AIMLinux/AddOn/Security - Revision history

Yanwei.cao at 07:09, 16 March 2020

2020-03-16T07:09:00Z

Yanwei.cao at 07:07, 16 March 2020

2020-03-16T07:07:19Z

Yanwei.cao at 07:04, 16 March 2020

2020-03-16T07:04:44Z

Yanwei.cao at 07:01, 16 March 2020

2020-03-16T07:01:13Z

Yanwei.cao at 06:57, 16 March 2020

2020-03-16T06:57:35Z

Yanwei.cao at 06:51, 16 March 2020

2020-03-16T06:51:20Z

Yanwei.cao at 06:34, 16 March 2020

2020-03-16T06:34:45Z

Yanwei.cao at 06:28, 16 March 2020

2020-03-16T06:28:50Z

Yanwei.cao at 02:46, 16 March 2020

2020-03-16T02:46:15Z

Yanwei.cao at 02:43, 16 March 2020

2020-03-16T02:43:47Z

@@ Line 23: / Line 23: @@
 *../linux64/srktool -h 4 -t SRK_1_2_3_4_table.bin -e SRK_1_2_3_4_fuse.bin -d sha256 -c ./SRK1_sha256_4096_65537_v3_ca_crt.pem,./SRK2_sha256_4096_65537_v3_ca_crt.pem,./SRK3_sha256_4096_65537_v3_ca_crt.pem,./SRK4_sha256_4096_65537_v3_ca_crt.pem -f 1
 *Create the fuse table and binary to be flashed later. This command will generate root public key file "SRK_1_2_3_4_table.bin" and its corresponding hash "SRK_1_2_3_4_fuse.bin". The content of the latter will be later on burned to chip eFuse. '''NOTE''': Don't leave space between the pem file names. Otherwise the generated SRK table and fuse file will not be correct.
-*Show "SRK_1_2_3_4_fuse.bin" information. For example:<br/>~/cst-2.3.2/crts$ hexdump -C SRK_1_2_3_4_fuse.bin<br/>00000000 79? f5 61 26 6f cd d4 e9? ae d2 06 ff 5b f8? ea 40??|y.a&o.......[..@|<br/>00000010 01 1c 32 97 0e e3 6b b0?13 c0 1e c8 88 eb 37 cc??|..2...k.......7.|<br/>00000020
+*Show "SRK_1_2_3_4_fuse.bin" information. For example:<br/>~/cst-2.3.2/crts$ hexdump -C SRK_1_2_3_4_fuse.bin<br/>00000000 79&nbsp;f5 61 26 6f cd d4 e9&nbsp;ae d2 06 ff 5b f8&nbsp;ea 40&nbsp; |y.a&o.......[..@|<br/>00000010 01 1c 32 97 0e e3 6b b0?13 c0 1e c8 88 eb 37 cc&nbsp; |..2...k.......7.|<br/>00000020
 === Build secure images ===

@@ Line 14: / Line 14: @@
 *Create a text file called serial, which contains 8 digits. For example: Fill in "12356789" to the serial file
-*Create a text file called key_pass.txt, which contains two lines of identical text, such as "advantech_test". For example:
+*Create a text file called key_pass.txt, which contains two lines of identical text, such as "advantech_test". For example:<br/>~/cst-2.3.2/keys$ cat key_pass.txt<br/>advantech_test<br/>advantech_test
 *./hab4_pki_tree.sh
@@ Line 25: / Line 23: @@
 *../linux64/srktool -h 4 -t SRK_1_2_3_4_table.bin -e SRK_1_2_3_4_fuse.bin -d sha256 -c ./SRK1_sha256_4096_65537_v3_ca_crt.pem,./SRK2_sha256_4096_65537_v3_ca_crt.pem,./SRK3_sha256_4096_65537_v3_ca_crt.pem,./SRK4_sha256_4096_65537_v3_ca_crt.pem -f 1
 *Create the fuse table and binary to be flashed later. This command will generate root public key file "SRK_1_2_3_4_table.bin" and its corresponding hash "SRK_1_2_3_4_fuse.bin". The content of the latter will be later on burned to chip eFuse. '''NOTE''': Don't leave space between the pem file names. Otherwise the generated SRK table and fuse file will not be correct.
-*Show "SRK_1_2_3_4_fuse.bin" information. For example:
+*Show "SRK_1_2_3_4_fuse.bin" information. For example:<br/>~/cst-2.3.2/crts$ hexdump -C SRK_1_2_3_4_fuse.bin<br/>00000000 79? f5 61 26 6f cd d4 e9? ae d2 06 ff 5b f8? ea 40??|y.a&o.......[..@|<br/>00000010 01 1c 32 97 0e e3 6b b0?13 c0 1e c8 88 eb 37 cc??|..2...k.......7.|<br/>00000020
 === Build secure images ===
@@ Line 135: / Line 131: @@
 *cd /sys/fsl_otp
 *Use the 8 dwords generated in last step and burn them to SRK fuse one by one.<br/>echo 0x2661F579 > HW_OCOTP_SRK0<br/>echo 0xE9D4CD6F > HW_OCOTP_SRK1<br/>echo 0xFF06D2AE > HW_OCOTP_SRK2<br/>echo 0x40EAF85B > HW_OCOTP_SRK3<br/>echo 0x97321C01 > HW_OCOTP_SRK4<br/>echo 0xB06BE30E > HW_OCOTP_SRK5<br/>echo 0xC81EC013 > HW_OCOTP_SRK6<br/>echo 0xCC37EB88 > HW_OCOTP_SRK7
+*Verify that the correct value has been burned. Type command:<br/>ls | grep "SRK.$" | xargs cat<br/>Log message:<br/>…/sys/fsl_otp# ls | grep "SRK.$" | xargs cat<br/>0x2661f579<br/>0xe9d4cd6f<br/>0xff06d2ae<br/>0x40eaf85b<br/>0x97321c01<br/>0xb06be30e<br/>0xc81ec013<br/>0xcc37eb88
 .Insert USB disk to the device. Suppose the USB disk path is /run/media/sda1

@@ Line 183: / Line 183: @@
 .Boot the device again and press "Enter" key to stay in the u-boot stage. The security patch should work now.
+*Successful authentication will give the following dump message in U-Boot load. Check hab status for u-boot when HAB enabled. The following message is a correct status.<br/>=> hab_status<br/>Log:<br/>Secure boot enabled<br/>HAB Configuration: 0xcc, HAB State: 0x99<br/>No HAB Events Found!
-Successful authentication will give the following dump message in U-Boot load. Check hab status for u-boot when HAB enabled. The following message is a correct status.<br/>=> hab_status
+*After typing following command: if the device is "close", will see following message. Successful authentication will give the following dump message in zImage load:<br/>=> hab_auth_img 10800000 0x639000<br/>log:<br/>Authenticate image from DDR location 0x10800000...<br/>Secure boot enabled<br/>HAB Configuration: 0xcc, HAB State: 0x99<br/>No HAB Events Found!
-Log:<br/>Secure boot enabled<br/>HAB Configuration: 0xcc, HAB State: 0x99<br/>No HAB Events Found!
+*set and save loading kernel image address<br/>=> setenv loadaddr 10800000<br/>=> saveenv<br/>log:<br/>Saving Environment to SPI Flash...<br/>JEDEC ID: 0xef:0x40:0x16<br/>Erasing SPI flash...Writing to SPI flash..................................SUCCESS<br/>.................................................................................<br/>done
+*Boot the device again. The security patch should work now. Successful authentication will give the following dump message in zImage load:<br/>...<br/>...<br/>Kernel image @ 0x10800000 [ 0x000000 - 0x638f58 ]<br/>## Flattened Device Tree blob at 18000000<br/>&nbsp; Booting using the fdt blob at 0x18000000<br/>Authenticate image from DDR location 0x10800000...<br/>Secure boot enabled<br/>HAB Configuration: 0xcc, HAB State: 0x99<br/>No HAB Events Found!<br/>&nbsp; Using Device Tree in place at 18000000, end 1800e5df<br/>Starting kernel ...

@@ Line 136: / Line 136: @@
 *Use the 8 dwords generated in last step and burn them to SRK fuse one by one.<br/>echo 0x2661F579 > HW_OCOTP_SRK0<br/>echo 0xE9D4CD6F > HW_OCOTP_SRK1<br/>echo 0xFF06D2AE > HW_OCOTP_SRK2<br/>echo 0x40EAF85B > HW_OCOTP_SRK3<br/>echo 0x97321C01 > HW_OCOTP_SRK4<br/>echo 0xB06BE30E > HW_OCOTP_SRK5<br/>echo 0xC81EC013 > HW_OCOTP_SRK6<br/>echo 0xCC37EB88 > HW_OCOTP_SRK7
+*
 Verify that the correct value has been burned. Type command:<br/>ls | grep "SRK.$" | xargs cat
@@ Line 168: / Line 169: @@
 *Check hab status for u-boot when HAB disabled. The following message is a correct status.<br/>=> hab_status<br/>Secure boot disabled<br/>HAB Configuration: 0xf0, HAB State: 0x66<br/>No HAB Events Found!
 *Modify U-Boot bootcmd so it includes the HAB command that checks the kernel:<br/>=> load mmc 0 10800000 zImage<br/>log:<br/>reading zImage<br/>6015320 bytes read in 294 ms (19.5 MiB/s)
+*After you type following command: if the device is "open", you will see following message:<br/>=> hab_auth_img 10800000 0x639000<br/>log:<br/>hab fuse not enabled
 .Turn on chip HAB.
@@ Line 179: / Line 177: @@
 *cd /sys/fsl_otp
 *Turn on RNG_TRIM<br/>echo 0x00040000 > HW_OCOTP_MEM0
+*See hab status for device "open":<br/>cat HW_OCOTP_CFG5<br/>log:<br/>0x0
 *Put SEC_CONFIG to close (turn on chip security).<br/>echo 0x2 > HW_OCOTP_CFG5
-See hab status for device "open":<br/>cat HW_OCOTP_CFG5
+*See hab status for device "close":<br/>cat HW_OCOTP_CFG5<br/>log:<br/>0x2
 .Boot the device again and press "Enter" key to stay in the u-boot stage. The security patch should work now.

@@ Line 136: / Line 136: @@
 *Use the 8 dwords generated in last step and burn them to SRK fuse one by one.<br/>echo 0x2661F579 > HW_OCOTP_SRK0<br/>echo 0xE9D4CD6F > HW_OCOTP_SRK1<br/>echo 0xFF06D2AE > HW_OCOTP_SRK2<br/>echo 0x40EAF85B > HW_OCOTP_SRK3<br/>echo 0x97321C01 > HW_OCOTP_SRK4<br/>echo 0xB06BE30E > HW_OCOTP_SRK5<br/>echo 0xC81EC013 > HW_OCOTP_SRK6<br/>echo 0xCC37EB88 > HW_OCOTP_SRK7
+*
 Verify that the correct value has been burned. Type command:<br/>ls | grep "SRK.$" | xargs cat
 Log message:<br/>…/sys/fsl_otp# ls | grep "SRK.$" | xargs cat<br/>0x2661f579<br/>0xe9d4cd6f<br/>0xff06d2ae<br/>0x40eaf85b<br/>0x97321c01<br/>0xb06be30e<br/>0xc81ec013<br/>0xcc37eb88
@@ Line 159: / Line 158: @@
 == <span style="font-size: 15.6px;">'''Test'''</span> ==
-<span style="font-size: 15.6px;">1.</span>Boot the device again and press "Enter" key to stay in the u-boot stage<span style="font-size: 15.6px;"></span>
+<span style="font-size: 15.6px;">1.</span>Boot the device again and press "Enter" key to stay in the u-boot stage
 Adv-Boot SPL 2016.03 (Nov 08 2017 - 14:17:25)<br/>BOOT_DEVICE_AUTO<br/>MMC read: dev # 0, block # 3,count 1200 ...<br/>booting from SD<br/>Jumping to U-Boot
@@ Line 176: / Line 175: @@
 .Turn on chip HAB.
-*!!! CAUTION !!! Make sure you perform all the steps correctly. After this step, there will be no way back, and a chip may permanently be bricked.
+*!!! CAUTION&nbsp;!!! Make sure you perform all the steps correctly. After this step, there will be no way back, and a chip may permanently be bricked.
 *Normal boot into kernel.
 *cd /sys/fsl_otp
 *Turn on RNG_TRIM<br/>echo 0x00040000 > HW_OCOTP_MEM0
+*
 See hab status for device "open":<br/>cat HW_OCOTP_CFG5
@@ Line 186: / Line 186: @@
+*
 Put SEC_CONFIG to close (turn on chip security).<br/>echo 0x2 > HW_OCOTP_CFG5
+*
 See hab status for device "close":<br/>cat HW_OCOTP_CFG5
@@ Line 196: / Line 198: @@
+*
 Successful authentication will give the following dump message in U-Boot load. Check hab status for u-boot when HAB enabled. The following message is a correct status.<br/>=> hab_status
 Log:<br/>Secure boot enabled<br/>HAB Configuration: 0xcc, HAB State: 0x99<br/>No HAB Events Found!
 *Modify U-Boot bootcmd so it includes the HAB command that checks the kernel:
-Modify U-Boot bootcmd so it includes the HAB command that checks the kernel:<br/>load mmc 0 10800000 zImage
 log:<br/>reading zImage<br/>6015320 bytes read in 294 ms (19.5 MiB/s)
 *After typing following command: if the device is "close", will see following message. Successful authentication will give the following dump message in zImage load:
-After typing following command: if the device is "close", will see following message. Successful authentication will give the following dump message in zImage load:<br/>hab_auth_img 10800000 0x639000
 log:<br/>Authenticate image from DDR location 0x10800000...<br/>Secure boot enabled<br/>HAB Configuration: 0xcc, HAB State: 0x99<br/>No HAB Events Found!
+*
 set and save loading kernel image address<br/>setenv loadaddr 10800000<br/>saveenv
@@ Line 216: / Line 222: @@
+*
 Boot the device again. The security patch should work now. Successful authentication will give the following dump message in zImage load:<br/>...<br/>...<br/>Kernel image @ 0x10800000 [ 0x000000 - 0x638f58 ]<br/>## Flattened Device Tree blob at 18000000<br/>&nbsp; &nbsp;Booting using the fdt blob at 0x18000000
 Authenticate image from DDR location 0x10800000...<br/>Secure boot enabled<br/>HAB Configuration: 0xcc, HAB State: 0x99<br/>No HAB Events Found!<br/>&nbsp; &nbsp;Using Device Tree in place at 18000000, end 1800e5df<br/>Starting kernel ...

← Older revision		Revision as of 06:28, 16 March 2020
Line 132:		Line 132:

	*!!! CAUTION!!! Make sure you perform all the steps correctly. Otherwise you may damage a chip permanently. It is strongly recommended that a socket board is used, so in the worst case scenario, we can change a chip without totally damaging the board.		*!!! CAUTION!!! Make sure you perform all the steps correctly. Otherwise you may damage a chip permanently. It is strongly recommended that a socket board is used, so in the worst case scenario, we can change a chip without totally damaging the board.
		+	*Normal boot into kernel.
		+	*cd /sys/fsl_otp
		+	*Use the 8 dwords generated in last step and burn them to SRK fuse one by one.<br/>echo 0x2661F579 > HW_OCOTP_SRK0<br/>echo 0xE9D4CD6F > HW_OCOTP_SRK1<br/>echo 0xFF06D2AE > HW_OCOTP_SRK2<br/>echo 0x40EAF85B > HW_OCOTP_SRK3<br/>echo 0x97321C01 > HW_OCOTP_SRK4<br/>echo 0xB06BE30E > HW_OCOTP_SRK5<br/>echo 0xC81EC013 > HW_OCOTP_SRK6<br/>echo 0xCC37EB88 > HW_OCOTP_SRK7
		+	*
		+	Verify that the correct value has been burned. Type command:<br/>ls \| grep "SRK.$" \| xargs cat
		+
		+	Log message:<br/>…/sys/fsl_otp# ls \| grep "SRK.$" \| xargs cat<br/>0x2661f579<br/>0xe9d4cd6f<br/>0xff06d2ae<br/>0x40eaf85b<br/>0x97321c01<br/>0xb06be30e<br/>0xc81ec013<br/>0xcc37eb88
		+
		+	3.Insert USB disk to the device. Suppose the USB disk path is /run/media/sda1
		+
		+	4.Burn the secure SPL image (spl_signed) to SPI.
		+
		+	cd /run/media/sda1<br/>flash_erase /dev/mtd0 0 192<br/>dd if=spl_signed of=/dev/mtd0 bs=512 seek=2<br/>sync

	== <span style="font-size: 15.6px;">'''Test'''</span> ==		== <span style="font-size: 15.6px;">'''Test'''</span> ==

@@ Line 125: / Line 125: @@
 *The fuse table generated in the third point is what needs to be flashed to the device. However, the hexdump command above doesn’t show the values in their correct endianness, instead the command below will be more useful.
 *The following command gives you what needs to be flashed in the proper order. Dump the content of the eFuse file in ~/cst-2.3.2/crts directory. They will be burned to chip with kernel utilities.
-Log message:<br/>0x2661F579<br/>0xE9D4CD6F<br/>0xFF06D2AE<br/>0x40EAF85B<br/>0x97321C01<br/>0xB06BE30E<br/>0xC81EC013<br/>0xCC37EB88
+&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hexdump -e '/4 "0x"' -e '/4 "%X""\n"' < SRK_1_2_3_4_fuse.bin
 *!!! CAUTION!!! Make sure you perform all the steps correctly. Otherwise you may damage a chip permanently. It is strongly recommended that a socket board is used, so in the worst case scenario, we can change a chip without totally damaging the board.
 == <span style="font-size: 15.6px;">'''Test'''</span> ==

@@ Line 126: / Line 126: @@
 *The fuse table generated in the third point is what needs to be flashed to the device. However, the hexdump command above doesn’t show the values in their correct endianness, instead the command below will be more useful.
+*
 The following command gives you what needs to be flashed in the proper order. Dump the content of the eFuse file in ~/cst-2.3.2/crts directory. They will be burned to chip with kernel utilities.<br/>hexdump -e '/4 "0x"' -e '/4 "%X""\n"' < SRK_1_2_3_4_fuse.bin