HAB Events after changing ddr timings

[damien_dunn]

Hello,

We successfully had secure boot fully validating our images on our custom imx8mm board. We use Linux 5.4 and uboot 2020. We updated the ddr4 timings to the  new values we received from our manufacturer, we verified that these new values pass the stress testing tools. However, after updating the ddr4 timings, the SPL is unable to correctly verify uBoot. We have been trying to figure out if there are any offsets that aren't being updated correctly but we haven't had any luck trying to figure out why changing the ddr4 timing causes these hab event errors.

HAB Events:

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------

event data:

0xdb 0x00 0x14 0x43 0x33 0x0c 0xa0 0x00

0x00 0x00 0x00 0x00 0x40 0x1f 0xdd 0xc0

0x00 0x00 0x00 0x20

STS = HAB_FAILURE (0x33)

RSN = HAB_INV_ASSERTION (0x0C)

CTX = HAB_CTX_ASSERT (0xA0)

ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 2 -----------------

event data:

0xdb 0x00 0x14 0x43 0x33 0x0c 0xa0 0x00

0x00 0x00 0x00 0x00 0x40 0x1f 0xcd 0xc0

0x00 0x00 0x00 0x04

STS = HAB_FAILURE (0x33)

RSN = HAB_INV_ASSERTION (0x0C)

CTX = HAB_CTX_ASSERT (0xA0)

ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 3 -----------------

event data:

0xdb 0x00 0x3c 0x43 0x33 0x18 0xc0 0x00

0xca 0x00 0x34 0x00 0x02 0xc5 0x1d 0x00

0x00 0x00 0x16 0x5c 0x40 0x1f 0xcd 0xc0

0x00 0x00 0x10 0x20 0x40 0x20 0x00 0x00

0x00 0x0b 0x02 0xd8 0x40 0x2b 0x02 0xd8

0x00 0x00 0x9a 0x68 0x00 0x92 0x00 0x00

0x00 0x00 0xb1 0xe0 0xfe 0x00 0x00 0x00

0x00 0x20 0x43 0x40

STS = HAB_FAILURE (0x33)

RSN = HAB_INV_SIGNATURE (0x18)

CTX = HAB_CTX_COMMAND (0xC0)

ENG = HAB_ENG_ANY (0x00)

[Harvey021]

Hi @damien_dunn 

From "Appendix A: Interpreting HAB Event Data from Report_Event() API of the HABv4 API".

In this case the context is the hab_rvt.assert()API. An assertion event means that one of the following required areas is not signed as documented in the Operation section for authenticate_image() API:
• IVT;
• DCD (if provided);
• Boot Data (initial byte - if provided);
• Entry point (initial word).

the below data blocks that do not have a required valid signature:

Address event: 0x401fddc0

Length event: 0x20

To the event3, you can refer to the "Example 2 of HABv4 API"

You can find the HABv4 API at path of doc if you download the cst tool.

Best regards

Harvey