From: Marco Felsch <m.felsch@xxxxxxxxxxxxxx>
This adds the required Kconfig options which need to be enabled and
correctly set to build a custom device specific barebox image which can
be used to burn the FIELD_RETURN fuse.
The CST tool can't handle quoted UID strings so we need to define it on
the cmdline by using the -D switch. This removes the quotes within the
CSF file and the CST is happy.
Signed-off-by: Marco Felsch <m.felsch@xxxxxxxxxxxxxx>
Signed-off-by: Stefan Kerkmann <s.kerkmann@xxxxxxxxxxxxxx>
---
arch/arm/mach-imx/Kconfig | 26 ++++++++++++++++++++++++++
include/mach/imx/habv4-imx8-gencsf.h | 7 +++++++
scripts/Makefile.lib | 1 +
3 files changed, 34 insertions(+)
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index c8a439b8a0b11fa168419ce77d7ee83fa86f2298..779b986b872cac0126a006a592d72a462b46b5db 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -838,6 +838,16 @@ config HABV4_CSF_SRK_REVOKE_UNLOCK
the SRK_REVOKE_LOCK sticky bit. This is required for key
revocation. Don't enable this if you are unsure.
+config HABV4_CSF_UNLOCK_FIELD_RETURN
+ depends on HABV4
+ bool "Unlock field return"
+ help
+ Enable this option to instruct the HAB code to not lock
+ the FIELD_RETURN_LOCK sticky bit. This is required to be
+ able to fuse the FIELD_RETURN fuse. It is also required
+ that the CONFIG_HABV4_CSF_UNLOCK_UID is set correct as
+ well.
+
config HAB_CERTS_ENV
depends on HAB
bool "Specify certificates in environment"
@@ -858,6 +868,7 @@ config HAB_CERTS_ENV
CONFIG_HABV4_TABLE_BIN
CONFIG_HABV4_CSF_CRT_PEM
+ CONFIG_HABV4_CSF_UNLOCK_UID
CONFIG_HABV4_IMG_CRT_PEM
config HABV4_SRK_INDEX
@@ -892,6 +903,21 @@ config HABV4_CSF_CRT_PEM
This file will be inserted into the Command Sequence File
(CSF) when using the CSF template that comes with barebox.
+config HABV4_CSF_UNLOCK_UID
+ depends on HABV4 && HABV4_CSF_UNLOCK_FIELD_RETURN
+ string "CSF Unlock UID"
+ help
+ Device specific 64-bit UID Required to unlock the field-return
+ feature. This value must match the per device UNIQUE_ID fuses.
+
+ The below example shows the expected format. The UNIQUE_ID is
+ queried by Linux via:
+ - cat /sys/devices/soc0/serial_number
+ 7766554433221100
+
+ So this value have to be set:
+ - 0x00, 0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77
+
config HABV4_IMG_CRT_PEM
string "Path to IMG certificate"
default "../crts/IMG1_1_sha256_4096_65537_v3_usr_crt.pem"
diff --git a/include/mach/imx/habv4-imx8-gencsf.h b/include/mach/imx/habv4-imx8-gencsf.h
index b3d29f5896881ba2abeaa6d4b297a031240fac99..480f88fa9552c51fd94e8f11a1ddc03a544f8081 100644
--- a/include/mach/imx/habv4-imx8-gencsf.h
+++ b/include/mach/imx/habv4-imx8-gencsf.h
@@ -42,6 +42,13 @@ hab Engine = OCOTP
hab Features = SRK REVOKE
#endif
+#if defined(CONFIG_HABV4_CSF_UNLOCK_FIELD_RETURN)
+hab [Unlock]
+hab Engine = OCOTP
+hab Features = FIELD RETURN
+hab UID = HABV4_CSF_UNLOCK_UID
+#endif
+
hab [Install Key]
/* verification key index in key store (0, 2...4) */
hab Verification index = 0
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 0f4e7307cb41dfe938a0bcef4117b396c1ae469f..5616acf3413d9709d703ac8ed90b0d72885603ce 100644
--- a/scripts/Makefile.lib
+++ b/scripts/Makefile.lib
@@ -565,6 +565,7 @@ imxcfg_cpp_flags = -Wp,-MD,$(depfile) -nostdinc -x assembler-with-cpp \
$(call overwrite-hab-env,CONFIG_HABV3_IMG_CRT_DER) \
$(call overwrite-hab-env,CONFIG_HABV4_TABLE_BIN) \
$(call overwrite-hab-env,CONFIG_HABV4_CSF_CRT_PEM) \
+ $(call overwrite-hab-env,CONFIG_HABV4_CSF_UNLOCK_UID) \
$(call overwrite-hab-env,CONFIG_HABV4_IMG_CRT_PEM) \
$(call overwrite-fit-env,CONFIG_BOOTM_FITIMAGE_PUBKEY) \
--
2.39.5
