HABv4 on imx6ull

[GrDK]

Hi，

I burn a signed u-boot-dtb.imx, and prog the fuse, when check the hab events, it occurs err like this. What could I do for it?

=> hab_status

Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x14 0x42 0x69 0x0a 0xc0 0x00
0xca 0x00 0x0c 0x00 0x01 0xc5 0x1d 0x00
0x00 0x00 0x07 0xe4

STS = HAB_WARNING (0x69)
RSN = HAB_UNS_ENGINE (0x0A)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 2 -----------------
event data:
0xdb 0x00 0x1c 0x42 0x69 0x0a 0xc0 0x00
0xca 0x00 0x14 0x00 0x02 0xc5 0x1d 0x00
0x00 0x00 0x0d 0x3c 0x87 0x7f 0xf4 0x00
0x00 0x08 0x2c 0x00

STS = HAB_WARNING (0x69)
RSN = HAB_UNS_ENGINE (0x0A)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

[JorgeCas · Accepted solution]

Hello,

This processor does not have CAAM, I suggest you try with a different engine:

[Header]
Version = 4.2
Hash Algorithm = sha256
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
Engine = SW

Best regards.

[GrDK]

Hi JorgeCas,  

thanks for your reply, and I finally reach at 

###########

Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66
No HAB Events Found!

###########

But lately when I boot the device, it occurs 

###########

Authenticate image from DDR location 0x80800000...
bad magic magic=0x0 length=0x00 version=0x0
bad length magic=0x0 length=0x00 version=0x0
bad version magic=0x0 length=0x00 version=0x0
Error: Invalid IVT structure

Allowed IVT structure:
IVT HDR = 0x4X2000D1
IVT ENTRY = 0xXXXXXXXX
IVT RSV1 = 0x0
IVT DCD = 0x0
IVT BOOT_DATA = 0xXXXXXXXX
IVT SELF = 0xXXXXXXXX
IVT CSF = 0xXXXXXXXX
IVT RSV2 = 0x0
Authenticate zImage Fail, Please check

###########

I do not make any config to authenticate zImage, could u please give me a help?

[JorgeCas]

Hello,

This error is because authenticate image code failed, you can refer to the application note to check if your steps are correct.

You can also refer to the next links:

https://community.nxp.com/t5/i-MX-Processors/Secure-boot-imx6-Invalid-IVT-structure/td-p/1618944

https://www.ezurio.com/documentation/high-assurance-boot-hab-for-dummies

Best regards.

[GrDK]

And I found that, we use mfgtools to update uboot, zImage and ..., once enable HAB, mfgtool could not work.

[GrDK]

Here is my csf_uboot.txt, 

[Header]

Version = 4.2

Hash Algorithm = sha256

Engine Configuration = 0

Certificate Format = X509

Signature Format = CMS

Engine = CAAM

[Install SRK]

# Index of the key location in the SRK table to be installed

File = "../crts/SRK_1_2_3_4_table.bin"

Source index = 0

[Install CSFK]

# Key used to authenticate the CSF data

File = "../crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"

[Authenticate CSF]

[Install Key]

# Key slot index used to authenticate the key to be installed

Verification index = 0

# Target key slot in HAB key store where key will be installed

Target Index = 2

# Key to install

File= "../crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"

[Authenticate Data]

# Key slot index used to authenticate the image data

Verification index = 2

# Authenticate Start Address, Offset, Length and file

Blocks = 0x877ff400 0x00000000 0x00082c00 "u-boot-dtb.imx"