FIELD_RETURN_LOCK enabling

[mohamed-ali_fod]

Hi,

I read 021bc050: 00000018 so seems that FIELD_RETURN_LOCK is not set.

The same issue as https://community.nxp.com/t5/i-MX-Processors/FIELD-RETURN-LOCK-enabling/m-p/894182#M135143

I flashed a signed u-boot but no more log is seen on console, could you please share me the solution?

Thanks,

Mohamed Ali

[Sanket_Parekh]

Hi @mohamed-ali_fod 

I hope you are doing well.

The FIELD_RETURN fuse is protected by the FIELD_RETURN_LOCK sticky bit in the OCOTP_CTRL fuse controller.

OCOTP module clock must be enabled to set the sticky bit.

Please make sure that the below-mentioned changes are applied to u-boot to enable the OCOTP module clock.
Enable OCOTP CTRL clock in DCD and plugin

Do not disable the OCOTP clock after every access

Thanks & Regards,

Sanket Parekh

[mohamed-ali_fod]

Hi Sanket,

I did this modification: https://github.com/nxp-imx/uboot-imx/commit/9a3d4a6b8470980c4d4f938619a9d34a9282a69c

I have enable_ocotp_clk(1); in prepare_access function but in finish_access I have 

#ifdef CONFIG_MX7ULP
/* Need to power down the OTP memory */
writel(1, &regs->pdn);
#endif

there is no call to enable_ocotp_clk(0);

In the CSF I have

[Unlock]
Engine = OCOTP
Features = FIELD RETURN
UID = 0x1f,0x09 ,0x64 ,0xd9 ,0xd4 ,0xc1 ,0x0c ,0x04

But it still not work, the problem is that when the board is flashed with u-boot that was built with the above Unlock CSF it cannot boot anymore, could you please help?

Thank you in advance,

Mohamed Ali

[Sanket_Parekh]

Hi @mohamed-ali_fod ,

I hope you are doing well.

Please mention the processor part number and board directory used in u-boot-imx in your case.

Please try using the latest u-boot-imx version.

Please make sure that the correct UID(read from fuses) is used in CSF.

Thanks & Regards,

Sanket Parekh

[mohamed-ali_fod]

Hi Sanket,

My original CSF was:

[Unlock]
Engine = CAAM
Features = RNG

I replace it by

[Unlock]
Engine = OCOTP
Features = FIELD RETURN
UID = 0x1f,0x09 ,0x64 ,0xd9 ,0xd4 ,0xc1 ,0x0c ,0x04

I think I have to keep both unlock sections, could you please confirm?

I tried also to load (using jlink) signed u-boot to my secure board (I activate only the SEC_CONFIG bit) , the load works but I got no console:

Downloading file [./u-boot-spinor-signed.imx.bin]...
O.K.

VerifyBin ./u-boot-spinor-signed.imx.bin 0x177ff400
Loading binary file ./u-boot-spinor-signed.imx.bin
Reading 689472 bytes data from target memory @ 0x177FF400.
Verify successful.

Using the same u-boot binary, the console works on non secure board.

Any idea?

Thank you in advance,

Mohamed Ali

[Sanket_Parekh]

Hi @mohamed-ali_fod 

I hope you are doing well.

Yes, One needs to keep both Unlock sections.

Please refer to 5.2.13 Unlock (HAB only) in Code-Signing Tool User’s Guide for more information related to unlock command.

Please cross-check that the correct UID (in the correct endian) is used in CSF.

Thanks & Regards,

Sanket Parekh

[mohamed-ali_fod]

Hi Sanket,

I hope you are doing well. Thank you for the confirmation, the field return works if I kept both Unlock sections.

One last question: 

How it is possible to run signed uboot in secured board using jlink? 

I am using the following commands but the u-boot run only in non secured board, in case of secured board the u-boot is loaded in RAM but doesn't run:

loadbin ./u-boot-spinor-signed.imx.bin 0x177ff400
SetPC 0x17800000
g

Best regards,

Mohamed Ali

[Sanket_Parekh]

Hi @mohamed-ali_fod 

I hope you are doing well.

Glad to know that field return works well.

Yes, It is possible to run a signed uboot in a secured board using JTAG

Please raise another case for further queries.

Thanks & Regards,

Sanket Parekh