Secure Boot Chain¶

meta-tolomeo implements a two-stage authenticated boot chain: the first stage is hardware-specific and covers the path from the silicon BootROM to the bootloader, the second is generic and covers the path from U-Boot to the Linux kernel. Each stage authenticates the next component in the chain before handing over execution.

The Trust Chain¶

BootROM → SPL / U-Boot  (Stage 1 — NXP HAB4 or AHAB)
U-Boot  → Linux kernel  (Stage 2 — U-Boot FIT signature)

Stage 1 is enforced by hardware: the i.MX BootROM will not execute a bootloader container that does not pass signature verification. Stage 2 is enforced by U-Boot firmware: a kernel FIT image that does not carry a valid RSA signature is rejected before the kernel is started.

Both stages are gated by the secure-boot distro feature and are inactive in development builds that do not set it.

Stage 1 — BootROM to Bootloader (NXP i.MX)¶

The i.MX BootROM holds a hash of the Super Root Key (SRK) set burned permanently into device fuses during manufacturing. At every power-on, the BootROM verifies the cryptographic signature of the SPL/U-Boot container against that fused hash before transferring execution. A container that fails verification causes the BootROM to halt.

meta-tolomeo supports two NXP signing protocols depending on the i.MX device family:

HAB4 — i.MX8M (mx8-generic-bsp)¶

High Assurance Boot version 4, used on i.MX8M Plus and related i.MX8M variants. The signing tool is the NXP Code Signing Tool (CST). The U-Boot config fragment enables CONFIG_IMX_HAB.

External reference: NXP Code Signing Tool (CST) documentation

AHAB — i.MX9 (mx9-generic-bsp)¶

Advanced High Assurance Boot, used on i.MX93 and other i.MX9 variants. Authentication is delegated to the EdgeLock Enclave (ELE), a dedicated security subsystem on the SoC. The signing tool is the NXP Secure Provisioning SDK (SPSDK). The U-Boot config fragment enables CONFIG_AHAB_BOOT.

External references:

• NXP SPSDK documentation

Stage 2 — U-Boot to Linux Kernel (FIT Signature)¶

The Linux kernel, device trees, and optional firmware are packaged into a FIT (Flattened Image Tree) image at build time. The build system signs the FIT image with an RSA private key and embeds the corresponding public key into U-Boot's own device tree.

At boot time, U-Boot reads the embedded public key and verifies the FIT image signature before loading the kernel. A FIT image without a valid signature, or signed with an unknown key, is rejected.

This mechanism is not NXP-specific. It applies to any BSP that inherits kernel_fitimage_mcore and enables UBOOT_SIGN_ENABLE.

The secure-boot Distro Feature¶

Adding secure-boot to DISTRO_FEATURES is the single switch that activates the full chain:

• Enables the HAB/AHAB U-Boot config fragment (CONFIG_IMX_HAB or CONFIG_AHAB_BOOT)
• Enables FIT image signing at build time (UBOOT_SIGN_ENABLE = "1")
• Activates the imx-boot-signature recipe, which produces the signed NXP boot image

Builds without secure-boot produce unsigned images and are suitable for development and emulation targets (e.g. QEMU) where hardware authentication is not available.

Development Keys¶

DAVE provides pre-generated key material under devel-keys/ for build validation without requiring production key infrastructure: