Partial UKI Secure boot on QCOM RB3Gen2ļƒ

We currently support partial secure boot on QCOM RB2Gen2 Platform. Layer meta-ts provides the U-boot which can verify the RB3Gen2 Unified Kernel Image (UKI). meta-ts will be further extended to support a full chain of trust by TF-A firmware verifying the U-boot.

QCOM Rb3Gen2 Core Kit image an built from lightspeed as follows

kas build kas-cfgs/qcs6490-rb3gen2-core-kit.yaml

Once it is successfully built, we should see the images in the directory build/tmp/deploy/images/qcs6490-rb3gen2-core-kit

Please run the following script to make images ready for deployment in the hardware.

#!/bin/bash

set -e

cp esp-qcom-image-qcs6490-rb3gen2-core-kit.rootfs.vfat efi.bin &&
cp core-image-full-cmdline-qcs6490-rb3gen2-core-kit.rootfs.ext4 rootfs.img &&
cp dtb-qcs6490-rb3gen2-image.vfat dtb.bin

# replace uefi.elf with u-boot-qcom-rb3gen2.mbn in all specified files for label="uefi_a"

FILES=("partition.xml" "rawprogram4.xml")  # Add more files to this list as needed

for FILE in "${FILES[@]}"; do
echo "updating $FILE..."
sed -i '/label="uefi_a"/s/uefi\.elf/u-boot-qcom-rb3gen2.mbn/g' "$FILE"
echo "Done with $FILE."

Now we need to deploy the image into Rb3Ge2 hardware using QualCom qdl tool as follows

~/qdl/qdl prog_firehose_ddr.elf rawprogram0.xml rawprogram1.xml rawprogram2.xml rawprogram3.xml rawprogram4.xml rawprogram5.xml patch*.xml