I can successfully create a Yocto build for my i.MX8M-Plus board within a dockerized 64-bit Ubuntu 18.04 environment and boot the device.
Now I want to work on secure boot and so I am using CST Tool 3.3.2 to attempt to generate the signed binaries for imx-boot, and the kernel. The CST Tool signs the kernel just fine, but segmentation faults when trying to sign the imx-boot FIT image. The command that fails is shown below. I have tried several versions of CST tool and they all fail in the same way. What have I done wrong and how can I get this to work? Thank you!
developer@docker-desktop:/workspaces/cst-3.3.2/linux64/bin$ ./cst --version
Code Signing Tool Version: 3.3.2-development
Compiled with:
OpenSSL 1.1.1t 7 Feb 2023
OPENSSLDIR: "/opt/cst-ssl"
ENGINESDIR: "/opt/cst-ssl/lib/engines-1.1"
Segmentation Fault:
+ /workspaces/cst-3.3.2/linux64/bin/cst -i /home/developer/compulab-nxp-bsp/build-iot-gate-imx8plus/tmp/deploy/images/iot-gate-imx8plus/cst-tools/hab/signed/u/csf_spl.txt -o /home/developer/compulab-nxp-bsp/build-iot-gate-imx8plus/tmp/deploy/images/iot-gate-imx8plus/cst-tools/hab/signed/u/csf_spl.bin
../tools/csf.u: line 30: 28249 Segmentation fault ${CST} -i ${O}/csf_spl.txt -o ${O}/csf_spl.bin
Makefile:34: recipe for target 'hab/signed/u' failed
make: *** [hab/signed/u] Error 139
Line that causes segmentation fault:
${CST} -i ${O}/csf_spl.txt -o ${O}/csf_spl.bin
${CST} -i ${O}/csf_fit.txt -o ${O}/csf_fit.bin
Contents of csf_spl.txt:
[Header]
Version = 4.3
Hash Algorithm = sha256
Engine = CAAM
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
[Install SRK]
# Index of the key location in the SRK table to be installed
File = "../crts/SRK_1_2_3_4_table.bin"
Source index = 0
[Install CSFK]
# Key used to authenticate the CSF data
File = "../crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"
[Authenticate CSF]
[Unlock]
# Leave Job Ring and DECO master ID registers Unlocked
Engine = CAAM
Features = MFG
[Install Key]
# Key slot index used to authenticate the key to be installed
Verification index = 0
# Target key slot in HAB key store where key will be installed
Target index = 2
# Key to install
File = "../crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"
[Authenticate Data]
# Key slot index used to authenticate the image data
Verification index = 2
# Authenticate Start Address, Offset, Length and file
Blocks = \
"/home/developer/compulab-nxp-bsp/build-iot-gate-imx8plus/tmp/deploy/images/iot-gate-imx8plus/cst-tools/hab/flash.bin"
