Verified-boot in bsp 43

[Jayashree]

Hello,

I’m working on BSP 43 and currently enabling Verified Boot via local.conf to perform kernel image verification.
However, when I attempt to load an external U-Boot script via TFTP, "tftp <filename>" the file gets loaded into the loadaddr, and then when i execute it through "source ${loadaddr}",
I encounter an error: Wrong image for source command.

The same steps when followed without verified-boot, it is successfully executed.

Any insights or suggestions on this would be appreciated.

[carlos_o]

Hi @Jayashree 

Thanks for your post

Please help me giving more information about your setup

Could you share if you are using S32G2 or S32G3?
The image you are building is for SD or QSPI? 
Which version of HSE are you using?

[Jayashree]

Hello,

Here are the answers to your questions:

• Are you using S32G2 or S32G3?
  → S32G3

• Is the image built for SD or QSPI?
  → SD

• Which version of HSE are you using?
  → The version of HSE doesn't significantly impact this issue, but I'm using HSE FW 0.2.51.

---

Observations from the past few days:

• The “Wrong image format for source command” error originates from source.c.

• When Verified Boot is enabled, CONFIG_FIT gets enabled as well. Since my script is not in FIT format, it falls back to the default case.

• To work around this, I forced U-Boot to read the script in uImage format, even with Verified Boot enabled.

• I also noticed that the verify variable is automatically set to -1, causing the kernel image and DTB to boot without verification.

• When I stopped at U-Boot and manually set verify=yes, the verification step did take place, and the image booted as expected.

• However, when I attempted to patch the verify variable to automate this flow, I encountered an error.
  
  I would appreciate your guidance on how to correctly automate this behavior within the U-Boot flow.

  
  manually adding verify=yes (working)
  
  
  this is when i patched verify=yes and tried to boot (It fails even when I manually set verify to yes.

[carlos_o]

Hi @Jayashree 

Apologies for the late reply.

Could you please confirm that you are adding DISTRO_FEATURES:append = " verifiedboot" to your conf/local.conf file in the Yocto build directory?

I'm working to replicate the issue at my end.

[Jayashree]

I'm happy to share that I’ve identified the issue.

Yes, I am adding
DISTRO_FEATURES:append = " verifiedboot"
to the conf/local.conf file in the Yocto build directory.

The problem was that the verify variable was getting set to -1, which caused the kernel and DTB to load without verification. I’ve created a patch to set verify=yes, and perform a reset and with this change, everything is now working as expected.

[carlos_o]

Thanks for share your resolution of the issue!