2415597_en-US

[#1]

Enable Secure Boot in Falcon Mode (6.12.49 - Kernel Version) || iMX8MP_EVK

Hi Team,

Could you please help me enable Secure Boot in Falcon Mode?

I have successfully achieved Falcon Mode with the help of the meta-imx-fastboot GitHub repository. However, I observed that the meta-imx-fastboot implementation intentionally removes OP-TEE during the Falcon Mode boot flow.

Since OP-TEE is also required for my use case, I raised a query on the NXP forum, where @elena_popa provided a solution to retain and enable OP-TEE. I have attached the forum link for reference.

Currently, I am facing an issue with enabling Secure Boot, as I could not find any document for Secure Boot with falcon mode for my current kernel version.
Environment details:

• Board: i.MX8M Plus EVK (i.MX8MP EVK)
• Kernel Version: 6.12.49
• Yocto Environment: Yocto-based NXP BSP
• Boot Mode: Falcon Mode
• Requirement: Falcon Mode + OP-TEE + Secure Boot

Yocto ProjectRe: Enable Secure Boot in Falcon Mode (6.12.49 - Kernel Version) || iMX8MP_EVK

Hello,

Could you please share which error are you getting?

Best regards.

Re: Enable Secure Boot in Falcon Mode (6.12.49 - Kernel Version) || iMX8MP_EVK

Hi @JorgeCas
What I did: Extended the imx-boot-signature recipe to also sign our Falcon FIT bundles (kernel-atf-dtb.itb, u-boot-atf.itb) using imx_signer + the same sign.cfg used for the main imx-boot container.

Issue: With HAB open (no fuses burned), hab_status shows:

u-boot=> hab_status

Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x40 0x1f 0xdd 0xc0
0x00 0x00 0x00 0x20

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 2 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x40 0x1f 0xad 0xc0
0x00 0x00 0x00 0x04

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 3 -----------------
event data:
0xdb 0x00 0x3c 0x45 0x33 0x18 0xc0 0x00
0xca 0x00 0x34 0x00 0x02 0xc5 0x00 0x00
0x00 0x00 0x0b 0x50 0x40 0x1f 0xad 0xc0
0x00 0x00 0x30 0x20 0x40 0x20 0x00 0x00
0x00 0x12 0x12 0xb8 0x40 0x32 0x12 0xb8
0x00 0x01 0x44 0x68 0x00 0x97 0x00 0x00
0x00 0x00 0xbd 0x00 0x56 0x00 0x00 0x00
0x00 0x09 0x57 0x50

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 4 -----------------
event data:
0xdb 0x00 0x3c 0x45 0x33 0x18 0xc0 0x00
0xca 0x00 0x34 0x00 0x02 0xc5 0x00 0x00
0x00 0x00 0x0b 0x50 0x40 0x1f 0xad 0xc0
0x00 0x00 0x30 0x20 0x40 0x20 0x00 0x00
0x00 0x12 0x12 0xb8 0x40 0x32 0x12 0xb8
0x00 0x01 0x44 0x68 0x00 0x97 0x00 0x00
0x00 0x00 0xbd 0x00 0x56 0x00 0x00 0x00
0x00 0x09 0x57 0x50

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

The failing block addresses/sizes match exactly u-boot-atf.itb's loadables (U-Boot, ATF, OP-TEE). This is deterministic across clean rebuilds. Meanwhile the signed imx-boot SPL+ATF+U-Boot container (signed via the same recipe/tool) authenticates fine.

Question: Does signing a Falcon-mode u-boot-atf.itb (multi-loadable FIT: U-Boot + ATF + OP-TEE) need a different CSF structure than what imx_signer's default csf_hab4.cfg produces for the standard imx-boot SD container? Is there a reference for signing Falcon u-boot-atf.itb/kernel-atf-dtb.itb specifically?

Re: Enable Secure Boot in Falcon Mode (6.12.49 - Kernel Version) || iMX8MP_EVK

Hello,

I apologize for the delay.

As mentioned in repository, the secure Boot support is enabled in lf-6.6.36-2.1.0-secure branch and can be used as reference but, unfortunately, unfortunately, lf-6.12.20-2.0.0-secure Falcon branch explicitly states that Secure Boot is not supported for that BSP and newer.

There is no documentation available for porting the secure Falcon implementation from the 6.6 secure branch. The authentication of the imx-boot container suggests a mismatched FIT CSF block map or CSF insertion offset.

Best regards.

Re: Enable Secure Boot in Falcon Mode (6.12.49 - Kernel Version) || iMX8MP_EVKPlease help here..!