Verified Boot on i.MX6

Create vmlinux.bin

$ arm-linux-gnueabi-objcopy -O binary vmlinux vmlinux.bin

$ gzip vmlinux.bin

$ cp imx6q-icore-rqs.dtb imx6q-icore-rqs-pubkey.dtb

FIT input

kernel_fdt.its

/* Simple U-Boot uImage source file containing a single kernel and FDT blob */

/dts-v1/;

/ {

    description = "Verified RSA image with single Linux kernel and FDT blob";

    #address-cells = <1>;

    images {

        kernel@1 {

            description = "i.MX6 Linux kernel";

            data = /incbin/("./vmlinux.bin.gz");

            type = "kernel";

            arch = "arm";

            os = "linux";

            compression = "gzip";

            load = <0x10008000>;

            entry = <0x10008000>;

            hash@1 {

                algo = "md5";

            };

            hash@2 {

                algo = "sha1";

            };

            signature@1 {

                algo = "sha1,rsa2048";

                key-name-hint = "eng";

            };

        };

        fdt@1 {

            description = "Engicam i.CoreM6 Quad/Dual RQS Starter Kit Devicetree blob";

            data = /incbin/("./imx6q-icore-rqs.dtb");

            type = "flat_dt";

            arch = "arm";

            compression = "none";

            hash@1 {

                algo = "md5";

            };

            hash@2 {

                algo = "sha1";

            };

            signature@1 {

                algo = "sha1,rsa2048";

                key-name-hint = "eng";

            };

        };

    };

    configurations {

        default = "conf@1";

        conf@1 {

            description = "Boot Linux kernel with FDT blob";

            kernel = "kernel@1";

            fdt = "fdt@1";

        };

    };

};

RSA key generation

- Create RSA key pair
$ mkdir mykeys
$ openssl genrsa -F4 -out mykeys/eng.key 2048

- Create a certificate contains public key

$ openssl req  -batch -new -x509 -key mykeys/eng.key -out mykeys/eng.crt

FIT output

$ ./mkimage -f kernel_fdt.its -K imx6q-icore-rqs-pubkey.dtb -k mykeys/ -r fit.itb

Build U-Boot with Public key

$ .make DEV_TREE_BIN=../imx6q-icore-rqs-pubkey.dtb

Boot VerifiedBoot

U-Boot SPL 2017.01-rc2-00010-gb42d823 (Dec 21 2016 - 11:13:46)
Trying to boot from MMC1

U-Boot 2017.01-rc2-00010-gb42d823 (Dec 21 2016 - 11:13:46 +0100)

CPU:   Freescale i.MX6D rev1.2 at 792 MHz
Reset cause: POR
Model: Engicam i.CoreM6 Quad/Dual RQS Starter Kit
DRAM:  512 MiB
MMC:   FSL_SDHC: 0
*** Warning - bad CRC, using default environment

In:    serial
Out:   serial
Err:   serial
Net:   No ethernet found.
Hit any key to stop autoboot:  0
switch to partitions #0, OK
mmc0 is current device
reading boot.scr
** Unable to read file boot.scr **
reading fit.itb
6167494 bytes read in 335 ms (17.6 MiB/s)
Booting FIT image from mmc ...
## Loading kernel from FIT Image at 12000000 ...
   Using 'conf@1' configuration
   Verifying Hash Integrity ... OK
   Trying 'kernel@1' kernel subimage
     Description:  i.MX6 Linux kernel
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x120000f0
     Data Size:    6130148 Bytes = 5.8 MiB
     Architecture: ARM
     OS:           Linux
     Load Address: 0x10008000
     Entry Point:  0x10008000
     Hash algo:    md5
     Hash value:   b975a202ea2963c53c53f527329930cd
     Hash algo:    sha1
     Hash value:   78b93fe404b795de8c837af27d67f4df9b96083a
     Sign algo:    sha1,rsa2048:eng
     Sign value:   4288ce2c7380a90b7b7b9c000760f086fe67560d16fb5ea85bc792ff3ed70e381956bbff99c514213e00e3d21838650ada0eb68439e253ef493e3e0098e0d47109d3e
   Verifying Hash Integrity ... md5+ sha1+ sha1,rsa2048:eng- OK
## Loading fdt from FIT Image at 12000000 ...
   Using 'conf@1' configuration
   Trying 'fdt@1' fdt subimage
     Description:  Engicam i.CoreM6 Quad/Dual RQS Starter Kit Devicetree blob
     Type:         Flat Device Tree
     Compression:  uncompressed
     Data Start:   0x125d8dbc
     Data Size:    35298 Bytes = 34.5 KiB
     Architecture: ARM
     Hash algo:    md5
     Hash value:   4371a4dfe55127c2fda8a9feb4d3b313
     Hash algo:    sha1
     Hash value:   e34a9326b5e7fd43557753ef980fe67326f82ea1
     Sign algo:    sha1,rsa2048:eng
     Sign value:   94cebd60a6ff2e123ed763760b88c026b74b12eb9c37a97d73eec1a25e01d6e29284f393c5ca20951a605378bf8b547bdc0ce0aae16e069e6db0c5af7f00d4cfc6c94
   Verifying Hash Integrity ... md5+ sha1+ sha1,rsa2048:eng- OK
   Booting using the fdt blob at 0x125d8dbc
   Uncompressing Kernel Image ... OK
   Using Device Tree in place at 125d8dbc, end 125e479d

Starting kernel ...

[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 4.9.0-next-20161216-dirty (root@jagan-XPS-13-9350) (gcc version 4.7.1 20120402 (prerelease) (crosstool-NG linaro-1.13.1-206
[    0.000000] CPU: ARMv7 Processor [412fc09a] revision 10 (ARMv7), cr=10c5387d
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt:Machine model: Engicam i.CoreM6 Quad SOM
[    0.000000] cma: Reserved 64 MiB at 0x2c000000
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] percpu: Embedded 14 pages/cpu @dbb9d000 s26816 r8192 d22336 u57344
[    0.000000] Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 130048
[    0.000000] Kernel command line: console=ttymxc3,115200 root=/dev/mmcblk0p2 rootwait rw
[    0.000000] PID hash table entries: 2048 (order: 1, 8192 bytes)
[    0.000000] Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)

[    3.750068]   #0: imx-audio-sgtl5000
[    3.765128] EXT4-fs (mmcblk0p2): couldn't mount as ext3 due to feature incompatibilities
[    3.807473] usb 1-1: device descriptor read/64, error -71
[    4.020338] EXT4-fs (mmcblk0p2): mounted filesystem with ordered data mode. Opts: (null)
[    4.028685] VFS: Mounted root (ext4 filesystem) on device 179:2.
[    4.038301] devtmpfs: mounted
[    4.044169] Freeing unused kernel memory: 1024K
INIT: [    4.177458] usb 1-1: device descriptor read/64, error -71
version 2.88 booting
[    4.437640] usb 1-1: new full-speed USB device number 3 using ci_hdrc
mount: mount point /mnt/.psplash does not exist
[    4.677537] usb 1-1: device descriptor read/64, error -71
Starting udev