* [U-Boot] [PATCH] arm: ls1021atwr: Add distro secure boot support
@ 2017-06-06 15:21 Sumit Garg
2017-08-07 20:02 ` York Sun
0 siblings, 1 reply; 2+ messages in thread
From: Sumit Garg @ 2017-06-06 15:21 UTC (permalink / raw)
To: u-boot
Enable validation of boot.scr script prior to its execution dependent
on "secureboot" flag in environment. Disable fall back option to
qspi boot in case of secure boot. Also enable "secureboot=y" flag
in environment for ARM based platforms instead of bootcmd.
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Tested-by: Vinitha Pillai <vinitha.pillai@nxp.com>
---
configs/ls1021atwr_nor_SECURE_BOOT_defconfig | 1 +
.../ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig | 1 +
include/configs/ls1021atwr.h | 40 ++++++++++++++++++++--
3 files changed, 40 insertions(+), 2 deletions(-)
diff --git a/configs/ls1021atwr_nor_SECURE_BOOT_defconfig b/configs/ls1021atwr_nor_SECURE_BOOT_defconfig
index 5b6ca22..9e1ab08 100644
--- a/configs/ls1021atwr_nor_SECURE_BOOT_defconfig
+++ b/configs/ls1021atwr_nor_SECURE_BOOT_defconfig
@@ -44,3 +44,4 @@ CONFIG_USB_STORAGE=y
# CONFIG_VIDEO_SW_CURSOR is not set
CONFIG_RSA=y
CONFIG_SPL_RSA=y
+CONFIG_DISTRO_DEFAULTS=y
diff --git a/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig b/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig
index 783787a..af9fb9c 100644
--- a/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig
+++ b/configs/ls1021atwr_sdcard_ifc_SECURE_BOOT_defconfig
@@ -59,3 +59,4 @@ CONFIG_USB_STORAGE=y
# CONFIG_VIDEO_SW_CURSOR is not set
CONFIG_RSA=y
CONFIG_SPL_RSA=y
+CONFIG_DISTRO_DEFAULTS=y
diff --git a/include/configs/ls1021atwr.h b/include/configs/ls1021atwr.h
index 43767de..810e2c8 100644
--- a/include/configs/ls1021atwr.h
+++ b/include/configs/ls1021atwr.h
@@ -393,6 +393,7 @@
"fdt_addr=0x64f00000\0" \
"kernel_addr=0x65000000\0" \
"scriptaddr=0x80000000\0" \
+ "scripthdraddr=0x80080000\0" \
"fdtheader_addr_r=0x80100000\0" \
"kernelheader_addr_r=0x80200000\0" \
"kernel_addr_r=0x81000000\0" \
@@ -402,6 +403,7 @@
"kernel_size=0x2800000\0" \
BOOTENV \
"boot_scripts=ls1021atwr_boot.scr\0" \
+ "boot_script_hdr=hdr_ls1021atwr_bs.out\0" \
"scan_dev_for_boot_part=" \
"part list ${devtype} ${devnum} devplist; " \
"env exists devplist || setenv devplist 1; " \
@@ -412,6 +414,21 @@
"run scan_dev_for_boot; " \
"fi; " \
"done\0" \
+ "scan_dev_for_boot=" \
+ "echo Scanning ${devtype} " \
+ "${devnum}:${distro_bootpart}...; " \
+ "for prefix in ${boot_prefixes}; do " \
+ "run scan_dev_for_scripts; " \
+ "done;" \
+ "\0" \
+ "boot_a_script=" \
+ "load ${devtype} ${devnum}:${distro_bootpart} " \
+ "${scriptaddr} ${prefix}${script}; " \
+ "env exists secureboot && load ${devtype} " \
+ "${devnum}:${distro_bootpart} " \
+ "${scripthdraddr} ${prefix}${boot_script_hdr} " \
+ "&& esbc_validate ${scripthdraddr};" \
+ "source ${scriptaddr}\0" \
"installer=load mmc 0:2 $load_addr " \
"/flex_installer_arm32.itb; " \
"bootm $load_addr#ls1021atwr\0" \
@@ -429,6 +446,7 @@
"fdt_addr=0x64f00000\0" \
"kernel_addr=0x65000000\0" \
"scriptaddr=0x80000000\0" \
+ "scripthdraddr=0x80080000\0" \
"fdtheader_addr_r=0x80100000\0" \
"kernelheader_addr_r=0x80200000\0" \
"kernel_addr_r=0x81000000\0" \
@@ -438,6 +456,7 @@
"kernel_size=0x2800000\0" \
BOOTENV \
"boot_scripts=ls1021atwr_boot.scr\0" \
+ "boot_script_hdr=hdr_ls1021atwr_bs.out\0" \
"scan_dev_for_boot_part=" \
"part list ${devtype} ${devnum} devplist; " \
"env exists devplist || setenv devplist 1; " \
@@ -448,6 +467,21 @@
"run scan_dev_for_boot; " \
"fi; " \
"done\0" \
+ "scan_dev_for_boot=" \
+ "echo Scanning ${devtype} " \
+ "${devnum}:${distro_bootpart}...; " \
+ "for prefix in ${boot_prefixes}; do " \
+ "run scan_dev_for_scripts; " \
+ "done;" \
+ "\0" \
+ "boot_a_script=" \
+ "load ${devtype} ${devnum}:${distro_bootpart} " \
+ "${scriptaddr} ${prefix}${script}; " \
+ "env exists secureboot && load ${devtype} " \
+ "${devnum}:${distro_bootpart} " \
+ "${scripthdraddr} ${prefix}${boot_script_hdr} " \
+ "&& esbc_validate ${scripthdraddr};" \
+ "source ${scriptaddr}\0" \
"installer=load mmc 0:2 $load_addr " \
"/flex_installer_arm32.itb; " \
"bootm $load_addr#ls1021atwr\0" \
@@ -461,9 +495,11 @@
#undef CONFIG_BOOTCOMMAND
#if defined(CONFIG_QSPI_BOOT) || defined(CONFIG_SD_BOOT_QSPI)
-#define CONFIG_BOOTCOMMAND "run distro_bootcmd;run qspi_bootcmd"
+#define CONFIG_BOOTCOMMAND "run distro_bootcmd; env exists secureboot" \
+ "&& esbc_halt; run qspi_bootcmd;"
#else
-#define CONFIG_BOOTCOMMAND "run distro_bootcmd;run nor_bootcmd"
+#define CONFIG_BOOTCOMMAND "run distro_bootcmd; env exists secureboot" \
+ "&& esbc_halt; run nor_bootcmd;"
#endif
#define CONFIG_BOOTARGS "console=ttyS0,115200 root=/dev/ram0"
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* [U-Boot] [PATCH] arm: ls1021atwr: Add distro secure boot support
2017-06-06 15:21 [U-Boot] [PATCH] arm: ls1021atwr: Add distro secure boot support Sumit Garg
@ 2017-08-07 20:02 ` York Sun
0 siblings, 0 replies; 2+ messages in thread
From: York Sun @ 2017-08-07 20:02 UTC (permalink / raw)
To: u-boot
On 06/05/2017 08:54 PM, Sumit Garg wrote:
> Enable validation of boot.scr script prior to its execution dependent
> on "secureboot" flag in environment. Disable fall back option to
> qspi boot in case of secure boot. Also enable "secureboot=y" flag
> in environment for ARM based platforms instead of bootcmd.
>
> Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
> Tested-by: Vinitha Pillai <vinitha.pillai@nxp.com>
> ---
Applied to fsl-qoriq master. Thanks.
York
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-08-07 20:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-06-06 15:21 [U-Boot] [PATCH] arm: ls1021atwr: Add distro secure boot support Sumit Garg
2017-08-07 20:02 ` York Sun
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.