From 576294c9a3391f4181cfc298027f29c6c28b943a Mon Sep 17 00:00:00 2001 From: Prabhakar Kushwaha Date: Tue, 18 Jul 2017 14:39:07 +0530 Subject: arm: ls1021atwr: Add distro secure boot support Enable validation of boot.scr script prior to its execution dependent on "secureboot" flag in environment. Disable fall back option to qspi boot in case of secure boot. Also enable "secureboot=y" flag in environment for ARM based platforms instead of bootcmd. Signed-off-by: Sumit Garg Tested-by: Vinitha Pillai diff --git a/configs/ls1021atwr_nor_SECURE_BOOT_defconfig b/configs/ls1021atwr_nor_SECURE_BOOT_defconfig index cf99770..c8cb215 100644 --- a/configs/ls1021atwr_nor_SECURE_BOOT_defconfig +++ b/configs/ls1021atwr_nor_SECURE_BOOT_defconfig @@ -46,3 +46,4 @@ CONFIG_VIDEO_FSL_DCU_FB=y # CONFIG_VIDEO_SW_CURSOR is not set CONFIG_RSA=y CONFIG_SPL_RSA=y +CONFIG_DISTRO_DEFAULTS=y diff --git a/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig b/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig index d13652a..8689fa7 100644 --- a/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig +++ b/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig @@ -61,3 +61,4 @@ CONFIG_VIDEO_FSL_DCU_FB=y # CONFIG_VIDEO_SW_CURSOR is not set CONFIG_RSA=y CONFIG_SPL_RSA=y +CONFIG_DISTRO_DEFAULTS=y diff --git a/include/configs/ls1021atwr.h b/include/configs/ls1021atwr.h index 1dc99b2..c4cf0c2 100644 --- a/include/configs/ls1021atwr.h +++ b/include/configs/ls1021atwr.h @@ -378,17 +378,21 @@ "initrd_high=0xffffffff\0" \ "fdt_high=0xffffffff\0" \ "fdt_addr=0x64f00000\0" \ - "kernel_addr=0x65000000\0" \ + "kernelheader_addr=0x60800000\0" \ + "kernel_addr=0x61000000\0" \ "scriptaddr=0x80000000\0" \ + "scripthdraddr=0x80080000\0" \ "fdtheader_addr_r=0x80100000\0" \ "kernelheader_addr_r=0x80200000\0" \ "kernel_addr_r=0x81000000\0" \ "fdt_addr_r=0x90000000\0" \ "ramdisk_addr_r=0xa0000000\0" \ "load_addr=0xa0000000\0" \ + "kernelheader_size=0x40000\0" \ "kernel_size=0x2800000\0" \ BOOTENV \ "boot_scripts=ls1021atwr_boot.scr\0" \ + "boot_script_hdr=hdr_ls1021atwr_bs.out\0" \ "scan_dev_for_boot_part=" \ "part list ${devtype} ${devnum} devplist; " \ "env exists devplist || setenv devplist 1; " \ @@ -399,32 +403,57 @@ "run scan_dev_for_boot; " \ "fi; " \ "done\0" \ + "scan_dev_for_boot=" \ + "echo Scanning ${devtype} " \ + "${devnum}:${distro_bootpart}...; " \ + "for prefix in ${boot_prefixes}; do " \ + "run scan_dev_for_scripts; " \ + "done;" \ + "\0" \ + "boot_a_script=" \ + "load ${devtype} ${devnum}:${distro_bootpart} " \ + "${scriptaddr} ${prefix}${script}; " \ + "env exists secureboot && load ${devtype} " \ + "${devnum}:${distro_bootpart} " \ + "${scripthdraddr} ${prefix}${boot_script_hdr} " \ + "&& esbc_validate ${scripthdraddr};" \ + "source ${scriptaddr}\0" \ "installer=load mmc 0:2 $load_addr " \ "/flex_installer_arm32.itb; " \ "bootm $load_addr#ls1021atwr\0" \ "qspi_bootcmd=echo Trying load from qspi..;" \ "sf probe && sf read $load_addr " \ - "$kernel_addr $kernel_size && bootm $load_addr#$board\0" \ + "$kernel_addr $kernel_size; env exists secureboot " \ + "&& sf read $kernelheader_addr_r $kernelheader_addr " \ + "$kernelheader_size && esbc_validate ${kernelheader_addr_r}; " \ + "bootm $load_addr#$board\0" \ "nor_bootcmd=echo Trying load from nor..;" \ "cp.b $kernel_addr $load_addr " \ - "$kernel_size && bootm $load_addr#$board\0" + "$kernel_size; env exists secureboot " \ + "&& cp.b $kernelheader_addr $kernelheader_addr_r " \ + "$kernelheader_size && esbc_validate ${kernelheader_addr_r}; " \ + "bootm $load_addr#$board\0" #else #define CONFIG_EXTRA_ENV_SETTINGS \ "bootargs=root=/dev/ram0 rw console=ttyS0,115200\0" \ "initrd_high=0xffffffff\0" \ "fdt_high=0xffffffff\0" \ "fdt_addr=0x64f00000\0" \ - "kernel_addr=0x65000000\0" \ + "kernelheader_addr=0x60800000\0" \ + "kernel_addr=0x61000000\0" \ "scriptaddr=0x80000000\0" \ + "scripthdraddr=0x80080000\0" \ "fdtheader_addr_r=0x80100000\0" \ "kernelheader_addr_r=0x80200000\0" \ "kernel_addr_r=0x81000000\0" \ "fdt_addr_r=0x90000000\0" \ "ramdisk_addr_r=0xa0000000\0" \ "load_addr=0xa0000000\0" \ + "kernelheader_size=0x40000\0" \ "kernel_size=0x2800000\0" \ BOOTENV \ "boot_scripts=ls1021atwr_boot.scr\0" \ + "boot_script_hdr=hdr_ls1021atwr_bs.out\0" \ "scan_dev_for_boot_part=" \ "part list ${devtype} ${devnum} devplist; " \ "env exists devplist || setenv devplist 1; " \ @@ -435,22 +464,45 @@ "run scan_dev_for_boot; " \ "fi; " \ "done\0" \ + "scan_dev_for_boot=" \ + "echo Scanning ${devtype} " \ + "${devnum}:${distro_bootpart}...; " \ + "for prefix in ${boot_prefixes}; do " \ + "run scan_dev_for_scripts; " \ + "done;" \ + "\0" \ + "boot_a_script=" \ + "load ${devtype} ${devnum}:${distro_bootpart} " \ + "${scriptaddr} ${prefix}${script}; " \ + "env exists secureboot && load ${devtype} " \ + "${devnum}:${distro_bootpart} " \ + "${scripthdraddr} ${prefix}${boot_script_hdr} " \ + "&& esbc_validate ${scripthdraddr};" \ + "source ${scriptaddr}\0" \ "installer=load mmc 0:2 $load_addr " \ "/flex_installer_arm32.itb; " \ "bootm $load_addr#ls1021atwr\0" \ "qspi_bootcmd=echo Trying load from qspi..;" \ "sf probe && sf read $load_addr " \ - "$kernel_addr $kernel_size && bootm $load_addr#$board\0" \ + "$kernel_addr $kernel_size; env exists secureboot " \ + "&& sf read $kernelheader_addr_r $kernelheader_addr " \ + "$kernelheader_size && esbc_validate ${kernelheader_addr_r}; " \ + "bootm $load_addr#$board\0" \ "nor_bootcmd=echo Trying load from nor..;" \ "cp.b $kernel_addr $load_addr " \ - "$kernel_size && bootm $load_addr#$board\0" + "$kernel_size; env exists secureboot " \ + "&& cp.b $kernelheader_addr $kernelheader_addr_r " \ + "$kernelheader_size && esbc_validate ${kernelheader_addr_r}; " \ + "bootm $load_addr#$board\0" #endif #undef CONFIG_BOOTCOMMAND #if defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI) -#define CONFIG_BOOTCOMMAND "run distro_bootcmd;run qspi_bootcmd" +#define CONFIG_BOOTCOMMAND "run distro_bootcmd; run qspi_bootcmd; " \ + "env exists secureboot && esbc_halt;" #else -#define CONFIG_BOOTCOMMAND "run distro_bootcmd;run nor_bootcmd" +#define CONFIG_BOOTCOMMAND "run distro_bootcmd; run nor_bootcmd; " \ + "env exists secureboot && esbc_halt;" #endif #define CONFIG_BOOTARGS "console=ttyS0,115200 root=/dev/ram0" -- cgit v0.10.2