The README.mxc_hab is outdated and need improvements, add the following
modifications:
- Reorganize document and remove duplicate content
- Add CST download link
- Update CST package name
- Align command lines with CST v2.3.3
- Update U-Boot binary name
- Remove CSF padding since is not documented in AN4581
Signed-off-by: Breno Lima <breno.lima@nxp.com>
Currently the High Assurance Boot procedure is documented in two
places:
- doc/README.imx6
- doc/README.mxc_hab
It is better to consolidate all HAB related information into
README.mxc_hab file, so move the content from README.imx6 to
README.mxc_hab.
Signed-off-by: Breno Lima <breno.lima@nxp.com>
Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
The original text is from the time that the config options were not
converted to Kconfig.
After the conversion to Kconfig only CONFIG_SECURE_BOOT and
CONFIG_CMD_DEKBLOB need to be selected by the user.
The other config options are automatically selected by the Kconfig
logic.
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Reviewed-by: Breno Lima <breno.lima@nxp.com>
Commit 6e1f4d2652 ("arm: imx-common: add SECURE_BOOT option to
Kconfig") moved the CONFIG_SECURE_BOOT option to Kconfig, so update
the mxc_hab README file to reflect that.
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Reviewed-by: Gary Bisson <gary.bisson@boundarydevices.com>
It is necessary to modify the configuration file for the target
board. It wasn't well documented that to enable any of the secure
boot modes, it is required to add CONFIG_SECURE_BOOT to the board
configuration file.
Also, fixed a typo in the encrypted boot section.
Signed-off-by: Ulises Cardenas <Ulises.Cardenas@freescale.com>
Include/fsl_sec.h defines sec_in and sec_out, according to the
platform's endianess. Therefore, CONFIG_SYS_FSL_LE needs to be
declared in the configuration file of the target, in order to use
enable the DEK blob generation command. This requirement is not
explicit in the README.mxc_hab.
Signed-off-by: Ulises Cardenas <Ulises.Cardenas@freescale.com>
Freescale's SEC block has built-in Data Encryption
Key(DEK) Blob Protocol which provides a method for
protecting a DEK for non-secure memory storage.
SEC block protects data in a data structure called
a Secret Key Blob, which provides both confidentiality
and integrity protection.
Every time the blob encapsulation is executed,
a AES-256 key is randomly generated to encrypt the DEK.
This key is encrypted with the OTP Secret key
from SoC. The resulting blob consists of the encrypted
AES-256 key, the encrypted DEK, and a 16-bit MAC.
During decapsulation, the reverse process is performed
to get back the original DEK. A caveat to the blob
decapsulation process, is that the DEK is decrypted
in secure-memory and can only be read by FSL SEC HW.
The DEK is used to decrypt data during encrypted boot.
Commands added
--------------
dek_blob - encapsulating DEK as a cryptgraphic blob
Commands Syntax
---------------
dek_blob src dst len
Encapsulate and create blob of a len-bits DEK at
address src and store the result at address dst.
Signed-off-by: Raul Cardenas <Ulises.Cardenas@freescale.com>
Signed-off-by: Nitin Garg <nitin.garg@freescale.com>
Signed-off-by: Ulises Cardenas <ulises.cardenas@freescale.com>
Signed-off-by: Ulises Cardenas-B45798 <Ulises.Cardenas@freescale.com>
Add support for setting the CSF (Command Sequence File) pointer
which is used for HAB (High Assurance Boot) in the imximage by
adding e.g.
CSF 0x2000
in the imximage.cfg file.
This will set the CSF pointer accordingly just after the padded
data image area. The boot_data.length is adjusted with the
value from the imximage.cfg config file.
The resulting u-boot.imx can be signed with the FSL HAB tooling.
The generated CSF block needs to be appended to the u-boot.imx.
Signed-off-by: Stefano Babic <sbabic@denx.de>
Breno Lima
Fabio Estevam
Ulises Cardenas
Wolfgang Denk
Stefano Babic