AnsweredAssumed Answered

Signed Unencrypted U-boot for iMX28

Question asked by kamel B on May 19, 2017
Latest reply on May 22, 2017 by Yuri Muhin

Hi,

 

Im looking for a way to boot on a signed unencrypt U-boot, I have done the following steps :

1. Set OTP setting using MFGTool :

# force HAB authentication
hw_ocotp_rom7 = 0x00300000

# enable unencrypted boot
hw_ocotp_rom0 = 0x00000010

2. For the signing keys I followed instruction  Problems with i.MX28 High Assurance Boot , so I have all keys ok

3. Generated U-boot binaries (u-boot-spl.bin and u-boot.bin) using target "make u-boot-signed.sb" (u-boot-2016-05)

 

4. The target "u-boot-signed" is encrypt :

$ sbtool -x 2 u-boot-signed.sb
---- Boot image header ----
Signature 1:           STMP
Signature 2:           sgtl
Format version:        1.1
Flags:                 0x0001
Image blocks:          35944
First boot tag block:  9
First boot section ID: 0x00000000
Key count:             1
Key dictionary block:  7
Header blocks:         6
Section count:         1
Section header size:   1
Timestamp:             531932795000000
Product version:       999.999.999
Component version:     999.999.999
Drive tag:             0x0000
SHA-1 digest of header:
    0x00000000: 6e 26 45 72 f5 02 ef ac 95 00 d4 f2 b6 d8 2c ac
    0x00000010: c7 5a 81 bd
Header digest is correct.

---- Section table ----
Section 0:
    Identifier: 0x0
    Offset:     10 blocks (160 bytes)
    Length:     35932 blocks (574912 bytes)
    Flags:      0x00000001
                0x1 = ROM_SECTION_BOOTABLE

---- Key dictionary ----
error: the image is encrypted but no key was provided

so I used elftosb to get an unencrypt bootsream like below :

$ elftosb -V -d -f imx28 -c ./arch/arm/cpu/arm926ejs/mxs/u-boot-imx28.bd -o u-boot_unencrypt.sb
source u_boot_spl => path(spl/u-boot-spl.bin)
source u_boot => path(u-boot.bin)
Boot Section 0x00000000:
  LOAD | adr=0x00000000 | len=0x000021c0 | crc=0x0d86a13e | flg=0x00000000
  LOAD | adr=0x00008000 | len=0x00000020 | crc=0x88d2e4d7 | flg=0x00000000
  CALL | adr=0x00008000 | arg=0x00000000 | flg=0x00000001
  LOAD | adr=0x40000100 | len=0x00088480 | crc=0x40fa530b | flg=0x00000000
  LOAD | adr=0x00008000 | len=0x00000020 | crc=0xf66ee67b | flg=0x00000000
  CALL | adr=0x00008000 | arg=0x00000000 | flg=0x00000001

Here the detail of the unencrypt bootstream:

$ sbtool -x 2 u-boot_unencrypt.sb
---- Boot image header ----
Signature 1:           STMP
Signature 2:           sgtl
Format version:        1.1
Flags:                 0x0000
Image blocks:          35448
First boot tag block:  7
First boot section ID: 0x00000000
Key count:             0
Key dictionary block:  7
Header blocks:         6
Section count:         1
Section header size:   1
Timestamp:             546699162000000
Product version:       999.999.999
Component version:     999.999.999
Drive tag:             0x0000
SHA-1 digest of header:
    0x00000000: bc fc 49 d4 14 67 95 0e 37 49 97 e0 03 35 6c ae
    0x00000010: 70 ec 87 75
Header digest is correct.

---- Section table ----
Section 0:
    Identifier: 0x0
    Offset:     8 blocks (128 bytes)
    Length:     35438 blocks (567008 bytes)
    Flags:      0x00000001
                0x1 = ROM_SECTION_BOOTABLE

---- SHA-1 digest of entire image ----
    0x00000000: 7e f3 88 d8 37 df 96 e7 a6 65 89 28 53 47 68 cb
    0x00000010: 20 5d 38 a0
Image digest is correct.

---- Boot tags ----
0000: @ block 000007 | id=0x00000000 | length=035438 | flags=0x00000001
        0x1 = ROM_SECTION_BOOTABLE

 

When I tried to boot on this bootstream using mxsldr or mfgtool, Im getting ROM error code 0X80501010 (Request data beyond the end of a section).

 

Question: How do we generate a signed unencrypted U-boot Bootstream for iMX28 ?

 

Best Regards,

KB

Outcomes