Hi,
What 'Generating a fast authentication PKI tree' suppose to mean.
I was following pretty much:
https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/Steps-to-enable-secure-boot-in-i-MX8M-Na...
Is there a better paper? . I am not using yocto. I have build everything on build-root. Is cleaner and faster,
though I see NXP went all the way with yocto.
I did not burn the fuses yet. I did not do anything with the filesystem and kernel.
OS Already flashed in the emmc partition 1
I have gathered all u-boot build files as:
marius@hpp:~/_br/u-boot$ ls -la ./secure_boot/
total 2872
drwxrwxr-x 4 marius marius 4096 Jun 30 10:40 .
drwxrwxr-x 8 marius marius 4096 Jun 30 10:40 ..
-rwxrwxr-x 1 marius marius 37632 Jun 30 09:49 bl31.bin
drwxrwxr-x 3 marius marius 4096 Jun 27 15:56 CRT
drwxrwxr-x 2 marius marius 4096 Jun 27 15:56 CSF
-rw-rw-r-- 1 marius marius 2204 Jun 30 10:40 csf_fit.bin
-rw-rw-r-- 1 marius marius 1150 Jun 30 09:49 csf_fit.txt
-rw-rw-r-- 1 marius marius 2188 Jun 30 10:40 csf_spl.bin
-rw-rw-r-- 1 marius marius 1112 Jun 30 09:49 csf_spl.txt
-rw-rw-r-- 1 marius marius 1163384 Jun 30 10:40 flash.bin
-rwxrwxr-x 1 marius marius 404 Jun 30 09:49 gen_addr.sh
-rw-rw-r-- 1 marius marius 297 Jun 27 15:56 gen_addr.txt
-rwxrwxr-x 1 marius marius 2378 Jun 27 19:49 print_fit_hab.sh
-rw-rw-r-- 1 marius marius 1163384 Jun 30 10:40 signed_flash.bin
-rw-rw-r-- 1 marius marius 32 Jun 30 10:40 SRK_1_2_3_4_fuse.bin
-rw-rw-r-- 1 marius marius 147 Jun 30 10:40 SRK_1_2_3_4_table.bin
-rwxrwxr-x 1 marius marius 691456 Jun 30 10:40 u-boot-nodtb.bin
I have assembled signed_flash.bin as
# on PC
cp ./flash.bin ./signed_flashed.bin
SPL_BIN=csf_spl.bin
FIT_BIN=csf_fit.bin
csf_off='0x3c000'
sld_csf_off='0x58c20'
FLASH_BIN_SIGNED=./signed_flashed.bin
dd if=./${SPL_BIN} of=${FLASH_BIN_SIGNED} seek=$((csf_off)) bs=1 conv=notrunc
dd if=./${FIT_BIN} of=${FLASH_BIN_SIGNED} seek=$((sld_csf_off)) bs=1 conv=notrunc
#### on device ####
u-boot-> ums 0 mmc 2
/
#### on PC
# emmc is visible sd as /dev/sdb
dd if=${FLASH_BIN_SIGNED} of=/dev/sdb bs=1023 seek=33
#### on device ####
Crtrl+C
u-boot-> reset
Then: booting up.
Booting from mmc ...
fdt_file=imx8mm-var-dart-dt8mcustomboard-legacy.dtb
38538 bytes read in 10 ms (3.7 MiB/s)
hab fuse not enabled
Authenticate image from DDR location 0x40480000...
bad magic magic=0x85 length=0x4668 version=0xd1
bad length magic=0x85 length=0x4668 version=0xd1
bad version magic=0x85 length=0x4668 version=0xd1
Error: Invalid IVT structure
Allowed IVT structure:
IVT HDR = 0x4X2000D1
IVT ENTRY = 0xXXXXXXXX
IVT RSV1 = 0x0
IVT DCD = 0x0
IVT BOOT_DATA = 0xXXXXXXXX
IVT SELF = 0xXXXXXXXX
IVT CSF = 0xXXXXXXXX
IVT RSV2 = 0x0
## Flattened Device Tree blob at 43000000
Booting using the fdt blob at 0x43000000
Using Device Tree in place at 0000000043000000, end 000000004300c689
Starting kernel ...
unable to select a mode
device_remove: Device 'mmc@30b60000.blk' failed to remove, but children are gone
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
[ 0.000000] Linux version 5.15.60-imx8mm (marius@hpp) (aarch64-linux-gcc.br_real (Buildroot 2021.11-4428-g6b6741b) 11.3.0, GNU ld (GNU Binutils) 2.38) #1 SMP PREEMPT Fri Jun 9 08:36:47 EDT 2023
...... boots fine into linux prompt
Then stopping at u-boot prompt I have following hab options;
hab_auth_img- authenticate image via HAB
hab_auth_img_or_fail- authenticate image via HAB on failure drop to USB BootROM mode
hab_failsafe- run BootROM failsafe routine
hab_status- display HAB status
hab_version- print HAB major/minor version
u-boot-> hab_version
HAB version: 4.3
u-boot-> hab_status
Secure boot disabled
HAB Configuration: 0xf0, HAB State: 0x66
--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x08 0x43 0x33 0x11 0xcf 0x00
STS = HAB_FAILURE (0x33)
RSN = HAB_INV_CSF (0x11)
CTX = HAB_CTX_CSF (0xCF)
ENG = HAB_ENG_ANY (0x00)
--------- HAB Event 2 -----------------
event data:
0xdb 0x00 0x14 0x43 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x00 0x7e 0x0f 0xc0
0x00 0x00 0x00 0x20
STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)
--------- HAB Event 3 -----------------
event data:
0xdb 0x00 0x14 0x43 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x00 0x7e 0x0f 0xe0
0x00 0x00 0x00 0x01
STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)
--------- HAB Event 4 -----------------
event data:
0xdb 0x00 0x14 0x43 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x00 0x7e 0x10 0x00
0x00 0x00 0x00 0x04
STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)
u-boot->
Then in this document: HAB4_API.pdf
STS = HAB_FAILURE (0x33)
I dont know what to do next ?
Thank you.
Hi
What 'Generating a fast authentication PKI tree' suppose to mean?
I see this from your post
Best regards
Harvey
