xref: /openbmc/u-boot/doc/imx/habv4/guides/encrypted_boot.txt (revision b89074f65047c4058741ed2bf3e6ff0c5af4c5bc)
1*364c0a89SBreno Matheus Lima1. Setup U-Boot Image for Encrypted Boot
2*364c0a89SBreno Matheus Lima----------------------------------------
3*364c0a89SBreno Matheus LimaAn authenticated U-Boot image is used as starting point for
4*364c0a89SBreno Matheus LimaEncrypted Boot. The image is encrypted by i.MX Code Signing
5*364c0a89SBreno Matheus LimaTool (CST). The CST replaces only the image data of
6*364c0a89SBreno Matheus Limau-boot-dtb.imx with the encrypted data. The Initial Vector Table,
7*364c0a89SBreno Matheus LimaDCD, and Boot data, remains in plaintext.
8*364c0a89SBreno Matheus Lima
9*364c0a89SBreno Matheus LimaThe image data is encrypted with a Encryption Key (DEK).
10*364c0a89SBreno Matheus LimaTherefore, this key is needed to decrypt the data during the
11*364c0a89SBreno Matheus Limabooting process. The DEK is protected by wrapping it in a Blob,
12*364c0a89SBreno Matheus Limawhich needs to be appended to the U-Boot image and specified in
13*364c0a89SBreno Matheus Limathe CSF file.
14*364c0a89SBreno Matheus Lima
15*364c0a89SBreno Matheus LimaThe DEK blob is generated by an authenticated U-Boot image with
16*364c0a89SBreno Matheus Limathe dek_blob cmd enabled. The image used for DEK blob generation
17*364c0a89SBreno Matheus Limaneeds to have the following configurations enabled in Kconfig:
18*364c0a89SBreno Matheus Lima
19*364c0a89SBreno Matheus LimaCONFIG_SECURE_BOOT=y
20*364c0a89SBreno Matheus LimaCONFIG_CMD_DEKBLOB=y
21*364c0a89SBreno Matheus Lima
22*364c0a89SBreno Matheus LimaNote: The encrypted boot feature is only supported by HABv4 or
23*364c0a89SBreno Matheus Limagreater.
24*364c0a89SBreno Matheus Lima
25*364c0a89SBreno Matheus LimaThe dek_blob command then can be used to generate the DEK blob of
26*364c0a89SBreno Matheus Limaa DEK previously loaded in memory. The command is used as follows:
27*364c0a89SBreno Matheus Lima
28*364c0a89SBreno Matheus Limadek_blob <DEK address> <Output Address> <Key Size in Bits>
29*364c0a89SBreno Matheus Limaexample: dek_blob 0x10800000 0x10801000 192
30*364c0a89SBreno Matheus Lima
31*364c0a89SBreno Matheus LimaThe resulting DEK blob then is used to construct the encrypted
32*364c0a89SBreno Matheus LimaU-Boot image. Note that the blob needs to be transferred back
33*364c0a89SBreno Matheus Limato the host.Then the following commands are used to construct
34*364c0a89SBreno Matheus Limathe final image.
35*364c0a89SBreno Matheus Lima
36*364c0a89SBreno Matheus Limacat u-boot-dtb.imx csf-u-boot.bin > u-boot-signed.imx
37*364c0a89SBreno Matheus Limaobjcopy -I binary -O binary --pad-to <blob_dst> --gap-fill=0x00 \
38*364c0a89SBreno Matheus Lima    u-boot-signed.imx u-boot-signed-pad.bin
39*364c0a89SBreno Matheus Limacat u-boot-signed-pad.imx DEK_blob.bin > u-boot-encrypted.imx
40*364c0a89SBreno Matheus Lima
41*364c0a89SBreno Matheus Lima    NOTE: u-boot-signed.bin needs to be padded to the value
42*364c0a89SBreno Matheus Lima    equivalent to the address in which the DEK blob is specified
43*364c0a89SBreno Matheus Lima    in the CSF.
44