i.MX 93 Pro Center: How to Install a Sequencer - Practical (Japanese Blog) Previously, we have explained the i.MX 93 in the following example of aセキュアブートの仕組みについて解説を行いました。 (Please refer to the following for previous notes).
Journalism: i.MX 93 Prospectus: Signatures and Certifications for SequiaBoot (Japanese Logo)
This time, the Secure boot is actually installed in a hanzion form.
table of contents
i.MX 93 Secure Boot Hands-on
1. Hands-on environment
2. Host PC Center (Linux)
3. Download Code Signing Tool
4. SRK generation
5. git center
6. i.MX Linux BSP downloads
7. meta-imx-frdm downloads
8. meta-nxp-security-reference-design downloads
9. Center for Virtual Environment (CVE)
10. IMAGE VIDEO
11. occasions when the bitbake is reopened while in transit
12. Occasions for signing the signature
13. ramdisk signature
14. Host PCs and guesthouse connections
15. UUU Institutes (Linux)
16. UUU Institutes (Windows)
17. シリアルコンソール (Linux)
18. シリアルコンソール (Windows)
19. Linux Startup Tasks (1)
19.1. Serial DownloadでLinux Startup
19.2. SDまたはeMMCでLinux startup
20. Written on SRK hash.
21. Linux Startup Tasks (2)
22. Moving on OEM Closed
23. Linux Startup Tasks (3)
24. References
i.MX 93 Secure Boot Hands-on¶
The i.MX 93 Pro Center introduces the manual for installing the Advanced High Assurance Boot (AHAB) using the セキュアブート.
1. Hands-on environment¶
Host PC.
YoctoBuilder is available for Linux PCs and Windows PCs in a virtual environment (WSL2, VMware, VirtualBox, etc.).
The OS is Ubuntu 22.04.
A connection to the network is necessary.
The capacity of the disk is 100GB. (In the case of FRDM-IMX93 with core-image-minimal)
UUU, コンソールによる作はLinux PCもしくはWindows PCでも可能です。
UUU is available for Linux and Windows.
The シリアルコンソール is available for Linux PCs with screen and minicom, and for Windows PCs with TeraTerm and PuTTY.
Target.
FRDM-IMX93
microSD もしくはeMMC を使用します。
The Host PC and Target are connected to each other by 2 USB cables.
i.MX Linux BSP 6.6.36-2.1.0 (GitHub)
meta-imx-frdm (branch: lf-6.6.36-2.1.0, tag: imx-frdm-4.0) (GitHub)
meta-nxp-security-reference-design (branch: scarthgap-6.6.23-2.0.0) (GitHub)
2. Host PC center (Linux )¶
Host PC's OS is Ubuntu 22.04. The system has been updated with the latest state.
$ sudo apt-get -y update
$ sudo apt-get -y upgrade
Yoctoでイメージをビルドするために必要なパッケージをインストールします。 The Dockerfile of imx-docker を参考にしています。
$ sudo apt-get -y install gawk wget git-core diffstat unzip texinfo \
gcc-multilib build-essential chrpath socat file cpio python3 \
python3-pip python3-pexpect xz-utils debianutils iputils-ping \
libsdl1.2-dev xterm tar locales net-tools rsync sudo vim curl zstd \
liblz4-tool libssl-dev bc lzop libgnutls28-dev efitools git-lfs \
bsdmainutils
This time, we will work on the top ディレクトリ at HOMEディレクトリ直下の ~/imx93-secure-boot とします。 The place or name of the data center is optional, but you should read and replace it if necessary.
$ mkdir ~/imx93-secure-boot
$ cd ~/imx93-secure-boot
The ultimate ディレクトリツリー for Host PC is the following.
imx93-secure-boot
├── IMX_CST_TOOL_NEW.tgz
├── cst-4.0.1
│ ├── ...
│ ├── keys
│ ├── crts
│ └── linux64
│ └── bin
├── backup-cst
└── yocto
├── ...
├── bin
├── build-imx93-11x11-lpddr4x-frdm
│ ├── ...
│ ├── conf
│ └── tmp
│ └── deploy
│ └── images
│ └── imx93-11x11-lpddr4x-frdm
├── downloads
└── sources
├── ...
├── meta-imx
├── meta-imx-frdm
└── meta-nxp-security-reference-design
3. Download the Code Signing Tool
The Code Signing Tool (CST) is based on the i.MX Processor's High Assurance Boot (HAB) and Advanced High Assurance Boot (AHAB) functions.
NXPのwebサイトから最新版がダウンロードできます。
Code Signing Tool (latest version)
i.MX Software and Development Tools
Link to Code Signing Tools below this page.
最新版をダウンロードすると、 IMX_CST_TOOL_NEW.tgz というファイルなので、最上位ディレクトリに保存してから、展します。
$ cd ~/imx93-secure-boot
$ cp ~/Downloads/IMX_CST_TOOL_NEW.tgz .
$ tar xf IMX_CST_TOOL_NEW.tgz
展開すると（2025/08現在の最新バージョンである） cst-4.0.1 というディレクトリに展されます。 バージョンが異なる場場は読み替えてください。
4. SRK generation¶
Generate a Super Root Key (SRK) for the CST using secure boot. Please refer to the following information for details.
UG10106, Code Signing Tool User Guide, Rev. 4.0.1 - 27 June 2025
cst-4.0.1/docs/UG10106_Rev4.0.1.pdf On the other hand, it is not a good idea to have a good time.
ahab_pki_tree.shでSRKを生成します。 Optionally, the following options can be selected.
The existing CA key can be used to select a CA key by y/n.
Use the CA key name and CA certificate name.
SRK key type をrsa, rsa-pss, eccから選択します。
rsa、rsa-pssの場場、keyのビット長を2048, 3072, 4096から選択します。
eccの場場、keyのビット長をp256, p384, p521から選択します。
digestアルゴリズムをsha256, sha384, sha512から選択します。
SRK is effective for a number of years.
SRK is generated by CA certificate, and y/n is selected to check SRK.
This time, SRK is generated with the following settings.
existing CA or make a difference
key type = ecc
key length = p384
digest algorithm = sha384
Period = 10 years
Certificates of User and Generation
ahab_pki_tree.shでインタラクティブにSRKの生成を行う場は、以下のようななります。
$ cd ~/imx93-secure-boot
$ cd cst-4.0.1/keys
$ ./ahab_pki_tree.sh
...
Do you want to use an existing CA key (y/n)?: n
Do you want to use Elliptic Curve Cryptography (y/n)?: y
Enter length for elliptic curve to be used for PKI tree:
Possible values p256, p384, p521: p384
Enter the digest algorithm to use: sha384
Enter PKI tree duration (years): 10
Do you want the SRK certificates to have the CA flag set? (y/n)?: n
...
$ cd -
If you want to specify the number of quotes in ahab_pki_tree.sh, please do the following.
$ cd ~/imx93-secure-boot
$ cd cst-4.0.1/keys
$ ./ahab_pki_tree.sh -existing-ca n -kt ecc -kl p384 -da sha384 -duration 10 -srk-ca n
$ cd -
Next, the hash value of the certificate is generated by srktool on the i.MX processor'sヒューズ.
$ cd cst-4.0.1/crts
$ ../linux64/bin/srktool -a -d sha256 -s sha384 -t SRK_1_2_3_4_table.bin \
-e SRK_1_2_3_4_fuse.bin -f 1 \
-c SRK1_sha384_secp384r1_v3_usr_crt.pem,SRK2_sha384_secp384r1_v3_usr_crt.pem,SRK3_sha384_secp384r1_v3_usr_crt.pem,SRK4_sha384_secp384r1_v3_usr_crt.pem
Warning
The 4 files that are designated by the -c OPCSIN are not included in the text of Conmar's Mickey, and the text of the Spaces are included in the text of the Spaces.
The SRK_1_2_3_4_table.bin and SRK_1_2_3_4_fuse.bin are generated. These two files are generated correctly and confirmed.
The sha256 digest of SRK_1_2_3_4_table.bin is represented.
$ openssl dgst -binary -sha256 SRK_1_2_3_4_table.bin | hexdump -e '/4 "0x"' -e '/4 "%08x""\n"'
This digest and SRK_1_2_3_4_fuse.bin have the same content.
$ hexdump -e '/4 "0x"' -e '/4 "%08x""\n"' SRK_1_2_3_4_fuse.bin | tee srk_fuse.txt
Same as the above, SRK_1_2_3_4_table.bin and SRK_1_2_3_4_fuse.bin are generated correctly, and are considered to be the same as the SRK_1_2_3_4_fuse.bin.
The value of i.MX 93 is written in the certificate's hash value, and the content of Sunawachi srk_fuse.txt is written in the certificate's hash value.
ヒューズを書き込むためのu-bootコマンドをファイルとして作成しておきます。 Initially, the following ファイル をu-boot_cmd_temp.txtというファイル名で作成します。 This is a program for i.MX 93, Bank 16, and Word 0-7, and it is programmed in a computerized format.
fuse prog -y 16 0
fuse prog -y 16 1
fuse prog -y 16 2
fuse prog -y 16 3
fuse prog -y 16 4
fuse prog -y 16 5
fuse prog -y 16 6
fuse prog -y 16 7
u-boot_cmd_temp.txtにヒューズ値が書かれたsrk_fuse.txtを右側に貼り付けて、u-boot_cmd.txtというファイルを生成します。
$ paste -d" " u-boot_cmd_temp.txt srk_fuse.txt | tee u-boot_cmd.txt
The following form of u-boot_cmd.txt is generated. If you want to write the file, please refer to the following form.
fuse prog -y 16 0
fuse prog -y 16 1
fuse prog -y 16 2
fuse prog -y 16 3
fuse prog -y 16 4
fuse prog -y 16 5
fuse prog -y 16 6
fuse prog -y 16 7
This time, Yoctoビルド has automatically generated the secure boot ためのバイナリします。 その過程でnxp-cst-signerというツールが実行されます。 nxp-cst-signerはCSTディレクトリの直下にある設定ファイル(csf_ahab.cfg)を参考するルールになっているため, ~/imx93-secure-boot/cst-4.0.1/csf_ahab.cfg The following is a summary of the results of the study.
$ cd ~/imx93-secure-boot
$ cd cst-4.0.1
$ edit csf_ahab.cfg
The following notes are kept in the setup file.
#Header
header_version=1.0
#Install SRK
srktable_file=SRK_1_2_3_4_table.bin
srk_source=SRK1_sha384_secp384r1_v3_usr_crt.pem
srk_source_index=0
srk_source_set=OEM
srk_revocations=0x0
#Install Certificate
sgk_file=
sgk_permissions=
The CST setting is complete.
This CSTディレクトリは、ヒューズを書き込んだi.MX 93デバイスのソフトウェアに署名をする時に必要なりますののでをずバックアップを取得し、安全な場な場なに長-termななタビジネトください。
$ cd ~/imx93-secure-boot
$ mkdir backup-cst
$ tar cf backup-cst/cst-4.0.1_$(date +"%Y%m%d-%H%M%S").tar.gz cst-4.0.1/
5. git centers¶
If you are interested in Yocto's video, please register your git user name and password with us, or register with us on any other occasion.
$ git config --global user.name "Your Name"
$ git config --global user.email "
[email protected]"
6. i.MX Linux BSP downloads¶
Yoctoビルド ディレクトリを作成します。
$ cd ~/imx93-secure-boot
$ mkdir yocto
$ cd yocto
repoツールをダウンロードします。
$ mkdir bin
$ curl http://commondatastorage.googleapis.com/git-repo-downloads/repo > bin/repo
The right to use PATH is granted by the repo.
$ chmod a+x bin/repo
$ PATH=${PATH}:$(pwd)/bin
repoでi.MX Linux BSP 6.6.36-2.1.0のレシピをダウンロードするための初期化を行います。
$ repo init -u https://github.com/nxp-imx/imx-manifest -b imx-linux-scarthgap -m imx-6.6.36-2.1.0.xml
repoでi.MX Linux BSP 6.6.36-2.1.0のレシピをダウンロードします。
$ repo sync
7. meta-imx-frdm downloads¶
Additional meta layer for FRDM-IMX93 is downloaded.
$ cd sources
$ git clone https://github.com/nxp-imx-support/meta-imx-frdm -b imx-frdm-4.0
$ cd ..
8. meta-nxp-security-reference-design downloads¶
Yoctoによるsecure bootの自動ビルドを行うための追加meta layerをダウンロードします。 このレイヤにはi.MX Linux BSP 6.6.36-2.1.0用は存在しませんが、近近のscarthgap-6.6.23-2.0.0.0ブランチを使用します。
$ cd sources
$ git clone https://github.com/nxp-imx-support/meta-nxp-security-reference-design -b scarthgap-6.6.23-2.0.0
$ cd ..
This レイヤーをFRDM-IMX93に適すると、署名を行う時にi.MX 93 EVKのdtbが使われてしまう不具合があるため修正をしておきましょう。 (This submission is for reference only. < https://github.com/nxp-imx-support/meta-nxp-security-reference-design/pull/2 > )
diff --git a/meta-secure-boot/recipes-secure-boot/imx-mkimage/imx-boot_%.bbappend b/meta-secure-boot/recipes-secure-boot/imx-mkimage/imx-boot_%.bbappend
index 1bbc7b2..6a2f069 100644
--- a/meta-secure-boot/recipes-secure-boot/imx-mkimage/imx-boot_%.bbappend
+++ b/meta-secure-boot/recipes-secure-boot/imx-mkimage/imx-boot_%.bbappend
@@ -15,7 +15,7 @@ do_compile:append:ahab() {
mv ${BOOT_STAGING}/flash.bin ${BOOT_STAGING}/flash.bak
# Invoke mkimage again to Get container info
- make SOC=${IMX_BOOT_SOC_TARGET} flash_kernel
+ make SOC=${IMX_BOOT_SOC_TARGET} ${MKIMAGE_EXTRA_ARGS} flash_kernel
# Rename kernel image name and move back the imx-boot flash image name
mv ${BOOT_STAGING}/flash.bin ${BOOT_STAGING}/flash_os.bin
9. Site Map of the Verde Environment¶
Yoctoビルドのプロジェクトのセッアップを行います。FRDM-IMX93の場場は以下コマンドになります。
$ MACHINE=imx93-11x11-lpddr4x-frdm DISTRO=fsl-imx-xwayland EULA=1 source sources/meta-imx-frdm/tools/imx-frdm-setup.sh -b build-imx93-11x11-lpddr4x-frdm
The comand ended normally and build-imx93-11x11-lpddr4x-frdm ディレクトリに移動しています。
次のコマンドで、 meta-nxp-security-reference-design/meta-secure-boot をlayerとして追加します。 This is necessary to automate the signing of the secure boot.
$ bitbake-layers add-layer ../sources/meta-nxp-security-reference-design/meta-secure-boot
The program settings (local.conf) are added to the program. Open local.conf in Edita.
$ edit conf/local.conf
Append the next 1 line to the end of local.conf. The rootfs of rambootするためが追加で生成されます。
IMAGE_FSTYPES:append = " cpio.gz.u-boot"
Append the next line to the end of local.conf. Set the absolute CST defaults for the CST_PATH variable. The meta-nxp-security-reference-design is necessary to refer to the CST defaults.
CST_PATH =
Add the next 1 line to the end of local.conf. The problem with i.MX 93 EVK's dtb was avoided when meta-nxp-security-reference-design was signed to FRDM-IMX93's kernel and dtb.
MKIMAGE_EXTRA_ARGS:imx93-11x11-lpddr4x-frdm = "KERNEL_DTB=imx93-11x11-frdm.dtb"
Edit to save local.conf.
10. IMAGE VELDO¶
This time, the size is minimized, and the signatures of the katsu and secure boot are automatically executed on core-image-minimal-secure-boot をbitbakeします。 The process takes several hours to complete.
$ bitbake core-image-minimal-secure-boot -k
The image video has ended normally and the following 2 files have been generated. 1 file is a signature payki bootloader, and the other file is a combination of linux kernel and dtb, which is a signature payki OS console.
$ stat tmp/deploy/images/imx93-11x11-lpddr4x-frdm/signed-imx-boot-imx93-11x11-lpddr4x-frdm-sd.bin-flash_singleboot
$ stat tmp/deploy/images/imx93-11x11-lpddr4x-frdm/os_cntr_signed.bin
Signed and dated Bootloader and Signed and dated OSコンテナを組み込んだイメージファイルも生成されています。 This wic file is activated by SD or eMMC.
$ stat tmp/deploy/images/imx93-11x11-lpddr4x-frdm/core-image-minimal-secure-boot-imx93-11x11-lpddr4x-frdm.rootfs.wic.zst
Serial DownloadでLinuxを起する時に使用するramdiskも生成されています。 This file is signed later. ( Signature of ramdisk )
$ stat tmp/deploy/images/imx93-11x11-lpddr4x-frdm/core-image-minimal-secure-boot-imx93-11x11-lpddr4x-frdm.rootfs.cpio.gz.u-boot
11. occasions where bitbake is reopened while in transit ¶¶
If the bitbake is interrupted on the way, or if another shell is reopened, it is necessary to set the number of environment changes in Yocto. Also, you can use the following scripts.
$ cd ~/imx93-secure-boot
$ cd yocto
$ source setup-environment build-imx93-11x11-lpddr4x-frdm
12. Occasions for signatures¶
When SRK is regenerated, the signatures will be cleaned and rebranded at imx-boot , imx-boot-signature , linux-imx-signature and the 4 pairs of images (this time core-image-minimal-secure-boot ).
$ bitbake imx-boot imx-boot-signature linux-imx-signature core-image-minimal-secure-boot -c cleanall
$ bitbake core-image-minimal-secure-boot -k
13. ramdisk's signature¶
イメージのビルドが正常終了すると、deployディレクトリに2つのツールが存在します。 mkimage_imx8は起動コンテナを作成するツールです。 cst_signerはコンテナに署名を行うツールです。
$ stat tmp/deploy/images/imx93-11x11-lpddr4x-frdm/imx-boot-tools/mkimage_imx8
$ stat tmp/deploy/images/imx93-11x11-lpddr4x-frdm/imx-boot-tools/cst_signer
また、deployディレクトリにramdiskファイルも存在します。
$ stat tmp/deploy/images/imx93-11x11-lpddr4x-frdm/core-image-minimal-secure-boot-imx93-11x11-lpddr4x-frdm.rootfs.cpio.gz.u-boot
mkimage_imx8とcst_signerを使って、ramdiskファイルに署名をします。
Initially mkimage_imx8 でramdiskをコンテナにします。 The form of the ramdisk is as follows.
$ INITRD=
$ INITRD_ADDR=
$ mkimage_imx8 -soc IMX9 -container -data ${INITRD} a55 ${INITRD_ADDR} -out
The specifics are as follows.
$ tmp/deploy/images/imx93-11x11-lpddr4x-frdm/imx-boot-tools/mkimage_imx8 \
-soc IMX9 \
-container \
-data tmp/deploy/images/imx93-11x11-lpddr4x-frdm/core-image-minimal-secure-boot-imx93-11x11-lpddr4x-frdm.rootfs.cpio.gz.u-boot \
a55 \
0x83800000 \
-out initrd_cntr.bin
The second cst_signer is signed by コンテナ. The form of the cst_signer is as follows.
$ CST_PATH= cst_signer -d -i -c /csf_ahab.cfg
The specifics are as follows.
$ CST_PATH=/home/nxp/imx93-secure-boot/cst-4.0.1 \
tmp/deploy/images/imx93-11x11-lpddr4x-frdm/imx-boot-tools/cst_signer \
-d \
-i initrd_cntr.bin \
-c /home/nxp/imx93-secure-boot/cst-4.0.1/csf_ahab.cfg
Signed ramdisk or deployディレクトリに移動しておきます。
$ mv signed-initrd_cntr.bin tmp/deploy/images/imx93-11x11-lpddr4x-frdm/
The environment in which this secure boot will be implemented is a Bildungsroman.
14. Host PCs and guesthouses
The Host PC and Target are connected to each other by 2 USB cables.
Fig. 1 Link between Host PC and Tartar Gateway ¶
15. UUU Institutes (Linux )¶
Linux version of UUU is configured on the following sites: uuu をダウンロードして、 /usr/local/bin などのPATHの通った場場に配置します。
UUU Releases (latest version) <https://github.com/nxp-imx/mfgtools/releases/latest>
In the following section, you can set the settings for the sudo なし でuuu を実行できるようにsettingファインストールします.
$ sudo sh -c "uuu -udev > /etc/udev/rules.d/70-uuu.rules"
$ sudo udevadm control --reload
Host PC and FRDM-IMX93's USB1 port are connected to USB 続して、FRDM-IMX93をSerial Download modeに設定して电源ONすると以下のコマンドで接続されているFRDM-IMX93の情報が見えること確認えることします。
$ uuu -lsusb
uuu (Universal Update Utility) for nxp imx chips -- libuuu_1.5.201-11-gf2a4e3e
Connected Known USB Devices
Path Chip Pro Vid Pid BcdVersion Serial_no
====================================================================
3:1224 MX93 SDPS: 0x1FC9 0x014E 0x0001 3A24F36BB35F4594
16. UUU Institutes (Windows )¶
Windows version of UUU is the following サイトから uuu.exe をダウンロードして、PATHの通った場場に配置します。
UUU Releases (latest version) <https://github.com/nxp-imx/mfgtools/releases/latest>
Host PC and FRDM-IMX93's USB1 port are connected to USB 続して、FRDM-IMX93をSerial Download modeに設定して电源ONすると以下のコマンドで接続されているFRDM-IMX93の情報が見えること確認えることします。
> uuu -lsusb
uuu (Universal Update Utility) for nxp imx chips -- libuuu_1.5.201-11-gf2a4e3e
Connected Known USB Devices
Path Chip Pro Vid Pid BcdVersion Serial_no
====================================================================
3:1224 MX93 SDPS: 0x1FC9 0x014E 0x0001 3A24F36BB35F4594
17. シリアルコンソール (Linux )¶
Host PCでシリアルコンソールを開きます。 For example, minicom can open the シリアルポート of FRDM-IMX93 on the following occasions.
$ minicom -D/dev/ttyACM0
18. シリアルコンソール (Windows )¶
Windows シリアルコンソールのアプリケーションで、FRDM-IMX93の場場はComputer USB-Enhanced-SERIAL-A CH342 を開きます。
The i.MX 93 EVK is available in a 3-panel box with a 4-panel COM port.
19. Linux Startup Tasks (1 )¶
Bootloader and Linux を起動して、AHABのエラーを確認します。 BOOT_MODEによって方法が異なりますので、いずれかを選択してテストします。
Serial DownloadでLinux Startup
SDまたはeMMCでLinux startup
19.1. Serial DownloadでLinux Startup¶
Serial Download de Bootloader and Linux bootstrap.
The next 3 files are used.
Signed Bootloaderファイル signed-imx-boot-imx93-11x11-lpddr4x-frdm-sd.bin-flash_singleboot
Linux kernel and dtb combined with a signature payment file on 1 console os_cntr_signed.bin
Signed ramdiskファイル signed-initrd_cntr.bin
The presence of 3 files is confirmed by the following pas.
$ cd ~/imx93-secure-boot
$ cd yocto/build-imx93-11x11-lpddr4x-frdm/tmp/deploy/images/imx93-11x11-lpddr4x-frdm
$ stat signed-imx-boot-imx93-11x11-lpddr4x-frdm-sd.bin-flash_singleboot
$ stat os_cntr_signed.bin
$ stat signed-initrd_cntr.bin
$ cd -
The UUU has made the スクリプトファイル sdp-ramboot-yocto-signed.uuu a reality.
$ cd ~/imx93-secure-boot
$ edit sdp-ramboot-yocto-signed.uuu
The following items are noted for preservation.
uuu_version 1.2.39
SDPS: boot -f yocto/build-imx93-11x11-lpddr4x-frdm/tmp/deploy/images/imx93-11x11-lpddr4x-frdm/signed-imx-boot-imx93-11x11-lpddr4x-frdm-sd.bin-flash_singleboot
FB: ucmd ahab_status
FB: ucmd setenv ramargs 'setenv bootargs ${jh_clk} console=${console} root=/dev/ram rw'
FB: ucmd setenv ramboot 'echo Booting from initramfs ...; run ramargs; booti ${loadaddr} ${initrd_addr} ${fdt_addr};'
FB: ucmd setenv fastboot_buffer ${cntr_addr}
FB: download -f yocto/build-imx93-11x11-lpddr4x-frdm/tmp/deploy/images/imx93-11x11-lpddr4x-frdm/os_cntr_signed.bin
FB: ucmd auth_cntr ${cntr_addr}
FB: ucmd ahab_status
FB: ucmd setenv fastboot_buffer ${cntr_addr}
FB: download -f yocto/build-imx93-11x11-lpddr4x-frdm/tmp/deploy/images/imx93-11x11-lpddr4x-frdm/signed-initrd_cntr.bin
FB: ucmd auth_cntr ${cntr_addr}
FB: ucmd ahab_status
FB: acmd run ramboot
FB: done
The UUU de-scrimp is practiced.
$ uuu -d -v sdp-ramboot-yocto-signed.uuu
FRDM-IMX93をSerial Downloadモードに設定して电源ONすると、BootloaderからLinuxが起動します。 AHABのエラーは、Linuxが起動する直前実行した ahab_status コマンドの結果で判断します。
Authenticate OS container at 0x98000000
...
Lifecycle: 0x00000008, OEM Open
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)
Detect USB boot. Will enter fastboot mode!
Booting from initramfs ...
## Loading init Ramdisk from Legacy Image at 83800000 ...
Image Name: core-image-minimal-secure-boot-i
Created: 2011-04-05 23:00:00 UTC
Image Type: AArch64 Linux RAMDisk Image (uncompressed)
Data Size: 56894907 Bytes = 54.3 MiB
Load Address: 00000000
Entry Point: 00000000
Verifying Checksum ... OK
## Flattened Device Tree blob at 83000000
Booting using the fdt blob at 0x83000000
Working FDT set to 83000000
Using Device Tree in place at 0000000083000000, end 000000008300eaef
Working FDT set to 83000000
fail to find output device
probe video device failed, ret -19
Starting kernel ...
[ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x412fd050]
[ 0.000000] Linux version 6.6.36-lts-next-g20aa8fc92c79 (oe-user@oe-host) (aarch64-poky-linux-gcc (GCC) 13.3.0, GNU ld 4
[ 0.000000] KASLR disabled due to lack of seed
[ 0.000000] Machine model: NXP i.MX93 11X11 FRDM board
...
Linux ga startするまでに、u-boot-spl, u-boot, kernel+dtb, ramdiskの4次の認證が行われますが、まだSRK hashがヒューズに書かれていない状態では、4次の認證エラー ELE_BAD_KEY_HASH_FAILURE_IND (0xFA) が発生したことが表示されます。
エラー ELE_NO_AUTHENTICATION_FAILURE_IND (0xEE) が出る場場は、「イメージに署名が無いので認證できなかった」という意味で、署名付きイメージのビルドが正しくできていない可能性があります。
Lifecycle: 0x00000008, OEM Open
0x0287eed6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_NO_AUTHENTICATION_FAILURE_IND (0xEE)
STA = ELE_SUCCESS_IND (0xD6)
SRK hashがヒューズに書かれて認證が正しく行われれば、AHABのエラーが無くなり、以下のように No Events Found! という表示になります。
Lifecycle: 0x00000008, OEM Open
No Events Found!
19.2. SDまたはeMMCでLinux startup ¶
FRDM-IMX93のBOOT_MODEスイッチをSerial Downloadモードに設定して电源をONします。 SDブートの場場は書き込み可能なmicroSDカードをカードスロットに挿入ししてから、以下のコマンドでSDにイメージを書き込みます。
Listing 1 Writing in SD ¶
$ cd ~/imx93-secure-boot
$ cd yocto/build-imx93-11x11-lpddr4x-frdm/tmp/deploy/images/imx93-11x11-lpddr4x-frdm/
$ uuu -b sd_all signed-imx-boot-imx93-11x11-lpddr4x-frdm-sd.bin-flash_singleboot core-image-minimal-secure-boot-imx93-11x11-lpddr4x-frdm.rootfs.wic.zst
$ cd -
In case of eMMCブート, please write down the eMMC messages in the following commemorations.
Listing 2 Writing on eMMC ¶
$ cd ~/imx93-secure-boot
$ cd yocto/build-imx93-11x11-lpddr4x-frdm/tmp/deploy/images/imx93-11x11-lpddr4x-frdm/
$ uuu -b emmc_all signed-imx-boot-imx93-11x11-lpddr4x-frdm-sd.bin-flash_singleboot core-image-minimal-secure-boot-imx93-11x11-lpddr4x-frdm.rootfs.wic.zst
$ cd -
The power supply of FRDM-IMX93 is OFF when the writing is finished. FRDM-IMX93のBOOT_MODEスイッチを、SDブートモードまたはeMMCブートモードに設定して电源ONします。
U-Boot's startup にコンソールでリターンキーを押すことで、起動を一時停止しプロンプトを表示できます。 The following code is certified with the signature OS IMAGE (kernel + dtb).
Listing 3 Authentication of Signed OS Images ¶
u-boot=> mmc dev ${mmcdev}
u-boot=> mmc rescan
u-boot=> run loadcntr
u-boot=> run mmcargs
u-boot=> run auth_os
ahab_status The Comanufactured AHAB's Elite is confirmed by the Comanufactured AHAB.
Listing 4 Signature of Images Certified Elite ¶
u-boot=> ahab_status
Lifecycle: 0x00000008, OEM Open
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)
Linux ga startするまでに、u-boot-spl, u-boot, kernel+dtbの3回の認證が行われますが、まだSRK hashがヒューズに書かれていない状態では、3回の認證エラー ELE_BAD_KEY_HASH_FAILURE_IND (0xFA) が発したことが表示されます。
エラー ELE_NO_AUTHENTICATION_FAILURE_IND (0xEE) が出る場場は、「イメージに署名が無いので認證できなかった」という意味で、署名付きイメージのビルドが正しくできていない可能性があります。
Listing 5 Signature Information ¶
Lifecycle: 0x00000008, OEM Open
0x0287eed6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_NO_AUTHENTICATION_FAILURE_IND (0xEE)
STA = ELE_SUCCESS_IND (0xD6)
SRK hashがヒューズに書かれて認證が正しく行われれば、AHABのエラーが無くなり、以下のように No Events Found! という表示になります。
Listing 6 When AHAB is unavailable ¶
Lifecycle: 0x00000008, OEM Open
No Events Found!
Lastly, the following comanagers were confirmed to have been activated by the Linux Logline.
Listing 7 Linux Startup ¶
u-boot=> run boot_os
20. Writing of SRK hash on a hikigome .
i.MX 93のヒューズ Bank 16、Word 0-7の値が0x00000000であることここと確認します。
u-boot=> fuse read 16 0
u-boot=> fuse read 16 1
u-boot=> fuse read 16 2
u-boot=> fuse read 16 3
u-boot=> fuse read 16 4
u-boot=> fuse read 16 5
u-boot=> fuse read 16 6
u-boot=> fuse read 16 7
SRK Generation The contents of the u-boot_cmd.txt file generated by the SRK are confirmed. (The actual values of to and other notations are shown in the table below.)
$ cd ~/imx93-secure-boot
$ cat cst-4.0.1/crts/u-boot_cmd.txt
fuse prog -y 16 0
fuse prog -y 16 1
fuse prog -y 16 2
fuse prog -y 16 3
fuse prog -y 16 4
fuse prog -y 16 5
fuse prog -y 16 6
fuse prog -y 16 7
u-boot_cmd.txt The SRK hash of the u-boot program is written in the ヒューズにヒき込みます。 (This is the actual value of 〜 and the notation.)
Warning
Hikari's writing is limited to one time, and the dollar is returned to this point. Very much to confirm that on Shita on the careful work to do を行ってください。
u-boot=> fuse prog -y 16 0
u-boot=> fuse prog -y 16 1
u-boot=> fuse prog -y 16 2
u-boot=> fuse prog -y 16 3
u-boot=> fuse prog -y 16 4
u-boot=> fuse prog -y 16 5
u-boot=> fuse prog -y 16 6
u-boot=> fuse prog -y 16 7
21. Linux Startup Tasks (2 )¶
Bootloader and Linux startup, AHAB's Elite is confirmed. Linux Bootstrap (1) The Linux bootloader and Linux bootstrap are available in the same way as the Linux bootstrap.
Serial DownloadでLinux Startup
SDまたはeMMCでLinux startup
SRK hashのヒューズを書き込んだため、 ahab_status コマンドの結果が No Events Found! と表示されるはずです。 This means that the signature is paid by the Immigration Department.
Lifecycle: 0x00000008, OEM Open
No Events Found!
22. Relocation of OEM Closed¶
i.MX 93デバイスのLifecycleがOEM Closedに遷移移することで、署名付きイメージのみ起動できるようになり、署名の無いイメージや、不正な署名付きイメージは起動できなくなります。
署名付きイメージで起動して ahab_status コマンドで AHAB エラーが無いことを確認します。
u-boot=> ahab_status
Lifecycle: 0x00000008, OEM Open
No Events Found!
ahab_close The company has implemented and relocated the OEM Closed.
Warning
The relocation of OEM Closed is limited to one time only, and the return of OEM Open is not allowed. Please make sure that you are very sure that you have done your work carefully.
u-boot=> ahab_close
Warning: Please ensure your sample is in NXP closed state, OEM SRK hash has been fused,
and you are able to boot a signed image successfully without any SECO events reported.
If not, your sample will be unrecoverable.
Really perform this operation?
y
Change to OEM closed successfully
u-boot=>
The re-center is in line with the OEM Closed and Nari-masu at the time of the next start-up. Signed and paid イメージであれば再起動します。
u-boot=> reset
resetting ...
U-Boot SPL 2024.04+gde16f4f1722+p0 (Sep 02 2024 - 10:44:35 +0000)
SOC: 0xa1009300
...
ahab_status The concept is being implemented and relocated by OEM Closed.
u-boot=> ahab_status
Lifecycle: 0x00000020, OEM closed
No Events Found!
u-boot=>
23. Linux Startup Tasks (3 )¶
Bootloader and Linux startup are confirmed. Linux Bootstrap (1) The Linux bootloader and Linux startup task (1) are confirmed by the same method as the bootloader.
Serial DownloadでLinux Startup
SDまたはeMMCでLinux startup
Linuxまで起動できれば、Secure Bootに成功したことになります。
24. References¶
i.MX 93 Applications Processor Reference Manual
i.MX 93 Applications Processor Security Reference Manual, Rev. 5, 2025-03-04
(入手は i.MX 93 サイト Secure DocumentationのSecurity Reference Manualのリンクからリクエストを送信して、認認が出るとNXPからダウンロードURLのメールが届きます。)
UG10106, Code Signing Tool User Guide, Rev. 4.0.1 - 27 June 2025
(CSTのパッケージに含まれています。cst-4.0.1/docs/UG10106_Rev4.0.1.pdf)
U-Boot AHAB documents
AN12312, Secure Boot on AHAB Supported Devices
UG10195, i.MX FRDM Software User Guide
UM12181, FRDM-IMX93 Board User Manual
meta-imx-frdm README (imx-frdm-4.0)
meta-nxp-security-reference-design/meta-secure-boot README (scarthgap-6.6.23-2.0.0)
This information is a reference for the use of NXP products.
For more information, please refer to the official website.
The contents of the record and the actual operation may be different depending on the difference in conditions such as the use of a flash drive or a USB flash drive.
If you have any questions about the function of the product, please do not hesitate to contact us for inspection and test.
=========================
The "Comment" columnof this submission should containa comment, which should be answered by the return mail now. Please contact us for the number of copies, and the questionnaire to be sent to us. NXP Technical Question for NXP -NXP's Technical Questionnaire. How to use the questionnaire ( Japanese Logo ) " Please refer toださい. (About Us) NXP Distributor, Moshiku NXP If you have any questions about NXP and its products, please contact us.)
Previously, we have explained the i.MX 93 in the following example of aセキュアブートの仕組みについて解説を行いました。 (Please refer to the following for previous notes).
Journalism: i.MX 93 Prospectus: Signatures and Certifications for SequiaBoot (Japanese Logo)
This time, the Secure boot is actually installed in a hanzion form. i.MX Processors Security Japanese Logo
