Secure Boot Fails at zImage Authentication - HAB State: 0x99 on i.MX with U-Boot 2024.04

[LoKi]

Dear NXP Support,

I’m working on enabling secure boot on a custom board based on an NXP i.MX SoC, using the following U-Boot version:

U-Boot 2024.04+gen7+g0b041b8cc+dirty-wip (Apr 02 2024 - 10:58:58 +0000)

During the boot process, the image loads correctly from flash to RAM, but authentication of the zImage fails. Below is the relevant boot log:

Authenticate image from DDR location 0x80800000...

Secure boot enabled

HAB Configuration: 0xcc, HAB State: 0x99
No HAB Events Found!

Authenticate zImage Fail, Please check

Observations:

• Secure boot is enabled.

• Image is successfully loaded to DDR.

• No HAB events are reported.

• HAB configuration is 0xCC, and HAB state is 0x99.

• The system fails at authentication of the zImage.

Questions:

1. What does a failed authentication with no HAB events typically indicate?

2. Is zImage the correct image format to sign, or should it be wrapped in a FIT image or Image format (Image)?

3. Could the failure be due to misalignment, missing padding, or CSF-related issues?

4. Are there specific U-Boot requirements or patches for secure boot with zImage in recent versions?
   
   
   

Could you please help me understand what might be causing this authentication failure?
I have attached full boot logs and signing details for your reference.

U-Boot 2024.04+gen7+g0b041b8cc+dirty-wip (Apr 02 2024 - 10:58:58 +0000)

DRAM: 128 MiB
Core: 45 devices, 10 uclasses, devicetree: separate
MMC:
Loading Environment from SPIFlash... SF: Detected w25q256 with page size 256 Bytes, erase size 64 KiB, total 32 MiB
OK
In: serial
Out: serial
Err: serial
Net: No ethernet found.
Hit any key to stop autoboot: 0
SF: Detected w25q256 with page size 256 Bytes, erase size 64 KiB, total 32 MiB
ubi0: attaching mtd3
ubi0: scanning is finished
ubi0: attached mtd3 (name "ubi-partition", size 31 MiB)
ubi0: PEB size: 65536 bytes (64 KiB), LEB size: 65408 bytes
ubi0: min./max. I/O unit sizes: 1/256, sub-page size 1
ubi0: VID header offset: 64 (aligned 64), data offset: 128
ubi0: good PEBs: 504, bad PEBs: 0, corrupted PEBs: 0
ubi0: user volume: 2, internal volumes: 1, max. volumes count: 128
ubi0: max/mean erase counter: 29/24, WL threshold: 4096, image sequence number: 128498004
ubi0: available PEBs: 228, total reserved PEBs: 276, PEBs reserved for bad PEB handling: 0
UBIFS (ubi0:0): UBIFS: mounted UBI device 0, volume 0, name "rootfs", R/O mode
UBIFS (ubi0:0): LEB size: 65408 bytes (63 KiB), min./max. I/O unit sizes: 8 bytes/256 bytes
UBIFS (ubi0:0): FS size: 13997312 bytes (13 MiB, 214 LEBs), journal size 2027648 bytes (1 MiB, 31 LEBs)
UBIFS (ubi0:0): reserved for root: 0 bytes (0 KiB)
UBIFS (ubi0:0): media format: w4/r0 (latest is w4/r0), UUID A179EEE8-902D-42EF-837B-932CC0EC38EE, small LPT model
Loading file '/boot/zImage' to addr 0x80800000...
Done
Loading file '/boot/power.dtb' to addr 0x80c00000...
Done
Kernel image @ 0x80800000 [ 0x000000 - 0x3e41a8 ]
## Flattened Device Tree blob at 80c00000
Booting using the fdt blob at 0x80c00000
Working FDT set to 80c00000

Authenticate image from DDR location 0x80800000...

Secure boot enabled

HAB Configuration: 0xcc, HAB State: 0x99
No HAB Events Found!

Authenticate zImage Fail, Please check

Any guidance or reference to known issues would be greatly appreciated.

Thank you in advance for your support!

Best regards,

LoKI

[Harvey021]

Hi @LoKi 

It seems that you don't attach your signing details. Can you please share?

Do you have a chance to test hab events with the signed images in an open device?

Which device are you working on?

Regards

Harvey

[LoKi]

Hi @Harvey021 

I'm using NXP's official Code Signing Tool (CST) to sign the Linux kernel image (`zImage`) for secure boot on an i.MX6ULL platform. The signing process completes successfully with the following output:

SignServer engine RSA priv enc end.
CSF Processed successfully and signed data available in zImage-csf.bin
SignServer engine finish start.
SignServer engine finish end.
SignServer engine destroy start.
SignServer engine destroy end.

   Device Info:
- SoC: i.MX6ULL
- Board: Custom board based on i.MX6ULL

However, during boot, even with the signed image, I still receive the following:

Authenticate image from DDR location 0x80800000...
Secure boot enabled
HAB Configuration: 0xcc, HAB State: 0x99
No HAB Events Found!
Authenticate zImage Fail, Please check

I have not yet tested the hab_status command but plan to do so shortly and share the results.

This suggests that the signature verification is failing, despite no HAB events being reported.

Could you please help me understand and resolve this issue? Specifically:

Are there any common pitfalls or recommended debugging steps to troubleshoot the Authenticate zImage Fail error?

Does the `Authenticate zImage Fail` message imply the HAB engine didn’t even attempt verification properly due to image format or structure?

Regards,

Loki