Hi Tony Thurgood,
Sorry for my later reply.
Could you please check the following point:
1. Don't use the code relocated offset 0x2000, you can use the 0XA000.
Eg, use the led_blinky_0x6000a000.srec, then in your own board which HAB is closed and try again.
2. Do you use the MIMXRT1020 sample chip?
3. I have contacted with Jay
In fact, the MCUbootUtility tool can choose the Hab open or close ,it is this option:
But, when customer use the key as OTPMK, then the item can't be modified to no, because using this key, the HAB must close, otherwise, otpmk will use all 0 as the key to encrypt the image.
So, if using the otpmk as BEE key, and HAB is open, it means you use all 0 as the key, not the real SNVS key. as you know, all 0 is also one type of key.
When choosing the user key, then the "Enable Certificate for HW encryption" can be modified.
For your question, Jay just told me you can't use 0X2000 as the app startpoint, and he is very busy, I still didn't get the details. So, could you please in your own HAB closed board, try the other app point code, like 0XA000, any difference?
Best Regards,
Kerry
Hi Tony Thurgood,
1. Maybe I didn't describe it very clear, I mean try the code reset handler not with 0X2000.
You can try other address, eg, 0xa000.
You can relocate your code:
define symbol m_interrupts_start = 0x6000a000;
define symbol m_interrupts_end = 0x6000a3FF;
define symbol m_text_start = 0x6000a400;
define symbol m_text_end = 0x6000FFFF;
Then try it in your own board which already fuse the HAB close.
After you test it, please tell me the result, thank you.
2. You mentioned:I want to use "Fixed Otpmk (SVNS) Key" AND keep the HAB open for development.
As Jay told me, if the HAB open, the code won't read the real OTPMK key as the BEE key, it may use all 0 as the BEE encryption, but just the MCUBootUtility tool didn't allow you choose the HAB close as no.
You can do it like your way, choose SNVS key, and with HAB open, it also can boot, just the encryption key is all 0, not the real OTPMK
From the reference manual, I find this description may also demonstrate Jay's description:
When the HAB is open, the HAB secure won't work, then it also can't use the master secret key selected by SNVS, and may use 0X00 as the default key.
3. Does Jay agree with the NXP documentation that says the HAB can be open for development?
Yes, Jay agree that you can leave HAB open, it also can boot with BEE.
4. I have a BEE encrypted board that starts and can be run with the j-link IAR Workbench debugger, is it possible to find out what step of the HAB is failing?
To be honest, I still didn't find the detailed way to find out the HAB failing, that's why I can't confirm it now. I will still try to find help from our internal side, and try to reproduce your problem with some of our other boards(not EVK).
Anyway, I suggest you follow Jay's suggestion, don't relocate the reset handler to offset 0x2000, you can try 0XA000, any improvement?
After your test, please give me your test result, thanks!
Best Regards,
Kerry
