arm: mxs: Adjust the load address of U-Boot and SPL for HAB

This patch adds the groundwork for generating signed BootStream, which can be used by the HAB library in i.MX28. We are adding a new target, u-boot-signed.sb , since the process for generating regular non-signed BootStream is much easier. Moreover, the signed bootstream depends on external _proprietary_ _binary-only_ tool from Freescale called 'cst', which is available only under NDA.

To make things even uglier, the CST or HAB mandates a kind-of circular dependency. The problem is, unlike the regular IVT, which is generated by mxsimage, the IVT for signed boot must be generated by hand here due to special demands of the CST. The U-Boot binary (or SPL binary) and IVT are then signed by the CST as a one block. But here is the problem. The size of the entire image (U-Boot, IVT, CST blocks) must be appended at the end of IVT. But the size of the entire image is not known until the CST has finished signing the U-Boot and IVT. We solve this by expecting the CST block to be always 3904B (which it is in case two files, U-Boot and the hand-made IVT, are signed in the CST block).

Signed-off-by Marek Vasut <[email protected]>

Cc Stefano Babic <[email protected]>

---
 Makefile                                       |  2 +
 arch/arm/cpu/arm926ejs/mxs/Makefile            | 60 ++++++++++++++++++++++++++
 arch/arm/cpu/arm926ejs/mxs/mxsimage-signed.cfg | 10 +++++
 3 files changed, 72 insertions(+)
 create mode 100644 arch/arm/cpu/arm926ejs/mxs/mxsimage-signed.cfg

NOTE: Stefano, I had to tweak this to play well with kbuild.

Hi Marek,

Quoted 22 lines · Marek Vasut

This patch adds the groundwork for generating signed BootStream, which can be used by the HAB library in i.MX28. We are adding a new target, u-boot-signed.sb , since the process for generating regular non-signed BootStream is much easier. Moreover, the signed bootstream depends on external _proprietary_ _binary-only_ tool from Freescale called 'cst', which is available only under NDA.

To make things even uglier, the CST or HAB mandates a kind-of circular dependency. The problem is, unlike the regular IVT, which is generated by mxsimage, the IVT for signed boot must be generated by hand here due to special demands of the CST. The U-Boot binary (or SPL binary) and IVT are then signed by the CST as a one block. But here is the problem. The size of the entire image (U-Boot, IVT, CST blocks) must be appended at the end of IVT. But the size of the entire image is not known until the CST has finished signing the U-Boot and IVT. We solve this by expecting the CST block to be always 3904B (which it is in case two files, U-Boot and the hand-made IVT, are signed in the CST block).

Signed-off-by Marek Vasut <[email protected]>

Cc Stefano Babic <[email protected]>

---

Quoted 8 lines

 Makefile                                       |  2 +
 arch/arm/cpu/arm926ejs/mxs/Makefile            | 60
 ++++++++++++++++++++++++++
 arch/arm/cpu/arm926ejs/mxs/mxsimage-signed.cfg | 10 +++++
 3 files changed, 72 insertions(+)
 create mode 100644 arch/arm/cpu/arm926ejs/mxs/mxsimage-signed.cfg

NOTE: Stefano, I had to tweak this to play well with kbuild.

ok - only to track what we have already discussed via IIRC.

The patch was already accepted, but it conflicts with current u-boot-arm. I revert it on u-boot-imx, and Marek rebased it.

Marek, I could not apply it directly after merging u-boot-arm - maybe because we set on different commit id. Never mind, I merge it again and it looks ok.

I have pushed a -test branch on u-boot-imx after merging u-boot-arm and your patches. It looks ok, and if you do not complain, I will send it to Albert for inclusion in u-boot-arm.

When using HAB, there are additional special requirements on the placement of U-Boot and the U-Boot SPL in memory. To fullfill these, this patch moves the U-Boot binary a little further from the begining of the DRAM, so the HAB CST and IVT can be placed in front of the U-Boot binary. This is necessary, since both the U-Boot and the IVT must be contained in single CST signature. To make things worse, the IVT must be concatenated with one more entry at it's end, that is the length of the entire CST signature, IVT and U-Boot binary in memory. By placing the blocks in this order -- CST, IVT, U-Boot, we can easily align them all and then produce the length field as needed.

As for the SPL, on i.MX23/i.MX28, the SPL size is limited to 32 KiB, thus we place the IVT at 0x8000 offset, CST right past IVT and claim the size is correct. The HAB library accepts this setup.

Finally, to make sure the vectoring in SPL still works even after moving the SPL from 0x0 to 0x1000, we add a small function which copies the vectoring code and tables to 0x0. This is fine, since the vectoring code is position independent.

Signed-off-by Marek Vasut <[email protected]>

Cc Stefano Babic <[email protected]>

---