Boot command using hab_auth_img

[pgentili]

Hi everyone,

I'm trying to use HAB for the kernel verification. I managed to sign the kernel image and to get "No HAB Events Found!" calling  hab_auth_img 0x40480000 0x13c6f60 0x13c6000.

I have two questions:

1. Do I have to explicitly add the hab_auth_img command in my bootcmd? Or is it in some way performed under the hood?
2. If the command must be explicit does it mean that every time I want to update my kernel I also have to update U-Boot?

Thanks

Paolo Gentili

[pgentili]

Hi, just a quick update.

I found a workaround: I modified the booti.c file so that the booti command requires also the image size and the image offset. This way useful also because I need to verify not only the kernel but also the DTB: a modification to booti.c was needed nevertheless.

Thanks

Paolo

[adam_m]

I'm having a similar problem.  Can you share your modifications to booti.c?

Thanks!

Adam

[pgentili]

Hi, sorry for the late reply.

Please find attached two patches for uboot.

The logic is this: I removed any hab_auth_img control inside the booti command. The verification is perfomed by uboot before launching booti using the command load_fdt and loadimage.

Regards,

Paolo

[pgentili]

Hi,

Thanks for your reply but you misunderstood me, let me explain again.

The kernel is the same, these are the steps to reproduce:

1) Manually load kernel Image at addr x

2) Run hab_auth_img with the kernel size/offset that I know because I compiled it

3) It returns no events, good.

4) Run booti

5) It automatically run an hab_authentication but if fails... (I found out that is related to a wrong kernel size).

So why with the same Image I'm having this problem?

Thanks

Paolo

[pgentili]

Hi again,

Thanks for your reply.

I later found out that uboot itself, in the booti routine, tries to verify the kernel.

I have a problem though: the verification run manually by me is fine (via hab_auth_img) but the one performed by uboot fails. I found out that the problem is in the kernel size: my image has size 0x13c6f60 but the size retrieved inside booti_setup is 0x143b020.

Do you know why this is happening?

Thanks

Paolo Gentili

[Yuri]

Hello,

   Looks like Your  kernel is not the same, as used in the example. 
Kernel size depends on configuration. 

Regards,

Yuri.

[Yuri]

Hello,

  Yes, you can  modify your U-Boot bootcmd so it includes the HAB command that checks the kernel.

If some parameters changed - it will be needed to modify bootcmd.

Regards,

Yuri.