How to generate the os_container with yocto project by imx-mkimage tool?

[yang_wang-wy]

Hello Sir,
I am working on the imx8dx products. I use the yocto to build my file system and integrate the kernel dtb and rootfs into one wic image.
I have one question about generating the os_container with the yocto project or by manual with the imx-mkimage tool?

Because I want to verify the secure boot function and use the auth_cntr command to verify my firmware in uboot. 

I checked the two-issue and not helpful with my question. https://community.nxp.com/t5/i-MX-Processors/How-to-generate-a-signed-OS-container-image-for-iMX8X/m...  https://community.nxp.com/t5/i-MX-Processors/i-MX8X-Secure-Boot-with-encrypted-OS-container/m-p/1203...

[Yuri]

@yang_wang-wy 
Hello,

  We have not considered and tested use case to pack the  Root-FS into
the container, assuming using crypto-FS.

Regards,
Yuri.

[yang_wang-wy]

Hello @Yuri 

Maybe I could have below understanding, check my point, please.

1. Our verify process could only support from power on to kernel start, this means that the uboot could verify the kernel but kernel can not do more.

2. if we can not use the imx-mkimage to generate a container that how to use the cst tool to sign it?

[Yuri]

@yang_wang-wy 
Hello,

  the recommended trust chain is as following:

i.MX boot ROM HAB checks U-boot;
U-boot checks kernel;
kernel uses encrypted root FS.

Regards,
Yuri.

[Yuri]

@yang_wang-wy 
Hello,

 use the following:

https://www.nxp.com/docs/en/application-note/AN12312.pdf

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/ahab/guides/mx8_mx8x_secure_boot.t...

https://community.nxp.com/t5/i-MX-Processors-Knowledge-Base/i-MX8-Boot-process-and-creating-a-bootab...

Regards,
Yuri.