Hi Tim, Stefano, On 10.07.21 11:14, Stefano Babic wrote: > Hi Tim, > > On 10.07.21 02:05, Tim Harvey wrote: >> Greetings, >> >> Has anyone successfully used secure boot with IMX8M Mini or other >> IMX8M? Peng's recent series got merged with the exception of what >> looks like the addition of couple of 'caam' commands to blob/deblob >> DEK's. >> >> There are no guides yet however I'm following the guides for the >> downstream NXP U-Boot and thus far have been able to get the SPL to >> boot with no HAB events but when it tries to authenticate the FIT >> image it validate_ivt fails with 'Error: Invalid IVT structure'. > > Heiko tested this and found it, if I am not wrong he found the cause. Added > him in CC. > > I have also planned to test this, it is on my TODO list...
I am currently not in my office, the whole next week ... so I could not check my current state of the patches... but I found a problem, yes. The problem was that the ROM API loaded the IVT header to a memallocated address, which does of course not fit with the address you have in IVT header ... I have not full access to my development setup ,and found on my local some old state of the patches .... may you can try them? Of course they need a rework, other solution, but it shows the problem hopefully... bye, Heiko >> I'm >> not entirely clear if my CSF is wrong, or in the wrong place or if >> there is something missing. >> > > Best regards, > Stefano > > -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: +49-8142-66989-52 Fax: +49-8142-66989-80 Email: [email protected] -- DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: +49-8142-66989-52 Fax: +49-8142-66989-80 Email: [email protected]
>From 4a753221b5f60bb1c7a1c40f96cfa6a757a47f33 Mon Sep 17 00:00:00 2001 From: Heiko Schocher <[email protected]> Date: Tue, 8 Jun 2021 07:25:18 +0200 Subject: [PATCH 1/2] spl_fit. add hook to make fixes after fit header is loaded add hook function spl_load_simple_fit_fix_load() which is called after fit image header is loaded. Signed-off-by: Heiko Schocher <[email protected]> --- common/spl/spl_fit.c | 11 +++++++++++ include/spl.h | 8 ++++++++ 2 files changed, 19 insertions(+) diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c index caddf51196..f1374ee672 100644 --- a/common/spl/spl_fit.c +++ b/common/spl/spl_fit.c @@ -547,6 +547,15 @@ __weak bool spl_load_simple_fit_skip_processing(void) return false; } +/* + * Weak default function to allow fixes after fit header + * is loaded. + */ +__weak void *spl_load_simple_fit_fix_load(void *fit) +{ + return fit; +} + static void warn_deprecated(const char *msg) { printf("DEPRECATED: %s\n", msg); @@ -684,6 +693,8 @@ int spl_load_simple_fit(struct spl_image_info *spl_image, if (spl_load_simple_fit_skip_processing()) return 0; + ctx.fit = spl_load_simple_fit_fix_load(ctx.fit); + ret = spl_simple_fit_parse(&ctx); if (ret < 0) return ret; diff --git a/include/spl.h b/include/spl.h index cee9a42ddb..f8ff7217a4 100644 --- a/include/spl.h +++ b/include/spl.h @@ -282,6 +282,14 @@ ulong spl_get_image_text_base(void); */ bool spl_load_simple_fit_skip_processing(void); +/** + * spl_load_simple_fit_fix_load() - Hook to make fixes + * after fit image header is loaded + * + * Returns pointer to fit + */ +void *spl_load_simple_fit_fix_load(void *fit); + /** * spl_load_simple_fit() - Loads a fit image from a device. * @spl_image: Image description to set up -- 2.20.1
>From 30507c10fdff6e56442b128bc96522afae6ba4ea Mon Sep 17 00:00:00 2001 From: Heiko Schocher <[email protected]> Date: Tue, 8 Jun 2021 08:10:35 +0200 Subject: [PATCH 2/2] imx: spl: implement spl_load_simple_fit_fix_load read the address where the IVT header must sit from IVT image header, loaded from SPL into an malloced buffer and copy the IVT header to this address May make this dependend on SoC ? Signed-off-by: Heiko Schocher <[email protected]> --- arch/arm/mach-imx/spl.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/arch/arm/mach-imx/spl.c b/arch/arm/mach-imx/spl.c index dc6aebcaf7..a35e84caa4 100644 --- a/arch/arm/mach-imx/spl.c +++ b/arch/arm/mach-imx/spl.c @@ -345,3 +345,32 @@ int dram_init_banksize(void) return 0; } #endif + +/* + * read the address where the IVT header must sit + * from IVT image header, loaded from SPL into + * an malloced buffer and copy the IVT header + * to this address + */ +void *spl_load_simple_fit_fix_load(void *fit) +{ + struct ivt *ivt; + unsigned long new; + unsigned long offset; + unsigned long size; + u8 *tmp = (u8 *)fit; + + offset = ALIGN(fdt_totalsize(fit), 0x1000); + size = ALIGN(fdt_totalsize(fit), 4); + size = board_spl_fit_size_align(size); + tmp += offset; + ivt = (struct ivt *)tmp; + debug("%s: ivt: %p offset: %lx size: %lx\n", __func__, ivt, offset, size); + debug("%s: ivt self: %x\n", __func__, ivt->self); + new = ivt->self; + new -= offset; + debug("%s: new %lx\n", __func__, new); + memcpy((void *)new, fit, size); + + return (void *)new; +} -- 2.20.1
