iMX6, CONFIG_IMX_HAB and fuse_read()
Hi!
I am currently not subscribed (already filled the form waiting for confirmation), so please CC me for the moment.
I am trying to enable Secure Boot/HAB on u-boot 2022.07. In a previous version this was achieved by enabling CONFIG_SECURE_BOOT, which was then renamed to CONFIG_IMX_HAB.
Now if I enable this option I get:
``` | arm-tdx-linux-gnueabi-ld.bfd: arch/arm/mach-imx/hab.o: in function `imx_hab_is_enabled': | /home/lisandro/myproject/build/tmp/work/apalis_imx6-tdx-linux-gnueabi/u-boot-toradex/1_2022.07-r0/git/arch/arm/mach-imx/hab.c:875: undefined reference to `fuse_read' | make[2]: *** [/home/lisandro/myproject/build/tmp/work/apalis_imx6-tdx-linux-gnueabi/u-boot-toradex/1_2022.07-r0/git/scripts/Makefile.spl:525: spl/u-boot-spl] Error 1 ```
Now without IMX_HAB enabled CONFIG_CMD_FUSE is enabled and actually works, ie, I can read the fuses from u-boot's command line. So I'm suspecting this is just a missing condition... somewhere. But so far I have not been able to detect exactly where. Can anyone give me a non-NULL pointer on this?
Thanks in advance, Lisandro.
-- Lisandro Pérez Meyer Embedded Platform Engineer
Hi Lisandro,
On Fri, Dec 8, 2023 at 3:43 PM Lisandro Pérez Meyer lpmeyer@ics.com wrote:
Hi!
I am currently not subscribed (already filled the form waiting for confirmation), so please CC me for the moment.
I am trying to enable Secure Boot/HAB on u-boot 2022.07. In a previous
Please try the top of tree U-Boot instead.
On the mx7dsabresd_defconfig, for example, both CONFIG_IMX_HAB=y and CONFIG_CMD_FUSE=y are selected and this target builds fine.
Hi!
On Fri, Dec 8, 2023 at 3:53 PM Fabio Estevam festevam@gmail.com wrote:
Hi Lisandro,
On Fri, Dec 8, 2023 at 3:43 PM Lisandro Pérez Meyer lpmeyer@ics.com wrote:
Hi!
I am currently not subscribed (already filled the form waiting for confirmation), so please CC me for the moment.
I am trying to enable Secure Boot/HAB on u-boot 2022.07. In a previous
Please try the top of tree U-Boot instead.
On the mx7dsabresd_defconfig, for example, both CONFIG_IMX_HAB=y and CONFIG_CMD_FUSE=y are selected and this target builds fine.
Sure thing!
For the sake of completeness:
gcc: gcc-arm-9.2-2019.12-x86_64-arm-none-linux-gnueabihf.tar.xz as per https://developer-archives.toradex.com/knowledge-base/build-u-boot-and-linux...
``` $ export ARCH=arm $ export DTC_FLAGS="-@" $ export PATH=~/gcc-linaro/bin/:$PATH $ export CROSS_COMPILE=arm-none-linux-gnueabihf- ```
I added IMX_HAB:
``` $ echo "CONFIG_IMX_HAB=y" >> configs/apalis_imx6_defconfig ```
And built:
``` $ make apalis_imx6_defconfig $ make -j16 [...] LD spl/u-boot-spl arm-none-linux-gnueabihf-ld.bfd: arch/arm/mach-imx/hab.o: in function `imx_hab_is_enabled': /tmp/tmp.iSzdlFQa34/u-boot/arch/arm/mach-imx/hab.c:879: undefined reference to `fuse_read' make[1]: *** [scripts/Makefile.spl:527: spl/u-boot-spl] Error 1 ```
Same error :-/
Don't forget to CC me ;-)
On Fri, Dec 8, 2023 at 4:54 PM Lisandro Pérez Meyer lpmeyer@ics.com wrote: [snip]
On the mx7dsabresd_defconfig, for example, both CONFIG_IMX_HAB=y and CONFIG_CMD_FUSE=y are selected and this target builds fine.
Sure thing!
For the sake of completeness:
gcc: gcc-arm-9.2-2019.12-x86_64-arm-none-linux-gnueabihf.tar.xz as per https://developer-archives.toradex.com/knowledge-base/build-u-boot-and-linux...
$ export ARCH=arm $ export DTC_FLAGS="-@" $ export PATH=~/gcc-linaro/bin/:$PATH $ export CROSS_COMPILE=arm-none-linux-gnueabihf-I added IMX_HAB:
$ echo "CONFIG_IMX_HAB=y" >> configs/apalis_imx6_defconfigAnd built:
$ make apalis_imx6_defconfig $ make -j16 [...] LD spl/u-boot-spl arm-none-linux-gnueabihf-ld.bfd: arch/arm/mach-imx/hab.o: in function `imx_hab_is_enabled': /tmp/tmp.iSzdlFQa34/u-boot/arch/arm/mach-imx/hab.c:879: undefined reference to `fuse_read' make[1]: *** [scripts/Makefile.spl:527: spl/u-boot-spl] Error 1Same error :-/
Forgot to mention: I used master's current HEAD, commit 2f0282922b2c458eea7f85c500a948a587437b63
On Fri, Dec 8, 2023 at 10:15 PM Lisandro Pérez Meyer lpmeyer@ics.com wrote:
I added IMX_HAB:
$ echo "CONFIG_IMX_HAB=y" >> configs/apalis_imx6_defconfig
Please try like this:
--- a/configs/apalis_imx6_defconfig +++ b/configs/apalis_imx6_defconfig @@ -21,7 +21,9 @@ CONFIG_OF_LIBFDT_OVERLAY=y CONFIG_SYS_MONITOR_LEN=409600 CONFIG_SPL_MMC=y CONFIG_SPL_SERIAL=y +CONFIG_SPL_DRIVERS_MISC=y CONFIG_SPL=y +CONFIG_IMX_HAB=y CONFIG_CMD_HDMIDETECT=y CONFIG_SYS_LOAD_ADDR=0x14200000 CONFIG_AHCI=y
Hi!
On Fri, Dec 8, 2023 at 11:44 PM Fabio Estevam festevam@gmail.com wrote:
On Fri, Dec 8, 2023 at 10:15 PM Lisandro Pérez Meyer lpmeyer@ics.com wrote:
I added IMX_HAB:
$ echo "CONFIG_IMX_HAB=y" >> configs/apalis_imx6_defconfigPlease try like this:
--- a/configs/apalis_imx6_defconfig +++ b/configs/apalis_imx6_defconfig @@ -21,7 +21,9 @@ CONFIG_OF_LIBFDT_OVERLAY=y CONFIG_SYS_MONITOR_LEN=409600 CONFIG_SPL_MMC=y CONFIG_SPL_SERIAL=y +CONFIG_SPL_DRIVERS_MISC=y CONFIG_SPL=y +CONFIG_IMX_HAB=y CONFIG_CMD_HDMIDETECT=y CONFIG_SYS_LOAD_ADDR=0x14200000 CONFIG_AHCI=y
That made it! So the question is: is CONFIG_SPL_DRIVERS_MISC something that should be pulled in automatically by CONFIG_IMX_HAB or by something else?
On Sat, Dec 9, 2023 at 11:12 AM Lisandro Pérez Meyer lpmeyer@ics.com wrote:
That made it! So the question is: is CONFIG_SPL_DRIVERS_MISC something that should be pulled in automatically by CONFIG_IMX_HAB or by something else?
Yes, I think we need something like that:
diff --git a/arch/arm/mach-imx/Kconfig b/arch/arm/mach-imx/Kconfig index abd48d42583a..c34bc25c0bfb 100644 --- a/arch/arm/mach-imx/Kconfig +++ b/arch/arm/mach-imx/Kconfig @@ -54,6 +54,7 @@ config IMX_HAB bool "Support i.MX HAB features" depends on ARCH_MX7 || ARCH_MX6 || ARCH_MX5 || ARCH_IMX8M || ARCH_MX7ULP select FSL_CAAM if HAS_CAAM + select SPL_DRIVERS_MISC if SPL imply CMD_DEKBLOB if HAS_CAAM help This option enables the support for secure boot (HAB).
I will run some tests and submit it soon,
participants (2)
-
Fabio Estevam -
Lisandro Pérez Meyer