[U-Boot] [PATCH v3 5/7] enable chain of trust for ARM platforms

[Ruchika Gupta]

> -----Original Message-----
> From: Aneesh Bansal [mailto:aneesh.bansal at nxp.com]
> Sent: Friday, January 22, 2016 4:37 PM
> To: u-boot at lists.denx.de
> Cc: york sun <york.sun at nxp.com>; Ruchika Gupta
> <ruchika.gupta at nxp.com>; Prabhakar Kushwaha
> <prabhakar.kushwaha at nxp.com>; Aneesh Bansal
> <aneesh.bansal at nxp.com>
> Subject: [PATCH v3 5/7] enable chain of trust for ARM platforms
> 
> Chain of Trust is enabled for ARM platforms (LS1021 and LS1043).
> In board_late_init(), fsl_setenv_chain_of_trust() is called which will perform
> the following:
> - If boot mode is non-secure, return (No Change)
> - If boot mode is secure, set the following environmet variables:
>    bootdelay = 0 (To disable Boot Prompt)
>    bootcmd = CONFIG_CHAIN_BOOT_CMD (Validate and execute Boot script)
> 
> Signed-off-by: Aneesh Bansal <aneesh.bansal at nxp.com>
> ---
> Changes in v3:
> Protect the inclusion of file fsl_validate.h with macro
> CONFIG_CHAIN_OF_TRUST
> 
> Changes in v2:
> Defconfigs for Secure Boot Target are not removed.
> 
>  arch/arm/cpu/armv8/fsl-layerscape/soc.c     |  6 ++++++
>  board/freescale/common/Makefile             |  1 +
>  board/freescale/common/fsl_chain_of_trust.c | 17 +++++++++++++++++
>  board/freescale/ls1021aqds/ls1021aqds.c     |  4 ++++
>  board/freescale/ls1021atwr/ls1021atwr.c     |  4 ++++
>  include/fsl_validate.h                      |  2 ++
>  6 files changed, 34 insertions(+)
> 
> diff --git a/arch/arm/cpu/armv8/fsl-layerscape/soc.c
> b/arch/arm/cpu/armv8/fsl-layerscape/soc.c
> index 23d6b73..d97a445 100644
> --- a/arch/arm/cpu/armv8/fsl-layerscape/soc.c
> +++ b/arch/arm/cpu/armv8/fsl-layerscape/soc.c
> @@ -12,6 +12,9 @@
>  #include <asm/io.h>
>  #include <asm/global_data.h>
>  #include <asm/arch-fsl-layerscape/config.h>
> +#ifdef CONFIG_CHAIN_OF_TRUST
> +#include <fsl_validate.h>
> +#endif
> 
>  DECLARE_GLOBAL_DATA_PTR;
> 
> @@ -241,6 +244,9 @@ int board_late_init(void)  #ifdef
> CONFIG_SCSI_AHCI_PLAT
>  	sata_init();
>  #endif
> +#ifdef CONFIG_CHAIN_OF_TRUST
> +	fsl_setenv_chain_of_trust();
> +#endif
> 
>  	return 0;
>  }
> diff --git a/board/freescale/common/Makefile
> b/board/freescale/common/Makefile index 51d2814..be114ce 100644
> --- a/board/freescale/common/Makefile
> +++ b/board/freescale/common/Makefile
> @@ -76,5 +76,6 @@ obj-$(CONFIG_LAYERSCAPE_NS_ACCESS)	+=
> ns_access.o
>  ifdef CONFIG_SECURE_BOOT
>  obj-$(CONFIG_CMD_ESBC_VALIDATE) += fsl_validate.o cmd_esbc_validate.o
> endif
> +obj-$(CONFIG_CHAIN_OF_TRUST) += fsl_chain_of_trust.o
> 
>  endif
> diff --git a/board/freescale/common/fsl_chain_of_trust.c
> b/board/freescale/common/fsl_chain_of_trust.c
> index ff67bd7..ecfcc82 100644
> --- a/board/freescale/common/fsl_chain_of_trust.c
> +++ b/board/freescale/common/fsl_chain_of_trust.c
> @@ -51,3 +51,20 @@ int fsl_check_boot_mode_secure(void)  #endif
>  	return 0;
>  }
> +
> +int fsl_setenv_chain_of_trust(void)
> +{
> +	/* Check Boot Mode
> +	 * If Boot Mode is Non-Secure, no changes are required
> +	 */
> +	if (fsl_check_boot_mode_secure() == 0)
> +		return 0;
> +
> +	/* If Boot mode is Secure, set the environment variables
> +	 * bootdelay = 0 (To disable Boot Prompt)
> +	 * bootcmd = CONFIG_CHAIN_BOOT_CMD (Validate and execute
> Boot script)
> +	 */
> +	setenv("bootdelay", "0");
> +	setenv("bootcmd", CONFIG_CHAIN_BOOT_CMD);
> +	return 0;
> +}
> diff --git a/board/freescale/ls1021aqds/ls1021aqds.c
> b/board/freescale/ls1021aqds/ls1021aqds.c
> index ca1ea61..6e82232 100644
> --- a/board/freescale/ls1021aqds/ls1021aqds.c
> +++ b/board/freescale/ls1021aqds/ls1021aqds.c
> @@ -22,6 +22,7 @@
>  #include <fsl_sec.h>
>  #include <spl.h>
>  #include <fsl_devdis.h>
> +#include <fsl_validate.h>
> 
>  #include "../common/sleep.h"
>  #include "../common/qixis.h"
> @@ -369,6 +370,9 @@ int board_late_init(void)  #ifdef
> CONFIG_SCSI_AHCI_PLAT
>  	ls1021a_sata_init();
>  #endif
> +#ifdef CONFIG_CHAIN_OF_TRUST
> +	fsl_setenv_chain_of_trust();
> +#endif
> 
>  	return 0;
>  }
> diff --git a/board/freescale/ls1021atwr/ls1021atwr.c
> b/board/freescale/ls1021atwr/ls1021atwr.c
> index ae62bca..054cc3d 100644
> --- a/board/freescale/ls1021atwr/ls1021atwr.c
> +++ b/board/freescale/ls1021atwr/ls1021atwr.c
> @@ -30,6 +30,7 @@
>  #ifdef CONFIG_U_QE
>  #include "../../../drivers/qe/qe.h"
>  #endif
> +#include <fsl_validate.h>
> 
> 
>  DECLARE_GLOBAL_DATA_PTR;
> @@ -553,6 +554,9 @@ int board_late_init(void)  #ifdef
> CONFIG_SCSI_AHCI_PLAT
>  	ls1021a_sata_init();
>  #endif
> +#ifdef CONFIG_CHAIN_OF_TRUST
> +	fsl_setenv_chain_of_trust();
> +#endif
> 
>  	return 0;
>  }
> diff --git a/include/fsl_validate.h b/include/fsl_validate.h index
> ad14867..83efcf4 100644
> --- a/include/fsl_validate.h
> +++ b/include/fsl_validate.h
> @@ -205,4 +205,6 @@ int fsl_secboot_blob_encap(cmd_tbl_t *cmdtp, int
> flag, int argc,  int fsl_secboot_blob_decap(cmd_tbl_t *cmdtp, int flag, int
> argc,
>  	char * const argv[]);
> 
> +int fsl_check_boot_mode_secure(void);
> +int fsl_setenv_chain_of_trust(void);
>  #endif
> --
> 1.8.1.4
Acked-by: Ruchika Gupta <ruchika.gupta at nxp.com>