Stage the configured XBL-sec ELF and embed it as a type-5 PT_LOAD segment in the remade SPL ELF. The linker script places its complete ELF image at the configured Shikra address, alongside the U-Boot SPL load segment.
The resulting u-boot-spl.elf is unsigned; external tooling performs signing after the normal build. Signed-off-by: Abhilash V <[email protected]> --- arch/arm/mach-snapdragon/Kconfig | 10 +++++ board/qualcomm/shikra/config.mk | 24 +++++++++++ board/qualcomm/shikra/shikra-spl-wrap-elf.lds | 42 ++++++++++++++----- configs/qcom_shikra_spl_defconfig | 1 + 4 files changed, 67 insertions(+), 10 deletions(-) create mode 100644 board/qualcomm/shikra/config.mk diff --git a/arch/arm/mach-snapdragon/Kconfig b/arch/arm/mach-snapdragon/Kconfig index b9c0362117a..ceebd679651 100644 --- a/arch/arm/mach-snapdragon/Kconfig +++ b/arch/arm/mach-snapdragon/Kconfig @@ -135,6 +135,16 @@ config QCOM_TMEL_ELF Path of the TME Elf file to be concatenated to u-boot.mbn to create boot rom expected multi-elf image +config QCOM_XBL_SEC_ELF + string "XBL-sec ELF image" + depends on SPL && SPL_REMAKE_ELF + help + Name of the XBL-sec ELF image in the U-Boot source-tree root to + embed in the SPL ELF. + + The image is copied to the build output as xbl_sec.elf and embedded + by the platform SPL linker script as a Qualcomm XBL-sec segment. + choice prompt "Qualcomm boot0.h workaround" optional diff --git a/board/qualcomm/shikra/config.mk b/board/qualcomm/shikra/config.mk new file mode 100644 index 00000000000..51480059410 --- /dev/null +++ b/board/qualcomm/shikra/config.mk @@ -0,0 +1,24 @@ +# SPDX-License-Identifier: GPL-2.0-only +# +# Shikra secure SPL image generation. +# +# The XBL-sec image is provided to the SPL linker script as xbl_sec.elf. +# The generated spl/u-boot-spl.elf contains the XBL-sec type-5 PT_LOAD +# segment. + +# The input name is selected by CONFIG_QCOM_XBL_SEC_ELF and is resolved in +# the source-tree root. Signing is intentionally performed outside the +# U-Boot build. +QCOM_SHIKRA_XBL_SEC_INPUT := $(srctree)/$(CONFIG_QCOM_XBL_SEC_ELF:"%"=%) + +QCOM_SHIKRA_XBL_SEC_ELF := xbl_sec.elf + +quiet_cmd_shikra_xbl_sec = XBLSEC $@ + cmd_shikra_xbl_sec = cp $< $@ + +# Stage the configured XBL-sec image in the output directory before linking +# the SPL ELF. +$(QCOM_SHIKRA_XBL_SEC_ELF): $(QCOM_SHIKRA_XBL_SEC_INPUT) FORCE + $(call if_changed,shikra_xbl_sec) + +spl/u-boot-spl.elf: $(QCOM_SHIKRA_XBL_SEC_ELF) diff --git a/board/qualcomm/shikra/shikra-spl-wrap-elf.lds b/board/qualcomm/shikra/shikra-spl-wrap-elf.lds index b2922cd2c2c..387b83ae6dc 100644 --- a/board/qualcomm/shikra/shikra-spl-wrap-elf.lds +++ b/board/qualcomm/shikra/shikra-spl-wrap-elf.lds @@ -1,18 +1,40 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ + +/* The boot ROM identifies XBL-sec by the segment type in p_flags. */ +#define PF_SEGMENT_TYPE_XBL_SEC 5 + /* - * SPDX-License-Identifier: GPL-2.0-only - * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + * The XBL-sec segment address must match the address encoded by the supplied + * XBL-sec image: + * + * entry address 0x0c350000 + * LOAD offset 0x00002000 + * base address 0x0c34e000 */ +#define XBL_SEC_SEGMENT_ADDR 0x000000000c34e000 + +/* xbl_sec.elf is staged in the output directory by the board build rules. */ +TARGET("binary") +INPUT("./xbl_sec.elf") + +OUTPUT_FORMAT("default") + +ENTRY(CONFIG_PLATFORM_ELFENTRY) + PHDRS { - ptype PT_LOAD FLAGS(0x7); + data PT_LOAD FLAGS(7); + xbl_sec PT_LOAD FLAGS(5 | (PF_SEGMENT_TYPE_XBL_SEC << 24)); } -ENTRY(_entry) - SECTIONS { + . = XBL_SEC_SEGMENT_ADDR; + .xbl_sec : { + "./xbl_sec.elf" + } :xbl_sec + . = CONFIG_PLATFORM_ELFENTRY; - _entry = . ; - data : { - *(.data) - . = ALIGN(4); - } :ptype + .data : { + *(.data*) + } :data } diff --git a/configs/qcom_shikra_spl_defconfig b/configs/qcom_shikra_spl_defconfig index 7bcb3e21a15..1d997510c77 100644 --- a/configs/qcom_shikra_spl_defconfig +++ b/configs/qcom_shikra_spl_defconfig @@ -104,6 +104,7 @@ CONFIG_SPL_STACK=0x0C294800 # CONFIG_SAVE_PREV_BL_FDT_ADDR is not set CONFIG_SPL_REMAKE_ELF=y CONFIG_SPL_REMAKE_ELF_LDSCRIPT="board/qualcomm/shikra/shikra-spl-wrap-elf.lds" +CONFIG_QCOM_XBL_SEC_ELF="qc_sec_local_signed.mbn" CONFIG_QCOM_SPL_BOOTIMEM_FLUSH_BASE=0x0C219000 CONFIG_QCOM_SPL_BOOTIMEM_FLUSH_SIZE=0x134000 CONFIG_SYS_BOARD="shikra" -- 2.34.1
