cmd: mvebu/bubt: Check for A38x/A37xx OTP secure bits and secure boot
For obvious reasons BootROMS rejects unsigned images when secure boot is
enabled in OTP secure bits. So check for OPT secure bits and do not allow
flashing unsigned images when secure boot is enabled. Access to OTP via
U-Boot fuse API is currently implemented only for A38x and A37xx SoCs.
Additionally Armada 3700 BootROM rejects signed trusted image when secure
boot is not enabled in OTP. So add also check for this case. On the other
hand Armada 38x BootROM acceps images with secure boot header when secure
boot is not enabled in OTP.
OTP secure bits may have burned also boot device source. Check it also and
reject flashing images to target storage which does not match OTP.
Signed-off-by: Pali Rohár <pali@kernel.org>
Reviewed-by: Stefan Roese <sr@denx.de>
diff --git a/cmd/mvebu/Kconfig b/cmd/mvebu/Kconfig
index 120397d..9ec3aa9 100644
--- a/cmd/mvebu/Kconfig
+++ b/cmd/mvebu/Kconfig
@@ -5,6 +5,7 @@
bool "bubt"
select SHA256 if ARMADA_3700
select SHA512 if ARMADA_3700
+ select MVEBU_EFUSE if ARMADA_38X || ARMADA_3700
help
bubt - Burn a u-boot image to flash
For details about bubt command please see the documentation