HAB

[Abhay2080]

I am working on signing the firmware and preparing it for secure boot.

Suppose the development team provides me with a firmware image that already contains the FCB/FCFB, IVT, Boot Data, and other required boot components. My responsibility is only to sign the image and provide the signed firmware back to the development team.

I am using the CST (Code Signing Tool) to generate the signed firmware. I have created the csf.txt file and used cst.exe to generate csf.bin.

My question is: If I simply append csf.bin to the existing firmware image, will the firmware actually be considered signed?

My understanding is that the IVT contains a pointer to the CSF, so if I simply append csf.bin without updating the IVT to point to the CSF location, the ROM may not know where to find the CSF.

So, what is the correct procedure for signing an existing firmware image that already contains the FCB/FCFB, IVT, Boot Data, and other boot components?

I would like to understand the proper flow for generating the final signed firmware image that can be used for secure boot.

[Kan_Li · Accepted solution]

Hi @Abhay2080 ,

The flow is something like below:

1. Dev team sets csf = 0x60000000 + sizeof(firmware.bin) in the IVT during the build. This is a linker/build-time constant.
2. CST reads firmware.bin (which already has the correct csf pointer), computes the SHA-256 hash over the [Authenticate Data] blocks (which includes the IVT with its pre-set csf value), and produces csf.bin.
3. cat firmware.bin csf.bin places csf.bin at exactly byte offset sizeof(firmware.bin) — which maps to AHB address 0x60020000 — exactly where the IVT's csf field already points.
4. HAB at boot reads csf from IVT → jumps to 0x60020000 → finds the CSF → authenticates.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------