| Message ID | 20211020024933.16964-11-chiawei_wang@aspeedtech.com |
|---|---|
| State | Superseded |
| Delegated to: | Tom Rini |
| Headers | show |
| Series | aspeed: Support secure boot chain with FIT image verification | expand |
On Wed, 20 Oct 2021 at 02:50, Chia-Wei Wang <chiawei_wang@aspeedtech.com> wrote: > > Enable SPL FIT image load and verification support. > The HW accelerated SHA is also available with the > newly added support of the HACE HW hash engine. > > The SPL thumb build is also enabled to keep the binary > less than 64KB to fit into the Aspeed secure boot design. > > Signed-off-by: Chia-Wei Wang <chiawei_wang@aspeedtech.com> Reviewed-by: Joel Stanley <joel@jms.id.au> > --- > configs/evb-ast2600_defconfig | 20 +++++++++++++++++--- > 1 file changed, 17 insertions(+), 3 deletions(-) > > diff --git a/configs/evb-ast2600_defconfig b/configs/evb-ast2600_defconfig > index 56ab885d9b..eba6940ec1 100644 > --- a/configs/evb-ast2600_defconfig > +++ b/configs/evb-ast2600_defconfig > @@ -1,7 +1,8 @@ > CONFIG_ARM=y > CONFIG_SYS_DCACHE_OFF=y > +CONFIG_SPL_SYS_THUMB_BUILD=y > CONFIG_ARCH_ASPEED=y > -CONFIG_SYS_TEXT_BASE=0x10000 > +CONFIG_SYS_TEXT_BASE=0x80000000 > CONFIG_ASPEED_AST2600=y > CONFIG_TARGET_EVB_AST2600=y > CONFIG_SPL_LIBCOMMON_SUPPORT=y > @@ -12,13 +13,17 @@ CONFIG_ENV_SIZE=0x10000 > CONFIG_SYS_MALLOC_LEN=0x2000000 > CONFIG_DEFAULT_DEVICE_TREE="ast2600-evb" > CONFIG_SPL_SERIAL=y > +CONFIG_SPL_STACK_R_ADDR=0x83000000 > CONFIG_SPL_SIZE_LIMIT=0x10000 > CONFIG_SPL=y > # CONFIG_ARMV7_NONSEC is not set > # CONFIG_SYS_MALLOC_CLEAR_ON_INIT is not set > CONFIG_SYS_LOAD_ADDR=0x83000000 > CONFIG_FIT=y > -# CONFIG_LEGACY_IMAGE_FORMAT is not set > +CONFIG_SPL_FIT_SIGNATURE=y > +CONFIG_SPL_LOAD_FIT=y > +CONFIG_SPL_LOAD_FIT_ADDRESS=0x10000 > +# CONFIG_USE_SPL_FIT_GENERATOR is not set > CONFIG_USE_BOOTARGS=y > CONFIG_BOOTARGS="console=ttyS4,115200n8 root=/dev/ram rw" > CONFIG_USE_BOOTCOMMAND=y > @@ -26,8 +31,10 @@ CONFIG_BOOTCOMMAND="bootm 20100000" > # CONFIG_DISPLAY_CPUINFO is not set > CONFIG_SPL_SIZE_LIMIT_SUBTRACT_GD=y > CONFIG_SPL_SIZE_LIMIT_SUBTRACT_MALLOC=y > -# CONFIG_SPL_LEGACY_IMAGE_SUPPORT is not set > CONFIG_SPL_SYS_MALLOC_SIMPLE=y > +CONFIG_SPL_STACK_R=y > +CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x2000000 > +CONFIG_SPL_FIT_IMAGE_TINY=y > CONFIG_SPL_DM_RESET=y > CONFIG_SPL_RAM_SUPPORT=y > CONFIG_SPL_RAM_DEVICE=y > @@ -47,6 +54,9 @@ CONFIG_REGMAP=y > CONFIG_SPL_OF_TRANSLATE=y > CONFIG_CLK=y > CONFIG_SPL_CLK=y > +CONFIG_DM_HASH=y > +CONFIG_HASH_ASPEED=y > +CONFIG_ASPEED_ACRY=y > CONFIG_DM_I2C=y > CONFIG_MISC=y > CONFIG_SPL_MISC=y > @@ -65,5 +75,9 @@ CONFIG_SYS_NS16550=y > CONFIG_SYSRESET=y > CONFIG_SPL_SYSRESET=y > CONFIG_WDT=y > +CONFIG_SHA512_ALGO=y > +CONFIG_SHA512=y > +CONFIG_SHA384=y > CONFIG_HEXDUMP=y > # CONFIG_EFI_LOADER is not set > +CONFIG_PHANDLE_CHECK_SEQ=y > -- > 2.17.1 >
diff --git a/configs/evb-ast2600_defconfig b/configs/evb-ast2600_defconfig index 56ab885d9b..eba6940ec1 100644 --- a/configs/evb-ast2600_defconfig +++ b/configs/evb-ast2600_defconfig @@ -1,7 +1,8 @@ CONFIG_ARM=y CONFIG_SYS_DCACHE_OFF=y +CONFIG_SPL_SYS_THUMB_BUILD=y CONFIG_ARCH_ASPEED=y -CONFIG_SYS_TEXT_BASE=0x10000 +CONFIG_SYS_TEXT_BASE=0x80000000 CONFIG_ASPEED_AST2600=y CONFIG_TARGET_EVB_AST2600=y CONFIG_SPL_LIBCOMMON_SUPPORT=y @@ -12,13 +13,17 @@ CONFIG_ENV_SIZE=0x10000 CONFIG_SYS_MALLOC_LEN=0x2000000 CONFIG_DEFAULT_DEVICE_TREE="ast2600-evb" CONFIG_SPL_SERIAL=y +CONFIG_SPL_STACK_R_ADDR=0x83000000 CONFIG_SPL_SIZE_LIMIT=0x10000 CONFIG_SPL=y # CONFIG_ARMV7_NONSEC is not set # CONFIG_SYS_MALLOC_CLEAR_ON_INIT is not set CONFIG_SYS_LOAD_ADDR=0x83000000 CONFIG_FIT=y -# CONFIG_LEGACY_IMAGE_FORMAT is not set +CONFIG_SPL_FIT_SIGNATURE=y +CONFIG_SPL_LOAD_FIT=y +CONFIG_SPL_LOAD_FIT_ADDRESS=0x10000 +# CONFIG_USE_SPL_FIT_GENERATOR is not set CONFIG_USE_BOOTARGS=y CONFIG_BOOTARGS="console=ttyS4,115200n8 root=/dev/ram rw" CONFIG_USE_BOOTCOMMAND=y @@ -26,8 +31,10 @@ CONFIG_BOOTCOMMAND="bootm 20100000" # CONFIG_DISPLAY_CPUINFO is not set CONFIG_SPL_SIZE_LIMIT_SUBTRACT_GD=y CONFIG_SPL_SIZE_LIMIT_SUBTRACT_MALLOC=y -# CONFIG_SPL_LEGACY_IMAGE_SUPPORT is not set CONFIG_SPL_SYS_MALLOC_SIMPLE=y +CONFIG_SPL_STACK_R=y +CONFIG_SPL_STACK_R_MALLOC_SIMPLE_LEN=0x2000000 +CONFIG_SPL_FIT_IMAGE_TINY=y CONFIG_SPL_DM_RESET=y CONFIG_SPL_RAM_SUPPORT=y CONFIG_SPL_RAM_DEVICE=y @@ -47,6 +54,9 @@ CONFIG_REGMAP=y CONFIG_SPL_OF_TRANSLATE=y CONFIG_CLK=y CONFIG_SPL_CLK=y +CONFIG_DM_HASH=y +CONFIG_HASH_ASPEED=y +CONFIG_ASPEED_ACRY=y CONFIG_DM_I2C=y CONFIG_MISC=y CONFIG_SPL_MISC=y @@ -65,5 +75,9 @@ CONFIG_SYS_NS16550=y CONFIG_SYSRESET=y CONFIG_SPL_SYSRESET=y CONFIG_WDT=y +CONFIG_SHA512_ALGO=y +CONFIG_SHA512=y +CONFIG_SHA384=y CONFIG_HEXDUMP=y # CONFIG_EFI_LOADER is not set +CONFIG_PHANDLE_CHECK_SEQ=y
Enable SPL FIT image load and verification support. The HW accelerated SHA is also available with the newly added support of the HACE HW hash engine. The SPL thumb build is also enabled to keep the binary less than 64KB to fit into the Aspeed secure boot design. Signed-off-by: Chia-Wei Wang <chiawei_wang@aspeedtech.com> --- configs/evb-ast2600_defconfig | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)