Patch for u-boot-imx: Using FIT and HAB in bootm command

キャンセル
次の結果を表示 
表示  限定  | 次の代わりに検索 
もしかして: 

Patch for u-boot-imx: Using FIT and HAB in bootm command

6,141件の閲覧回数
tmuthmann
Contributor I

Hi,

i want to propose the following patch to bootm.c.

If you want to use FIT Images and HAB together you always get this on bootm:

Not valid image format for Authentication, Please check

This is because there is no case for FIT Images in the switch statement.

I tested the patch below and was able to boot a HAB signed FIT Image without problems.

diff --git "a/cmd/bootm.c" "b/cmd/bootm.c"
index 03ea3b8998..47122e50cc 100644
--- "a/cmd/bootm.c"
+++ "b/cmd/bootm.c"
@@ -176,6 +176,15 @@ int do_bootm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 	case IMAGE_FORMAT_ANDROID:
 		/* Do this authentication in boota command */
 		break;
+#endif
+#ifdef CONFIG_FIT
+	case IMAGE_FORMAT_FIT:
+		if (authenticate_image(image_load_addr,
+			image_get_image_size((image_header_t *)image_load_addr)) != 0) {
+			printf("Authenticate FIT image Fail, Please check\n");
+			return 1;
+		}
+		break;
 #endif
 	default:
 		printf("Not valid image format for Authentication, Please check\n"); 

Thanks,

Thomas

ラベル(1)
11 返答(返信)

116件の閲覧回数
mprt42
Contributor I

Is this in the meantime already implemented somewhere by NXP?
Thanks.

0 件の賞賛

3,377件の閲覧回数
chen-wust
Contributor II

I'd like to ask you a question. Do we need special processing when adding digital signatures to fitimage, or is it the same as the official guidance (zimage/image)? Do we need to do something special with the.its file that generates fitimage?

0 件の賞賛

3,353件の閲覧回数
jclsn
Contributor IV
No, you can sign any file with HAB actually

You don’t need to do something to the .its file. You just create the blob FIT blob and sign it
0 件の賞賛

4,346件の閲覧回数
sascha1
Contributor I

Is there any way to get this patch upstream? I'm absolutely willing to send patches around on some mailing list or gitlabs if someone tells me how to contribute.

Cheers,
Sascha

0 件の賞賛

4,312件の閲覧回数
jclsn
Contributor IV

Probably yes. Maybe we should notify some NXP employee.

Like:

@BiyongSUN 

@Yuri 

Or you create a ticket yourself

0 件の賞賛

5,090件の閲覧回数
jclsn
Contributor IV

The patch actually requires to read the image size with the function fit_get_size() from the image header, because the image headers of FIT images differ. For me the first patch only worked by chance and I could fix it by exchanging the function.

Here is the diff:

 

diff --git a/cmd/bootm.c b/cmd/bootm.c
index bed84bd735..6fcd17eaf5 100644
--- a/cmd/bootm.c
+++ b/cmd/bootm.c
@@ -175,7 +175,7 @@ int do_bootm(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 #ifdef CONFIG_FIT
        case IMAGE_FORMAT_FIT:
                if (authenticate_image(load_addr,
-                       image_get_image_size((image_header_t *)load_addr)) != 0) {
+                       fit_get_size((void *)load_addr)) != 0) {
                        printf("Authenticate FIT image Fail, Please check\n");
                        return 1;
                }

 

5,809件の閲覧回数
tmuthmann
Contributor I

Thx everyone for the replies and kudos.

Meanwhile i'm using U-Boot Mainline, so you will get no more updates from me.

To be sure to use the correct address and size my code is like that now:

uint32_t fileaddr = env_get_hex("fileaddr", 0);
uint32_t filesize = env_get_hex("filesize", 0);
uint32_t ivt_offset = filesize - CONFIG_CSF_SIZE;

imx_hab_authenticate_image(fileaddr, filesize, ivt_offset);

fileaddr and filesize is set on all load operations as far I can see.

5,815件の閲覧回数
jonnye
Contributor II

Hi @tmuthmann 

Your solution helped me a lot. After using your patch I was able to boot HAB signed fitImage.

But when I rebuild my images and disabled Mender it was not working for me. After some investigation I think that

the image_get_image_size is picking bytes 12..15 as size of the image which is a little less than the image size in bytes 4..7 which seems to be more correct. In some cases this made authenticate_image() not be able to find the IVT structure and verification failed.

So, it did not depend on Mender but the size of the fitImage, so maybe you can get into the same problem when rebuilding your images.

Regards,

Jonny

0 件の賞賛

5,843件の閲覧回数
kunyichen
Contributor IV

I try on imx8mp with BSP Linux 5.10.9_1.0.0​, still need this patch for booting  FIT image with HAB feature

0 件の賞賛

5,972件の閲覧回数
paul_geurts
Contributor III

Is this already implemented somewhere by NXP? We are running into the same problem with v2020.04_5.4.24_2.1.0. I think it's rather strange NXP does not see this as a valid usecase. 

Anyway, Thanks for the patch

6,033件の閲覧回数
vinothkumars
Senior Contributor IV
0 件の賞賛