topic Re: i.MX28 HAB Secure Boot Chain in i.MX Processors

i.MX28 HAB Secure Boot Chain

garylijs — Thu, 14 May 2015 04:12:54 GMT

Hi,

I was successfully able to use the HAB and the Code Signing Tool to sign and to validate the signature of Eboot on i.MX28.

The application note AN4555 indicates that "The same library functions can be called from later boot stages to extend the boot chain past the stage immediately after the Boot ROM", using the HAB API.

I am interested in extending the secure boot to the OS and Application.

Are there any additional documentation from Freescale on the details of the HAB API and on how to extend the secure boot chain for i.MX28?

Thanks for your time and assistance.

Best Regards,

Gary

Re: i.MX28 HAB Secure Boot Chain

Yuri — Thu, 14 May 2015 04:42:04 GMT

I am afraid we do not have additional information about i.MX28 WinCE signing.

You may refer to general information in "HAB4_API.pdf" and "HABCST_UG.pdf"

in the CST tools.

Also, "i.MX_6_Linux_High_Assurance_Boot_(HAB)_User's_Guide.pdf" from Linux
documentation may be helpful.

Have a great day,
Yuri

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: i.MX28 HAB Secure Boot Chain

garylijs — Thu, 14 May 2015 07:03:44 GMT

Hi Yuri,

Thanks for your answer,I try to think of other way.

Regards,

Gary

Re: i.MX28 HAB Secure Boot Chain

garylijs — Fri, 15 May 2015 06:18:52 GMT

Hi Yuri,

I have referred "i.MX_6_Linux_High_Assurance_Boot_(HAB)_User's_Guide.pdf" and uboot code of i.MX6, I have found follow code in uboot:

#ifdef CONFIG_SECURE_BOOT

/* -------- start of HAB API updates ------------*/

#define hab_rvt_report_event ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT)

#define hab_rvt_report_status ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS)

#define hab_rvt_authenticate_image \

((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE)

#define hab_rvt_entry ((hab_rvt_entry_t *) HAB_RVT_ENTRY)

#define hab_rvt_exit ((hab_rvt_exit_t *) HAB_RVT_EXIT)

#define hab_rvt_clock_init HAB_RVT_CLOCK_INIT

#define OCOTP_CFG5_OFFSET 0x460

#define IVT_SIZE 0x20

#define ALIGN_SIZE 0x1000

#define CSF_PAD_SIZE 0x2000

* +------------+ 0x0 (DDR_UIMAGE_START) -

* | Header | |

* +------------+ 0x40 |

* | | |

* | Image Data | |

* . | |

* . | > Stuff to be authenticated ----+

* . | | |

* | | | |

* +------------+ | |

* | | | |

* | Fill Data | | |

* | | | |

* +------------+ Align to ALIGN_SIZE | |

* | IVT | | |

* +------------+ + IVT_SIZE - |

* | | |

* | CSF DATA | <---------------------------------------------------------+

* | |

* +------------+

* | |

* | Fill Data |

* | |

* +------------+ + CSF_PAD_SIZE

........

I know above definition are about the HAB API. In uboot, we could call these functions to validate the signed kernel.

BUT I don't know these mechanism whether are applied to i.MX28.

Thanks,

Gary

Re: i.MX28 HAB Secure Boot Chain

Yuri — Fri, 15 May 2015 07:49:15 GMT

Hello,

Please take a look at section 12.7.1 (ROM Vector Table Addresses).

Sorry, but the information you are requesting is treated as confidential info at this time and requires a signed NDA (Non-Disclosure Agreement). Naturally, we cannot discuss this with you in public anyway, this requires to be handled as a Service Request (SR). Be aware that to give you remote support through a SR, we will still need the confirmation of a Freescale employee that the NDA is in place. If you want to go this route, the next steps will be: If you have already signed a NDA agreement for this product, please contact the person who assisted you or create a SR and name us a Freescale person that can confirm this. If you have not signed an agreement, please contact your local Freescale Distributor Salesperson or FAE for assistance. For a listing of our distributors, refer to: http://www.freescale.com/webapp/sps/site/overview.jsp?code=DISTRIBUTORS

Have a great day,
(my name)

-------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-------------------------------------------------------------------------------

Re: i.MX28 HAB Secure Boot Chain

garylijs — Fri, 15 May 2015 08:07:37 GMT

Hi Yuri,

Thank you very much, I will contact the FAE.

Regards,

Gary

Re: i.MX28 HAB Secure Boot Chain

collinshi — Wed, 27 Jul 2016 13:10:07 GMT

Hi Gary,

From your description:

"I was successfully able to use the HAB and the Code Signing Tool to sign and to validate the signature of Eboot on i.MX28."

I have to sign the eboot on imx28 now.

Could you share your steps to add IVT and HAB data into Eboot?

I have on idea on this.

Thanks