Hi,
I'm developing on a custom board with imx6ull and we are implementing HAB secure boot. I've managed to successfully sign the u-boot binary, but I have problems with signing the kernel zImage and DTB file.
I've followed instructions in mx6_mx7_secure_boot.txt and "AN4581 - i.MX Secure Boot on HABv4 Supported Devices.pdf" and padded my zImage file to next 0x1000 boundary, appended IVT data and CSF binary.
Unfortunately, when I try to use hab_auth_img to test the signature the board resets
Colibri iMX6ULL # ubifsmount ubi0:rootfsb
Colibri iMX6ULL # ubifsload ${kernel_addr_r} /boot/zImage
Loading file '/boot/zImage' to addr 0x81000000...
Done
Colibri iMX6ULL # hab_auth_img ${kernel_addr_r} ${filesize}
Authenticate image from DDR location 0x81000000...
bad magic magic=0x0 length=0xa000 version=0xe1
bad length magic=0x0 length=0xa000 version=0xe1
bad version magic=0x0 length=0xa000 version=0xe1
Colibri iMX6ULL # md 0x81691000 8
81691000: 402000d1 81000000 00000000 00000000 .. @............
81691010: 00000000 81691000 81691020 00000000 ......i. .i.....
Colibri iMX6ULL # hab_auth_img ${kernel_addr_r} ${filesize} 0x691000
Authenticate image from DDR location 0x81000000...
data abort
pc : [<0000a8a2>] lr : [<0000ab1f>]
reloc pc : [<e78b58a2>] lr : [<e78b5b1f>]
sp : 9df2c2a8 ip : 0000e7ed fp : 00690fe0
r10: 04d3f640 r9 : 9df2c584 r8 : 00000000
r7 : 00000000 r6 : 00904cb4 r5 : 04d3f640 r4 : 00000000
r3 : 5be0cd19 r2 : 00000008 r1 : 00904cb4 r0 : 04d3f640
Flags: nZCv IRQs off FIQs off Mode SVC_32 (T)
Code: 2a08 d1ea 4605 2400 (f810) 7024
Resetting CPU ...
resetting ...
In above example I first tried to use hab_auth_img without specifying IVT offset, but as you see, it didn't work. I checked offset from the binary and checked the memory with
Colibri iMX6ULL # md 0x81691000 8
81691000: 402000d1 81000000 00000000 00000000 .. @............
81691010: 00000000 81691000 81691020 00000000 ......i. .i.....
To me the IVT looks correct, but perhaps I'm missing something, or the location of the IVT is somehow incorrect.
My CSF Text:
[Header]
Version = 4.2
Hash Algorithm = sha256
Engine = SW
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
[Install SRK]
File = "../crts/srk_1_2_3_4_table.bin"
Source index = 0
[Install CSFK]
File = "../crts/CSF1_1_sha256_4096_65537_v3_usr_crt.pem"
[Authenticate CSF]
[Install Key]
Verification index = 0
Target index = 2
File = "../crts/IMG1_1_sha256_4096_65537_v3_usr_crt.pem"
[Authenticate Data]
Verification index = 2
Blocks = 81000000 0x00000000 0x00691020 "/tmp/cst_CODE_SIGN/kernel_image.bin"
