Changes between Version 33 and Version 34 of venice/secure_boot

Timestamp:

05/16/2024 08:53:31 PM (4 months ago)

Author:

Tim Harvey

Comment:

added linux methods for reading/blowing OTP fuses

venice/secure_boot

@@ -201 +201 @@
    * **OTP fuses can only be programmed once - be careful to use the correct values**
    * **IF YOU WISH TO IMPLEMENT DISK ENCRYPTION AS WELL: FINISH FDE SETUP AND COME BACK TO THIS**
+   * via U-Boot:
 {{{#!bash
 fuse prog -y 6 0 0xDCE644DB
@@ -211 +212 @@
 fuse prog -y 7 3 0xDB9B5895
 }}}
+   * via Linux:
+{{{#!bash
+# read OTP fuse
+# $1 bank
+# $2 word
+# OTP is arranged as banks of 32bit words so we access with bs=4 and skip to the word we want
+OCOTP_DEV=/sys/devices/platform/soc@0/30000000.bus/30350000.efuse/imx-ocotp0/nvmem
+fuse_read()
+{
+        local bank=$1
+        local word=$2
+        local offset=$(($((bank*4))+((word%4))))
+        # and can use hexdump to display as a 32bit int
+        dd if=$OCOTP_DEV bs=4 count=1 skip=$offset 2>/dev/null | hexdump -v -e '1/4 "0x%08x"'
+}
+
+# blow OTP fuse
+#  $1 bank
+#  $2 word
+#  $3 value
+fuse_blow() {
+        local bank=$1
+        local word=$2
+        local val=$3
+        local offset=$(($((bank*4))+((word%4))))
+
+        echo "fuse_blow: bank$bank word$word offset=$offset val=$val"
+        # output binary 32bit int
+        local b0=$(( $((val>>24)) & 0xff))
+        local b1=$(( $((val>>16)) & 0xff))
+        local b2=$(( $((val>>8)) & 0xff))
+        local b3=$(( $((val>>0)) & 0xff))
+        printf "\\x$(printf "%x" $b3)\\x$(printf "%x" $b2)\\x$(printf "%x" $b1)\\x$(printf "%x" $b0)" |
+                dd of=$OCOTP_DEV bs=4 seek=$offset 2>/dev/null
+}
+
+echo "Current SRK_FUSES:"
+echo $(fuse_read 6 0)
+echo $(fuse_read 6 1)
+echo $(fuse_read 6 2)
+echo $(fuse_read 6 3)
+echo $(fuse_read 7 0)
+echo $(fuse_read 7 1)
+echo $(fuse_read 7 2)
+echo $(fuse_read 7 3)
+echo $(fuse_read 1 3)
+
+echo "Blowing fuses from $SRK_HASH..."
+bank=6
+word=0
+for i in $(hexdump -e '/4 "0x"' -e '/4 "%X""\n"' $SRK_HASH); do
+     fuse_blow $bank $word $i
+     word=$((word+1))
+     [ $word -eq 4 ] && {
+          word=0
+          bank=$((bank+1))
+     }
+done
+}}}
  6. Boot it again and verify no HAB events:
 {{{#!bash
@@ -220 +280 @@
 }}}
  7. Close the device (lock it down!) - this step is irreversible, make sure there are no HAB events from the prior step
+  * via U-Boot:
 {{{#!bash
 u-boot=> fuse prog -y 1 3 0x2000000
+}}}
+  * via Linux (see above):
+{{{#!bash
+fuse blow 1 3 0x2000000
 }}}
   * This sets the SEC_CONFIG[1] fuse on the i.MX8M and once done the processor will not load an image that has not been signed using the correct PKI tree