i.MX8M Secure Boot (HABv4) does not work with SRK1, SRK2 and SRK3

[jfs17]

Hi,

I have iMX8MP board and I have successfully enabled HABv4 feature. I generated 4 keys and provisioned the public keys into the board.

Below commands that I executed.

{cst_dir}/keys/hab4_pki_tree.sh -existing-ca n -kt rsa -kl 4096 -duration 10 -num-srk 4 -srk-ca y

{cst_dir}/linux64/bin/srktool -h 4 -t ../{cst_dir}/crts/SRK_1_2_3_4_table.bin -e ../{cst_dir}/crts/SRK_1_2_3_4_fuse.bin -d sha256 -c ../{cst_dir}/crts/SRK1_sha256_4096_65537_v3_ca_crt.pem,../{cst_dir}/crts/SRK2_sha256_4096_65537_v3_ca_crt.pem,../{cst_dir}/crts/SRK3_sha256_4096_65537_v3_ca_crt.pem,../{cst_dir}/crts/SRK4_sha256_4096_65537_v3_ca_crt.pem -f 1

I signed the bootloader and Linux image using SRK0 (first key) and the board runs perfectly. But when I tried to sign the bootloader and Linux using SRK1, SRK2, SRK3, it fails when run the Linux.

Authenticate image from DDR location 0x40400000...

Secure boot enabled

HAB Configuration: 0xcc, HAB State: 0x99

--------- HAB Event 1 -----------------
event data:
        0xdb 0x00 0x14 0x45 0x33 0x0f 0xc0 0x00
        0xbe 0x00 0x0c 0x00 0x03 0x17 0x00 0x00
        0x00 0x00 0x00 0x58

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_INDEX (0x0F)
CTX = HAB_CTX_COMMAND (0xC0)
ENG = HAB_ENG_ANY (0x00)

Authenticate Image Fail, Please check

I appreciate your help to troubleshoot my issues. For reference I attach the CSF files, CSFs SRK0 is one that worked, CSFs SRK1 is one that failed.

Thanks

Jefri

[Harvey021]

Hi @jfs17 

Please have a reference to the link

Regards

Harvey

[jfs17]

Hi Harvey,

Thanks for the response. I checked the link you provided; the problem was because the TS mistakenly generated the SRK_table.bin. There were spaces after "," when trigger the srktool command.

I put my command to trigger the srktool in my thread, and I think it is correct without additional spaces.

{cst_dir}/linux64/bin/srktool -h 4 -t ../{cst_dir}/crts/SRK_1_2_3_4_table.bin -e ../{cst_dir}/crts/SRK_1_2_3_4_fuse.bin -d sha256 -c ../{cst_dir}/crts/SRK1_sha256_4096_65537_v3_ca_crt.pem,../{cst_dir}/crts/SRK2_sha256_4096_65537_v3_ca_crt.pem,../{cst_dir}/crts/SRK3_sha256_4096_65537_v3_ca_crt.pem,../{cst_dir}/crts/SRK4_sha256_4096_65537_v3_ca_crt.pem -f 1

My command above generates SRK_table.bin with size 2112 bytes.

[Harvey021]

Hi @jfs17 

Have a try to load the signed flash.bin without loading kernel and dtb.

Regards

Harvey

[jfs17]

I attached the CSF additional images for signing the Linux using SRK0 and SRK1.