rt1189 Boot Flow

[yanyanwang]

1. As shown in the figure, does the "Authenticate Image" process verify the hash value during the SHA-512 hashing stage? 

2. If I set the hash value, will the BootROM verify the image integrity? And if the BootROM verification fails, will it enter recovery mode?

[Gavin_Jia]

Hi @yanyanwang ,

A1: Yes. RT1180 uses AHAB with two authentication layers:

• Signature layer: ECDSA (SHA-256 / SHA-384) verifies the Container header and image array entry (which stores each image's Hash).
• Hash layer: The ROM re-computes the digest of the loaded image body and compares it against the Hash stored in the image array entry.

The SHA hashing stage in your figure is exactly this mandatory integrity check, which does verify the hash value.

A2:The ROM always computes and compares the hash, but whether a failure is enforced depends on the device life cycle: the out-of-fab default is the Open configuration, where authentication runs but all authentication errors are ignored and the image still executes. Only after the device is moved to OEM_CLOSED will a hash mismatch actually block boot.

Whether it enters recovery depends on the Recovery Boot fuse. if enabled, a primary-boot authentication failure triggers a re-load and re-authentication from the recovery device; if not enabled, the flow falls through to Serial Downloader / Fatal Mode / reset loop.

Best regards,
Gavin

[yanyanwang]

As shown in the figure above, if I only sign the image and do not encrypt it, will it be able to go through the bootrom verification flow? Additionally, with oem_close enabled, will it still be able to enter the bootrom verification flow?

[Gavin_Jia · Accepted solution]

Please find answers to your two questions below:

1. Can a signed-only (non-encrypted) image go through the BootROM verification flow? Yes. In the RT1180 AHAB, signing (authentication) is the mandatory part of secure boot, ensuring image authenticity and integrity, while encryption (OTFAD/IEE) is an independent, optional anti-cloning feature and is NOT a prerequisite for verification. Therefore, a signed-only image will go through the full AHAB signature verification flow normally, this is also the standard approach in NXP's official SPSDK rt118x_secure_boot example.

2. With oem_close (OEM_CLOSED) enabled, will it still enter the verification flow? Yes, and verification becomes mandatory.

Recommendation: Before performing oem_close, please program the signed image in the OEM_OPEN state first and confirm it boots successfully with no ELE events, then close the device (SRKH is irreversible once fused) to avoid bricking the part.

(Please refer to: i.MX RT1180 Security Reference Manual. After signing the NDA through your company account, submit a request to the online technic sales representative.)

[yanyanwang]

1. Is hash verification enabled only when the signature authentication feature is enabled? How can hash verification be enabled independently? How can the device be transitioned into the OEM_CLOSED lifecycle state?

2. I will enable the Recovery Boot fuse.

3. My goal is to use an unencrypted image. The Boot ROM should calculate and verify the image hash. If the hash verification fails, the Boot ROM should enter the recovery boot flow and boot the recovery image from the LPSPI NOR Flash.