Enable HABV4 Secure Boot to Yocto Build

Enable HABv4 SecureBoot to Yocto Build

Additional Yocto Build Configuration

Base on Yocto Building Guide, for example Building Yocto for SP2-IMX8MP, there are a few additional settings needed to apply to specific steps in order to enable HABv4 secure boot for NXP-IMX8 Platforms.

Modification to Step 2.3: HAB Setup the yocto build environment for sp2-imx8mp

    $ HAB=1 EULA=1 MACHINE=sp2-imx8mp DISTRO=imx-desktop-xwayland BUILD=<build_dir> source adlink-imx-setup-release.sh

    => Append hab to EXTRA_IMAGE_FEATURES in local.conf (which in turn, set CONFIG_IMX_HAB=y for u-boot build configuration)
    => hook meta-adlink-hab meta layer to bblayer.conf
    => set HAB_VER to habv4 in local.conf

Modification to Step 2.3.1: Required setting in conf/bblayer.conf

    BBLAYERS += "${BSPDIR}/sources/meta-adlink-nxp/meta-adlink-hab"

    => Done by adlink-imx-setup-release.sh

Modification to Step 2.3.2: Additional setting in conf/local.conf

Manually modify CA-Certificates repository setting for imx-boot and linux-imx recipes. Must point to your own generated CA-Certificates in order for modified yocto build process to sign imx-boot(flash.bin) and linux kernel(Image) correctly.

    # your pki keys for signing uboot/spl
    CACERT_REPO:pn-imx-boot = "git://GitLab.Adlinktech.com/EV/adlink-ca-certs.git;user=${PRIVATE_USER}:${PRIVATE_TOKEN}"
    CACERT_SRC:pn-imx-boot = "${CACERT_REPO};protocol=http;branch=${CACERT_BRANCH};name=cacert;destsuffix=${CACERT_DEST};"
    CACERT_BRANCH:pn-imx-boot = "your-ca-branch"
    SRCREV_cacert:pn-imx-boot = "29062578e38659c5ba505c6910ff47f60c4b7a3d"
    CST_KEY_LENGTH:pn-imx-boot = "4096" # if your generate RSA key length is 4096, default is 2048

    # the same pki keys for signing kernel
    CACERT_REPO:pn-linux-imx = "git://GitLab.Adlinktech.com/EV/adlink-ca-certs.git;user=${PRIVATE_USER}:${PRIVATE_TOKEN}"
    CACERT_SRC:pn-linux-imx = "${CACERT_REPO};protocol=http;branch=${CACERT_BRANCH};name=cacert;destsuffix=${CACERT_DEST}"
    CACERT_BRANCH:pn-linux-imx = "your-ca-branch"
    SRCREV_cacert:pn-linux-imx = "29062578e38659c5ba505c6910ff47f60c4b7a3d"
    CST_KEY_LENGTH:pn-linux-imx = "4096" # if your generated RSA key length is 4096, default is 2048

After Step 4: Bitbake Generated Artifacts for HABv4

• flash_evk-csf-fit.bin
• flash_evk-csf-fit.csf
• flash_evk-csf-fit.log
• flash_evk-csf-spl.bin
• flash_evk-csf-spl.csf
• flash_evk-csf-spl.log
• fuse.bin
• fuse.bin.u-boot-cmds [**]
• Image
• Image_pad
• Image_pad_ivt
• Image_signed[*]
• Image.csf
• Image.csf.bin
• imx-boot-sp2-imx8mp-sd.bin-flash_evk
• imx-boot-sp2-imx8mp-sd.bin-flash_evk-signed[*]
• ivt.bin
• mkimage-flash_evk.hab
• mkimage-flash_evk.log
• table.bin

[*]: The final signed flash.bin and kernel image.

[**]: U-boot commands to burn hashed PKI keys to the NXP IMX8 SOC's one-time programmable fuse.

Technical Details of meta-adlink-hab meta-layer

Modification to imx-boox recipe

imx-boox_%.bbappend:

include imx-boot-hab.inc if hab is defined within IMAGE_FEATURES

imx-boot-hab.inc:

• add mx8m_create_csf.sh mx8m_template.csf mx8_create_csf.sh mx8_template.csf mx8_create_fuse_commands.sh scripts to the recipe
• modify SRC_URI to also download ca certificates (specified by CACERT_REPO, CACERT_BRANCH, CACERT_DEST, SRCREV_cacert, CACERT_SRC variables)
• generate CST keys, crts, and ca if existing certificates do not exist
• generate table.bin and fuse.bin if they do not exist
• modify soc.mak script from imx-mkimage to specify platform-specific u-boot dtb (sp2-imx8mp's u-boot device tree)
• create sign_flash_habv4 function that utilize mx8m_create_csf.sh to calculate spl and fit offsets.
• sign flash bin, and generate u-boot fuse command at the end of the do_compile task

Modification to linux-imx recipe

linux-imx_%.bbappend:

include linux-imx-hab.inc if hab is defined within IMAGE_FEATURES

linux-imx-hab.inc:

• add genIVT perl script, default.csf, mx8_template.csf template, mx8_create_csf.sh, and align_image.sh to the recipe
• modify SRC_URI to also download ca certificates (specified by CACERT_REPO, CACERT_BRANCH, CACERT_DEST, SRCREV_cacert, CACERT_SRC variables)
• Recycle and re-use SRK table and fuse table from imx-boot
• create a sign_kernel_habv4 function to 1. Read Kernel Image Size, 2. Pad Kernel Image, 3. Generate IVT using genIVT perl script, 4. append ivt.bin at the end of padded kernel Image, 5. create csf file for signing, 6. create signature, 7. Attach signature to signed kernel Image.
• sign the kernel image after do_compile task