[PATCH] ARM: i.MX: configurable Super Root Key index

[PATCH] ARM: i.MX: configurable Super Root Key index

[Rouven Czerwinski]

Allow the configuration of the Super Root Key Index, to let the user
select another key if a previous key has been revoked.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
---
 arch/arm/mach-imx/Kconfig                          | 10 ++++++++++
 arch/arm/mach-imx/include/mach/habv4-imx6-gencsf.h |  2 +-
 arch/arm/mach-imx/include/mach/habv4-imx8-gencsf.h |  2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index 072c659008..6dd5cb2aca 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -845,6 +845,16 @@ config HAB_CERTS_ENV
 	  CONFIG_HABV4_CSF_CRT_PEM
 	  CONFIG_HABV4_IMG_CRT_PEM
 
+config HABV4_SRK_INDEX
+	depends on HABV4
+	int "SRK index"
+	default 0
+	help
+	  Select the Super Root Key used in the Command Sequence File to sign
+	  the CSF binary. This should only be changed if a previous key was
+	  revoked and another key needs to be used. For HABV4 the Index is in
+	  the range from 0 to 3.
+
 if HABV4 && !HAB_CERTS_ENV
 
 config HABV4_TABLE_BIN
diff --git a/arch/arm/mach-imx/include/mach/habv4-imx6-gencsf.h b/arch/arm/mach-imx/include/mach/habv4-imx6-gencsf.h
index 5818879609..2961b97b79 100644
--- a/arch/arm/mach-imx/include/mach/habv4-imx6-gencsf.h
+++ b/arch/arm/mach-imx/include/mach/habv4-imx6-gencsf.h
@@ -19,7 +19,7 @@ hab Engine = CAAM
 hab [Install SRK]
 hab File = CONFIG_HABV4_TABLE_BIN
 hab # SRK index within SRK-Table 0..3
-hab Source index = 0
+hab Source index = CONFIG_HABV4_SRK_INDEX
 
 hab [Install CSFK]
 /* target key index in keystore 1 */
diff --git a/arch/arm/mach-imx/include/mach/habv4-imx8-gencsf.h b/arch/arm/mach-imx/include/mach/habv4-imx8-gencsf.h
index 34039ee590..9ed6893988 100644
--- a/arch/arm/mach-imx/include/mach/habv4-imx8-gencsf.h
+++ b/arch/arm/mach-imx/include/mach/habv4-imx8-gencsf.h
@@ -19,7 +19,7 @@ hab Engine = CAAM
 hab [Install SRK]
 hab File = CONFIG_HABV4_TABLE_BIN
 hab # SRK index within SRK-Table 0..3
-hab Source index = 0
+hab Source index = CONFIG_HABV4_SRK_INDEX
 
 hab [Install CSFK]
 /* target key index in keystore 1 */
-- 
2.26.1


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: [PATCH] ARM: i.MX: configurable Super Root Key index

[Sascha Hauer]

On Tue, May 05, 2020 at 02:58:36PM +0200, Rouven Czerwinski wrote:
> Allow the configuration of the Super Root Key Index, to let the user
> select another key if a previous key has been revoked.
> 
> Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
> ---
>  arch/arm/mach-imx/Kconfig                          | 10 ++++++++++
>  arch/arm/mach-imx/include/mach/habv4-imx6-gencsf.h |  2 +-
>  arch/arm/mach-imx/include/mach/habv4-imx8-gencsf.h |  2 +-
>  3 files changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
> index 072c659008..6dd5cb2aca 100644
> --- a/arch/arm/mach-imx/Kconfig
> +++ b/arch/arm/mach-imx/Kconfig
> @@ -845,6 +845,16 @@ config HAB_CERTS_ENV
>  	  CONFIG_HABV4_CSF_CRT_PEM
>  	  CONFIG_HABV4_IMG_CRT_PEM
>  
> +config HABV4_SRK_INDEX
> +	depends on HABV4
> +	int "SRK index"
> +	default 0
> +	help
> +	  Select the Super Root Key used in the Command Sequence File to sign
> +	  the CSF binary. This should only be changed if a previous key was
> +	  revoked and another key needs to be used. For HABV4 the Index is in
> +	  the range from 0 to 3.

Applied this time, but I hope that we won't get many more of these
policy encoding defines in habv4-imx6-gencsf.h.

Sascha


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox