AnsweredAssumed Answered

Problems with i.MX28 High Assurance Boot

Question asked by Christopher Preschern on Apr 17, 2013

Hi,

 

I’ve got a problem with using High Assurance Boot (HAB) on my i.mx28 using U-boot (version 04/2012).

When booting, I get several HAB failure events (described later on) and I don’t know what to do about it and how to interpret them in detail. I’ll first give the general steps which I applied to get HAB running and I attached my source files.

 

I followed the instructions from several Freescale manuals:

  • I generated keys/certificates with the hab4_pki_tree script from the Code-Signing Tool (CST) package as described in the “HAB Code-Signing Tool” documentation
  • I generated the e-fuse hash and the SRK table as described in the “HAB Code-Signing Tool” documentation
  • I programmed the e-fuse hash into the i.mx28 by using the otp_burner and the BitInit Tools
  • I checked with the BitBurner Tool if the fuses were actually set à I could see the fuse hash value with the tool, so I assume up until this step everything went fine.
  • I modified the u-boot Linker File (.lds) to reserve a section for the code signature as described in the “Secure Boot with i.MX28 HAB v4” documentation (page 15)
  • I call the HAB report_event() function from the ROM Vector Table in the U-Boot Source to get HAB Debug output
  • I compiled my U-Boot with the mx28 config from Denx to obtain: u-boot (ELF file), u-boot.bin (Binary), u-boot-spl (ELF), u-boot.bin (Binary). The spl program is some kind of first-stage bootloader which is called before u-boot
  • I wrote a CSF File for u-boot.bin and one for u-boot-spl.bin. I wrote the file as explained in the “HAB Code-Signing Tool” documentation and end up with files which are pretty much the same as the example given at page 27 of the “Secure Boot with i.MX28 HAB v4” documentation
  • I used the CST to create the signatures of u-boot.bin  and u-boot-spl.bin
  • I modified the u-boot.bd file to load the signature
  • I ran elftosb to create my boodable sb-File

 

When booting, I get the following HAB Errors:

--------- HAB Event 1 -----------------

event data:

    0xdb 0x00 0x14 0x40 0x33 0x22 0x33 0x00

    0x00 0x00 0x00 0x0f 0x00 0x00 0x00 0x00

    0x00 0x00 0x07 0x50

 

--------- HAB Event 2 -----------------

event data:

    0xdb 0x00 0x14 0x40 0x33 0x22 0x33 0x00

    0x00 0x00 0x00 0x0f 0x00 0x00 0x80 0x00

    0x54 0xce 0x13 0xdd

 

--------- HAB Event 3 -----------------

event data:

    0xdb 0x00 0x08 0x40 0x33 0x22 0x0a 0x00

 

--------- HAB Event 4 -----------------

event data:

    0xdb 0x00 0x14 0x40 0x33 0x0c 0xa0 0x00

    0x00 0x00 0x00 0x00 0x00 0x00 0x80 0x00

    0x00 0x00 0x00 0x20

 

--------- HAB Event 5 -----------------

event data:

    0xdb 0x00 0x14 0x40 0x33 0x0c 0xa0 0x00

    0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x14

    0x00 0x00 0x00 0x04

 

--------- HAB Event 6 -----------------

event data:

    0xdb 0x00 0x14 0x40 0x33 0x22 0x33 0x00

    0x00 0x00 0x00 0x0f 0x00 0x00 0x80 0x00

    0x54 0xce 0x13 0xdd

 

--------- HAB Event 7 -----------------

event data:

    0xdb 0x00 0x14 0x40 0x33 0x0c 0xa0 0x00

    0x00 0x00 0x00 0x00 0x00 0x00 0x80 0x00

    0x00 0x00 0x00 0x20

 

--------- HAB Event 8 -----------------

event data:

    0xdb 0x00 0x14 0x40 0x33 0x22 0x33 0x00

   0x00 0x00 0x00 0x0f 0x04 0x10 0x00 0x00

    0x00 0x00 0x03 0xe8

 

My questions are:

  • Are the general steps I described above correct, or did I miss something?
  • How do I interpret the HAB events? I know that the HAB API documentation provides some information about that, however if I analyze the first event with the HAB API documentation I obtain the information that the check_target() function accessed an invalid address. The check_target function was called with the following parameters (according to the HAB debug output):
    • Type of target: 0x00 0x00 0x00 0x0f (the documentation says that this is HAB_TGT_MEMORY and that the memory white list has to be checked à what does that mean?)
    • Address of target region: 0x00 0x00 0x00 0x00
    • Size of target region: 0x00 0x00 0x07 0x50

          With just this information I have no idea where I should start and what to do

  • Am I correct that I do not manually have to create an Image Vector Table (IVT) as described by the “Secure Boot with i.MX28 HAB v4” documentation on page 16? The “Using elftosb to generate HAB enabled boot streams” documentation says that the IVT is created by a command in the bd file (which I use in my attached bd-file). So does this mean that the “Secure Boot with i.MX28 HAB v4” documentation is not up-to-date? How should I now include the IVT? With the command in the bd-File or by manually linking a section into the binary (as described in “Secure Boot with i.MX28 HAB v4”)?
  • Should HAB also work if I do not modify the linker file of U-Boot, but just load the signature to any free area in the memory (and of course reference this address in the bd-file)?
  • Do the source files I provide with this posting look correct?
  • Did anybody our there get HAB working? Is there an example (full source code) available?


I'm really stuck here and I appreachiate any kind of help very much.


Best regards,

Christopher

Original Attachment has been moved to: u-boot.lds.zip

Original Attachment has been moved to: uboot-csf.zip

Original Attachment has been moved to: u-boot-spl.lds.zip

Original Attachment has been moved to: u-boot.bd.zip

Original Attachment has been moved to: spl-csf.zip

Outcomes