Problem authenticating zImage with HABv4 RVT on i.MX6ULZ

[sjuengst]

Hi, I'm trying to authenticate the linux kernel zImage using HABv4 RVT calls in u-boot-imx_2020.04.  I'm getting a HAB failure that looks to be caused by a stale data cache.  Here's my csf.bin.  At offset 0x48, you can see that I'm asking HAB to authenticate 0x80800000 for length 0x8ff020.

0000000 d4 00 50 40 be 00 0c 00 03 17 00 00 00 00 00 50
0000010 be 00 0c 02 09 00 00 01 00 00 08 90 ca 00 0c 00
0000020 01 c5 00 00 00 00 0d e4 b2 00 08 ff 00 00 00 02
0000030 be 00 0c 00 09 00 00 02 00 00 10 e8 ca 00 14 00
0000040 02 c5 00 00 00 00 16 3c 80 80 00 00 00 8f f0 20
0000050 d7 08 40 40 e1 02 0f 21 00 00 00 80 02 00 00 03

When authenticate_image() runs, HAB reports an invalid signature on 0x877ff400 for length 0x075c00.  Note that 0x877ff400 is also the u-boot DDR address (which had just recently been HAB authenticated by the boot ROM).

Authenticate image from DDR location 0x80800000...

Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------
event data:
	0xdb 0x00 0x1c 0x42 0x33 0x18 0xc0 0x00
	0xca 0x00 0x14 0x00 0x02 0xc5 0x00 0x00
	0x00 0x00 0x16 0x3c 0x87 0x7f 0xf4 0x00
	0x00 0x07 0x5c 0x00

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

U-boot contains this code block to disable the MMU on some i.MX6 variants, but it doesn't handle i.MX6ULZ.

    /*
     * If the MMU is enabled, we have to notify the ROM
     * code, or it won't flush the caches when needed.
     * This is done, by setting the "pu_irom_mmu_enabled"
     * word to 1. You can find its address by looking in
     * the ROM map. This is critical for
     * authenticate_image(). If MMU is enabled, without
     * setting this bit, authentication will fail and may
     * crash.
     */
    /* Check MMU enabled */
    if (is_soc_type(MXC_SOC_MX6) && get_cr() & CR_M) {
        if (is_mx6dq()) {
            /*
             * This won't work on Rev 1.0.0 of
             * i.MX6Q/D, since their ROM doesn't
             * do cache flushes. don't think any
             * exist, so we ignore them.
             */
            if (!is_mx6dqp())
                writel(1, MX6DQ_PU_IROM_MMU_EN_VAR);
        } else if (is_mx6sdl()) {
            writel(1, MX6DLS_PU_IROM_MMU_EN_VAR);
        } else if (is_mx6sl()) {
            writel(1, MX6SL_PU_IROM_MMU_EN_VAR);
        }
    }

Can someone tell me whether there's a similar PU_IROM_MMU_EN_VAR flag for i.MX6ULZ?

Thanks,

Stu

[Yuri]

@sjuengst 
Hello,

  I've sent You some comments directly.

Regards,
Yuri.