Re: HABv4 with SPL and u-boot-dtb.img on i.MX6

22 Feb 2024


      On Tue, 20 Feb 2024 11:29:53 -0500
Sean Anderson sean.anderson@seco.com wrote:
...
On 2/20/24 04:50, Benjamin Lemouzy wrote:
...
Using fdtdump shows that crc32 is used as hash algorithm for FIT image which is a super weak one.
I tried to pass another algo (sha256) using mkimage -o option but that doesn't work.
./tools/mkimage -f auto -A arm -T firmware -C none -O u-boot -a 0x17800000 -e 0x17800000 -p 0x0 -n "U-Boot 2024.04-rc2-00025-g9e00b6993f-dirty for mx6sabresd board" -E -b arch/arm/dts/imx6q-sabresd.dtb -b arch/arm/dts/imx6qp-sabresd.dtb -b arch/arm/dts/imx6dl-sabresd.dtb -d u-boot-nodtb.bin -o sha256 u-boot-dtb.img
Is there any way to change U-Boot FIT image hash?
I believe these options are only used for signed FIT images (e.g. for
verified boot [1]). Since you are using an external signing process,
they have no effect. I suggest creating your FIT manually (e.g. -f
u-boot.its instead of -f auto). You should be able to specify the hashes
manually that way.
Using "fdtdump -s u-boot-dtb.img" output as reference to create a u-boot.its file, I now have a u-boot.itb file with sha256 hashes.
...
...
I also try to use image format and force the HAB to verify the whole u-boot-dtb.img file by patching the FIT image size:
image_size=$(stat -tc %s u-boot-dtb.img)
printf "00000004: %08x" "$image_size" | xxd -r - u-boot-dtb.img


SPL starts, authentication looks fine but the boot fails.
Is there any chance to make it work or is it insane to try to use this format?
I have always just used verified boot for U-Boot and the kernel, and
only used vendor-specific stuff for SPL.
That indeed a good idea but CONFIG_SPL_FIT_SIGNATURE and CONFIG_SPL_DM (as dependency) take a lot of space and SPL overflows i.MX6 OCRAM.
I finally succeed to make U-Boot check with HAB work using the new u-boot.itb image with the following signature format:
------- +-----------------------------+ <-- *load_address
                ^   |                             |
                |   |                             |
                |   |          Image data         |
         Signed |   |                             |
          Data  |   |                             |
                |   +-----------------------------+
                |   |    Padding Next Boundary    |
                |   +-----------------------------+ <-- *ivt
                v   |     Image Vector Table      |
            ------- +-----------------------------+ <-- *csf
                    |                             |
                    | Command Sequence File (CSF) |
                    |                             |
                    +-----------------------------+
                    |     Padding (optional)      |
                    +-----------------------------+
I don't really understand what u-boot-dtb.img file is but it doesn't work with U-Boot CONFIG_IMX_HAB.
Thanks for help!
Benjamin