Changes between Version 43 and Version 44 of venice/secure_boot

Timestamp:

10/07/2025 05:04:35 PM (7 weeks ago)

Author:

Ryan Erbstoesser

Comment:

add a few comments for cst, etc

venice/secure_boot

@@ -97 +97 @@
  1. Creation of Code Signing Key: '''This is an example - read the CST documentation and tailor to your needs'''
   a. Retrieve the NXP Code Signing Tool (CST): https://www.nxp.com/webapp/Download?colCode=IMX_CST_TOOL_NEW (Account required on NXP site)
-  b. Unpack the CST :
+  b. Unpack the CST : (versions may change over time)
 {{{#!bash
 tar xvf cst-3.4.0.tgz
@@ -150 +150 @@
 {{{#!bash
 # setup env to point to the CST
-export CST_DIR=/usr/src/nxp/cst-3.4.0
+export CST_DIR=/usr/src/nxp/cst-3.4.0 #ADJUST TO POINT TO ACTUAL DIRECTORY 
 export CST_BIN=$CST_DIR/linux64/bin/cst
 export CSF_KEY=$CST_DIR/crts/CSF1_1_sha256_4096_65537_v3_usr_crt.pem
@@ -167 +167 @@
 cp $VENICE_BSP/atf/build/imx8mm/release/bl31.bin . # ATF
 # configure for venice board
-make imx8mm_venice_defconfig
+make imx8mm_venice_defconfig #SEE NOTE BELOW FOR imx8mp
 make menuconfig # select CONFIG_IMX_HAB=y
 make flash.bin
@@ -180 +180 @@
 < # CONFIG_CMD_DEKBLOB is not set
 }}}
-   - note that the above is for imx8mm (you need to copy the ATF from the imx8mp directory and use imx8mp_venice_defconfig if you are using imx8mp for example)
- 3. create a signed_flash.bin (required prior to v2024.10; for v2024.10-venice branch you can skip this step as it signs it automatically
+   - NOTE that the above is for imx8mm (you need to copy the ATF from the imx8mp directory and use imx8mp_venice_defconfig if you are using imx8mp for example)
+ 3. Create a signed_flash.bin (required prior to v2024.10; for v2024.10-venice branch you can skip this step as it signs it automatically
 {{{#!bash
 # sign flash.bin (if U-Boot version is less than v2024.10 where automated signing was introduced if CONFIG_IMX_HAB=y)
@@ -226 +226 @@
 No HAB Events Found!
 }}}
-  - Note the 'hab fuse not enabled' message which means the SEC_CONFIG[1] fuse is not blown and the device is not locked
+  - Note the 'hab fuse not enabled' message which means the !SEC_CONFIG[1] fuse is not blown and the device is not locked
   - Note the 'Authenticate image from DDR location' messages which shows that image authentication is able to be used
  5. Program SRK Hash fuses from Step 1 into IMX OTP (using U-Boot and the keys from fuse bin)