Secure boot on iMX8MP

[Suryashmichakraborty]

I have generated the keys and fused on the iMX8M plus board, but I am unable to flash the board with the signed image now. The super root key fuse table is being flashed into the board.

[AldoG]

Hello,

Did you follow i.MX Android Security User's Guide?
Could you share the steps that you have followed?
Also, which Android version are you working with?

Best regards/Saludos,
Aldo.

[Suryashmichakraborty]

Yes, I have followed the Android Security User guide provided by NXP Semiconductors and I have already fused the super root key fuse table on my board. I am working on Android14 BSP.

1. Set the configuration on uuu_defconfig as CONFIG_IMX_HAB=y.

2. Generated the keys(Super root key and certificate authority keys)

3. Generated the fuse from the super root key table.

4. Flashed the table on the board.

[AldoG]

Hello,

The steps that you have followed looks correct, now I'm failing to understand fully the issue here, where you able to flash and test if there was any hab events?
Is the device in a closed state?
Also, do you see anything in both UUU or uboot logs when attempting to flash?

Best regards/Saludos,
Aldo.

[Suryashmichakraborty]

I have set CONFIG_IMX_HAB=y in two files imx8mp_iwg40m_4gb_android_uuu_defconfig and imx8mp_iwg40m_4gb_android_defconfig. Is the files correct to enable the HAB features? I am building for 4GB iMX8M Plus board.

[AldoG]

Hello,

Yes, the configuration flag is correct (CONFIG_IMX_HAB), unfortunately I cannot coment much about the defconfig you are using as this is not an NXP EVK.

Best regards/Saludos,
Aldo.

[Suryashmichakraborty]

Hello, 

After flashing the board of i.MX8M Plus the hab_status is showing as follows: 

iWave-G40 >hab_status

Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x1c 0x45 0x33 0x18 0xc0 0x00
0xca 0x00 0x14 0x00 0x02 0xc5 0x1d 0x00
0x00 0x00 0x0d 0x3c 0x40 0x1f 0xad 0xc0
0x00 0x00 0x30 0x20

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 2 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x40 0x1f 0xdd 0xc0
0x00 0x00 0x00 0x20

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 3 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x40 0x1f 0xbd 0xc0
0x00 0x00 0x00 0x20

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 4 -----------------
event data:
0xdb 0x00 0x1c 0x45 0x33 0x18 0xc0 0x00
0xca 0x00 0x14 0x00 0x02 0xc5 0x1d 0x00
0x00 0x00 0x0d 0x3c 0x40 0x1f 0xad 0xc0
0x00 0x00 0x30 0x20

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 5 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x40 0x1f 0xad 0xc0
0x00 0x00 0x00 0x04

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 6 -----------------
event data:
0xdb 0x00 0x34 0x45 0x33 0x18 0xc0 0x00
0xca 0x00 0x2c 0x00 0x02 0xc5 0x1d 0x00
0x00 0x00 0x0d 0x54 0x40 0x1f 0xad 0xc0
0x00 0x00 0x10 0x20 0x40 0x20 0x00 0x00
0x00 0x13 0xe0 0x10 0x40 0x33 0xe0 0x10
0x00 0x01 0x01 0x30 0x00 0x97 0x00 0x00
0x00 0x00 0xaa 0x70

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 7 -----------------
event data:
0xdb 0x00 0x34 0x45 0x33 0x18 0xc0 0x00
0xca 0x00 0x2c 0x00 0x02 0xc5 0x1d 0x00
0x00 0x00 0x0d 0x54 0x40 0x1f 0xad 0xc0
0x00 0x00 0x10 0x20 0x40 0x20 0x00 0x00
0x00 0x13 0xe0 0x10 0x40 0x33 0xe0 0x10
0x00 0x01 0x01 0x30 0x00 0x97 0x00 0x00
0x00 0x00 0xaa 0x70

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_SIGNATURE (0x18)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 8 -----------------
event data:
0xdb 0x00 0x14 0x45 0x33 0x0c 0xa0 0x00
0x00 0x00 0x00 0x00 0x40 0x1f 0xad 0xc0
0x00 0x00 0x00 0x04

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ASSERTION (0x0C)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)
I have followed all the steps correctly can you please check?

Regards,

Suryashmi.

[AldoG]

Hello,

Well there is something wrong indeed, as you have many HAB events, specifically HAB_INV_SIGNATURE which means that the signature in your bootloader is not correct, so please make sure that you are using the correct one.

Best regards/Saludos,
Aldo.