include/config_fsl_chain_trust.h

   1 /*
   2  * Copyright 2015 Freescale Semiconductor, Inc.
   3  *
   4  * SPDX-License-Identifier:     GPL-2.0+
   5  */
   6
   7 #ifndef __CONFIG_FSL_CHAIN_TRUST_H
   8 #define __CONFIG_FSL_CHAIN_TRUST_H
   9
  10 /* For secure boot, since ENVIRONMENT in flash/external memories is
  11  * not verified, undef CONFIG_ENV_xxx and set default env
  12  * (CONFIG_ENV_IS_NOWHERE)
  13  */
  14 #ifdef CONFIG_SECURE_BOOT
  15
  16 #undef CONFIG_ENV_IS_IN_EEPROM
  17 #undef CONFIG_ENV_IS_IN_SPI_FLASH
  18
  19 #endif
  20
  21 #ifdef CONFIG_CHAIN_OF_TRUST
  22
  23 #ifndef CONFIG_EXTRA_ENV
  24 #define CONFIG_EXTRA_ENV        ""
  25 #endif
  26
  27 /*
  28  * Control should not reach back to uboot after validation of images
  29  * for secure boot flow and therefore bootscript should have
  30  * the bootm command. If control reaches back to uboot anyhow
  31  * after validating images, core should just spin.
  32  */
  33
  34 /*
  35  * Define the key hash for boot script here if public/private key pair used to
  36  * sign bootscript are different from the SRK hash put in the fuse
  37  * Example of defining KEY_HASH is
  38  * #define CONFIG_BOOTSCRIPT_KEY_HASH \
  39  *       "41066b564c6ffcef40ccbc1e0a5d0d519604000c785d97bbefd25e4d288d1c8b"
  40  */
  41
  42 #ifdef CONFIG_BOOTARGS
  43 #define CONFIG_SET_BOOTARGS     "setenv bootargs \'" CONFIG_BOOTARGS" \';"
  44 #else
  45 #define CONFIG_SET_BOOTARGS     "setenv bootargs \'root=/dev/ram "      \
  46                                 "rw console=ttyS0,115200 ramdisk_size=600000\';"
  47 #endif
  48
  49
  50 #ifdef CONFIG_BOOTSCRIPT_KEY_HASH
  51 #define CONFIG_SECBOOT \
  52         "setenv bs_hdraddr " __stringify(CONFIG_BOOTSCRIPT_HDR_ADDR)";" \
  53         CONFIG_SET_BOOTARGS     \
  54         CONFIG_EXTRA_ENV        \
  55         "esbc_validate $bs_hdraddr " \
  56           __stringify(CONFIG_BOOTSCRIPT_KEY_HASH)";" \
  57         "source $img_addr;"     \
  58         "esbc_halt\0"
  59 #else
  60 #define CONFIG_SECBOOT \
  61         "setenv bs_hdraddr " __stringify(CONFIG_BOOTSCRIPT_HDR_ADDR)";" \
  62         CONFIG_SET_BOOTARGS     \
  63         CONFIG_EXTRA_ENV        \
  64         "esbc_validate $bs_hdraddr;" \
  65         "source $img_addr;"     \
  66         "esbc_halt\0"
  67 #endif
  68
  69 #ifdef CONFIG_BOOTSCRIPT_COPY_RAM
  70 #define CONFIG_BS_COPY_ENV \
  71         "setenv bs_hdr_ram " __stringify(CONFIG_BS_HDR_ADDR_RAM)";" \
  72         "setenv bs_hdr_device " __stringify(CONFIG_BS_HDR_ADDR_DEVICE)";" \
  73         "setenv bs_hdr_size " __stringify(CONFIG_BS_HDR_SIZE)";" \
  74         "setenv bs_ram " __stringify(CONFIG_BS_ADDR_RAM)";" \
  75         "setenv bs_device " __stringify(CONFIG_BS_ADDR_DEVICE)";" \
  76         "setenv bs_size " __stringify(CONFIG_BS_SIZE)";"
  77
  78 /* For secure boot flow, default environment used will be used */
  79 #if defined(CONFIG_SYS_RAMBOOT) || defined(CONFIG_NAND_BOOT) || \
  80         defined(CONFIG_SD_BOOT)
  81 #if defined(CONFIG_RAMBOOT_NAND) || defined(CONFIG_NAND_BOOT)
  82 #define CONFIG_BS_COPY_CMD \
  83         "nand read $bs_hdr_ram $bs_hdr_device $bs_hdr_size ;" \
  84         "nand read $bs_ram $bs_device $bs_size ;"
  85 #elif defined(CONFIG_SD_BOOT)
  86 #define CONFIG_BS_COPY_CMD \
  87         "mmc read $bs_hdr_ram $bs_hdr_device $bs_hdr_size ;" \
  88         "mmc read $bs_ram $bs_device $bs_size ;"
  89 #endif
  90 #else
  91 #define CONFIG_BS_COPY_CMD \
  92         "cp.b $bs_hdr_device $bs_hdr_ram  $bs_hdr_size ;" \
  93         "cp.b $bs_device $bs_ram  $bs_size ;"
  94 #endif
  95 #endif /* CONFIG_BOOTSCRIPT_COPY_RAM */
  96
  97 #ifndef CONFIG_BS_COPY_ENV
  98 #define CONFIG_BS_COPY_ENV
  99 #endif
 100
 101 #ifndef CONFIG_BS_COPY_CMD
 102 #define CONFIG_BS_COPY_CMD
 103 #endif
 104
 105 #define CONFIG_CHAIN_BOOT_CMD   CONFIG_BS_COPY_ENV \
 106                                 CONFIG_BS_COPY_CMD \
 107                                 CONFIG_SECBOOT
 108
 109 #endif
 110 #endif