1) Please send a link or a document giving the specific steps to create a signed final boot container for iMX8x?
For secure boot on iMX8X, the boot container is built with the Yocto recipe imx-boot. On iMX8X the binaries for SCU Firmware, ARM Trusted Firmware, U-boot, etc. are located under build/deploy/images/imx8x/imx-boot-tools/
2) Having built the imx8x minimal bitbake with OpenEmbedded, all the needed artifacts to assemble the final boot container exist in the imx-boot... bin-flash image, correct?
3) Does the imx-boot Yocto recipe also do the csf signing? I don't see a signed image in the artifacts and I don't see the offsets. Instructions indicate:
To generate the flash.bin file:
- On i.MX 8 QXP:
$ cd <work>/imx-mkimage
$ make SOC=iMX8QX flash
If the command ends successfully, the end of the result should look
like:
CST: CONTAINER 0 offset: 0x400
CST: CONTAINER 0: Signature Block: offset is at 0x590
DONE.
Note: Please copy image to offset: IVT_OFFSET + IMAGE_OFFSET
Keep in mind the offsets above to be used with CST/CSF.
Once this flash has been created, then it needs to be signed using the CSF and a signed image created as below, correct?
1.5.1 Creating the CSF description file for the second container
-----------------------------------------------------------------
The CSF contains all the commands that the AHAB executes during the secure
boot. These commands instruct the AHAB on which memory areas of the image
to authenticate, which keys to install, use and etc.
CSF examples are available under doc/imx/hab/ahab/csf_examples/
directory.
This csf_boot_image.txt file example should be updated with the offset values
of the 1.4 section and the path to your flash.bin file. It is the last part
of the file:
[Authenticate Data]
# Binary to be signed generated by mkimage
File = "flash.bin"
# Offsets = Container header Signature block (printed out by mkimage)
Offsets = 0x400 0x590
1.5.2 Signing the boot image
-----------------------------
Now you use the CST to generate the signed boot image from the previously
created csf_boot_image.txt Commands Sequence File:
$ cd <work>
$ ./release/linux64/bin/cst -i csf_boot_image.txt -o flash.signed.bin
1.5.3 Flash the signed image
-----------------------------
Write the signed U-Boot image:
$ sudo dd if=flash.signed.bin of=/dev/sdX bs=1k seek=32 ; sync
Then insert the SD Card into the board and plug your device to your computer
with an USB serial cable.
