2 * Copyright 2015 Freescale Semiconductor, Inc.
4 * SPDX-License-Identifier: GPL-2.0+
8 #include <fsl_validate.h>
9 #include <fsl_secboot_err.h>
13 #ifdef CONFIG_ADDR_MAP
17 #ifdef CONFIG_FSL_CORENET
18 #include <asm/fsl_pamu.h>
22 #include <asm/arch/immap_ls102xa.h>
25 #if defined(CONFIG_MPC85xx)
26 #define CONFIG_DCFG_ADDR CONFIG_SYS_MPC85xx_GUTS_ADDR
28 #define CONFIG_DCFG_ADDR CONFIG_SYS_FSL_GUTS_ADDR
31 #ifdef CONFIG_SYS_FSL_CCSR_GUR_LE
32 #define gur_in32(a) in_le32(a)
34 #define gur_in32(a) in_be32(a)
37 /* Check the Boot Mode. If Secure, return 1 else return 0 */
38 int fsl_check_boot_mode_secure(void)
41 struct ccsr_sfp_regs *sfp_regs = (void *)(CONFIG_SYS_SFP_ADDR);
42 struct ccsr_gur __iomem *gur = (void *)(CONFIG_DCFG_ADDR);
44 val = sfp_in32(&sfp_regs->ospr) & ITS_MASK;
48 #if defined(CONFIG_FSL_CORENET) || !defined(CONFIG_MPC85xx)
49 /* For PBL based platforms check the SB_EN bit in RCWSR */
50 val = gur_in32(&gur->rcwsr[RCW_SB_EN_REG_INDEX - 1]) & RCW_SB_EN_MASK;
51 if (val == RCW_SB_EN_MASK)
55 #if defined(CONFIG_MPC85xx) && !defined(CONFIG_FSL_CORENET)
56 /* For Non-PBL Platforms, check the Device Status register 2*/
57 val = gur_in32(&gur->pordevsr2) & MPC85xx_PORDEVSR2_SBC_MASK;
58 if (val != MPC85xx_PORDEVSR2_SBC_MASK)
65 #ifndef CONFIG_SPL_BUILD
66 int fsl_setenv_chain_of_trust(void)
69 * If Boot Mode is Non-Secure, no changes are required
71 if (fsl_check_boot_mode_secure() == 0)
74 /* If Boot mode is Secure, set the environment variables
75 * bootdelay = 0 (To disable Boot Prompt)
76 * bootcmd = CONFIG_CHAIN_BOOT_CMD (Validate and execute Boot script)
78 setenv("bootdelay", "0");
79 setenv("bootcmd", CONFIG_CHAIN_BOOT_CMD);
84 #ifdef CONFIG_SPL_BUILD
85 void spl_validate_uboot(uint32_t hdr_addr, uintptr_t img_addr)
91 * If Boot Mode is Non-Secure, skip validation
93 if (fsl_check_boot_mode_secure() == 0)
96 printf("SPL: Validating U-Boot image\n");
98 #ifdef CONFIG_ADDR_MAP
102 #ifdef CONFIG_FSL_CORENET
104 fsl_secboot_handle_error(ERROR_ESBC_PAMU_INIT);
107 #ifdef CONFIG_FSL_CAAM
109 fsl_secboot_handle_error(ERROR_ESBC_SEC_INIT);
113 * dm_init_and_scan() is called as part of common SPL framework, so no
114 * need to call it again but in case of powerpc platforms which currently
115 * do not use common SPL framework, so need to call this function here.
117 #if defined(CONFIG_SPL_DM) && (!defined(CONFIG_SPL_FRAMEWORK))
118 dm_init_and_scan(false);
120 res = fsl_secboot_validate(hdr_addr, CONFIG_SPL_UBOOT_KEY_HASH,
124 printf("SPL: Validation of U-boot successful\n");
126 #endif /* ifdef CONFIG_SPL_BUILD */