* [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399
@ 2014-01-20 9:27 Aneesh Bansal
2014-01-20 22:06 ` Scott Wood
2014-04-23 22:26 ` York Sun
0 siblings, 2 replies; 6+ messages in thread
From: Aneesh Bansal @ 2014-01-20 9:27 UTC (permalink / raw)
To: u-boot
The workaround for IFC errata A003399 was not enabled
in case of secure boot. So, secure boot from NOR was not
working.
Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
---
include/configs/P1010RDB.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/include/configs/P1010RDB.h b/include/configs/P1010RDB.h
index c21cf07..b0e51fb 100644
--- a/include/configs/P1010RDB.h
+++ b/include/configs/P1010RDB.h
@@ -455,8 +455,7 @@ extern unsigned long get_sdram_size(void);
#endif
#ifdef CONFIG_SYS_FSL_ERRATUM_IFC_A003399
-#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)\
- && !defined(CONFIG_SECURE_BOOT)
+#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)
#define CONFIG_A003399_NOR_WORKAROUND
#endif
#endif
--
1.8.1.4
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399
2014-01-20 9:27 [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399 Aneesh Bansal
@ 2014-01-20 22:06 ` Scott Wood
2014-01-27 7:15 ` aneesh.bansal at freescale.com
[not found] ` <e11ecd6cbd4e4d5280731bae97c37073@DM2PR03MB415.namprd03.prod.outlook.com>
2014-04-23 22:26 ` York Sun
1 sibling, 2 replies; 6+ messages in thread
From: Scott Wood @ 2014-01-20 22:06 UTC (permalink / raw)
To: u-boot
On Mon, 2014-01-20 at 14:57 +0530, Aneesh Bansal wrote:
> The workaround for IFC errata A003399 was not enabled
> in case of secure boot. So, secure boot from NOR was not
> working.
>
> Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
> ---
> include/configs/P1010RDB.h | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/include/configs/P1010RDB.h b/include/configs/P1010RDB.h
> index c21cf07..b0e51fb 100644
> --- a/include/configs/P1010RDB.h
> +++ b/include/configs/P1010RDB.h
> @@ -455,8 +455,7 @@ extern unsigned long get_sdram_size(void);
> #endif
>
> #ifdef CONFIG_SYS_FSL_ERRATUM_IFC_A003399
> -#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)\
> - && !defined(CONFIG_SECURE_BOOT)
> +#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)
> #define CONFIG_A003399_NOR_WORKAROUND
> #endif
> #endif
Why do you need the workaround? Doesn't secure boot involve the bootrom
loading U-Boot into SRAM, rather than execute-in-place from NOR?
-Scott
^ permalink raw reply [flat|nested] 6+ messages in thread
* [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399
2014-01-20 22:06 ` Scott Wood
@ 2014-01-27 7:15 ` aneesh.bansal at freescale.com
[not found] ` <e11ecd6cbd4e4d5280731bae97c37073@DM2PR03MB415.namprd03.prod.outlook.com>
1 sibling, 0 replies; 6+ messages in thread
From: aneesh.bansal at freescale.com @ 2014-01-27 7:15 UTC (permalink / raw)
To: u-boot
>> The workaround for IFC errata A003399 was not enabled
>> in case of secure boot. So, secure boot from NOR was not
>> working.
>>
>> Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
>> ---
>> include/configs/P1010RDB.h | 3 +--
>> 1 file changed, 1 insertion(+), 2 deletions(-)
>>
>> diff --git a/include/configs/P1010RDB.h b/include/configs/P1010RDB.h
>> index c21cf07..b0e51fb 100644
>> --- a/include/configs/P1010RDB.h
>> +++ b/include/configs/P1010RDB.h
>> @@ -455,8 +455,7 @@ extern unsigned long get_sdram_size(void);
>> #endif
>>
>> #ifdef CONFIG_SYS_FSL_ERRATUM_IFC_A003399
>> -#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)\
>> - && !defined(CONFIG_SECURE_BOOT)
>> +#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)
>> #define CONFIG_A003399_NOR_WORKAROUND
>> #endif
>> #endif
>
>Why do you need the workaround? Doesn't secure boot involve the bootrom
>loading U-Boot into SRAM, rather than execute-in-place from NOR?
>
>-Scott
The Boot ROM code does not copy the U-boot from NOR into SRAM. In case of secure boot from NOR, it is executed as an execute-in-place memory and so this workaround is required.
Regards,
Aneesh Bansal
^ permalink raw reply [flat|nested] 6+ messages in thread
* [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399
[not found] ` <e11ecd6cbd4e4d5280731bae97c37073@DM2PR03MB415.namprd03.prod.outlook.com>
@ 2014-01-28 21:08 ` Scott Wood
2014-02-03 9:17 ` aneesh.bansal at freescale.com
0 siblings, 1 reply; 6+ messages in thread
From: Scott Wood @ 2014-01-28 21:08 UTC (permalink / raw)
To: u-boot
On Sun, 2014-01-26 at 23:27 -0600, Bansal Aneesh-B39320 wrote:
> > -----Original Message-----
> > From: Wood Scott-B07421
> > Sent: Tuesday, January 21, 2014 3:36 AM
> > To: Bansal Aneesh-B39320
> > Cc: u-boot at lists.denx.de; Sun York-R58495
> > Subject: Re: [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround
> > for IFC errata A003399
> >
> > On Mon, 2014-01-20 at 14:57 +0530, Aneesh Bansal wrote:
> > > The workaround for IFC errata A003399 was not enabled in case of
> > > secure boot. So, secure boot from NOR was not working.
> > >
> > > Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
> > > ---
> > > include/configs/P1010RDB.h | 3 +--
> > > 1 file changed, 1 insertion(+), 2 deletions(-)
> > >
> > > diff --git a/include/configs/P1010RDB.h b/include/configs/P1010RDB.h
> > > index c21cf07..b0e51fb 100644
> > > --- a/include/configs/P1010RDB.h
> > > +++ b/include/configs/P1010RDB.h
> > > @@ -455,8 +455,7 @@ extern unsigned long get_sdram_size(void); #endif
> > >
> > > #ifdef CONFIG_SYS_FSL_ERRATUM_IFC_A003399
> > > -#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)\
> > > - && !defined(CONFIG_SECURE_BOOT)
> > > +#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)
> > > #define CONFIG_A003399_NOR_WORKAROUND #endif #endif
> >
> > Why do you need the workaround? Doesn't secure boot involve the bootrom
> > loading U-Boot into SRAM, rather than execute-in-place from NOR?
> >
> > -Scott
> >
> The Boot ROM code does not copy the U-boot from NOR into SRAM. In case of secure
> boot from NOR, it is executed as an execute-in-place memory and so this workaround
> is required.
That doesn't sound very secure.
-Scott
^ permalink raw reply [flat|nested] 6+ messages in thread
* [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399
2014-01-28 21:08 ` Scott Wood
@ 2014-02-03 9:17 ` aneesh.bansal at freescale.com
0 siblings, 0 replies; 6+ messages in thread
From: aneesh.bansal at freescale.com @ 2014-02-03 9:17 UTC (permalink / raw)
To: u-boot
> -----Original Message-----
> From: Wood Scott-B07421
> Sent: Wednesday, January 29, 2014 2:38 AM
> To: Bansal Aneesh-B39320
> Cc: u-boot at lists.denx.de; Sun York-R58495
> Subject: Re: [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround
> for IFC errata A003399
>
> On Sun, 2014-01-26 at 23:27 -0600, Bansal Aneesh-B39320 wrote:
> > > -----Original Message-----
> > > From: Wood Scott-B07421
> > > Sent: Tuesday, January 21, 2014 3:36 AM
> > > To: Bansal Aneesh-B39320
> > > Cc: u-boot at lists.denx.de; Sun York-R58495
> > > Subject: Re: [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable
> > > workaround for IFC errata A003399
> > >
> > > On Mon, 2014-01-20 at 14:57 +0530, Aneesh Bansal wrote:
> > > > The workaround for IFC errata A003399 was not enabled in case of
> > > > secure boot. So, secure boot from NOR was not working.
> > > >
> > > > Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
> > > > ---
> > > > include/configs/P1010RDB.h | 3 +--
> > > > 1 file changed, 1 insertion(+), 2 deletions(-)
> > > >
> > > > diff --git a/include/configs/P1010RDB.h
> > > > b/include/configs/P1010RDB.h index c21cf07..b0e51fb 100644
> > > > --- a/include/configs/P1010RDB.h
> > > > +++ b/include/configs/P1010RDB.h
> > > > @@ -455,8 +455,7 @@ extern unsigned long get_sdram_size(void);
> > > > #endif
> > > >
> > > > #ifdef CONFIG_SYS_FSL_ERRATUM_IFC_A003399
> > > > -#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)\
> > > > - && !defined(CONFIG_SECURE_BOOT)
> > > > +#if !defined(CONFIG_SPL) && !defined(CONFIG_SYS_RAMBOOT)
> > > > #define CONFIG_A003399_NOR_WORKAROUND #endif #endif
> > >
> > > Why do you need the workaround? Doesn't secure boot involve the
> > > bootrom loading U-Boot into SRAM, rather than execute-in-place from
> NOR?
> > >
> > > -Scott
> > >
> > The Boot ROM code does not copy the U-boot from NOR into SRAM. In case
> > of secure boot from NOR, it is executed as an execute-in-place memory
> > and so this workaround is required.
>
> That doesn't sound very secure.
>
> -Scott
>
Can you please elaborate on the kind of security threats that you see with this approach.
If you are concerned about someone replacing the NOR flash at runtime, then we have the
Hardware Tamper detect mechanism to deal with that.
So, currently the bootROM code does not copy from NOR to SRAM.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399
2014-01-20 9:27 [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399 Aneesh Bansal
2014-01-20 22:06 ` Scott Wood
@ 2014-04-23 22:26 ` York Sun
1 sibling, 0 replies; 6+ messages in thread
From: York Sun @ 2014-04-23 22:26 UTC (permalink / raw)
To: u-boot
On 01/20/2014 01:27 AM, Aneesh Bansal wrote:
> The workaround for IFC errata A003399 was not enabled
> in case of secure boot. So, secure boot from NOR was not
> working.
>
> Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
> ---
Applied to u-boot-mpc85xx/master, thanks.
York
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2014-04-23 22:26 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-20 9:27 [U-Boot] [PATCH 2/3] powerpc/p1010rdb: SECURE BOOT- enable workaround for IFC errata A003399 Aneesh Bansal
2014-01-20 22:06 ` Scott Wood
2014-01-27 7:15 ` aneesh.bansal at freescale.com
[not found] ` <e11ecd6cbd4e4d5280731bae97c37073@DM2PR03MB415.namprd03.prod.outlook.com>
2014-01-28 21:08 ` Scott Wood
2014-02-03 9:17 ` aneesh.bansal at freescale.com
2014-04-23 22:26 ` York Sun
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox