Finding HAB blocks information

[Xuban11]

Hello,

I'm working on HABv4 with i.MX 6 processor.

I need HAB Blocks information.

That information is in a log file.

I don't find the log file, it should be here with u-boot-dtb.imx.log file name.

Where is the build log file? thank you very much

 

[RockDeng]

I had same issue. After enable CONFIG_IMX_HAB, the commans like hab_status is active in uboot, but still can't get the HAB BLOCKS from u-boot.imx file.

[BiyongSUN]

You can the following way.

If the image is not for security boot, it will tell you "ivt_csf pointer is zero. Not a security image!".

If the it is a security image, it will tell you the HAB information.

parseIVT - a script to help i.MX6 Code Signing
https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/parseIVT-a-script-to-help-i-MX6-Code-Sig...

[Xuban11]

Hello sir,

Your script has been useful to confirm that my image doesn't have the security features.

I'm now working on rebuilding an image with security features

Thank you for your help,

-Xuban

[BiyongSUN]

It is good to the script can help you some. 

It doesn't make sense to find a build log  for an existing i.MX6 u-boot.

If we want to know the HAB information, we have to do build again? make no sense. 

That is why I write down the script.  

If you don't like my script.

You can use the u-boot  dumpimage to get the information. but you still need u-boot.

My script is designed since the old version u-boot. it has one big difference is the image is not aligned to 0x1000. 

My script can tell how much need to pad. 

HAB enabled image:

./u-boot/tools/dumpimage -l out/u-boot-dtb.imx
Image Type: Freescale IMX Boot Image
Image Ver: 2 (i.MX53/6/7 compatible)
Mode: DCD
Data Size: 643168 Bytes = 628.09 KiB = 0.61 MiB
Load Address: 177ff420
Entry Point: 17800000
HAB Blocks: 0x177ff400 0x00000000 0x0009ac00
DCD Blocks: 0x00910000 0x0000002c 0x000002f8

no HAB enabled image:

./u-boot/tools/dumpimage -l out/u-boot-dtb.imx
Image Type: Freescale IMX Boot Image
Image Ver: 2 (i.MX53/6/7 compatible)
Mode: DCD
Data Size: 626688 Bytes = 612.00 KiB = 0.60 MiB
Load Address: 177ff420
Entry Point: 17800000

[Xuban11]

Hello,

Yes, you are right. They should include the script to the official documentation.

I have one more question regarding the building of an image with security features. I read in the documentation that I have to enable CONFIG_IMX_HAB=y

I don't know how to do that. My build environment does not contain any _defconfig file.

Thank you very much!

-Xuban

I attach my build environment 

[Harvey021]

Hello Xuban.

You can follow below steps:

Firstly, to add the line "CONFIG_IMX_HAB=y" at the end for the _defconfig of the target for which you want to compile.

Secondly, go back compile it.

1. source setup-environment your_build_directory
2. bitbake u-boot-imx -f -c configure
3. bitbake u-boot-imx -f -c compile

Then you will see HAB block information there as mentioned.

Best regards

Harvey

[Xuban11]

Hello,

Where is the _defconfig file? I can't find it.

Thank you

[Harvey021]

Hello Xuban.

The file would be located at 

L5.10.72_2.2.0_GA/imx-yocto-bsp/build-fb-imx6ull/tmp/work/imx6ull14x14evk-poky-linux-gnueabi/u-boot-imx/2021.04-r0/git/configs/

Best regards

Harvey

[Xuban11]

Hello sir,

I'm doing a new build directory because the old one is broken.

I need to enable CONFIG_IMX_HAB=y

Where do I enable this since the _defconfig files are not even created.

Thank you very much

[Harvey021]

Hello xuban.

as the path below I shared with you at the preceding post.

L5.10.72_2.2.0_GA/imx-yocto-bsp/build-fb-imx6ull/tmp/work/imx6ull14x14evk-poky-linux-gnueabi/u-boot-imx/2021.04-r0/git/configs/

then, you will see many targets which named as like, for example, you are working imx6ull14x14evk.

therefore, the _defconfig will be mx6ull_14x14_evk_defconfig. you will do add the line " CONFIG_IMX_HAB=y" at the last line of the configure file that you are editing.

Best regards

Harvey 

[Harvey021]

Hello Xuban.

Based on the BSP version you are working is 5.10.72, if you want to find HAB block information, the path to find it should be at 

L5.10.72_2.2.0_GA/imx-yocto-bsp/build-fb-imx6ull/tmp/work/imx6ull14x14evk-poky-linux-gnueabi/u-boot-imx/2021.04-r0/build/mx6ull_14x14_evk_optee_config\

and the .log name might be like u-boot.imx.log

Please feel free to reach out us, if you have any further question.

Best regards

Harvey

[Xuban11]

Hello sir, 

I found the log file following the route you sugested, unfortunantly it doesn't contain the HAB blocks line.

Why is this? Where can I find HAB blocks information?

Thank you for your kind response,

-Xuban

I attach my log file (image1) and also how it should be according to the documentation i'm following (https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides/mx6_mx7_secure_boot.t...) 

[RockDeng]

Hi Xuban,

Did you fix that issue in the end? If so, please share you solution. Many thanks!