Re: IMX8M Mini HAB secure boot - working?

[Heiko Schocher <hs@denx.de>]

[-- Attachment #1: Type: text/plain, Size: 1882 bytes --]

Hi Tim, Stefano,

On 10.07.21 11:14, Stefano Babic wrote:
> Hi Tim,
> 
> On 10.07.21 02:05, Tim Harvey wrote:
>> Greetings,
>>
>> Has anyone successfully used secure boot with IMX8M Mini or other
>> IMX8M? Peng's recent series got merged with the exception of what
>> looks like the addition of couple of 'caam' commands to blob/deblob
>> DEK's.
>>
>> There are no guides yet however I'm following the guides for the
>> downstream NXP U-Boot and thus far have been able to get the SPL to
>> boot with no HAB events but when it tries to authenticate the FIT
>> image it validate_ivt fails with 'Error: Invalid IVT structure'.
> 
> Heiko tested this and found it, if I am not wrong he found the cause. Added him in CC.
> 
> I have also planned to test this, it is on my TODO list...

I am currently not in my office, the whole next week ... so I could not
check my current state of the patches... but I found a problem, yes.

The problem was that the ROM API loaded the IVT header to a
memallocated address, which does of course not fit with the
address you have in IVT header ...

I have not full access to my development setup ,and found on my local
some old state of the patches .... may you can try them?

Of course they need a rework, other solution, but it shows the problem
hopefully...

bye,
Heiko
>> I'm
>> not entirely clear if my CSF is wrong, or in the wrong place or if
>> there is something missing.
>>
> 
> Best regards,
> Stefano
> 
> 

-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-52   Fax: +49-8142-66989-80   Email: hs@denx.de


-- 
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-52   Fax: +49-8142-66989-80   Email: hs@denx.de


[-- Attachment #2: 0001-spl_fit.-add-hook-to-make-fixes-after-fit-header-is-.patch --]
[-- Type: text/x-patch, Size: 1766 bytes --]

>From 4a753221b5f60bb1c7a1c40f96cfa6a757a47f33 Mon Sep 17 00:00:00 2001
From: Heiko Schocher <hs@denx.de>
Date: Tue, 8 Jun 2021 07:25:18 +0200
Subject: [PATCH 1/2] spl_fit. add hook to make fixes after fit header is
 loaded

add hook function spl_load_simple_fit_fix_load()
which is called after fit image header is loaded.

Signed-off-by: Heiko Schocher <hs@denx.de>
---
 common/spl/spl_fit.c | 11 +++++++++++
 include/spl.h        |  8 ++++++++
 2 files changed, 19 insertions(+)

diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
index caddf51196..f1374ee672 100644
--- a/common/spl/spl_fit.c
+++ b/common/spl/spl_fit.c
@@ -547,6 +547,15 @@ __weak bool spl_load_simple_fit_skip_processing(void)
 	return false;
 }
 
+/*
+ * Weak default function to allow fixes after fit header
+ * is loaded.
+ */
+__weak void *spl_load_simple_fit_fix_load(void *fit)
+{
+	return fit;
+}
+
 static void warn_deprecated(const char *msg)
 {
 	printf("DEPRECATED: %s\n", msg);
@@ -684,6 +693,8 @@ int spl_load_simple_fit(struct spl_image_info *spl_image,
 	if (spl_load_simple_fit_skip_processing())
 		return 0;
 
+	ctx.fit = spl_load_simple_fit_fix_load(ctx.fit);
+
 	ret = spl_simple_fit_parse(&ctx);
 	if (ret < 0)
 		return ret;
diff --git a/include/spl.h b/include/spl.h
index cee9a42ddb..f8ff7217a4 100644
--- a/include/spl.h
+++ b/include/spl.h
@@ -282,6 +282,14 @@ ulong spl_get_image_text_base(void);
  */
 bool spl_load_simple_fit_skip_processing(void);
 
+/**
+ * spl_load_simple_fit_fix_load() - Hook to make fixes
+ * after fit image header is loaded
+ *
+ * Returns pointer to fit
+ */
+void *spl_load_simple_fit_fix_load(void *fit);
+
 /**
  * spl_load_simple_fit() - Loads a fit image from a device.
  * @spl_image:	Image description to set up
-- 
2.20.1




[-- Attachment #3: 0002-imx-spl-implement-spl_load_simple_fit_fix_load.patch --]
[-- Type: text/x-patch, Size: 1576 bytes --]

>From 30507c10fdff6e56442b128bc96522afae6ba4ea Mon Sep 17 00:00:00 2001
From: Heiko Schocher <hs@denx.de>
Date: Tue, 8 Jun 2021 08:10:35 +0200
Subject: [PATCH 2/2] imx: spl: implement spl_load_simple_fit_fix_load

read the address where the IVT header must sit
from IVT image header, loaded from SPL into
an malloced buffer and copy the IVT header
to this address

May make this dependend on SoC ?

Signed-off-by: Heiko Schocher <hs@denx.de>
---
 arch/arm/mach-imx/spl.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/arch/arm/mach-imx/spl.c b/arch/arm/mach-imx/spl.c
index dc6aebcaf7..a35e84caa4 100644
--- a/arch/arm/mach-imx/spl.c
+++ b/arch/arm/mach-imx/spl.c
@@ -345,3 +345,32 @@ int dram_init_banksize(void)
 	return 0;
 }
 #endif
+
+/*
+ * read the address where the IVT header must sit
+ * from IVT image header, loaded from SPL into
+ * an malloced buffer and copy the IVT header
+ * to this address
+ */
+void *spl_load_simple_fit_fix_load(void *fit)
+{
+	struct ivt *ivt;
+	unsigned long new;
+	unsigned long offset;
+	unsigned long size;
+	u8 *tmp = (u8 *)fit;
+
+	offset = ALIGN(fdt_totalsize(fit), 0x1000);
+        size = ALIGN(fdt_totalsize(fit), 4);
+        size = board_spl_fit_size_align(size);
+	tmp += offset;
+	ivt = (struct ivt *)tmp;
+	debug("%s: ivt: %p offset: %lx size: %lx\n", __func__, ivt, offset, size);
+	debug("%s: ivt self: %x\n", __func__, ivt->self);
+	new = ivt->self;
+	new -= offset;
+	debug("%s: new %lx\n", __func__, new);
+	memcpy((void *)new, fit, size);
+
+	return (void *)new;
+}
-- 
2.20.1