diff options
| author | Sascha Hauer <s.hauer@pengutronix.de> | 2017-03-23 11:19:38 +0100 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2017-04-04 08:44:29 +0200 |
| commit | 9dc622d5622ceeedfc5e793a201cad029ff0f5ab (patch) | |
| tree | ab76b409c306a42a62fb1a85db09d8122e9ac8f9 /include | |
| parent | f98666122e3456115cbb0cb8bd730a87183deb98 (diff) | |
| download | barebox-9dc622d5622ceeedfc5e793a201cad029ff0f5ab.tar.gz barebox-9dc622d5622ceeedfc5e793a201cad029ff0f5ab.tar.xz | |
i.MX: hab: Add HAB fusebox related convenience functions / command
Secure boot with HAB requires handling of the super root key hash
and actually locking down the device. The related information is
stored in the i.MX fusebox device (IIM on older SoCs, OCOTP on newer
SoCs). This patch adds several convenience functions to store and
read the super root key hash and to lock down a SoC. Also we add
a command to do this from the command line.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'include')
| -rw-r--r-- | include/hab.h | 21 |
1 files changed, 21 insertions, 0 deletions
diff --git a/include/hab.h b/include/hab.h index 818d7ca1c5..fb7149ef53 100644 --- a/include/hab.h +++ b/include/hab.h @@ -41,4 +41,25 @@ static inline int imx25_hab_get_status(void) } #endif +#define SRK_HASH_SIZE 32 + +/* Force writing of key, even when a key is already written */ +#define IMX_SRK_HASH_FORCE (1 << 0) +/* Permanently write fuses, without this flag only the shadow registers + * are written. + */ +#define IMX_SRK_HASH_WRITE_PERMANENT (1 << 1) +/* When writing the super root key hash, also burn the write protection + * fuses so that the key hash can not be modified. + */ +#define IMX_SRK_HASH_WRITE_LOCK (1 << 2) + +bool imx_hab_srk_hash_valid(const void *buf); +int imx_hab_write_srk_hash(const void *buf, unsigned flags); +int imx_hab_write_srk_hash_hex(const char *srkhash, unsigned flags); +int imx_hab_write_srk_hash_file(const char *filename, unsigned flags); +int imx_hab_read_srk_hash(void *buf); +int imx_hab_lockdown_device(unsigned flags); +int imx_hab_device_locked_down(void); + #endif /* __HABV4_H */ |