1*364c0a89SBreno Matheus Lima1. Setup U-Boot Image for Encrypted Boot 2*364c0a89SBreno Matheus Lima---------------------------------------- 3*364c0a89SBreno Matheus LimaAn authenticated U-Boot image is used as starting point for 4*364c0a89SBreno Matheus LimaEncrypted Boot. The image is encrypted by i.MX Code Signing 5*364c0a89SBreno Matheus LimaTool (CST). The CST replaces only the image data of 6*364c0a89SBreno Matheus Limau-boot-dtb.imx with the encrypted data. The Initial Vector Table, 7*364c0a89SBreno Matheus LimaDCD, and Boot data, remains in plaintext. 8*364c0a89SBreno Matheus Lima 9*364c0a89SBreno Matheus LimaThe image data is encrypted with a Encryption Key (DEK). 10*364c0a89SBreno Matheus LimaTherefore, this key is needed to decrypt the data during the 11*364c0a89SBreno Matheus Limabooting process. The DEK is protected by wrapping it in a Blob, 12*364c0a89SBreno Matheus Limawhich needs to be appended to the U-Boot image and specified in 13*364c0a89SBreno Matheus Limathe CSF file. 14*364c0a89SBreno Matheus Lima 15*364c0a89SBreno Matheus LimaThe DEK blob is generated by an authenticated U-Boot image with 16*364c0a89SBreno Matheus Limathe dek_blob cmd enabled. The image used for DEK blob generation 17*364c0a89SBreno Matheus Limaneeds to have the following configurations enabled in Kconfig: 18*364c0a89SBreno Matheus Lima 19*364c0a89SBreno Matheus LimaCONFIG_SECURE_BOOT=y 20*364c0a89SBreno Matheus LimaCONFIG_CMD_DEKBLOB=y 21*364c0a89SBreno Matheus Lima 22*364c0a89SBreno Matheus LimaNote: The encrypted boot feature is only supported by HABv4 or 23*364c0a89SBreno Matheus Limagreater. 24*364c0a89SBreno Matheus Lima 25*364c0a89SBreno Matheus LimaThe dek_blob command then can be used to generate the DEK blob of 26*364c0a89SBreno Matheus Limaa DEK previously loaded in memory. The command is used as follows: 27*364c0a89SBreno Matheus Lima 28*364c0a89SBreno Matheus Limadek_blob <DEK address> <Output Address> <Key Size in Bits> 29*364c0a89SBreno Matheus Limaexample: dek_blob 0x10800000 0x10801000 192 30*364c0a89SBreno Matheus Lima 31*364c0a89SBreno Matheus LimaThe resulting DEK blob then is used to construct the encrypted 32*364c0a89SBreno Matheus LimaU-Boot image. Note that the blob needs to be transferred back 33*364c0a89SBreno Matheus Limato the host.Then the following commands are used to construct 34*364c0a89SBreno Matheus Limathe final image. 35*364c0a89SBreno Matheus Lima 36*364c0a89SBreno Matheus Limacat u-boot-dtb.imx csf-u-boot.bin > u-boot-signed.imx 37*364c0a89SBreno Matheus Limaobjcopy -I binary -O binary --pad-to <blob_dst> --gap-fill=0x00 \ 38*364c0a89SBreno Matheus Lima u-boot-signed.imx u-boot-signed-pad.bin 39*364c0a89SBreno Matheus Limacat u-boot-signed-pad.imx DEK_blob.bin > u-boot-encrypted.imx 40*364c0a89SBreno Matheus Lima 41*364c0a89SBreno Matheus Lima NOTE: u-boot-signed.bin needs to be padded to the value 42*364c0a89SBreno Matheus Lima equivalent to the address in which the DEK blob is specified 43*364c0a89SBreno Matheus Lima in the CSF. 44