Security is becoming a growing concern, especially when these devices connect to the Internet: how to protect data from tampering, how to protect FW from malicious damage, how to ensure that the device can start safely... these are security considerations.
This topic mainly introduces the Security Boot mechanism.

Security Boot

For security consideration, it is necessary that the hardware have some mechanism to ensure that the software it is running can be trusted.
NXP i.MX6 series chip provides High Assurance Boot (HAB) feature which meets such a requirement. OEM can utilize it to make their product reject any system image which is not authorized for running.

You can refer to i.MX_6_Linux_High_Assurance_Boot_(HAB)_User's_Guide.pdf for more details.
In this topic, we mainly introduce how to implement and test security boot.

Signature

Setup CST environment

Unpack the Code Signing Tools (CST) package:
```
tar -xvf cst-2.3.2.tar.gz
cd cst-2.3.2/keys
```

2. Create required files:

   * Create a text file called `serial`, which contains 8 digits. Example:

     ```text
     12356789
     ```

   * Create a text file called `key_pass.txt`, which contains two identical lines:

     ```bash
     cat key_pass.txt
     advantech_test
     advantech_test
     ```

   * Run:

     ```bash
     ./hab4_pki_tree.sh
     ```

     Enter the following answers: `n`, `n`, `4096`, `10`, `4`, `y`.

3. Generate SRK table and fuse binary:

   ```bash
   cd ../crts
   ../linux64/srktool -h 4 \
     -t SRK_1_2_3_4_table.bin \
     -e SRK_1_2_3_4_fuse.bin \
     -d sha256 \
     -c ./SRK1_sha256_4096_65537_v3_ca_crt.pem,./SRK2_sha256_4096_65537_v3_ca_crt.pem,./SRK3_sha256_4096_65537_v3_ca_crt.pem,./SRK4_sha256_4096_65537_v3_ca_crt.pem \
     -f 1
   ```

   This generates:

   * `SRK_1_2_3_4_table.bin` (root public key file)
   * `SRK_1_2_3_4_fuse.bin` (hash for eFuse burning)

   **NOTE**: Do not leave spaces between PEM file names.

   Example check:

   ```bash
   hexdump -C SRK_1_2_3_4_fuse.bin
   ```

---

### Build secure images

1. Build u-boot and kernel image for i.MX6 project (e.g., RSB-4411).

   Setup cross compile environment:
   [Yocto Cross Compile Setup](http://ess-wiki.advantech.com.tw/view/IoTGateway/BSP/Linux/iMX6/Yocto_LBV8_User_Guide#Setting_up_cross_compiling_environment)

2. Get and build **u-boot**:

   ```bash
   git clone https://github.com/ADVANTECH-Corp/uboot-imx6.git -b imx_v2016.03_4.1.15_2.0.0_ga
   cd uboot-imx6/
   source /opt/poky/2.1/environment-setup-cortexa9hf-neon-poky-linux-gnueabi
   ```

   Ensure `CONFIG_SECURE_BOOT` is enabled in `./include/configs/mx6xxxx.h`:

   ```c
   #define CONFIG_SECURE_BOOT
   #ifdef CONFIG_SECURE_BOOT
   #ifndef CONFIG_CSF_SIZE
   #define CONFIG_CSF_SIZE 0x4000
   #endif
   #endif
   ```

   Build SPL and u-boot:

   ```bash
   make mx6qrsb4411a1_1G_defconfig
   make -j4 V=1 u-boot.imx all
   ```

3. Get and build **kernel**:

   ```bash
   git clone https://github.com/ADVANTECH-Corp/linux-imx6.git -b imx_4.1.15_2.0.0_ga
   cd linux-imx6/
   source /opt/poky/2.1/environment-setup-cortexa9hf-neon-poky-linux-gnueabi
   make imx_v7_adv_defconfig
   make -j4 zImage
   ```

   Output: `arch/arm/boot/zImage`

---

## Sign u-boot image

1. Copy SPL (`SPL`) and u-boot (`u-boot_crc.bin`, `u-boot_crc.bin.crc`) to `~/cst-2.3.2/linux64/`

2. Copy `spl.csf` to `~/cst-2.3.2/linux64/`
   Edit `Blocks =` line with correct HAB blocks.

3. Generate signed SPL:

   ```bash
   ./habsplimagegen.sh
   ```

   Output: `spl_signed`

4. Copy `uboot_normal.csf` to `~/cst-2.3.2/linux64/`
   Edit `Blocks =` line with correct size.

5. Generate signed u-boot:

   ```bash
   ./habubootimagegen.sh
   ```

   Output: `u-boot_normal_signed.bin`

---

## Sign kernel image

1. Copy `zImage` to `cst-2.3.2/linux64/`

2. Update `genIVT` with zImage size:

   ```bash
   hexdump -C zImage | tail -n 1
   ```

3. Copy `zImage.csf` to `cst-2.3.2/linux64/`
   Edit `Blocks =` line.

4. Generate signed kernel:

   ```bash
   ./habZimagegen.sh
   ```

   Output: `zImage_signed`

---

## Burn

1. Copy `spl_signed`, `u-boot_crc.bin.crc`, `u-boot_normal_signed.bin`, `zImage_signed` to USB

2. Burn SRK fuse:

   ```bash
   hexdump -e '/4 "0x"' -e '/4 "%X""\n"' < SRK_1_2_3_4_fuse.bin
   ```

   Example result:

   ```text
   0x2661F579
   0xE9D4CD6F
   0xFF06D2AE
   0x40EAF85B
   0x97321C01
   0xB06BE30E
   0xC81EC013
   0xCC37EB88
   ```

   Burn to eFuse:

   ```bash
   echo 0x2661F579 > HW_OCOTP_SRK0
   echo 0xE9D4CD6F > HW_OCOTP_SRK1
   ...
   echo 0xCC37EB88 > HW_OCOTP_SRK7
   ```

   Verify:

   ```bash
   ls | grep "SRK.$" | xargs cat
   ```

3. Burn SPL:

   ```bash
   flash_erase /dev/mtd0 0 192
   dd if=spl_signed of=/dev/mtd0 bs=512 seek=2
   sync
   ```

4. Burn u-boot:

   ```bash
   dd if=u-boot_crc.bin.crc of=/dev/mmcblk0 bs=512 seek=2 conv=fsync
   dd if=u-boot_normal_signed.bin of=/dev/mmcblk0 bs=512 seek=3 conv=fsync
   sync
   ```

5. Burn kernel:

   ```bash
   cp zImage_signed /dev/mmcblk0p1/zImage
   sync
   ```

---

## Test

1. Boot and stop in u-boot, check HAB status:

   ```bash
   => hab_status
   Secure boot disabled
   HAB Configuration: 0xf0, HAB State: 0x66
   No HAB Events Found!
   ```

2. Turn on chip HAB:

   ```bash
   cd /sys/fsl_otp
   echo 0x00040000 > HW_OCOTP_MEM0
   echo 0x2 > HW_OCOTP_CFG5
   cat HW_OCOTP_CFG5   # should show 0x2
   ```

3. Reboot and check HAB again:

   ```bash
   => hab_status
   Secure boot enabled
   HAB Configuration: 0xcc, HAB State: 0x99
   No HAB Events Found!
   ```

4. Test kernel authentication:

   ```bash
   => load mmc 0 10800000 zImage
   => hab_auth_img 10800000 0x639000
   ```

   Should show successful authentication.

Signature​

Setup CST environment​

Signature

Setup CST environment