summaryrefslogtreecommitdiff
path: root/doc/README.esbc_validate
diff options
context:
space:
mode:
authorgaurav rana <gaurav.rana@freescale.com>2015-02-27 09:45:35 +0530
committerYork Sun <yorksun@freescale.com>2015-03-05 12:04:59 -0800
commit47151e4bcc10d87247e0a4809e6761b4477aa80b (patch)
treee17de983af82f8df694b90ff9a0af5b6e0a81bdf /doc/README.esbc_validate
parentfe78378d7df90541c09b279b67ce79ebbdca93d5 (diff)
downloadu-boot-imx-47151e4bcc10d87247e0a4809e6761b4477aa80b.zip
u-boot-imx-47151e4bcc10d87247e0a4809e6761b4477aa80b.tar.gz
u-boot-imx-47151e4bcc10d87247e0a4809e6761b4477aa80b.tar.bz2
SECURE BOOT: Add command for validation of images
1. esbc_validate command is meant for validating header and signature of images (Boot Script and ESBC uboot client). SHA-256 and RSA operations are performed using SEC block in HW. This command works on both PBL based and Non PBL based Freescale platforms. Command usage: esbc_validate img_hdr_addr [pub_key_hash] 2. ESBC uboot client can be linux. Additionally, rootfs and device tree blob can also be signed. 3. In the event of header or signature failure in validation, ITS and ITF bits determine further course of action. 4. In case of soft failure, appropriate error is dumped on console. 5. In case of hard failure, SoC is issued RESET REQUEST after dumping error on the console. 6. KEY REVOCATION Feature: QorIQ platforms like B4/T4 have support of srk key table and key revocation in ISBC code in Silicon. The srk key table allows the user to have a key table with multiple keys and revoke any key in case of particular key gets compromised. In case the ISBC code uses the key revocation and srk key table to verify the u-boot code, the subsequent chain of trust should also use the same. 6. ISBC KEY EXTENSION Feature: This feature allows large number of keys to be used for esbc validation of images. A set of public keys is being signed and validated by ISBC which can be further used for esbc validation of images. Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com> Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com> Reviewed-by: York Sun <yorksun@freescale.com>
Diffstat (limited to 'doc/README.esbc_validate')
-rw-r--r--doc/README.esbc_validate41
1 files changed, 41 insertions, 0 deletions
diff --git a/doc/README.esbc_validate b/doc/README.esbc_validate
new file mode 100644
index 0000000..941b607
--- /dev/null
+++ b/doc/README.esbc_validate
@@ -0,0 +1,41 @@
+/*
+ * (C) Copyright 2015
+ *
+ * SPDX-License-Identifier: GPL-2.0+
+ */
+
+esbc_validate command
+========================================
+
+1. esbc_validate command is meant for validating header and
+ signature of images (Boot Script and ESBC uboot client).
+ SHA-256 and RSA operations are performed using SEC block in HW.
+ This command works on both PBL based and Non PBL based Freescale
+ platforms.
+ Command usage:
+ esbc_validate img_hdr_addr [pub_key_hash]
+ esbc_validate hdr_addr <hash_val>
+ Validates signature using RSA verification.
+ $hdr_addr Address of header of the image to be validated.
+ $hash_val -Optional. It provides Hash of public/srk key to be
+ used to verify signature.
+
+2. ESBC uboot client can be linux. Additionally, rootfs and device
+ tree blob can also be signed.
+3. In the event of header or signature failure in validation,
+ ITS and ITF bits determine further course of action.
+4. In case of soft failure, appropriate error is dumped on console.
+5. In case of hard failure, SoC is issued RESET REQUEST after
+ dumping error on the console.
+6. KEY REVOCATION Feature:
+ QorIQ platforms like B4/T4 have support of srk key table and key
+ revocation in ISBC code in Silicon.
+ The srk key table allows the user to have a key table with multiple
+ keys and revoke any key in case of particular key gets compromised.
+ In case the ISBC code uses the key revocation and srk key table to
+ verify the u-boot code, the subsequent chain of trust should also
+ use the same.
+6. ISBC KEY EXTENSION Feature:
+ This feature allows large number of keys to be used for esbc validation
+ of images. A set of public keys is being signed and validated by ISBC
+ which can be further used for esbc validation of images.