topic Re: ahab_status error from imx93 secure boot in i.MX Processors

ahab_status error from imx93 secure boot

Jacky-Cheng — Fri, 26 Apr 2024 09:25:46 GMT

Hi, professionals !

I'm doing the secure boot on imx93. I use Yocto with meta-nxp-security-reference-design/meta-secure-boot meta layer, which supports i.MX boot image signing automation to compile the signed uboot and kernel container.

First time, i referred to the ahab document and generated the ecc sha384 keys, and got the signed uboot and kernel container. I flash it to first board and run ahab_status, it succeed

Second time, i generated the rsa-2048 sha256 keys, and every steps else is the same with the first time. I flash the signed uboot and kernel to second board and run ahab_status, it failed, shows

0x0287f7d6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_CONTAINER_FAILURE_IND (0xF7)
STA = ELE_SUCCESS_IND (0xD6)

I'm really confused why it can't work with the rsa keys, and what does the failure indication mean? I think the imx93 and ahab support both ECC and RSA, and i really follow the same step, just key type are different.

I am very eager to get your support and help! Thanks in advance!

Re: ahab_status error from imx93 secure boot

Harvey021 — Sun, 28 Apr 2024 08:40:50 GMT

Hi,

Probably a cause as like " By default, the NXP CST Signer Tool uses standard keys of type ECC P256-SHA256 for i.MX 8/8x/8ULP/9 Family" as stated from <10.9.2 Prerequisites for preparing a signed image>

Regards

Harvey

Re: ahab_status error from imx93 secure boot

Jacky-Cheng — Sun, 28 Apr 2024 09:01:08 GMT

Hi Harvey, thanks for your reply first! But, it just said by default, not explicitly stated that other key types can't be used. So i wonder can RSA key type works? And if not, what's the reason? Thanks again!

Re: ahab_status error from imx93 secure boot

Harvey021 — Sun, 28 Apr 2024 10:24:56 GMT

As AHAB should support RSA key. With checking the whole statement from the section " 10.9.2 Prerequisites for preparing a signed image". my understanding is that the Signer Tool, by default, will use ECC type of keys for i.MX93 device for signing. Sorry, it is not available for me to have a test for now.

Can you side have a test while using RSA keys? as stated here “Note: (Optional) Create and populate csf_hab4.cfg and/or csf_ahab.cfg with the preferred key type at the CST location to use your preferred PKI tree. The default configuration files are located at the CST Signer work directory in Yocto build.”

Regards

Harvey

Re: ahab_status error from imx93 secure boot

Jacky-Cheng — Mon, 06 May 2024 03:20:30 GMT

This issue has been resolved. As the IMX93 Reference Manual say, it support rsa-pss and ecc key, but not rsa key, so it is clear that imx93 doesn't support rsa type keys.

Re: ahab_status error from imx93 secure boot

Harvey021 — Tue, 07 May 2024 13:43:42 GMT

That is correct, no RSA with ele device.

Re: ahab_status error from imx93 secure boot

brati_7 — Thu, 28 Nov 2024 07:32:29 GMT

Hi @Jacky-Cheng actually i am also using imx93 with yocto and i want secure boot i.MX 93 signed and encrypted AHAB image but as i am totally new to this i was unable to do after many attempts. What i did was added the layer to my source and then i am confused like how the generated how the keys generated what conf i need to add in local.conf and all can you please help me with this to provide steps!

Thanks & regards
Brati

Re: ahab_status error from imx93 secure boot

brati_7 — Fri, 29 Nov 2024 13:04:45 GMT

Hi @Harvey021 I have compiled the image including the meta-secure-boot by follwing the document but previously i was using "core-image-selinux-imx93-11x11-lpddr4x-curiosity.rootfs.wic.zst" to flash now can you please tell what are the images i can use to flash and how can i flash please.

Thank you in advance
Brati

Re: ahab_status error from imx93 secure boot

Migli0 — Tue, 18 Feb 2025 12:58:01 GMT

I ended up with the same errors of Jacky-Cheng...
Where is this statement located? I could not find it in the IMX93RM and SRM.
Are you referring to the table 4 in UG10106?