i.MX8M Mini HAB invalid IVT with SDP boot

[DanielD]

Hello everyone,

I use a custom system with an i.MX8M Mini. I am currently trying to fix an issue with the Secure Boot implementation that makes me some trouble. We have a signed SPL, which if booted from MMC, causes no hab events, when I boot through SDP on the other hand, I will get the following:

PicoCoreMX8MMr2-LPDDR4 # hab_status

Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x08 0x43 0x33 0x05 0x0a 0x00

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_IVT (0x05)
CTX = HAB_CTX_AUTHENTICATE (0x0A)
ENG = HAB_ENG_ANY (0x00)

The IVT (including boot data) looks like this:

007e0fc0: 412000d1 007e1000 00000000 00000000
007e0fd0: 007e0fe0 007e0fc0 007ff5c0 00000000
007e0fe0: 007e0bc0 00020a00 00000000 00000000
007e0ff0: 00000000 00000000 00000000 00000000

The CSF offset is also on the adress mentioned in the IVT. The SPL Image itself is padded to the length of 0x20600.

The CSF looks like this:

[Header]
Version = 4.3
Hash Algorithm = sha256
Engine = ANY
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
[Install SRK]
File = "/home/developer/Desktop/release/crts/SRK_Table.bin"
Source index = 0
[Install CSFK]
File = "/home/developer/Desktop/release/crts/CSF1_1_sha256_2048_65537_v3_usr_crt.pem"
[Authenticate CSF]
[Install Key]
File = "/home/developer/Desktop/release/crts/IMG1_1_sha256_2048_65537_v3_usr_crt.pem"
Verification index = 0
Target index = 2
[Authenticate Data]
Verification index = 2
Blocks = 0x7e0fc0 0 124416 "SPL"

Even stranger is that other firmware checked by the SPL do not seem to cause Problems until the UBoot is checked. Again, booting from MMC does not cause any Issues, but when trying to check the signed UBoot with SDP will fail.

On closed Boards the Event cuased with the SPL will not cause to System to stop booting, but when checking the UBoot it will stop. On open Boards every check results in Events like this for Example:

--------- HAB Event 26 -----------------
event data:
0xdb 0x00 0x14 0x43 0x33 0x28 0xa0 0x00
0x00 0x00 0x00 0x00 0x00 0x91 0x00 0x80
0x00 0x00 0x00 0x04

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_CALL (0x28)
CTX = HAB_CTX_ASSERT (0xA0)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 27 -----------------
event data:
0xdb 0x00 0x24 0x43 0x33 0x30 0xe1 0x1d
0x00 0x08 0x00 0x02 0x00 0x00 0x00 0x00
0x55 0x55 0x00 0x03 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
0x00 0x00 0x00 0x05

STS = HAB_FAILURE (0x33)
RSN = HAB_ENG_FAIL (0x30)
CTX = HAB_CTX_ENTRY (0xE1)
ENG = HAB_ENG_CAAM (0x1D)

According to the HAB4_API.pdf, HAB_INV_IVT means one of two thing:

HAB_INV_IVT: IVT malformed
HAB_INV_IVT: IVT version number is less than HAB library version

And do not see a reason for both to be the case, but maybe I am missing something.

Any help is greatly appreciated!

Kand regards,

Daniel

[AldoG]

Hello,

I don't know if you are following a guide for this, but as spicified in the documentation:
The HAB code requires an Image Vector Table (IVT) for determining the image
length and the CSF location. Since Image does not include an IVT this has
to be manually created and appended to the end of the padded Image

Please double check that this has been done correctly.
https://github.com/nxp-imx/uboot-imx/blob/lf_v2025.04/doc/imx/habv4/guides/mx8m_secure_boot.txt#L568


Also, note that if SRK Fuses = 0 it leads to no HAB events due to SRK hash check.

Best regards/Saludos,
Aldo.