HUB functionality problem, using SPL and DCD on imx6sx

[narkoskatona]

Hi,

I am trying to use the HAB functionality on an i.MX6SX processor.

I have enabled HAB support in U-Boot (`CONFIG_IMX_HAB`).

I was able to sign the image using the fast authentication method with the following configuration:

```
[Header]
Version = 4.2
Hash Algorithm = sha256
Engine Configuration = 0
Certificate Format = X509
Signature Format = CMS
Engine = ANY

[Install SRK]
# Index of the key location in the SRK table to be installed
File = "../../crts/SRK_1_2_3_4_table.bin"
Source index = 0

[Install NOCAK]
File = "../../crts/SRK1_sha256_2048_65537_v3_usr_crt.pem"

[Authenticate CSF]

[Unlock]
Engine = CAAM
Features = RNG

[Authenticate Data]
# Key slot index 0 used to authenticate the image data
Verification index = 0
# Authenticate Start Address, Offset, Length, and file
Blocks = 0x00907400 0x00000000 0x0000ec00 "SPL"
```

Unfortunately, it doesn't work. The `hab_status` command outputs the following errors:

```
Secure boot disabled

HAB Configuration: 0xf0, HAB State: 0x66

--------- HAB Event 1 -----------------
event data:
0xdb 0x00 0x14 0x42 0x33 0x22 0x33 0x00
0x00 0x00 0x00 0x0f 0x00 0x90 0x70 0x00
0x00 0x01 0x12 0x00

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ADDRESS (0x22)
CTX = HAB_CTX_TARGET (0x33)
ENG = HAB_ENG_ANY (0x00)

--------- HAB Event 2 -----------------
event data:
0xdb 0x00 0x14 0x42 0x33 0x22 0x33 0x00
0x00 0x00 0x00 0x0f 0x00 0x90 0x70 0x00
0x00 0x01 0x10 0x60

STS = HAB_FAILURE (0x33)
RSN = HAB_INV_ADDRESS (0x22)
CTX = HAB_CTX_TARGET (0x33)
ENG = HAB_ENG_ANY (0x00)
```

The addresses referenced in the error messages point to the MMU table, which is located outside the OCRAM region.

What could be causing this issue?

[Harvey021]

Hi,

Have a try to configure the SPL verification length to be smaller to see what happens, and then mainly reduce the second field in BOOTDATA to see if this problem can be solved.

Regards

Harvey

[narkoskatona · Accepted solution]

The issue was that the SPL size was too large to fit into the OCRAM. I had to reduce its size.