diff mbox

[U-Boot,4/4] powerpc/p1010rdb: add p1010rdb-pb support with updating p1010rdb-pa

Message ID 1379054763-7406-4-git-send-email-Shengzhou.Liu@freescale.com
State Accepted
Delegated to: York Sun
Headers show

Commit Message

Shengzhou Liu Sept. 13, 2013, 6:46 a.m. UTC 
- Rename old P1010RDB board as P1010RDB-PA.
- Add support for new P1010RDB-PB board.
- Some optimization.

For more details, see board/freescale/p1010rdb/README.

Signed-off-by: Shengzhou Liu <Shengzhou.Liu@freescale.com>
---
 board/freescale/p1010rdb/p1010rdb.c | 176 ++++++++++++++++++++++++++++++++++--
 boards.cfg                          |  40 +++++---
 include/configs/P1010RDB.h          | 101 ++++++++++++++++++---
 3 files changed, 283 insertions(+), 34 deletions(-)

Comments

bin4ry Sept. 13, 2013, 2:57 p.m. UTC | #1 
Hi everyone,

I want to implement a minimal secure boot architecture into u-boot by
letting the u-boot.img be decrypted during SPL execution. Thus, the
u-boot.img is present on the MMC in an encrypted version. I already
implemented a basic AES-128 en-/decryption algorithm into the SPL.

Everything will be implement on a PandaBoard (OMAP4460). Now my
questions are:

1.) What would be the general architecture? u-boot.img is loaded into
external memory (DRAM)at address 0x80100000. To decrypt it, the whole
file needs to be processed by SPL, which will not be able to load the
data since the SPL can not exceed a certain size (~49 kByte I guess).

    -> Thus, would it be somehow possible to implement the algorithm in
the SPL but let the u-boot.img data be stored in DRAM for processing?

2.) Furthermore, where could be a good place to put the actual algorithm
in? I figured that in my situation the function call flow is something
like this:

... > omap_boot_device() > boot_device() > spl_mmc_load_image() >
mmc_load_image_fat > file_fat_read() > do_fat_read()
>_jump_to_image_noargs() where u-boot.img is eventually called using the
image_entry() function.


Thanks a lot,
-b
Michael Nazzareno Trimarchi Sept. 13, 2013, 5:28 p.m. UTC | #2 
Hi

On Fri, Sep 13, 2013 at 4:57 PM, bin4ry <0xbin4ry@gmail.com> wrote:
> Hi everyone,
>
> I want to implement a minimal secure boot architecture into u-boot by
> letting the u-boot.img be decrypted during SPL execution. Thus, the
> u-boot.img is present on the MMC in an encrypted version. I already
> implemented a basic AES-128 en-/decryption algorithm into the SPL.
>
> Everything will be implement on a PandaBoard (OMAP4460). Now my
> questions are:
>
> 1.) What would be the general architecture? u-boot.img is loaded into
> external memory (DRAM)at address 0x80100000. To decrypt it, the whole
> file needs to be processed by SPL, which will not be able to load the
> data since the SPL can not exceed a certain size (~49 kByte I guess).
>
>     -> Thus, would it be somehow possible to implement the algorithm in
> the SPL but let the u-boot.img data be stored in DRAM for processing?
>
> 2.) Furthermore, where could be a good place to put the actual algorithm
> in? I figured that in my situation the function call flow is something
> like this:
>
> ... > omap_boot_device() > boot_device() > spl_mmc_load_image() >
> mmc_load_image_fat > file_fat_read() > do_fat_read()

... > omap_boot_device() > boot_device() > spl_mmc_load_image()
>file_fat_read() > do_fat_read()

I don't understand you can decrypt it after load. Why just verify the signature?

Michael


>>_jump_to_image_noargs() where u-boot.img is eventually called using the
> image_entry() function.
>
>
> Thanks a lot,
> -b
>
>
> _______________________________________________
> U-Boot mailing list
> U-Boot@lists.denx.de
> http://lists.denx.de/mailman/listinfo/u-boot
Albert ARIBAUD Sept. 15, 2013, 6:08 a.m. UTC | #3 
Hi bin4ry,

On Fri, 13 Sep 2013 16:57:20 +0200, bin4ry <0xbin4ry@gmail.com> wrote:

> Hi everyone,
> 
> I want to implement a minimal secure boot architecture into u-boot by
> letting the u-boot.img be decrypted during SPL execution. Thus, the
> u-boot.img is present on the MMC in an encrypted version. I already
> implemented a basic AES-128 en-/decryption algorithm into the SPL.

What's the point of encrypting the whole binary? Secure boot usually
uses authentication, not encryption, of the payload that is to be
secured: instead of decrypting several hundreds of KBs, you hash them
(which is faster) and decrypt only the few hundreds bits of the
encrypted hash in order to compare both hashes (but trust chain remains
the same of course).

Note: if you chose payload encryption over authentication (hash
encryption) because you are worried about collision, preimage or even
second preimage resistance, then you should just go with use a stronger
hash function. Besides, for a small and compact payload such as a
bootloader, the risks of collisions are reduced because there is less
room in the input space.

Amicalement,
bin4ry Sept. 30, 2013, 7:28 a.m. UTC | #4 
Am 13.09.2013 19:28, schrieb Michael Trimarchi:
> Hi
> I don't understand you can decrypt it after load. Why just verify the signature?
>
> Michael
>

This is a proof-of-concept for a technique, which involves
de-/encrypting the u-boot.img with a key derived from a hardware
fingerprint. This is why I can not just verify the signature.

Yes, I want to decrypt it after load. However, I am not sure about the
correct position in the SPL source code to this, i.e. the position after
loading the u-boot.img and before executing it. I assume after
do_fat_read() the u-boot.img is loaded into internal memory and
jump_to_image_no_args() executes the u-boot.img. Thus, the decryption
routine should be implemented between both functions?
bin4ry Sept. 30, 2013, 7:51 a.m. UTC | #5 
Hi Albert,

so if I get you right the workflow for payload authentication is the
following:

Encryption process:

1. Create hash value H for u-boot.img
2. Encrypt the hash value H with secret K to get encrypted hash values H_enc
3. Store H_enc

Decryption process:

1. Read H_enc
2. Decrypt H_enc using secret K to get plain hash values H
3. Create Hash values H' of u-boot.img
4. Compare H and H'

Did I get you right?

Thanks and best regards,
-b

Am 15.09.2013 08:08, schrieb Albert ARIBAUD:
> What's the point of encrypting the whole binary? Secure boot usually
> uses authentication, not encryption, of the payload that is to be
> secured: instead of decrypting several hundreds of KBs, you hash them
> (which is faster) and decrypt only the few hundreds bits of the
> encrypted hash in order to compare both hashes (but trust chain remains
> the same of course).
>
> Note: if you chose payload encryption over authentication (hash
> encryption) because you are worried about collision, preimage or even
> second preimage resistance, then you should just go with use a stronger
> hash function. Besides, for a small and compact payload such as a
> bootloader, the risks of collisions are reduced because there is less
> room in the input space.
>
> Amicalement,
Albert ARIBAUD Oct. 5, 2013, 10:03 a.m. UTC | #6 
Hi bin4ry,

Sorry for the delay in answering.

On Mon, 30 Sep 2013 09:51:54 +0200, bin4ry <0xbin4ry@gmail.com> wrote:

> Hi Albert,
> 
> so if I get you right the workflow for payload authentication is the
> following:
> 
> Encryption process:

(you really should not talk about "encryption process" if your goal is
authentication rather than encryption. The correct term would be
somehting like "signature process" and "signature verification process")
 
> 1. Create hash value H for u-boot.img
> 2. Encrypt the hash value H with secret K to get encrypted hash values H_enc
> 3. Store H_enc
>
> Decryption process:
> 
> 1. Read H_enc
> 2. Decrypt H_enc using secret K to get plain hash values H
> 3. Create Hash values H' of u-boot.img
> 4. Compare H and H'
> 
> Did I get you right?

Almost, but not quite.

The most important problem is that you seem to assume use of symmetric
encryption , since your 'K' seems to be both the encryption and
decryption key. That is not good, because K is needed on the target for
the verification phase, and thus, could then be used by an attacker to
encrypt the hash of a malicious payload that would then pass
verification. You need asymetric encryption, with a pair of public and
private keys. The private key is used in the signing process, for
encrypting the hash. The public key is on the device and is used in the
verification process, for decrypting the encrypted hash.

But then, of course, you can't simply have the public key in Flash,
because the attacker could generate a new pair of keys, then sign the
malicious payload hash with the new private key and flash the new
public key. Therefore, you need a way to secure the public key. One way
is to have it in ROM, but this could be against silicon or manufacter
budget. Fuses are usually not big enough, but you could fuse a hash of
the key.

Note that, in any case, authentication only makes senses if you can
trust the piece of software on the arget that will check the key and
verify the payload hash... Which means you need some secure mode on the
device to boot (pun intended). And that mode will probably already
include a way of signing the payloads.

> Thanks and best regards,

You're welcome.

> -b

Amicalement,
diff mbox

Patch

diff --git a/board/freescale/p1010rdb/p1010rdb.c b/board/freescale/p1010rdb/p1010rdb.c
index ae8ba45..e940d22 100644
--- a/board/freescale/p1010rdb/p1010rdb.c
+++ b/board/freescale/p1010rdb/p1010rdb.c
@@ -38,12 +38,23 @@  DECLARE_GLOBAL_DATA_PTR;
 enum {
 	MUX_TYPE_IFC,
 	MUX_TYPE_SDHC,
+	MUX_TYPE_SPIFLASH,
+	MUX_TYPE_TDM,
+	MUX_TYPE_CAN,
+	MUX_TYPE_CS0_NOR,
+	MUX_TYPE_CS0_NAND,
+};
+
+enum {
+	I2C_READ_BANK,
+	I2C_READ_PCB_VER,
 };
 
 static uint sd_ifc_mux;
 
 struct cpld_data {
 	u8 cpld_ver; /* cpld revision */
+#if defined(CONFIG_P1010RDB_PA)
 	u8 pcba_ver; /* pcb revision number */
 	u8 twindie_ddr3;
 	u8 res1[6];
@@ -58,6 +69,9 @@  struct cpld_data {
 	u8 por1; /* POR Options */
 	u8 por2; /* POR Options */
 	u8 por3; /* POR Options */
+#elif defined(CONFIG_P1010RDB_PB)
+	u8 rom_loc;
+#endif
 };
 
 int board_early_init_f(void)
@@ -116,6 +130,9 @@  int config_board_mux(int ctrl_type)
 	ccsr_gur_t __iomem *gur = (void *)(CONFIG_SYS_MPC85xx_GUTS_ADDR);
 	u8 tmp;
 
+#if defined(CONFIG_P1010RDB_PA)
+	struct cpld_data *cpld_data = (void *)(CONFIG_SYS_CPLD_BASE);
+
 	switch (ctrl_type) {
 	case MUX_TYPE_IFC:
 		i2c_set_bus_num(I2C_PCA9557_BUS_NUM);
@@ -136,25 +153,171 @@  int config_board_mux(int ctrl_type)
 		clrsetbits_be32(&gur->pmuxcr, PMUXCR1_SDHC_MASK,
 				PMUXCR1_SDHC_ENABLE);
 		break;
+	case MUX_TYPE_SPIFLASH:
+		out_8(&cpld_data->spi_cs0_sel, MUX_CPLD_SPICS0_FLASH);
+		break;
+	case MUX_TYPE_TDM:
+		out_8(&cpld_data->tdm_can_sel, MUX_CPLD_TDM);
+		out_8(&cpld_data->spi_cs0_sel, MUX_CPLD_SPICS0_SLIC);
+		break;
+	case MUX_TYPE_CAN:
+		out_8(&cpld_data->tdm_can_sel, MUX_CPLD_CAN_UART);
+		break;
 	default:
 		break;
 	}
+#elif defined(CONFIG_P1010RDB_PB)
+	uint orig_bus = i2c_get_bus_num();
+	i2c_set_bus_num(I2C_PCA9557_BUS_NUM);
 
+	switch (ctrl_type) {
+	case MUX_TYPE_IFC:
+		i2c_read(I2C_PCA9557_ADDR2, 0, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x04);
+		i2c_write(I2C_PCA9557_ADDR2, 1, 1, &tmp, 1);
+		i2c_read(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x04);
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		sd_ifc_mux = MUX_TYPE_IFC;
+		clrbits_be32(&gur->pmuxcr, PMUXCR1_IFC_MASK);
+		break;
+	case MUX_TYPE_SDHC:
+		i2c_read(I2C_PCA9557_ADDR2, 0, 1, &tmp, 1);
+		setbits_8(&tmp, 0x04);
+		i2c_write(I2C_PCA9557_ADDR2, 1, 1, &tmp, 1);
+		i2c_read(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x04);
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		sd_ifc_mux = MUX_TYPE_SDHC;
+		clrsetbits_be32(&gur->pmuxcr, PMUXCR1_SDHC_MASK,
+				PMUXCR1_SDHC_ENABLE);
+		break;
+	case MUX_TYPE_SPIFLASH:
+		i2c_read(I2C_PCA9557_ADDR2, 0, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x80);
+		i2c_write(I2C_PCA9557_ADDR2, 1, 1, &tmp, 1);
+		i2c_read(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x80);
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		break;
+	case MUX_TYPE_TDM:
+		i2c_read(I2C_PCA9557_ADDR2, 0, 1, &tmp, 1);
+		setbits_8(&tmp, 0x82);
+		i2c_write(I2C_PCA9557_ADDR2, 1, 1, &tmp, 1);
+		i2c_read(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x82);
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		break;
+	case MUX_TYPE_CAN:
+		i2c_read(I2C_PCA9557_ADDR2, 0, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x02);
+		i2c_write(I2C_PCA9557_ADDR2, 1, 1, &tmp, 1);
+		i2c_read(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x02);
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		break;
+	case MUX_TYPE_CS0_NOR:
+		i2c_read(I2C_PCA9557_ADDR2, 0, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x08);
+		i2c_write(I2C_PCA9557_ADDR2, 1, 1, &tmp, 1);
+		i2c_read(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x08);
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		break;
+	case MUX_TYPE_CS0_NAND:
+		i2c_read(I2C_PCA9557_ADDR2, 0, 1, &tmp, 1);
+		setbits_8(&tmp, 0x08);
+		i2c_write(I2C_PCA9557_ADDR2, 1, 1, &tmp, 1);
+		i2c_read(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		clrbits_8(&tmp, 0x08);
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &tmp, 1);
+		break;
+	default:
+		break;
+	}
+	i2c_set_bus_num(orig_bus);
+#endif
 	return 0;
 }
 
+#ifdef CONFIG_P1010RDB_PB
+int i2c_pca9557_read(int type)
+{
+	u8 val;
+
+	i2c_set_bus_num(I2C_PCA9557_BUS_NUM);
+	i2c_read(I2C_PCA9557_ADDR2, 0, 1, &val, 1);
+
+	switch (type) {
+	case I2C_READ_BANK:
+		val = (val & 0x10) >> 4;
+		break;
+	case I2C_READ_PCB_VER:
+		val = ((val & 0x60) >> 5) + 1;
+		break;
+	default:
+		break;
+	}
+
+	return val;
+}
+#endif
+
 int checkboard(void)
 {
 	struct cpu_type *cpu;
+	struct cpld_data *cpld_data = (void *)(CONFIG_SYS_CPLD_BASE);
+	u8 val;
 
 	cpu = gd->arch.cpu;
-	printf("Board: %sRDB\n", cpu->name);
+#if defined(CONFIG_P1010RDB_PA)
+	printf("Board: %sRDB-PA, ", cpu->name);
+#elif defined(CONFIG_P1010RDB_PB)
+	printf("Board: %sRDB-PB, ", cpu->name);
+	i2c_set_bus_num(I2C_PCA9557_BUS_NUM);
+	i2c_init(CONFIG_SYS_FSL_I2C_SPEED, CONFIG_SYS_FSL_I2C_SLAVE);
+	val = 0x0;  /* no polarity inversion */
+	i2c_write(I2C_PCA9557_ADDR2, 2, 1, &val, 1);
+#endif
 
 #ifdef CONFIG_SDCARD
 	/* switch to IFC to read info from CPLD */
 	config_board_mux(MUX_TYPE_IFC);
 #endif
 
+#if defined(CONFIG_P1010RDB_PA)
+	val = (in_8(&cpld_data->pcba_ver) & 0xf);
+	printf("PCB: v%x.0\n", val);
+#elif defined(CONFIG_P1010RDB_PB)
+	val = in_8(&cpld_data->cpld_ver);
+	printf("CPLD: v%x.%x, ", val >> 4, val & 0xf);
+	printf("PCB: v%x.0, ", i2c_pca9557_read(I2C_READ_PCB_VER));
+	val = in_8(&cpld_data->rom_loc) & 0xf;
+	puts("Boot from: ");
+	switch (val) {
+	case 0xf:
+		config_board_mux(MUX_TYPE_CS0_NOR);
+		printf("NOR vBank%d\n", i2c_pca9557_read(I2C_READ_BANK));
+		break;
+	case 0xe:
+		puts("SDHC\n");
+		val = 0x60; /* set pca9557 pin input/output */
+		i2c_write(I2C_PCA9557_ADDR2, 3, 1, &val, 1);
+		break;
+	case 0x5:
+		config_board_mux(MUX_TYPE_IFC);
+		config_board_mux(MUX_TYPE_CS0_NAND);
+		puts("NAND\n");
+		break;
+	case 0x6:
+		config_board_mux(MUX_TYPE_IFC);
+		puts("SPI\n");
+		break;
+	default:
+		puts("unknown\n");
+		break;
+	}
+#endif
 	return 0;
 }
 
@@ -348,7 +511,6 @@  void board_reset(void)
 
 int misc_init_r(void)
 {
-	struct cpld_data *cpld_data = (void *)(CONFIG_SYS_CPLD_BASE);
 	ccsr_gur_t *gur = (void *)(CONFIG_SYS_MPC85xx_GUTS_ADDR);
 
 	if (hwconfig_subarg_cmp("fsl_p1010mux", "tdm_can", "can")) {
@@ -356,7 +518,7 @@  int misc_init_r(void)
 				MPC85xx_PMUXCR_CAN1_UART |
 				MPC85xx_PMUXCR_CAN2_TDM |
 				MPC85xx_PMUXCR_CAN2_UART);
-		out_8(&cpld_data->tdm_can_sel, MUX_CPLD_CAN_UART);
+		config_board_mux(MUX_TYPE_CAN);
 	} else if (hwconfig_subarg_cmp("fsl_p1010mux", "tdm_can", "tdm")) {
 		clrbits_be32(&gur->pmuxcr, MPC85xx_PMUXCR_CAN2_UART |
 				MPC85xx_PMUXCR_CAN1_UART);
@@ -364,11 +526,10 @@  int misc_init_r(void)
 				MPC85xx_PMUXCR_CAN1_TDM);
 		clrbits_be32(&gur->pmuxcr2, MPC85xx_PMUXCR2_UART_GPIO);
 		setbits_be32(&gur->pmuxcr2, MPC85xx_PMUXCR2_UART_TDM);
-		out_8(&cpld_data->tdm_can_sel, MUX_CPLD_TDM);
-		out_8(&cpld_data->spi_cs0_sel, MUX_CPLD_SPICS0_SLIC);
+		config_board_mux(MUX_TYPE_TDM);
 	} else {
 		/* defaultly spi_cs_sel to flash */
-		out_8(&cpld_data->spi_cs0_sel, MUX_CPLD_SPICS0_FLASH);
+		config_board_mux(MUX_TYPE_SPIFLASH);
 	}
 
 	if (hwconfig("esdhc"))
@@ -376,6 +537,9 @@  int misc_init_r(void)
 	else if (hwconfig("ifc"))
 		config_board_mux(MUX_TYPE_IFC);
 
+#ifdef CONFIG_P1010RDB_PB
+	setbits_be32(&gur->pmuxcr2, MPC85xx_PMUXCR2_GPIO01_DRVVBUS);
+#endif
 	return 0;
 }
 
diff --git a/boards.cfg b/boards.cfg
index 48aa0bf..e3457d8 100644
--- a/boards.cfg
+++ b/boards.cfg
@@ -787,20 +787,32 @@  MPC8572DS_36BIT              powerpc     mpc85xx     mpc8572ds           freesca
 MPC8572DS_NAND               powerpc     mpc85xx     mpc8572ds           freescale      -           MPC8572DS:NAND
 C29XPCIE                     powerpc     mpc85xx     c29xpcie            freescale      -           C29XPCIE:C29XPCIE,36BIT
 C29XPCIE_SPIFLASH            powerpc     mpc85xx     c29xpcie            freescale      -           C29XPCIE:C29XPCIE,36BIT,SPIFLASH
-P1010RDB_36BIT_NAND          powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,36BIT,NAND
-P1010RDB_36BIT_NAND_SECBOOT  powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,36BIT,NAND_SECBOOT,SECURE_BOOT
-P1010RDB_36BIT_NOR           powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,36BIT
-P1010RDB_36BIT_NOR_SECBOOT   powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,36BIT,SECURE_BOOT
-P1010RDB_36BIT_SDCARD        powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,36BIT,SDCARD
-P1010RDB_36BIT_SPIFLASH      powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,36BIT,SPIFLASH
-P1010RDB_36BIT_SPIFLASH_SECBOOT      powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,36BIT,SPIFLASH,SECURE_BOOT
-P1010RDB_NAND                powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,NAND
-P1010RDB_NAND_SECBOOT        powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,NAND_SECBOOT,SECURE_BOOT
-P1010RDB_NOR                 powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB
-P1010RDB_NOR_SECBOOT         powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,SECURE_BOOT
-P1010RDB_SDCARD              powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,SDCARD
-P1010RDB_SPIFLASH            powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,SPIFLASH
-P1010RDB_SPIFLASH_SECBOOT    powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB,SPIFLASH,SECURE_BOOT
+P1010RDB-PA_36BIT_NAND       powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,36BIT,NAND
+P1010RDB-PA_36BIT_NAND_SECBOOT powerpc   mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,36BIT,NAND_SECBOOT,SECURE_BOOT
+P1010RDB-PA_36BIT_NOR        powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,36BIT
+P1010RDB-PA_36BIT_NOR_SECBOOT powerpc    mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,36BIT,SECURE_BOOT
+P1010RDB-PA_36BIT_SDCARD     powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,36BIT,SDCARD
+P1010RDB-PA_36BIT_SPIFLASH   powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,36BIT,SPIFLASH
+P1010RDB-PA_36BIT_SPIFLASH_SECBOOT powerpc mpc85xx   p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,36BIT,SPIFLASH,SECURE_BOOT
+P1010RDB-PA_NAND             powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,NAND
+P1010RDB-PA_NOR              powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA
+P1010RDB-PA_SDCARD           powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,SDCARD
+P1010RDB-PA_SPIFLASH         powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,SPIFLASH
+P1010RDB-PA_SPIFLASH_SECBOOT powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PA,SPIFLASH,SECURE_BOOT
+P1010RDB-PB_NOR              powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB
+P1010RDB-PB_NAND             powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,NAND
+P1010RDB-PB_SDCARD           powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,SDCARD
+P1010RDB-PB_SPIFLASH         powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,SPIFLASH
+P1010RDB-PB_NOR_SECBOOT      powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,SECURE_BOOT
+P1010RDB-PB_NAND_SECBOOT     powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,NAND_SECBOOT,SECURE_BOOT
+P1010RDB-PB_SPIFLASH_SECBOOT powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,SPIFLASH,SECURE_BOOT
+P1010RDB-PB_36BIT_NOR        powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,36BIT
+P1010RDB-PB_36BIT_NOR_SECBOOT powerpc    mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,36BIT,SECURE_BOOT
+P1010RDB-PB_36BIT_NAND       powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,36BIT,NAND
+P1010RDB-PB_36BIT_NAND_SECBOOT powerpc   mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,36BIT,NAND_SECBOOT,SECURE_BOOT
+P1010RDB-PB_36BIT_SDCARD     powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,36BIT,SDCARD
+P1010RDB-PB_36BIT_SPIFLASH   powerpc     mpc85xx     p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,36BIT,SPIFLASH
+P1010RDB-PB_36BIT_SPIFLASH_SECBOOT powerpc mpc85xx   p1010rdb            freescale      -           P1010RDB:P1010RDB_PB,36BIT,SPIFLASH,SECURE_BOOT
 P1011RDB                     powerpc     mpc85xx     p1_p2_rdb           freescale      -           P1_P2_RDB:P1011RDB
 P1011RDB_36BIT               powerpc     mpc85xx     p1_p2_rdb           freescale      -           P1_P2_RDB:P1011RDB,36BIT
 P1011RDB_36BIT_SDCARD        powerpc     mpc85xx     p1_p2_rdb           freescale      -           P1_P2_RDB:P1011RDB,36BIT,SDCARD
diff --git a/include/configs/P1010RDB.h b/include/configs/P1010RDB.h
index 4dfcc51..f866794 100644
--- a/include/configs/P1010RDB.h
+++ b/include/configs/P1010RDB.h
@@ -120,7 +120,11 @@ 
 #endif
 
 /* controller 2, Slot 2, tgtid 2, Base address 9000 */
+#if defined(CONFIG_P1010RDB_PA)
 #define CONFIG_SYS_PCIE2_NAME		"PCIe Slot"
+#elif defined(CONFIG_P1010RDB_PB)
+#define CONFIG_SYS_PCIE2_NAME		"mini PCIe Slot"
+#endif
 #define CONFIG_SYS_PCIE2_MEM_VIRT	0xa0000000
 #ifdef CONFIG_PHYS_64BIT
 #define CONFIG_SYS_PCIE2_MEM_BUS	0xc0000000
@@ -200,25 +204,24 @@  extern unsigned long get_sdram_size(void);
 #define CONFIG_SYS_DDR_INIT_ADDR	0x00000000
 #define CONFIG_SYS_DDR_INIT_EXT_ADDR	0x00000000
 #define CONFIG_SYS_DDR_MODE_CONTROL	0x00000000
-
 #define CONFIG_SYS_DDR_ZQ_CONTROL	0x89080600
 #define CONFIG_SYS_DDR_SR_CNTR		0x00000000
 #define CONFIG_SYS_DDR_RCW_1		0x00000000
 #define CONFIG_SYS_DDR_RCW_2		0x00000000
-#define CONFIG_SYS_DDR_CONTROL		0x470C0000	/* Type = DDR3  */
-#define CONFIG_SYS_DDR_CONTROL_2	0x04401010
+#define CONFIG_SYS_DDR_CONTROL		0xc70c0008      /* Type = DDR3  */
+#define CONFIG_SYS_DDR_CONTROL_2	0x24401000
 #define CONFIG_SYS_DDR_TIMING_4		0x00000001
 #define CONFIG_SYS_DDR_TIMING_5		0x03402400
 
-#define CONFIG_SYS_DDR_TIMING_3_800	0x00020000
-#define CONFIG_SYS_DDR_TIMING_0_800	0x00330004
-#define CONFIG_SYS_DDR_TIMING_1_800	0x6f6B4644
+#define CONFIG_SYS_DDR_TIMING_3_800	0x00030000
+#define CONFIG_SYS_DDR_TIMING_0_800	0x00110104
+#define CONFIG_SYS_DDR_TIMING_1_800	0x6f6b8644
 #define CONFIG_SYS_DDR_TIMING_2_800	0x0FA888CF
 #define CONFIG_SYS_DDR_CLK_CTRL_800	0x03000000
-#define CONFIG_SYS_DDR_MODE_1_800	0x40461520
-#define CONFIG_SYS_DDR_MODE_2_800	0x8000c000
+#define CONFIG_SYS_DDR_MODE_1_800	0x00441420
+#define CONFIG_SYS_DDR_MODE_2_800	0x00000000
 #define CONFIG_SYS_DDR_INTERVAL_800	0x0C300100
-#define CONFIG_SYS_DDR_WRLVL_CONTROL_800	0x8655A608
+#define CONFIG_SYS_DDR_WRLVL_CONTROL_800 0x8675f608
 
 /* settings for DDR3 at 667MT/s */
 #define CONFIG_SYS_DDR_TIMING_3_667		0x00010000
@@ -315,6 +318,8 @@  extern unsigned long get_sdram_size(void);
 				| CSPR_MSEL_NAND	\
 				| CSPR_V)
 #define CONFIG_SYS_NAND_AMASK	IFC_AMASK(64*1024)
+
+#if defined(CONFIG_P1010RDB_PA)
 #define CONFIG_SYS_NAND_CSOR	(CSOR_NAND_ECC_ENC_EN	/* ECC on encode */ \
 				| CSOR_NAND_ECC_DEC_EN	/* ECC on decode */ \
 				| CSOR_NAND_ECC_MODE_4	/* 4-bit ECC */ \
@@ -322,13 +327,26 @@  extern unsigned long get_sdram_size(void);
 				| CSOR_NAND_PGS_512	/* Page Size = 512b */ \
 				| CSOR_NAND_SPRZ_16	/* Spare size = 16 */ \
 				| CSOR_NAND_PB(32))	/* 32 Pages Per Block */
+#define CONFIG_SYS_NAND_BLOCK_SIZE	(16 * 1024)
+
+#elif defined(CONFIG_P1010RDB_PB)
+#define CONFIG_SYS_NAND_ONFI_DETECTION
+#define CONFIG_SYS_NAND_CSOR   (CSOR_NAND_ECC_ENC_EN   /* ECC on encode */ \
+				| CSOR_NAND_ECC_DEC_EN  /* ECC on decode */ \
+				| CSOR_NAND_ECC_MODE_4  /* 4-bit ECC */ \
+				| CSOR_NAND_RAL_3       /* RAL = 3Byes */ \
+				| CSOR_NAND_PGS_4K      /* Page Size = 4K */ \
+				| CSOR_NAND_SPRZ_224    /* Spare size = 224 */ \
+				| CSOR_NAND_PB(128))  /*Pages Per Block = 128 */
+#define CONFIG_SYS_NAND_BLOCK_SIZE     (512 * 1024)
+#endif
 
 #define CONFIG_SYS_NAND_BASE_LIST	{ CONFIG_SYS_NAND_BASE }
 #define CONFIG_SYS_MAX_NAND_DEVICE	1
 #define CONFIG_MTD_NAND_VERIFY_WRITE
 #define CONFIG_CMD_NAND
-#define CONFIG_SYS_NAND_BLOCK_SIZE	(16 * 1024)
 
+#if defined(CONFIG_P1010RDB_PA)
 /* NAND Flash Timing Params */
 #define CONFIG_SYS_NAND_FTIM0		FTIM0_NAND_TCCST(0x01) | \
 					FTIM0_NAND_TWP(0x0C)   | \
@@ -343,6 +361,23 @@  extern unsigned long get_sdram_size(void);
 					FTIM2_NAND_TWHRE(0x0f)
 #define CONFIG_SYS_NAND_FTIM3		FTIM3_NAND_TWW(0x04)
 
+#elif defined(CONFIG_P1010RDB_PB)
+/* support MT29F16G08ABABAWP 4k-pagesize 2G-bytes NAND */
+/* ONFI NAND Flash mode0 Timing Params */
+#define CONFIG_SYS_NAND_FTIM0  (FTIM0_NAND_TCCST(0x07)| \
+					FTIM0_NAND_TWP(0x18)   | \
+					FTIM0_NAND_TWCHT(0x07) | \
+					FTIM0_NAND_TWH(0x0a))
+#define CONFIG_SYS_NAND_FTIM1  (FTIM1_NAND_TADLE(0x32)| \
+					FTIM1_NAND_TWBE(0x39)  | \
+					FTIM1_NAND_TRR(0x0e)   | \
+					FTIM1_NAND_TRP(0x18))
+#define CONFIG_SYS_NAND_FTIM2  (FTIM2_NAND_TRAD(0x0f) | \
+					FTIM2_NAND_TREH(0x0a)  | \
+					FTIM2_NAND_TWHRE(0x1e))
+#define CONFIG_SYS_NAND_FTIM3	0x0
+#endif
+
 #define CONFIG_SYS_NAND_DDR_LAW		11
 
 /* Set up IFC registers for boot location NOR/NAND */
@@ -475,10 +510,20 @@  extern unsigned long get_sdram_size(void);
 #define CONFIG_SYS_FSL_I2C2_SLAVE	0x7F
 #define CONFIG_SYS_FSL_I2C2_OFFSET	0x3100
 #define I2C_PCA9557_ADDR1		0x18
+#define I2C_PCA9557_ADDR2		0x19
 #define I2C_PCA9557_BUS_NUM		0
 
 /* I2C EEPROM */
-#undef CONFIG_ID_EEPROM
+#if defined(CONFIG_P1010RDB_PB)
+#define CONFIG_ID_EEPROM
+#ifdef CONFIG_ID_EEPROM
+#define CONFIG_SYS_I2C_EEPROM_NXID
+#endif
+#define CONFIG_SYS_I2C_EEPROM_ADDR_LEN	1
+#define CONFIG_SYS_I2C_EEPROM_ADDR	0x57
+#define CONFIG_SYS_EEPROM_BUS_NUM	0
+#define MAX_NUM_PORTS			9 /* for 128Bytes EEPROM */
+#endif
 /* enable read and write access to EEPROM */
 #define CONFIG_CMD_EEPROM
 #define CONFIG_SYS_I2C_MULTI_EEPROMS
@@ -602,9 +647,14 @@  extern unsigned long get_sdram_size(void);
 #define CONFIG_ENV_SIZE		0x2000
 #elif defined(CONFIG_NAND)
 #define CONFIG_ENV_IS_IN_NAND
+#if defined(CONFIG_P1010RDB_PA)
 #define CONFIG_ENV_SIZE		CONFIG_SYS_NAND_BLOCK_SIZE
+#define CONFIG_ENV_RANGE	(3 * CONFIG_ENV_SIZE) /* 3*16=48K for env */
+#elif defined(CONFIG_P1010RDB_PB)
+#define CONFIG_ENV_SIZE		(16 * 1024)
+#define CONFIG_ENV_RANGE	(32 * CONFIG_ENV_SIZE) /* new block size 512K */
+#endif
 #define CONFIG_ENV_OFFSET	((512 * 1024) + CONFIG_SYS_NAND_BLOCK_SIZE)
-#define CONFIG_ENV_RANGE	(3 * CONFIG_ENV_SIZE)
 #elif defined(CONFIG_SYS_RAMBOOT)
 #define CONFIG_ENV_IS_NOWHERE		/* Store ENV in memory only */
 #define CONFIG_ENV_ADDR			(CONFIG_SYS_MONITOR_BASE - 0x1000)
@@ -697,7 +747,6 @@  extern unsigned long get_sdram_size(void);
 #define CONFIG_HAS_ETH2
 #endif
 
-#define CONFIG_HOSTNAME		P1010RDB
 #define CONFIG_ROOTPATH		"/opt/nfsroot"
 #define CONFIG_BOOTFILE		"uImage"
 #define CONFIG_UBOOTPATH	u-boot.bin/* U-Boot image on TFTP server */
@@ -736,7 +785,31 @@  extern unsigned long get_sdram_size(void);
 	"ext2load usb 0:4 $loadaddr $bootfile;"		\
 	"ext2load usb 0:4 $fdtaddr $fdtfile;"	\
 	"ext2load usb 0:4 $ramdiskaddr $ramdiskfile;"	\
-	"bootm $loadaddr $ramdiskaddr $fdtaddr\0"		\
+	"bootm $loadaddr $ramdiskaddr $fdtaddr\0"	\
+	CONFIG_BOOTMODE
+
+#if defined(CONFIG_P1010RDB_PA)
+#define CONFIG_BOOTMODE \
+	"boot_bank0=i2c dev 0; i2c mw 18 1 f1; i2c mw 18 3 f0;" \
+	"mw.b ffb00011 0; mw.b ffb00009 0; reset\0" \
+	"boot_bank1=i2c dev 0; i2c mw 18 1 f1; i2c mw 18 3 f0;" \
+	"mw.b ffb00011 0; mw.b ffb00009 1; reset\0" \
+	"boot_nand=i2c dev 0; i2c mw 18 1 f9; i2c mw 18 3 f0;" \
+	"mw.b ffb00011 0; mw.b ffb00017 1; reset\0"
+
+#elif defined(CONFIG_P1010RDB_PB)
+#define CONFIG_BOOTMODE \
+	"boot_bank0=i2c dev 0; i2c mw 18 1 fe; i2c mw 18 3 0;" \
+	"i2c mw 19 1 2; i2c mw 19 3 e1; reset\0" \
+	"boot_bank1=i2c dev 0; i2c mw 18 1 fe; i2c mw 18 3 0;" \
+	"i2c mw 19 1 12; i2c mw 19 3 e1; reset\0" \
+	"boot_nand=i2c dev 0; i2c mw 18 1 fc; i2c mw 18 3 0;" \
+	"i2c mw 19 1 8; i2c mw 19 3 f7; reset\0" \
+	"boot_spi=i2c dev 0; i2c mw 18 1 fa; i2c mw 18 3 0;" \
+	"i2c mw 19 1 0; i2c mw 19 3 f7; reset\0" \
+	"boot_sd=i2c dev 0; i2c mw 18 1 f8; i2c mw 18 3 0;" \
+	"i2c mw 19 1 4; i2c mw 19 3 f3; reset\0"
+#endif
 
 #define CONFIG_RAMBOOTCOMMAND		\
 	"setenv bootargs root=/dev/ram rw "	\