Enabling Secure Boot on ODROID M1 #593

m-iwanicki · 2024-04-12T13:22:32Z

No description provided.

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

pietrushnic

@m-iwanicki are we considering this blog post ready for review?

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

TomaszAIR · 2024-04-18T11:58:31Z

@m-iwanicki please cherry pick c670c52 and 0ab8b78, it should help with SEO fails

m-iwanicki · 2024-04-18T12:12:07Z

@m-iwanicki please cherry pick c670c52 and 0ab8b78, it should help with SEO fails

@TomaszAIR Done, but some links still fail.

TomaszAIR

@m-iwanicki I left a review, basically it is nice that everything worked but this blog post needs some edits and definitely a plan for itself. Right now it is hard to read, please let me know if I could help more.

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

TomaszAIR · 2024-04-18T12:07:57Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+Enabling Secure Mode is based on storing the hash of the public key in
+the OTP memory and enabling verification of the pre-loader’s signature.
+After correctly executing this step, the RK3568B SoC will check if the hash
+of the public key that is contained in the booted image matches the hash


@m-iwanicki it does that? Does it not check if the signature was signed with priv key which public key is saved in OTP? https://archive.fosdem.org/2023/schedule/event/arm_secure_boot_2/attachments/slides/5852/export/events/attachments/arm_secure_boot_2/slides/5852/Overview_of_Secure_Boot_in_Arm_based_SoCs_2nd_Edition.pdf; slide 6 and 18

Also, some diagram here explaining what is happening would be nice

Changed in 9605d08, rewrote it a little and added a diagram.
Even on your slide (18) there is information that it only saves hash to OTP/EFUSE.

@TomaszAIR And I'm not sure if I can use/store this diagram from Rockchip. I took it from Rockchip Secure Boot Application Note_v1.2_20160202.pdf that's inside this zip. There are also interesting diagrams in Rockchip Secure Boot Application Note.
Or should I make one myself?

@m-iwanicki Since the linked document is classified as "Publicity," it indicates that it is likely meant to be shared publicly, but this doesn't always automatically grant permission for unrestricted use. What we can do is:

Create our own simple diagram

Add the annotation with the source

@m-iwanicki, have you addressed this?

@artur-rs Should I embed link inside diagram or is using ![https://link.to.source](path/to/image) enough? Though it's probably not good from accessibility point.

@m-iwanicki, you can as well add the link into MD comment below the image.

I guess you are right. Just checked to make sure that comments are also added in html page.

6101ce1
Added as a quote as a comments  weren't in html code at least in preview.

Source

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

TomaszAIR · 2024-04-18T12:59:24Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+### U-Boot configuration
+
+To build U-Boot I used `odroid-m1-rk3568_defconfig` configuration. The only
+change I needed to make to this configuration was changing


@m-iwanicki we now what is happening here? Can we explain?

I didn't debug this too deeply so I can't say much more than what's can be glanced from error itself which is it tries to allocate more memory than it's allowed. Maybe it needs to load whole FIT image before verifying/calculating hashes/signatures and with added signature it's too big.

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

artur-rs · 2024-04-18T14:22:40Z

@m-iwanicki @TomaszAIR we can resolve SEO fails on the develop branch

DaniilKl · 2024-09-23T09:00:47Z

@m-iwanicki, I am currently reviewing this PR, could you meanwhile rebase it on the latest master?

How to write key hash to OTP, changes needed to U-Boot to verify signature, how to sign loader. Signed-off-by: Michał Iwanicki <[email protected]>

Add requested changes Signed-off-by: Michał Iwanicki <[email protected]>

Signed-off-by: Michał Iwanicki <[email protected]>

m-iwanicki · 2024-09-23T11:37:25Z

@DaniilKl rebased on current develop

Signed-off-by: Michał Iwanicki <[email protected]>

DaniilKl

@m-iwanicki, I really was trying not to argue about the form of the blog post or the way language is being used. Here are my recommendations for future:

Pay attention to perfect tenses, these (especially past or future) are not needed in technical articles, almost everything can be explained using simple tenses. The perfects only complicate the situation.
Pay attention to articles and use some tools to check them if you are not sure.
Pay attention to readability. Sometimes (when an article is too big) it is not enough to write an intro with a sum up, reader will forget it somewhere in the half of the article and will get lost. First thing you can do here: add an intro and sum up into every chapter, so the reader will be able to connect everything in line while reading.

Actually, have you checked this blog post with e.g. Grammarly?

DaniilKl · 2024-09-23T09:50:45Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+contained in rkbin repository can't handle loaders generated with new idb
+header.
+
+I used newest commits available in those repositories.


"newest" is a relative version, could you use absolute versioning?

I do, check links. newest (at the time of writing) is explanation why those commits in particular.

DaniilKl · 2024-09-23T09:51:56Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+  return -EINVAL;
+```
+
+To generate RSA keys and certificate I decided to use `openssl` command.


Suggested change

To generate RSA keys and certificate I decided to use `openssl` command.

To generate RSA keys and certificate I decided to use `openssl` tool.

DaniilKl · 2024-09-23T09:53:40Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+  python3-setuptools python3-pyelftools swig libssl-dev device-tree-compiler python2 bc
+```
+
+To build Rockchip U-Boot I also needed cross-compiler. By default `make.sh`


Could you specify more precisely the make.sh you are referring to?

DaniilKl · 2024-09-23T10:05:18Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+openssl rsa -in keys/dev.key -pubout -out keys/dev.pubkey
+openssl req -batch -new -x509 -key keys/dev.key -out keys/dev.crt
+```
+


You can add here a sentence where the keys will be used, so the reader will note this and will be able to track progress more easily. This will improve navigation and readability of your blog post.

DaniilKl · 2024-09-23T10:15:45Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+
+In `rkbin/RKBOOT/RK3568MINIALL.ini` I had to update FlashBoot so it points to
+`u-boot-spl.bin` file. Later this `.ini` file will be used by `boot_merger` tool
+to create `rk356x_spl_loader_v1.21.113.bin` file which will contain U-Boot SPL.


You have described the .ini file. But what is the rk356x_spl_loader_v1.21.113.bin file used for? Maybe you could mention that this is the loader, that loads the keys.

DaniilKl · 2024-09-23T12:28:47Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+## What's next
+
+While I managed enable Secure Boot on Odroid it would be good to more
+thoroughly test its security and capability.


Suggested change

thoroughly test its security and capability.

thoroughly test its security and capabilities.

DaniilKl · 2024-09-23T12:29:20Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+While I managed enable Secure Boot on Odroid it would be good to more
+thoroughly test its security and capability.
+Some of the questions that I would like to find answers for are whether there
+really isn't way to overwrite key hash and if it's possible to store more than


Suggested change

really isn't way to overwrite key hash and if it's possible to store more than

really isn't any way to overwrite the hash stoored in OTP and if it's possible to store more than

DaniilKl · 2024-09-23T12:30:45Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+one. OTP has 8k bits of memory based on RK3568 datasheet while hashes are only
+256 bits in size so theoretically we could store 32 different hashes.
+
+Good next step would be to transfer capability of writing hash to OTP from


Suggested change

Good next step would be to transfer capability of writing hash to OTP from

Good next step would be to mainstream capability of writing hash to OTP from

maybe upstream?

DaniilKl · 2024-09-23T12:31:21Z

blog/content/post/2024-04-12-odroid-m1-secure-boot.md

+
+Good next step would be to transfer capability of writing hash to OTP from
+Rockchip U-Boot to mainline U-Boot which would simplify whole implementation
+quite a bit.


Suggested change

quite a bit.

a lot.

Why not quite a lot?

DaniilKl · 2024-09-23T12:33:08Z

blog/static/img/secure-boot-process.png

Not perfect picture for a blog post, too complicated and needs additional explanation. I have not understood it fully yet.

m-iwanicki · 2024-09-23T12:53:46Z

@DaniilKl

Actually, have you checked this blog post with e.g. Grammarly?

Tried to but it went poorly. Currently I'm using languagetool

pietrushnic · 2024-09-23T13:19:05Z

Actually, have you checked this blog post with e.g. Grammarly?

That is the main point, and Grammarly should provide improvements if used correctly.

Tried to but it went poorly. Currently I'm using languagetool

Please provide more details about the issues.

m-iwanicki · 2024-09-23T13:44:26Z

Please provide more details about the issues.

Hundreds of errors
have to copy/paste text to their website, fix and then copy back
markdown has no highlights so it's harder to read
doesn't ignore code blocks (a lot of errors)
It's online so I have to keep in mind what I use it with
I'm not sure but I think it's a little overeager with the (feels like it wants to add it every third word)

Maybe it can be configured (custom rules/words?) and used e.g. from cli?

pietrushnic · 2024-09-23T22:14:54Z

Please provide more details about the issues.
* Hundreds of errors

Why do you assume those are false positives?

* have to copy/paste text to their website, fix and then copy back

Everyone who writes public-facing text should try to make it as high-quality as possible. If that means copying to a tool that improves that, then why not do that? Is copying to another window at the end of writing that much overhead?

* markdown has no highlights so it's harder to read

True. But that is not the goal of that tool, and AFAIK, it deals quite well with markdown syntax not showing markdown [link](URL) as an issue. Why would the text editorial tool need markdown highlights? How does it help in the task?

* doesn't ignore code blocks (a lot of errors)

Code blocks should not be copied for editorial corrections, so that is unnecessary.

* It's online so I have to keep in mind what I use it with

We use the premium version with certain guarantees. I don't know what the precise issue is. We ask to use Grammarly with text we plan to make public, e.g., blog posts.

* I'm not sure but I think it's a little overeager with `the` (feels like it wants to add it every third word)

You can always ignore some suggestions if you know better.

Maybe it can be configured (custom rules/words?) and used e.g. from cli?

It can be configured and trained but has no support for cli. Also, I don't like the lack of integration with Vim/vim. Still, it is much better than wasting the time of a reviewer correcting articles or improving sentence quality if you can delegate that to the machine. We pay for that service, so I would ask you to use it for public text. If you have some better alternatives, we should consider those.

TomaszAIR reviewed Apr 15, 2024

View reviewed changes

blog/content/post/2024-04-12-odroid-m1-secure-boot.md Outdated Show resolved Hide resolved

m-iwanicki force-pushed the odroid-m1-rk3568-secure-boot branch from e53252b to af72329 Compare April 17, 2024 13:12

m-iwanicki marked this pull request as ready for review April 17, 2024 13:37

m-iwanicki changed the title ~~WIP: Enabling Secure Boot on ODROID M1~~ Enabling Secure Boot on ODROID M1 Apr 17, 2024

pietrushnic requested changes Apr 17, 2024

View reviewed changes

blog/content/post/2024-04-12-odroid-m1-secure-boot.md Show resolved Hide resolved

TomaszAIR suggested changes Apr 18, 2024

View reviewed changes

m-iwanicki added 7 commits September 23, 2024 13:36

post: 2024-04-12-odroid-m1-secure-boot.md: new post

848f553

How to write key hash to OTP, changes needed to U-Boot to verify signature, how to sign loader. Signed-off-by: Michał Iwanicki <[email protected]>

post: 2024-04-12-odroid-m1-secure-boot.md: Add changes

edb5a48

Add requested changes Signed-off-by: Michał Iwanicki <[email protected]>

post: odroid-m1-secure-boot: Reorganize post, add requested changes

57522b1

Signed-off-by: Michał Iwanicki <[email protected]>

post: odroid-m1-secure-boot: add filename of created ramboot loader

01daa94

Signed-off-by: Michał Iwanicki <[email protected]>

post: odroid-m1-secure-boot: fix sentence

1407c29

Signed-off-by: Michał Iwanicki <[email protected]>

post: odroid-m1-secure-boot: use public diagram & add source

4324e9c

Signed-off-by: Michał Iwanicki <[email protected]>

post: odroid-m1-secure-boot: fix typos

a35e823

Signed-off-by: Michał Iwanicki <[email protected]>

m-iwanicki force-pushed the odroid-m1-rk3568-secure-boot branch from d5f3c23 to a35e823 Compare September 23, 2024 11:37

docs: odroid-m1-rk3568-secure-boot: fix pre-commit failures

b1cc506

Signed-off-by: Michał Iwanicki <[email protected]>

DaniilKl reviewed Sep 23, 2024

View reviewed changes

	To generate RSA keys and certificate I decided to use `openssl` command.
	To generate RSA keys and certificate I decided to use `openssl` tool.

	thoroughly test its security and capability.
	thoroughly test its security and capabilities.

	really isn't way to overwrite key hash and if it's possible to store more than
	really isn't any way to overwrite the hash stoored in OTP and if it's possible to store more than

	Good next step would be to transfer capability of writing hash to OTP from
	Good next step would be to mainstream capability of writing hash to OTP from

Enabling Secure Boot on ODROID M1 #593

Are you sure you want to change the base?

Enabling Secure Boot on ODROID M1 #593

Conversation

m-iwanicki commented Apr 12, 2024

pietrushnic left a comment

Choose a reason for hiding this comment

TomaszAIR commented Apr 18, 2024

m-iwanicki commented Apr 18, 2024

TomaszAIR left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

m-iwanicki Sep 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

artur-rs commented Apr 18, 2024

DaniilKl commented Sep 23, 2024

m-iwanicki commented Sep 23, 2024

DaniilKl left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

m-iwanicki Sep 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

m-iwanicki commented Sep 23, 2024

pietrushnic commented Sep 23, 2024 • edited Loading

m-iwanicki commented Sep 23, 2024

pietrushnic commented Sep 23, 2024

m-iwanicki Sep 23, 2024 •

edited

Loading

m-iwanicki Sep 23, 2024 •

edited

Loading

pietrushnic commented Sep 23, 2024 •

edited

Loading