u-boot/doc/README.mxc_hab

1 High Assurance Boot (HAB) for i.MX6 CPUs
3 To enable the authenticated or encrypted boot mode of U-Boot, it is
9 In addition, the U-Boot image to be programmed into the
10 boot media needs to be properly constructed, i.e. it must contain a
14 doc/README.imximage for how to prepare u-boot.imx.
19 which can be used in the Freescale tooling to authenticate U-Boot
22 Image Type:   Freescale IMX Boot Image
36 (1)	Size of area in file u-boot.imx to sign
37 	This area should include the IVT, the Boot Data the DCD
38 	and U-Boot itself.
39 (2)	Start of area in u-boot.imx to sign
43 'hab_status' in U-Boot to retrieve the HAB status and events. This
46 Commands to generate a signed U-Boot using Freescale HAB tools:
47 cst --o U-Boot_CSF.bin < U-Boot.CSF
50 cat u-boot.imx U-Boot_CSF_pad.bin > u-boot-signed.imx
55 Setup U-Boot Image for Encrypted Boot
57 An authenticated U-Boot image is used as starting point for
58 Encrypted Boot. The image is encrypted by Freescale's Code
60 u-boot.imx with the encrypted data. The Initial Vector Table,
61 DCD, and Boot data, remains in plaintext.
66 which needs to be appended to the U-Boot image and specified in
69 The DEK blob is generated by an authenticated U-Boot image with
79 Note: The encrypted boot feature is only supported by HABv4 or
89 U-Boot image. Note that the blob needs to be transferred back
95 cat u-boot.imx U-Boot_CSF_pad.bin > u-boot-signed.imx
97     u-boot-signed.imx u-boot-signed-pad.bin
98 cat u-boot-signed-pad.imx DEK_blob.bin > u-boot-encrypted.imx
100     NOTE: u-boot-signed.bin needs to be padded to the value