topic Re: iMX6 ull encrypted boot in i.MX Processors

iMX6 ull encrypted boot

CarlosFG — Fri, 05 Feb 2021 09:12:51 GMT

I'm trying to enable encrypted boot in iMX6 ULL EVK. According to IMX6ULLRM and IMX6ULLSRM this should be possible. One of the steps to get encrypted boot work is generate a "dek blob" [1][2] inside the processor. In order to do that, there is a u-boot command named "dek_blob" that uses the CAAM [1][3][4]. I couldn't get his command work, It fails at this point in a function named caam_page_alloc() which is always called with the same parameters: caam_page_alloc(1, 1), this means it fails regardless of how I use the dek_blob command. I also tried to use the CAAM Linux drivers unsuccessfully. Later I found in a couple of sites the CAAM is not available in iMX6ULL [5][6]

So my question is ¿How can I encapsulate a DEK and obtain a dek blob in the iMX6ULL?

Re: iMX6 ull encrypted boot

igorpadykov — Sat, 06 Feb 2021 11:59:55 GMT

Hi CarlosFG

unfortunately i.MX6ULL does not support encrypted boot.

Best regards
igor

Re: iMX6 ull encrypted boot

CarlosFG — Mon, 08 Feb 2021 08:02:21 GMT

Thanks you very much igorpadykov.

The Applications Processor Reference Manual for this device (IMX6ULLRM) says the encrypted boot is supported. I humbly suggest to amend it in order to avoid other engineers waste their time trying to make it work.

Re: iMX6 ull encrypted boot

igorpadykov — Tue, 09 Feb 2021 04:52:38 GMT

Hi CarlosFG

in theory it can be supported, but in practice NXP software implementation currently

supports only CAAM based options.

Best regards
igor

Re: iMX6 ull encrypted boot

mprt — Fri, 03 Mar 2023 15:31:10 GMT

Is there any update on this matter?

You wrote that there is currently only the CAAM based implementation.

I hope there's a way to implement encrypted boot using the various keys. Unfortunately, I don't have access to the SRM.