IMX8M - No HAB event while SRK_HASH is undefined

[Romain-PC]

Hi,

I'm experimenting with the HAB on IMX8M, I'm using a U-boot image that I would like to verify on boot.

Once the HAB is activated, the hab_status command generates 4 HAB events. Which is normal since the image is not signed.
However once the image is signed with my keys, I no longer have any HAB event. I didn't burn SRK_HASH.

Is it normal behavior not to throw an error when no hashes are burned in the fuses? (i.e. bank 6 and 7 all bits at 0).
Besides, does the hab_status command allow you to recheck the image after boot? Allowing to experiment with fuse override.

Best regards,

Romain.

[hector_delgado]

Hi @Romain-PC ,

I hope you're doing well. Could you let us know which i.MX 8M are you using exactly? And is it a custom board or one of our EVKs? Thank you.

Best regards,
Hector.

[Romain-PC]

Hi @hector_delgado 

I am using an i.MX 8M Quad. It is a custom board : Boundary Devices Nitrogen 8M rev 1.1.

Moreover, when the signed image is verified, there is therefore no HAB event, but there is also no message "No HAB event".

Best regards,

Romain.

[hector_delgado · Accepted solution]

Hi @Romain-PC ,

I hope you're doing well. This depends on the HAB version you're using. I'll attach a screenshot from one of our application notes that goes into detail regarding version differences regarding SRK_HASH check in open mode. I would also recommend checking the following guides:

• AN4581 - i.MX Secure Boot on HABv4 Supported Devices https://www.nxp.com/webapp/Download?colCode=AN4581
• AN12263 - HABv4 RVT Guidelines and Recommendations https://www.nxp.com/webapp/Download?colCode=AN12263

Let me know if this information was useful.

Best regards,
Hector.

 

[Romain-PC]

Hi,

I missed this array, thank you it's really clear !

Best regards,

Romain.