topic Re: Using `dek_blob` command in i.MX6UL in i.MX Processors

Using `dek_blob` command in i.MX6UL

jdepedro — Wed, 22 Jun 2016 07:38:54 GMT

I am trying to use the dek_command in the i.MX6UL, but I am getting some errors:

=> dek_blob 0x80800000 0x80801000 80

RNG: Instantiation failed with error ffffffff

RNG: Instantiation failed with error fffffffd

RNG: Failed to instantiate RNG

RNG instantiation failed

Encapsulating provided DEK to form blob

Allocation of page 0 in partition 1 failed 0x1

I add the following U-Boot configuration options:

#define CONFIG_SYS_FSL_SEC-COMPAT 4

#define CONFIG_FSL_CAAM

#define CONFIG_CMD_DEKBLOB

#define CONFIG_SYS_FSL_SEC_LE

Is the configuration correct? How could I debug/fix those errors?

Re: Using `dek_blob` command in i.MX6UL

Yuri — Fri, 24 Jun 2016 06:33:45 GMT

Hello,

IMX6 should be booted using the signed U-boot.

Also, please look at the following

Encrypted boot loader on SabreSD i.MX6q board

Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Fri, 24 Jun 2016 06:59:04 GMT

Hi Yuri,

thanks for your answer. I am already using a signed U-Boot image. Can you comment on the configuration for the header? Specifically should I use

#define CONFIG_SYS_FSL_SEC_LE

#define CONFIG_SYS_FSL_SEC_BE?

Also, I have this working on the i.MX6Q. So I expect this to some specific configuration for the i.MX6UL. The only thing I can think is the HAB version, which is 4.1.2 in i.MX6UL. Not sure if this would somehow affect to the dek_blob command.

Re: Using `dek_blob` command in i.MX6UL

Yuri — Mon, 04 Jul 2016 06:53:53 GMT

Hello,

basically U-boot options for i.MX6 UL are the same as for other devices of i.MX6 series.

perhaps the following helps.

Encrypted U-boot Example

Regards,

Yuri.

Re: Using `dek_blob` command in i.MX6UL

robertlubas — Tue, 02 Aug 2016 09:41:16 GMT

Hello,

I have singed u-boot with no hab_events and with #define CONFIG_SYS_FSL_SEC_LE. I'm getting the same errors in dek_blob.

Do you have anything new?

Regards,

Robert

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Tue, 02 Aug 2016 10:58:11 GMT

Could you provide a way to contact you? I have tried some things by myself and have some progress, but not working yet.

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Thu, 25 Aug 2016 12:35:12 GMT

Hello,

do you have any progress on this?

Regards,

Jiri

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Thu, 25 Aug 2016 12:56:34 GMT

Yes, to make it work you need to fix two problems:

The secure memory register map is not correctly defined. I cannot provide the details as they come from the i.MX6UL Security Reference Manual, which is a document under NDA. I think you have to contact your local NXP FAE to get that.
The memory invalidation ranges are not correct, which leads to problems when using caches and DMA for the CAAM. As a workaround, you can just disable the intruction and data caches during DEK blob generation.

I hope that helps.

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Thu, 25 Aug 2016 16:02:49 GMT

Ok, my happiness was a bit premature. I did both steps (I expect both are described also in https://community.nxp.com/thread/395507#comment-819340). And I got the same error.

So, I still have not burned SEC_CONFIG fuse, but I expect fake key is used in that case to encrypt DEK.

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Thu, 25 Aug 2016 16:08:21 GMT

Not having the SEC_CONFIG fuse burned is not a problem, as you expect, the test key is used instead of the OTPMK, but the dek blob command should still work.

Are you sure that the caches are disabled and that you have applied the patch for the registers? Provide the output with debug enabled and I may be able to help you.

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Thu, 25 Aug 2016 16:40:46 GMT

I'm not absolutely sure about caches, but I expect dcache off and icache off commands to work in U-Boot. Providing debug output will be a bit problematic as we're using U-Boot 2016.05 instead of the older one from FSL.

Furthermore I tried whether at least hw accelerated hash functions works and they don't. So there are two options. CAAM is broken in upstream U-Boot, or (the more probable) I have some serious mistake in my board configuration. So I'll have to spend some time investigating and I'll eventually let you know.

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Fri, 26 Aug 2016 14:22:26 GMT

So,

I followed Encrypted boot loader on SabreSD i.MX6q board with little difference related to MX6UL and also took https://community.nxp.com/thread/395507#comment into account. The last difference is that we use U-Boot 2016.05 instead of U-Boot 2016.03 used in 1st link above. Thus I reverted commit f91e65a74eff93d5187a3b27e1badd80c2a35fed (imx: Refactoring CAAM Job Ring structure and Secure Memory for imx7) and used patch from 2nd link.

After enabling a little debugging in CAAM i got:

==> mw.b 0x83701000 0xff 0x1000
==> dek_blob 0x83700000 0x83701000 128

Encapsulating provided DEK to form blob
Allocation of page 0 in partition 1 failed 0x1
Error in Job Descriptor Construction: 1
Error in Encapsulation 1
==> md.b 0x83701000 0x48
83701000: 81 00 48 41 66 55 10 00 00 00 00 00 00 00 00 00 ..HAfU..........
83701010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
83701020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
83701030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
83701040: 00 00 00 00 00 00 00 00

And that is dead end for me.

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Fri, 26 Aug 2016 14:32:47 GMT

The i.MX6Q uses a different Secure Memory version than the i.MX6UL.

I would recommend to test in the NXP release of U-Boot 2015.04 applying the patch and disabling the caches. Verify that it works then and then check the differences (or git bisect).

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Mon, 29 Aug 2016 13:42:58 GMT

Hello,

I get back to 2015.04, where is fortunately a bit easier to get debug outputs. So our problem is also with RNG.

01: operation
02: jump
03: load_imm_u32
05: operation
Error in SEC deq
RNG: Instantiation failed with error ffffffff
01: operation
02: jump
03: load_imm_u32
05: operation
Error in SEC deq
RNG: Instantiation failed with error ffffffff
01: operation
02: jump
03: load_imm_u32
05: operation
Error in SEC deq
RNG: Instantiation failed with error ffffffff
01: operation
02: jump
03: load_imm_u32
05: operation
Error in SEC enq
RNG: Instantiation failed with error fffffffd
RNG: Failed to instantiate RNG
RNG instantiation failed

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Mon, 29 Aug 2016 13:45:36 GMT

Are you completely sure that you applied the register map patch and recompiled and reflashed properly? Those are the exact same error messages that you would get without the patch applied.

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Mon, 29 Aug 2016 14:06:09 GMT

I rather rechecked it. I got this RNG error despite the patch is applied or not.

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Mon, 29 Aug 2016 14:11:11 GMT

I cannot help you further then, maybe you are using a different i.MX6UL (I am usnig i.MX6UL-2). You should probably open a Service Request with NXP, as they don't usually discuss this security related topics on the community forums.

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Tue, 30 Aug 2016 13:05:43 GMT

I finally made it to work. The core of the problem was function sec_init(). Which is re-entrant unless it fails. And it fails if it has caches on. And if you forget this function in your board init from time, when you were trying to get hw accelerated hashing function to work, then you're doomed.

Re: Using `dek_blob` command in i.MX6UL

jdepedro — Tue, 30 Aug 2016 13:24:06 GMT

I though you were using the NXP branch of U-Boot (which does not use hw accelerated hashing functions).

Glad to hear it is working now.

Re: Using `dek_blob` command in i.MX6UL

jiriluznicky — Fri, 02 Sep 2016 12:38:33 GMT

FYI: In upstream U-Boot there is badly defined CAAM_BASE_ADDR in /arch/arm/include/asm/arch-mx6/imx-regs.h. It's fixed in imx-2015.04 branch with MLK-10808-3 commit. But never merged into upstream.