diff mbox series

[U-Boot,RFC,06/15] secure boot: rename CONFIG_SECURE_BOOT

Message ID 20190918012643.25192-7-takahiro.akashi@linaro.org
State RFC
Delegated to: Heinrich Schuchardt
Headers show
Series efi_loader: add secure boot support | expand

Commit Message

AKASHI Takahiro Sept. 18, 2019, 1:26 a.m. UTC 
The configuration, CONFIG_SECURE_BOOT, was scattered among different
architecture directories for different implementation. This will prevent
UEFI secure boot from being added later.

So let's rename them, giving each implementation to different
configuration option. CONFIG_SECURE_BOOT still remains not to break
existing implicit dependency.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
---
 Kconfig                                   | 7 +++++++
 arch/arm/cpu/armv7/ls102xa/Kconfig        | 3 ++-
 arch/arm/cpu/armv8/fsl-layerscape/Kconfig | 3 ++-
 arch/arm/mach-imx/Kconfig                 | 3 ++-
 arch/powerpc/cpu/mpc85xx/Kconfig          | 3 ++-
 5 files changed, 15 insertions(+), 4 deletions(-)

Comments

Tom Rini Sept. 19, 2019, 3:02 p.m. UTC | #1 
On Wed, Sep 18, 2019 at 10:26:34AM +0900, AKASHI Takahiro wrote:

> The configuration, CONFIG_SECURE_BOOT, was scattered among different
> architecture directories for different implementation. This will prevent
> UEFI secure boot from being added later.
> 
> So let's rename them, giving each implementation to different
> configuration option. CONFIG_SECURE_BOOT still remains not to break
> existing implicit dependency.
> 
> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
> ---
>  Kconfig                                   | 7 +++++++
>  arch/arm/cpu/armv7/ls102xa/Kconfig        | 3 ++-
>  arch/arm/cpu/armv8/fsl-layerscape/Kconfig | 3 ++-
>  arch/arm/mach-imx/Kconfig                 | 3 ++-
>  arch/powerpc/cpu/mpc85xx/Kconfig          | 3 ++-
>  5 files changed, 15 insertions(+), 4 deletions(-)
> 
> diff --git a/Kconfig b/Kconfig
> index 1f0904f7045e..c11fc102a7d4 100644
> --- a/Kconfig
> +++ b/Kconfig
> @@ -282,6 +282,13 @@ config SYS_LDSCRIPT
>  
>  endmenu		# General setup
>  
> +config SECURE_BOOT
> +	bool "Secure Boot"
> +	imply SHA256
> +	help
> +	  Enable Secure Boot feature. The actual behavior may vary
> +	  from architecture to architecture.
> +
>  menu "Boot images"
>  
>  config ANDROID_BOOT_IMAGE
> diff --git a/arch/arm/cpu/armv7/ls102xa/Kconfig b/arch/arm/cpu/armv7/ls102xa/Kconfig
> index 94fa68250ddf..ce1bc580d23d 100644
> --- a/arch/arm/cpu/armv7/ls102xa/Kconfig
> +++ b/arch/arm/cpu/armv7/ls102xa/Kconfig
> @@ -50,8 +50,9 @@ config MAX_CPUS
>  	  cores, count the reserved ports. This will allocate enough memory
>  	  in spin table to properly handle all cores.
>  
> -config SECURE_BOOT
> +config FSL_ARMV7_ENABLE_SECURE_BOOT
>  	bool	"Secure Boot"
> +	depends on SECURE_BOOT
>  	help
>  		Enable Freescale Secure Boot feature. Normally selected
>  		by defconfig. If unsure, do not change.
> diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
> index 42d31fdab0a0..d4cfe31f8ebf 100644
> --- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
> +++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
> @@ -383,8 +383,9 @@ config EMC2305
>  	 Enable the EMC2305 fan controller for configuration of fan
>  	 speed.
>  
> -config SECURE_BOOT
> +config FSI_ARMV8_ENABLE_SECURE_BOOT
>  	bool "Secure Boot"
> +	depends on SECURE_BOOT
>  	help
>  		Enable Freescale Secure Boot feature
>  
> diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
> index aeb54934888d..e1602fd5f0e8 100644
> --- a/arch/arm/mach-imx/Kconfig
> +++ b/arch/arm/mach-imx/Kconfig
> @@ -34,8 +34,9 @@ config USE_IMXIMG_PLUGIN
>  	  i.MX6/7 supports DCD and Plugin. Enable this configuration
>  	  to use Plugin, otherwise DCD will be used.
>  
> -config SECURE_BOOT
> +config FSL_IMX_ENABLE_SECURE_BOOT
>  	bool "Support i.MX HAB features"
> +	depends on SECURE_BOOT
>  	depends on ARCH_MX7 || ARCH_MX6 || ARCH_MX5
>  	select FSL_CAAM if HAS_CAAM
>  	imply CMD_DEKBLOB
> diff --git a/arch/powerpc/cpu/mpc85xx/Kconfig b/arch/powerpc/cpu/mpc85xx/Kconfig
> index c038a6ddb0f4..9cf6ebbfe3ce 100644
> --- a/arch/powerpc/cpu/mpc85xx/Kconfig
> +++ b/arch/powerpc/cpu/mpc85xx/Kconfig
> @@ -1208,8 +1208,9 @@ config FSL_LAW
>  	help
>  		Use Freescale common code for Local Access Window
>  
> -config SECURE_BOOT
> +config FSL_MPC_ENABLE_SECURE_BOOT
>  	bool	"Secure Boot"
> +	depends on SECURE_BOOT
>  	help
>  		Enable Freescale Secure Boot feature. Normally selected
>  		by defconfig. If unsure, do not change.

I've added Priyanka Jain to the thread as the custodian for PowerPC and
NXP stuff and Stefano Babic as the custodian for i.MX stuff.  I don't
want to see "CONFIG_SECURE_BOOT" continue on as a config option, it's
too broad.  Can we please rename and update the existing NXP CONFIG
option (and I assume split it into a few ones to reflect better where
things really changed fundamentally from one SoC/arch to the next) and
update the help text?  Thanks!
Stefano Babic Sept. 19, 2019, 3:10 p.m. UTC | #2 
On 19/09/19 17:02, Tom Rini wrote:
> On Wed, Sep 18, 2019 at 10:26:34AM +0900, AKASHI Takahiro wrote:
> 
>> The configuration, CONFIG_SECURE_BOOT, was scattered among different
>> architecture directories for different implementation. This will prevent
>> UEFI secure boot from being added later.
>>
>> So let's rename them, giving each implementation to different
>> configuration option. CONFIG_SECURE_BOOT still remains not to break
>> existing implicit dependency.
>>
>> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
>> ---
>>  Kconfig                                   | 7 +++++++
>>  arch/arm/cpu/armv7/ls102xa/Kconfig        | 3 ++-
>>  arch/arm/cpu/armv8/fsl-layerscape/Kconfig | 3 ++-
>>  arch/arm/mach-imx/Kconfig                 | 3 ++-
>>  arch/powerpc/cpu/mpc85xx/Kconfig          | 3 ++-
>>  5 files changed, 15 insertions(+), 4 deletions(-)
>>
>> diff --git a/Kconfig b/Kconfig
>> index 1f0904f7045e..c11fc102a7d4 100644
>> --- a/Kconfig
>> +++ b/Kconfig
>> @@ -282,6 +282,13 @@ config SYS_LDSCRIPT
>>  
>>  endmenu		# General setup
>>  
>> +config SECURE_BOOT
>> +	bool "Secure Boot"
>> +	imply SHA256
>> +	help
>> +	  Enable Secure Boot feature. The actual behavior may vary
>> +	  from architecture to architecture.
>> +
>>  menu "Boot images"
>>  
>>  config ANDROID_BOOT_IMAGE
>> diff --git a/arch/arm/cpu/armv7/ls102xa/Kconfig b/arch/arm/cpu/armv7/ls102xa/Kconfig
>> index 94fa68250ddf..ce1bc580d23d 100644
>> --- a/arch/arm/cpu/armv7/ls102xa/Kconfig
>> +++ b/arch/arm/cpu/armv7/ls102xa/Kconfig
>> @@ -50,8 +50,9 @@ config MAX_CPUS
>>  	  cores, count the reserved ports. This will allocate enough memory
>>  	  in spin table to properly handle all cores.
>>  
>> -config SECURE_BOOT
>> +config FSL_ARMV7_ENABLE_SECURE_BOOT
>>  	bool	"Secure Boot"
>> +	depends on SECURE_BOOT
>>  	help
>>  		Enable Freescale Secure Boot feature. Normally selected
>>  		by defconfig. If unsure, do not change.
>> diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>> index 42d31fdab0a0..d4cfe31f8ebf 100644
>> --- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>> +++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>> @@ -383,8 +383,9 @@ config EMC2305
>>  	 Enable the EMC2305 fan controller for configuration of fan
>>  	 speed.
>>  
>> -config SECURE_BOOT
>> +config FSI_ARMV8_ENABLE_SECURE_BOOT
>>  	bool "Secure Boot"
>> +	depends on SECURE_BOOT
>>  	help
>>  		Enable Freescale Secure Boot feature
>>  
>> diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
>> index aeb54934888d..e1602fd5f0e8 100644
>> --- a/arch/arm/mach-imx/Kconfig
>> +++ b/arch/arm/mach-imx/Kconfig
>> @@ -34,8 +34,9 @@ config USE_IMXIMG_PLUGIN
>>  	  i.MX6/7 supports DCD and Plugin. Enable this configuration
>>  	  to use Plugin, otherwise DCD will be used.
>>  
>> -config SECURE_BOOT
>> +config FSL_IMX_ENABLE_SECURE_BOOT
>>  	bool "Support i.MX HAB features"
>> +	depends on SECURE_BOOT
>>  	depends on ARCH_MX7 || ARCH_MX6 || ARCH_MX5
>>  	select FSL_CAAM if HAS_CAAM
>>  	imply CMD_DEKBLOB
>> diff --git a/arch/powerpc/cpu/mpc85xx/Kconfig b/arch/powerpc/cpu/mpc85xx/Kconfig
>> index c038a6ddb0f4..9cf6ebbfe3ce 100644
>> --- a/arch/powerpc/cpu/mpc85xx/Kconfig
>> +++ b/arch/powerpc/cpu/mpc85xx/Kconfig
>> @@ -1208,8 +1208,9 @@ config FSL_LAW
>>  	help
>>  		Use Freescale common code for Local Access Window
>>  
>> -config SECURE_BOOT
>> +config FSL_MPC_ENABLE_SECURE_BOOT
>>  	bool	"Secure Boot"
>> +	depends on SECURE_BOOT
>>  	help
>>  		Enable Freescale Secure Boot feature. Normally selected
>>  		by defconfig. If unsure, do not change.
> 
> I've added Priyanka Jain to the thread as the custodian for PowerPC and
> NXP stuff and Stefano Babic as the custodian for i.MX stuff.  I don't
> want to see "CONFIG_SECURE_BOOT" continue on as a config option, it's
> too broad.  Can we please rename and update the existing NXP CONFIG
> option (and I assume split it into a few ones to reflect better where
> things really changed fundamentally from one SoC/arch to the next) and
> update the help text?  Thanks!

Sure - SECURE_BOOT for NXP means enabling HAB, a config can be rename to
identify the component itself (CONFIG_HAB for example).

Regards,
Stefano
Priyanka Jain Sept. 25, 2019, 4:19 a.m. UTC | #3 
>-----Original Message-----
>From: Stefano Babic <sbabic@denx.de>
>Sent: Thursday, September 19, 2019 8:40 PM
>To: Tom Rini <trini@konsulko.com>; AKASHI Takahiro
><takahiro.akashi@linaro.org>; Priyanka Jain <priyanka.jain@nxp.com>;
>Stefano Babic <sbabic@denx.de>
>Cc: xypron.glpk@gmx.de; agraf@csgraf.de; u-boot@lists.denx.de
>Subject: Re: [U-Boot] [RFC 06/15] secure boot: rename CONFIG_SECURE_BOOT
>
>On 19/09/19 17:02, Tom Rini wrote:
>> On Wed, Sep 18, 2019 at 10:26:34AM +0900, AKASHI Takahiro wrote:
>>
>>> The configuration, CONFIG_SECURE_BOOT, was scattered among different
>>> architecture directories for different implementation. This will
>>> prevent UEFI secure boot from being added later.
>>>
>>> So let's rename them, giving each implementation to different
>>> configuration option. CONFIG_SECURE_BOOT still remains not to break
>>> existing implicit dependency.
>>>
>>> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
>>> ---
>>>  Kconfig                                   | 7 +++++++
>>>  arch/arm/cpu/armv7/ls102xa/Kconfig        | 3 ++-
>>>  arch/arm/cpu/armv8/fsl-layerscape/Kconfig | 3 ++-
>>>  arch/arm/mach-imx/Kconfig                 | 3 ++-
>>>  arch/powerpc/cpu/mpc85xx/Kconfig          | 3 ++-
>>>  5 files changed, 15 insertions(+), 4 deletions(-)
>>>
>>> diff --git a/Kconfig b/Kconfig
>>> index 1f0904f7045e..c11fc102a7d4 100644
>>> --- a/Kconfig
>>> +++ b/Kconfig
>>> @@ -282,6 +282,13 @@ config SYS_LDSCRIPT
>>>
>>>  endmenu		# General setup
>>>
>>> +config SECURE_BOOT
>>> +	bool "Secure Boot"
>>> +	imply SHA256
>>> +	help
>>> +	  Enable Secure Boot feature. The actual behavior may vary
>>> +	  from architecture to architecture.
>>> +
>>>  menu "Boot images"
>>>
>>>  config ANDROID_BOOT_IMAGE
>>> diff --git a/arch/arm/cpu/armv7/ls102xa/Kconfig
>>> b/arch/arm/cpu/armv7/ls102xa/Kconfig
>>> index 94fa68250ddf..ce1bc580d23d 100644
>>> --- a/arch/arm/cpu/armv7/ls102xa/Kconfig
>>> +++ b/arch/arm/cpu/armv7/ls102xa/Kconfig
>>> @@ -50,8 +50,9 @@ config MAX_CPUS
>>>  	  cores, count the reserved ports. This will allocate enough memory
>>>  	  in spin table to properly handle all cores.
>>>
>>> -config SECURE_BOOT
>>> +config FSL_ARMV7_ENABLE_SECURE_BOOT
>>>  	bool	"Secure Boot"
>>> +	depends on SECURE_BOOT
>>>  	help
>>>  		Enable Freescale Secure Boot feature. Normally selected
>>>  		by defconfig. If unsure, do not change.
>>> diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>>> b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>>> index 42d31fdab0a0..d4cfe31f8ebf 100644
>>> --- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>>> +++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>>> @@ -383,8 +383,9 @@ config EMC2305
>>>  	 Enable the EMC2305 fan controller for configuration of fan
>>>  	 speed.
>>>
>>> -config SECURE_BOOT
>>> +config FSI_ARMV8_ENABLE_SECURE_BOOT
>>>  	bool "Secure Boot"
>>> +	depends on SECURE_BOOT
>>>  	help
>>>  		Enable Freescale Secure Boot feature
>>>
>>> diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
>>> index aeb54934888d..e1602fd5f0e8 100644
>>> --- a/arch/arm/mach-imx/Kconfig
>>> +++ b/arch/arm/mach-imx/Kconfig
>>> @@ -34,8 +34,9 @@ config USE_IMXIMG_PLUGIN
>>>  	  i.MX6/7 supports DCD and Plugin. Enable this configuration
>>>  	  to use Plugin, otherwise DCD will be used.
>>>
>>> -config SECURE_BOOT
>>> +config FSL_IMX_ENABLE_SECURE_BOOT
>>>  	bool "Support i.MX HAB features"
>>> +	depends on SECURE_BOOT
>>>  	depends on ARCH_MX7 || ARCH_MX6 || ARCH_MX5
>>>  	select FSL_CAAM if HAS_CAAM
>>>  	imply CMD_DEKBLOB
>>> diff --git a/arch/powerpc/cpu/mpc85xx/Kconfig
>>> b/arch/powerpc/cpu/mpc85xx/Kconfig
>>> index c038a6ddb0f4..9cf6ebbfe3ce 100644
>>> --- a/arch/powerpc/cpu/mpc85xx/Kconfig
>>> +++ b/arch/powerpc/cpu/mpc85xx/Kconfig
>>> @@ -1208,8 +1208,9 @@ config FSL_LAW
>>>  	help
>>>  		Use Freescale common code for Local Access Window
>>>
>>> -config SECURE_BOOT
>>> +config FSL_MPC_ENABLE_SECURE_BOOT
>>>  	bool	"Secure Boot"
>>> +	depends on SECURE_BOOT
>>>  	help
>>>  		Enable Freescale Secure Boot feature. Normally selected
>>>  		by defconfig. If unsure, do not change.
>>
>> I've added Priyanka Jain to the thread as the custodian for PowerPC
>> and NXP stuff and Stefano Babic as the custodian for i.MX stuff.  I
>> don't want to see "CONFIG_SECURE_BOOT" continue on as a config option,
>> it's too broad.  Can we please rename and update the existing NXP
>> CONFIG option (and I assume split it into a few ones to reflect better
>> where things really changed fundamentally from one SoC/arch to the
>> next) and update the help text?  Thanks!
>
>Sure - SECURE_BOOT for NXP means enabling HAB, a config can be rename to
>identify the component itself (CONFIG_HAB for example).
>
>Regards,
>Stefano
>
Sure, We will look into this and update NXP CONFIG_SECURE_BOOT option.
Priyanka
>
>--
>================================================================
>=====
>DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
>HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
>Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic@denx.de
>================================================================
>=====
AKASHI Takahiro Oct. 29, 2019, 5:19 a.m. UTC | #4 
Priyanka, Stefano and Tom,

On Wed, Sep 25, 2019 at 04:19:43AM +0000, Priyanka Jain wrote:
> 
> 
> >-----Original Message-----
> >From: Stefano Babic <sbabic@denx.de>
> >Sent: Thursday, September 19, 2019 8:40 PM
> >To: Tom Rini <trini@konsulko.com>; AKASHI Takahiro
> ><takahiro.akashi@linaro.org>; Priyanka Jain <priyanka.jain@nxp.com>;
> >Stefano Babic <sbabic@denx.de>
> >Cc: xypron.glpk@gmx.de; agraf@csgraf.de; u-boot@lists.denx.de
> >Subject: Re: [U-Boot] [RFC 06/15] secure boot: rename CONFIG_SECURE_BOOT
> >
> >On 19/09/19 17:02, Tom Rini wrote:
> >> On Wed, Sep 18, 2019 at 10:26:34AM +0900, AKASHI Takahiro wrote:
> >>
> >>> The configuration, CONFIG_SECURE_BOOT, was scattered among different
> >>> architecture directories for different implementation. This will
> >>> prevent UEFI secure boot from being added later.
> >>>
> >>> So let's rename them, giving each implementation to different
> >>> configuration option. CONFIG_SECURE_BOOT still remains not to break
> >>> existing implicit dependency.
> >>>
> >>> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
> >>> ---
> >>>  Kconfig                                   | 7 +++++++
> >>>  arch/arm/cpu/armv7/ls102xa/Kconfig        | 3 ++-
> >>>  arch/arm/cpu/armv8/fsl-layerscape/Kconfig | 3 ++-
> >>>  arch/arm/mach-imx/Kconfig                 | 3 ++-
> >>>  arch/powerpc/cpu/mpc85xx/Kconfig          | 3 ++-
> >>>  5 files changed, 15 insertions(+), 4 deletions(-)
> >>>
> >>> diff --git a/Kconfig b/Kconfig
> >>> index 1f0904f7045e..c11fc102a7d4 100644
> >>> --- a/Kconfig
> >>> +++ b/Kconfig
> >>> @@ -282,6 +282,13 @@ config SYS_LDSCRIPT
> >>>
> >>>  endmenu		# General setup
> >>>
> >>> +config SECURE_BOOT
> >>> +	bool "Secure Boot"
> >>> +	imply SHA256
> >>> +	help
> >>> +	  Enable Secure Boot feature. The actual behavior may vary
> >>> +	  from architecture to architecture.
> >>> +
> >>>  menu "Boot images"
> >>>
> >>>  config ANDROID_BOOT_IMAGE
> >>> diff --git a/arch/arm/cpu/armv7/ls102xa/Kconfig
> >>> b/arch/arm/cpu/armv7/ls102xa/Kconfig
> >>> index 94fa68250ddf..ce1bc580d23d 100644
> >>> --- a/arch/arm/cpu/armv7/ls102xa/Kconfig
> >>> +++ b/arch/arm/cpu/armv7/ls102xa/Kconfig
> >>> @@ -50,8 +50,9 @@ config MAX_CPUS
> >>>  	  cores, count the reserved ports. This will allocate enough memory
> >>>  	  in spin table to properly handle all cores.
> >>>
> >>> -config SECURE_BOOT
> >>> +config FSL_ARMV7_ENABLE_SECURE_BOOT
> >>>  	bool	"Secure Boot"
> >>> +	depends on SECURE_BOOT
> >>>  	help
> >>>  		Enable Freescale Secure Boot feature. Normally selected
> >>>  		by defconfig. If unsure, do not change.
> >>> diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
> >>> b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
> >>> index 42d31fdab0a0..d4cfe31f8ebf 100644
> >>> --- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
> >>> +++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
> >>> @@ -383,8 +383,9 @@ config EMC2305
> >>>  	 Enable the EMC2305 fan controller for configuration of fan
> >>>  	 speed.
> >>>
> >>> -config SECURE_BOOT
> >>> +config FSI_ARMV8_ENABLE_SECURE_BOOT
> >>>  	bool "Secure Boot"
> >>> +	depends on SECURE_BOOT
> >>>  	help
> >>>  		Enable Freescale Secure Boot feature
> >>>
> >>> diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
> >>> index aeb54934888d..e1602fd5f0e8 100644
> >>> --- a/arch/arm/mach-imx/Kconfig
> >>> +++ b/arch/arm/mach-imx/Kconfig
> >>> @@ -34,8 +34,9 @@ config USE_IMXIMG_PLUGIN
> >>>  	  i.MX6/7 supports DCD and Plugin. Enable this configuration
> >>>  	  to use Plugin, otherwise DCD will be used.
> >>>
> >>> -config SECURE_BOOT
> >>> +config FSL_IMX_ENABLE_SECURE_BOOT
> >>>  	bool "Support i.MX HAB features"
> >>> +	depends on SECURE_BOOT
> >>>  	depends on ARCH_MX7 || ARCH_MX6 || ARCH_MX5
> >>>  	select FSL_CAAM if HAS_CAAM
> >>>  	imply CMD_DEKBLOB
> >>> diff --git a/arch/powerpc/cpu/mpc85xx/Kconfig
> >>> b/arch/powerpc/cpu/mpc85xx/Kconfig
> >>> index c038a6ddb0f4..9cf6ebbfe3ce 100644
> >>> --- a/arch/powerpc/cpu/mpc85xx/Kconfig
> >>> +++ b/arch/powerpc/cpu/mpc85xx/Kconfig
> >>> @@ -1208,8 +1208,9 @@ config FSL_LAW
> >>>  	help
> >>>  		Use Freescale common code for Local Access Window
> >>>
> >>> -config SECURE_BOOT
> >>> +config FSL_MPC_ENABLE_SECURE_BOOT
> >>>  	bool	"Secure Boot"
> >>> +	depends on SECURE_BOOT
> >>>  	help
> >>>  		Enable Freescale Secure Boot feature. Normally selected
> >>>  		by defconfig. If unsure, do not change.
> >>
> >> I've added Priyanka Jain to the thread as the custodian for PowerPC
> >> and NXP stuff and Stefano Babic as the custodian for i.MX stuff.  I
> >> don't want to see "CONFIG_SECURE_BOOT" continue on as a config option,
> >> it's too broad.  Can we please rename and update the existing NXP
> >> CONFIG option (and I assume split it into a few ones to reflect better
> >> where things really changed fundamentally from one SoC/arch to the
> >> next) and update the help text?  Thanks!
> >
> >Sure - SECURE_BOOT for NXP means enabling HAB, a config can be rename to
> >identify the component itself (CONFIG_HAB for example).
> >
> >Regards,
> >Stefano
> >
> Sure, We will look into this and update NXP CONFIG_SECURE_BOOT option.
> Priyanka

Can we expect this re-work on NXP/Freescal platforms to be done
in the current release cycle, that is v2020.01?

If not, can I continue to use my match[1] as part of my UEFI secure boot
patch set for the time being?

  [1] https://lists.denx.de/pipermail/u-boot/2019-September/383908.html

Thanks,
-Takahiro Akashi


> >
> >--
> >================================================================
> >=====
> >DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
> >HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
> >Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic@denx.de
> >================================================================
> >=====
Priyanka Jain Oct. 30, 2019, 8:24 a.m. UTC | #5 
>-----Original Message-----
>From: AKASHI Takahiro <takahiro.akashi@linaro.org>
>Sent: Tuesday, October 29, 2019 10:49 AM
>To: Priyanka Jain <priyanka.jain@nxp.com>; Stefano Babic <sbabic@denx.de>
>Cc: Tom Rini <trini@konsulko.com>; Udit Agarwal <udit.agarwal@nxp.com>;
>xypron.glpk@gmx.de; agraf@csgraf.de; u-boot@lists.denx.de
>Subject: Re: [U-Boot] [RFC 06/15] secure boot: rename CONFIG_SECURE_BOOT
>
>Priyanka, Stefano and Tom,
>
>On Wed, Sep 25, 2019 at 04:19:43AM +0000, Priyanka Jain wrote:
>>
>>
>> >-----Original Message-----
>> >From: Stefano Babic <sbabic@denx.de>
>> >Sent: Thursday, September 19, 2019 8:40 PM
>> >To: Tom Rini <trini@konsulko.com>; AKASHI Takahiro
>> ><takahiro.akashi@linaro.org>; Priyanka Jain <priyanka.jain@nxp.com>;
>> >Stefano Babic <sbabic@denx.de>
>> >Cc: xypron.glpk@gmx.de; agraf@csgraf.de; u-boot@lists.denx.de
>> >Subject: Re: [U-Boot] [RFC 06/15] secure boot: rename
>> >CONFIG_SECURE_BOOT
>> >
>> >On 19/09/19 17:02, Tom Rini wrote:
>> >> On Wed, Sep 18, 2019 at 10:26:34AM +0900, AKASHI Takahiro wrote:
>> >>
>> >>> The configuration, CONFIG_SECURE_BOOT, was scattered among
>> >>> different architecture directories for different implementation.
>> >>> This will prevent UEFI secure boot from being added later.
>> >>>
>> >>> So let's rename them, giving each implementation to different
>> >>> configuration option. CONFIG_SECURE_BOOT still remains not to
>> >>> break existing implicit dependency.
>> >>>
>> >>> Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
>> >>> ---
>> >>>  Kconfig                                   | 7 +++++++
>> >>>  arch/arm/cpu/armv7/ls102xa/Kconfig        | 3 ++-
>> >>>  arch/arm/cpu/armv8/fsl-layerscape/Kconfig | 3 ++-
>> >>>  arch/arm/mach-imx/Kconfig                 | 3 ++-
>> >>>  arch/powerpc/cpu/mpc85xx/Kconfig          | 3 ++-
>> >>>  5 files changed, 15 insertions(+), 4 deletions(-)
>> >>>
>> >>> diff --git a/Kconfig b/Kconfig
>> >>> index 1f0904f7045e..c11fc102a7d4 100644
>> >>> --- a/Kconfig
>> >>> +++ b/Kconfig
>> >>> @@ -282,6 +282,13 @@ config SYS_LDSCRIPT
>> >>>
>> >>>  endmenu		# General setup
>> >>>
>> >>> +config SECURE_BOOT
>> >>> +	bool "Secure Boot"
>> >>> +	imply SHA256
>> >>> +	help
>> >>> +	  Enable Secure Boot feature. The actual behavior may vary
>> >>> +	  from architecture to architecture.
>> >>> +
>> >>>  menu "Boot images"
>> >>>
>> >>>  config ANDROID_BOOT_IMAGE
>> >>> diff --git a/arch/arm/cpu/armv7/ls102xa/Kconfig
>> >>> b/arch/arm/cpu/armv7/ls102xa/Kconfig
>> >>> index 94fa68250ddf..ce1bc580d23d 100644
>> >>> --- a/arch/arm/cpu/armv7/ls102xa/Kconfig
>> >>> +++ b/arch/arm/cpu/armv7/ls102xa/Kconfig
>> >>> @@ -50,8 +50,9 @@ config MAX_CPUS
>> >>>  	  cores, count the reserved ports. This will allocate enough memory
>> >>>  	  in spin table to properly handle all cores.
>> >>>
>> >>> -config SECURE_BOOT
>> >>> +config FSL_ARMV7_ENABLE_SECURE_BOOT
>> >>>  	bool	"Secure Boot"
>> >>> +	depends on SECURE_BOOT
>> >>>  	help
>> >>>  		Enable Freescale Secure Boot feature. Normally selected
>> >>>  		by defconfig. If unsure, do not change.
>> >>> diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>> >>> b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>> >>> index 42d31fdab0a0..d4cfe31f8ebf 100644
>> >>> --- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>> >>> +++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
>> >>> @@ -383,8 +383,9 @@ config EMC2305
>> >>>  	 Enable the EMC2305 fan controller for configuration of fan
>> >>>  	 speed.
>> >>>
>> >>> -config SECURE_BOOT
>> >>> +config FSI_ARMV8_ENABLE_SECURE_BOOT
>> >>>  	bool "Secure Boot"
>> >>> +	depends on SECURE_BOOT
>> >>>  	help
>> >>>  		Enable Freescale Secure Boot feature
>> >>>
>> >>> diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
>> >>> index aeb54934888d..e1602fd5f0e8 100644
>> >>> --- a/arch/arm/mach-imx/Kconfig
>> >>> +++ b/arch/arm/mach-imx/Kconfig
>> >>> @@ -34,8 +34,9 @@ config USE_IMXIMG_PLUGIN
>> >>>  	  i.MX6/7 supports DCD and Plugin. Enable this configuration
>> >>>  	  to use Plugin, otherwise DCD will be used.
>> >>>
>> >>> -config SECURE_BOOT
>> >>> +config FSL_IMX_ENABLE_SECURE_BOOT
>> >>>  	bool "Support i.MX HAB features"
>> >>> +	depends on SECURE_BOOT
>> >>>  	depends on ARCH_MX7 || ARCH_MX6 || ARCH_MX5
>> >>>  	select FSL_CAAM if HAS_CAAM
>> >>>  	imply CMD_DEKBLOB
>> >>> diff --git a/arch/powerpc/cpu/mpc85xx/Kconfig
>> >>> b/arch/powerpc/cpu/mpc85xx/Kconfig
>> >>> index c038a6ddb0f4..9cf6ebbfe3ce 100644
>> >>> --- a/arch/powerpc/cpu/mpc85xx/Kconfig
>> >>> +++ b/arch/powerpc/cpu/mpc85xx/Kconfig
>> >>> @@ -1208,8 +1208,9 @@ config FSL_LAW
>> >>>  	help
>> >>>  		Use Freescale common code for Local Access Window
>> >>>
>> >>> -config SECURE_BOOT
>> >>> +config FSL_MPC_ENABLE_SECURE_BOOT
>> >>>  	bool	"Secure Boot"
>> >>> +	depends on SECURE_BOOT
>> >>>  	help
>> >>>  		Enable Freescale Secure Boot feature. Normally selected
>> >>>  		by defconfig. If unsure, do not change.
>> >>
>> >> I've added Priyanka Jain to the thread as the custodian for PowerPC
>> >> and NXP stuff and Stefano Babic as the custodian for i.MX stuff.  I
>> >> don't want to see "CONFIG_SECURE_BOOT" continue on as a config
>> >> option, it's too broad.  Can we please rename and update the
>> >> existing NXP CONFIG option (and I assume split it into a few ones
>> >> to reflect better where things really changed fundamentally from
>> >> one SoC/arch to the
>> >> next) and update the help text?  Thanks!
>> >
>> >Sure - SECURE_BOOT for NXP means enabling HAB, a config can be rename
>> >to identify the component itself (CONFIG_HAB for example).
>> >
>> >Regards,
>> >Stefano
>> >
>> Sure, We will look into this and update NXP CONFIG_SECURE_BOOT option.
>> Priyanka
>
>Can we expect this re-work on NXP/Freescal platforms to be done in the
>current release cycle, that is v2020.01?
>
Yes, we are working on the changes for NXP ARM and mpc85xx platforms.

Regards
Priyanka
 
>If not, can I continue to use my match[1] as part of my UEFI secure boot patch
>set for the time being?
>
>  [1]
>https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.de
>nx.de%2Fpipermail%2Fu-boot%2F2019-
>September%2F383908.html&amp;data=02%7C01%7Cpriyanka.jain%40nxp.com
>%7C00a34480e43c4950cb0808d75c2f836b%7C686ea1d3bc2b4c6fa92cd99c5c30
>1635%7C0%7C0%7C637079231443969244&amp;sdata=gvOKFn6Rt7sgbmrbMo
>Vq2cawyetW5z6H50Qhv0aX0rA%3D&amp;reserved=0
>
>Thanks,
>-Takahiro Akashi
>
>
>> >
>> >--
>>
>>================================================================
>> >=====
>> >DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
>> >HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
>> >Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic@denx.de
>>
>>================================================================
>> >=====
diff mbox series

Patch

diff --git a/Kconfig b/Kconfig
index 1f0904f7045e..c11fc102a7d4 100644
--- a/Kconfig
+++ b/Kconfig
@@ -282,6 +282,13 @@  config SYS_LDSCRIPT
 
 endmenu		# General setup
 
+config SECURE_BOOT
+	bool "Secure Boot"
+	imply SHA256
+	help
+	  Enable Secure Boot feature. The actual behavior may vary
+	  from architecture to architecture.
+
 menu "Boot images"
 
 config ANDROID_BOOT_IMAGE
diff --git a/arch/arm/cpu/armv7/ls102xa/Kconfig b/arch/arm/cpu/armv7/ls102xa/Kconfig
index 94fa68250ddf..ce1bc580d23d 100644
--- a/arch/arm/cpu/armv7/ls102xa/Kconfig
+++ b/arch/arm/cpu/armv7/ls102xa/Kconfig
@@ -50,8 +50,9 @@  config MAX_CPUS
 	  cores, count the reserved ports. This will allocate enough memory
 	  in spin table to properly handle all cores.
 
-config SECURE_BOOT
+config FSL_ARMV7_ENABLE_SECURE_BOOT
 	bool	"Secure Boot"
+	depends on SECURE_BOOT
 	help
 		Enable Freescale Secure Boot feature. Normally selected
 		by defconfig. If unsure, do not change.
diff --git a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
index 42d31fdab0a0..d4cfe31f8ebf 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
+++ b/arch/arm/cpu/armv8/fsl-layerscape/Kconfig
@@ -383,8 +383,9 @@  config EMC2305
 	 Enable the EMC2305 fan controller for configuration of fan
 	 speed.
 
-config SECURE_BOOT
+config FSI_ARMV8_ENABLE_SECURE_BOOT
 	bool "Secure Boot"
+	depends on SECURE_BOOT
 	help
 		Enable Freescale Secure Boot feature
 
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index aeb54934888d..e1602fd5f0e8 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -34,8 +34,9 @@  config USE_IMXIMG_PLUGIN
 	  i.MX6/7 supports DCD and Plugin. Enable this configuration
 	  to use Plugin, otherwise DCD will be used.
 
-config SECURE_BOOT
+config FSL_IMX_ENABLE_SECURE_BOOT
 	bool "Support i.MX HAB features"
+	depends on SECURE_BOOT
 	depends on ARCH_MX7 || ARCH_MX6 || ARCH_MX5
 	select FSL_CAAM if HAS_CAAM
 	imply CMD_DEKBLOB
diff --git a/arch/powerpc/cpu/mpc85xx/Kconfig b/arch/powerpc/cpu/mpc85xx/Kconfig
index c038a6ddb0f4..9cf6ebbfe3ce 100644
--- a/arch/powerpc/cpu/mpc85xx/Kconfig
+++ b/arch/powerpc/cpu/mpc85xx/Kconfig
@@ -1208,8 +1208,9 @@  config FSL_LAW
 	help
 		Use Freescale common code for Local Access Window
 
-config SECURE_BOOT
+config FSL_MPC_ENABLE_SECURE_BOOT
 	bool	"Secure Boot"
+	depends on SECURE_BOOT
 	help
 		Enable Freescale Secure Boot feature. Normally selected
 		by defconfig. If unsure, do not change.