i.mx8 ahab encryption

[BrainKub]

Hello! I'm trying to encrypt the uboot image using AHAB. I built an imx cst with encryption support and when trying to encrypt the image, it gives an error: Invalid argument: ImageIndexes. Tell me how to solve this problem, where to get the value of image indexes? I tried to set 0 and the default value was 0xFFFFFFFE

[BrainKub]

I built flash.bin with parameters:
CONFIG_AHAB_BOOT=y
CONFIG_CMD_DEKBLOB=y
CONFIG_IMG_SECO_DEK_ENCAP=y
CONFIG_FAT_WRITE=y
Built an imx code signing tool with encryption support:
$ sudo apt-get install libssl-dev openssl
$ cd <CST install directory>/code/back_end/src
$ $ gcc -o css_encrypted -I ../dr -L ../../../linux 64/lib *.cl frontend -lcrypto
$ $ cp css_encrypted ../../../linux 64/bit/

Generated a PKI and tried to encrypt the image:
././release/linux 64/bit/css_encrypted -i csf_enc_boot_image.txt -open_flash.bin
Invalid argument: ImageIndexes

Then I tried to just remove this parameter, then cst gave this:

Invalid command: InstallSecretKey is illegal for given target

Can you tell me, please, where you can read more about the css file parameters and preferably encryption on imx8 in general?

[Yuri]

@BrainKub 
Hello,

  please provide the sequence to reproduce the issue.

Also:

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4/guides/encrypted_boot.txt?h=...

Regards,
Yuri.

[BrainKub]

I did it according to the instruction

https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/ahab/guides/mx8_mx8x_encrypted_boo...
Built u boot with parameters:
CONFIG_AHAB_BOOT=y
CONFIG_CMD_DEKBLOB=y
CONFIG_IMG_SECO_DEK_ENCAP=y
CONFIG_FAT_WRITE=y
took csf from the example and tried to encrypt the image. But I didn't really understand where to get the value of the image indexes parameter. Perhaps I have it incorrectly defined..

[Yuri]

@BrainKub 
Hello,

  Code-Signing Tool User’s Guide describes the image indexes parameter.

Image Indexes  - List of images that will be encrypted.  Mask of bits (by default, all images are
encrypted)

Image Indexes = 0xFFFFFFFE /* Image index 0 not encrypted */

Regards,
Yuri.