MLK-18129-2 imx8qxp: Add secure boot environment

Add the secure boot relevant environment variables to ARM2 and MEK.
When CONFIG_AHAB_BOOT is enabled, we will switch to boot in this
new way:
1. Load the OS container to address 0x98000000
2. Using auth_cntr to authenticate the OS container. It will load the
   kernel and FDT to destination address.
3. Using booti to boot kernel.

Signed-off-by: Ye Li <ye.li@nxp.com>
Acked-by: Peng Fan <peng.fan@nxp.com>
(cherry picked from commit 545c8fe112244f20377e97921389c86eacc8551f)
(cherry picked from commit cba5acebbe6be0736f229ef719b1a1e5835e1a5f)

diff --git a/board/freescale/imx8qxp_arm2/imx8qxp_arm2.c b/board/freescale/imx8qxp_arm2/imx8qxp_arm2.c
index 0dca6ae..8164e77 100644 (file)
--- a/board/freescale/imx8qxp_arm2/imx8qxp_arm2.c
+++ b/board/freescale/imx8qxp_arm2/imx8qxp_arm2.c
@@ -606,6 +606,11 @@ int board_late_init(void)
        env_set("board_rev", "iMX8QXP");
 #endif
 
+       env_set("sec_boot", "no");
+#ifdef CONFIG_AHAB_BOOT
+       env_set("sec_boot", "yes");
+#endif
+
        return 0;
 }
 

diff --git a/board/freescale/imx8qxp_mek/imx8qxp_mek.c b/board/freescale/imx8qxp_mek/imx8qxp_mek.c
index 87b4d3a..9c5e248 100644 (file)
--- a/board/freescale/imx8qxp_mek/imx8qxp_mek.c
+++ b/board/freescale/imx8qxp_mek/imx8qxp_mek.c
@@ -487,6 +487,11 @@ int board_late_init(void)
        env_set("board_rev", "iMX8QXP");
 #endif
 
+       env_set("sec_boot", "no");
+#ifdef CONFIG_AHAB_BOOT
+       env_set("sec_boot", "yes");
+#endif
+
        return 0;
 }
 

diff --git a/include/configs/imx8qxp_arm2.h b/include/configs/imx8qxp_arm2.h
index c2adc73..8863f89 100644 (file)
--- a/include/configs/imx8qxp_arm2.h
+++ b/include/configs/imx8qxp_arm2.h
@@ -99,6 +99,12 @@
 #define CONFIG_MAX7322_I2C_BUS         0 /* I2C1 */
 #endif
 
+#ifdef CONFIG_AHAB_BOOT
+#define AHAB_ENV "sec_boot=yes\0"
+#else
+#define AHAB_ENV "sec_boot=no\0"
+#endif
+
 /* Boot M4 */
 #define M4_BOOT_ENV \
        "m4_0_image=m4_0.bin\0" \
@@ -122,6 +128,7 @@
 #else
 #define CONFIG_EXTRA_ENV_SETTINGS              \
        M4_BOOT_ENV \
+       AHAB_ENV \
        "script=boot.scr\0" \
        "image=Image\0" \
        "panel=NULL\0" \
@@ -129,6 +136,8 @@
        "earlycon=lpuart32,0x5a060000\0" \
        "fdt_addr=0x83000000\0"                 \
        "fdt_high=0xffffffffffffffff\0"         \
+       "cntr_addr=0x98000000\0"                        \
+       "cntr_file=os_cntr_signed.bin\0" \
        "boot_fdt=try\0" \
        "fdt_file=" CONFIG_DEFAULT_FDT_FILE "\0" \
        "initrd_addr=0x83100000\0" \
@@ -143,16 +152,26 @@
                "source\0" \
        "loadimage=fatload mmc ${mmcdev}:${mmcpart} ${loadaddr} ${image}\0" \
        "loadfdt=fatload mmc ${mmcdev}:${mmcpart} ${fdt_addr} ${fdt_file}\0" \
+       "loadcntr=fatload mmc ${mmcdev}:${mmcpart} ${cntr_addr} ${cntr_file}\0" \
+       "auth_os=auth_cntr ${cntr_addr}\0" \
        "mmcboot=echo Booting from mmc ...; " \
                "run mmcargs; " \
-               "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
-                       "if run loadfdt; then " \
+               "if test ${sec_boot} = yes; then " \
+                       "if run auth_os; then " \
                                "booti ${loadaddr} - ${fdt_addr}; " \
                        "else " \
-                               "echo WARN: Cannot load the DT; " \
+                               "echo ERR: failed to authenticate; " \
                        "fi; " \
                "else " \
-                       "echo wait for boot; " \
+                       "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
+                               "if run loadfdt; then " \
+                                       "booti ${loadaddr} - ${fdt_addr}; " \
+                               "else " \
+                                       "echo WARN: Cannot load the DT; " \
+                               "fi; " \
+                       "else " \
+                               "echo wait for boot; " \
+                       "fi;" \
                "fi;\0" \
        "netargs=setenv bootargs console=${console},${baudrate} earlycon=${earlycon},${baudrate} " \
                "root=/dev/nfs " \
@@ -164,15 +183,24 @@
                "else " \
                        "setenv get_cmd tftp; " \
                "fi; " \
-               "${get_cmd} ${loadaddr} ${image}; " \
-               "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
-                       "if ${get_cmd} ${fdt_addr} ${fdt_file}; then " \
+               "if test ${sec_boot} = yes; then " \
+                       "${get_cmd} ${cntr_addr} ${cntr_file}; " \
+                       "if run auth_os; then " \
                                "booti ${loadaddr} - ${fdt_addr}; " \
                        "else " \
-                               "echo WARN: Cannot load the DT; " \
+                               "echo ERR: failed to authenticate; " \
                        "fi; " \
                "else " \
-                       "booti; " \
+                       "${get_cmd} ${loadaddr} ${image}; " \
+                       "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
+                               "if ${get_cmd} ${fdt_addr} ${fdt_file}; then " \
+                                       "booti ${loadaddr} - ${fdt_addr}; " \
+                               "else " \
+                                       "echo WARN: Cannot load the DT; " \
+                               "fi; " \
+                       "else " \
+                               "booti; " \
+                       "fi;" \
                "fi;\0"
 #endif
 
@@ -187,10 +215,17 @@
                   "if run loadbootscript; then " \
                           "run bootscript; " \
                   "else " \
-                          "if run loadimage; then " \
-                                  "run mmcboot; " \
-                          "else run netboot; " \
-                          "fi; " \
+                          "if test ${sec_boot} = yes; then " \
+                                  "if run loadcntr; then " \
+                                          "run mmcboot; " \
+                                  "else run netboot; " \
+                                  "fi; " \
+                           "else " \
+                                  "if run loadimage; then " \
+                                          "run mmcboot; " \
+                                  "else run netboot; " \
+                                  "fi; " \
+                        "fi; " \
                   "fi; " \
           "else booti ${loadaddr} - ${fdt_addr}; fi"
 #endif

diff --git a/include/configs/imx8qxp_mek.h b/include/configs/imx8qxp_mek.h
index 35e45d5..32e7de6 100644 (file)
--- a/include/configs/imx8qxp_mek.h
+++ b/include/configs/imx8qxp_mek.h
@@ -73,6 +73,12 @@
 
 #define CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG
 
+#ifdef CONFIG_AHAB_BOOT
+#define AHAB_ENV "sec_boot=yes\0"
+#else
+#define AHAB_ENV "sec_boot=no\0"
+#endif
+
 /* Boot M4 */
 #define M4_BOOT_ENV \
        "m4_0_image=m4_0.bin\0" \
@@ -111,6 +117,7 @@
 #define CONFIG_EXTRA_ENV_SETTINGS              \
        M4_BOOT_ENV \
        XEN_BOOT_ENV \
+       AHAB_ENV \
        "script=boot.scr\0" \
        "image=Image\0" \
        "panel=NULL\0" \
@@ -118,6 +125,8 @@
        "earlycon=lpuart32,0x5a060000\0" \
        "fdt_addr=0x83000000\0"                 \
        "fdt_high=0xffffffffffffffff\0"         \
+       "cntr_addr=0x98000000\0"                        \
+       "cntr_file=os_cntr_signed.bin\0" \
        "boot_fdt=try\0" \
        "fdt_file=fsl-imx8qxp-mek.dtb\0" \
        "initrd_addr=0x83100000\0" \
@@ -132,16 +141,26 @@
                "source\0" \
        "loadimage=fatload mmc ${mmcdev}:${mmcpart} ${loadaddr} ${image}\0" \
        "loadfdt=fatload mmc ${mmcdev}:${mmcpart} ${fdt_addr} ${fdt_file}\0" \
+       "loadcntr=fatload mmc ${mmcdev}:${mmcpart} ${cntr_addr} ${cntr_file}\0" \
+       "auth_os=auth_cntr ${cntr_addr}\0" \
        "mmcboot=echo Booting from mmc ...; " \
                "run mmcargs; " \
-               "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
-                       "if run loadfdt; then " \
+               "if test ${sec_boot} = yes; then " \
+                       "if run auth_os; then " \
                                "booti ${loadaddr} - ${fdt_addr}; " \
                        "else " \
-                               "echo WARN: Cannot load the DT; " \
+                               "echo ERR: failed to authenticate; " \
                        "fi; " \
                "else " \
-                       "echo wait for boot; " \
+                       "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
+                               "if run loadfdt; then " \
+                                       "booti ${loadaddr} - ${fdt_addr}; " \
+                               "else " \
+                                       "echo WARN: Cannot load the DT; " \
+                               "fi; " \
+                       "else " \
+                               "echo wait for boot; " \
+                       "fi;" \
                "fi;\0" \
        "netargs=setenv bootargs console=${console},${baudrate} earlycon=${earlycon},${baudrate} " \
                "root=/dev/nfs " \
@@ -153,15 +172,24 @@
                "else " \
                        "setenv get_cmd tftp; " \
                "fi; " \
-               "${get_cmd} ${loadaddr} ${image}; " \
-               "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
-                       "if ${get_cmd} ${fdt_addr} ${fdt_file}; then " \
+               "if test ${sec_boot} = yes; then " \
+                       "${get_cmd} ${cntr_addr} ${cntr_file}; " \
+                       "if run auth_os; then " \
                                "booti ${loadaddr} - ${fdt_addr}; " \
                        "else " \
-                               "echo WARN: Cannot load the DT; " \
+                               "echo ERR: failed to authenticate; " \
                        "fi; " \
                "else " \
-                       "booti; " \
+                       "${get_cmd} ${loadaddr} ${image}; " \
+                       "if test ${boot_fdt} = yes || test ${boot_fdt} = try; then " \
+                               "if ${get_cmd} ${fdt_addr} ${fdt_file}; then " \
+                                       "booti ${loadaddr} - ${fdt_addr}; " \
+                               "else " \
+                                       "echo WARN: Cannot load the DT; " \
+                               "fi; " \
+                       "else " \
+                               "booti; " \
+                       "fi;" \
                "fi;\0"
 
 #define CONFIG_BOOTCOMMAND \
@@ -169,10 +197,17 @@
                   "if run loadbootscript; then " \
                           "run bootscript; " \
                   "else " \
-                          "if run loadimage; then " \
-                                  "run mmcboot; " \
-                          "else run netboot; " \
-                          "fi; " \
+                          "if test ${sec_boot} = yes; then " \
+                                  "if run loadcntr; then " \
+                                          "run mmcboot; " \
+                                  "else run netboot; " \
+                                  "fi; " \
+                           "else " \
+                                  "if run loadimage; then " \
+                                          "run mmcboot; " \
+                                  "else run netboot; " \
+                                  "fi; " \
+                        "fi; " \
                   "fi; " \
           "else booti ${loadaddr} - ${fdt_addr}; fi"