arm: ls1043ardb: Add SD secure boot target

- Add SD secure boot target for ls1043ardb.
- Implement FSL_LSCH2 specific spl_board_init() to setup CAAM stream
  ID and corresponding stream ID in SMMU.
- Change the u-boot size defined by a macro for copying the main
  U-Boot by SPL to also include the u-boot Secure Boot header size as
  header is appended to u-boot image. So header will also be copied
  from SD to DDR.
- CONFIG_MAX_SPL_SIZE is limited to 90KB. SPL is copied to OCRAM
  (128K) where 32K are reserved for use by boot ROM and 6K for secure
  boto header.
- Error messages during SPL boot are limited to error code numbers
  instead of strings to reduce the size of SPL image.

Signed-off-by: Vinitha Pillai-B57223 <vinitha.pillai@nxp.com>
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Signed-off-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>

diff --git a/arch/arm/cpu/armv8/fsl-layerscape/spl.c b/arch/arm/cpu/armv8/fsl-layerscape/spl.c
index 73a8680741741f501bd4ee84f9cffb98c7d7cba5..dfacf98e889bb3f2393d5c8b26e08ffa6cc22ecb 100644 (file)
--- a/arch/arm/cpu/armv8/fsl-layerscape/spl.c
+++ b/arch/arm/cpu/armv8/fsl-layerscape/spl.c
@@ -41,6 +41,24 @@ u32 spl_boot_mode(const u32 boot_device)
 }
 
 #ifdef CONFIG_SPL_BUILD
+
+void spl_board_init(void)
+{
+#if defined(CONFIG_SECURE_BOOT) && defined(CONFIG_FSL_LSCH2)
+       /*
+        * In case of Secure Boot, the IBR configures the SMMU
+        * to allow only Secure transactions.
+        * SMMU must be reset in bypass mode.
+        * Set the ClientPD bit and Clear the USFCFG Bit
+       */
+       u32 val;
+       val = (in_le32(SMMU_SCR0) | SCR0_CLIENTPD_MASK) & ~(SCR0_USFCFG_MASK);
+       out_le32(SMMU_SCR0, val);
+       val = (in_le32(SMMU_NSCR0) | SCR0_CLIENTPD_MASK) & ~(SCR0_USFCFG_MASK);
+       out_le32(SMMU_NSCR0, val);
+#endif
+}
+
 void board_init_f(ulong dummy)
 {
        /* Clear global data */

diff --git a/arch/arm/include/asm/fsl_secure_boot.h b/arch/arm/include/asm/fsl_secure_boot.h
index 558dc62cc7710a7e117ac72c5eb603fa400a8e41..1ca5f42ed61749861aeadae3af0424f5f01c5a8d 100644 (file)
--- a/arch/arm/include/asm/fsl_secure_boot.h
+++ b/arch/arm/include/asm/fsl_secure_boot.h
@@ -27,10 +27,11 @@
 #define CONFIG_SPL_UBOOT_KEY_HASH      NULL
 #endif /* ifdef CONFIG_SPL_BUILD */
 
+#define CONFIG_KEY_REVOCATION
+
 #ifndef CONFIG_SPL_BUILD
 #define CONFIG_CMD_BLOB
 #define CONFIG_CMD_HASH
-#define CONFIG_KEY_REVOCATION
 #ifndef CONFIG_SYS_RAMBOOT
 /* The key used for verification of next level images
  * is picked up from an Extension Table which has
@@ -87,7 +88,11 @@
 /* For SD boot address and size are assigned in terms of sector
  * offset and no. of sectors respectively.
  */
-#define CONFIG_BS_HDR_ADDR_DEVICE      0x00000900
+#if defined(CONFIG_LS1043A)
+#define CONFIG_BS_HDR_ADDR_DEVICE      0x00000920
+#else
+#define CONFIG_BS_HDR_ADDR_DEVICE       0x00000900
+#endif
 #define CONFIG_BS_ADDR_DEVICE          0x00000940
 #define CONFIG_BS_HDR_SIZE             0x00000010
 #define CONFIG_BS_SIZE                 0x00000008

diff --git a/board/freescale/common/fsl_validate.c b/board/freescale/common/fsl_validate.c
index 7396aa2f698aa0022317460becc230f9b7ad1b81..125655a37a208bca75941e37d3ac67cb937401c6 100644 (file)
--- a/board/freescale/common/fsl_validate.c
+++ b/board/freescale/common/fsl_validate.c
@@ -393,6 +393,7 @@ static void fsl_secboot_bootscript_parse_failure(void)
  */
 void fsl_secboot_handle_error(int error)
 {
+#ifndef CONFIG_SPL_BUILD
        const struct fsl_secboot_errcode *e;
 
        for (e = fsl_secboot_errcodes; e->errcode != ERROR_ESBC_CLIENT_MAX;
@@ -400,6 +401,9 @@ void fsl_secboot_handle_error(int error)
                if (e->errcode == error)
                        printf("ERROR :: %x :: %s\n", error, e->name);
        }
+#else
+       printf("ERROR :: %x\n", error);
+#endif
 
        /* If Boot Mode is secure, transition the SNVS state and issue
         * reset based on type of failure and ITS setting.

diff --git a/board/freescale/ls1043ardb/MAINTAINERS b/board/freescale/ls1043ardb/MAINTAINERS
index 0503a3fcc966c3d84432fc0766cd4df8eb1cf667..8b69892bbbc05c34f8bc33b75a1014afd878f708 100644 (file)
--- a/board/freescale/ls1043ardb/MAINTAINERS
+++ b/board/freescale/ls1043ardb/MAINTAINERS
@@ -12,3 +12,4 @@ LS1043A_SECURE_BOOT BOARD
 M:     Ruchika Gupta <ruchika.gupta@nxp.com>
 S:     Maintained
 F:     configs/ls1043ardb_SECURE_BOOT_defconfig
+F:     configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig

diff --git a/configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig b/configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig
new file mode 100644 (file)
index 0000000..3f35d64
--- /dev/null
+++ b/configs/ls1043ardb_sdcard_SECURE_BOOT_defconfig
@@ -0,0 +1,57 @@
+CONFIG_ARM=y
+CONFIG_TARGET_LS1043ARDB=y
+CONFIG_SPL_LIBCOMMON_SUPPORT=y
+CONFIG_SPL_LIBGENERIC_SUPPORT=y
+CONFIG_SPL_MMC_SUPPORT=y
+CONFIG_SPL_SERIAL_SUPPORT=y
+CONFIG_SPL_ENV_SUPPORT=y
+CONFIG_SPL_DRIVERS_MISC_SUPPORT=y
+CONFIG_SPL_WATCHDOG_SUPPORT=y
+CONFIG_DEFAULT_DEVICE_TREE="fsl-ls1043a-rdb"
+CONFIG_FIT=y
+CONFIG_FIT_VERBOSE=y
+CONFIG_OF_BOARD_SETUP=y
+CONFIG_SYS_EXTRA_OPTIONS="RAMBOOT_PBL,SPL_FSL_PBL,SD_BOOT"
+CONFIG_SECURE_BOOT=y
+CONFIG_SD_BOOT=y
+CONFIG_BOOTDELAY=10
+CONFIG_SPL=y
+CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_USE_SECTOR=y
+CONFIG_SYS_MMCSD_RAW_MODE_U_BOOT_SECTOR=0x110
+CONFIG_SPL_MPC8XXX_INIT_DDR_SUPPORT=y
+CONFIG_HUSH_PARSER=y
+CONFIG_CMD_GPT=y
+CONFIG_CMD_MMC=y
+CONFIG_CMD_SF=y
+CONFIG_CMD_I2C=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_DHCP=y
+CONFIG_CMD_PXE=y
+CONFIG_CMD_MII=y
+CONFIG_CMD_PING=y
+CONFIG_CMD_CACHE=y
+CONFIG_CMD_EXT2=y
+CONFIG_CMD_FAT=y
+# CONFIG_SPL_EFI_PARTITION is not set
+CONFIG_OF_CONTROL=y
+CONFIG_DM=y
+CONFIG_SPL_DM=y
+CONFIG_MTD_NOR_FLASH=y
+CONFIG_SPI_FLASH=y
+CONFIG_NETDEVICES=y
+CONFIG_E1000=y
+CONFIG_PCI=y
+CONFIG_DM_PCI=y
+CONFIG_DM_PCI_COMPAT=y
+CONFIG_PCIE_LAYERSCAPE=y
+CONFIG_SYS_NS16550=y
+CONFIG_DM_SPI=y
+CONFIG_USB=y
+CONFIG_DM_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_DWC3=y
+CONFIG_USB_STORAGE=y
+CONFIG_RSA=y
+CONFIG_SPL_RSA=y
+CONFIG_SPL_CRYPTO_SUPPORT=y
+CONFIG_SPL_HASH_SUPPORT=y

diff --git a/include/configs/ls1043a_common.h b/include/configs/ls1043a_common.h
index 23b7ef7b8206ab8c1f6f955d1bf165dd216586a1..c63c5e3403ad1787e80a1e3ce312f65d4e02c91a 100644 (file)
--- a/include/configs/ls1043a_common.h
+++ b/include/configs/ls1043a_common.h
@@ -71,7 +71,7 @@
 #define CONFIG_SPL_TARGET              "u-boot-with-spl.bin"
 
 #define CONFIG_SPL_TEXT_BASE           0x10000000
-#define CONFIG_SPL_MAX_SIZE            0x1d000
+#define CONFIG_SPL_MAX_SIZE            0x17000
 #define CONFIG_SPL_STACK               0x1001e000
 #define CONFIG_SPL_PAD_TO              0x1d000
 
@@ -80,7 +80,19 @@
 #define CONFIG_SYS_SPL_MALLOC_SIZE     0x100000
 #define CONFIG_SPL_BSS_START_ADDR      0x80100000
 #define CONFIG_SPL_BSS_MAX_SIZE                0x80000
-#define CONFIG_SYS_MONITOR_LEN         0xa0000
+
+#ifdef CONFIG_SECURE_BOOT
+#define CONFIG_U_BOOT_HDR_SIZE                         (16 << 10)
+/*
+ * HDR would be appended at end of image and copied to DDR along
+ * with U-Boot image. Here u-boot max. size is 512K. So if binary
+ * size increases then increase this size in case of secure boot as
+ * it uses raw u-boot image instead of fit image.
+ */
+#define CONFIG_SYS_MONITOR_LEN         (0x100000 + CONFIG_U_BOOT_HDR_SIZE)
+#else
+#define CONFIG_SYS_MONITOR_LEN         0x100000
+#endif /* ifdef CONFIG_SECURE_BOOT */
 #endif
 
 /* NAND SPL */