Convert CONFIG_CMD_BLOB to Kconfig

This converts the following to Kconfig: CONFIG_CMD_BLOB Signed-off-by: Simon Glass <sjg@chromium.org> [trini: Add imply CMD_BLOB under CHAIN_OF_TRUST] Signed-off-by: Tom Rini <trini@konsulko.com> [Breno: Backported to v2017.03] Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> (cherry picked from commit 921eb14d54c612680c3e73d9ddf9e1b9f526905f)

Convert CONFIG_CMD_BLOB to Kconfig
This converts the following to Kconfig: CONFIG_CMD_BLOB Signed-off-by: Simon Glass <sjg@chromium.org> [trini: Add imply CMD_BLOB under CHAIN_OF_TRUST] Signed-off-by: Tom Rini <trini@konsulko.com> [Breno: Backported to v2017.03] Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> (cherry picked from commit 921eb14d54c612680c3e73d9ddf9e1b9f526905f)
Simon Glass · Ye Li
1 parent 415efc9358
Showing 6 changed files with 47 additions and 4 deletions Side-by-side Diff
arch/arm/include/asm/fsl_secure_boot.h
arch/powerpc/include/asm/fsl_secure_boot.h
board/freescale/common/Kconfig
cmd/Kconfig
cmd/Makefile
scripts/config_whitelist.txt
@@ -28,7 +28,6 @@
 #endif /* ifdef CONFIG_SPL_BUILD */
  
 #ifndef CONFIG_SPL_BUILD
-#define CONFIG_CMD_BLOB
 #define CONFIG_CMD_HASH
 #define CONFIG_KEY_REVOCATION
 #ifndef CONFIG_SYS_RAMBOOT
@@ -100,7 +100,6 @@
 #endif /* ifdef CONFIG_SPL_BUILD */
  
 #define CONFIG_CMD_ESBC_VALIDATE
-#define CONFIG_CMD_BLOB
 #define CONFIG_FSL_SEC_MON
 #define CONFIG_SHA_PROG_HW_ACCEL
  
@@ -2,6 +2,7 @@
  
 config CHAIN_OF_TRUST
 	depends on !FIT_SIGNATURE && SECURE_BOOT
+	imply CMD_BLOB
 	select FSL_CAAM
 	bool
 	default y
@@ -740,6 +740,51 @@
 endmenu
  
 menu "Security commands"
+
+config CMD_BLOB
+	bool "Enable the 'blob' command"
+	help
+	  This is used with the Freescale secure boot mechanism.
+
+	  Freescale's SEC block has built-in Blob Protocol which provides
+	  a method for protecting user-defined data across system power
+	  cycles. SEC block protects data in a data structure called a Blob,
+	  which provides both confidentiality and integrity protection.
+
+	  Encapsulating data as a blob
+	  Each time that the Blob Protocol is used to protect data, a
+	  different randomly generated key is used to encrypt the data.
+	  This random key is itself encrypted using a key which is derived
+	  from SoC's non-volatile secret key and a 16 bit Key identifier.
+	  The resulting encrypted key along with encrypted data is called a
+	  blob. The non-volatile secure key is available for use only during
+	  secure boot.
+
+	  During decapsulation, the reverse process is performed to get back
+	  the original data.
+
+	  Sub-commands:
+            blob enc - encapsulating data as a cryptgraphic blob
+	    blob dec - decapsulating cryptgraphic blob to get the data
+
+	  Syntax:
+
+	  blob enc src dst len km
+
+	  Encapsulate and create blob of data $len bytes long
+	  at address $src and store the result at address $dst.
+	  $km is the 16 byte key modifier is also required for
+	  generation/use as key for cryptographic operation. Key
+	  modifier should be 16 byte long.
+
+	  blob dec src dst len km
+
+	  Decapsulate the  blob of data at address $src and
+	  store result of $len byte at addr $dst.
+	  $km is the 16 byte key modifier is also required for
+	  generation/use as key for cryptographic operation. Key
+	  modifier should be 16 byte long.
+
 config CMD_TPM
 	bool "Enable the 'tpm' command"
 	depends on TPM
@@ -158,9 +158,9 @@
 # Power
 obj-$(CONFIG_CMD_PMIC) += pmic.o
 obj-$(CONFIG_CMD_REGULATOR) += regulator.o
-endif # !CONFIG_SPL_BUILD
  
 obj-$(CONFIG_CMD_BLOB) += blob.o
+endif # !CONFIG_SPL_BUILD
  
 # core command
 obj-y += nvedit.o
@@ -459,7 +459,6 @@
 CONFIG_CMD_ASKEN
 CONFIG_CMD_BAT
 CONFIG_CMD_BEDBUG
-CONFIG_CMD_BLOB
 CONFIG_CMD_BMODE
 CONFIG_CMD_BMP
 CONFIG_CMD_BOOTLDR
...	...	@@ -28,7 +28,6 @@
28	28	#endif /* ifdef CONFIG_SPL_BUILD */
29	29
30	30	#ifndef CONFIG_SPL_BUILD
31		-#define CONFIG_CMD_BLOB
32	31	#define CONFIG_CMD_HASH
33	32	#define CONFIG_KEY_REVOCATION
34	33	#ifndef CONFIG_SYS_RAMBOOT
...	...	@@ -100,7 +100,6 @@
100	100	#endif /* ifdef CONFIG_SPL_BUILD */
101	101
102	102	#define CONFIG_CMD_ESBC_VALIDATE
103		-#define CONFIG_CMD_BLOB
104	103	#define CONFIG_FSL_SEC_MON
105	104	#define CONFIG_SHA_PROG_HW_ACCEL
106	105
...	...	@@ -2,6 +2,7 @@
2	2
3	3	config CHAIN_OF_TRUST
4	4	depends on !FIT_SIGNATURE && SECURE_BOOT
	5	+ imply CMD_BLOB
5	6	select FSL_CAAM
6	7	bool
7	8	default y
...	...	@@ -740,6 +740,51 @@
740	740	endmenu
741	741
742	742	menu "Security commands"
	743	+
	744	+config CMD_BLOB
	745	+ bool "Enable the 'blob' command"
	746	+ help
	747	+ This is used with the Freescale secure boot mechanism.
	748	+
	749	+ Freescale's SEC block has built-in Blob Protocol which provides
	750	+ a method for protecting user-defined data across system power
	751	+ cycles. SEC block protects data in a data structure called a Blob,
	752	+ which provides both confidentiality and integrity protection.
	753	+
	754	+ Encapsulating data as a blob
	755	+ Each time that the Blob Protocol is used to protect data, a
	756	+ different randomly generated key is used to encrypt the data.
	757	+ This random key is itself encrypted using a key which is derived
	758	+ from SoC's non-volatile secret key and a 16 bit Key identifier.
	759	+ The resulting encrypted key along with encrypted data is called a
	760	+ blob. The non-volatile secure key is available for use only during
	761	+ secure boot.
	762	+
	763	+ During decapsulation, the reverse process is performed to get back
	764	+ the original data.
	765	+
	766	+ Sub-commands:
	767	+ blob enc - encapsulating data as a cryptgraphic blob
	768	+ blob dec - decapsulating cryptgraphic blob to get the data
	769	+
	770	+ Syntax:
	771	+
	772	+ blob enc src dst len km
	773	+
	774	+ Encapsulate and create blob of data $len bytes long
	775	+ at address $src and store the result at address $dst.
	776	+ $km is the 16 byte key modifier is also required for
	777	+ generation/use as key for cryptographic operation. Key
	778	+ modifier should be 16 byte long.
	779	+
	780	+ blob dec src dst len km
	781	+
	782	+ Decapsulate the blob of data at address $src and
	783	+ store result of $len byte at addr $dst.
	784	+ $km is the 16 byte key modifier is also required for
	785	+ generation/use as key for cryptographic operation. Key
	786	+ modifier should be 16 byte long.
	787	+
743	788	config CMD_TPM
744	789	bool "Enable the 'tpm' command"
745	790	depends on TPM
...	...	@@ -158,9 +158,9 @@
158	158	# Power
159	159	obj-$(CONFIG_CMD_PMIC) += pmic.o
160	160	obj-$(CONFIG_CMD_REGULATOR) += regulator.o
161		-endif # !CONFIG_SPL_BUILD
162	161
163	162	obj-$(CONFIG_CMD_BLOB) += blob.o
	163	+endif # !CONFIG_SPL_BUILD
164	164
165	165	# core command
166	166	obj-y += nvedit.o
...	...	@@ -459,7 +459,6 @@
459	459	CONFIG_CMD_ASKEN
460	460	CONFIG_CMD_BAT
461	461	CONFIG_CMD_BEDBUG
462		-CONFIG_CMD_BLOB
463	462	CONFIG_CMD_BMODE
464	463	CONFIG_CMD_BMP
465	464	CONFIG_CMD_BOOTLDR