topic Re: Boot command using hab_auth_img in i.MX Processors

Boot command using hab_auth_img

pgentili — Thu, 07 May 2020 11:25:53 GMT

Hi everyone,

I'm trying to use HAB for the kernel verification. I managed to sign the kernel image and to get "No HAB Events Found!" calling hab_auth_img 0x40480000 0x13c6f60 0x13c6000.

I have two questions:

Do I have to explicitly add the hab_auth_img command in my bootcmd? Or is it in some way performed under the hood?
If the command must be explicit does it mean that every time I want to update my kernel I also have to update U-Boot?

Thanks

Paolo Gentili

Re: Boot command using hab_auth_img

Yuri — Fri, 08 May 2020 07:27:06 GMT

Hello,

Yes, you can modify your U-Boot bootcmd so it includes the HAB command that checks the kernel.

If some parameters changed - it will be needed to modify bootcmd.

Regards,

Yuri.

Re: Boot command using hab_auth_img

pgentili — Mon, 25 May 2020 17:24:14 GMT

Hi again,

Thanks for your reply.

I later found out that uboot itself, in the booti routine, tries to verify the kernel.

I have a problem though: the verification run manually by me is fine (via hab_auth_img) but the one performed by uboot fails. I found out that the problem is in the kernel size: my image has size 0x13c6f60 but the size retrieved inside booti_setup is 0x143b020.

Do you know why this is happening?

Thanks

Paolo Gentili

Re: Boot command using hab_auth_img

Yuri — Tue, 26 May 2020 02:01:25 GMT

Hello,

Looks like Your kernel is not the same, as used in the example.
Kernel size depends on configuration.

Regards,

Yuri.

Re: Boot command using hab_auth_img

pgentili — Tue, 26 May 2020 05:52:56 GMT

Hi,

Thanks for your reply but you misunderstood me, let me explain again.

The kernel is the same, these are the steps to reproduce:

1) Manually load kernel Image at addr x

2) Run hab_auth_img with the kernel size/offset that I know because I compiled it

3) It returns no events, good.

4) Run booti

5) It automatically run an hab_authentication but if fails... (I found out that is related to a wrong kernel size).

So why with the same Image I'm having this problem?

Thanks

Paolo

Re: Boot command using hab_auth_img

pgentili — Fri, 29 May 2020 10:01:45 GMT

Hi, just a quick update.

I found a workaround: I modified the booti.c file so that the booti command requires also the image size and the image offset. This way useful also because I need to verify not only the kernel but also the DTB: a modification to booti.c was needed nevertheless.

Thanks

Paolo

Re: Boot command using hab_auth_img

adam_m — Thu, 10 Dec 2020 17:24:01 GMT

I'm having a similar problem. Can you share your modifications to booti.c?

Thanks!

Adam

Re: Boot command using hab_auth_img

pgentili — Fri, 22 Jan 2021 11:18:23 GMT

Hi, sorry for the late reply.

Please find attached two patches for uboot.

The logic is this: I removed any hab_auth_img control inside the booti command. The verification is perfomed by uboot before launching booti using the command load_fdt and loadimage.

Regards,

Paolo