This adds the required Kconfig options which need to be enabled and
correctly set to build a custom device specific barebox image which can
be used to burn the FIELD_RETURN fuse.
The CST tool can't handle quoted UID strings so we need to define it on
the cmdline by using the -D switch. This removes the quotes within the
CSF file and the CST is happy.
Signed-off-by: Marco Felsch <m.felsch@xxxxxxxxxxxxxx>
---
arch/arm/mach-imx/Kconfig | 25 +++++++++++++++++++++++++
include/mach/imx/habv4-imx8-gencsf.h | 7 +++++++
scripts/Makefile.lib | 1 +
3 files changed, 33 insertions(+)
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 68f55971506b..8bbde38e0d9a 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -843,6 +843,31 @@ config HABV4_CSF_UNLOCK_SRK_REVOKE
the SRK_REVOKE_LOCK sticky bit. This is required for key
revocation. Don't enable this if you are unsure.
+config HABV4_CSF_UNLOCK_FIELD_RETURN
+ depends on HABV4
+ bool "Unlock field return"
+ help
+ Enable this option to instruct the HAB code to not lock
+ the FIELD_RETURN_LOCK sticky bit. This is required to be
+ able to fuse the FIELD_RETURN fuse. It is also required
+ that the CONFIG_HABV4_CSF_UNLOCK_UID is set correct as
+ well.
+
+config HABV4_CSF_UNLOCK_UID
+ depends on HABV4 && HABV4_CSF_UNLOCK_FIELD_RETURN
+ string "CSF Unlock UID"
+ help
+ Device specific 64-bit UID Required to unlock the field-return
+ feature. This value must match the per device UNIQUE_ID fuses.
+
+ The below example shows the expected format. The UNIQUE_ID is
+ queried by Linux via:
+ - cat /sys/devices/soc0/serial_number
+ 7766554433221100
+
+ So this value have to be set:
+ - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
+
config HAB_CERTS_ENV
depends on HAB
bool "Specify certificates in environment"
diff --git a/include/mach/imx/habv4-imx8-gencsf.h b/include/mach/imx/habv4-imx8-gencsf.h
index 56d9ef2de92f..3106facc511f 100644
--- a/include/mach/imx/habv4-imx8-gencsf.h
+++ b/include/mach/imx/habv4-imx8-gencsf.h
@@ -42,6 +42,13 @@ hab Engine = OCOTP
hab Features = SRK REVOKE
#endif
+#if defined(CONFIG_HABV4_CSF_UNLOCK_FIELD_RETURN)
+hab [Unlock]
+hab Engine = OCOTP
+hab Features = FIELD RETURN
+hab UID = HABV4_CSF_UNLOCK_UID
+#endif
+
hab [Install Key]
/* verification key index in key store (0, 2...4) */
hab Verification index = 0
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 6b1f0ccbc003..ffbd5360cba0 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -566,6 +566,7 @@ imxcfg_cpp_flags = -Wp,-MD,$(depfile) -nostdinc -x assembler-with-cpp \
$(call overwrite-hab-env,CONFIG_HABV4_TABLE_BIN) \
$(call overwrite-hab-env,CONFIG_HABV4_CSF_CRT_PEM) \
$(call overwrite-hab-env,CONFIG_HABV4_IMG_CRT_PEM) \
+ -DHABV4_CSF_UNLOCK_UID=$(CONFIG_HABV4_CSF_UNLOCK_UID) \
$(call overwrite-fit-env,CONFIG_BOOTM_FITIMAGE_PUBKEY) \
dcd-tmp = $(subst $(comma),_,$(dot-target).dcd.tmp)
--
2.39.2
