https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1177116#M164434 <P>we use imx6ull in our product, and use nxp's linux-imx-5.4.24.</P><P>1、do you mean sign a dtb the same as sign a zImage, except&nbsp;<SPAN>DTB load_address and size?</SPAN></P><P><SPAN>2、and is the signed dtb&nbsp;layout the same as zImage's?</SPAN></P><DIV><DIV class="content"><TABLE class="blob"><TBODY><TR><TD class="lines"><DIV class="highlight"><PRE>The diagram below illustrate the zImage layout: ------- +-----------------------------+ &lt;-- *load_address ^ | | | | | | | | | | | | | zImage/dtb? Signed | | | Data | | | | | | | +-----------------------------+ | | Padding Next Boundary | | +-----------------------------+ &lt;-- *ivt v | Image Vector Table | ------- +-----------------------------+ &lt;-- *csf | | | Command Sequence File (CSF) | | | +-----------------------------+ | Padding (optional) | +-----------------------------+</PRE></DIV></TD></TR></TBODY></TABLE><P>3、is there any software interface to <SPAN>authenticate&nbsp;zImage in user space(eg. rootfs) before update zImage?</SPAN></P></DIV></DIV> Tue, 03 Nov 2020 09:23:52 GMT changbaoma 2020-11-03T09:23:52Z https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1174162#M164127 <P>now i have sucess to signature single&nbsp;zImage, and sucess to hab_auth_img without any&nbsp;HAB Events found.</P><P>=&gt; hab_auth_img 80800000 585000</P><P>Authenticate image from DDR location 0x80800000...</P><P>Secure boot enabled</P><P>HAB Configuration: 0xcc, HAB State: 0x99<BR />No HAB Events Found!</P><P>&nbsp;</P><P>And now i want to&nbsp;&nbsp;signature dtb too,&nbsp; but i don't know how to do?</P><P>Any help is appresiated.</P> Wed, 28 Oct 2020 02:30:38 GMT https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1174162#M164127 changbaoma 2020-10-28T02:30:38Z https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1176927#M164411 <P><a href="https://community.nxp.com/t5/user/viewprofilepage/user-id/63946">@changbaoma</a>&nbsp;<BR />Hello,<BR /><BR />&nbsp; What i.MX device is used in the case?<BR />What Linux release?<BR /><BR /></P> <P>Regards,<BR />Yuri.</P> Tue, 03 Nov 2020 03:26:57 GMT https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1176927#M164411 Yuri 2020-11-03T03:26:57Z https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1177035#M164426 <P><a href="https://community.nxp.com/t5/user/viewprofilepage/user-id/63946">@changbaoma</a>&nbsp;<BR /><BR /></P> <P>Basically the DTB may be signed in the same manner as kernel.<BR />Please look at section 5.8 (Extending the root of trust) of app note <BR />AN4581 (i.MX Secure Boot on HABv4 Supported Devices, Rev. 4, June 2020).</P> <P><A href="https://www.nxp.com/docs/en/application-note/AN4581.pdf" target="_blank">https://www.nxp.com/docs/en/application-note/AN4581.pdf </A></P> <P>Also section 2 ( Extending the root of trust) will be helpful.</P> <P><A href="https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides/mx6_mx7_secure_boot.txt?h=imx_v2018.03_4.14.98_2.0.0_ga" target="_blank">https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides/mx6_mx7_secure_boot.txt?h=imx_v2018.03_4.14.98_2.0.0_ga </A></P> <P>Use U-boot environment to define what parameters / addresses are used<BR />in Your system for DTB load.</P> <P>&nbsp;</P> <P>Regards,<BR />Yuri.</P> Tue, 03 Nov 2020 06:55:30 GMT https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1177035#M164426 Yuri 2020-11-03T06:55:30Z https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1177116#M164434 <P>we use imx6ull in our product, and use nxp's linux-imx-5.4.24.</P><P>1、do you mean sign a dtb the same as sign a zImage, except&nbsp;<SPAN>DTB load_address and size?</SPAN></P><P><SPAN>2、and is the signed dtb&nbsp;layout the same as zImage's?</SPAN></P><DIV><DIV class="content"><TABLE class="blob"><TBODY><TR><TD class="lines"><DIV class="highlight"><PRE>The diagram below illustrate the zImage layout: ------- +-----------------------------+ &lt;-- *load_address ^ | | | | | | | | | | | | | zImage/dtb? Signed | | | Data | | | | | | | +-----------------------------+ | | Padding Next Boundary | | +-----------------------------+ &lt;-- *ivt v | Image Vector Table | ------- +-----------------------------+ &lt;-- *csf | | | Command Sequence File (CSF) | | | +-----------------------------+ | Padding (optional) | +-----------------------------+</PRE></DIV></TD></TR></TBODY></TABLE><P>3、is there any software interface to <SPAN>authenticate&nbsp;zImage in user space(eg. rootfs) before update zImage?</SPAN></P></DIV></DIV> Tue, 03 Nov 2020 09:23:52 GMT https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1177116#M164434 changbaoma 2020-11-03T09:23:52Z https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1177721#M164496 <P><a href="https://community.nxp.com/t5/user/viewprofilepage/user-id/63946">@changbaoma</a>&nbsp;<BR />Hello,<BR /><BR /></P> <P>&nbsp; 1) yes - in general Your understanding is correct.<BR />&nbsp; 2) U-boot uses HAB ROM API for authentication, but we do not have&nbsp;<BR />&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Linux user space for HAB ROM.</P> <P>Regards,<BR />Yuri.</P> Wed, 04 Nov 2020 06:57:10 GMT https://community.nxp.com/t5/i-MX-Processors/how-to-authenticate-dtb-togeter-with-zImage/m-p/1177721#M164496 Yuri 2020-11-04T06:57:10Z