i.MX6 Secure boot test

[vsiles]

Hi !

I'm working on a secure boot for an i.MX6q platform. My u-boot is splitted into SPL and u-boot.img.

SPL is signed and I have 0 HAB event pending at this point. I added a call to the authenticate function in the SPL, to try to check a signed u-boot.img but I get a "hab fuse not enabled" message. In the code I see that authenticate_image only call the HAB if the fuse is burnt.

I removed this test and the SPL tries but fails to check u-boot.img (it fails in hab_rvt_authenticate_image).

1) why is the authenticate_image only designed to work if the fuse is burnt ? can't we try to check the signature of a second stage boot without burning the fuse ?

2) any idea with the hab_rvt_authenticate_image, called from the SPL, might not return ?

Best,

Vincent

[igorpadykov]

Hi Vincent

spl is not supported in nxp bsp releases and this can be posted on

uboot mail list. In general one can try to debug it using examples on

Validating uImage signature using HAB 

Best regards
igor
-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[gary_bisson]

Hi Igor,

In that case, can you answer the question for U-Boot, same principle:

- Why does U-Boot need the fuse to be burnt in order to authenticate a kernel zImage?

Regards,

Gary

[vsiles]

I think the ROM is reading the shadow register (OCOTP bank 0 word 6) instead of the fuse. If you write 0x2 in the register via software, the ROM will gladly authenticate a signed blob, without having to burn the fuse.

However the current code in u-boot (hab.c) seems to read the fuse, so I had to patch a bit the authenticate_image on my open boards.

[igorpadykov]

Hi Gary

one can try uboot example with nxp imx-test (..test/mxc_secureboot)

www.nxp.com/lgfiles/NMG/MAD/YOCTO/imx-test-5.4.tar.gz

http://git.freescale.com/git/cgit.cgi/imx/uboot-imx.git/tree/?h=imx_v2015.04_4.1.15_1.0.0_ga

I am not familiar with spl details.

Best regards
igor

[vsiles]

Thanks you igorpadykov I'll have a look.

By the way, in the TRM of the imx6 one can read, in the IVT section:

Table 8-27. IVT Header Format

Version: A single byte field set to 0x40 or 0x41

Can it really be any of the two values ? I see that our current script uses 0x40 and Gary's script is using 0x41.

Can you clarify ?

Best,

V.

[igorpadykov]

in uboot/tools/imximage.c IVT_VERSION=0x40 used only

~igor

[vsiles · Accepted solution]

Just for fun, I switch our 0x40 to 0x41 and now the boot goes further away (we get HAB event I will investigate) but I'm no longer stuck !

For the reference, here are the events I currently get. I'll use your other input to debug them:

U-Boot SPL 2016.03-20583-g91d2071 (Jan 24 2017 - 10:27:38)
Trying to boot from MMC
spl: mmc_dev = 1
timeout irqstat=10000

Authenticate image from DDR location 0x3fffffc0...

Secure boot enabled

HAB Configuration: 0xcc, HAB State: 0x99

--------- HAB Event 1 -----------------
event data:
        0xdb 0x00 0x08 0x41 0x33 0x22 0x0a 0x00

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ADDRESS (0x22)
CTX = HAB_CTX_AUTHENTICATE (0x0A)
ENG = HAB_ENG_ANY (0x00)

Authenticating TZSW failed

Authenticate image from DDR location 0x177fffc0...

Secure boot enabled

HAB Configuration: 0xcc, HAB State: 0x99

--------- HAB Event 1 -----------------
event data:
        0xdb 0x00 0x08 0x41 0x33 0x22 0x0a 0x00

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ADDRESS (0x22)
CTX = HAB_CTX_AUTHENTICATE (0x0A)
ENG = HAB_ENG_ANY (0x00)


--------- HAB Event 2 -----------------
event data:
        0xdb 0x00 0x08 0x41 0x33 0x22 0x0a 0x00

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ADDRESS (0x22)
CTX = HAB_CTX_AUTHENTICATE (0x0A)
ENG = HAB_ENG_ANY (0x00)

Authenticating u-boot.img failed
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[vsiles]

My TZASC is activated, so I wonder if the CAAM is correctly configured to go and read "Secure" memory, probably not...

I recovered JTAG access (though it triggers an SNVS interrupt, #52), but I still can't use the imx_usb tool to replace my SPL, so I'm short of ideas on how to test this.

Any help on flashing a new u-boot in the device (sabre lite) is welcome :smileywink:

[vsiles]

For the record, I have the same HAB Event output with TZASC disabled, so I'm trying to check what could be wrong in my CSF config.

[gary_bisson]

Hi Vincent,

That (1) is a good question, I've done the same test as you (skipping the fuse test) and ended up with the same result.

So I guess it's not possible but I don't know the reason.

Not sure to understand your second question, have you tried burning the fuse and the authenticate still doesn't work?

Regards,

Gary

[vsiles]

Dear Gary, I finally managed to use the imx_usb program to flash a new signed SPL.

There might be a thing or two wrong with your blog post, because I had to use 0x914000 instead of 0x910000 for the last Authenticate Data.

For the record, here is my csf tex file:

[Header]
Version = 4.1
Security Configuration = Open
Hash Algorithm = sha256
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS

[Install SRK]
File = "crts/SRK_1_2_3_4_table.bin"
Source index = 0

[Install CSFK]
File = "crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"

[Authenticate CSF]

[Install Key]
# Key slot index used to authenticate the key to be installed
Verification index = 0
# Key to install
Target index = 2
File = "crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"

[Authenticate Data]
Verification index = 2
Blocks = 0x177ff400 0x0 0x7ac00 "u-boot.imx", \
    0x00914000 0x2C 0x318 "u-boot.imx"

## [Authenticate Data]
## Verification index = 2
## Blocks = 0x00910000 0x2C 0x318 "u-boot.imx"

[Unlock]
Engine = CAAM
Features = RNG
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

[gary_bisson]

Hi Vincent,

It depends which version of imx_usb_loader you use. If you use master, it should be 910000 but it's configurable in the conf file. My article matches with the HEAD of imx_usb_loader.

The reason is that people wanted the default value to be the same as the MFGTools.

However, note that Jeremie Corbier (who added support for HAB SDP in imx_usb_loader) did it with SPL which requires to use 0x914000 since SPL was taking too much space and wouldn't fit below 0x910000.

Regards,

Gary

PS: As a FYI I'm off for vacation so I won't be able to answer any question for the next week.

[vsiles]

Thanks for the info !

Enjoy your vacation :smileyhappy:

V.