MLK-19790 imx: caam: new u-boot command to set PRIBLOB bitfield from CAAM SCFGR regis...

It is highly recommended to set the PRIBLOB bitfield to 0x3 once your
encrypted boot image has booted up, this prevents the generation of new
blobs that can be used to decrypt an encrypted boot image. The PRIBLOB is
a sticky type bit and cannot be changed until the next power on reset.

Add the set_priblob_bitfield U-Boot command to prevent the generation of
new blobs.

Signed-off-by: Clement Le Marquis <clement.lemarquis@nxp.com>
Acked-by: Ye Li <Ye.Li@nxp.com>
(cherry picked from commit 69cca568b85f36a77ef6ef31538f69366d238845)
(cherry picked from commit e8f813a6b66961759916e65b8c18ec43fd36a7c3)
(cherry picked from commit 55552a26af9a3d94cd19d30c12efcdc1f373d88b)

diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 2cc78e6..2a3e42b 100644 (file)
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -92,6 +92,13 @@ config CMD_DEKBLOB
          creates a blob of data. See also CMD_BLOB and doc/imx/habv4/* for
          more information.
 
+config CMD_PRIBLOB
+       bool "Support the set_priblob_bitfield command"
+       depends on HAS_CAAM && IMX_HAB
+       help
+         This option enables the priblob command which can be used
+               to set the priblob setting to 0x3.
+
 config CMD_HDMIDETECT
        bool "Support the 'hdmidet' command"
        help

diff --git a/arch/arm/mach-imx/Makefile b/arch/arm/mach-imx/Makefile
index aa1056a..baa3eed 100644 (file)
--- a/arch/arm/mach-imx/Makefile
+++ b/arch/arm/mach-imx/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_SYS_I2C_MXC) += i2c-mxv7.o
 endif
 ifeq ($(SOC),$(filter $(SOC),mx7 mx6 mxs mx7ulp imx8m imx8 imxrt))
 obj-y  += misc.o
+obj-$(CONFIG_CMD_PRIBLOB) += priblob.o
 obj-$(CONFIG_SPL_BUILD)        += spl.o
 endif
 ifeq ($(SOC),$(filter $(SOC),mx7))

diff --git a/arch/arm/mach-imx/priblob.c b/arch/arm/mach-imx/priblob.c
new file mode 100644 (file)
index 0000000..4c5ebda
--- /dev/null
+++ b/arch/arm/mach-imx/priblob.c
@@ -0,0 +1,32 @@
+/*
+ * Copyright 2018 NXP
+ * SPDX-License-Identifier: GPL-2.0+
+ */
+
+/*
+ * Boot command to get and set the PRIBLOB bitfield form the SCFGR register
+ * of the CAAM IP. It is recommended to set this bitfield to 3 once your
+ * encrypted boot image is ready, to prevent the generation of blobs usable
+ * to decrypt an encrypted boot image.
+ */
+#include <asm/io.h>
+#include <common.h>
+#include <command.h>
+#include "../drivers/crypto/fsl_caam_internal.h"
+
+int do_priblob_write(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+       writel((readl(CAAM_SCFGR) & 0xFFFFFFFC) | 3, CAAM_SCFGR);
+       printf("New priblob setting = 0x%x\n", readl(CAAM_SCFGR) & 0x3);
+
+       return 0;
+}
+
+U_BOOT_CMD(
+       set_priblob_bitfield, 1, 0, do_priblob_write,
+       "Set the PRIBLOB bitfield to 3",
+       "<value>\n"
+       "    - Write 3 in PRIBLOB bitfield of SCFGR regiter of CAAM IP.\n"
+       "    Prevent the generation of blobs usable to decrypt an\n"
+       "    encrypted boot image."
+);