1 /*
2  * Copyright 2015 Freescale Semiconductor, Inc.
3  *
4  * SPDX-License-Identifier:	GPL-2.0+
5  */
6 
7 #ifndef __CONFIG_FSL_CHAIN_TRUST_H
8 #define __CONFIG_FSL_CHAIN_TRUST_H
9 
10 /* For secure boot, since ENVIRONMENT in flash/external memories is
11  * not verified, undef CONFIG_ENV_xxx and set default env
12  * (CONFIG_ENV_IS_NOWHERE)
13  */
14 #ifdef CONFIG_SECURE_BOOT
15 
16 #undef CONFIG_ENV_IS_IN_EEPROM
17 #undef CONFIG_ENV_IS_IN_NAND
18 #undef CONFIG_ENV_IS_IN_MMC
19 #undef CONFIG_ENV_IS_IN_SPI_FLASH
20 #undef CONFIG_ENV_IS_IN_FLASH
21 
22 #define CONFIG_ENV_IS_NOWHERE
23 
24 #endif
25 
26 #ifdef CONFIG_CHAIN_OF_TRUST
27 
28 #ifndef CONFIG_EXTRA_ENV
29 #define CONFIG_EXTRA_ENV	""
30 #endif
31 
32 /*
33  * Control should not reach back to uboot after validation of images
34  * for secure boot flow and therefore bootscript should have
35  * the bootm command. If control reaches back to uboot anyhow
36  * after validating images, core should just spin.
37  */
38 
39 /*
40  * Define the key hash for boot script here if public/private key pair used to
41  * sign bootscript are different from the SRK hash put in the fuse
42  * Example of defining KEY_HASH is
43  * #define CONFIG_BOOTSCRIPT_KEY_HASH \
44  *	 "41066b564c6ffcef40ccbc1e0a5d0d519604000c785d97bbefd25e4d288d1c8b"
45  */
46 
47 #ifdef CONFIG_BOOTARGS
48 #define CONFIG_SET_BOOTARGS	"setenv bootargs \'" CONFIG_BOOTARGS" \';"
49 #else
50 #define CONFIG_SET_BOOTARGS	"setenv bootargs \'root=/dev/ram "	\
51 				"rw console=ttyS0,115200 ramdisk_size=600000\';"
52 #endif
53 
54 
55 #ifdef CONFIG_BOOTSCRIPT_KEY_HASH
56 #define CONFIG_SECBOOT \
57 	"setenv bs_hdraddr " __stringify(CONFIG_BOOTSCRIPT_HDR_ADDR)";" \
58 	CONFIG_SET_BOOTARGS	\
59 	CONFIG_EXTRA_ENV	\
60 	"esbc_validate $bs_hdraddr " \
61 	  __stringify(CONFIG_BOOTSCRIPT_KEY_HASH)";" \
62 	"source $img_addr;"	\
63 	"esbc_halt\0"
64 #else
65 #define CONFIG_SECBOOT \
66 	"setenv bs_hdraddr " __stringify(CONFIG_BOOTSCRIPT_HDR_ADDR)";" \
67 	CONFIG_SET_BOOTARGS	\
68 	CONFIG_EXTRA_ENV	\
69 	"esbc_validate $bs_hdraddr;" \
70 	"source $img_addr;"	\
71 	"esbc_halt\0"
72 #endif
73 
74 #ifdef CONFIG_BOOTSCRIPT_COPY_RAM
75 #define CONFIG_BS_COPY_ENV \
76 	"setenv bs_hdr_ram " __stringify(CONFIG_BS_HDR_ADDR_RAM)";" \
77 	"setenv bs_hdr_device " __stringify(CONFIG_BS_HDR_ADDR_DEVICE)";" \
78 	"setenv bs_hdr_size " __stringify(CONFIG_BS_HDR_SIZE)";" \
79 	"setenv bs_ram " __stringify(CONFIG_BS_ADDR_RAM)";" \
80 	"setenv bs_device " __stringify(CONFIG_BS_ADDR_DEVICE)";" \
81 	"setenv bs_size " __stringify(CONFIG_BS_SIZE)";"
82 
83 /* For secure boot flow, default environment used will be used */
84 #if defined(CONFIG_SYS_RAMBOOT) || defined(CONFIG_NAND_BOOT) || \
85 	defined(CONFIG_SD_BOOT)
86 #if defined(CONFIG_RAMBOOT_NAND) || defined(CONFIG_NAND_BOOT)
87 #define CONFIG_BS_COPY_CMD \
88 	"nand read $bs_hdr_ram $bs_hdr_device $bs_hdr_size ;" \
89 	"nand read $bs_ram $bs_device $bs_size ;"
90 #elif defined(CONFIG_SD_BOOT)
91 #define CONFIG_BS_COPY_CMD \
92 	"mmc read $bs_hdr_ram $bs_hdr_device $bs_hdr_size ;" \
93 	"mmc read $bs_ram $bs_device $bs_size ;"
94 #endif
95 #else
96 #define CONFIG_BS_COPY_CMD \
97 	"cp.b $bs_hdr_device $bs_hdr_ram  $bs_hdr_size ;" \
98 	"cp.b $bs_device $bs_ram  $bs_size ;"
99 #endif
100 #endif /* CONFIG_BOOTSCRIPT_COPY_RAM */
101 
102 #ifndef CONFIG_BS_COPY_ENV
103 #define CONFIG_BS_COPY_ENV
104 #endif
105 
106 #ifndef CONFIG_BS_COPY_CMD
107 #define CONFIG_BS_COPY_CMD
108 #endif
109 
110 #define CONFIG_CHAIN_BOOT_CMD	CONFIG_BS_COPY_ENV \
111 				CONFIG_BS_COPY_CMD \
112 				CONFIG_SECBOOT
113 
114 #endif
115 #endif
116