:24:32 -07:00