topic iMX8M mini Secure Boot in i.MX Processors

iMX8M mini Secure Boot

flouveau — Thu, 21 Nov 2019 13:30:02 GMT

Hi all,

I try to understand how secure boot is working for imx8mmevk board.

I read following documentation :

My issue is about creating flash.bin with the output provided by yocto.

All documentation talks about doing all steps manually, but yocto provides these files. I assume it canbe used to generate flash.bin.

Yocto creates the following directory tmp/deploy/images/imx8mmevk/imx-boot-tools

In this directory, I have following files:

bl31-imx8mm.bin
bl31-imx8mm.bin-optee
fsl-imx8mm-evk.dtb
lpddr4_pmu_train_1d_dmem.bin
lpddr4_pmu_train_1d_imem.bin
lpddr4_pmu_train_2d_dmem.bin
lpddr4_pmu_train_2d_imem.bin
mkimage_fit_atf.sh
mkimage_imx8
mkimage_uboot
signed_dp_imx8m.bin
signed_hdmi_imx8m.bin
soc.mak
tee.bin
u-boot-imx8mmevk.bin-sd
u-boot-nodtb.bin-imx8mmevk-sd
u-boot-spl.bin-imx8mmevk-sd

My question : How to create the flash.bin file to be able to flash the EVK board ?

Regards,

Fabrice

Re: iMX8M mini Secure Boot

Bio_TICFSL — Tue, 26 Nov 2019 15:21:45 GMT

Hello Fabrice,

You can find the yocto L4.14.92 documentation on

i.MX Software | NXP

Regards

Re: iMX8M mini Secure Boot

flouveau — Wed, 15 Jan 2020 08:32:23 GMT

I answer myself,

In Yocto BSP from NXP, tht too mkimage is already built and the recipe imx-boot generates the unsigned flash.bin as a file named imx-boot-<hardware>-sd.bin-flash_evk

This file contains SPL and U-BOOT.

To create a signed image, I follow steps described in mx8m_mx8mm_secure_boot.txt\guides\habv4\imx\doc -...
All Signature part is well explained in Code Signing Tool User Guide.

I was able to create a signed file but no tested yet.
Hope this help.

Re: iMX8M mini Secure Boot

kanimozhi_t — Tue, 11 Aug 2020 12:03:36 GMT

Hey @Fabrice,

It's great to hear that you've successfully signed i.MX 8M Mini's flash.bin and I'm also trying to achieve the same.

But, I'm facing issues now and posted it in here (https://community.nxp.com/thread/539440 ). Hope you can provide some help.

Thanks in advance.

Re: iMX8M mini Secure Boot

flouveau — Tue, 11 Aug 2020 13:30:18 GMT

Hi Kanimozhi Thangappan,

I look at your csf_spl.txt, and it's similar to mine.

The only thing that differs is that you use absolute path where I use local path as explained in tutorial. I copy flash.bin into cst folder, at the exact place where txt file is (cst-3.3.0/release/linux64).

[Header]
    Version = 4.3
    Hash Algorithm = sha256
    Engine = CAAM
    Engine Configuration = 0
    Certificate Format = X509
    Signature Format = CMS

[Install SRK]
    # Index of the key location in the SRK table to be installed
    File = "../crts/SRK_1_2_3_4_table.bin"
    Source index = 0

[Install CSFK]
    # Key used to authenticate the CSF data
    File = "../crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"

[Authenticate CSF]

[Unlock]
    # Leave Job Ring and DECO master ID registers Unlocked
    Engine = CAAM
    Features = MID

[Install Key]
    # Key slot index used to authenticate the key to be installed
    Verification index = 0
    # Target key slot in HAB key store where key will be installed
    Target index = 2
    # Key to install
    File = "../crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"

[Authenticate Data]
    # Key slot index used to authenticate the image data
    Verification index = 2
    # Authenticate Start Address, Offset, Length and file
    Blocks = 0x7e0fc0 0x0 0x2a600 "flash.bin"

Sorry to not helping you much than this.

Fabrice

Re: iMX8M mini Secure Boot

kanimozhi_t — Wed, 12 Aug 2020 10:28:01 GMT

Thanks for your inputs.

I've solved my problem. If you're curious, here's the answer: https://community.nxp.com/thread/539440#comment-1352925