i.MX8MP HABv4 hangs when trying to run hab_auth_img on a Linux kernel image

[eertal]

Hi!

I'm having a problem trying to setup HABv4 authentication for additional boot images. Right now, I have the bootloader authentication setup and working up to U-boot proper. After booting to U-boot proper using a signed image, hab_status reports no errors, so everything is ok up to that point. I have also tested that authentication works up to U-boot proper on both open and closed devices.

The next step I'm trying to do is to extend the root of trust to the Kernel image. What I have done so far:

- I enabled HABv4 support in U-boot according to uboot-imx/doc/imx/habv4/mx8m_secure_boot.txt, ie. CONFIG_IMX_HAB is enabled.

- I created a signed Kernel image according to uboot-imx/doc/imx/habv4/mx8m_secure_boot.txt

- I booted the system and loaded the signed Kernel image into RAM with

fatload mmc 2:1 0x40400000 Image

- I attempted to authenticate the image with

hab_auth_img 0x40400000 0x12F2020 0x12F0000

At this point I would expect hab_auth_img to either report some HAB events or tell me that no HAB events exist. However, the problem I have is that hab_auth_img simply hangs and I'm forced to perform a hard reset on the system. Oddly, if I try to boot the image using booti instead, the HABv4 authentication built into the booti command also hangs most of the time, but sometimes it seems to succeed randomly.

The contents of my signed image are as documented in uboot-imx/doc/imx/habv4/mx8m_secure_boot.txt, ie. the signed image contains a Kernel image, an IVT and a CSF binary.

- I'm using an uncompressed Kernel image for the Kernel.

- The contents of the IVT binary are (as a hexdump):

0000000: 00d1 4120 0000 4040 0000 0000 0000 0000
0000010: 0000 0000 0000 416f 0020 416f 0000 0000

- The contents of the CSF source file are:

[Header]
Version = 4.5
Hash Algorithm = sha256
Engine = CAAM
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS

[Install SRK]
# Install Super Root Key (SRK).
File = "[Path to SRK_1_2_3_4_table.bin]"
Source index = 0

[Install CSFK]
# Install Command Sequence File Key (CSFK).
File = "[Path to IMG1_1_sha256_2048_65537_v3_usr_crt.pem]"

[Authenticate CSF]
# Authenticate the Command Sequence File
# Use all defaults.

[Install Key]
# Install Image Key.
File = "[Path to CSF1_1_sha256_2048_65537_v3_usr_crt.pem]"
Verification index = 0
Target Index = 2

[Authenticate Data]
# Authenticate Image data
Blocks = 0x40400000 0x0 0x12f0020 "Image_ivt.bin"
Verification index = 2

I have also tried signing the Kernel image with a CSF file containing the contents above and this [Unlock] directive, but it did not solve the problem.

[Unlock]
Engine = CAAM
Features = MFG,MID,RNG

The SPL and FIT images for the bootloader are signed with the same CSF as above, including the [Unlock] addition, and with a different Blocks= value in [Authenticate Data]. The HABv4 authentication works just fine for the bootloader.

I have also tried to trace where exactly U-boot hangs after running hab_auth_img. It seems that the image authentication function in ROM code is called, but the function never returns.

Any help is appreciated!

Best regards,

Eero

[hector_delgado]

Hi @eertal ,

I hope you're doing well!

What version of CST did you use for signing? Also, are you working with a custom board or an EVK?

Thank you.

Best regards,
Hector.

[eertal]

Hi @hector_delgado ,

I've tried signing with CST v3.1.0 and v3.3.2. The bootloader authentication works with both versions, but the Linux image authentication doesn't work with either version. Currently I'm using the v3.3.2 version.

I'm working with a custom board.

Best regards,

Eero

[hector_delgado]

Hi @eertal ,

What version of u-boot are you using? There may be some compatibility issues when authenticating kernel images. 

Also, I believe that the hab_auth_img function uses the API function hab_rvt_authenticate_image, but for HAB versions 4.2+ it is highly recommended to use authenticate_image_no_dcd() instead. You can review these details in the High Assurance Boot Version 4 Application Programming Interface Reference Manual (included with your download of our CST). I'd also recommend taking a look at both i.MX Secure Boot on HABv4 Supported Devices (https://www.nxp.com/webapp/Download?colCode=AN4581) and HABv4 RVT Guidelines and Recommendations (https://www.nxp.com/webapp/Download?colCode=AN12263&location=null). 

Let me know if this was of any help.

Best regards,
Hector.