Skip to content

Commit

Permalink
LFU-637 doc:imx:ahab Add i.MX95 Information to Secure Boot documentation
Browse files Browse the repository at this point in the history 
Signed-off-by: Elgin Allen <elgin.allen@nxp.com>
  • Loading branch information
@elginnxp
elginnxp committed Jan 16, 2024
1 parent 9e960b1 commit c1665b4
Showing 1 changed file with 48 additions and 2 deletions.
50 changes: 48 additions & 2 deletions doc/imx/ahab/guides/mx8ulp_9x_secure_boot.txt
View file
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ Trust by using the AHAB API call via ELE FW.
1.3 Building an image supporting secure boot
------------------------------------------------

A typical singleboot mode image with Cortex-M support contains three containers:
A typical singleboot mode 8ULP/93 image with Cortex-M support contains three containers:

*start ----> +---------------------------+ ---------
| 1st Container header | ^
Expand Down Expand Up @@ -108,6 +108,47 @@ The third container includes the U-Boot proper and the ATF. The SPL is in
charge to load this container and also to interface with ELE FW to authenticate
the additional container.

The image layout for the i.MX95 is very similar to the 8ULP and 93 image with
an additional executable image and V2X FW image:

*start ----> +---------------------------+ ---------
| 1st Container header | ^
| and signature | |
+---------------------------+ |
| Padding for 1kB alignment | |
*start +0x400 ----> +---------------------------+ |
| 2nd Container header | |
| and signature | |
+---------------------------+ |
| Padding for 1kB alignment | |
*start + 0x800 ----> +---------------------------+ |
| 3rd Container header | |
| and signature | | Authenticated at
+---------------------------+ | ELE ROM/FW Level
| Padding | |
+---------------------------+ |
| ELE FW | |
+---------------------------+ |
| V2X FW | |
+---------------------------+ |
| Padding | |
+---------------------------+ |
| Optional Executable Image| |
+---------------------------+ |
| Cortex-M Image | |
+---------------------------+ |
| SPL Image | v
+---------------------------+ ---------
| 4th Container header | ^
| and signature | |
+---------------------------+ |
| Padding | | Authenticated
+---------------------------+ | at SPL Level
| ARM Trusted FW (ATF) | |
+---------------------------+ |
| U-Boot Proper IMG | v
+---------------------------+ ---------

The signing procedure is slightly different when compared with HABv4 series. On
AHAB the signature is directly included in the container, the CST is
responsible to sign and handle the "Signature Block":
Expand Down Expand Up @@ -383,7 +424,7 @@ On i.MX8ULP:
=> fuse prog 15 6 0xe5e804fe
=> fuse prog 15 7 0x7a451024

On i.MX93:
On i.MX93 and i.MX95:

=> fuse prog 16 0 0xdb2959f2
=> fuse prog 16 1 0x90dfc39c
Expand Down Expand Up @@ -418,6 +459,11 @@ a previous step failed. It is also irreversible. Run on the U-Boot terminal:

=> ahab_close

Warning: Please ensure your sample is in NXP closed state, OEM SRK hash has
been fused,and you are able to boot a signed image successfully without any SECO
events reported. If not, your sample will be unrecoverable.


Now reboot the target, and run:

=> ahab_status
Expand Down

0 comments on commit c1665b4

Please sign in to comment.