summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2021-04-08crypto: caam: Fix pointer size to 32bit for i.MX8MAymen Sghaier
The CAAM block used in i.MX8M is 32 bits address size but when the flag PHYS_64BIT is enabled for armv8, the CAAM driver will try to use a wrong pointer size. This patch fixes this issue. Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08crypto: Add blob command support for i.MX8M platformsAymen Sghaier
This patch enable blob command for mScale platforms. Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08crypto: caam: Fix build warnings pointer castingAymen Sghaier
Enabling CAAM driver for i.MX8M platforms, a 64 bits architecture, lead to casting warnings: from/to pointer to/from integer with different size. This patch fix these warnings Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08crypto: caam: Add CAAM support to i.MX8M platformsAymen Sghaier
This patch enable CAAM support for i.MX8M platforms. Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx7ulp: Enable support for cmd blobFranck LENORMAND
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08caam: enable support for iMX7ULPFranck LENORMAND
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08crypto: caam: change JR running loopFranck LENORMAND
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08cmd: blob: Instantiate RNG before running CMD_BLOBBreno Lima
U-Boot can instantiate CAAM RNG if needed by crypto operations. Call sec_init() prior running a blob operation to ensure RNG is correctly instantiated. Make sure CAAM clock is enabled and check if a job ring is available for that operation. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08cmd: blob: Add IMX_HAB and CAAM supported SoCs as dependencyBreno Lima
In order to build CMD_BLOB on i.MX CAAM supported devices it's necessary to select IMX_HAB. Add IMX_HAB and CAAM supported SoCs as dependency. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08mx6dq: hab: Fix chip version in hab.h codeBreno Lima
Since commit 8891410c729b ("MLK-19848 mx6dq: Fix chip version issue for rev1.3") it's not possible to call the HAB API functions on i.MX6DQ SoC Rev 1.3: Authenticate image from DDR location 0x12000000... undefined instruction pc : [<412c00dc>] lr : [<8ff560bc>] reloc pc : [<c8b6d0dc>] lr : [<178030bc>] sp : 8ef444a8 ip : 126e8068 fp : 8ff59aa8 r10: 8ffd51e4 r9 : 8ef50eb0 r8 : 006e8000 r7 : 00000000 r6 : 126ea01f r5 : 0000002b r4 : 126e8000 r3 : 412c00dd r2 : 00000001 r1 : 00000001 r0 : 00000063 Flags: nzCv IRQs off FIQs off Mode SVC_32 Resetting CPU ... resetting ... The hab.h code is defining the HAB API base address according to the old SoC revision number, thus failing when calling the HAB API authenticate_image() function. Fix this issue by using mx6dq rev 1.3 instead of mx6dq rev 1.5. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: cmd_dek: Enable DEK only for chips supporting CAAMYe Li
Since cmd_dek is using CAAM JR, so enable the CMD_DEK only when HAS_CAAM is set Signed-off-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08iMX8M: Add support to enable CONFIG_IMX_HABYe Li
Add some SOC level codes and build configurations to use HAB lib for CONFIG_IMX_HAB (secure boot), like adding the SEC_CONFIG fuse, enable fuse driver, CAAM clock function, and add CAAM secure RAM to MMU table. The FSL_CAAM is temporally not enabled for iMX8M when CONFIG_IMX_HAB is set, because we don't need the CAAM driver for SPL. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08crypto: fsl: blob: Flush dcache range for destination addressBreno Lima
The blob command is not working on i.MX7D, i.MX8MQ and i.MX8MM devices. Due to different cache management it's necessary to flush dcache range for destination address so data can be available in memory. Add necessary operations in blob_encap() and blob_decap() functions. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: HAB: Add support for iMX8MMYe Li
The imx8mm has changed the address of rvt_hab, use new address for imx8mm. The authentication procedure is same as imx8mq. In u-boot, the authentication uses SIP call to trap ATF to run HAB authenticate. Users need to add CONFIG_SECURE_BOOT=y to defconfig to enable the feature. Signed-off-by: Ye Li <ye.li@nxp.com> Acked-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: hab: Fix build warnings in 32-bit targetsBreno Lima
When building 32-bit targets with CONFIG_SECURE_BOOT and DEBUG enabled the following warnings are displayed: arch/arm/mach-imx/hab.c:840:41: warning: format '%lx' expects argument \ of type 'long unsigned int', but argument 3 has type 'uint32_t \ {aka unsigned int}' [-Wformat=] printf("HAB check target 0x%08x-0x%08lx fail\n", ~~~~^ %08x ddr_start, ddr_start + bytes); arch/arm/mach-imx/hab.c:845:45: warning: format '%x' expects argument \ of type 'unsigned int', but argument 3 has type 'ulong \ {aka long unsigned int}' [-Wformat=] printf("\nivt_offset = 0x%x, ivt addr = 0x%x\n", ivt_offset, ivt_addr); ~^ %lx Fix warnings by providing the correct data type. Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Breno Lima <breno.lima@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08mx7ulp: hab: Add hab_status command for HABv4 M4 bootBreno Lima
When booting in low power or dual boot modes the M4 binary is authenticated by the M4 ROM code. Add an option in hab_status command so users can retrieve M4 HAB failure and warning events. => hab_status m4 Secure boot disabled HAB Configuration: 0xf0, HAB State: 0x66 No HAB Events Found! Add command documentation in mx6_mx7_secure_boot.txt guide. As HAB M4 API cannot be called from A7 core the code is parsing the M4 HAB persistent memory region. The HAB persistent memory stores HAB events, public keys and others HAB related information. The HAB persistent memory region addresses and sizes can be found in AN12263 "HABv4 RVT Guidelines and Recommendations". Reviewed-by: Utkarsh Gupta <utkarsh.gupta@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Breno Lima <breno.lima@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: hab: Check if IVT header is HABv4Breno Lima
The HABv4 implementation in ROM checks if HAB major version in IVT header is 4.x. The current implementation in hab.c code is only validating HAB v4.0 and HAB v4.1 and may be incompatible with newer HABv4 versions. Modify verify_ivt_header() function to align with HABv4 implementation in ROM code. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: hab: Display All HAB events via hab_status commandUtkarsh Gupta
Add ability for hab_status command to show All HAB events and not just HAB failure events Signed-off-by: Utkarsh Gupta <utkarsh.gupta@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: hab: Enable hab.c to authenticate additional images in open configurationBreno Lima
Currently it's not possible to authenticate additional boot images in HAB open configuration. The hab.c code is checking if the SEC_CONFIG[1] fuse is programmed prior to calling the hab_authenticate_image() API function. Users cannot check if their additional boot images has been correctly signed prior to closing their device. Enable hab.c to authenticate additional boot images in open mode so HAB events can be retrieved through get_hab_status() function. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08hab: Change calling to ROM API failsafeYe Li
Modify to use hab_rvt_failsafe function for failsafe ROM API, not directly call its ROM address. This function will wrap the sip call for iMX8M platforms. Signed-off-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: HAB: Validate IVT before authenticating imageUtkarsh Gupta
Calling csf_is_valid() with an un-signed image may lead to data abort as the CSF pointer could be pointing to a garbage address when accessed in HAB_HDR_LEN(*(const struct hab_hdr *)(ulong)ivt_initial->csf). Authenticate image from DDR location 0x80800000... Check CSF for Write Data command before authenticating image data abort pc : [<fff5494c>] lr : [<fff54910>] reloc pc : [<8780294c>] lr : [<87802910>] sp : fdf45dc8 ip : 00000214 fp : 00000000 r10: fffb6170 r9 : fdf4fec0 r8 : 00722020 r7 : 80f20000 r6 : 80800000 r5 : 80800000 r4 : 00720000 r3 : 17a5aca3 r2 : 00000000 r1 : 80f2201f r0 : 00000019 Flags: NzcV IRQs off FIQs off Mode SVC_32 Resetting CPU ... resetting ... To avoid such errors during authentication process, validate IVT structure by calling validate_ivt function which checks the following values in an IVT: IVT_HEADER = 0x4X2000D1 ENTRY != 0x0 RES1 = 0x0 DCD = 0x0 /* Recommended */ SELF != 0x0 /* Absoulute address of IVT */ CSF != 0x0 RES2 = 0x0 This commit also checks if Image's start address is 4 byte aligned. commit "0088d127 MLK-14945 HAB: Check if IVT valid before authenticating image" removed as this patch addresses the issue. Signed-off-by: Utkarsh Gupta <utkarsh.gupta@nxp.com> Signed-off-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: HAB: Update hab codes to support ARM64 and i.MX8MPeng Fan
There are some changes to support ARM64 i.MX8M platform in this patches: 1. The hab_rvt base and function vectors are different as i.MX6/7 2. Need to bypass an workaround for i.MX6 to fix problem in MMU. 3. The x18 register needed save & restore before calling any HAB API. According to ARM procedure call spec, the x18 is caller saved when it is used as temporary register. So calling HAB API may scratch this register, and cause crash once accessing the gd pointer. On ARMv7, the r9 is callee saved when it is used as variable register. So no need to save & restore it. 4. Add SEC_CONFIG fuse for iMX8M When current EL is not EL3, the direct calling to HAB will fail because CAAM/SNVS can't initialize at non-secure mode. In this case, we use SIP call to run the HAB in ATF. Signed-off-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: hab: Add function to authenticate kernel imageYe Li
When loading kernel image, the image size is parsed from header, so it does not include the CSF and IVT. Add back the authenticate_image function to wrap the imx_hab_authenticate_image with calculating IVT offset and full image size. Signed-off-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: Avoid hardcoded Job Ring Max sizeBreno Lima
Prior instantiating RNG we have to ensure if the CAAM job rings are available. Avoid hardcoded job ring max size and use the definition at fsl_sec.h Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: Ensure CAAM clock is enabled prior getting out_jr_sizeBreno Lima
Prior calling sec_in32() we have to ensure CAAM clock is enabled, the function sec_in32() is reading CAAM registers and if CAAM clock is disabled the system will hang. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: Avoid hardcoded output ring size register offset (ORSR)Breno Lima
The CAAM output ring size register offset is currently defined in fsl_sec.h as FSL_CAAM_ORSR_JRa_OFFSET, use this definition to avoid hardcoded value in i.MX common code. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx: imx7 Support for Manufacturing ProtectionBreno Lima
This code was originally developed by Raul Cardenas <raul.casas@nxp.com> and modified to be applied in U-Boot imx_v2017.03. More information about the initial submission can be seen in the link below: https://lists.denx.de/pipermail/u-boot/2016-February/245273.html i.MX7D has an a protection feature for Manufacturing process. This feature uses asymmetric encryption to sign and verify authenticated software handled between parties. This command enables the use of such feature. The private key is unique and generated once per device. And it is stored in secure memory and only accessible by CAAM. Therefore, the public key generation and signature functions are the only functions available for the user. The manufacturing-protection authentication process can be used to authenticate the chip to the OEM's server. Command usage: Print the public key for the device. - mfgprot pubk Generates Signature over given data. - mfgprot sign <data_address> <data_size> Signed-off-by: Raul Ulises Cardenas <raul.casas@nxp.com> Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8m: add regs used by CAAMPeng Fan
Add regs used by CAAM Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mn: evk: update MAINTAINERSPeng
Add imx8mn_evk_defconfig to be maintained Typo fix Signed-off-by: Peng <peng.fan@nxp.com>
2021-04-08imx8mq_evk: Applying default LPDDR4 script for B2Ye Li
Both i.MX8MQ B1 and B2 should use default LPDDR4 script, while B0 has another dedicated script. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08misc: ocotp: Update OCOTP driver for iMX8MQ B2Ye Li
i.MX8MQ B2 also has fixed value in OCOTP_READ_FUSE_DATA register, so it does not support "fuse sense" command like B1. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08iMX8MQ: Recognize the B2 revisionYe Li
i.MX8MQ B2 is using same value in OCOTP_READ_FUSE_DATA like B1, so we have to check the ROM verision to distinguish the revision. As we have checked the B1 rev for sticky bits work around in secure boot. So it won't apply on B2. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08arch: mach-imx: imx8m: fix unique_id read error for imx8mpPeng Fan
The value of Unique ID in uboot and kernel is different for iMX8MP: serial#=02e1444a0002aaff root@imx8mpevk:/sys/devices/soc0# cat soc_uid D699300002E1444A The reason is that Fuse Addresses of Unique ID of iMX8MP are 0x420 and 0x430. Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Alice Guo <alice.guo@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8m: ddr: Disable CA VREF Training for LPDDR4Ye Li
Users reported LPDDR4 MR12 value is set to 0 during PHY training, not the value from FSP timing structure, which cause compliance test failed. The root cause is the CATrainOpt[0] is set to 1 in 2D FSP timing but not set in 1D. According to PHY training application node, to enable the feature both 1D and 2D need set this field to 1, otherwise the training result will be incorrect. The PHY training doc also recommends to set CATrainOpt[0] to 0 to use MR12 value from message block (FSP structure). So update the LPDDR4 scripts of all mscale to clear CATrainOpt[0]. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Jacky Bai <ping.bai@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8m: soc: update fuse pathPeng Fan
Update fuse path to disable modules correctly. Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8m: Update thermal and PMU kernel nodes for dual/single coresYe Li
For dual core and single core iMX8M parts, the thermal node and PMU node in kernel DTB also needs update to remove the refers to deleted core nodes. Otherwise both driver will fail to work. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mn: Add support for 11x11 UltraLite part numberYe Li
There are 3 part numbers for 11x11 i.MX8MNano with different core number configuration: UltraLite Quad/Dual/Solo Comparing with i.MX8MN Lite parts, they have MIPI DSI disabled. So checking the MIPI DSI disable fuse to recognize these parts. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mn: Add low drive mode support for DDR4/LPDDR4 EVKYe Li
Add dedicated defconfigs for iMX8MN low drive mode which set the VDD_SOC and VDD_DRAM to 0.8v, DDR at 1600MTS (800Mhz clock) and GPU at 200Mhz. Signed-off-by: Ye Li <ye.li@nxp.com> Acked-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mn: Add LPDDR4 EVK board supportPeng Fan
Add support for iMX8MN LPDDR4 EVK board which uses 2GB LPDDR4 and PCA9450B PMIC. Signed-off-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mn_evk: drop duplicated codePeng Fan
uart clk has been enabled, no need enable again. Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08power: pca9450: add a new parameter for power_pca9450_initPeng Fan
Currently PCA9450 might have address 0x25 or 0x35, so let user choose the address. Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Jaehoon Chung <jh80.chung@samsung.com>
2021-04-08imx8mn: Update the DDR4 timing script on imx8mn ddr4 evkJacky Bai
On i.MX8MN, we can only support DLL-ON mode only, so update the timing to support 2400mts & 1066mts setpoint. Signed-off-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mp_evk: Increase VDD_ARM to 0.95v Overdrive voltagePeng Fan
There is a frequency/timing limitation for SOC and ARM, if SOC is OD voltage/OD freq, then ARM can't run at ND voltage/1.2Ghz, it may have timing risk from SOC to ARM. Current VDD_SOC is set to 0.95v OD voltage in SPL, and kernel will increase bus clocks to OD frequency before it increases ARM voltage. So to conform to the limitation, we'd better increases VDD_ARM to OD voltage in SPL. Signed-off-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mp_evk: spl: clean up including headersPeng Fan
Clean up the including headers Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mp: refine power on imx8mp boardhaidong.zheng
VDD SOC normal run changed to 0.85V LPDDR4 freq0 change from 4000MTS to 2400MTS Signed-off-by: haidong.zheng <haidong.zheng@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mp_evk: Update LPDDR4 refresh timeYe Li
Use more safer refresh time value for 6GB LPDDR4 on this EVK board. Update the parameters for every frequency point. Signed-off-by: Ye Li <ye.li@nxp.com> Reviewed-by: Jacky Bai <ping.bai@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mp_evk: Update LPDDR4 timing for new FW 202006Ye Li
After switching to new LPDDR4 firmware 202006 version, have to update the LPDDR4 timing accordingly from RPA tool. Signed-off-by: Ye Li <ye.li@nxp.com> Tested-by: Sherry Sun <sherry.sun@nxp.com> Tested-by: Jacky Bai <ping.bai@nxp.com> Reviewed-by: Jacky Bai <ping.bai@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mp: ddr: Add inline ECC feature supportSherry Sun
Add inline ECC support for lpddr4 on imx8mp-evk. And add a config which can enable/disable inline ECC feature for lpddr4 on imx8mp-evk board. Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mp_evk: add/cleanup variable for distroPeng Fan
Add fdt_addr_r fdtfile which used by distro boot Clean up environment Signed-off-by: Peng Fan <peng.fan@nxp.com>
2021-04-08imx8mm_evk: add/cleanup variable for distroPeng Fan
Add fdt_addr_r fdtfile which used by distro boot Clean up environment Signed-off-by: Peng Fan <peng.fan@nxp.com>
generated by cgit v1.2.3 (git 2.0.4) at 2024-07-07 10:08:22 +0000