i.MX Processors中的主题 Re: IMX93 - AHAB - Secure Boot

IMX93 - AHAB - Secure Boot

il_ciancio — Thu, 03 Apr 2025 14:36:01 GMT

Hello NXP Experts,

I have followed this guide uboot-imx/doc/imx/ahab/guides/mx8ulp_9x_secure_boot.txt at lf_v2023.04 · nxp-imx/uboot-imx in order to generate a PKI Tree and SRK_Table compatible with my target: IMX9332.

I have followed also the "i.MX Linux User's Guide" chapter "10.9.1 Automated image signing for secure boot", in order to generate a signed image with Yocto.

Looking at the generated binaries, I have found the SRK_Table generated, so I'm confident that bitbake works correctly.

I have also flashed my EVK with UUU.

In u-boot, I runned ahab_status and below there is the result:

Looking on other ticket in this wonderfull community, It seems that the problem is that I have not flashed the eFuse (and I did not).

What can I do If I want to test the signature on the SWs over the public keys in the SRK Table flashed? In other terms, Can I flash an OS without signature and during the boot I will have an error on the signature?

Please help me!

Regards,

Alessandro.

Re: IMX93 - AHAB - Secure Boot

Harvey021 — Mon, 07 Apr 2025 06:15:49 GMT

Hello @il_ciancio

For official verification and container integrity checks, using the ahab_status is recommended.

The signed images will trigger events if any error on both open and closed device.

and images not signed or signing incorrectly won't boot on a closed device.

Regards

Harvey

Re: IMX93 - AHAB - Secure Boot

il_ciancio — Mon, 07 Apr 2025 08:38:44 GMT

Hello @Harvey021 ,

thanks for your reply.

I have putted the ahab_status from my board and looking at the error (see the table below)

it seems that the only problem is that I have not flashed the e-fuse.

What do you think?

Re: IMX93 - AHAB - Secure Boot

Harvey021 — Mon, 07 Apr 2025 09:05:30 GMT

Yes, the SRK Hash not fused will raise the issue of the key hash not matched

Regards

Harvey

Re: IMX93 - AHAB - Secure Boot

il_ciancio — Mon, 07 Apr 2025 09:08:20 GMT

Thanks,
so the certificates generated by CST tool and the image generated and signed by Yocto are well configured, otherwise will I get other error?

Re: IMX93 - AHAB - Secure Boot

Harvey021 — Wed, 09 Apr 2025 09:53:55 GMT

SRK Hash acts as a role to establish root of trust. As stated from guide introduction_ahab.txt

"On the target device during the authentication process the AHAB code verify the
SRK Table against the SoC SRK_HASH fuses, in case the verification is successful
the root of trust is established and the AHAB code can progress with the image
authentication."

Regards

Harvey

Re: IMX93 - AHAB - Secure Boot

il_ciancio — Wed, 09 Apr 2025 11:59:32 GMT

So without fusing I can't verify (in order to test on the board the signature) if the image/certs/SRK table are properly generated?

Re: IMX93 - AHAB - Secure Boot

Harvey021 — Thu, 10 Apr 2025 06:42:50 GMT

The way with SRK Hash fusing is our recommended and verified procedure.

You may try tool, OPENSSL, for help to images verification. However, we don't provide support for that.

Regards

Harvey