topic Re: Signing firmware part by part in i.MX Processors

Signing firmware part by part

prashanweerasin — Thu, 27 Apr 2017 05:34:37 GMT

Hi All,

I am currently working on performing secure boot on imx6ul using habv4. In my system the firmware is separated in to two parts other than boot loader. One is with kernel+rootfs (Part A) and the other part contains some critical application services (Part B) provided by another party (it’s mounted as a separate partition to the OS). The idea is to bug fix or change one part and flash it to the system without touching or bothering about the other.

I followed the steps provided by nxp and successfully signed and verified the boot loader and the complete firmware part (Part A + Part B) without any HAB events.

But when signing kernel + rootfs + critical app part (Part A + Part B), since the all signatures information are given in a single csf file which is embedded in the final image, I will not be able to write the Part A (kernel+rootfs) or Part B (critical app part ) separately after changing one part. How can I sign two parts separately so I can update only the relevant part and respective signature?

Thank you,

Pra

Re: Signing firmware part by part

Yuri — Thu, 27 Apr 2017 06:29:16 GMT

Hello,

U-boot can authenticate other additional parts of system, using

authenticate_image function for it in the same manner as for uImage.

Have a great day,

Yuri

------------------------------------------------------------------------------

Note: If this post answers your question, please click the Correct Answer

button. Thank you!

Re: Signing firmware part by part

prashanweerasin — Thu, 27 Apr 2017 07:02:26 GMT

Hi Yuri,

Thank you very much for replying me.

If I understood correctly you are suggesting to invoke authenticate_image function using u-boot script. Is there any other way to automate this ?

Best regards,

Pra.

Re: Signing firmware part by part

Yuri — Thu, 27 Apr 2017 07:16:00 GMT

Hi, Pra !

I am afraid we do not have examples (automation technique) for

using several signing parts with U-boot.

You should call additional authenticate_image function from U-boot.

Regards,

Yuri.