S32K312 Secureboot Authentication

[jeongwoo]

When changing to a different FBL while Secureboot is enabled, the META Data values ​​generated via the HMAC Key change. As the FBL is changed, the HSE needs to recalculate the META Data using the HMAC Key; however, because the HMAC Key is deleted due to the new FBL, recalculating the META Data becomes impossible. Consequently, a reset occurs due to a verification failure at the FBL, making it impossible to launch the application. Is there a way to re-authenticate the changed FBL using the HMAC Key, thereby allowing both the FBL and the application to run normally? 

When running the HSE_SRV_ID_SMR_ENTRY_INSTALL service, HseResponse returns 0xA5AA5317. This corresponds to the following definition:

#define HSE_SRV_RSP_KEY_EMPTY ((hseSrvResponse_t)0xA5AA5317UL)

This indicates that the key is empty. (As I asked previously, I suspect this response appears because that region has been erased.)

I have checked the smrEntry values. When I set a breakpoint at the point where SecureBootState is 0, I confirmed that smrEntry was entirely 0. When I set a breakpoint at the return point where Fota_S32k3_SecureBootProcess ends, I confirmed that the values appeared. At the time of return, the SecureBootState value was 1.

I would greatly appreciate it if you could guide me on how to inject the key or otherwise resolve this issue.

1) When a breakpoint is set at if(SecureBootState == 0) / Result: smrEntry = 0

2) A breakpoint at return secureBootProcessResult, the last part of the Fota_S32k3_SecureBootProcess function

[lukaszadrapa]

Hi @jeongwoo 

It seems that the primary issue currently blocking further progress is that we do not know whether the HMAC key is still available.

As a first step, could you please confirm whether you have performed the check I suggested previously and what the result was?

“To confirm if the key is erased or not, you can use service HSE_SRV_ID_GET_KEY_INFO, structure struct hseGetKeyInfoSrv_t. Using this service, you will get information in hseKeyInfo_t, so you can check the state of key.”

Once we have confirmed the state of the key, we can proceed with the next steps. If the key is missing or has been erased, we can try to install it again. Alternatively, you could also attempt to install the key directly using the same procedure that was originally used during provisioning and see whether the operation succeeds.

Regards,

Lukas