From patchwork Fri Apr 12 16:54:46 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Davis X-Patchwork-Id: 1084859 X-Patchwork-Delegate: trini@ti.com Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.denx.de (client-ip=81.169.180.215; helo=lists.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=quarantine dis=none) header.from=ti.com Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=ti.com header.i=@ti.com header.b="zTRNy5eC"; dkim-atps=neutral Received: from lists.denx.de (dione.denx.de [81.169.180.215]) by ozlabs.org (Postfix) with ESMTP id 44gklM26FFz9s55 for ; Sat, 13 Apr 2019 03:04:31 +1000 (AEST) Received: by lists.denx.de (Postfix, from userid 105) id F1A79C21EE3; Fri, 12 Apr 2019 16:58:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on lists.denx.de X-Spam-Level: X-Spam-Status: No, score=0.0 required=5.0 tests=T_DKIM_INVALID autolearn=unavailable autolearn_force=no version=3.4.0 Received: from lists.denx.de (localhost [IPv6:::1]) by lists.denx.de (Postfix) with ESMTP id E3E58C21F6E; Fri, 12 Apr 2019 16:58:01 +0000 (UTC) Received: by lists.denx.de (Postfix, from userid 105) id D59ECC21F0F; Fri, 12 Apr 2019 16:55:14 +0000 (UTC) Received: from lelv0143.ext.ti.com (lelv0143.ext.ti.com [198.47.23.248]) by lists.denx.de (Postfix) with ESMTPS id 49F03C21F79 for ; Fri, 12 Apr 2019 16:55:13 +0000 (UTC) Received: from lelv0265.itg.ti.com ([10.180.67.224]) by lelv0143.ext.ti.com (8.15.2/8.15.2) with ESMTP id x3CGtBBY099013; Fri, 12 Apr 2019 11:55:11 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ti.com; s=ti-com-17Q1; t=1555088111; bh=8Ygs7CU30MEP4QmzyKh54C1+fSWxiLOCoPjBJO1b1xE=; h=From:To:CC:Subject:Date:In-Reply-To:References; b=zTRNy5eC0EiLuYoII/DbMMyyNyPl7J73n59u1IIbSZdvKTOyNhAKUJT/CYVGo/h8K z61zo4zx6Pth6YrIn6iQM81MPxkgRlUquee8uoV7nKYKeyBkoAc0l7m/+wUF+CnfBT AO9poe4/KAU0CY8AMRlTBVltFpLFiH9lZZgyuADg= Received: from DFLE113.ent.ti.com (dfle113.ent.ti.com [10.64.6.34]) by lelv0265.itg.ti.com (8.15.2/8.15.2) with ESMTPS id x3CGtBG7029304 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=FAIL); Fri, 12 Apr 2019 11:55:11 -0500 Received: from DFLE115.ent.ti.com (10.64.6.36) by DFLE113.ent.ti.com (10.64.6.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5; Fri, 12 Apr 2019 11:54:53 -0500 Received: from fllv0040.itg.ti.com (10.64.41.20) by DFLE115.ent.ti.com (10.64.6.36) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1713.5 via Frontend Transport; Fri, 12 Apr 2019 11:54:53 -0500 Received: from legion.dal.desgin.ti.com (legion.dal.design.ti.com [128.247.22.53]) by fllv0040.itg.ti.com (8.15.2/8.15.2) with ESMTP id x3CGsrj5036081; Fri, 12 Apr 2019 11:54:53 -0500 Received: from localhost ([10.250.67.168]) by legion.dal.desgin.ti.com (8.11.7p1+Sun/8.11.7) with ESMTP id x3CGsqU28871; Fri, 12 Apr 2019 11:54:52 -0500 (CDT) From: "Andrew F. Davis" To: Tom Rini , Lokesh Vutla , Andreas Dannenberg Date: Fri, 12 Apr 2019 12:54:46 -0400 Message-ID: <20190412165448.1788-6-afd@ti.com> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190412165448.1788-1-afd@ti.com> References: <20190412165448.1788-1-afd@ti.com> MIME-Version: 1.0 X-EXCLAIMER-MD-CONFIG: e1e8a2fd-e40a-4ac6-ac9b-f7e9cc9ee180 Cc: u-boot@lists.denx.de Subject: [U-Boot] [PATCH v3 5/7] arm: mach-k3: Add secure device build support X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.18 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" K3 HS devices require signed binaries for boot, use the SECDEV tools to sign the boot artifacts during build. Signed-off-by: Andrew F. Davis Reviewed-by: Tom Rini Reviewed-by: Andreas Dannenberg --- MAINTAINERS | 1 + arch/arm/mach-k3/config.mk | 25 ++++++++++++++++++ arch/arm/mach-k3/config_secure.mk | 44 +++++++++++++++++++++++++++++++ tools/k3_fit_atf.sh | 8 ++++-- 4 files changed, 76 insertions(+), 2 deletions(-) create mode 100644 arch/arm/mach-k3/config_secure.mk diff --git a/MAINTAINERS b/MAINTAINERS index de1ea20930..69a6789c04 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -722,6 +722,7 @@ F: arch/arm/mach-omap2/omap5/sec_entry_cpu1.S F: arch/arm/mach-omap2/sec-common.c F: arch/arm/mach-omap2/config_secure.mk F: arch/arm/mach-k3/security.c +F: arch/arm/mach-k3/config_secure.mk F: configs/am335x_hs_evm_defconfig F: configs/am335x_hs_evm_uart_defconfig F: configs/am43xx_hs_evm_defconfig diff --git a/arch/arm/mach-k3/config.mk b/arch/arm/mach-k3/config.mk index be00d79fb0..2d8f61f9db 100644 --- a/arch/arm/mach-k3/config.mk +++ b/arch/arm/mach-k3/config.mk @@ -36,6 +36,14 @@ cmd_gencert = cat $(srctree)/tools/k3_x509template.txt | sed $(SED_OPTS) > u-boo # If external key is not provided, generate key using openssl. ifeq ($(CONFIG_SYS_K3_KEY), "") KEY=u-boot-spl-eckey.pem +# On HS use real key or warn if not available +ifeq ($(CONFIG_TI_SECURE_DEVICE),y) +ifneq ($(wildcard $(TI_SECURE_DEV_PKG)/keys/custMpk.pem),) +KEY=$(TI_SECURE_DEV_PKG)/keys/custMpk.pem +else +$(warning "WARNING: signing key not found. Random key will NOT work on HS hardware!") +endif +endif else KEY=$(patsubst "%",$(srctree)/%,$(CONFIG_SYS_K3_KEY)) endif @@ -65,6 +73,15 @@ ALL-y += tiboot3.bin endif ifdef CONFIG_ARM64 +ifeq ($(CONFIG_TI_SECURE_DEVICE),y) +SPL_ITS := u-boot-spl-k3_HS.its +$(SPL_ITS): FORCE + IS_HS=1 \ + $(srctree)/tools/k3_fit_atf.sh \ + $(patsubst %,$(obj)/dts/%.dtb,$(subst ",,$(CONFIG_SPL_OF_LIST))) > $@ + +ALL-y += tispl.bin_HS +else SPL_ITS := u-boot-spl-k3.its $(SPL_ITS): FORCE $(srctree)/tools/k3_fit_atf.sh \ @@ -72,7 +89,15 @@ $(SPL_ITS): FORCE ALL-y += tispl.bin endif +endif + +else +ifeq ($(CONFIG_TI_SECURE_DEVICE),y) +ALL-y += u-boot.img_HS else ALL-y += u-boot.img endif +endif + +include $(srctree)/arch/arm/mach-k3/config_secure.mk diff --git a/arch/arm/mach-k3/config_secure.mk b/arch/arm/mach-k3/config_secure.mk new file mode 100644 index 0000000000..6d63c57665 --- /dev/null +++ b/arch/arm/mach-k3/config_secure.mk @@ -0,0 +1,44 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Copyright (C) 2018 Texas Instruments, Incorporated - http://www.ti.com/ +# Andrew F. Davis + +quiet_cmd_k3secureimg = SECURE $@ +ifneq ($(TI_SECURE_DEV_PKG),) +ifneq ($(wildcard $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh),) +cmd_k3secureimg = $(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh \ + $< $@ \ + $(if $(KBUILD_VERBOSE:1=), >/dev/null) +else +cmd_k3secureimg = echo "WARNING:" \ + "$(TI_SECURE_DEV_PKG)/scripts/secure-binary-image.sh not found." \ + "$@ was NOT secured!"; cp $< $@ +endif +else +cmd_k3secureimg = echo "WARNING: TI_SECURE_DEV_PKG environment" \ + "variable must be defined for TI secure devices." \ + "$@ was NOT secured!"; cp $< $@ +endif + +%.dtb_HS: %.dtb FORCE + $(call if_changed,k3secureimg) + +$(obj)/u-boot-spl-nodtb.bin_HS: $(obj)/u-boot-spl-nodtb.bin FORCE + $(call if_changed,k3secureimg) + +tispl.bin_HS: $(obj)/u-boot-spl-nodtb.bin_HS $(patsubst %,$(obj)/dts/%.dtb_HS,$(subst ",,$(CONFIG_SPL_OF_LIST))) $(SPL_ITS) FORCE + $(call if_changed,mkfitimage) + +MKIMAGEFLAGS_u-boot.img_HS = -f auto -A $(ARCH) -T firmware -C none -O u-boot \ + -a $(CONFIG_SYS_TEXT_BASE) -e $(CONFIG_SYS_UBOOT_START) \ + -n "U-Boot $(UBOOTRELEASE) for $(BOARD) board" -E \ + $(patsubst %,-b arch/$(ARCH)/dts/%.dtb_HS,$(subst ",,$(CONFIG_OF_LIST))) + +OF_LIST_TARGETS = $(patsubst %,arch/$(ARCH)/dts/%.dtb,$(subst ",,$(CONFIG_OF_LIST))) +$(OF_LIST_TARGETS): dtbs + +u-boot-nodtb.bin_HS: u-boot-nodtb.bin FORCE + $(call if_changed,k3secureimg) + +u-boot.img_HS: u-boot-nodtb.bin_HS u-boot.img $(patsubst %.dtb,%.dtb_HS,$(OF_LIST_TARGETS)) FORCE + $(call if_changed,mkimage) diff --git a/tools/k3_fit_atf.sh b/tools/k3_fit_atf.sh index 430b5ca616..4e9f69c087 100755 --- a/tools/k3_fit_atf.sh +++ b/tools/k3_fit_atf.sh @@ -21,6 +21,10 @@ if [ ! -f $TEE ]; then TEE=/dev/null fi +if [ ! -z "$IS_HS" ]; then + HS_APPEND=_HS +fi + cat << __HEADER_EOF /dts-v1/; @@ -51,7 +55,7 @@ cat << __HEADER_EOF }; spl { description = "SPL (64-bit)"; - data = /incbin/("spl/u-boot-spl-nodtb.bin"); + data = /incbin/("spl/u-boot-spl-nodtb.bin$HS_APPEND"); type = "standalone"; os = "U-Boot"; arch = "arm64"; @@ -66,7 +70,7 @@ do cat << __FDT_IMAGE_EOF $(basename $dtname) { description = "$(basename $dtname .dtb)"; - data = /incbin/("$dtname"); + data = /incbin/("$dtname$HS_APPEND"); type = "flat_dt"; arch = "arm"; compression = "none";