Changes between Version 8 and Version 9 of venice/secure_boot


Ignore:
Timestamp:
06/23/2023 11:06:07 PM (2 years ago)
Author:
Tim Harvey
Comment:

updated instructions for latest Gateworks U-Boot v2023.04

Legend:

Unmodified
Added
Removed
Modified

  • venice/secure_boot

    v8 v9  
    2525https://www.nxp.com/webapp/Download?colCode=IMX_CST_TOOL_NEW
    2626
    27 == i.MX secure boot SPL (U-Boot v2021-07-venice)
    28 ** This section is based on the [https://github.com/Gateworks/uboot-venice/tree/v2021.07-venice v2021-07-venice Gateworks U-Boot repository] - Instructions will differ for other versions of U-Boot **
    29 
    30 Boards using U-Boot SPL and U-Boot propper for boot firmware support using HABv4 authentication for both images.
     27== i.MX secure boot
     28Boards using U-Boot for boot firmware support using HABv4 authentication for both images.
    3129
    3230The HAB library is a sub-component of the boot ROM on i.MX processors. It is responsible for verifying the digital signatures included as part of the product software and ensures that, when the processor is configured as a secure device, no unauthenticated code is allowed to run.
    … …  
    3937  - CONFIG_CMD_FSL_CAAM_KB=y ('caam genblob' and 'caam decap' cmds)
    4038  - CONFIG_CMD_DEKBLOB=y (optional) ('dek_blob' cmd)
    41   - CONFIG_OF_LIST=<single target> (at this time only a single board can be supported by the image so replace the list of models in configs/imx8*_venice_defconfig with just the model you want to support)
     39  - CONFIG_SPL_LOAD_FIT_ADDRESS=0x48000000
    4240 - Create a PKI tree and SRK table via the NXP Code Signing Tool
    4341 - Construct boot firmware with a proper Command Sequence File (CSF) (CSF blobs are created with the NXP Code Signing Tool)
    … …  
    9997{{{#!bash
    10098# checkout u-boot
    101 git clone https://github.com/Gateworks/uboot-venice.git -b v2021.07-venice
     99git clone https://github.com/Gateworks/uboot-venice.git
    102100cd u-boot
    103101# setup cross toolchain environment (ie source setup-environment in Venice BSP dir)
    … …  
    105103export CROSS_COMPILE="aarch64-linux-"
    106104export ARCH=arm64
    107 export ATF_LOAD_ADDR=0x920000 # IMX8MM
    108105# configure for venice board
    109106make imx8mm_venice_defconfig
    110 make menuconfig # select CONFIG_IMX_HAB=y 'Support i.MX HAB features' and CONFIG_OF_LIST to specify a single board dtb
     107make menuconfig # select CONFIG_IMX_HAB=y and CONFIG_SPL_LOAD_FIT_ADDRESS=0x48000000
    111108make flash.bin
    112109}}}
    113   * Use the v2021.07-venice U-Boot branch as this has support for IMX8M HAB
    114   * Select a single board DTB for CONFIG_OF_LIST
    115  3. create a signed_flash.bin using the [http://trac.gateworks.com/attachment/wiki/venice/secure_boot/sign_hab_imx8m.sh  sign_hab_imx8m.sh script]
     110 3. create a signed_flash.bin
    116111{{{#!bash
    117112# setup env to point to the CST
    118 export CST_DIR=/usr/src/nxp/cst-3.3.1/
     113export CST_DIR=/usr/src/nxp/cst-3.3.2/
    119114export CST_BIN=$CST_DIR/linux64/bin/cst
    120 export SIGN_KEY=$CST_DIR/crts/CSF1_1_sha256_4096_65537_v3_usr_crt.pem
     115export CSF_KEY=$CST_DIR/crts/CSF1_1_sha256_4096_65537_v3_usr_crt.pem
    121116export IMG_KEY=$CST_DIR/crts/IMG1_1_sha256_4096_65537_v3_usr_crt.pem
    122117export SRK_TABLE=$CST_DIR/crts/SRK_1_2_3_4_table.bin
    123 # sign it
    124 $ wget http://trac.gateworks.com/raw-attachment/wiki/venice/secure_boot/sign_hab_imx8m.sh
    125 $ chmod +x sign_hab_imx8m.sh
    126 $ ./sign_hab_imx8m.sh
    127 Install SRK
    128 Install CSFK
    129 Authenticate CSF
    130 Install key
    131 Authenticate data
    132 CSF Processed successfully and signed data available in csf_spl.bin
    133 Install SRK
    134 Install CSFK
    135 Authenticate CSF
    136 Install key
    137 Authenticate data
    138 CSF Processed successfully and signed data available in csf_fit.bin
    139 6472+0 records in
    140 6472+0 records out
    141 6472 bytes (6.5 kB, 6.3 KiB) copied, 0.0102526 s, 631 kB/s
    142 6488+0 records in
    143 6488+0 records out
    144 6488 bytes (6.5 kB, 6.3 KiB) copied, 0.0119102 s, 545 kB/s
    145 signed_flash.bin is ready!
    146 # create a JTAG image if needed
    147 mkimage_jtag --emmc -s signed_flash.bin@user:erase_none:66-32640 > signed_u-boot_spl-imx8mm.bin
    148 }}}
    149   * the script will create csf_spl.txt and csf_fit.txt which are templates used to create csf_spl.bin and csf_fit.bin which are then copied to the correct offsets in flash.bin to create signed_flash.bin
    150   * on a board without SRK Hash fuses programmed and flashed with this signed image the serial console will look this this:
    151 {{{#!bash
    152 U-Boot SPL 2021.07-00087-g54ac394a7c74 (Jun 09 2023 - 14:39:52 -0700)
     118export PATH=$CST_DIR/linux64/bin:$PATH
     119# sign flash.bin
     120/bin/sh doc/imx/habv4/csf_examples/mx8m/csf.sh
     121# create a JTAG image (if needed) using one of the following
     122mkimage_jtag --emmc -s --partconf=boot0 \
     123  flash.bin@boot0:erase_none:66-8192 > signed_u-boot_spl-imx8mm.bin # imx8mm emmc boot0 partition
     124mkimage_jtag --emmc -s --partconf=boot0 \
     125  flash.bin@boot0:erase_none:0-8192 > signed_u-boot_spl-imx8mm.bin # imx8mp/imx8mn emmc boot0 partition
     126}}}
     127  4. Program signed firmware image:
     128{{{#!bash
     129jtag_usbv4 -p signed_u-boot_spl-imx8mm.bin
     130}}}
     131  * Booting this would look something like the following:
     132{{{#!bash
     133U-Boot SPL 2023.04-00034-g1f567dfbe119 (Jun 23 2023 - 15:53:20 -0700)
    153134GSCv3   : v61 0x1d6f RST:VIN Thermal protection:disabled
    154135RTC     : 1970-01-01   0:00:31 UTC
    155 Model   : GW7301-00-B1B
    156 Serial  : 852420
    157 MFGDate : 11-19-2021
    158 PMIC    : MP5416
    159 DRAM    : LPDDR4 1 GiB
    160 WDT:   Started with servicing (60s timeout)
    161 Trying to boot from MMC1
    162 DTB     : imx8mm-venice-gw73xx-0x
     136Model   : GW7200-01-B1F
     137Serial  : 935180
     138MFGDate : 04-05-2023
     139PMIC    : MP5416 (IMX8MM)
     140DRAM    : LPDDR4 4 GiB 3000MT/s 1500MHz
     141Failed to initialize caam_jr: -19
     142WDT:   Started watchdog@30280000 with servicing every 1000ms (60s timeout)
     143Trying to boot from eMMC
    163144hab fuse not enabled
    164145
    165 Authenticate image from DDR location 0x401fcdc0...
     146Authenticate image from DDR location 0x48000000...
     147DTB     : imx8mm-venice-gw72xx-0x
    166148NOTICE:  BL31: v2.4(release):f884ad7b0ba2
    167149NOTICE:  BL31: Built : 13:06:09, Oct 20 2021
    168150
    169151
    170 U-Boot 2021.07-00087-g54ac394a7c74 (Jun 09 2023 - 14:39:52 -0700)
    171 
    172 CPU:   Freescale i.MX8MMQ rev1.0 1600 MHz (running at 1200 MHz)
    173 CPU:   Industrial temperature grade (-40C to 105C) at 34C
    174 Reset cause: POR
    175 Model: Gateworks Venice GW73xx-0x i.MX8MM Development Kit
    176 DRAM:  1 GiB
    177 WDT:   Started with servicing (60s timeout)
    178 MMC:   FSL_SDHC: 0, FSL_SDHC: 1, FSL_SDHC: 2
    179 Loading Environment from MMC... OK
    180 In:    serial
    181 Out:   serial
    182 Err:   serial
    183 Net:   DP83867 eth0: ethernet@30be0000 [PRIME]
    184 GSC     : boot watchdog disabled
    185 Hit any key to stop autoboot:  0
    186 u-boot=> 
    187 }}}
    188   - Note the 'hab fuse not enabled' and the 'Authenticate image from DDR location' messages
    189  4. Program SRK Hash fuses from Step 1 into IMX OTP (using U-Boot and the keys from fuse bin)
     152U-Boot 2023.04-00034-g1f567dfbe119 (Jun 23 2023 - 15:53:20 -0700)
     153}}}
     154  - Note the 'hab fuse not enabled' message which means the SEC_CONFIG[1] fuse is not blown and the device is not locked
     155  - Note the 'Authenticate image from DDR location' messages which shows that image authentication is able to be used
     156 5. Program SRK Hash fuses from Step 1 into IMX OTP (using U-Boot and the keys from fuse bin)
    190157{{{#!bash
    191158fuse prog -y 6 0 0xDCE644DB
    … …  
    200167   * **Do not use the above fuse values - use values generated above from your serial/passphrase**
    201168   * **OTP fuses can only be programmed once - be careful to use the correct values**
    202   5. Program signed firmware image:
    203 {{{#!bash
    204 jtag_usbv4 -p signed_u-boot_spl-imx8mm.bin
    205 }}}
    206   6. Boot it and verify no HAB events:
     169  6. Boot it again and verify no HAB events:
    207170{{{#!bash
    208171u-boot=> hab_status
    … …  
    217180}}}
    218181  * This sets the SEC_CONFIG[1] fuse on the i.MX8M and once done the processor will not load an image that has not been signed using the correct PKI tree
    219   * on a board with SRK Hash fuses programmed, SEC_CONFIG[1] set and flashed with a signed image the serial console will look this this:
    220 {{{#!bash
    221 U-Boot SPL 2021.07-00087-g54ac394a7c74 (Jun 09 2023 - 14:39:52 -0700)
    222 GSCv3   : v58 0xf098 RST:VIN Thermal protection:enabled at 96C
    223 RTC     : 1970-01-03  16:34:29 UTC
    224 Model   : GW7301-01-B1B
    225 Serial  : 852455
    226 MFGDate : 11-10-2020
    227 PMIC    : MP5416
    228 DRAM    : LPDDR4 4 GiB
    229 WDT:   Started with servicing (60s timeout)
    230 Trying to boot from MMC1
    231 DTB     : imx8mm-venice-gw73xx-0x
    232 
    233 Authenticate image from DDR location 0x401fcdc0...
    234 NOTICE:  BL31: v2.4(release):f884ad7b0ba2
    235 NOTICE:  BL31: Built : 13:06:09, Oct 20 2021
    236 
    237 
    238 U-Boot 2021.07-00087-g54ac394a7c74 (Jun 09 2023 - 14:39:52 -0700)
    239 
    240 CPU:   Freescale i.MX8MMQ rev1.0 1600 MHz (running at 1200 MHz)
    241 CPU:   Industrial temperature grade (-40C to 105C) at 30C
    242 Reset cause: POR
    243 Model: Gateworks Venice GW73xx-0x i.MX8MM Development Kit
    244 DRAM:  4 GiB
    245 WDT:   Started with servicing (60s timeout)
    246 MMC:   FSL_SDHC: 0, FSL_SDHC: 1, FSL_SDHC: 2
    247 Loading Environment from MMC... OK
    248 In:    serial
    249 Out:   serial
    250 Err:   serial
    251 Net:   DP83867 eth0: ethernet@30be0000 [PRIME]
    252 GSC     : boot watchdog disabled
    253 Thermal protection:enabled at 96C
    254 Hit any key to stop autoboot:  0
    255 }}}
    256   - Note the 'Authenticate image from DDR location' message
     182
     183For more info see:
     184 - https://elixir.bootlin.com/u-boot/latest/source/doc/imx/habv4/introduction_habv4.txt
     185 - https://elixir.bootlin.com/u-boot/latest/source/doc/imx/habv4/guides/mx8m_spl_secure_boot.txt
     186
    257187
    258188== HABv4 encrypted boot architecture