If Vendor Authorized Boot (VAB) is enabled on Agilex 5, the firmware checks the signature of the first stage loader. If the first stage loader loads the second stage (SSBL) from flash, the first stage loader is then responsible for checking the authenticity of the SSBL.
Add support for verifying a certificate that is attached to an SSBL and rejecting an SSBL with an invalid certificate if VAB is enabled. Signed-off-by: Michael Tretter <[email protected]> --- Michael Tretter (2): arm: socfpga: mailbox_s10: add certificate validation arm: socfpga: agilex5: add SSBL verification arch/arm/mach-socfpga/agilex5-xload.c | 157 ++++++++++++++++++++++++++++++++++ arch/arm/mach-socfpga/mailbox_s10.c | 53 ++++++++++++ include/mach/socfpga/mailbox_s10.h | 2 + 3 files changed, 212 insertions(+) --- base-commit: e3bdefdf2484c19e17cf3a8cd7cb29d47917b545 change-id: 20261021-socfpga-agilex5-verify-ssbl-4fb1af9aa267 Best regards, -- Michael Tretter <[email protected]>
