Commit graph

6 commits

Author SHA1 Message Date
Fabio Estevam
7a037cc91f README: mxc_hab: Adapt the CONFIG_SECURE_BOOT text to Kconfig
Commit 6e1f4d2652 ("arm: imx-common: add SECURE_BOOT option to
Kconfig") moved the CONFIG_SECURE_BOOT option to Kconfig, so update
the mxc_hab README file to reflect that.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Reviewed-by: Gary Bisson <gary.bisson@boundarydevices.com>
2017-01-27 10:34:14 +01:00
Ulises Cardenas
8148b82449 Fix mxc_hab documenation
It is necessary to modify the configuration file for the target
board. It wasn't well documented that to enable any of the secure
boot modes, it is required to add CONFIG_SECURE_BOOT to the board
configuration file.

Also, fixed a typo in the encrypted boot section.

Signed-off-by: Ulises Cardenas <Ulises.Cardenas@freescale.com>
2015-05-15 19:20:46 +02:00
Ulises Cardenas
f97d112eb6 Fix mxc_hab documenation for DEK blob generation
Include/fsl_sec.h defines sec_in and sec_out, according to the
platform's endianess. Therefore, CONFIG_SYS_FSL_LE needs to be
declared in the configuration file of the target, in order to use
enable the DEK blob generation command. This requirement is not
explicit in the README.mxc_hab.

Signed-off-by: Ulises Cardenas <Ulises.Cardenas@freescale.com>
2015-04-08 10:54:10 +02:00
Raul Cardenas
0200020bc2 imx6: Added DEK blob generator command
Freescale's SEC block has built-in Data Encryption
Key(DEK) Blob Protocol which provides a method for
protecting a DEK for non-secure memory storage.
SEC block protects data in a data structure called
a Secret Key Blob, which provides both confidentiality
and integrity protection.
Every time the blob encapsulation is executed,
a AES-256 key is randomly generated to encrypt the DEK.
This key is encrypted with the OTP Secret key
from SoC. The resulting blob consists of the encrypted
AES-256 key, the encrypted DEK, and a 16-bit MAC.

During decapsulation, the reverse process is performed
to get back the original DEK. A caveat to the blob
decapsulation process,  is that the DEK is decrypted
in secure-memory and can only be read by FSL SEC HW.
The DEK is used to decrypt data during encrypted boot.

Commands added
--------------
  dek_blob - encapsulating DEK as a cryptgraphic blob

Commands Syntax
---------------
  dek_blob src dst len

    Encapsulate and create blob of a len-bits DEK at
    address src and store the result at address dst.

Signed-off-by: Raul Cardenas <Ulises.Cardenas@freescale.com>
Signed-off-by: Nitin Garg <nitin.garg@freescale.com>

Signed-off-by: Ulises Cardenas <ulises.cardenas@freescale.com>

Signed-off-by: Ulises Cardenas-B45798 <Ulises.Cardenas@freescale.com>
2015-03-02 09:57:06 +01:00
Wolfgang Denk
93e1459641 Coding Style cleanup: replace leading SPACEs by TABs
Signed-off-by: Wolfgang Denk <wd@denx.de>
[trini: Drop changes for PEP 4 following python tools]
Signed-off-by: Tom Rini <trini@ti.com>
2013-10-14 16:06:54 -04:00
Stefano Babic
0187c985aa tools: add support for setting the CSF into imximage
Add support for setting the CSF (Command Sequence File) pointer
which is used for HAB (High Assurance Boot) in the imximage by
adding e.g.

CSF 0x2000

in the imximage.cfg file.

This will set the CSF pointer accordingly just after the padded
data image area. The boot_data.length is adjusted with the
value from the imximage.cfg config file.

The resulting u-boot.imx can be signed with the FSL HAB tooling.
The generated CSF block needs to be appended to the u-boot.imx.

Signed-off-by: Stefano Babic <sbabic@denx.de>
2013-08-31 15:06:29 +02:00