MA-24310 Fix bug: imx_signer failed to sign Android bootloader on i.MX 8m - #8
MA-24310 Fix bug: imx_signer failed to sign Android bootloader on i.MX 8m#8github-sunxc wants to merge 1 commit into
Conversation
|
Please provide more deatils on the issue and resolution provided. |
…X 8m Android with i.MX 8m platform used HABv4 to verify the signed bootloader. To make sure all of components in bootloader image be signed, we enabled a optional function on Android bootloader: Add optional FIT FDT signature (CVE-2023-39902). But this tool failed to sign Android bootloader because incorrect CSF generated. To fix this issue, the optional IVT should use a local image table to generate the CSF file. Signed-off-by: Maximus <maximus.sun@nxp.com>
748f0c1 to
53fe6a6
Compare
|
Hi @github-sunxc , please provide an unsigned image that can be tested to reprodduce this issue. |
|
Hi, there are two files in attachment, the "bootloader-imx8mp-trusty-dual.img" is bootloader with "fit fdt" enablement, you can try to sign this file, then the sign flow will pass but "container_2.csf" has wrong format. |
|
@github-sunxc I looked into the files and it seems the .img file is the FIT image. The yocto enablement currently supports only BSP images which contain either IVT or Container header. Signing just a FIT image is not supported. Do you see the same issue when you singed the combined flash.bin image? (SPL + FIT) |
|
The .img file is not a pure FIT image, 2 IVT insided. Here is struct graph: Also, I have another question, 95 bootloader failed to sign on Android and BSP images, will you support it in the future? |
|
Hi @github-sunxc , the tool currently only support images that i.MX can boot out of BootROM. IVT and Container are the only supported formats which is what this tool supports. |
|
Yes, you can check this patch: LFU-573-2 imx8m: Reserve new IVT+CSF for FIT FDT signature. Which in "imx-mkimage" repo, you can get this repo by following command: Infact, there are 3 ivt in BSP bootloader images, but BSP secure boot not check the third ivt, so BSP secure boot can pass even through the third csf is wrong. If we can get a correct format of third csf, the Android auto sign can pass too. |
|
Thats unlikely as we have specifically covered this issue. Please check: https://github.com/nxp-imx-support/nxp-cst-signer/blob/master/src/imx_signer.c#L1610 |
2 participants
Android with i.MX 8m platform used HABv4 to verify the signed bootloader. To make sure all of components in bootloader image be signed, we enabled a optional function on Android bootloader: Add optional FIT FDT signature (CVE-2023-39902).
But this tool failed to sign Android bootloader because incorrect CSF generated. To fix this issue, the optional IVT should use a local image table to generate the CSF file.