                CST 2.3.3 Release Notes


PROJECT(S):             CST
DATE:                   November 14th, 2017

           COPYRIGHT © 2017 NXP
           ALL RIGHTS RESERVED. PRESENCE OF COPYRIGHT
           NOTICE IS NOT AN ACKNOWLEDGEMENT OF PUBLICATION.

1 READ ME FIRST
    This is the NXP Code Signing Tool (CST) for the High
    Assurance Boot (HAB) library. The CST provides software code
    signing support designed for use with NXP processors that
    integrate the HAB library in the internal boot ROM. This release
    provides the features required for the code signing for SoC
    supporting HAB version 3 and HAB version 4.

1.1 REQUIREMENTS
    This release supports Linux and Windows hosts
    For Linux, the CST is known to work on Ubuntu 14.04 and later.
    For Windows, the CST is known to work on Windows 7 and later

    Most Linux distributions should work but they have not been fully
    tested. If you run into library problems, see section 2.1 below
    for instructions on how to relink CST.

1.2 PROBLEM REPORTING INSTRUCTIONS
    Problems with this release may be reported to your local NXP
    representative or at community.nxp.com.


2 NEW FEATURES & Fixes
    The following is included in this release:

2.1 Encrypted Boot support
    This version of CST allows the user to relink the executable
    to include support for generating encrypted boot images.

    To relink on 32 bit Linux machines:
       cd <CST install directory>/code/back_end/src
       gcc -o cst -I ../hdr -L ../../../linux32/lib *.c \
           -lfrontend -lcrypto
       cp cst ../../../linux32

    To relink on 64 bit Linux machines:
       cd <CST install directory/code/back_end/src
       gcc -o cst -I ../hdr -L ../../../linux64/lib *.c -lfrontend -lcrypto
       cp cst ../../../linux64

    To relink on Windows machines:
       This requires the MINGW compiler and OpenSSL header files and
       library. The easiest way to get them is to install Cygwin

       cd <CST install directory/code/back_end/src
       i686-w64-mingw32-gcc -o cst.exe -I ../hdr -L ../../../mingw32/lib \
         *.c -lfrontend -lcrypto
       cp cst ../../../mingw32


    This was added in CST 2.3.0

2.2 64 bit native binaries
    CST now includes both 32 and 64 bit native binaries. They are
    located in the linux32 and linux64 directories, respectively.

    This was added in CST 2.3.0

2.3 Issue INIT RNG command
    On closed i.MX devices with CAAM, HAB will initialize the RNG by
    default. If the RNG trim fuses have not been set correctly, RNG
    iniatialization will fail, causing the boot to fail.

    To prevent HAB from initializing the RNG, you can add an UNLOCK
    command to the CST input file.

    This version of CST will add that command automatically if the CSF
    includes "Engine = CAAM" in the header unless
    explicitly told otherwise. The way to disable this behavior is to
    add the following to the CST input file:
        [Init]
             Engine = CAAM
             Features = RNG

    This was added in CST 2.3.1, fixed in 2.3.2

2.4 Changed CST input file handling
    Previous versions of CST got the CSF input file on standard
    input. This has changed. Now the input filename is supplied as a
    command line argument.

    Example:
       cst --output csf.bin --input input.csf

    This was added in CST 2.3.2

2.5 Added unlock command for Manufacturing Protection
    The new unlock command will cause HAB to keep the manufacturing
    protection key in internal CAAM memory after boot.

    This was added in CST 2.3.2

2.6 Windows support
    This version of CST adds support for Microsoft Windows.

    This was added in CST 2.3.3

2.7 Removed several commands
    This version of CST removed support for the following commands:
    	 Write Data
	 Clear Mask
	 Set Mask
	 Check All Clear
	 Check All Set
	 Check Any Clear
	 Check Any Set
	 Set MID

    This was added in CST 2.3.3




3 KNOWN ISSUES

No known issues.

