secure_boot.ld

OUTPUT_ARCH( "riscv" )
ENTRY( reset_vector )
SECTIONS
{
  /* Root of trust in a trusted ROM */
  . = 0x1000;
  .rot : {
    _start = .;
    PROVIDE(reset_vector = .);
    *(.bootloader.entry)
    *(.bootloader)
    
    /* Device tree string follows the boot ROM: */
    PROVIDE(dtb_ptr = .);
    _end = .;
  }
  
  /* System memory */
  . = 0x80000000;
  /* Expected locations for various keys and metadata */
  .bootloader_header (NOLOAD) : {
    PROVIDE(pk_m = .); /* from untrusted boot image */
    . += 32;
    
    PROVIDE(pk_d = .); /* from untrusted boot image */
    . += 32;
    
    PROVIDE(cert_d = .); /* from untrusted boot image */
    . += 64;

    PROVIDE(pk_s = .); /* computed by trusted bootloader */
    . += 64;

    PROVIDE(sk_s = .); /* computed by trusted bootloader */
    . += 32;

    PROVIDE(hash_s = .); /* computed by trusted bootloader */
    . += 64;

    PROVIDE(cert_s = .); /* computed by trusted bootloader */
    . += 64;

    PROVIDE(len_s = .); /* from untrusted boot image */
    . += 64;
  }
  
  /* Reserve some space for M-mode stacks */
  . = ALIGN(0x1000);
  .m_stacks (NOLOAD) : {
    *(.mstacks) /* Usually 1 page per core */
  }
  
  /* Post-boot environment image (S) */
  . = ALIGN(0x1000);
  .payload (NOLOAD) : {
    PROVIDE(payload_ptr = .);
    *(.payload)
  }
}