From patchwork Wed May 25 16:40:52 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sumit Garg X-Patchwork-Id: 626115 X-Patchwork-Delegate: yorksun@freescale.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from theia.denx.de (theia.denx.de [85.214.87.163]) by ozlabs.org (Postfix) with ESMTP id 3rF8P7234zz9sdb for ; Wed, 25 May 2016 20:57:15 +1000 (AEST) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id AEC27A7514; Wed, 25 May 2016 12:57:12 +0200 (CEST) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DI_F1C5iQ7kb; Wed, 25 May 2016 12:57:12 +0200 (CEST) Received: from theia.denx.de (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id 4A593A74DB; Wed, 25 May 2016 12:57:12 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by theia.denx.de (Postfix) with ESMTP id B9543A74DB for ; Wed, 25 May 2016 12:57:08 +0200 (CEST) Received: from theia.denx.de ([127.0.0.1]) by localhost (theia.denx.de [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9fZqA6Yu0cd5 for ; Wed, 25 May 2016 12:57:08 +0200 (CEST) X-policyd-weight: NOT_IN_SBL_XBL_SPAMHAUS=-1.5 NOT_IN_SPAMCOP=-1.5 NOT_IN_BL_NJABL=-1.5 (only DNSBL check requested) Received: from na01-by2-obe.outbound.protection.outlook.com (mail-by2on0066.outbound.protection.outlook.com [207.46.100.66]) by theia.denx.de (Postfix) with ESMTPS id 76112A74C6 for ; Wed, 25 May 2016 12:57:03 +0200 (CEST) Received: from CH1PR03CA008.namprd03.prod.outlook.com (10.255.156.153) by BL2PR03MB466.namprd03.prod.outlook.com (10.141.92.17) with Microsoft SMTP Server (TLS) id 15.1.497.12; Wed, 25 May 2016 10:23:42 +0000 Received: from BY2FFO11FD011.protection.gbl (10.255.156.132) by CH1PR03CA008.outlook.office365.com (10.255.156.153) with Microsoft SMTP Server (TLS) id 15.1.501.7 via Frontend Transport; Wed, 25 May 2016 10:23:42 +0000 Authentication-Results: spf=fail (sender IP is 192.88.168.50) smtp.mailfrom=nxp.com; nxp.com; dkim=none (message not signed) header.d=none;nxp.com; dmarc=none action=none header.from=nxp.com; Received-SPF: Fail (protection.outlook.com: domain of nxp.com does not designate 192.88.168.50 as permitted sender) receiver=protection.outlook.com; client-ip=192.88.168.50; helo=tx30smr01.am.freescale.net; Received: from tx30smr01.am.freescale.net (192.88.168.50) by BY2FFO11FD011.mail.protection.outlook.com (10.1.14.129) with Microsoft SMTP Server (TLS) id 15.1.497.8 via Frontend Transport; Wed, 25 May 2016 10:23:41 +0000 Received: from localhost.ap.freescale.net ([10.232.14.164]) by tx30smr01.am.freescale.net (8.14.3/8.14.0) with ESMTP id u4PANbkM000811; Wed, 25 May 2016 03:23:38 -0700 From: Sumit Garg To: Date: Wed, 25 May 2016 12:40:52 -0400 Message-ID: <1464194453-5829-1-git-send-email-sumit.garg@nxp.com> X-Mailer: git-send-email 1.8.1.4 X-EOPAttributedMessage: 0 X-Matching-Connectors: 131086454218816775; (91ab9b29-cfa4-454e-5278-08d120cd25b8); () X-Forefront-Antispam-Report: CIP:192.88.168.50; IPV:NLI; CTRY:US; EFV:NLI; SFV:NSPM; SFS:(10009020)(6009001)(2980300002)(1110001)(1109001)(339900001)(199003)(189002)(9170700003)(4326007)(110136002)(2906002)(50466002)(575784001)(86362001)(1220700001)(586003)(19580395003)(50226002)(87936001)(5003940100001)(8666003)(106466001)(77096005)(48376002)(92566002)(50986999)(104016004)(105606002)(6806005)(5008740100001)(11100500001)(76506005)(8676002)(2351001)(36756003)(8936002)(81166006)(85426001)(33646002)(189998001)(229853001)(19580405001)(7059030)(4720700001); DIR:OUT; SFP:1101; SCL:1; SRVR:BL2PR03MB466; H:tx30smr01.am.freescale.net; FPR:; SPF:Fail; MLV:sfv; A:1; MX:1; LANG:en; X-Microsoft-Exchange-Diagnostics: 1; BY2FFO11FD011; 1:7rWKn1f+cL4rplcMmGbkTmd0rUzfm5CBAaOp1T1PpZnj6BM3EhUHBhXtW2yd4FkA533uMeddySBFSFJZylBAqSpS2tXaYPLidjywojNvS5gh7/49/TR8wFh5qb91iNTPHMbYlcFEFy+5cmxnonl86DZDnrcZfXtRNMZKkDoyIjUu8xe8HAMBrgocTZ6U7t1VvkO3+8cwtkQhvfilSKPxAZpGkhLs2r0Ypgz+sulzVq16/VoYsqkXGcTbqimOxml0WRvGPGYuw/nX+Gx6lt8bxhsaiGVWjL8S/kuGbn7Y3yaGvyW/GwtYrQUOoBmrVWtQucQOlJzKIShUHUX7XkDuAtUJue1hckgQK4JCZEg9LyrFSMDghO2hm2YHwsaZY+Dmvi2icS4KifEXf0B2eNZGNZ4kuz5YigQju/O2a9GmbemZnk+XgBIjiXOpzuV6BboyGMGicD99GSvkRk2YLuob3yly10AsXd98b5VPJbHHROMFIUQpIhNOD/T8dMaJK2ObNigUGfJgizEWml1AX5czQk1xdyrJ4dz3tM+d0pXspVUy66HwUgxHL4CkpgsfYy0SkSvqJn8gO4B1KwHsiQH5kCW5Yo15K2OZaeXCbcmlTIbDSmo92GiKwFGz2Ga/fLzcL1pB9b3/nLo2fWhkAcnKZqpHmqbiKpyTZuhZW+/YDicaTiVSJVuxCB1W15jy6oVG MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 8516b947-f461-4c6e-fd07-08d38486a50a X-Microsoft-Exchange-Diagnostics: 1; BL2PR03MB466; 2:DmD1b2OC6yUocyEmKqy/nlM1hTaLstSuq7V5qWVdzHDIL8q2zq9cS46kBS7ODxw8RVHMF3bc5e4OmCqifZmKNyXRZ80Ov78/6ZGRU/Tu6lw7aa7D+TEokJw0xaaqMwfsIEiBZ51RsX6+wkauAleV7TEuFXLIjBwYae4w4GLm8dx7U6p8kOrCZQQV5J3Og8al; 3:OiyqldE+T5zzy6SbqaRxr8cjk5lrNgLitdX18FK0LmyezMVgK0euIDv8kEGpqcc0CEUTjxSKp8I/oF8fxnm4RGU+xGHIJv59sSWeNtuFCEzPuDscYdQU+nnwT/HHH5GYAII7+u5kcPesMioLcR9HIBKPPgDfQmRFeI0w8Udj7nb1co3QdisPgp//8BCuA9iRLgv5rgzZqQi3kZ8qXinVNkVcS59HDWW+5N3wcrj70XA= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BL2PR03MB466; X-Microsoft-Exchange-Diagnostics: 1; BL2PR03MB466; 25:gFqMUzapdFYoeuuG+DKOz/G9rrb4my/kaKdRNVJEIglZvBGkF2o83x5+NH78Hsf+ck7ffRCm1sAEQDOsKrkNSVRTIt0ZHrPfw92tBp6vUc892HJoE/hxVsmmiac8MNxPdbEaCaxzxSyyMzSM3oDrpuwfU8nnXYkSOFAkCpa7w8x9Yy0f87ezgkTU+SQzCLy6mDJ0dUXrcpx1Fm6dpSw66+CB5kmwJF32nR/QFRY8uc7YhFL51wYliZaeWFiYTXnODMmfj1MOPg7/yUyWXXX1FBjgHnQg2FxIJznVKzULOOxLrGr19ABr8bIBW2z/WACioTC2TwLaY211KClNg60d2yzLlXNhObLtaBcAkuD3iCouVKh6gfVpBRSC+543WQ0TPDFLpfouKN+Js0boHptu40872O1K3FUDIK4z1+B4EQUupF8tDDFC8uj5BT3N9iBOMYhcX90my69IoLb6N1eDb7Kg6KnbyR63mQ986vHydtQbBpgwLlqIsag66h9GwFat/bpFJQam23knGho+Qrj7JWDrLSX+CmxTRphRtI99iykDdWKySw5lKaWVr5PJJBsaqFpopDhtFlFAuVoap87F4EPBoS4SiFY65GRZ4dv4Ql776arVQyHq+KryXPOKjg0dod3WhnHhUN1jJ8z0GaxgyBwSTBUfUaNRk05tpVKPwv2VLLUMnhV9xmDX18/CnHVPkSOTpIbWYthIcoC/cpPrxPZTITJEUhMIGa26tncFEXdT1L1t7gOcQbCsIBZn/S7NqSS2R6iv/LeA5u5WBquQqDKKcQGSWXs+mXImTUjnVRw= X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0; PCL:0; RULEID:(601004)(2401047)(13017025)(13015025)(13018025)(13024025)(13023025)(5005006)(8121501046)(3002001)(10201501046)(6055026); SRVR:BL2PR03MB466; BCL:0; PCL:0; RULEID:(400006); SRVR:BL2PR03MB466; X-Microsoft-Exchange-Diagnostics: 1; BL2PR03MB466; 4:g4Z1sy0r5V90RcyifbkFiWuOL9Bd0IjhDJtC+z6u1OKKlmnUiqUnKe5WLOnRUXFGf6wCdtcRHQYBtHnuqdSKp8S6Ua/8AY2xvzGxrpF8jrF22uq0AhJ7m+PE0XJUmbB98gBq9cNdLPUJN+DdvTaOgzq4PEafD1NTVKvFCeYPTwl5DaWgXfNdzhWdtjCLJIzo2zMi8riyVNJL9/r6fD46usbtUYY0/W5PHlj2tdvLHjOzmXEjFxvrTcOsq17/rWM6U19Shp7KGp6ZzQ18w3kuXcpnZmSNHb6KvwR4XZWjMSgvAEi9WXPGSnai69cwrhhci3SbsZuFdGMuj46O882UU94YQ0u3hdnTVEZBl5H/FGuHAluwLUjhW85RnJHLj5I+8mpWwWSZUI9EMiwUHIvlQOFzEqZilVizVxhnZEWZBrVNuLY/0OTI32JTH9WgBnpBxdDNnNuf5Xltkgc+z/pvZR4YLcWGfP+FDvcxWNQwlnw= X-Forefront-PRVS: 09538D3531 X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1; BL2PR03MB466; 23:bwAtc14rKFWguewCGGpqJqpGAFYWO7aqakmVQ/0SJu?= =?us-ascii?Q?BCl8OvDlR27aW3Y8SSdhtlunP+SzPlLOsZ0O4vkHYotkVHZF1PksdjVO29hj?= =?us-ascii?Q?fXci2O0L1BAX9fE7MIqxz9erG1qLzl4ujaIDakxRFJZ+zM3bu067unfI/Rbf?= =?us-ascii?Q?8FPCMRy/Y2t4/TCTOGik0sXbaeHe30bTkY4hKXFNxy6qkcxeYClbO1BidfDo?= =?us-ascii?Q?GbhgFLnLgAPY8mP8g8PCKc5MaVyvGi2cnZPR/fBabzs9PofaUF5va6h5hbZ6?= =?us-ascii?Q?ubOn61EuPwcEr3Z+04iyIPio4ghTznhdl/zC9nmEkLtUVQvBVOa4f43NFmWx?= =?us-ascii?Q?ayDZ4/50acYzmKoWzbI2CVca9GBGeCj28WKPNB9C5MKEkJ1/MLHKpHpNvJ3I?= =?us-ascii?Q?gYppWO1gdIVjuRwJlGdhEd/wf3hsTAueOZ0AepiK09MxkDtjcQVLafNxjjG6?= =?us-ascii?Q?HEWTGC8iK16PTqR0XF5NUwnyib0hqUeuYpOxLF0JEA/8x7If2pB9lU9SEbGU?= =?us-ascii?Q?ciwxN+MbMrhl5TudXaPSFApEbEL1aH2gZFxMEm7E9nJBTQbSBYdp8mrdag6w?= =?us-ascii?Q?ImbQueXzE//skWKRfxTnMyJb0IA6AK84X+rkGWSCeMQePb54rsjVvnmUlidP?= =?us-ascii?Q?esfU+V9D1owg5dyviM6RTR3noO5PB1d4iHqw8MEKDE6POYDCnVEjYqT6s2y4?= =?us-ascii?Q?grl2LdonBzhfkeaQ6UxuP5XlTMmwBLnEIBsoznroX3WhXSyRitb1erjZQH3S?= =?us-ascii?Q?q+JtQurMHEc+nKgEPy3LluLe3/ZJWooL/L5CpYsC4jlBxmog8RiW6GGYeFrh?= =?us-ascii?Q?Yo/Le4rCCxMxSB0MhVr0GZlbtbV07p7nnagcgd6amWl86Yf7DEsdXcBcDP1q?= =?us-ascii?Q?5rJlQYiLP+qYhD5fmeL/5M23STVZWpnRQgYr7hs0NoXDY4kkUNpwyNFwEHGZ?= =?us-ascii?Q?jFPGIr42IUq3zir621/sl3YjknmKETcnk6Hw6rDgGygbNdYIrCLiwmDPkOXO?= =?us-ascii?Q?7pwhqDLh4mqB/r58013YcnCbO4TibuzWfQPsLDitpCNv5d3A5VXmAt9QDMEp?= =?us-ascii?Q?rr2AhYKpRqnEBkfd1rVDcqnETAaIDYde1LZZldze0n79P/P1TVwYGjDziszc?= =?us-ascii?Q?0bB0aCAm6cUMwkbRcFmL16Vx50UEXM?= X-Microsoft-Exchange-Diagnostics: 1; BL2PR03MB466; 5:gzJUcrY1k3hhOwMYUiELQY59wfQpnp+VAw8Mc4NGU0cvytVgHpVJM4n9tY2LarUkzFhV2ERPdP4/6do0zym297jJZHXbbMPL6J87SlQYKRvM3DNBRXvoQo066W5zGnPOYdVDactnfKMPM/Ey5kRZcZGyykAJDDfZkryjz4gsjsE=; 24:EkSpwVQasqsSRM8hIZxpASZWAERoXj64YFt7uU9CBr24n5rya/hAPA+R4+qk2jt7zzmmY++5ePPfYBUaAWb3STNoMQWn0tQ5vh1vyyW291g=; 7:A4k2p6nX1OAtXjdB06Gj6zpZ1iZjCmIxSYyJVSwsc1j2cKkAxxa0CEdHcY6zypyBscZ8jXQnyLL8P8s57CqxlZZTJBUE7o+y+D7CbfPoPzvIXW/9ZRw7ZtJDvHppyaY1YSWOBxrB9yyVTvKYgUwGPAj/xPaA3jmq92HI+k9y2XeyKGEFHaigYFAEmZ1shLzL SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 May 2016 10:23:41.6788 (UTC) X-MS-Exchange-CrossTenant-Id: 5afe0b00-7697-4969-b663-5eab37d5f47e X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=5afe0b00-7697-4969-b663-5eab37d5f47e; Ip=[192.88.168.50]; Helo=[tx30smr01.am.freescale.net] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL2PR03MB466 Cc: ruchika.gupta@nxp.com Subject: [U-Boot] [PATCH v2 1/2] powerpc/mpc85xx: SECURE BOOT- Enable chain of trust in SPL X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.15 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" As part of Chain of Trust for Secure boot, the SPL U-Boot will validate the next level U-boot image. Add a new function spl_validate_uboot to perform the validation. Enable hardware crypto operations in SPL using SEC block. In case of Secure Boot, PAMU is not bypassed. For allowing SEC block access to CPC configured as SRAM, configure PAMU. Reviewed-by: Ruchika Gupta Signed-off-by: Aneesh Bansal Signed-off-by: Sumit Garg --- Changes in v2: Patches rebased arch/powerpc/cpu/mpc8xxx/fsl_pamu.c | 8 +++++ arch/powerpc/cpu/mpc8xxx/pamu_table.c | 8 +++++ arch/powerpc/include/asm/fsl_secure_boot.h | 26 +++++++++++++++ board/freescale/common/fsl_chain_of_trust.c | 50 +++++++++++++++++++++++++++++ common/Makefile | 2 ++ drivers/Makefile | 1 + drivers/crypto/fsl/jr.c | 16 +++++++++ drivers/mtd/nand/fsl_ifc_spl.c | 24 ++++++++++++++ include/fsl_validate.h | 1 + lib/Makefile | 3 ++ 10 files changed, 139 insertions(+) diff --git a/arch/powerpc/cpu/mpc8xxx/fsl_pamu.c b/arch/powerpc/cpu/mpc8xxx/fsl_pamu.c index 9421f1e..ede8e66 100644 --- a/arch/powerpc/cpu/mpc8xxx/fsl_pamu.c +++ b/arch/powerpc/cpu/mpc8xxx/fsl_pamu.c @@ -239,15 +239,23 @@ int pamu_init(void) spaact_size = sizeof(struct paace) * NUM_SPAACT_ENTRIES; /* Allocate space for Primary PAACT Table */ +#if (defined(CONFIG_SPL_BUILD) && defined(CONFIG_SPL_PPAACT_ADDR)) + ppaact = (void *)CONFIG_SPL_PPAACT_ADDR; +#else ppaact = memalign(PAMU_TABLE_ALIGNMENT, ppaact_size); if (!ppaact) return -1; +#endif memset(ppaact, 0, ppaact_size); /* Allocate space for Secondary PAACT Table */ +#if (defined(CONFIG_SPL_BUILD) && defined(CONFIG_SPL_SPAACT_ADDR)) + sec = (void *)CONFIG_SPL_SPAACT_ADDR; +#else sec = memalign(PAMU_TABLE_ALIGNMENT, spaact_size); if (!sec) return -1; +#endif memset(sec, 0, spaact_size); ppaact_phys = virt_to_phys((void *)ppaact); diff --git a/arch/powerpc/cpu/mpc8xxx/pamu_table.c b/arch/powerpc/cpu/mpc8xxx/pamu_table.c index 26c5ea4..a8e6f51 100644 --- a/arch/powerpc/cpu/mpc8xxx/pamu_table.c +++ b/arch/powerpc/cpu/mpc8xxx/pamu_table.c @@ -28,6 +28,14 @@ void construct_pamu_addr_table(struct pamu_addr_tbl *tbl, int *num_entries) i++; #endif +#if (defined(CONFIG_SPL_BUILD) && (CONFIG_SYS_INIT_L3_VADDR)) + tbl->start_addr[i] = + (uint64_t)virt_to_phys((void *)CONFIG_SYS_INIT_L3_VADDR); + tbl->size[i] = 256 * 1024; /* 256K CPC flash */ + tbl->end_addr[i] = tbl->start_addr[i] + tbl->size[i] - 1; + + i++; +#endif debug("PAMU address\t\t\tsize\n"); for (j = 0; j < i ; j++) debug("%llx \t\t\t%llx\n", tbl->start_addr[j], tbl->size[j]); diff --git a/arch/powerpc/include/asm/fsl_secure_boot.h b/arch/powerpc/include/asm/fsl_secure_boot.h index 826f9c9..2a29277 100644 --- a/arch/powerpc/include/asm/fsl_secure_boot.h +++ b/arch/powerpc/include/asm/fsl_secure_boot.h @@ -72,6 +72,30 @@ #ifdef CONFIG_CHAIN_OF_TRUST +#ifdef CONFIG_SPL_BUILD +#define CONFIG_SPL_DM 1 +#define CONFIG_SPL_CRYPTO_SUPPORT +#define CONFIG_SPL_DRIVERS_MISC_SUPPORT +/* + * PPAACT and SPAACT table for PAMU must be placed on DDR after DDR init + * due to space crunch on CPC and thus malloc will not work. + */ +#define CONFIG_SPL_PPAACT_ADDR 0x2e000000 +#define CONFIG_SPL_SPAACT_ADDR 0x2f000000 +#define CONFIG_SPL_JR0_LIODN_S 454 +#define CONFIG_SPL_JR0_LIODN_NS 458 +/* + * Define the key hash for U-Boot here if public/private key pair used to + * sign U-boot are different from the SRK hash put in the fuse + * Example of defining KEY_HASH is + * #define CONFIG_SPL_UBOOT_KEY_HASH \ + * "41066b564c6ffcef40ccbc1e0a5d0d519604000c785d97bbefd25e4d288d1c8b" + * else leave it defined as NULL + */ + +#define CONFIG_SPL_UBOOT_KEY_HASH NULL +#endif /* ifdef CONFIG_SPL_BUILD */ + #define CONFIG_CMD_ESBC_VALIDATE #define CONFIG_CMD_BLOB #define CONFIG_FSL_SEC_MON @@ -82,6 +106,7 @@ #define CONFIG_FSL_CAAM #endif +#ifndef CONFIG_SPL_BUILD /* fsl_setenv_chain_of_trust() must be called from * board_late_init() */ @@ -119,5 +144,6 @@ #endif /* #ifdef CONFIG_BOOTSCRIPT_COPY_RAM */ #include +#endif /* #ifndef CONFIG_SPL_BUILD */ #endif /* #ifdef CONFIG_CHAIN_OF_TRUST */ #endif diff --git a/board/freescale/common/fsl_chain_of_trust.c b/board/freescale/common/fsl_chain_of_trust.c index ecfcc82..992babf 100644 --- a/board/freescale/common/fsl_chain_of_trust.c +++ b/board/freescale/common/fsl_chain_of_trust.c @@ -6,7 +6,17 @@ #include #include +#include #include +#include + +#ifdef CONFIG_ADDR_MAP +#include +#endif + +#ifdef CONFIG_FSL_CORENET +#include +#endif #ifdef CONFIG_LS102XA #include @@ -52,6 +62,7 @@ int fsl_check_boot_mode_secure(void) return 0; } +#ifndef CONFIG_SPL_BUILD int fsl_setenv_chain_of_trust(void) { /* Check Boot Mode @@ -68,3 +79,42 @@ int fsl_setenv_chain_of_trust(void) setenv("bootcmd", CONFIG_CHAIN_BOOT_CMD); return 0; } +#endif + +#ifdef CONFIG_SPL_BUILD +void spl_validate_uboot(uint32_t hdr_addr, uintptr_t img_addr) +{ + int res; + + /* Check Boot Mode + * If Boot Mode is Non-Secure, skip validation + */ + if (fsl_check_boot_mode_secure() == 0) + return; + + printf("SPL: Validating U-Boot image\n"); + +#ifdef CONFIG_ADDR_MAP + init_addr_map(); +#endif + +#ifdef CONFIG_FSL_CORENET + if (pamu_init() < 0) + fsl_secboot_handle_error(ERROR_ESBC_PAMU_INIT); +#endif + +#ifdef CONFIG_FSL_CAAM + if (sec_init() < 0) + fsl_secboot_handle_error(ERROR_ESBC_SEC_INIT); +#endif + +#if defined(CONFIG_DM) + dm_init_and_scan(false); +#endif + res = fsl_secboot_validate(hdr_addr, CONFIG_SPL_UBOOT_KEY_HASH, + &img_addr); + + if (res == 0) + printf("SPL: Validation of U-boot successful\n"); +} +#endif diff --git a/common/Makefile b/common/Makefile index f9b26b7..402835b 100644 --- a/common/Makefile +++ b/common/Makefile @@ -93,6 +93,8 @@ obj-$(CONFIG_USB_KEYBOARD) += usb_kbd.o endif # !CONFIG_SPL_BUILD ifdef CONFIG_SPL_BUILD +# core +obj-$(CONFIG_SPL_CRYPTO_SUPPORT) += hash.o obj-$(CONFIG_ENV_IS_IN_FLASH) += env_flash.o obj-$(CONFIG_SPL_YMODEM_SUPPORT) += xyzModem.o obj-$(CONFIG_SPL_NET_SUPPORT) += miiphyutil.o diff --git a/drivers/Makefile b/drivers/Makefile index 99dd07f..d125b42 100644 --- a/drivers/Makefile +++ b/drivers/Makefile @@ -38,6 +38,7 @@ obj-$(CONFIG_OMAP_USB_PHY) += usb/phy/ obj-$(CONFIG_SPL_SATA_SUPPORT) += block/ obj-$(CONFIG_SPL_USB_HOST_SUPPORT) += block/ obj-$(CONFIG_SPL_MMC_SUPPORT) += block/ +obj-$(CONFIG_SPL_CRYPTO_SUPPORT) += crypto/ else diff --git a/drivers/crypto/fsl/jr.c b/drivers/crypto/fsl/jr.c index 8bc517d..2309b23 100644 --- a/drivers/crypto/fsl/jr.c +++ b/drivers/crypto/fsl/jr.c @@ -563,10 +563,26 @@ int sec_init(void) sec_out32(&sec->mcfgr, mcr); #ifdef CONFIG_FSL_CORENET +#ifdef CONFIG_SPL_BUILD + /* For SPL Build, Set the Liodns in SEC JR0 for + * creating PAMU entries corresponding to these. + * For normal build, these are set in set_liodns(). + */ + liodn_ns = CONFIG_SPL_JR0_LIODN_NS & JRNSLIODN_MASK; + liodn_s = CONFIG_SPL_JR0_LIODN_S & JRSLIODN_MASK; + + liodnr = sec_in32(&sec->jrliodnr[0].ls) & + ~(JRNSLIODN_MASK | JRSLIODN_MASK); + liodnr = liodnr | + (liodn_ns << JRNSLIODN_SHIFT) | + (liodn_s << JRSLIODN_SHIFT); + sec_out32(&sec->jrliodnr[0].ls, liodnr); +#else liodnr = sec_in32(&sec->jrliodnr[0].ls); liodn_ns = (liodnr & JRNSLIODN_MASK) >> JRNSLIODN_SHIFT; liodn_s = (liodnr & JRSLIODN_MASK) >> JRSLIODN_SHIFT; #endif +#endif ret = jr_init(); if (ret < 0) { diff --git a/drivers/mtd/nand/fsl_ifc_spl.c b/drivers/mtd/nand/fsl_ifc_spl.c index cbeb74a..30aa966 100644 --- a/drivers/mtd/nand/fsl_ifc_spl.c +++ b/drivers/mtd/nand/fsl_ifc_spl.c @@ -11,6 +11,9 @@ #include #include #include +#ifdef CONFIG_CHAIN_OF_TRUST +#include +#endif static inline int is_blank(uchar *addr, int page_size) { @@ -268,6 +271,27 @@ void nand_boot(void) */ flush_cache(CONFIG_SYS_NAND_U_BOOT_DST, CONFIG_SYS_NAND_U_BOOT_SIZE); #endif + +#ifdef CONFIG_CHAIN_OF_TRUST + /* + * As U-Boot header is appended at end of U-boot image, so + * calculate U-boot header address using U-boot header size. + */ +#define CONFIG_U_BOOT_HDR_ADDR \ + ((CONFIG_SYS_NAND_U_BOOT_START + \ + CONFIG_SYS_NAND_U_BOOT_SIZE) - \ + CONFIG_U_BOOT_HDR_SIZE) + spl_validate_uboot(CONFIG_U_BOOT_HDR_ADDR, + CONFIG_SYS_NAND_U_BOOT_START); + /* + * In case of failure in validation, spl_validate_uboot would + * not return back in case of Production environment with ITS=1. + * Thus U-Boot will not start. + * In Development environment (ITS=0 and SB_EN=1), the function + * may return back in case of non-fatal failures. + */ +#endif + uboot = (void *)CONFIG_SYS_NAND_U_BOOT_START; uboot(); } diff --git a/include/fsl_validate.h b/include/fsl_validate.h index a71e1ce..7695b30 100644 --- a/include/fsl_validate.h +++ b/include/fsl_validate.h @@ -254,4 +254,5 @@ int fsl_secboot_blob_decap(cmd_tbl_t *cmdtp, int flag, int argc, int fsl_check_boot_mode_secure(void); int fsl_setenv_chain_of_trust(void); +void spl_validate_uboot(uint32_t hdr_addr, uintptr_t img_addr); #endif diff --git a/lib/Makefile b/lib/Makefile index 02dfa29..2cdb436 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -59,6 +59,9 @@ obj-$(CONFIG_$(SPL_)OF_CONTROL) += fdtdec.o ifdef CONFIG_SPL_BUILD obj-$(CONFIG_SPL_YMODEM_SUPPORT) += crc16.o obj-$(CONFIG_SPL_NET_SUPPORT) += net_utils.o +ifdef CONFIG_SPL_CRYPTO_SUPPORT +obj-$(CONFIG_RSA) += rsa/ +endif endif obj-$(CONFIG_ADDR_MAP) += addr_map.o obj-y += hashtable.o