From: Stefan Kerkmann <s.kerkmann@pengutronix.de>
To: Sascha Hauer <s.hauer@pengutronix.de>,
BAREBOX <barebox@lists.infradead.org>
Cc: Marco Felsch <m.felsch@pengutronix.de>,
Stefan Kerkmann <s.kerkmann@pengutronix.de>
Subject: [PATCH v3 06/10] i.MX8M: HABv4: add an option to allow key revocation
Date: Thu, 23 Jan 2025 15:56:11 +0100 [thread overview]
Message-ID: <20250123-v2024-05-0-topic-hab-v3-6-e90d0e43c2de@pengutronix.de> (raw)
In-Reply-To: <20250123-v2024-05-0-topic-hab-v3-0-e90d0e43c2de@pengutronix.de>
From: Marco Felsch <m.felsch@pengutronix.de>
The HAB code needs an special [Unlock] instruction to keep the
SRK_REVOKE fuse bank unlocked. This is required if a key needs to be
revoked.
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
---
arch/arm/mach-imx/Kconfig | 8 ++++++++
include/mach/imx/habv4-imx8-gencsf.h | 6 ++++++
2 files changed, 14 insertions(+)
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig
index d1f8dc795b578fafd2bd2b4c1e59b85430668af7..c8a439b8a0b11fa168419ce77d7ee83fa86f2298 100644
--- a/arch/arm/mach-imx/Kconfig
+++ b/arch/arm/mach-imx/Kconfig
@@ -830,6 +830,14 @@ config HABV4_QSPI
help
Enable this option to build signed QSPI/FlexSPI images.
+config HABV4_CSF_SRK_REVOKE_UNLOCK
+ depends on HABV4
+ bool "Unlock SRK revocation"
+ help
+ Enable this option to instruct the HAB code to not lock
+ the SRK_REVOKE_LOCK sticky bit. This is required for key
+ revocation. Don't enable this if you are unsure.
+
config HAB_CERTS_ENV
depends on HAB
bool "Specify certificates in environment"
diff --git a/include/mach/imx/habv4-imx8-gencsf.h b/include/mach/imx/habv4-imx8-gencsf.h
index 5f92ceceab00bcb740fc288c050be23e1ed307c2..b3d29f5896881ba2abeaa6d4b297a031240fac99 100644
--- a/include/mach/imx/habv4-imx8-gencsf.h
+++ b/include/mach/imx/habv4-imx8-gencsf.h
@@ -36,6 +36,12 @@ hab [Unlock]
hab Engine = CAAM
hab Features = RNG, MID
+#if defined(CONFIG_HABV4_CSF_SRK_REVOKE_UNLOCK)
+hab [Unlock]
+hab Engine = OCOTP
+hab Features = SRK REVOKE
+#endif
+
hab [Install Key]
/* verification key index in key store (0, 2...4) */
hab Verification index = 0
--
2.39.5
next prev parent reply other threads:[~2025-01-23 15:01 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-01-23 14:56 [PATCH v3 00/10] i.MX8M HAB and OCOTP additions and fixes Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 01/10] nvmem: ocotp: add support to get/set srk_revoke sticky bit Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 02/10] nvmem: ocotp: add support to query the field-return " Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 03/10] hab: convert flags to use BIT() macro Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 04/10] i.MX: HAB: add imx_hab_revoke_key support Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 05/10] i.MX: HABv4: add more i.MX8M fuse defines Stefan Kerkmann
2025-01-23 14:56 ` Stefan Kerkmann [this message]
2025-01-23 14:56 ` [PATCH v3 07/10] i.MX8M: HABv4: add option to allow burning the field-return fuse Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 08/10] i.MX: HAB: add imx_hab_field_return support Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 09/10] i.mx8: ocotp: add GPx_LOCK defines Stefan Kerkmann
2025-01-23 14:56 ` [PATCH v3 10/10] hab: lock GP5 on i.MX8MP socs Stefan Kerkmann
2025-01-28 10:00 ` [PATCH v3 00/10] i.MX8M HAB and OCOTP additions and fixes Sascha Hauer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250123-v2024-05-0-topic-hab-v3-6-e90d0e43c2de@pengutronix.de \
--to=s.kerkmann@pengutronix.de \
--cc=barebox@lists.infradead.org \
--cc=m.felsch@pengutronix.de \
--cc=s.hauer@pengutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox