mirror of
https://github.com/brain-hackers/u-boot-brain
synced 2024-09-27 23:20:26 +09:00
arm64: ls1043ardb: Add distro secure boot support
Enable validation of boot.scr script prior to its execution dependent on "secureboot" flag in environment. Disable fall back option to nor/qspi boot in case of secure boot. Also enable "secureboot=y" flag in environment for ARM based platforms instead of bootcmd. Signed-off-by: Sumit Garg <sumit.garg@nxp.com> Tested-by: Vinitha Pillai <vinitha.pillai@nxp.com> Reviewed-by: York Sun <york.sun@nxp.com>
This commit is contained in:
parent
8de227ee0b
commit
76bbf1c634
@ -81,7 +81,13 @@ int fsl_setenv_chain_of_trust(void)
|
|||||||
* bootcmd = CONFIG_CHAIN_BOOT_CMD (Validate and execute Boot script)
|
* bootcmd = CONFIG_CHAIN_BOOT_CMD (Validate and execute Boot script)
|
||||||
*/
|
*/
|
||||||
setenv("bootdelay", "0");
|
setenv("bootdelay", "0");
|
||||||
|
|
||||||
|
#ifdef CONFIG_ARM
|
||||||
|
setenv("secureboot", "y");
|
||||||
|
#else
|
||||||
setenv("bootcmd", CONFIG_CHAIN_BOOT_CMD);
|
setenv("bootcmd", CONFIG_CHAIN_BOOT_CMD);
|
||||||
|
#endif
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
@ -39,3 +39,4 @@ CONFIG_USB_STORAGE=y
|
|||||||
CONFIG_RSA=y
|
CONFIG_RSA=y
|
||||||
CONFIG_SPL_RSA=y
|
CONFIG_SPL_RSA=y
|
||||||
CONFIG_RSA_SOFTWARE_EXP=y
|
CONFIG_RSA_SOFTWARE_EXP=y
|
||||||
|
CONFIG_DISTRO_DEFAULTS=y
|
||||||
|
@ -55,3 +55,4 @@ CONFIG_USB_XHCI_DWC3=y
|
|||||||
CONFIG_USB_STORAGE=y
|
CONFIG_USB_STORAGE=y
|
||||||
CONFIG_RSA=y
|
CONFIG_RSA=y
|
||||||
CONFIG_SPL_RSA=y
|
CONFIG_SPL_RSA=y
|
||||||
|
CONFIG_DISTRO_DEFAULTS=y
|
||||||
|
@ -275,6 +275,7 @@
|
|||||||
"fdt_addr=0x64f00000\0" \
|
"fdt_addr=0x64f00000\0" \
|
||||||
"kernel_addr=0x65000000\0" \
|
"kernel_addr=0x65000000\0" \
|
||||||
"scriptaddr=0x80000000\0" \
|
"scriptaddr=0x80000000\0" \
|
||||||
|
"scripthdraddr=0x80080000\0" \
|
||||||
"fdtheader_addr_r=0x80100000\0" \
|
"fdtheader_addr_r=0x80100000\0" \
|
||||||
"kernelheader_addr_r=0x80200000\0" \
|
"kernelheader_addr_r=0x80200000\0" \
|
||||||
"kernel_addr_r=0x81000000\0" \
|
"kernel_addr_r=0x81000000\0" \
|
||||||
@ -285,6 +286,7 @@
|
|||||||
"mtdparts=" MTDPARTS_DEFAULT "\0" \
|
"mtdparts=" MTDPARTS_DEFAULT "\0" \
|
||||||
BOOTENV \
|
BOOTENV \
|
||||||
"boot_scripts=ls1043ardb_boot.scr\0" \
|
"boot_scripts=ls1043ardb_boot.scr\0" \
|
||||||
|
"boot_script_hdr=hdr_ls1043ardb_bs.out\0" \
|
||||||
"scan_dev_for_boot_part=" \
|
"scan_dev_for_boot_part=" \
|
||||||
"part list ${devtype} ${devnum} devplist; " \
|
"part list ${devtype} ${devnum} devplist; " \
|
||||||
"env exists devplist || setenv devplist 1; " \
|
"env exists devplist || setenv devplist 1; " \
|
||||||
@ -295,6 +297,20 @@
|
|||||||
"run scan_dev_for_boot; " \
|
"run scan_dev_for_boot; " \
|
||||||
"fi; " \
|
"fi; " \
|
||||||
"done\0" \
|
"done\0" \
|
||||||
|
"scan_dev_for_boot=" \
|
||||||
|
"echo Scanning ${devtype} " \
|
||||||
|
"${devnum}:${distro_bootpart}...; " \
|
||||||
|
"for prefix in ${boot_prefixes}; do " \
|
||||||
|
"run scan_dev_for_scripts; " \
|
||||||
|
"done;\0" \
|
||||||
|
"boot_a_script=" \
|
||||||
|
"load ${devtype} ${devnum}:${distro_bootpart} " \
|
||||||
|
"${scriptaddr} ${prefix}${script}; " \
|
||||||
|
"env exists secureboot && load ${devtype} " \
|
||||||
|
"${devnum}:${distro_bootpart} " \
|
||||||
|
"${scripthdraddr} ${prefix}${boot_script_hdr} " \
|
||||||
|
"&& esbc_validate ${scripthdraddr};" \
|
||||||
|
"source ${scriptaddr}\0" \
|
||||||
"installer=load mmc 0:2 $load_addr " \
|
"installer=load mmc 0:2 $load_addr " \
|
||||||
"/flex_installer_arm64.itb; " \
|
"/flex_installer_arm64.itb; " \
|
||||||
"bootm $load_addr#ls1043ardb\0" \
|
"bootm $load_addr#ls1043ardb\0" \
|
||||||
@ -307,9 +323,11 @@
|
|||||||
|
|
||||||
#undef CONFIG_BOOTCOMMAND
|
#undef CONFIG_BOOTCOMMAND
|
||||||
#if defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
|
#if defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
|
||||||
#define CONFIG_BOOTCOMMAND "run distro_bootcmd;run qspi_bootcmd"
|
#define CONFIG_BOOTCOMMAND "run distro_bootcmd; env exists secureboot" \
|
||||||
|
"&& esbc_halt; run qspi_bootcmd;"
|
||||||
#else
|
#else
|
||||||
#define CONFIG_BOOTCOMMAND "run distro_bootcmd;run nor_bootcmd"
|
#define CONFIG_BOOTCOMMAND "run distro_bootcmd; env exists secureboot" \
|
||||||
|
"&& esbc_halt; run nor_bootcmd;"
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
#define CONFIG_BOOTARGS "console=ttyS0,115200 root=/dev/ram0 " \
|
#define CONFIG_BOOTARGS "console=ttyS0,115200 root=/dev/ram0 " \
|
||||||
|
Loading…
Reference in New Issue
Block a user