Capsule Update Testcase Failure in ARM SystemReady ACS for iMX93 EVK

[arka]

Setup Details:

Hardware:
- NXP iMX93 EVK, booting from SD card.

Software:
- U-Boot: Built with STMM (Secure Trusted Management Module) enabled, based on NXP’s meta-imx styhead branch.
- ACS Image: Deployed on USB, with CapsuleApp.efi and capsule1.bin in FS0:\acs_tests\app.
- Yocto Layer: Using meta-woden for SystemReady test environment, aligned with NXP’s iMX93 BSP.

Issue Description:
- During the ACS Capsule Update test (https://developer.arm.com/documentation/DUI1101/3-0/Test-SystemReady-Devicetree-band/Test-UpdateCaps...), I executed:
FS0:\acs_tests\app\CapsuleApp.efi FS0:\acs_tests\app\signed_capsule.bin -OD

This resulted in:
Image not authenticated
Error Status: Security Violation

Suspecting Secure Boot or STMM authentication issues, I disabled CONFIG_OPTEE=y in the U-Boot defconfig, rebuilt, and reflashed the SD card. I then ran:
FS0:\acs_tests\app\CapsuleApp.efi FS0:\acs_tests\app\capsule1.bin -OD

This produced expected ASSERT_EFI_ERROR (Status = Not Found) messages (as per ACS documentation, https://developer.arm.com/documentation/DUI1101/3-0/Test-SystemReady-Devicetree-band/Test-ESRT), followed by:
CapsuleApp: creating capsule descriptors at 0xDD494040
CapsuleApp: capsule data starts at 0xDD0E3040 with size 0x277577
CapsuleApp: capsule block/size 0xDD0E3040/0x277577
Found EFI system partition on Boot0001: usb 0
FS0:;BLK3:
Succeed to write capsule1.bin
resetting ...

The capsule was written, and the system reset, but in this case OPTEE has been disabled.

Request Details:
1. Guidance on resolving the "Security Violation" error with CONFIG_OPTEE=y and STMM enabled:
- Are there specific signing keys or UEFI variable configurations (e.g., PK/KEK/db) required for the iMX93 BSP to support capsule update with Secure Boot enabled?
- What specific configurations for Secure Boot or STMM might be required to allow capsule update to pass the ACS test?

2. Known issues or patches for Capsule Update support in iMX93 BSP:
- Any documented issues or patches related to Capsule Update handling or UEFI variable management in the iMX93 BSP?

3. Recommendations for configuring the iMX93 EVK BSP to pass the ACS Capsule Update test:
- How to ensure correct handling of capsule updates when Secure Boot is enabled.
- Recommendations for the appropriate configuration of the iMX93 BSP for successful Capsule Update tests in the ACS.

Please let me know if additional logs (e.g., ACS output, U-Boot console, ESRT table) or setup details are required.

Thank you!

#iMX93 #SystemReady

[Harvey021]

Hi @arka 

I see there was already one ticket with the same problems - 00705404. 

And our engineer has been already working with internal team to assist.

So, Let's have a ticket to follow up that.

Regards

Harvey