From: Simon Glass Date: Thu, 27 Apr 2017 04:27:53 +0000 (-0600) Subject: Convert CONFIG_CMD_BLOB to Kconfig X-Git-Tag: v2017.05-rc3~27 X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=c04b9b3440a2b2c55267bc76c594f49d101657fb;p=u-boot Convert CONFIG_CMD_BLOB to Kconfig This converts the following to Kconfig: CONFIG_CMD_BLOB Signed-off-by: Simon Glass [trini: Add imply CMD_BLOB under CHAIN_OF_TRUST] Signed-off-by: Tom Rini --- diff --git a/arch/arm/include/asm/fsl_secure_boot.h b/arch/arm/include/asm/fsl_secure_boot.h index f5ca5d3b69..b0ca4bcf04 100644 --- a/arch/arm/include/asm/fsl_secure_boot.h +++ b/arch/arm/include/asm/fsl_secure_boot.h @@ -30,7 +30,6 @@ #define CONFIG_KEY_REVOCATION #ifndef CONFIG_SPL_BUILD -#define CONFIG_CMD_BLOB #define CONFIG_CMD_HASH #ifndef CONFIG_SYS_RAMBOOT /* The key used for verification of next level images diff --git a/arch/powerpc/include/asm/fsl_secure_boot.h b/arch/powerpc/include/asm/fsl_secure_boot.h index 2b5a2913ec..62ce816b13 100644 --- a/arch/powerpc/include/asm/fsl_secure_boot.h +++ b/arch/powerpc/include/asm/fsl_secure_boot.h @@ -104,7 +104,6 @@ #define CONFIG_SHA_PROG_HW_ACCEL #ifndef CONFIG_SPL_BUILD -#define CONFIG_CMD_BLOB /* * fsl_setenv_chain_of_trust() must be called from * board_late_init() diff --git a/board/freescale/common/Kconfig b/board/freescale/common/Kconfig index f5190ac178..8a9a9be8ce 100644 --- a/board/freescale/common/Kconfig +++ b/board/freescale/common/Kconfig @@ -1,5 +1,6 @@ config CHAIN_OF_TRUST depends on !FIT_SIGNATURE && SECURE_BOOT + imply CMD_BLOB select FSL_CAAM bool default y diff --git a/cmd/Kconfig b/cmd/Kconfig index 0c6d44e296..306027c11a 100644 --- a/cmd/Kconfig +++ b/cmd/Kconfig @@ -779,6 +779,50 @@ config CMD_AES supported by the algorithm but this command only supports 128 bits at present. +config CMD_BLOB + bool "Enable the 'blob' command" + help + This is used with the Freescale secure boot mechanism. + + Freescale's SEC block has built-in Blob Protocol which provides + a method for protecting user-defined data across system power + cycles. SEC block protects data in a data structure called a Blob, + which provides both confidentiality and integrity protection. + + Encapsulating data as a blob + Each time that the Blob Protocol is used to protect data, a + different randomly generated key is used to encrypt the data. + This random key is itself encrypted using a key which is derived + from SoC's non-volatile secret key and a 16 bit Key identifier. + The resulting encrypted key along with encrypted data is called a + blob. The non-volatile secure key is available for use only during + secure boot. + + During decapsulation, the reverse process is performed to get back + the original data. + + Sub-commands: + blob enc - encapsulating data as a cryptgraphic blob + blob dec - decapsulating cryptgraphic blob to get the data + + Syntax: + + blob enc src dst len km + + Encapsulate and create blob of data $len bytes long + at address $src and store the result at address $dst. + $km is the 16 byte key modifier is also required for + generation/use as key for cryptographic operation. Key + modifier should be 16 byte long. + + blob dec src dst len km + + Decapsulate the blob of data at address $src and + store result of $len byte at addr $dst. + $km is the 16 byte key modifier is also required for + generation/use as key for cryptographic operation. Key + modifier should be 16 byte long. + config CMD_TPM bool "Enable the 'tpm' command" depends on TPM diff --git a/cmd/Makefile b/cmd/Makefile index 97c862f651..e98786807b 100644 --- a/cmd/Makefile +++ b/cmd/Makefile @@ -152,9 +152,9 @@ obj-$(CONFIG_CMD_ETHSW) += ethsw.o # Power obj-$(CONFIG_CMD_PMIC) += pmic.o obj-$(CONFIG_CMD_REGULATOR) += regulator.o -endif # !CONFIG_SPL_BUILD obj-$(CONFIG_CMD_BLOB) += blob.o +endif # !CONFIG_SPL_BUILD # core command obj-y += nvedit.o diff --git a/scripts/config_whitelist.txt b/scripts/config_whitelist.txt index a58faf7194..091cfd35af 100644 --- a/scripts/config_whitelist.txt +++ b/scripts/config_whitelist.txt @@ -393,7 +393,6 @@ CONFIG_CM922T_XA10 CONFIG_CMDLINE_EDITING CONFIG_CMDLINE_PS_SUPPORT CONFIG_CMDLINE_TAG -CONFIG_CMD_BLOB CONFIG_CMD_BMODE CONFIG_CMD_BMP CONFIG_CMD_BSP