Enable NXP Authenticated Boot¶

Enable HAB4 (i.MX8M) or AHAB (i.MX9) authenticated boot in a custom BSP layer built on top of meta-tolomeo-nxp. This guide covers the BitBake integration steps only.

Prerequisites¶

• meta-tolomeo-nxp included in your layer stack
• SPSDK installed for AHAB targets (i.MX9), or CST for HAB4 targets (i.MX8M):
• SRK key set and signing configuration generated per NXP documentation, or the DAVE development keys available in devel-keys/ for build validation (see Development Keys)

Enable the Distro Feature¶

Add to your distro configuration file or machine configuration file:

DISTRO_FEATURES += "secure-boot"

Include the U-Boot Fragment¶

Add to your u-boot-imx_%.bbappend file inside your BSP layer:

require recipes-bsp/u-boot/u-boot-secure-boot.inc

This include is provided by meta-tolomeo-nxp. It pulls in:

• FIT image signature support (CONFIG_FIT_SIGNATURE=y, CONFIG_RSA=y)
• The HAB/AHAB U-Boot config fragment:
• CONFIG_IMX_HAB=y for i.MX8M (mx8-generic-bsp)
• CONFIG_AHAB_BOOT=y for i.MX9 (mx9-generic-bsp)

Configure the Signing Tool¶

Set the following variables in your kas configuration file or local.conf:

# Path to the SPSDK or CST installation
SIG_TOOL_PATH = "/path/to/spsdk-or-cst"

# Directory containing your signing configuration file
# Defaults to SIG_TOOL_PATH when not set
SIG_DATA_PATH = "${BSPDIR}/keys"

Place your signing configuration file in SIG_DATA_PATH:

The default config filenames can be overridden — see Secure Boot Reference.

Build¶

Run the build as usual. The imx-boot-signature recipe runs automatically when secure-boot is active:

kas build kas/<your-machine>_<your-distro>_<your-image>.yml

The signed boot image is written to the deploy directory:

build/tmp-glibc/deploy/images/<machine>/signed-imx-boot-<machine>.bin

Development Keys¶

DAVE provides pre-generated AHAB key material in devel-keys/ for build validation without requiring a production PKI:

To use the development keys, point SIG_DATA_PATH at devel-keys/:

SIG_DATA_PATH = "${BSPDIR}/devel-keys"