IVT offset in hab_auth_img - i.MX 8MQ

[kanimozhi_t]

Hi,

    I signed Linux kernel with HAB by following mx8m_secure_boot.txt and trying to authenticate the signing by,

hab_auth_img <Load Address> <Image Size> <IVT Offset>

    This returns "Invalid IVT Structure" Error.

u-boot=> hab_auth_img
hab_auth_img - authenticate image via HAB

Usage:
hab_auth_img addr length ivt_offset
addr - image hex address
length - image hex length
ivt_offset - hex offset of IVT in the image
u-boot=> hab_auth_img 0x40480000 0x1C21020 0x1C21000
hab fuse not enabled

Authenticate image from DDR location 0x40480000...
bad magic magic=0xd5 length=0x4828 version=0x45
bad length magic=0xd5 length=0x4828 version=0x45
Error: Invalid IVT structure

Allowed IVT structure:
IVT HDR = 0x4X2000D1
IVT ENTRY = 0xXXXXXXXX
IVT RSV1 = 0x0
IVT DCD = 0x0
IVT BOOT_DATA = 0xXXXXXXXX
IVT SELF = 0xXXXXXXXX
IVT CSF = 0xXXXXXXXX
IVT RSV2 = 0x0

I want to know,

1. How to calculate IVT Offset?
2. Image size for hab_auth_img includes IVT size (0x20)?

Thanks in advance.

[kanimozhi_t · Accepted solution]

To answer my own questions:

1. How to calculate IVT Offset? - IVT's offset is img_size
2. Image size for hab_auth_img includes IVT size (0x20)? - Yes

Elaborate answer:

The correct way to use hab_auth_img is as follows,

u-boot=> hab_auth_img <loadaddr> <img_size + ivt_size> <img_size>

1. loadaddr

(in uboot console)

u-boot=> printenv loadaddr

2. img_size

(in host pc's terminal)

~ hexdump -e '/4 "%X"' -s 12 -n <path_to_kernel_Image>

3. ivt_size - 0x20 (fixed)

[flobro]

question about solution...

hexdump: invalid number '/media/my-kernel-image'

 So I do :

hexdump -e '/4 "%X"' -s 12 -n my-kernel-image

but hexdump says:
hexdump: invalid number 'my-kernel-image'.

Posted solution has some issues.

THanks

[flobro]

nevermind... The posted solution should read:

hexdump -e '/4 "%X"' -s 12 -n 8 <kernel-image>

Or you can do :

echo 0x$(echo `od -t x4 -j0x10 -N4 <kernel-image> ` | cut -d' ' -f2)

[igorpadykov]

Hi kanimozhi_t

one can look at below links which may help

https://community.nxp.com/t5/i-MX-Processors/hab-auth-img-problem/m-p/1032545

https://boundarydevices.com/high-assurance-boot-hab-i-mx8m-edition/

Best regards
igor