MIMXRT1062xxx5A Secure Bootloader

[Rudy25]

Hi all,

We are using the MIMXRT1062xxx5A and NOR flash and we are planning to implement a secure bootloader. 

Basically, from POR and after ROM bootloader is executed, the secure bootloader will be executed next, then follow by the application (if there is a valid one).

The secure bootloader will check if there is a valid application and if yes it jumps to application otherwise it just stays in the secure bootloader and wait for the end user to trigger firmware upgrade/flashing request. Similarly, if from application a firmware upgrade request is received, it jumps back to secure bootloader.

But before firmware upgrade request is executed, the secure bootloader should check that the firmware upgrade request is genuine/authentic. And here comes the big HOW? We are still trying to figure out on how to do it. Any idea on how to do it is very much appreciated.

Questions:

1. Is the iMXRT MCU able to support a secure bootloader implementation? I mean, whether there is available hardware register that can generate some form of key and available tool to interpret it.

2. Are there any available documents/examples that we can refer to as a starting point? 

Thank you.

Regards,

Rudy

[JasonG]

We've been working on a similar bootloader and application firmware for RT1062 for months now. We started with the SBL&SFW projects, added signing and are only now looking at the suggestions of AN12681. 

I really wish NXP made it easier than it currently is! Seems like a basic requirement for any embedded system these days so why not just make it simple. There seems to be a forever growing list of host utilities. Some of which perform the same tasks. So it gets very confusing when reading all the different app notes which don't seem to align well. 

Does anyone have a good resource that explains the process of implementing encrypted firmware images for the i.MX RT10XX range? Besides the ones mentioned above...

[jingpan]

Hi @Rudy25 ,

Please refer to AN12681 and SBL&SFW user guide.

AN12681 show you how to sign your secure bootloader(could base on SBL). SBL&SFW user guide show you how to make a signed application(SFW) and how SBL verify it. So, it's a combine of two things.

Regards,

Jing 

[Rudy25]

Hello @jingpan ,

Can you please provide the link of the documents that you mentioned?

Thank you.

Regards,

Rudy

[jingpan]

Hi @Rudy25 ,

https://www.nxp.com/docs/en/user-guide/MCUOTASBLSFWUG.pdf

https://www.nxp.com/webapp/sps/download/mod_download.jsp?colCode=AN12681&location=null&appType=moder...

Regards,

Jing