iMX 8mm - anti rollback protection

cancel
Showing results for 
Search instead for 
Did you mean: 

iMX 8mm - anti rollback protection

Jump to solution
159 Views
Contributor III

Hi,

i.MX families using AHAB seem to have firmware anti-rollback protection via SECO as documented here https://www.nxp.com/docs/en/application-note/AN12312.pdf

What about other iMX8 socs (like iMX8mm) with HAB instead of AHAB? how could they protect from firmware roll-back at hardware level? is there any command that can be set by the CST to enable this?

many thanks

Jorge

 

Labels (1)
0 Kudos
1 Solution
142 Views
Contributor III

@Yuri, ok thanks for confirming so quick. that is pretty much what I thought as well.

View solution in original post

0 Kudos
5 Replies
135 Views
Contributor III

@Yuri, just another thing, in the case of AHAB, can the ROM check the version during SPL boot?

0 Kudos
123 Views
NXP TechSupport
NXP TechSupport

@jorge1 

Hello,
   

    the boot ROM in itself does not check versions. SPL as user's code - can check 
versions.

 

~Yuri.

0 Kudos
116 Views
Contributor III

right but it seems strange, since the version can be embedded in the container header at build time for AHAB to process. https://www.nxp.com/docs/en/application-note/AN12312.pdf [page 4]

do you know why ROM/AHAB do not run this check and instead it expects the bootloader to do it? seems much safer the other way around...

 

0 Kudos
143 Views
Contributor III

@Yuri, ok thanks for confirming so quick. that is pretty much what I thought as well.

View solution in original post

0 Kudos
144 Views
NXP TechSupport
NXP TechSupport

@jorge1 
Hello,

   The boot ROM (HAB) does not check boot image versions, this verification
can be implemented by customer's secondary boot (as U-boot).
Note, i.MX8Mm supports non-rollover monotonic counter. Please refer to
Security Reference Manual for i.MX 8M Mini for more details.

https://www.nxp.com/webapp/Download?colCode=IMX8MMSRM&appType=moderatedWithoutFAE

 

Regards,
Yuri.