Hands-on iMX6 High Assurance Boot a.k.a. Secure boot

Introduction

These notes are based on Boundary Device’s blog on implementing HAB on an imx6 SoC.

The guide above is out of date, and missing information. I hope this helps to fill in some of those gaps.

I won’t cover the purpose of secure boot or the chain of trust. You can read up on more info here.

The steps described here alone will not prevent you system from running untrusted code. A number of other steps will need to be included, such as 

• blowing fuses to prevent debug interfaces
• prevent the system from booting from arbitrary RAM location
• protecting OS filesystem
• Locked down uboot
  • Disable any external scripts from loading. e.g. 6x_bootscript
  • protect any dtbs
  • Strip the uboot binary down to the basic feature required
• Basically protect any artifacts that are involved in the boot process and running of the OS

Disclaimer: These are just some of my notes and should not be used in any production systems without due caution and validation for accuracy.
This guide also doesn’t cover encrypting your firmware.

Board spec

Boundary devices Nitrogen6X dev board

https://boundarydevices.com/product/nitrogen6x/

SoC MCiMX6Q6AVT10AC Arm Cortex-A9 Quad core 1GB DDR3 Ram

Comes with Linux pre-installed on sdcard.

Terminal access

HDMI

Get a working terminal on boundary devices’ shipped sdcard with Linux.

We need to disable qt gui startup from systemd.

Mount sdcard from another system.

Delete /media/mkocbayi/c1a350a8-ddfb-4d54-8f9f-56b0cbfab55c/etc/systemd/system/multi-user.target.wants/qtlauncher.service

This will stop qt gui on startup.

Boot the board with the modified sdcard.

Might have to press ctl-alt-f5 to get login prompt

Login root, no password.

RS232

The board comes with an rs232 cable for tty access and is enabled in uboot and linux.

I used the Trendnet TU-S9 usb to rs232 cable to connect with no issues.

CPU serial number

Serial number can be read from imx6 On-Chip OTP Controller.

From imx6 console run

From build system, set certificate serial using cpu uid, set CA passphrase to protect code signing private key, and generate certs

Rest of steps can be followed using HAB tutorial.

Create fuse table and binary to be flashed to imx fuses.

Display binary contents

Corrected endianness

Backup known working sdcard

partitions

and 

partition table

extended partition table

Restore sdcard backup

First restore partition tables

Now extended partitions

Update OS with drive’s new partitions

Restore partitions

First partition

second partition

Programming imx fuses

Sanity test

imx6 fuse prog command <bank> <word> <value>

As an example sanity check, we will read the mac address of our imx

imx6 eFuse base address = 0x400

On the i.MX6Q The MAC address is located at 0x620[31:0] (Lower MAC address) and 0x630[15:0] (Upper MAC address), the following example in U-Boot documentation can be used for calculating the bank and word for the Lower MAC address.

(0x620 – 0x400)/0x10 = 0x22 Hexadecimal = 34 Decimal

As the fuses are arranged in banks of 8 words:

34 / 8 = 4 and the remainder is 2, so in this case:

Bank = 4

Word = 2

Python code to calculate MAC_ADDR bank and word

def get_bank_word(fuse_address):
    if fuse_address <= 0x0: # TODO:Change to actual lowest possible value
        print('Must supply fuse address from imx reference manual')
        return

    fuse_base = 0x400

    result = int((fuse_address - fuse_base)/0x10) # result should be in decimal

    bank = int(result / 8)
    word = int(result % 8)

    print('Bank {} Word {}'.format(bank,word))
In [34]: get_bank_word(0x620)
Bank 4 Word 2
In [35]: get_bank_word(0x630)
 Bank 4 Word 3

This fuse word is shadowed in the register OCOTP_MAC0

And reading the fuses from uboot we get

=> fuse read 4 2
 Reading bank 4:
Word 0x00000002: b806928d
 => fuse read 4 3
 Reading bank 4:
Word 0x00000003: 00000019

Booting into the Linux kernel confirms the ethernet mac address

root@b2qt-nitrogen6x:~# ifconfig eth0
 eth0      Link encap:Ethernet  HWaddr 00:19:B8:06:92:8D  
           BROADCAST MULTICAST  MTU:1500  Metric:1
           RX packets:0 errors:0 dropped:0 overruns:0 frame:0
           TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
           collisions:0 txqueuelen:1000 
           RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

One Time Program of a SHA256 of Four RSA public keys

Using the knowledge from above, let’s plug-in the fuse address for burning the SRK (super root key) hash.

Page 351 of the imx6q reference manual says the fuse address starts at 0x580

From board’s u-boot prompt

Each value is 32bits x 8 = 256bit hash

Build u-boot boundary-v2018.07

Note: I originally followed boundary device’s HAB blog which instructed to compile u-boot 2016, and then decided to compile a more recent version instead.

Download and compile

Select ‘ARM architecture’ —> ‘Support i.MX HAB features’

And

Select ‘Device Drivers’  —> Hardware crypto devices  —>

[*] Freescale Crypto Driver Support

[*] Big-endian access to Freescale Secure Boot

(4) Freescale Secure Boot compatibility

-*- Little-endian access to Freescale Secure Boot

And

Select ‘Library routines’  —> ‘Security support’ —>

[*] Support the AES algorithm

Compile

Should have a file called u-boot.imx

Now, if the output of your make command displayed your HAB blocks values then great. However, at the time of writing these notes, my version of mkimage did not display the hab values.

Luckily a kind author wrote a patch.

Compile again

We will also need to create the uboot update script.

Copy your u-boot.imx file to where your code signing tools are.

Sign boot loader

Download and edit u-boot_sign.csf file.

Amended HAB block values to 

Blocks = 0x177ff400 0x0 0x8cc00 “u-boot.imx”

Now create csf file

concat csf binary with uboot

Flash signed uboot to eeprom

Copy the signed boot loader binary to the root of an SD card along with the upgrade script.

Note: The board boots uboot from spi flash.

From the uboot prompt run

Reset the board

And the uboot message shows the correct version.

Verify SRK hash is burnt into fuses

After upgrading uboot and restarting the board into uboot, read the fuses.

Check HAB for any events which might indicate failures.

Enable secure boot

From uboot prompt run

These values are obtained from the imx6 reference manual page 348, 0x460[1]

SEC_CONFIG[1].

Restart system and enter uboot again to verify secure boot mode

Sign kernel

Unsigned kernel

You can copy the zImage file from the original sdcard

Download the script that will help generate the signed image’s ivt

Calculate kernel image size in hex

Pad kernel to nearest 4KB

Pad our kernel image

Obtain uboot load address

10800000

Generate an ivt for the kernel image.

Merge ivt binary with padded kernel

Download example csf file for zImage

and plug in specific values for blocks.

Generate signature

Create signed binary by appending signature to kernel and ivt

Load signed image into ram via uboot and test

Values for hab_auth_img

$ hexdump -C /tftpboot/zImage_signed_10800000 |tail

0061a970

Boot

Need to modify u-boot script to load signed image when hab test passes.

I took Boundary device’s u-boot 6x_bootscript from my sdcard and stripped it down to what I needed to test the hab testing of the signed kernel image.

This is the result of my testing.

Once I was satisfied with the results, I then incorporated the hab test and signed kernel load commands to the main 6x_bootscript, and copied my signed kernel to the sdcard.

The final version of the 6x_bootscript is here.

As stated in the intro, the writeup isn’t a secure configuration and was created for testing imx6 hab features.

Test unsigned bootloader

Flash unsigned bootloader to verify that HAB feature works.

I wanted to test what the board would do if I flashed an unsigned bootloader.

I proceeded to reflash the EEPROM using the old unsigned uboot image and upgradeu. When the upgrade process completed and I power cycled the board, the system wouldn’t boot and no messages were displayed on the serial terminal.

Recover bricked board (imx_usb_loader)

Follow these instructions 

imx_usb_loader install

https://boundarydevices.com/unbricking-nitrogen6x-sabre-lite-i-mx6-board/

imx_usb_loader using signed image

Follow the steps described here https://boundarydevices.com/high-assurance-boot-hab-dummies/#flashing under “What about imx_usb_loader?”

These were the steps I performed

Set my board’s jumpers to boot into otg mode 1 off, and 2 on. Attached to board’s usb otg port and power cycled.

Obtain compiled unsigned u-boot binary

Get dcd length from u-boot binary

Update csf file. 

e.g. u-boot_sign.csf

with

Downloaded mod_4_mfgtool.sh tool

Clear dcd address from u-boot binary

Create csf bin

Set dcd in u-boot

Append both binaries

Place board into spl mode and flash

You should now see u-boot prompt on the serial console.

I inserted my sdcard which contained my signed u-boot image (without the imx_usb_loader modification).

Ran 

from uboot and waited for uboot to say completed and reset.

Turned off board power and set boot switches to 1, and 2 off.

Board started up as normal.

On my first attempt I failed. I went back and erased any old files and it worked on my second attempt.

References