Usage of SHA384 signature for FIT image instead of SHA256

Usage of SHA384 signature for FIT image instead of SHA256

[Gangadhar N]

[-- Attachment #1: Type: text/plain, Size: 2079 bytes --]

Hi All,
I am facing an issue while using SHA384 signature for FIT image instead of
SHA256. I get build errors.

ERROR: linux-obmc-5.8.17+gitAUTOINC+c26e1233f9-r0 do_assemble_fitimage:
Execution of
'/home/gangadhar/openbmc/build/tmp/work/linux-gnueabi/linux-obmc/5.8.17+gitAUTOINC+c26e1233f9-r0/temp/run.do_assemble_fitimage.17762'
failed with exit code 255:
none
fit-image.its:8.26-20.19: Warning (unit_address_vs_reg): /images/kernel@1:
node has a unit name, but no reg property
fit-image.its:17.32-19.27: Warning (unit_address_vs_reg): /images/kernel@1
/hash@1: node has a unit name, but no reg property
fit-image.its:21.29-31.19: Warning (unit_address_vs_reg): /images/fdt@...:
node has a unit name, but no reg property
fit-image.its:28.32-30.27: Warning (unit_address_vs_reg): /images/fdt@
.../hash@1: node has a unit name, but no reg property
fit-image.its:36.30-50.19: Warning (unit_address_vs_reg):
/configurations/conf@...: node has a unit name, but no reg property
fit-image.its:42.32-44.27: Warning (unit_address_vs_reg):
/configurations/conf@.../hash@1: node has a unit name, but no reg property
fit-image.its:45.37-49.27: Warning (unit_address_vs_reg):
/configurations/conf@.../signature@1: node has a unit name, but no reg
property
uboot-mkimage Can't add hashes to FIT blob: -93
Unsupported hash algorithm (sha384) for 'hash@1' hash node in 'kernel@1'
image node
WARNING: exit code 255 from a shell command.

Yocto changes that I have done,

diff --git a/poky/meta/classes/kernel-fitimage.bbclass
b/poky/meta/classes/kernel-fitimage.bbclass
index bb2f3c4cc..d4f9dddf2 100644
--- a/poky/meta/classes/kernel-fitimage.bbclass
+++ b/poky/meta/classes/kernel-fitimage.bbclass
@@ -51,13 +51,13 @@ python __anonymous () {
 UBOOT_MKIMAGE_DTCOPTS ??= ""

 # fitImage Hash Algo
-FIT_HASH_ALG ?= "sha256"
+FIT_HASH_ALG ?= "sha384"

 # fitImage Signature Algo
 FIT_SIGN_ALG ?= "rsa2048"

 # Generate keys for signing fitImage
-FIT_GENERATE_KEYS ?= "0"
+FIT_GENERATE_KEYS ?= "1"

 # Size of private key in number of bits
 FIT_SIGN_NUMBITS ?= "2048"

Thanks & Regards,
Gangadhar

[-- Attachment #2: Type: text/html, Size: 4021 bytes --]

Re: Usage of SHA384 signature for FIT image instead of SHA256

[Patrick Williams]

[-- Attachment #1: Type: text/plain, Size: 560 bytes --]

On Mon, May 30, 2022 at 02:56:10PM +0530, Gangadhar N wrote:
> Hi All,
> I am facing an issue while using SHA384 signature for FIT image instead of
> SHA256. I get build errors.
...

> uboot-mkimage Can't add hashes to FIT blob: -93
> Unsupported hash algorithm (sha384) for 'hash@1' hash node in 'kernel@1'
> image node

This is reporting that the mkimage tool generated by u-boot doesn't
support SHA384.  Which u-boot are you attempting to use?  It appears
that v2016.07 doesn't support sha384 but v2019.04 likely does.

-- 
Patrick Williams

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: Usage of SHA384 signature for FIT image instead of SHA256

[Gangadhar N]

[-- Attachment #1: Type: text/plain, Size: 720 bytes --]

Hi Patrick,
I am using 2020.10 uboot

Thanks & Regards,
Gangadhar

On Tue, May 31, 2022 at 7:14 PM Patrick Williams <patrick@stwcx.xyz> wrote:

> On Mon, May 30, 2022 at 02:56:10PM +0530, Gangadhar N wrote:
> > Hi All,
> > I am facing an issue while using SHA384 signature for FIT image instead
> of
> > SHA256. I get build errors.
> ...
>
> > uboot-mkimage Can't add hashes to FIT blob: -93
> > Unsupported hash algorithm (sha384) for 'hash@1' hash node in 'kernel@1'
> > image node
>
> This is reporting that the mkimage tool generated by u-boot doesn't
> support SHA384.  Which u-boot are you attempting to use?  It appears
> that v2016.07 doesn't support sha384 but v2019.04 likely does.
>
> --
> Patrick Williams
>

[-- Attachment #2: Type: text/html, Size: 1163 bytes --]

Re: Usage of SHA384 signature for FIT image instead of SHA256

[Patrick Williams]

[-- Attachment #1: Type: text/plain, Size: 449 bytes --]

On Wed, Jun 01, 2022 at 01:21:59PM +0530, Gangadhar N wrote:
> ERROR: linux-obmc-5.8.17+gitAUTOINC+c26e1233f9-r0
> do_assemble_fitimage:

...

> I am using 2020.10 uboot

I don't really understand what you're trying to accomplish.  Neither
linux-5.8 nor u-boot 2020.10 are something we've supported in OpenBMC
for any hardware I am aware of.  What are you trying to build?  Which
code are you using as the base?

-- 
Patrick Williams

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]