HABv4 with SPL and u-boot-dtb.img on i.MX6

[Benjamin Lemouzy]

On Tue, 20 Feb 2024 11:29:53 -0500
Sean Anderson <sean.anderson at seco.com> wrote:

> On 2/20/24 04:50, Benjamin Lemouzy wrote:
> > Using fdtdump shows that crc32 is used as hash algorithm for FIT image which is a super weak one.
> > I tried to pass another algo (sha256) using mkimage -o option but that doesn't work.
> >
> >   ./tools/mkimage -f auto -A arm -T firmware -C none -O u-boot -a 0x17800000 -e 0x17800000 -p 0x0 -n "U-Boot 2024.04-rc2-00025-g9e00b6993f-dirty for mx6sabresd board" -E -b arch/arm/dts/imx6q-sabresd.dtb -b arch/arm/dts/imx6qp-sabresd.dtb -b arch/arm/dts/imx6dl-sabresd.dtb -d u-boot-nodtb.bin -o sha256 u-boot-dtb.img
> >
> > Is there any way to change U-Boot FIT image hash?  
> 
> I believe these options are only used for signed FIT images (e.g. for
> verified boot [1]). Since you are using an external signing process,
> they have no effect. I suggest creating your FIT manually (e.g. -f
> u-boot.its instead of -f auto). You should be able to specify the hashes
> manually that way.

Using "fdtdump -s u-boot-dtb.img" output as reference to create a u-boot.its file, I now have a u-boot.itb file with sha256 hashes.

> > I also try to use image format and force the HAB to verify the whole u-boot-dtb.img file by patching the FIT image size:
> >
> >     image_size=$(stat -tc %s u-boot-dtb.img)
> >     printf "00000004: %08x" "$image_size" | xxd -r - u-boot-dtb.img
> >
> > SPL starts, authentication looks fine but the boot fails.
> > Is there any chance to make it work or is it insane to try to use this format?  
> 
> I have always just used verified boot for U-Boot and the kernel, and
> only used vendor-specific stuff for SPL.

That indeed a good idea but CONFIG_SPL_FIT_SIGNATURE and CONFIG_SPL_DM (as dependency) take a lot of space and SPL overflows i.MX6 OCRAM.

I finally succeed to make U-Boot check with HAB work using the new u-boot.itb image with the following signature format:

            ------- +-----------------------------+ <-- *load_address
                ^   |                             |
                |   |                             |
                |   |          Image data         |
         Signed |   |                             |
          Data  |   |                             |
                |   +-----------------------------+
                |   |    Padding Next Boundary    |
                |   +-----------------------------+ <-- *ivt
                v   |     Image Vector Table      |
            ------- +-----------------------------+ <-- *csf
                    |                             |
                    | Command Sequence File (CSF) |
                    |                             |
                    +-----------------------------+
                    |     Padding (optional)      |
                    +-----------------------------+

I don't really understand what u-boot-dtb.img file is but it doesn't work with U-Boot CONFIG_IMX_HAB.

Thanks for help!

Benjamin