[Samsung Galaxy Tab A series Questions & Answers] knumat:
I recently purchased several Samsung Galaxy Tab A7 tablets (SM-T500) from Amazon ("Amazon Renewed"), and half of them have a security issue that causes sensitive operations to fail (more details below), and a factory reset doesn't help. After hours of detective work, the only differences I've been able to find are related to GRDM, which seems to be an undocumented part of the Knox enterprise security.

Does anyone have any idea about how these tablets got into this state, or what would be needed to fix them? I filed a support request with Samsung, but I'm doubtful they will respond. I'd hate to return these tablets and pass this issue along to the next buyer. Hopefully it's not intentionally malicious spyware?

Similarities between problematic and normal device

I checked the following items, but they all seem to be "intact" on all of the tablets:

Settings -> About Tablet -> Status Information -> Device Status says "Official"

My understanding is that this means that none of the tablets are rooted

I used the "Root Checker" app and it said I did not have root access

This confirms that none of the tablets are rooted

Settings -> About Tablet -> Software Information is identical

All tablets have the latest security patch level of August 1, 2023

I used the "KNOX Status Samsung" app to check whether KNOX was tripped

All tablets say 0x0 meaning the warranty is still intact

My understanding is that this means that none of the tablets have ever had a custom ROM installed on them.

Settings -> Developer Options -> OEM Unlocking is disabled

My understanding is that this means that the bootloader is not unlocked on any of the tablets.

Differences between problematic and normal tablets

(1) When booting up into Download (ODIN) mode after a factory reset, the normal tablets show:

RPMB fuse Not Set
Available to RPMB PROVISIONING
CURRENT BINARY: Samsung Official
FRP LOCK : OFF
OEM LOCK : ON (L)
KG STATUS : PRENORMAL
WARRANTY VOID : 0x0
QUALCOMM SECUREBOOT : ENABLE
RP SWREV : B6(1,1,1,6,1,1) K6 S6
SECURE DOWNLOAD : ENABLE
GRDM STATUS : NORMAL (D0000502)
DID :041C9D346363

The problematic tablets are identical except for the GRDM status:

RPMB fuse Not Set
Available to RPMB PROVISIONING
CURRENT BINARY: Samsung Official
FRP LOCK : OFF
OEM LOCK : ON (L)
KG STATUS : PRENORMAL
WARRANTY VOID : 0x0
QUALCOMM SECUREBOOT : ENABLE
RP SWREV : B6(1,1,1,6,1,1) KG S6
SECURE DOWNLOAD : ENABLE
GRDM STATUS : ABNORMAL (FFFFFFFF) <---- DIFFERENT
DID :041C3172BA1C

(2) On normal tablets, I can do a factory reset and then scan a QR code to install our app and set it as the "device owner". However, on the problematic tablets, it says:

(3) On normal tablets, another way to set our app as "device owner" is via USB ("adb shell dpm set-device-owner") as long as there are no accounts configured (Google, Samsung, etc.). However, the problematic tablets say "Can't set package ComponentInfo{...} as device owner". Comparing logcat output from normal tablets and problematic tablets, the first sign of trouble seems to originate with the following messages:

01-04 09:54:54.961 613 613 I GRDM:ESE_HAL: eseHal_Close
01-04 09:54:54.961 613 613 D keymaster_swd: keymaster_swd [ERR] (tz_add_grdm_sak_cert:188) grdm_openLogicalChannel() failed. error:12
01-04 09:54:54.961 613 613 D keymaster_swd: keymaster_swd [ERR] (swd_get_issuer_cert:111) tz_add_grdm_sak_cert() failed
01-04 09:54:54.961 613 613 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_key_attest() returns -973
01-04 09:54:54.961 613 613 W keymaster_tee: [WRN]Cmd 14, err -973
01-04 09:54:54.961 613 613 W keymaster_tee: [WRN]nwd_attest_key ret -973
01-04 09:54:54.962 611 31222 E keystore2/skeymint: !@ getCertificate : errorCode : -973
01-04 09:54:54.962 611 31222 E keystore2/skeymint: !@ attestKey : errorCode : -973
01-04 09:54:54.963 611 31222 E keystore2: keystore2::error: In attest_key: attestation finish unexpectedly, certificate chain not received. 1000, Some("KnoxTestKey")
01-04 09:54:54.963 611 31222 E keystore2:
01-04 09:54:54.963 611 31222 E keystore2: Caused by:
01-04 09:54:54.963 611 31222 E keystore2: 0: In upgrade_keyblob_if_required: Called closure failed.
01-04 09:54:54.963 611 31222 E keystore2: 1: Error::Km(ErrorCode(-973))
01-04 09:54:54.971 1699 14495 E AttestationUtils: KeyStore exception
01-04 09:54:54.971 1699 14495 E AttestationUtils: android.os.ServiceSpecificException: (code -973)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Parcel.createExceptionOrNull(Parcel.java:2452)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Parcel.createException(Parcel.java:2422)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Parcel.readException(Parcel.java:2405)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Parcel.readException(Parcel.java:2347)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.security.samsungattestation.ISamsungAttestation$Stub$Proxy.attestKey(ISamsungAttestation.java:140)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.lambda$attestKey$0(AttestationUtils.java:494)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils$$ExternalSyntheticLambda1.execute(Unknown Source:4)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.handleRemoteExceptionSamsungAttestation(AttestationUtils.java:850)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.attestKey(AttestationUtils.java:493)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.generateKeyPair(AttestationUtils.java:765)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.android.server.knox.dar.DarManagerService.isKnoxKeyInstallable(DarManagerService.java:320)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.android.server.devicepolicy.DevicePolicyManagerService$Injector.verifyDeviceIntegrity(DevicePolicyManagerService.java:1939)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.android.server.devicepolicy.DevicePolicyManagerService.setDeviceOwner(DevicePolicyManagerService.java:9214)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.android.server.devicepolicy.DevicePolicyManagerServiceShellCommand.runSetDeviceOwner(DevicePolicyManagerServiceShellCommand.java:256)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.android.server.devicepolicy.DevicePolicyManagerServiceShellCommand.onCommand(DevicePolicyManagerServiceShellCommand.java:89)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.ShellCommand.exec(ShellCommand.java:38)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at com.android.server.devicepolicy.DevicePolicyManagerService.onShellCommand(DevicePolicyManagerService.java:10765)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Binder.shellCommand(Binder.java:986)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Binder.onTransact(Binder.java:860)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.app.admin.IDevicePolicyManager$Stub.onTransact(IDevicePolicyManager.java:7644)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Binder.execTransactInternal(Binder.java:1220)
01-04 09:54:54.971 1699 14495 E AttestationUtils: at android.os.Binder.execTransact(Binder.java:1179)
01-04 09:54:54.974 1699 14495 W System.err: java.security.ProviderException: Failed to generate attestation certificate chain
01-04 09:54:54.974 1699 14495 W System.err: at com.samsung.android.security.keystore.AttestationUtils.attestKey(AttestationUtils.java:502)
01-04 09:54:54.974 1699 14495 W System.err: at com.samsung.android.security.keystore.AttestationUtils.generateKeyPair(AttestationUtils.java:765)
01-04 09:54:54.974 1699 14495 W System.err: at com.android.server.knox.dar.DarManagerService.isKnoxKeyInstallable(DarManagerService.java:320)
01-04 09:54:54.974 1699 14495 W System.err: at com.android.server.devicepolicy.DevicePolicyManagerService$Injector.verifyDeviceIntegrity(DevicePolicyManagerService.java:1939)
01-04 09:54:54.975 1699 14495 W System.err: at com.android.server.devicepolicy.DevicePolicyManagerService.setDeviceOwner(DevicePolicyManagerService.java:9214)
01-04 09:54:54.975 1699 14495 W System.err: at com.android.server.devicepolicy.DevicePolicyManagerServiceShellCommand.runSetDeviceOwner(DevicePolicyManagerServiceShellCommand.java:256)
01-04 09:54:54.975 1699 14495 W System.err: at com.android.server.devicepolicy.DevicePolicyManagerServiceShellCommand.onCommand(DevicePolicyManagerServiceShellCommand.java:89)
01-04 09:54:54.975 1699 14495 W System.err: at com.android.modules.utils.BasicShellCommandHandler.exec(BasicShellCommandHandler.java:97)
01-04 09:54:54.975 1699 14495 W System.err: at android.os.ShellCommand.exec(ShellCommand.java:38)
01-04 09:54:54.975 1699 14495 W System.err: at com.android.server.devicepolicy.DevicePolicyManagerService.onShellCommand(DevicePolicyManagerService.java:10765)
01-04 09:54:54.975 1699 14495 W System.err: at android.os.Binder.shellCommand(Binder.java:986)
01-04 09:54:54.975 1699 14495 W System.err: at android.os.Binder.onTransact(Binder.java:860)
01-04 09:54:54.975 1699 14495 W System.err: at android.app.admin.IDevicePolicyManager$Stub.onTransact(IDevicePolicyManager.java:7644)
01-04 09:54:54.975 1699 14495 W System.err: at android.os.Binder.execTransactInternal(Binder.java:1220)
01-04 09:54:54.975 1699 14495 W System.err: at android.os.Binder.execTransact(Binder.java:1179)
01-04 09:54:54.975 1699 14495 W System.err: Caused by: android.security.KeyStoreException: -973
01-04 09:54:54.975 1699 14495 W System.err: at com.samsung.android.security.keystore.AttestationUtils.getKeyStoreException(AttestationUtils.java:1047)
01-04 09:54:54.975 1699 14495 W System.err: ... 15 more
01-04 09:54:54.976 1699 14495 E DevicePolicyManager: Failed in device integrity check
01-04 09:54:54.984 1699 14495 D EnterpriseDeviceManagerService: isAdminRemovableInternal: ComponentInfo{com.mhs.sleepapnea/com.mhs.copdv2.MyDeviceAdminReceiver}, userHandle = 0
01-04 09:54:54.994 1699 14495 D EnterpriseDeviceManagerService: isAdminRemovableInternal : true
01-04 09:54:55.007 1699 1699 E DevicePolicyManager: semGetAllowBluetoothMode - value retunrs : 2
01-04 09:54:55.019 1699 1699 I DevicePolicyManager: Device admin ComponentInfo{...} removed from user 0

(4) Normal tablets can use the Samsung Secure Folder app. However, that app crashes on problematic tablets, saying "If this keeps happening, contact Customer Service." When the crash occurred, there was some very similar output from logcat:

01-04 13:58:13.498 610 610 I GRDM:ESE_HAL: eseHal_Close
01-04 13:58:13.498 610 610 D keymaster_swd: keymaster_swd [ERR] (tz_add_grdm_sak_cert:188) grdm_openLogicalChannel() failed. error:12
01-04 13:58:13.498 610 610 D keymaster_swd: keymaster_swd [ERR] (swd_get_issuer_cert:111) tz_add_grdm_sak_cert() failed
01-04 13:58:13.498 610 610 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_key_attest() returns -973
01-04 13:58:13.498 610 610 W keymaster_tee: [WRN]Cmd 14, err -973
01-04 13:58:13.498 610 610 W keymaster_tee: [WRN]nwd_attest_key ret -973
01-04 13:58:13.499 608 618 E keystore2/skeymint: !@ getCertificate : errorCode : -973
01-04 13:58:13.499 608 618 E keystore2/skeymint: !@ attestKey : errorCode : -973
01-04 13:58:13.499 608 618 E keystore2: keystore2::error: In attest_key: attestation finish unexpectedly, certificate chain not received. 1000, Some("KnoxTestKey")
01-04 13:58:13.499 608 618 E keystore2:
01-04 13:58:13.499 608 618 E keystore2: Caused by:
01-04 13:58:13.499 608 618 E keystore2: 0: In upgrade_keyblob_if_required: Called closure failed.
01-04 13:58:13.499 608 618 E keystore2: 1: Error::Km(ErrorCode(-973))
01-04 13:58:13.502 610 610 D keymaster_swd: keymaster_swd [WRN] (swd_run_cb:254) swd_add_rng_entropy() returns 0
01-04 13:58:13.513 1686 2288 E AttestationUtils: KeyStore exception
01-04 13:58:13.513 1686 2288 E AttestationUtils: android.os.ServiceSpecificException: (code -973)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.os.Parcel.createExceptionOrNull(Parcel.java:2452)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.os.Parcel.createException(Parcel.java:2422)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.os.Parcel.readException(Parcel.java:2405)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.os.Parcel.readException(Parcel.java:2347)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.security.samsungattestation.ISamsungAttestation$Stub$Proxy.attestKey(ISamsungAttestation.java:140)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.lambda$attestKey$0(AttestationUtils.java:494)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils$$ExternalSyntheticLambda1.execute(Unknown Source:4)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.handleRemoteExceptionSamsungAttestation(AttestationUtils.java:850)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.attestKey(AttestationUtils.java:493)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.samsung.android.security.keystore.AttestationUtils.generateKeyPair(AttestationUtils.java:765)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.android.server.knox.dar.DarManagerService.isKnoxKeyInstallable(DarManagerService.java:320)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.android.server.pm.UserManagerService.verifyDeviceIntegrity(UserManagerService.java:7230)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.android.server.pm.UserManagerService.createUserInternalUncheckedNoTracing(UserManagerService.java:4114)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.android.server.pm.UserManagerService.createUserInternalUnchecked(UserManagerService.java:3870)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.android.server.pm.UserManagerService.createUserInternal(UserManagerService.java:3840)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at com.android.server.pm.UserManagerService.createProfileForUserWithThrow(UserManagerService.java:3759)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.os.IUserManager$Stub.onTransact(IUserManager.java:804)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.os.Binder.execTransactInternal(Binder.java:1215)
01-04 13:58:13.513 1686 2288 E AttestationUtils: at android.os.Binder.execTransact(Binder.java:1179)
01-04 13:58:13.514 1686 2288 W System.err: java.security.ProviderException: Failed to generate attestation certificate chain
01-04 13:58:13.515 1686 2288 W System.err: at com.samsung.android.security.keystore.AttestationUtils.attestKey(AttestationUtils.java:502)
01-04 13:58:13.515 1686 2288 W System.err: at com.samsung.android.security.keystore.AttestationUtils.generateKeyPair(AttestationUtils.java:765)
01-04 13:58:13.515 1686 2288 W System.err: at com.android.server.knox.dar.DarManagerService.isKnoxKeyInstallable(DarManagerService.java:320)
01-04 13:58:13.515 1686 2288 W System.err: at com.android.server.pm.UserManagerService.verifyDeviceIntegrity(UserManagerService.java:7230)
01-04 13:58:13.515 1686 2288 W System.err: at com.android.server.pm.UserManagerService.createUserInternalUncheckedNoTracing(UserManagerService.java:4114)
01-04 13:58:13.515 1686 2288 W System.err: at com.android.server.pm.UserManagerService.createUserInternalUnchecked(UserManagerService.java:3870)
01-04 13:58:13.515 1686 2288 W System.err: at com.android.server.pm.UserManagerService.createUserInternal(UserManagerService.java:3840)
01-04 13:58:13.515 1686 2288 W System.err: at com.android.server.pm.UserManagerService.createProfileForUserWithThrow(UserManagerService.java:3759)
01-04 13:58:13.515 1686 2288 W System.err: at android.os.IUserManager$Stub.onTransact(IUserManager.java:804)
01-04 13:58:13.515 1686 2288 W System.err: at android.os.Binder.execTransactInternal(Binder.java:1215)
01-04 13:58:13.515 1686 2288 W System.err: at android.os.Binder.execTransact(Binder.java:1179)
01-04 13:58:13.515 1686 2288 W System.err: Caused by: android.security.KeyStoreException: -973
01-04 13:58:13.515 1686 2288 W System.err: at com.samsung.android.security.keystore.AttestationUtils.getKeyStoreException(AttestationUtils.java:1047)
01-04 13:58:13.515 1686 2288 W System.err: ... 11 more
01-04 13:58:13.515 1686 2288 E UserManagerService: Failed in device integrity check
01-04 13:58:13.516 1686 2288 D SystemServerTiming: createUser-268566624 took to complete: 1403ms
01-04 13:58:13.516 1686 2288 D SystemServerTiming: !@Boot_SystemServer: 1403ms : createUser-268566624
01-04 13:58:13.516 1686 2288 I SystemServerTiming: !@Boot_EBS: Took 1403ms by 'createUser-268566624'
01-04 13:58:13.518 20183 20206 E [0]ProvisioningHistoryImpl: [CreateProfileTask] onCreateContainerFailed() : received containerId(-1)
01-04 13:58:13.520 1686 1941 D KnoxMUMContainerPolicy: updateProvisioningState called: state = 11
01-04 13:58:13.520 1686 1941 I KnoxMUMContainerPolicy: ProvisioningState.update():Bundle[{isCLType=false, pidKnox=-1, type=secure-folder, state=0, containerId=-1, requestId=-1, pidProvision=-1, creatorUid=10039, pwdRstToken=null, adminPackageName=com.samsung.knox.securefolder}]
01-04 13:58:13.520 1686 1941 I KnoxMUMContainerPolicy: ProvisioningState.update(): appying:{ state:11 }
01-04 13:58:13.520 1686 1941 I KnoxMUMContainerPolicy: failed
01-04 13:58:13.532 1686 1941 W ActivityManager: Skipping broadcast of Intent { act=enterprise.container.setup.failure flg=0x10 }: user 10039 and its parent (if any) are stopped
01-04 13:58:13.532 1686 1941 W ActivityManager: Skipping broadcast of Intent { act=enterprise.container.setup.failure flg=0x10 }: user 10039 and its parent (if any) are stopped
01-04 13:58:13.533 1686 1941 I KnoxMUMContainerPolicy: provisioningFinished()... { isCLType:false pidKnox:-1 type:secure-folder state:11 containerId:-1 requestId:-1 pidProvision:-1 creatorUid:10039 adminPackageName:com.samsung.knox.securefolder }
01-04 13:58:13.533 1686 1941 I KnoxMUMContainerPolicy: provisioningFinished() not a normal finish, state:11
01-04 13:58:13.535 1686 1941 E KnoxMUMContainerPolicy: no ongoing provisioning
01-04 13:58:13.537 1686 1941 D KnoxMUMContainerPolicy: updateProvisioningState called: state = 10
01-04 13:58:13.537 1686 1941 E KnoxMUMContainerPolicy: no ongoing provisioning
01-04 13:58:13.538 20183 20183 E [0]ProvisioningHistoryImpl: [ProvisioningActivity] creationFailed( -1)
01-04 13:58:13.541 1686 1941 W WindowManager: Prepare app transition: mNextAppTransitionRequests=[TRANSIT_CLOSE], mNextAppTransitionFlags=, displayId: 0 Callers=com.android.server.wm.DisplayContent.prepareAppTransition:6369 com.android.server.wm.DisplayContent.prepareAppTransition:6364 com.android.server.wm.ActivityRecord.finishIfPossible:3650 com.android.server.wm.ActivityClientController.finishActivity:529 android.app.IActivityClientController$Stub.onTransact:706
01-04 13:58:13.542 20183 20206 W [0]ProvisioningHistoryImpl: [ProvisioningExecutor] coroutine stoped by error. couldn't perform 1
01-04 13:58:13.547 20183 20183 E [0]ProvisioningHistoryImpl: [ContainerCreationService] creation failed. result=-1