12 Oct, 2019
1 commit
-
Add HABv4 encrypted boot documentation for i.MX8M, i.MX8MM and i.MX8MN
family devices covering the following topics:- How to encrypt and sign a flash.bin image.
- How to manage CAAM PRIBLOBs when using encrypted boot
- Add 4 CSF examples.Reviewed-by: Ye Li
Reviewed-by: Marius Grigoras
Signed-off-by: Breno Lima
(cherry picked from commit eee57255e0b0ea3a2808d3a2c19c8685afbac39b)
28 Aug, 2019
2 commits
-
The u-boot.bin file is not included in flash.bin binary, remove it
from mx8m_mx8mm_secure_boot.txt guide.Reviewed-by: Ye Li
Signed-off-by: Breno Lima -
Commit 28dd37699022("imx8: Clean up targets") in imx-mkimage project
renamed flash_linux target to flash_kernel.Update AHAB documentation to align with this change.
Reported-by: Frank Zhang
Reviewed-by: Ye Li
Signed-off-by: Breno Lima
16 Jul, 2019
1 commit
-
Writing/updating boot image in nand device is not
straight forward in i.MX6 platform and it requires
boot control block(BCB) to be configured.It becomes difficult to use uboot 'nand' command to
write BCB since it requires platform specific attributes
need to be taken care of.It is even difficult to use existing msx-nand.c driver by
incorporating BCB attributes like mxs_dma_desc does
because it requires change in mtd and nand command.So, cmd_nandbcb implemented in arch/arm/mach-imx
BCB contains two data structures, Firmware Configuration Block(FCB)
and Discovered Bad Block Table(DBBT). FCB has nand timings,
DBBT search area, page address of firmware.On summary, nandbcb update will
- erase the entire partition
- create BCB by creating 2 FCB/DBBT block followed by
1 FW block based on partition size and erasesize.
- fill FCB/DBBT structures
- write FW/SPL on FW1
- write FCB/DBBT in first 2 blocksfor nand boot, up on reset bootrom look for FCB structure in
first block's if FCB found the nand timings are loaded for
further reads. once FCB read done, DTTB will load and finally
firmware will be loaded which is boot image.Refer section "NAND Boot" from doc/imx/common/imx6.txt for more usage
information.Signed-off-by: Jagan Teki
Signed-off-by: Sergey Kubushyn
Signed-off-by: Shyam Saini
Signed-off-by: Han Xu
25 Jun, 2019
2 commits
-
Since we have changed imx-mkimage flash_spl_container target
to flash_spl, also update it in u-boot ahab document.Signed-off-by: Ye Li
Acked-by: Peng Fan
(cherry picked from commit f850d467db9cf3b9b58688b96f1b4d9d8632b07d) -
Commit ad7061ed742e ("doc: Move device tree bindings documentation to
doc/device-tree-bindings") moved all device tree binding documentation
to doc/device-tree-bindings directory.The current U-Boot project still have two documentation directories:
- doc/
- Documentation/Move all documentation and sphinx files to doc directory so all content
can be in a common place.Adapted to U-Boot v2019.04
Signed-off-by: Breno Lima
Acked-by: Ye Li
24 May, 2019
14 commits
-
Fix a typo in path provided for imx-mkimage iMX8QM and iMX8QXP directories.
Reported-by: Marius Grigoras
Signed-off-by: Breno Lima
Reviewed-by: Ye Li
(cherry picked from commit c75243c1a87a10f003377d9c144bcf412ba80440) -
The commands included in introduction guide should not be used as
reference for programming the SRK Hash fuses as they are in big
endian.Add a note to avoid a possible mistake.
Reported-by: Clement Le Marquis
Signed-off-by: Breno Lima
Reviewed-by: Ye Li
(cherry picked from commit 137319826cc32d98a9b6890f35dd6670e104c2a5) -
Since commit 771b824728ca ("MLK-20919 imx8: ahab: Add command to
close the chip") the U-Boot is able to move the lifecycle from
NXP closed to OEM closed.Update AHAB guides to use U-Boot ahab_close command instead of SCFW CLI.
As the procedure is now independent of SCFW terminal we can remove
this condition from documentation.Signed-off-by: Breno Lima
Reviewed-by: Ye Li
(cherry picked from commit 6f93d877e1454024f666a4810d24148cf595429e) -
Starting in L4.14.78 release, the OP-TEE CAAM driver does not set the
JROWN_NS field in case LMID is locked.We need to include the Unlock MID command in CSF file otherwise device
will fail to boot in HAB closed mode.Add section to avoid crash when OP-TEE is enabled.
Reported-by: Frank Zhang
Signed-off-by: Breno Lima
Reviewed-by: Ye Li
(cherry picked from commit af03284ad38bd03ef1f0d4942842629db93d2c11) -
Since commit cf2acc5b7cde ("MLK-18942-2 imx8: ahab: Add ahab_status
command") the U-Boot is able to display and parse the SECO events.Update AHAB guides to use U-Boot ahab_status command instead of
SCFW CLI.Starting in SECO FW v0.2.0 engineering release an invalid image
integrity is logged as an event in open mode. As ahab_status
is able to return this event the note can be removed.Signed-off-by: Breno Lima
Reviewed-by: Ye Li
(cherry picked from commit 385ed19051a47f5858e8d326e5ee97f8a08a679d) -
The set_priblob_bitfield command is enabled by selecting
CONFIG_CMD_PRIBLOB.Fix typo in mx6_mx7_encrypted_boot.txt guide.
Signed-off-by: Breno Lima
(cherry picked from commit 99f9696ef5f7d1c0f93b7d910e884890fca6c973) -
The current U-Boot implementation includes SPL targets for i.MX8QM and
i.MXQXP MEK boards:- imx8qxp_mek_spl_defconfig
- imx8qxp_mek_spl_fspi_defconfig
- imx8qm_mek_spl_defconfig
- imx8qm_mek_spl_fspi_defconfigThe U-Boot proper and ATF are included in an additional container being
necessary a different procedure for signing the flash.bin image.Add a step-by-step guide covering the signing procedure.
Add a CSF example for the 3rd container.Signed-off-by: Breno Lima
Reviewed-by: Frank Zhang
Reviewed-by: Marius Grigoras
Reviewed-by: Utkarsh Gupta
(cherry picked from commit 04505024d38eebbb5f39133b502c8e450ca40215) -
Add AHAB secure boot step-by-step guide for i.MX8 and i.MX8x families
devices.Add 3 CSF example files:
- Example to sign flash.bin only using SRK keys.
- Example to sign flash.bin using a subordinate SGK key.
- Example to sign Linux image only using SRK keys.Signed-off-by: Clement Le Marquis
Reviewed-by: Frank Zhang
Reviewed-by: Marius Grigoras
Reviewed-by: Utkarsh Gupta
(cherry picked from commit 7c46caba3b528b0399242f99612e5b094b1a4703) -
The AHAB is currently supported in i.MX8QXP and i.MX8QM devices.
Add an introductory document containing the following topics:
- AHAB Secure Boot Architecture
- System Control Unit (SCU) introduction
- Security Controller (SECO) introduction
- i.MX8/8x secure boot flow
- AHAB PKI tree generation
- SRK Table and SRK Hash generationSigned-off-by: Breno Lima
Reviewed-by: Frank Zhang
Reviewed-by: Marius Grigoras
Reviewed-by: Utkarsh Gupta
(cherry picked from commit 6e9ceb2526bd4a45c6ff669afb086cc3a0627e6b) -
Add HABv4 documentation for i.MX8M and i.MX8MM targets covering the
following topics:- How to sign an securely boot an flash.bin image.
- How to extend the root of trust for additional boot images.
- Add 2 CSF examples.Reviewed-by: Utkarsh Gupta
Signed-off-by: Breno Lima
(cherry picked from commit cc63be298a3e5f44e417f4098c124715917d09e1) -
Signed-off-by: Clement Le Marquis
(cherry picked from commit 0137aff2a7ea9b2a668b4dbf4e80a75f354052cc) -
Add useful documentation for encrypted boot:
- Add 2 CSF examples for encrypt and sign
- How to encrypt and sign a U-Boot binary on closed device
- Why and how increase the PRIBLOB bitfield from CAAM SCFGRSigned-off-by: Clement Le Marquis
(cherry picked from commit 3732dddfeddd989ca1fb930972f19303e3b67756) -
The csf_additional_images.txt example should match with
mx6_mx7_secure_boot.txt guide.Fix addresses provided in csf_additional_images.txt CSF
example.Reviewed-by: Ye Li
Signed-off-by: Breno Lima
(cherry picked from commit 17c3af7a1935a40057c01459766d41ff0a19723b)
(cherry picked from commit 270185b4c78f1139e965587ea2f0f290f9c4348c) -
When booting in low power or dual boot modes the M4 binary is
authenticated by the M4 ROM code.Add an option in hab_status command so users can retrieve M4 HAB
failure and warning events.=> hab_status m4
Secure boot disabled
HAB Configuration: 0xf0, HAB State: 0x66
No HAB Events Found!Add command documentation in mx6_mx7_secure_boot.txt guide.
As HAB M4 API cannot be called from A7 core the code is parsing
the M4 HAB persistent memory region. The HAB persistent memory
stores HAB events, public keys and others HAB related information.The HAB persistent memory region addresses and sizes can be found
in AN12263 "HABv4 RVT Guidelines and Recommendations".Reviewed-by: Utkarsh Gupta
Reviewed-by: Ye Li
Signed-off-by: Breno Lima
(cherry picked from commit 0efff16579fabcf57acb9c8857afac8fb58de355)
(cherry picked from commit 4815444f293d8021f8bd62079bd576e88cdef639)
02 Apr, 2019
1 commit
-
The ohci driver calls board_usb_init(), not usb_board_init().
Signed-off-by: Krzysztof Kozlowski
29 Mar, 2019
2 commits
-
- Bugfixes:
- mmc: correct the HS400 initialization process
- configs: ti: Move FIT image load address to avoid overwrite
- lib: time: update module enable MACRO
- Add mbrugger as RPi board maintainer, correct agraf's email address. -
Correct Alex's email address.
Signed-off-by: Heinrich Schuchardt
Reviewed-by: Alexander Graf
28 Mar, 2019
3 commits
-
Describe the target scope of the UEFI implementation in U-Boot.
Signed-off-by: Heinrich Schuchardt
-
The following TODOs are closed:
- GetNextVariableName is not implemented
- event groups
- manage events in a linked listSigned-off-by: Heinrich Schuchardt
-
We currently only support EFI_FILE_PROTOCOL_REVISION while
UEFI specs 2.4 - 2.7 prescribe EFI_FILE_PROTOCOL_REVISION2.
Add a todo.Add missing constants for the EFI file protocol revision.
Signed-off-by: Heinrich Schuchardt
11 Mar, 2019
1 commit
-
Changing voltage and enabling regulator might require delays so the
regulator stabilizes at expected level.Add support for "regulator-ramp-delay" binding which can introduce
required time to both enabling the regulator and to changing the
voltage.Signed-off-by: Krzysztof Kozlowski
Tested-by: Anand Moon
Signed-off-by: Minkyu Kang
01 Mar, 2019
1 commit
-
Alignment with kernel directory name as it have already bindings for
DDR controllers in the directory:
Documentation/devicetree/bindings/memory-controllerPS: the drivers using RAM u-class should be associated with
this binding directorySigned-off-by: Patrick Delaunay
27 Feb, 2019
2 commits
-
The readme guide describes the procedure to build, flash and boot Linux
using U-Boot on HiFive Unleashed. It also explains the current state of
U-boot support and future action items.Signed-off-by: Atish Patra
Signed-off-by: Anup Patel
Reviewed-by: Lukas Auer -
This patch adds fixed-factor clock driver which derives clock
rate by dividing (div) and multiplying (mult) fixed factors
to a parent clock.Signed-off-by: Atish Patra
Signed-off-by: Anup Patel
Reviewed-by: Simon Glass
21 Feb, 2019
2 commits
-
Without this padding nyan-big ends at a blank screen on boot.
Details on how to get to this padding can be found in the README.chromium under Notes.Signed-off-by: Tristan Bastian
Reviewed-by: Simon Glass
Signed-off-by: Tom Warren
20 Feb, 2019
3 commits
-
The Intel High-definition Audio is a newer-generation audio system which
provides for transfer of a large number of audio stream, each containing
up to 16 channels.Add support for HDA as a library which can be used by other drivers.
U-Boot currently uses only two channels (stereo).Signed-off-by: Simon Glass
Reviewed-by: Bin Meng -
At present it is possible to '#define DEBUG' at the top of a file which
causes all debug() statements in that file to become active. There is
currently no equivalent with logging, but this is a useful function.Add a LOG_DEBUG define along with documentation.
Signed-off-by: Simon Glass
Reviewed-by: Bin Meng -
The log_debug(), etc. function are documented only in the header file at
present. Add a section to README.log also.Signed-off-by: Simon Glass
Reviewed-by: Bin Meng
15 Feb, 2019
5 commits
-
The secure_boot.txt guide was replaced by mx6_mx7_secure_boot.txt and
mx6_mx7_spl_secure_boot.txt documents.Both documents covers all steps needed for SPL and non-SPL tagets,
so remove secure_boot.txt file to avoid duplicated content.Signed-off-by: Breno Lima
-
All guides are currently located at doc/imx/habv4/guides/ directory.
Move encrypted_boot.txt document to guides directory.
Signed-off-by: Breno Lima
-
The current U-Boot implementation includes SPL targets for
some NXP development boards:- mx6sabreauto_defconfig
- mx6sabresd_defconfig
- mx6ul_14x14_evk_defconfig
- mx6ul_9x9_evk_defconfigAdd additional steps needed to completly secure the
bootloader image.Signed-off-by: Breno Lima
-
Add HABv4 documentation for non-SPL targets covering the
following topics:- How to sign an securely boot an u-boot-dtb.imx image.
- How to extend the root of trust for additional boot images.
- Add 3 CSF examples.
- Add IVT generation script example.Reviewed-by: Ye Li
Reviewed-by: Utkarsh Gupta
Signed-off-by: Breno Lima -
The HABv4 is supported in i.MX50, i.MX53, i.MX6, i.MX7,
series and i.MX 8M, i.MX8MM devices.Add an introductory document containing the following topics:
- HABv4 Introduction
- HABv4 Secure Boot
- HABv4 Encrypted Boot
- HAB PKI tree generation
- HAB Fast Authentication PKI tree generation
- SRK Table and SRK Hash generationReviewed-by: Ye Li
Reviewed-by: Utkarsh Gupta
Signed-off-by: Breno Lima