The size of the IVT header should be defined in hab.h move it there now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.
This patch enables printout of the IVT entry, dcd and csf data fields.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 2 ++
1 file chang
There is no need to call is_enabled() twice in authenticate_image - it does
nothing but add an additional layer of indentation.
We can check for is_enabled() at the start of the function and return the
result code directly.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Es
later patches,
where we will break the current incorrect dependence on fixed offsets in
favour of an IVT described parsing of incoming binaries.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc:
imx_hab_authenticate_image() is on the other hand very explicit.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 4 ++--
arch/arm/mach-imx/
The IVT header contains a magic number, fixed length and one of two version
identifiers. Validate these settings before doing anything with a putative
IVT binary.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: G
It will be helpful to boot commands to know if the HAB is enabled. Export
imx_hab_is_enabled() now to facilitate further work with this data-point in
a secure-boot context.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebe
it now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/arm/mac
ux dmesg thus allowing download
of a new image via the BootROM USB download protocol routine.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/m
tautology. A more logical name is
imx_hab_is_enabled().
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 8
1 file changed, 4 insertions(
nvoked the part will drop down to its BootROM USB recovery mode.
Should it be the case that the part is in secure boot mode - only an
appropriately signed binary will be accepted by the ROM and subsequently
executed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng
The IVT is a self-describing structure which contains a self field. The
self field is the absolute physical base address the IVT ought to be at in
memory. Use the IVT self field to validate the calculated ivt_addr bugging
out if the two values differ.
Signed-off-by: Bryan O'Donoghue
Cc: St
CSF_PAD_SIZE should be defined in hab.h, move it to that location now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 1 +
.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 18 ++
1 file changed, 18 insertions(+)
diff --git a/arch/arm/mach-imx/ha
n the alternative BootROM API.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 15 +++
1 file changed, 15 insertions(+)
diff --git
The current code disjoins an entire block of code on hab_entry pass/fail
resulting in a large chunk of authenticate_image being offset to the right.
Fix this by checking hab_entry() pass/failure and exiting the function
directly if in an error state.
Signed-off-by: Bryan O'Donoghue
Cc: St
and perform that check as directed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 10 ++
1 file changed, 10 insertions(+)
diff --
region is good.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 9 +
1 file changed, 9 insertions(+)
diff --git a/arch/
There is no need to export these functions and data structures externally.
Make them all static now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mac
On 29/12/17 16:36, Breno Matheus Lima wrote:
Secure boot enabled
HAB Configuration: 0xcc, HAB State: 0x99
No HAB Events Found!
=>
In this situation the "hab_rvt_authenticate_image()" is not executed,
It's a bit confusing to receive a "No HAB Events Found!" message after
running hab_auth_img
On 29/12/17 16:42, Breno Matheus Lima wrote:
The hab_rvt_authenticate_image() is usually executed for extending the
root of trust beyond the initial boot image (zImage, u-boot-ivt.img),
in my understanding the layout described on the NXP documentation " |
IVT | BINARY | CSF | " just applies for
check in the NXP documents to
perform prior to hab_rvt_authenticate_image
- hab_rvt_failsafe is a useful function to set the board into BootROM
USB recovery mode.
Bryan O'Donoghue (25):
arm: imx: hab: Make authenticate_image return int
arm: imx: hab: Fix authenticate_image result
There is no need to call is_enabled() twice in authenticate_image - it does
nothing but add an additional layer of indentation.
We can check for is_enabled() at the start of the function and return the
result code directly.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Es
There is no need to export these functions and data structures externally.
Make them all static now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mac
: 36c1ca4d46ef ("imx: Support i.MX6 High Assurance Boot
authentication")
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 9 ++---
ar
region is good.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 9 +
1 file changed, 9 insertions(+)
diff --git a/arch/
.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 18 ++
1 file changed, 18 insertions(+)
diff --git a/arch/arm/mach-imx/ha
The IVT gives the absolute address of the CSF. There is no requirement for
the CSF to be located adjacent to the IVT so lets use the address provided
in the IVT header instead of the hard-coded fixed CSF offset currently in
place.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc:
The current code disjoins an entire block of code on hab_entry pass/fail
resulting in a large chunk of authenticate_image being offset to the right.
Fix this by checking hab_entry() pass/failure and exiting the function
directly if in an error state.
Signed-off-by: Bryan O'Donoghue
Cc: St
received some sort of status
code.
Signed-off-by: Bryan O'Donoghue
Suggested-by: Cc: Breno Matheus Lima
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
---
arch/arm/mach-imx/hab.c | 12 +++-
1 file changed, 7 inser
first step is fixing the return type in authenticate_image() so do that
now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.
and perform that check as directed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 9 +
1 file changed, 9 insertions(+)
diff --
The size of the IVT header should be defined in hab.h move it there now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.
There is no need to export these functions and data structures externally.
Make them all static now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mac
d-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 11 ++-
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/arm/mach-imx/ha
The IVT is a self-describing structure which contains a self field. The
self field is the absolute physical base address the IVT ought to be at in
memory. Use the IVT self field to validate the calculated ivt_addr bugging
out if the two values differ.
Signed-off-by: Bryan O'Donoghue
Cc: St
mage via HAB.
This patch is the first step in making that happen subsequent patches will
focus on removing hard-coded offsets to the IVT, which again is not
mandated to live at the end of a .imx image.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Alb
n the alternative BootROM API.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 15 +++
1 file changed, 15 insertions(+)
diff --git
CSF_PAD_SIZE should be defined in hab.h, move it to that location now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 1 +
performance impact with dcache switched off so
this fix is relatively pain-free.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 15 +
later patches,
where we will break the current incorrect dependence on fixed offsets in
favour of an IVT described parsing of incoming binaries.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc:
tautology. A more logical name is
imx_hab_is_enabled().
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 8
1 file changed, 4 insertions(
ux dmesg thus allowing download
of a new image via the BootROM USB download protocol routine.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/m
ux dmesg thus allowing download
of a new image via the BootROM USB download protocol routine.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/m
nvoked the part will drop down to its BootROM USB recovery mode.
Should it be the case that the part is in secure boot mode - only an
appropriately signed binary will be accepted by the ROM and subsequently
executed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng
The IVT header contains a magic number, fixed length and one of two version
identifiers. Validate these settings before doing anything with a putative
IVT binary.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: G
It will be helpful to boot commands to know if the HAB is enabled. Export
imx_hab_is_enabled() now to facilitate further work with this data-point in
a secure-boot context.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebe
received some sort of status
code.
Signed-off-by: Bryan O'Donoghue
Suggested-by: Cc: Breno Matheus Lima
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
---
arch/arm/mach-imx/hab.c | 12 +++-
1 file changed, 7 inser
imx_hab_authenticate_image() is on the other hand very explicit.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 4 ++--
arch/arm/mach-imx/
imx_hab_authenticate_image() is on the other hand very explicit.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 4 ++--
arch/arm/mach-imx/
n the alternative BootROM API.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 15 +++
1 file changed, 15 insertions(+)
diff --git
It will be helpful to boot commands to know if the HAB is enabled. Export
imx_hab_is_enabled() now to facilitate further work with this data-point in
a secure-boot context.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebe
This patch enables printout of the IVT entry, dcd and csf data fields.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 2 ++
1 file chang
tautology. A more logical name is
imx_hab_is_enabled().
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 8
1 file changed, 4 insertions(
nvoked the part will drop down to its BootROM USB recovery mode.
Should it be the case that the part is in secure boot mode - only an
appropriately signed binary will be accepted by the ROM and subsequently
executed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng
On 02/01/18 13:30, Breno Matheus Lima wrote:
Hi Bryan,
2017-12-29 23:08 GMT-02:00 Bryan O'Donoghue :
v3:
- Only call into ROM if headers are verified. - Bryan
- Print HAB event log if and only if a call was made to HAB
and a meaningful status code has been obtained. - Breno
v2:
onwards extend out the HAB functionality.
- hab_rvt_check_target is a recommended check in the NXP documents to
perform prior to hab_rvt_authenticate_image
- hab_rvt_failsafe is a useful function to set the board into BootROM
USB recovery mode.
Bryan O'Donoghue (25):
arm: imx: hab:
The current code disjoins an entire block of code on hab_entry pass/fail
resulting in a large chunk of authenticate_image being offset to the right.
Fix this by checking hab_entry() pass/failure and exiting the function
directly if in an error state.
Signed-off-by: Bryan O'Donoghue
Cc: St
: 36c1ca4d46ef ("imx: Support i.MX6 High Assurance Boot
authentication")
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 9 ++---
ar
first step is fixing the return type in authenticate_image() so do that
now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.
performance impact with dcache switched off so
this fix is relatively pain-free.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 15 +
There is no need to call is_enabled() twice in authenticate_image - it does
nothing but add an additional layer of indentation.
We can check for is_enabled() at the start of the function and return the
result code directly.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Es
The IVT is a self-describing structure which contains a self field. The
self field is the absolute physical base address the IVT ought to be at in
memory. Use the IVT self field to validate the calculated ivt_addr bugging
out if the two values differ.
Signed-off-by: Bryan O'Donoghue
Cc: St
The size of the IVT header should be defined in hab.h move it there now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.
mage via HAB.
This patch is the first step in making that happen subsequent patches will
focus on removing hard-coded offsets to the IVT, which again is not
mandated to live at the end of a .imx image.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Alb
The IVT header contains a magic number, fixed length and one of two version
identifiers. Validate these settings before doing anything with a putative
IVT binary.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: G
later patches,
where we will break the current incorrect dependence on fixed offsets in
favour of an IVT described parsing of incoming binaries.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc:
imx_hab_authenticate_image() is on the other hand very explicit.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 4 ++--
arch/arm/mach-imx/
nvoked the part will drop down to its BootROM USB recovery mode.
Should it be the case that the part is in secure boot mode - only an
appropriately signed binary will be accepted by the ROM and subsequently
executed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng
There is no need to export these functions and data structures externally.
Make them all static now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mac
CSF_PAD_SIZE should be defined in hab.h, move it to that location now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 1 +
and perform that check as directed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 9 +
1 file changed, 9 insertions(+)
diff --
d-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 11 ++-
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/arm/mach-imx/ha
n the alternative BootROM API.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 15 +++
1 file changed, 15 insertions(+)
diff --git
region is good.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 9 +
1 file changed, 9 insertions(+)
diff --git a/arch/
The IVT gives the absolute address of the CSF. There is no requirement for
the CSF to be located adjacent to the IVT so lets use the address provided
in the IVT header instead of the hard-coded fixed CSF offset currently in
place.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc:
received some sort of status
code.
Signed-off-by: Bryan O'Donoghue
Suggested-by: Cc: Breno Matheus Lima
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
---
arch/arm/mach-imx/hab.c | 12 +++-
1 file changed, 7 inser
.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 18 ++
1 file changed, 18 insertions(+)
diff --git a/arch/arm/mach-imx/ha
ux dmesg thus allowing download
of a new image via the BootROM USB download protocol routine.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/m
This patch enables printout of the IVT entry, dcd and csf data fields.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 2 ++
1 file chang
It will be helpful to boot commands to know if the HAB is enabled. Export
imx_hab_is_enabled() now to facilitate further work with this data-point in
a secure-boot context.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebe
tautology. A more logical name is
imx_hab_is_enabled().
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 8
1 file changed, 4 insertions(
On 03/01/18 01:25, Breno Matheus Lima wrote:
Hi Bryan,
2018-01-02 14:43 GMT-02:00 Bryan O'Donoghue :
The i.MX6 has some pretty explicit code associated with informing the IROM
about flushing caches during authenticate_image().
Looking at various pieces of documentation its pretty clea
ecommended check in the NXP documents to
perform prior to hab_rvt_authenticate_image
- hab_rvt_failsafe is a useful function to set the board into BootROM
USB recovery mode.
Bryan O'Donoghue (24):
arm: imx: hab: Make authenticate_image return int
arm: imx: hab: Fix authenticate_image re
first step is fixing the return type in authenticate_image() so do that
now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.
The current code disjoins an entire block of code on hab_entry pass/fail
resulting in a large chunk of authenticate_image being offset to the right.
Fix this by checking hab_entry() pass/failure and exiting the function
directly if in an error state.
Signed-off-by: Bryan O'Donoghue
Cc: St
: 36c1ca4d46ef ("imx: Support i.MX6 High Assurance Boot
authentication")
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 9 ++---
ar
d-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 11 ++-
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/arm/mach-imx/ha
There is no need to call is_enabled() twice in authenticate_image - it does
nothing but add an additional layer of indentation.
We can check for is_enabled() at the start of the function and return the
result code directly.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Es
later patches,
where we will break the current incorrect dependence on fixed offsets in
favour of an IVT described parsing of incoming binaries.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc:
The IVT is a self-describing structure which contains a self field. The
self field is the absolute physical base address the IVT ought to be at in
memory. Use the IVT self field to validate the calculated ivt_addr bugging
out if the two values differ.
Signed-off-by: Bryan O'Donoghue
Cc: St
CSF_PAD_SIZE should be defined in hab.h, move it to that location now.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 1 +
The IVT gives the absolute address of the CSF. There is no requirement for
the CSF to be located adjacent to the IVT so lets use the address provided
in the IVT header instead of the hard-coded fixed CSF offset currently in
place.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc:
region is good.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/include/asm/mach-imx/hab.h | 9 +
1 file changed, 9 insertions(+)
diff --git a/arch/
tautology. A more logical name is
imx_hab_is_enabled().
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 8
1 file changed, 4 insertions(
This patch enables printout of the IVT entry, dcd and csf data fields.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 2 ++
1 file chang
.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 18 ++
1 file changed, 18 insertions(+)
diff --git a/arch/arm/mach-imx/ha
n the alternative BootROM API.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 15 +++
1 file changed, 15 insertions(+)
diff --git
ux dmesg thus allowing download
of a new image via the BootROM USB download protocol routine.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/m
and perform that check as directed.
Signed-off-by: Bryan O'Donoghue
Cc: Stefano Babic
Cc: Fabio Estevam
Cc: Peng Fan
Cc: Albert Aribaud
Cc: Sven Ebenfeld
Cc: George McCollister
Cc: Breno Matheus Lima
---
arch/arm/mach-imx/hab.c | 9 +
1 file changed, 9 insertions(+)
diff --
301 - 400 of 580 matches
Mail list logo
