topic Re: Enable Secure boot imx8mq in i.MX Processors

Enable Secure boot imx8mq

saurav-pandya — Wed, 14 Dec 2022 12:35:21 GMT

Hi,

I am working on imx8mq board. I am trying to enable secure boot.

Please help to secure u-boot , kernel and device tree file.

Thanks,

Saurav

Re: Enable Secure boot imx8mq

Harvey021 — Tue, 20 Dec 2022 02:58:32 GMT

Hi @saurav-pandya

To enable secure boot for u-boot and extend to root of trust for kernel and device tree.

You can follow up the link: (habv4\imx\doc - uboot-imx - i.MX U-Boot (codeaurora.org)) where you will find all documents for enabling secure boot.

Best regards

Harvey

Re: Enable Secure boot imx8mq

saurav-pandya — Tue, 20 Dec 2022 05:06:53 GMT

Hi @Harvey021 ,

I have successfully boot with secure u-boot. Now I am working for secure kernel. I followed below step for secure kernel, still got issue.

$ od -x -j 0x10 -N 0x4 --endian=little Image
0000020 3000 0244
0000024
$ objcopy -I binary -O binary --pad-to 0x2443000 --gap-fill=0x00 Image Image_pad.bin

Create ivt file

./genIVT
cat Image_pad.bin ivt.bin > Image_pad_ivt.bin

Change in csf_additional_images.txt

Blocks = 0x40480000 0x0 0x02443000 "Image_pad_ivt.bin"

Create signed image

./cst --i csf_additional_images.txt --o csf_Image.bin
cat Image_pad_ivt.bin csf_Image.bin > Image_signed.bin

Test with signed image

u-boot=> hab_auth_img 0x40480000 0x2443000 0x428C3000
hab fuse not enabled
Authenticate image from DDR location 0x40480000...
bad magic magic=0x1f length=0xc098 version=0x1
bad length magic=0x1f length=0xc098 version=0x1
bad version magic=0x1f length=0xc098 version=0x1
Error: Invalid IVT structure
Allowed IVT structure:
IVT HDR = 0x4X2000D1
IVT ENTRY = 0xXXXXXXXX
IVT RSV1 = 0x0
IVT DCD = 0x0
IVT BOOT_DATA = 0xXXXXXXXX
IVT SELF = 0xXXXXXXXX
IVT CSF = 0xXXXXXXXX
IVT RSV2 = 0x0

Please help on same.

Thanks,

Saurav

Re: Enable Secure boot imx8mq

Harvey021 — Wed, 21 Dec 2022 05:56:51 GMT

Hi,

[Change in csf_additional_images.txt

Blocks = 0x40480000 0x0 0x02443000 "Image_pad_ivt.bin"]

It seems your ivt not signed.

Best regards

Harvey

Re: Enable Secure boot imx8mq

saurav-pandya — Wed, 21 Dec 2022 06:07:47 GMT

Hi @Harvey021 ,

Problem is resolved.

csf_additional_images.txt

Blocks = 0x40480000 0x00x02443000"Image_pad_ivt.bin"]

in this size value is wrong.

Thanks,

Saurav