leandrof/u-boot
1
0
Fork 1
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fsl: Secure Boot: Enable IE (Key extention) Feature

Browse Source 
For validating images from uboot (Such as Kernel Image), either keys
from SoC fuses can be used or keys from a verified table of public
keys can be used. The latter feature is called IE Key Extension
Feature.

For Layerscape Chasis 3 based platforms, IE table is validated by
Bootrom and address of this table is written in scratch registers 13
and 14 via PBI commands.

Following are the steps describing usage of this feature:

1) Verify IE Table in ISBC phase using keys stored in fuses.
2) Install IE table. (To be used across verification of multiple
   images stored in a static global structure.)
3) Use keys from IE table, to verify further images.

Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Signed-off-by: Saksham Jain <saksham.jain@nxp.com>
Signed-off-by: Udit Agarwal <udit.agarwal@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
This commit is contained in:
Udit Agarwal
2017-02-09 21:36:11 +05:30
committed by York Sun
parent 6d7b9e78f5
commit ac55dadb1c
3 changed files with 97 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
arch/arm/include/asm/fsl_secure_boot.h
View File

@@ -38,11 +38,11 @@
* in boot ROM of the SoC.
* The feature is only applicable in case of NOR boot and is
* not applicable in case of RAMBOOT (NAND, SD, SPI).
* For LS, this feature is available for all device if IE Table
* is copied to XIP memory
* Also, for LS, ISBC doesn't verify this table.
*/
#ifndef CONFIG_ESBC_HDR_LS
/* Current Key EXT feature not available in LS ESBC Header */
#define CONFIG_FSL_ISBC_KEY_EXT
#endif
#endif