topic Re: i.mx8 ahab encryption in i.MX Processors

i.mx8 ahab encryption

BrainKub — Tue, 19 Oct 2021 18:36:47 GMT

Hello! I'm trying to encrypt the uboot image using AHAB. I built an imx cst with encryption support and when trying to encrypt the image, it gives an error: Invalid argument: ImageIndexes. Tell me how to solve this problem, where to get the value of image indexes? I tried to set 0 and the default value was 0xFFFFFFFE

Re: i.mx8 ahab encryption

Yuri — Wed, 20 Oct 2021 08:57:34 GMT

@BrainKub
Hello,

please provide the sequence to reproduce the issue.

Also:

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides/encrypted_boot.txt?h=imx_v2020.04_5.4.70_2.3.0

Regards,
Yuri.

Re: i.mx8 ahab encryption

BrainKub — Wed, 20 Oct 2021 14:03:22 GMT

I did it according to the instruction

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/ahab/guides/mx8_mx8x_encrypted_boot.txt?h=imx_v2020.04_5.4.70_2.3.0
Built u boot with parameters:
CONFIG_AHAB_BOOT=y
CONFIG_CMD_DEKBLOB=y
CONFIG_IMG_SECO_DEK_ENCAP=y
CONFIG_FAT_WRITE=y
took csf from the example and tried to encrypt the image. But I didn't really understand where to get the value of the image indexes parameter. Perhaps I have it incorrectly defined..

Re: i.mx8 ahab encryption

BrainKub — Fri, 29 Oct 2021 12:43:19 GMT

I built flash.bin with parameters:
CONFIG_AHAB_BOOT=y
CONFIG_CMD_DEKBLOB=y
CONFIG_IMG_SECO_DEK_ENCAP=y
CONFIG_FAT_WRITE=y
Built an imx code signing tool with encryption support:
$ sudo apt-get install libssl-dev openssl
$ cd <CST install directory>/code/back_end/src
$ $ gcc -o css_encrypted -I ../dr -L ../../../linux 64/lib *.cl frontend -lcrypto
$ $ cp css_encrypted ../../../linux 64/bit/

Generated a PKI and tried to encrypt the image:
././release/linux 64/bit/css_encrypted -i csf_enc_boot_image.txt -open_flash.bin
Invalid argument: ImageIndexes

Then I tried to just remove this parameter, then cst gave this:

Invalid command: InstallSecretKey is illegal for given target

Can you tell me, please, where you can read more about the css file parameters and preferably encryption on imx8 in general?

Re: i.mx8 ahab encryption

Yuri — Tue, 28 Dec 2021 05:44:39 GMT

@BrainKub
Hello,

Code-Signing Tool User’s Guide describes the image indexes parameter.

Image Indexes - List of images that will be encrypted. Mask of bits (by default, all images are
encrypted)

Image Indexes = 0xFFFFFFFE /* Image index 0 not encrypted */

Regards,
Yuri.