1 /* 2 * Copyright 2015 Freescale Semiconductor, Inc. 3 * 4 * SPDX-License-Identifier: GPL-2.0+ 5 */ 6 7 #ifndef __CONFIG_FSL_CHAIN_TRUST_H 8 #define __CONFIG_FSL_CHAIN_TRUST_H 9 10 /* For secure boot, since ENVIRONMENT in flash/external memories is 11 * not verified, undef CONFIG_ENV_xxx and set default env 12 * (CONFIG_ENV_IS_NOWHERE) 13 */ 14 #ifdef CONFIG_SECURE_BOOT 15 16 #undef CONFIG_ENV_IS_IN_EEPROM 17 #undef CONFIG_ENV_IS_IN_NAND 18 #undef CONFIG_ENV_IS_IN_MMC 19 #undef CONFIG_ENV_IS_IN_SPI_FLASH 20 #undef CONFIG_ENV_IS_IN_FLASH 21 22 #define CONFIG_ENV_IS_NOWHERE 23 24 #endif 25 26 #ifdef CONFIG_CHAIN_OF_TRUST 27 28 #ifndef CONFIG_EXTRA_ENV 29 #define CONFIG_EXTRA_ENV "" 30 #endif 31 32 /* 33 * Control should not reach back to uboot after validation of images 34 * for secure boot flow and therefore bootscript should have 35 * the bootm command. If control reaches back to uboot anyhow 36 * after validating images, core should just spin. 37 */ 38 39 /* 40 * Define the key hash for boot script here if public/private key pair used to 41 * sign bootscript are different from the SRK hash put in the fuse 42 * Example of defining KEY_HASH is 43 * #define CONFIG_BOOTSCRIPT_KEY_HASH \ 44 * "41066b564c6ffcef40ccbc1e0a5d0d519604000c785d97bbefd25e4d288d1c8b" 45 */ 46 47 #ifdef CONFIG_BOOTSCRIPT_KEY_HASH 48 #define CONFIG_SECBOOT \ 49 "setenv bs_hdraddr " __stringify(CONFIG_BOOTSCRIPT_HDR_ADDR)";" \ 50 "setenv bootargs \'root=/dev/ram rw console=ttyS0,115200 " \ 51 "ramdisk_size=600000\';" \ 52 CONFIG_EXTRA_ENV \ 53 "esbc_validate $bs_hdraddr " \ 54 __stringify(CONFIG_BOOTSCRIPT_KEY_HASH)";" \ 55 "source $img_addr;" \ 56 "esbc_halt\0" 57 #else 58 #define CONFIG_SECBOOT \ 59 "setenv bs_hdraddr " __stringify(CONFIG_BOOTSCRIPT_HDR_ADDR)";" \ 60 "setenv bootargs \'root=/dev/ram rw console=ttyS0,115200 " \ 61 "ramdisk_size=600000\';" \ 62 CONFIG_EXTRA_ENV \ 63 "esbc_validate $bs_hdraddr;" \ 64 "source $img_addr;" \ 65 "esbc_halt\0" 66 #endif 67 68 /* For secure boot flow, default environment used will be used */ 69 #if defined(CONFIG_SYS_RAMBOOT) 70 #ifdef CONFIG_BOOTSCRIPT_COPY_RAM 71 #define CONFIG_BS_COPY_ENV \ 72 "setenv bs_hdr_ram " __stringify(CONFIG_BS_HDR_ADDR_RAM)";" \ 73 "setenv bs_hdr_flash " __stringify(CONFIG_BS_HDR_ADDR_FLASH)";" \ 74 "setenv bs_hdr_size " __stringify(CONFIG_BS_HDR_SIZE)";" \ 75 "setenv bs_ram " __stringify(CONFIG_BS_ADDR_RAM)";" \ 76 "setenv bs_flash " __stringify(CONFIG_BS_ADDR_FLASH)";" \ 77 "setenv bs_size " __stringify(CONFIG_BS_SIZE)";" 78 79 #if defined(CONFIG_RAMBOOT_NAND) 80 #define CONFIG_BS_COPY_CMD \ 81 "nand read $bs_hdr_ram $bs_hdr_flash $bs_hdr_size ;" \ 82 "nand read $bs_ram $bs_flash $bs_size ;" 83 #endif /* CONFIG_RAMBOOT_NAND */ 84 #endif /* CONFIG_BOOTSCRIPT_COPY_RAM */ 85 86 #endif 87 88 #ifndef CONFIG_BS_COPY_ENV 89 #define CONFIG_BS_COPY_ENV 90 #endif 91 92 #ifndef CONFIG_BS_COPY_CMD 93 #define CONFIG_BS_COPY_CMD 94 #endif 95 96 #define CONFIG_CHAIN_BOOT_CMD CONFIG_BS_COPY_ENV \ 97 CONFIG_BS_COPY_CMD \ 98 CONFIG_SECBOOT 99 100 #endif 101 #endif 102