topic IMX8MP NAND SECURE BOOT in i.MX Processors

IMX8MP NAND SECURE BOOT

AlfTeleco — Tue, 23 Nov 2021 08:44:21 GMT

Hello everyone,

I am trying to achieve secure boot, booting from a NAND memory. I'd been able to do it from an SD, so usual steps as signing, creating the PKI and CSF files are well formed and are familiar to me.

As far as I could see, there is a problem conforming the final binary with the addresses according to this thread:

https://lists.denx.de/pipermail/u-boot/2019-December/394629.html

The only existing solution to finally perform a secure boot from NAND is to disable CONFIG_IMX_HAB, and by doing so we loose the ability to check HAB events and the power of the HAB commands.

Is there any news in this topic? Any uboot patch that I have not been able to find?

Thank in advance

Re: IMX8MP NAND SECURE BOOT

igorpadykov — Wed, 24 Nov 2021 09:45:55 GMT

Hi Alvaro

nand secure boot is supported, there are no additional patches for that.

However there is below implication for latest kernels

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5094b7f135be

Best regards
igor

Re: IMX8MP NAND SECURE BOOT

AlfTeleco — Wed, 24 Nov 2021 10:32:15 GMT

Okay, thank you Igor.

I have achieved NAND secure boot indeed, BUT without the uboot commands available to manage the HAB, this is, disabling the CONFIG_IMX_HAB. Is there any path that let me use the CONFIG_IMX_HAB define while implementing the secure boot from a NAND.

Thanks in advance!

Re: IMX8MP NAND SECURE BOOT

igorpadykov — Wed, 24 Nov 2021 12:24:59 GMT

what uboot used in the case, one can try nxp from https://source.codeaurora.org/external/imx/uboot-imx repository

https://source.codeaurora.org/external/imx/uboot-imx/tree/?h=lf_v2021.04

follow documentation :

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides/mx8m_secure_boot.txt?h=lf_v2021.04

Best regards
igor