[people/ms/u-boot.git] / doc / README.mxc_hab

High Assurance Boot (HAB) for i.MX6 CPUs

To authenticate U-Boot only by the CPU there is no code required in
U-Boot itself. However, the U-Boot image to be programmed into the
boot media needs to be properly constructed, i.e. it must contain a
proper Command Sequence File (CSF).

The Initial Vector Table contains a pointer to the CSF. Please see
doc/README.imximage for how to prepare u-boot.imx.

The CSF itself is being generated by Freescale HAB tools.

mkimage will output additional information about "HAB Blocks"
which can be used in the Freescale tooling to authenticate U-Boot
(entries in the CSF file).

Image Type:   Freescale IMX Boot Image
Image Ver:    2 (i.MX53/6 compatible)
Data Size:    327680 Bytes = 320.00 kB = 0.31 MB
Load Address: 177ff420
Entry Point:  17800000
HAB Blocks:   177ff400 00000000 0004dc00
	      ^^^^^^^^ ^^^^^^^^ ^^^^^^^^
		|	|	   |
		|	|	   -------- (1)
		|	|
		|	------------------- (2)
		|
		--------------------------- (3)

(1)	Size of area in file u-boot.imx to sign
	This area should include the IVT, the Boot Data the DCD
	and U-Boot itself.
(2)	Start of area in u-boot.imx to sign
(3)	Start of area in RAM to authenticate

CONFIG_SECURE_BOOT currently enables only an additional command
'hab_status' in U-Boot to retrieve the HAB status and events. This
can be useful while developing and testing HAB.

Commands to generate a signed U-Boot using Freescale HAB tools:
cst --o U-Boot_CSF.bin < U-Boot.CSF
objcopy -I binary -O binary --pad-to 0x2000 --gap-fill=0x00 \
	U-Boot_CSF.bin U-Boot_CSF_pad.bin
cat u-boot.imx U-Boot_CSF_pad.bin > u-boot-signed.imx

NOTE: U-Boot_CSF.bin needs to be padded to the value specified in
the imximage.cfg file.
Commit	Line	Data
0187c985 SB	1	High Assurance Boot (HAB) for i.MX6 CPUs
	2
	3	To authenticate U-Boot only by the CPU there is no code required in
	4	U-Boot itself. However, the U-Boot image to be programmed into the
	5	boot media needs to be properly constructed, i.e. it must contain a
	6	proper Command Sequence File (CSF).
	7
	8	The Initial Vector Table contains a pointer to the CSF. Please see
	9	doc/README.imximage for how to prepare u-boot.imx.
	10
	11	The CSF itself is being generated by Freescale HAB tools.
	12
	13	mkimage will output additional information about "HAB Blocks"
	14	which can be used in the Freescale tooling to authenticate U-Boot
	15	(entries in the CSF file).
	16
	17	Image Type: Freescale IMX Boot Image
	18	Image Ver: 2 (i.MX53/6 compatible)
	19	Data Size: 327680 Bytes = 320.00 kB = 0.31 MB
	20	Load Address: 177ff420
	21	Entry Point: 17800000
	22	HAB Blocks: 177ff400 00000000 0004dc00
93e14596	23	^^^^^^^^ ^^^^^^^^ ^^^^^^^^
0187c985 SB	24	\| \| \|
	25	\| \| -------- (1)
	26	\| \|
	27	\| ------------------- (2)
	28	\|
	29	--------------------------- (3)
	30
	31	(1) Size of area in file u-boot.imx to sign
	32	This area should include the IVT, the Boot Data the DCD
	33	and U-Boot itself.
	34	(2) Start of area in u-boot.imx to sign
	35	(3) Start of area in RAM to authenticate
	36
	37	CONFIG_SECURE_BOOT currently enables only an additional command
	38	'hab_status' in U-Boot to retrieve the HAB status and events. This
	39	can be useful while developing and testing HAB.
	40
	41	Commands to generate a signed U-Boot using Freescale HAB tools:
	42	cst --o U-Boot_CSF.bin < U-Boot.CSF
	43	objcopy -I binary -O binary --pad-to 0x2000 --gap-fill=0x00 \
	44	U-Boot_CSF.bin U-Boot_CSF_pad.bin
	45	cat u-boot.imx U-Boot_CSF_pad.bin > u-boot-signed.imx
	46
	47	NOTE: U-Boot_CSF.bin needs to be padded to the value specified in
	48	the imximage.cfg file.