topic U-boot custom command in Yocto to invoke HSE API in S32G

U-boot custom command in Yocto to invoke HSE API

Jayashree — Wed, 27 Nov 2024 05:26:42 GMT

Hello,

I am currently working on implementing secure boot using HSE APIs to perform kernel image verification before loading. At present, U-Boot loads the kernel image without leveraging any cryptographic algorithms, relying solely on a U-Boot environment script.

I am considering including a custom U-Boot command within the environment script to invoke the HSE APIs (SMR and CR) for kernel verification. However, I am unsure about where and how to implement this in my yocto package or whether this approach is appropriate. If this method is not recommended, I would appreciate any suggestions for a better alternative.

Thank you.

Re: U-boot custom command in Yocto to invoke HSE API

chenyin_h — Wed, 27 Nov 2024 11:02:01 GMT

Hello, @Jayashree

Thanks for your post.

May I know which version BSP you are working with?

From BSP42.0 UM, Kernel image authentication is provided by U-Boot, using the upstream verified boot method, it is described in chapter 10.6, may I know if the method described could help on your case?

Chenyin

Re: U-boot custom command in Yocto to invoke HSE API

AshutoshNama — Wed, 27 Nov 2024 11:17:51 GMT

Great initiative!
Implementing HSE APIs via a custom U-Boot command is viable. Consider integrating it in cmd/ and patching via a Yocto bbappend. Alternatively, embed verification in U-Boot's boot sequence for tighter security.
Ensure mandatory checks and thorough testing.
Happy to discuss further if you hit roadblocks!

BR,
Ashutosh Nama

Re: U-boot custom command in Yocto to invoke HSE API

AshutoshNama — Wed, 27 Nov 2024 11:19:19 GMT

@Jayashree, Great initiative!

Implementing HSE APIs via a custom U-Boot command is viable.
Consider integrating it in cmd/ and patching via a Yocto bbappend. Alternatively, embed verification in U-Boot's boot sequence for tighter security.
Ensure mandatory checks and thorough testing. Happy to discuss further if you hit roadblocks!

BR,
Ashutosh Nama.