Hi,
I'm working on RT1176 on custom board and try to get HAB working with authenticated OTFAD. I'm using Secure Provisioning Tool (v7) and configuration itself looks quite simple, but I've still no success.
Systems configured to boot from fuses and all seems fine when using 'Unsigend' boot option. But when try OTFAD unsigned or authenticated the CPU won't start application and keeps booting into serial download.
I've tried with several boards and also be aware of the clock issue (痞子衡嵌入式:系统时钟配置不当会导致i.MXRT1xxx系列下OTFAD加密启动失败 - 痞子衡 - 博客园 (cnblogs.com)).
Is there any way to get information what's gone wrong during boot?
If helpful I can provide additional information about hardware, firmware, configuration. But as already stated configuration in SPT is quite simple.
Solved! Go to Solution.
Thank you for your additional information. As the steps followed are correct for the generated image we need to double check that XIP encryption is enabled on the corresponding GPIO. To check this make sure that the switches are configured like the last row:
Hello
I hope you are well.
What are the steps followed to test OTFAD? Which fuses were burned? Did you enable HAB?
Best regards,
Omar
Hi,
Im using MCUX to generate blinky example without changing root clock of M7:
Afterwards using SPT to generate image and load to hardware. On our hardware NOR Flash is connected to SPI1 2nd pingroup, so we've to add some options in boot memory configuration:
OTFAD configuration in SPT is done using default values and self generated certificate:
In given screenshot I've tried with OTFAD unsigend and "HAB open", but already tried with authenticated and HAB closed on other hardware but with same results.
OTP readout is here
I've also attached exported configuration as json file so you can see fuse settings.
Image generation and flashing is done without errors but afterwards CPU keeps booting into serial loader. When I try same procedure but with boot set to "unsigned" blinky example starts, so I don't think it's an issue with image itself oder NOR flash configuration.
According SRM it seems image loading fails:
But when I've a lock on the QSPI communication it stops reading after 300us just after IVT, so there is no access to encrypted image.
Thank you for your additional information. As the steps followed are correct for the generated image we need to double check that XIP encryption is enabled on the corresponding GPIO. To check this make sure that the switches are configured like the last row:
Hi,
thanks, you pointed the correct way, in the fuse configuration the ENCRYPT_XIP_EN (0x940[1]) fuse was not configured automatically by SPT.