diff options
| author | Sumit Garg <sumit.garg@nxp.com> | 2017-08-28 06:36:28 (GMT) |
|---|---|---|
| committer | Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com> | 2017-08-29 11:04:13 (GMT) |
| commit | d31450d53d05c39371f41caecc5e1dfa40ade15a (patch) | |
| tree | 7fc5dc9ff97d2484f56be41952e3669b6f74b5c8 | |
| parent | df0303c2f44367c5e3de050fb69c325f894e6174 (diff) | |
| download | u-boot-d31450d53d05c39371f41caecc5e1dfa40ade15a.tar.xz | |
arm64: ls1046ardb: Add distro secure boot support
Enable validation of boot.scr script prior to its execution dependent
on "secureboot" flag in environment. Enable fall back option to
qspi boot in case of secure boot. Also enable "secureboot=y" flag
in environment for ARM based platforms instead of bootcmd.
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Tested-by: Vinitha Pillai <vinitha.pillai@nxp.com>
| -rw-r--r-- | configs/ls1046ardb_qspi_SECURE_BOOT_defconfig | 1 | ||||
| -rw-r--r-- | configs/ls1046ardb_sdcard_SECURE_BOOT_defconfig | 1 | ||||
| -rw-r--r-- | include/configs/ls1046a_common.h | 25 | ||||
| -rw-r--r-- | include/configs/ls1046ardb.h | 3 |
4 files changed, 28 insertions, 2 deletions
diff --git a/configs/ls1046ardb_qspi_SECURE_BOOT_defconfig b/configs/ls1046ardb_qspi_SECURE_BOOT_defconfig index 6653016..4a4ddc0 100644 --- a/configs/ls1046ardb_qspi_SECURE_BOOT_defconfig +++ b/configs/ls1046ardb_qspi_SECURE_BOOT_defconfig @@ -36,3 +36,4 @@ CONFIG_FSL_QSPI=y CONFIG_USB=y CONFIG_DM_USB=y CONFIG_RSA=y +CONFIG_DISTRO_DEFAULTS=y diff --git a/configs/ls1046ardb_sdcard_SECURE_BOOT_defconfig b/configs/ls1046ardb_sdcard_SECURE_BOOT_defconfig index 5b72ae1..c96e789 100644 --- a/configs/ls1046ardb_sdcard_SECURE_BOOT_defconfig +++ b/configs/ls1046ardb_sdcard_SECURE_BOOT_defconfig @@ -44,3 +44,4 @@ CONFIG_USB=y CONFIG_DM_USB=y CONFIG_RSA=y CONFIG_SPL_RSA=y +CONFIG_DISTRO_DEFAULTS=y diff --git a/include/configs/ls1046a_common.h b/include/configs/ls1046a_common.h index 490744a..5a25232 100644 --- a/include/configs/ls1046a_common.h +++ b/include/configs/ls1046a_common.h @@ -220,18 +220,23 @@ "fdt_addr=0x64f00000\0" \ "kernel_addr=0x65000000\0" \ "scriptaddr=0x80000000\0" \ + "scripthdraddr=0x80080000\0" \ "fdtheader_addr_r=0x80100000\0" \ "kernelheader_addr_r=0x80200000\0" \ "load_addr=0xa0000000\0" \ + "kernel_addr_r=0x81000000\0" \ "fdt_addr_r=0x90000000\0" \ "ramdisk_addr_r=0xa0000000\0" \ "kernel_start=0x1000000\0" \ + "kernelheader_start=0x800000\0" \ "kernel_load=0xa0000000\0" \ "kernel_size=0x2800000\0" \ + "kernelheader_size=0x40000\0" \ "console=ttyS0,115200\0" \ MTDPARTS_DEFAULT "\0" \ BOOTENV \ "boot_scripts=ls1046ardb_boot.scr\0" \ + "boot_script_hdr=hdr_ls1046ardb_bs.out\0" \ "scan_dev_for_boot_part=" \ "part list ${devtype} ${devnum} devplist; " \ "env exists devplist || setenv devplist 1; " \ @@ -242,12 +247,30 @@ "run scan_dev_for_boot; " \ "fi; " \ "done\0" \ + "scan_dev_for_boot=" \ + "echo Scanning ${devtype} " \ + "${devnum}:${distro_bootpart}...; " \ + "for prefix in ${boot_prefixes}; do " \ + "run scan_dev_for_scripts; " \ + "done;" \ + "\0" \ + "boot_a_script=" \ + "load ${devtype} ${devnum}:${distro_bootpart} " \ + "${scriptaddr} ${prefix}${script}; " \ + "env exists secureboot && load ${devtype} " \ + "${devnum}:${distro_bootpart} " \ + "${scripthdraddr} ${prefix}${boot_script_hdr} " \ + "&& esbc_validate ${scripthdraddr};" \ + "source ${scriptaddr}\0" \ "installer=load mmc 0:2 $load_addr " \ "/flex_installer_arm64.itb; " \ "bootm $load_addr#ls1046ardb\0" \ "qspi_bootcmd=echo Trying load from qspi..;" \ "sf probe && sf read $load_addr " \ - "$kernel_start $kernel_size && bootm $load_addr#$board\0" + "$kernel_start $kernel_size; env exists secureboot " \ + "&& sf read $kernelheader_addr_r $kernelheader_start " \ + "$kernelheader_size && esbc_validate ${kernelheader_addr_r}; " \ + "bootm $load_addr#$board\0" #define CONFIG_BOOTARGS "console=ttyS0,115200 root=/dev/ram0 " \ diff --git a/include/configs/ls1046ardb.h b/include/configs/ls1046ardb.h index e007d18..7bdff82 100644 --- a/include/configs/ls1046ardb.h +++ b/include/configs/ls1046ardb.h @@ -243,7 +243,8 @@ #ifndef SPL_NO_MISC #undef CONFIG_BOOTCOMMAND -#define CONFIG_BOOTCOMMAND "run distro_bootcmd;run qspi_bootcmd" +#define CONFIG_BOOTCOMMAND "run distro_bootcmd; run qspi_bootcmd; " \ + "env exists secureboot && esbc_halt;" #define MTDPARTS_DEFAULT "mtdparts=1550000.quadspi:1m(rcw)," \ "15m(u-boot),48m(kernel.itb);" \ "7e800000.flash:16m(nand_uboot)," \ |