i.MX93 AHAB Secure Boot

[yaen]

Hi,

I’m trying to produce a signed bootloader for i.MX93 using both CST
(https://github.com/nxp-imx/uboot-imx/blob/lf_v2025.04/doc/imx/ahab/)
and SPSDK
(https://docs.nxp.com/bundle/AN14785/page/topics/introduction.html),
following the official guides.

Both methods complete, but signature verification reports warnings:

nxpimage bootable-image verify -f mimx9352 -b hsm_flash.bin -m serial_downloader
...
Summary table of verifier results:
+-----------+---------+-------+
| Succeeded | Warning | Error |
+-----------+---------+-------+
| 587 | 5 | 0 |
+-----------+---------+-------+

Overall result: Warning

After programming the SRK hash as advised in
https://community.nxp.com/t5/i-MX-Processors/IMX93-AHAB-Secure-Boot/m-p/2073790and rebooting, I get:

ahab_status
Lifecycle: 0x00000008, OEM Open
0x0287fad6
IPC = MU APD (0x2)
CMD = ELE_OEM_CNTN_AUTH_REQ (0x87)
IND = ELE_BAD_KEY_HASH_FAILURE_IND (0xFA)
STA = ELE_SUCCESS_IND (0xD6)

Could you clarify:

What causes the ELE_BAD_KEY_HASH_FAILURE_IND in this context?

Are the “warnings” from nxpimage verify expected, or do they indicate a signature mismatch?

Which toolchain (CST or SPSDK) is currently recommended for i.MX93 AHAB, and is there a verified example configuration available?

Thanks,
Yaakov

[yaen]

$ hexdump -C SRK_1_2_3_4_table.bin |head
00000000 d7 b4 01 42 e1 6c 00 27 00 02 00 80 30 00 30 00 |...B.l.'....0.0.|
00000010 03 41 64 13 d5 b6 e8 1d 4d 08 4a 3b d2 78 2e 9c |.Ad.....M.J;.x..|
00000020 ba db 9b ef 13 6a 0e c6 d4 d4 0c b0 3c 9f 46 8a |.....j......<.F.|
00000030 31 d0 68 63 1f 7c 76 d5 cb 48 a6 6a 63 1f f9 3a |1.hc.|v..H.jc..:|
00000040 d3 d9 34 e2 67 71 0f 17 af 38 0c 11 10 a7 bc 7a |..4.gq...8.....z|
00000050 32 90 e5 c4 50 f8 ce 64 8c b2 61 97 ca 40 ea dc |2...P..d..a..@..|
00000060 9d 7b a5 a1 6d 12 f5 7d 20 46 a9 5e ca 8d 0b 06 |.{..m..} F.^....|
00000070 e1 6c 00 27 00 02 00 80 30 00 30 00 f5 c0 f4 44 |.l.'....0.0....D|
00000080 21 88 8a 53 c7 f8 d6 02 85 d2 8f a3 bc b7 dd e1 |!..S............|
00000090 17 eb 6c 01 4c 3e d8 e0 07 ee 41 6f 64 27 3c 81 |..l.L>....Aod'<.|

irmware-ele-imx-2.0.2-89161a8.bin

[Harvey021]

The hash algorithm looks fine.

Please try to check if sha256sum of SRK_1_2_3_4_table matches with the SRK_1_2_3_4_fuse.bin and also read the fuse values that already burned on SoC and do match.

Regards

Harvey

[Harvey021]

Hi,

The key hash (in SRK Table) verification does not match that in the OTP fuse may cause.

Please share how you generate key and SRK Table and Hash.

Please note that, for i.MX93, a subordinate SGK key is not supported and In i.MX 8ULP/9x, the expected SRK HASH is of 256 bit.

Please reference - The Guide 

Regards

Harvey

[yaen]

Hi Harvey,

I generated the SRK Table and key hash with:

srktool -a -d sha256 -s sha384 -t SRK_1_2_3_4_table.bin \
           -e SRK_1_2_3_4_fuse.bin -f 1 -c \
           SRK1_sha384_secp384r1_v3_usr_crt.pem,\
SRK2_sha384_secp384r1_v3_usr_crt.pem,\
SRK3_sha384_secp384r1_v3_usr_crt.pem,\
SRK4_sha384_secp384r1_v3_usr_crt.pem

following the reference that you sent

Is there a preferred procedure to ensure the hash matches the fuse expectations?

Thanks,
Yaakov

[Harvey021]

Hi @yaen 

Please check your SRK Table hexdump -C SRK_1_2_3_4_table.bin | head and share.

Also share the version of your ELE FW.

Regards

Harvey