[U-Boot] i.MX HAB: U-Boot loading from SPI NOR flash

[Fernando AE]

Hello all,

I'm trying to make the High Assurance Boot (HAB) work in an iMX6UL-based board.

Here is the context of my experiment:

0) Reference documentation:
[1] Secure Boot on i.MX 50, i.MX 53, i.MX 6 and i.MX 7 Series using
HABv4, Document Number: AN4581, Rev. 2 , 05/2018
[2] i.MX 6UltraLite Applications Processor Reference Manual, Document
Number: IMX6ULRM
Rev. 1, 04/2016

1) i.MX6UL-based board
2) Fuses set to boot from "Serial ROM though SPI", in reality there is
a NOR flash there
3) Compiled/tried NXP U-Boot 2017.03 and 2018.03 with CONFIG_SECURE_BOOT=y
4) Both versions boot properly, I can use themselves to reflash and
iterate a new U-Boot in NOR Flash

As far I've understood, the ROM code loads the first 4KB in SRAM to
first check the U-Boot header values, [2] 8.5.4.2 ECSPI Boot.

If the header is ok, the whole U-Boot image in copied from NOR SPI to
"application destination".

**First question**:

I assume that some code in the first 4KB have to be executed in order
to turn on the external DRAM, otherwise the ROM code could not copy
data to the "application destination".

With this assumption, I cannot understand how the HAB can check the
signature of the whole U-Boot image before running any code inside it.

**Second question**:

Basically what I need to know is what address should I tell HAB to
start checking the signature. In the application note [1], the address
is set to the DRAM (external bus).

Thanks for your help,
Fernando