Can't boot after migrating to Android 12.1.0 from Android 9 with RPMB key programmed board

[tristanbss]

Hi,

We are trying to migrate to Android 12.1.0_1.0.0 from Android 9.

After flash images of android 12 to a board has been programmed RPMB key with Android 9 image that was built with "export CFG_RPMB_WRITE_KEY=y".

It failed to boot with the error logs as below:

U-Boot SPL 2022.04-gf3f79c8a (Jun 18 2024 - 20:53:43 +0800)
PMIC: PFUZE100 ID=0x10
DDRINFO: start DRAM init
DDRINFO: DRAM rate 3200MTS
DDRINFO:ddrphy calibration done
DDRINFO: ddrmix config done
SEC0: RNG instantiated
Normal Boot
Trying to boot from MMC1
No bootable slots found, try to boot into recovery mode...
MAC error on block #0
rpmb_init: read RPMB error
RPMB init failed!
SPL: failed to boot from all boot devices
### ERROR ### Please RESET the board ###

 Seems like it can't access RPMB on Android 12 bootloader.

How can i fix this issue?

[AldoG]

Hello,

Could you share how you did the migration?
Did you perform an OTA or just overwritte the whole image with A12?
Also, which i.MX device are you using?

Best regards/Saludos,
Aldo.

[tristanbss]

Hi AldoG,

We use a imx8mq custom board.

All images and partitions were rewritten to Android 12 images by uuu.

Thank you,

Tristan

[AldoG]

Hello,

Could you get the detail command which you have used to upgrade the system?

For example: uuu_imx_android_flash.bat -f imx8qm -a -e -u trusty-dual 

Best regards/Saludos,
Aldo.

[tristanbss]

Hi,

Here is the command we used,

./uuu_imx_android_flash.sh -t emmc -f imx8mq -p myproduct -c 58 -e -u trusty-dual

Best regards,

Tristan

[tristanbss]

BTW, we made a SD card with images enabled CFG_RPMB_WRITE_KEY to write RPMB key.

[AldoG]

Hello,

Thank you for sharing, I'm still working on this, could you share if the device is closed?

Best regards/Saludos,
Aldo.

[tristanbss]

Hi,

Thank you for your assistance.

If you mean HAB close, it is not closed yet.

Best regards,

Tristan

[AldoG]

Hello,

Please note that for RPBM key, it must be set after ahab_close.

Best regards/Saludos,
Aldo.

[tristanbss]

Hi,

Thank you for your response.

If we close the HAB of the board has programmed RPMB key, can it fix the boot issue?

Or any way to let this board can boot normally?

But if we close the HAB before programming RPMB key with Android 9, it will boot normally when flash to Android 12?

Best regards,

Tristan

[AldoG]

Hello,

Yes, usually before setting the RPMB key, SRK hash value needs to be programmed into eFuse hardware and close the chips.

Also, note that it is necessary to know where the RPMB key blob encapsulated with CAAM is stored and how tochange the location.

Best regards/Saludos,
Aldo.

[tristanbss]

Hi,

After we programmed the SRK hash and then try to sign bootloader images, we encountered a problem that we don't know how to modify csf_fit.txt and csf_spl.txt according to the build log as below. Can you provide a example?

Loader IMAGE:

 header_image_off       0x1a000

 dcd_off                0x0

 image_off              0x1a040

 csf_off                0x4c400

 spl hab block:         0x7e0fc0 0x1a000 0x32400




Second Loader IMAGE:

 sld_header_off         0x0

 sld_csf_off            0x0

 sld hab block:         0x0 0x0 0x0

./mkimage_imx8 -fit_ivt u-boot.itb 0x40200000 0x0 -out u-boot-ivt.itb

Platform:       i.MX8M (mScale)

FIT IMAGE:      u-boot.itb start addr: 0x40200000 offset: 0x00000000

Output:         u-boot-ivt.itb




FIT IVT IMAGE:

 fit_csf_off            0x1020

 fit hab block:         0x401fcdc0 0x0 0x1020

make[1]: Leaving directory '.../vendor/nxp-opensource/imx-mkimage'

make[1]: Entering directory '.../vendor/nxp-opensource/imx-mkimage'

./../scripts/dtb_check.sh imx8mq-hunter.dtb evk.dtb

Use u-boot DTB: imx8mq-hunter.dtb

./../scripts/pad_image.sh tee.bin

./../scripts/pad_image.sh bl31.bin

./../scripts/pad_image.sh u-boot-nodtb.bin evk.dtb

TEE_LOAD_ADDR=0xfe000000 ATF_LOAD_ADDR=0x00910000 VERSION=v1 ../iMX8M/print_fit_hab.sh 0x0 evk.dtb

0x40200000 0x3000 0xE2E58

0x402E2E58 0xE5E58 0xC468

0x910000 0xF22C0 0x8080

0xFE000000 0xFA340 0x2C92E0

make[1]: Leaving directory '.../vendor/nxp-opensource/imx-mkimage'

===================Finish building imx8mq-trusty-dual:imx8mq_hunter_android_trusty_dual_defconfig ===================

[tristanbss]

Thank you.

If we use random RPMB key, Is there still a RPMB key blob stored?