i.MX ProcessorsのトピックRe: imx6 secure boot

i.MX ProcessorsのトピックRe: imx6 secure boot https://community.nxp.com/t5/i-MX-Processors/imx6-secure-boot/m-p/1618214#M202946 <P>Hi <a href="https://community.nxp.com/t5/user/viewprofilepage/user-id/212816">@rakesh3</a>,</P> <DIV> <DIV>I hope you are doing well</DIV> <DIV> </DIV> <DIV>Please find the answer below.</DIV> <DIV> </DIV> <DIV> <DIV>Kindly double-check if the parameters Authenticate Start Address, Offset, and Length in [Authenticate Data] of the CSF file are correct.</DIV> <DIV> </DIV> <DIV>The message<SPAN> </SPAN><STRONG>HAB_INV_CERTIFICATE<SPAN> </SPAN></STRONG>means: other certificate or Super-Root Key Table verification failed (including mismatch with crt_hsh)</DIV> <DIV> </DIV> <DIV>For the message<SPAN> </SPAN><STRONG>HAB_INV_ASSERTION</STRONG>: the HAB checks that all of the following data have been authenticated (using their final locations):<BR /><BR />- IVT ;<BR /><BR />- DCD (if provided);<BR /><BR />- Boot Data (initial byte if provided);<BR /><BR />- Entry point (initial word).<BR /><BR /> Each of the above data components not covered by a valid signature will cause HAB to generate an event with reason HAB_INV_ASSERTION.</DIV> <DIV> </DIV> </DIV> <DIV>Kindly refer to the below document file to configure a secure boot. We will recommend you try the latest BSP version.</DIV> <DIV><A href="https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4?h=imx_v2020.04_5.4.24_2.1.0" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4?h%3Dimx_v2020.04_5.4.24_2.1.0&source=gmail&ust=1679379624908000&usg=AOvVaw0q4hHWnvewwfcOkTIUqRXS">https://source.codeaurora.org/<WBR />external/imx/uboot-imx/tree/<WBR />doc/imx/habv4?h=imx_v2020.04_<WBR />5.4.24_2.1.0</A></DIV> <DIV> </DIV> <DIV>AN12056<SPAN> </SPAN><A href="https://www.nxp.com/docs/en/application-note/AN12056.pdf?_gl=1*zy4qyk*_ga*MTQ3NzI0MDA3OS4xNjc5MDQ4MzY5*_ga_WM5LE0KMSH*MTY3OTA0ODM2OC4xLjEuMTY3OTA1MDY4MC4wLjAuMA.." target="_blank" rel="nofollow noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://www.nxp.com/docs/en/application-note/AN12056.pdf?_gl%3D1*zy4qyk*_ga*MTQ3NzI0MDA3OS4xNjc5MDQ4MzY5*_ga_WM5LE0KMSH*MTY3OTA0ODM2OC4xLjEuMTY3OTA1MDY4MC4wLjAuMA..&source=gmail&ust=1679379624908000&usg=AOvVaw2k9No3RokzEAnf36mIndW6"><STRONG>Encrypted Boot on HABv4 and CAAM Enabled Devices</STRONG></A></DIV> </DIV> <DIV> </DIV> <DIV><A href="https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/imx-processors/60046/1/i.MX_6_Linux_High_Assurance_Boot_(HAB)_User's_Guide.pdf" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/imx-processors/60046/1/i.MX_6_Linux_High_Assurance_Boot_(HAB)_User's_Guide.pdf&source=gmail&ust=1679379624908000&usg=AOvVaw24NzsQLtEp2qDw8oREOlzd">i.MX_6_Linux_High_Assurance_<WBR />Boot_(HAB)_User's_Guide.pdf</A></DIV> <DIV><A href="https://www.nxp.com/docs/en/application-note/AN4581.pdf?_gl=1*xrviye*_ga*Mjk4NDEwMTEwLjE2NzkwNDc1ODg.*_ga_WM5LE0KMSH*MTY3OTI5MjU0My4zLjEuMTY3OTI5MjU4OS4wLjAuMA.." target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://www.nxp.com/docs/en/application-note/AN4581.pdf?_gl%3D1*xrviye*_ga*Mjk4NDEwMTEwLjE2NzkwNDc1ODg.*_ga_WM5LE0KMSH*MTY3OTI5MjU0My4zLjEuMTY3OTI5MjU4OS4wLjAuMA..&source=gmail&ust=1679379624908000&usg=AOvVaw25GsZThLovpyWiAzOCvEpk">i.MX Secure Boot on HABv4 Supported Devices</A></DIV> <DIV> </DIV> <DIV><BR />Thanks & Regards,<BR />Dhruvit Vasavada</DIV> Mon, 20 Mar 2023 07:35:00 GMT Dhruvit 2023-03-20T07:35:00Z imx6 secure boot https://community.nxp.com/t5/i-MX-Processors/imx6-secure-boot/m-p/1613993#M202645 <P>Hi team, </P><P>Currently i am workign on imx6q board. Trying to implement the HAB in that so i have concluded the CONFIG_IMX_HAB in the config file of u-boot .</P><P>Created the signed u-boot and key using the CST tool.</P><P>But while checking the status of hab_status getting below events. </P><P>MX6 HORIZON U-Boot > hab_status</P><P>Secure boot disabled</P><P>HAB Configuration: 0xf0, HAB State: 0x66</P><P>--------- HAB Event 1 -----------------<BR />event data:<BR />0xdb 0x00 0x24 0x42 0x69 0x30 0xe1 0x1d<BR />0x00 0x04 0x00 0x02 0x40 0x00 0x36 0x06<BR />0x55 0x55 0x00 0x03 0x00 0x00 0x00 0x00<BR />0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00<BR />0x00 0x00 0x00 0x01</P><P>STS = HAB_WARNING (0x69)<BR />RSN = HAB_ENG_FAIL (0x30)<BR />CTX = HAB_CTX_ENTRY (0xE1)<BR />ENG = HAB_ENG_CAAM (0x1D)</P><P><BR />--------- HAB Event 2 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x00<BR />0x00 0x00 0x00 0x20</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 3 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x2c<BR />0x00 0x00 0x02 0xf8</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 4 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x20<BR />0x00 0x00 0x00 0x01</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 5 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x80 0x00 0x00<BR />0x00 0x00 0x00 0x04</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 6 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x21 0xc0 0x00<BR />0xbe 0x00 0x0c 0x00 0x03 0x17 0x00 0x00<BR />0x00 0x00 0x00 0x50</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_CERTIFICATE (0x21)<BR />CTX = HAB_CTX_COMMAND (0xC0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P>MX6 HORIZON U-Boot > <INTERRUPT><BR />MX6 HORIZON U-Boot ><BR />MX6 HORIZON U-Boot ><BR />MX6 HORIZON U-Boot ><BR />MX6 HORIZON U-Boot ><BR />MX6 HORIZON U-Boot > hab_status</P><P>Secure boot disabled</P><P>HAB Configuration: 0xf0, HAB State: 0x66</P><P>--------- HAB Event 1 -----------------<BR />event data:<BR />0xdb 0x00 0x24 0x42 0x69 0x30 0xe1 0x1d<BR />0x00 0x04 0x00 0x02 0x40 0x00 0x36 0x06<BR />0x55 0x55 0x00 0x03 0x00 0x00 0x00 0x00<BR />0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00<BR />0x00 0x00 0x00 0x01</P><P>STS = HAB_WARNING (0x69)<BR />RSN = HAB_ENG_FAIL (0x30)<BR />CTX = HAB_CTX_ENTRY (0xE1)<BR />ENG = HAB_ENG_CAAM (0x1D)</P><P><BR />--------- HAB Event 2 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x00<BR />0x00 0x00 0x00 0x20</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 3 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x2c<BR />0x00 0x00 0x02 0xf8</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 4 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x7f 0xf4 0x20<BR />0x00 0x00 0x00 0x01</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 5 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x0c 0xa0 0x00<BR />0x00 0x00 0x00 0x00 0x17 0x80 0x00 0x00<BR />0x00 0x00 0x00 0x04</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_ASSERTION (0x0C)<BR />CTX = HAB_CTX_ASSERT (0xA0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P><BR />--------- HAB Event 6 -----------------<BR />event data:<BR />0xdb 0x00 0x14 0x42 0x33 0x21 0xc0 0x00<BR />0xbe 0x00 0x0c 0x00 0x03 0x17 0x00 0x00<BR />0x00 0x00 0x00 0x50</P><P>STS = HAB_FAILURE (0x33)<BR />RSN = HAB_INV_CERTIFICATE (0x21)<BR />CTX = HAB_CTX_COMMAND (0xC0)<BR />ENG = HAB_ENG_ANY (0x00)</P><P>Below is my csf file .</P><P>[Header]<BR />Version = 4.2<BR /> Hash Algorithm = sha256<BR /> Engine Configuration = 0<BR /> Certificate Format = X509<BR /> Signature Format = CMS<BR /> Engine = CAAM<BR /><BR /> [Install SRK]<BR /> # Index of the key location in the SRK table to be installed<BR /> File = "../../crts/SRK_1_2_3_4_table.bin"<BR /> Source index = 0<BR /><BR /> [Install CSFK]<BR /> # Key used to authenticate the CSF data<BR /> File = "../../crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"<BR /><BR /> [Authenticate CSF]<BR /><BR /> [Install Key]<BR /> # Key slot index used to authenticate the key to be installed<BR /> Verification index = 0<BR /> # Target key slot in HAB key store where key will be installed<BR /> Target Index = 2<BR /> # Key to install<BR /> File= "../../crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"<BR /><BR /> [Authenticate Data]<BR /> # Key slot index used to authenticate the image data<BR /> Verification index = 2<BR /> # Authenticate Start Address, Offset, Length and file<BR /> #Blocks = 0x177ff400 0x00000000 0x00091c00 "u-boot-dtb.imx"<BR /> Blocks = 0x177ff400 0x00000000 0x00092c00 "u-boot-dtb.imx"<BR /><BR /> [Unlock]<BR /> Engine = CAAM<BR /> Features = RNG</P><P>Below is the u-boot-dtb.imx.log file.</P><P> Image Type: Freescale IMX Boot Image<BR />Image Ver: 2 (i.MX53/6/7 compatible)<BR /> Mode: DCD<BR /> Data Size: 610400 Bytes = 596.09 KiB = 0.58 MiB<BR /> Load Address: 177ff420<BR /> Entry Point: 17800000<BR /> HAB Blocks: 0x177ff400 0x00000000 0x00092c00<BR /> DCD Blocks: 0x00910000 0x0000002c 0x000002f8</P><P>Please help me on this issue, </P><P> </P><P>Regards,</P><P>Rk</P> Mon, 13 Mar 2023 11:38:33 GMT https://community.nxp.com/t5/i-MX-Processors/imx6-secure-boot/m-p/1613993#M202645 rakesh3 2023-03-13T11:38:33Z Re: imx6 secure boot https://community.nxp.com/t5/i-MX-Processors/imx6-secure-boot/m-p/1618214#M202946 <P>Hi <a href="https://community.nxp.com/t5/user/viewprofilepage/user-id/212816">@rakesh3</a>,</P> <DIV> <DIV>I hope you are doing well</DIV> <DIV> </DIV> <DIV>Please find the answer below.</DIV> <DIV> </DIV> <DIV> <DIV>Kindly double-check if the parameters Authenticate Start Address, Offset, and Length in [Authenticate Data] of the CSF file are correct.</DIV> <DIV> </DIV> <DIV>The message<SPAN> </SPAN><STRONG>HAB_INV_CERTIFICATE<SPAN> </SPAN></STRONG>means: other certificate or Super-Root Key Table verification failed (including mismatch with crt_hsh)</DIV> <DIV> </DIV> <DIV>For the message<SPAN> </SPAN><STRONG>HAB_INV_ASSERTION</STRONG>: the HAB checks that all of the following data have been authenticated (using their final locations):<BR /><BR />- IVT ;<BR /><BR />- DCD (if provided);<BR /><BR />- Boot Data (initial byte if provided);<BR /><BR />- Entry point (initial word).<BR /><BR /> Each of the above data components not covered by a valid signature will cause HAB to generate an event with reason HAB_INV_ASSERTION.</DIV> <DIV> </DIV> </DIV> <DIV>Kindly refer to the below document file to configure a secure boot. We will recommend you try the latest BSP version.</DIV> <DIV><A href="https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4?h=imx_v2020.04_5.4.24_2.1.0" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://source.codeaurora.org/external/imx/uboot-imx/tree/doc/imx/habv4?h%3Dimx_v2020.04_5.4.24_2.1.0&source=gmail&ust=1679379624908000&usg=AOvVaw0q4hHWnvewwfcOkTIUqRXS">https://source.codeaurora.org/<WBR />external/imx/uboot-imx/tree/<WBR />doc/imx/habv4?h=imx_v2020.04_<WBR />5.4.24_2.1.0</A></DIV> <DIV> </DIV> <DIV>AN12056<SPAN> </SPAN><A href="https://www.nxp.com/docs/en/application-note/AN12056.pdf?_gl=1*zy4qyk*_ga*MTQ3NzI0MDA3OS4xNjc5MDQ4MzY5*_ga_WM5LE0KMSH*MTY3OTA0ODM2OC4xLjEuMTY3OTA1MDY4MC4wLjAuMA.." target="_blank" rel="nofollow noopener noreferrer" data-saferedirecturl="https://www.google.com/url?q=https://www.nxp.com/docs/en/application-note/AN12056.pdf?_gl%3D1*zy4qyk*_ga*MTQ3NzI0MDA3OS4xNjc5MDQ4MzY5*_ga_WM5LE0KMSH*MTY3OTA0ODM2OC4xLjEuMTY3OTA1MDY4MC4wLjAuMA..&source=gmail&ust=1679379624908000&usg=AOvVaw2k9No3RokzEAnf36mIndW6"><STRONG>Encrypted Boot on HABv4 and CAAM Enabled Devices</STRONG></A></DIV> </DIV> <DIV> </DIV> <DIV><A href="https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/imx-processors/60046/1/i.MX_6_Linux_High_Assurance_Boot_(HAB)_User's_Guide.pdf" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://community.nxp.com/pwmxy87654/attachments/pwmxy87654/imx-processors/60046/1/i.MX_6_Linux_High_Assurance_Boot_(HAB)_User's_Guide.pdf&source=gmail&ust=1679379624908000&usg=AOvVaw24NzsQLtEp2qDw8oREOlzd">i.MX_6_Linux_High_Assurance_<WBR />Boot_(HAB)_User's_Guide.pdf</A></DIV> <DIV><A href="https://www.nxp.com/docs/en/application-note/AN4581.pdf?_gl=1*xrviye*_ga*Mjk4NDEwMTEwLjE2NzkwNDc1ODg.*_ga_WM5LE0KMSH*MTY3OTI5MjU0My4zLjEuMTY3OTI5MjU4OS4wLjAuMA.." target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://www.nxp.com/docs/en/application-note/AN4581.pdf?_gl%3D1*xrviye*_ga*Mjk4NDEwMTEwLjE2NzkwNDc1ODg.*_ga_WM5LE0KMSH*MTY3OTI5MjU0My4zLjEuMTY3OTI5MjU4OS4wLjAuMA..&source=gmail&ust=1679379624908000&usg=AOvVaw25GsZThLovpyWiAzOCvEpk">i.MX Secure Boot on HABv4 Supported Devices</A></DIV> <DIV> </DIV> <DIV><BR />Thanks & Regards,<BR />Dhruvit Vasavada</DIV> Mon, 20 Mar 2023 07:35:00 GMT https://community.nxp.com/t5/i-MX-Processors/imx6-secure-boot/m-p/1618214#M202946 Dhruvit 2023-03-20T07:35:00Z Re: imx6 secure boot https://community.nxp.com/t5/i-MX-Processors/imx6-secure-boot/m-p/1618218#M202947 <P>Thanks for reply Druvit,</P><P> </P><P>Checked on other device , now i am getting only one warning on hab_status.</P><P>U-Boot > hab_status</P><P>Secure boot disabled</P><P>HAB Configuration: 0xf0, HAB State: 0x66</P><P>--------- HAB Event 1 -----------------<BR />event data:<BR />0xdb 0x00 0x24 0x42 0x69 0x30 0xe1 0x1d<BR />0x00 0x04 0x00 0x02 0x40 0x00 0x36 0x06<BR />0x55 0x55 0x00 0x03 0x00 0x00 0x00 0x00<BR />0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00<BR />0x00 0x00 0x00 0x01</P><P>STS = HAB_WARNING (0x69)<BR />RSN = HAB_ENG_FAIL (0x30)<BR />CTX = HAB_CTX_ENTRY (0xE1)<BR />ENG = HAB_ENG_CAAM (0x1D)</P><P> </P><P>Could you please help me to find the issue, can we do something for this issue or can ignore this warning.</P><P>Here I have not fused the SRK_1_2_3_4_fuse.bin in the device. does it required to fuse this SRK_1_2_3_4_fuse.bin before running the </P><P>==>hab_status ????</P><P> </P><P>Please help me on this</P><P> </P><P>Regards,</P><P>Rk</P> Mon, 20 Mar 2023 07:58:12 GMT https://community.nxp.com/t5/i-MX-Processors/imx6-secure-boot/m-p/1618218#M202947 rakesh3 2023-03-20T07:58:12Z