secure boot otp provisioning tool - Githubissues

siemens / meta-iot2050

SIMATIC IOT2050 Isar/Debian Board Support Package

MIT License

130 stars 79 forks source link

secure boot otp provisioning tool #320

Closed BaochengSu closed 2 years ago

BaochengSu commented 2 years ago

V3 updates:

Drop un-needed count=1 during dd-ing the otpcmd.bin to u-boot flash.bin
Rewording: Revoke a leaked in-use key
Add kconfig options of anti-rollback secure version of SPL.

V2 updates:

Add set -e to make-otpcmd.sh
Re-organize the its file by make something common to include
Symlink the custMpk to u-boot files.
Use kas opt yaml for options
Use isar TEMPLATE_* instead of sbuild
Renewed the custSmpk and custBmpk certificate
u-boot modification is dropped, a dd copy is added after u-boot building.
Add ducoment for MPK, SMPK, BMPK
Revised README.md to reveal the existence of the make-otpcmd.sh

V1

Add a recipe for generating the otpcmd data
Refact the u-boot to take external otpcmd blob
Write the README.md regarding how to programming keys into OTP

Meanwhile:

Fix for the filesize command in u-boot

BaochengSu commented 2 years ago

Looks good to me now.

I was wondering if we should make the OTP features also available via kconfig, but I think they are too special and too critical to expose them this way. So, fine as it is IMHO.

You mean the kas-container menu? exactly same thoughts with you, too special and too occasional.

jan-kiszka commented 2 years ago

Yup, the kconfig for kas-container menu.