1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
U-Boot for Freescale i.MX6
This file contains information for the port of U-Boot to the Freescale i.MX6
SoC.
1. CONVENTIONS FOR FUSE ASSIGNMENTS
-----------------------------------
1.1 MAC Address: It is stored in fuse bank 4, with the 32 lsbs in word 2 and the
16 msbs in word 3[15:0].
For i.MX6SX and i.MX6UL, they have two MAC addresses. The second MAC address
is stored in fuse bank 4, with the 16 lsb in word 3[31:16] and the 32 msbs in
word 4.
Example:
For reading the MAC address fuses on a MX6Q:
- The MAC address is stored in two fuse addresses (the fuse addresses are
described in the Fusemap Descriptions table from the mx6q Reference Manual):
0x620[31:0] - MAC_ADDR[31:0]
0x630[15:0] - MAC_ADDR[47:32]
In order to use the fuse API, we need to pass the bank and word values, which
are calculated as below:
Fuse address for the lower MAC address: 0x620
Base address for the fuses: 0x400
(0x620 - 0x400)/0x10 = 0x22 = 34 decimal
As the fuses are arranged in banks of 8 words:
34 / 8 = 4 and the remainder is 2, so in this case:
bank = 4
word = 2
And the U-Boot command would be:
=> fuse read 4 2
Reading bank 4:
Word 0x00000002: 9f027772
Doing the same for the upper MAC address:
Fuse address for the upper MAC address: 0x630
Base address for the fuses: 0x400
(0x630 - 0x400)/0x10 = 0x23 = 35 decimal
As the fuses are arranged in banks of 8 words:
35 / 8 = 4 and the remainder is 3, so in this case:
bank = 4
word = 3
And the U-Boot command would be:
=> fuse read 4 3
Reading bank 4:
Word 0x00000003: 00000004
,which matches the ethaddr value:
=> echo ${ethaddr}
00:04:9f:02:77:72
Some other useful hints:
- The 'bank' and 'word' numbers can be easily obtained from the mx6 Reference
Manual. For the mx6quad case, please check the "46.5 OCOTP Memory Map/Register
Definition" from the "i.MX 6Dual/6Quad Applications Processor Reference Manual,
Rev. 1, 04/2013" document. For example, for the MAC fuses we have:
Address:
21B_C620 Value of OTP Bank4 Word2 (MAC Address)(OCOTP_MAC0)
21B_C630 Value of OTP Bank4 Word3 (MAC Address)(OCOTP_MAC1)
- The command '=> fuse read 4 2 2' reads the whole MAC addresses at once:
=> fuse read 4 2 2
Reading bank 4:
Word 0x00000002: 9f027772 00000004
2. Using imx_usb_loader for first install with SPL
--------------------------------------------------
imx_usb_loader is a very nice tool by Boundary Devices that
allow to install U-Boot without a JTAG debugger, using
the USB boot mode as described in the manual. It is
a replacement for Freescale's MFGTOOLS.
The sources can be found here:
https://github.com/boundarydevices/imx_usb_loader.git
Booting in USB mode, the i.MX6 announces itself to the Linux Host as:
Bus 001 Device 111: ID 15a2:0061 Freescale Semiconductor, Inc.
imx_usb_loader is able to download a single file (u-boot.imx)
to the board. For boards without SPL support, it is enough to
issue the command:
sudo ../imx_usb_loader/imx_usb -v u-boot.imx
In order to load SPL and u-boot.img via imx_usb_loader tool,
please refer to doc/README.sdp.
3. Using Secure Boot on i.MX6 machines with SPL support
-------------------------------------------------------
This version of U-Boot is able to build a signable version of the SPL
as well as a signable version of the U-Boot image. The signature can
be verified through High Assurance Boot (HAB).
CONFIG_SECURE_BOOT is needed to build those two binaries.
After building, you need to create a command sequence file and use
Freescales Code Signing Tool to sign both binaries. After creation,
the mkimage tool outputs the required information about the HAB Blocks
parameter for the CSF. During the build, the information is preserved
in log files named as the binaries. (SPL.log and u-boot-ivt.log).
More information about the CSF and HAB can be found in the AN4581.
https://cache.freescale.com/files/32bit/doc/app_note/AN4581.pdf
We don't want to explain how to create a PKI tree or SRK table as
this is well explained in the Application Note.
Example Output of the SPL (imximage) creation:
Image Type: Freescale IMX Boot Image
Image Ver: 2 (i.MX53/6/7 compatible)
Mode: DCD
Data Size: 61440 Bytes = 60.00 kB = 0.06 MB
Load Address: 00907420
Entry Point: 00908000
HAB Blocks: 00907400 00000000 0000cc00
Example Output of the u-boot-ivt.img (firmware_ivt) creation:
Image Name: U-Boot 2016.11-rc1-31589-g2a4411
Created: Sat Nov 5 21:53:28 2016
Image Type: ARM U-Boot Firmware with HABv4 IVT (uncompressed)
Data Size: 352192 Bytes = 343.94 kB = 0.34 MB
Load Address: 17800000
Entry Point: 00000000
HAB Blocks: 0x177fffc0 0x0000 0x00054020
The CST (Code Signing Tool) can be downloaded from NXP.
# Compile CSF and create signature
./cst --o csf-u-boot.bin < command_sequence_uboot.csf
./cst --o csf-SPL.bin < command_sequence_spl.csf
# Append compiled CSF to Binary
cat SPL csf-SPL.bin > SPL-signed
cat u-boot-ivt.img csf-u-boot.bin > u-boot-signed.img
These two signed binaries can be used on an i.MX6 in closed
configuration when the according SRK Table Hash has been flashed.
|
