brain-hackers_pepepper-mirror
/
u-boot-brain
mirror of https://github.com/brain-hackers/u-boot-brain
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

imx: caam: new u-boot command to set PRIBLOB bitfield from CAAM SCFGR register to 0x3 

It is highly recommended to set the PRIBLOB bitfield to 0x3 once your
encrypted boot image has booted up, this prevents the generation of new
blobs that can be used to decrypt an encrypted boot image. The PRIBLOB is
a sticky type bit and cannot be changed until the next power on reset.

Add the set_priblob_bitfield U-Boot command to prevent the generation of
new blobs.

Signed-off-by: Clement Le Marquis <clement.lemarquis@nxp.com>
Acked-by: Ye Li <Ye.Li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
This commit is contained in:
Clement Le Marquis 2021-03-25 17:30:32 +08:00 committed by Stefano Babic
parent 45f39e9fb7
commit 613cf239ed
3 changed files with 41 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
arch/arm/mach-imx/Kconfig
View File

@ -81,6 +81,13 @@ config CMD_DEKBLOB
creates a blob of data. See also CMD_BLOB and doc/imx/habv4/* for
more information.
config CMD_PRIBLOB
bool "Support the set_priblob_bitfield command"
depends on HAS_CAAM && IMX_HAB
help
This option enables the priblob command which can be used
to set the priblob setting to 0x3.
config CMD_HDMIDETECT
bool "Support the 'hdmidet' command"
help

1
arch/arm/mach-imx/Makefile
View File

@ -30,6 +30,7 @@ obj-$(CONFIG_SYS_I2C_MXC) += i2c-mxv7.o
endif
ifeq ($(SOC),$(filter $(SOC),mx7 mx6 mxs imx8m imx8 imxrt))
obj-y += misc.o
obj-$(CONFIG_CMD_PRIBLOB) += priblob.o
obj-$(CONFIG_SPL_BUILD) += spl.o
endif
ifeq ($(SOC),$(filter $(SOC),mx7))

33
arch/arm/mach-imx/priblob.c Normal file
View File

@ -0,0 +1,33 @@
// SPDX-License-Identifier: GPL-2.0+
/*
* Copyright 2018 NXP
*/
/*
* Boot command to get and set the PRIBLOB bitfield form the SCFGR register
* of the CAAM IP. It is recommended to set this bitfield to 3 once your
* encrypted boot image is ready, to prevent the generation of blobs usable
* to decrypt an encrypted boot image.
*/
#include <asm/io.h>
#include <common.h>
#include <command.h>
#include "../drivers/crypto/fsl_caam_internal.h"
int do_priblob_write(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
{
writel((readl(CAAM_SCFGR) & 0xFFFFFFFC) | 3, CAAM_SCFGR);
printf("New priblob setting = 0x%x\n", readl(CAAM_SCFGR) & 0x3);
return 0;
}
U_BOOT_CMD(
set_priblob_bitfield, 1, 0, do_priblob_write,
"Set the PRIBLOB bitfield to 3",
"<value>\n"
" - Write 3 in PRIBLOB bitfield of SCFGR regiter of CAAM IP.\n"
" Prevent the generation of blobs usable to decrypt an\n"
" encrypted boot image."
);