How to encrypt flash_flexspi target of mk-image for iMX8QX rev C0?

[BrainKub]

I can`t encrypt "flash_flexspi" target of "imx-mkimage" using the same CSF (for "flash" target):

[ERROR] CST: Offsets are not consistent with the input binary to be signed

Offset in CSF correct - they are from imx-mkimage output.

スポイラ

[Header]
Target = AHAB
Version = 1.0

[Install SRK]
# SRK table generated by srktool
File = "./release/crts/SRK_1_2_3_4_table.bin"
# Public key certificate in PEM format
Source = "./release/crts/SRK1_sha384_secp384r1_v3_usr_crt.pem"
# Index of the public key certificate within the SRK table (0 .. 3)
Source index = 0
# Type of SRK set (NXP or OEM)
Source set = OEM
# bitmask of the revoked SRKs
Revocations = 0x0

[Authenticate Data]
# Binary to be signed generated by mkimage
File = "flash.bin"
# Offsets = Container header Signature block (printed out by mkimage)
Offsets = 0x400 0x590

スポイラ

REVISION: B0
BOOT DEVICE: flexspi
New Container: 0
SCFW: scfw_tcm.bin
AP: u-boot-atf.bin core: a35 addr: 0x80000000
Output: flash.bin
CONTAINER FUSE VERSION: 0x00
CONTAINER SW VERSION: 0x0000
ivt_offset: 4096
rev: 2
Platform: i.MX8QXP B0
ivt_offset: 4096
container image offset (aligned):11800
flags: 0x10
Hash of the images = sha384
1+0 записей получено
1+0 записей отправлено
151552 байт (152 kB, 148 KiB) скопирован, 0,000365609 s, 415 MB/s
294+1 записей получено
294+1 записей отправлено
150720 байт (151 kB, 147 KiB) скопирован, 0,000656258 s, 230 MB/s
SCFW file_offset = 0x11800 size = 0x25000
Hash of the images = sha384
1+0 записей получено
1+0 записей отправлено
872448 байт (872 kB, 852 KiB) скопирован, 0,00104488 s, 835 MB/s
1702+1 записей получено
1702+1 записей отправлено
871767 байт (872 kB, 851 KiB) скопирован, 0,00213528 s, 408 MB/s
AP file_offset = 0x36800 size = 0xd5000
CST: CONTAINER 0 offset: 0x400
CST: CONTAINER 0: Signature Block: offset is at 0x590
DONE.
Note: Please copy image to offset: IVT_OFFSET + IMAGE_OFFSET
./../scripts/fspi_packer.sh ../scripts/fspi_header
0+1 записей получено
0+1 записей отправлено
512 байт скопировано, 0,00011303 s, 4,5 MB/s
1070+0 записей получено
1070+0 записей отправлено
1095680 байт (1,1 MB, 1,0 MiB) скопирован, 0,00211214 s, 519 MB/s
3+0 записей получено
3+0 записей отправлено
1536 байт (1,5 kB, 1,5 KiB) скопирован, 8,65e-05 s, 17,8 MB/s
F(Q)SPI IMAGE PACKED

How to encrypt "flash_flexspi" image for iMX8QXP C0?

[Zhiming_Liu]

Hi

You need follow this guide 

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides/mx8m_secure_boot.txt?...

make SOC=<SoC Name> flash_hdmi_spl_uboot

make SOC=<SoC Name> print_fit_hab

[BiyongSUN]

Solved: Re: How to sign flash_flexspi target of mk-image f... - NXP Community

[BrainKub]

What should I do with this value? Tell me please how I can determine the offsets.

[BiyongSUN · Accepted solution]

The guide in uboot does not consider the spi.  

It is for emmc/sdcard. 

So you add 4096(0x1000) to offset for spi as I have given you the link, which is printout by build or in the build log.

Suggest you make sure you can sign the emmc/sdcard image.