Production Mode on imx25

[leonardoalmeida]

Hello all.

I've got a problem and I hope anyone can help.

I'll say what have been done...

First, I've blown srk fuses and boot fuses. The board was booted sucessfully.

The Dryice DSR register after boot: "DRYICE_DSR = 00000100".

The HAB state was:

MX25 U-Boot > md.b 0x780018D4 0x10

780018d4: f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Then, right after, I've blowed the HAB_TYPE fuse for production mode. Here is the commented log (I've made a u-boot command for that):

//Getting a unsigned u-boot image:
MX25 U-Boot > sf probe 1 0 0;sf erase 0 0x40000;tftpboot ${loadaddr} u-boot-Fabrica.bin;sf write ${loadaddr} 0 0x40000;reset
4096 KiB M25P32 at 0:1 is now current device
SF: STMicro: Successfully erased 262144 bytes @ 0x0
cmdtp = L¸òƒ
argc = åðŸåðŸåðŸåðŸåðŸåðŸåðŸåt…@
argv[0] = tftpboot
argv[1] = 0x80800000
FEC: enable RMII gasket
Using FEC0 device
TFTP from server XXX.XXX.XXX.XXX; our IP address is XXX.XXX.XXX.XXX
Filename 'u-boot-Fabrica.bin'.
Load address: 0x80800000
Loading: T #########################################
done
Bytes transferred = 204824 (32018 hex)
resetting ...

U-Boot 2009.08-svn356 (Oct 30 2013 - 16:08:33)

CPU:   Freescale i.MX25 at 398 MHz
mx25 cpu clock: 398MHz
ipg clock     : 66498560Hz
Board: i.MX25 MAX PDK (3DS)
I2C:   ready
DRAM:  64 MB
NAND:  2 NAND chips detected
Manufacturer      : Micron (0x2c)
Device Code       : 0xdc
Cell Technology   : SLC
Chip Size         : 512 MiB
Pages per Block   : 64
Page Geometry     : 2048+64
ECC Strength      : 4 bits
ECC Size          : 512 B
Data Setup Time   : 20 ns
Data Hold Time    : 10 ns
Address Setup Time: 10 ns
GPMI Sample Delay : 6 ns
tREA              : Unknown
tRLOH             : Unknown
tRHOH             : Unknown
Description       : MT29F4G08AAA
Bad block table found at page 524224, version 0x01
Bad block table found at page 524160, version 0x01
1024 MiB
DRYICE_DSR = 00000100
MMC:   FSL_ESDHC: 0
In:    serial
Out:   serial
Err:   serial
i2c_addr:chip address cycle fail(a1)
Net:   FEC: enable RMII gasket
FEC0
Hit any key to stop autoboot:  0
Environment size: 1219/262140 bytes
//Getting HAB State
MX25 U-Boot > md.b 0x780018D4 0x10
780018d4: 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    N...............

//Getting a signed image
MX25 U-Boot > sf probe 1 0 0;sf erase 0 0x40000;tftpboot ${loadaddr} u-boot-Alone-signed-FUSE.bin;sf write ${loadaddr} 0 0x40000;reset
4096 KiB M25P32 at 0:1 is now current device
SF: STMicro: Successfully erased 262144 bytes @ 0x0
cmdtp = t¸òƒ
argc = åðŸåðŸåðŸåðŸåðŸåðŸåðŸåt…@
argv[0] = tftpboot
argv[1] = 0x80800000
FEC: enable RMII gasket
Using FEC0 device
TFTP from server XXX.XXX.XXX.XXX; our IP address is XXX.XXX.XXX.XXX
Filename 'u-boot-Alone-signed-FUSE.bin'.
Load address: 0x80800000
Loading: ############################################
done
Bytes transferred = 223002 (3671a hex)
resetting ...

U-Boot 2009.08-svn356 (Oct 30 2013 - 16:08:33)

CPU:   Freescale i.MX25 at 398 MHz
mx25 cpu clock: 398MHz
ipg clock     : 66498560Hz
Board: i.MX25 MAX PDK (3DS)
I2C:   ready
DRAM:  64 MB
NAND:  2 NAND chips detected
Manufacturer      : Micron (0x2c)
Device Code       : 0xdc
Cell Technology   : SLC
Chip Size         : 512 MiB
Pages per Block   : 64
Page Geometry     : 2048+64
ECC Strength      : 4 bits
ECC Size          : 512 B
Data Setup Time   : 20 ns
Data Hold Time    : 10 ns
Address Setup Time: 10 ns
GPMI Sample Delay : 6 ns
tREA              : Unknown
tRLOH             : Unknown
tRHOH             : Unknown
Description       : MT29F4G08AAA
Bad block table found at page 524224, version 0x01
Bad block table found at page 524160, version 0x01
1024 MiB
DRYICE_DSR = 00000100
MMC:   FSL_ESDHC: 0
In:    serial
Out:   serial
Err:   serial
i2c_addr:chip address cycle fail(a1)
Net:   FEC: enable RMII gasket
FEC0
Hit any key to stop autoboot:  0
//Getting HAB State
MX25 U-Boot > md.b 0x780018D4 0x10
780018d4: f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................

//Blowing SRK0_LOCK96 and SRK0_LOCK160 fuses
MX25 U-Boot > fuse init srklock
bank = 2 - row = 0000 - value = 03
iim_addr = 00000000
Blowing fuse at bank:2 row:0 value:3
blowing addr_h=0x10, addr_l=0x0
blowing addr_h=0x10, addr_l=0x1
sense_fuse: addr_h=0x10, addr_l=0x00
fuses at (bank:2, row:0) = 0x3
Read fuse at bank:2 row:0
sense_fuse: addr_h=0x10, addr_l=0x00
fuses at (bank:2, row:0) = 0x3
MX25 U-Boot > reset
resetting ...

U-Boot 2009.08-svn356 (Oct 30 2013 - 16:08:33)

CPU:   Freescale i.MX25 at 398 MHz
mx25 cpu clock: 398MHz
ipg clock     : 66498560Hz
Board: i.MX25 MAX PDK (3DS)
I2C:   ready
DRAM:  64 MB
NAND:  2 NAND chips detected
Manufacturer      : Micron (0x2c)
Device Code       : 0xdc
Cell Technology   : SLC
Chip Size         : 512 MiB
Pages per Block   : 64
Page Geometry     : 2048+64
ECC Strength      : 4 bits
ECC Size          : 512 B
Data Setup Time   : 20 ns
Data Hold Time    : 10 ns
Address Setup Time: 10 ns
GPMI Sample Delay : 6 ns
tREA              : Unknown
tRLOH             : Unknown
tRHOH             : Unknown
Description       : MT29F4G08AAA
Bad block table found at page 524224, version 0x01
Bad block table found at page 524160, version 0x01
1024 MiB
DRYICE_DSR = 00000100
MMC:   FSL_ESDHC: 0
In:    serial
Out:   serial
Err:   serial
i2c_addr:chip address cycle fail(a1)
Net:   FEC: enable RMII gasket
FEC0
Hit any key to stop autoboot:  0
//Getting HAB State
MX25 U-Boot > md.b 0x780018D4 0x10
780018d4: f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................
//Blowing HAB_TYPE and BOOT_LOCK fuses
MX25 U-Boot > fuse init bootlock
bank = 0 - row = 0004 - value = 0b
iim_addr = 00000010
Blowing fuse at bank:0 row:4 value:11
blowing addr_h=0x0, addr_l=0x20
blowing addr_h=0x0, addr_l=0x21
blowing addr_h=0x0, addr_l=0x23
sense_fuse: addr_h=0x00, addr_l=0x20
fuses at (bank:0, row:4) = 0xb
Read fuse at bank:0 row:4
sense_fuse: addr_h=0x00, addr_l=0x20
fuses at (bank:0, row:4) = 0xb
bank = 0 - row = 0000 - value = 01
iim_addr = 00000000
Blowing fuse at bank:0 row:0 value:1
blowing addr_h=0x0, addr_l=0x0
sense_fuse: addr_h=0x00, addr_l=0x00
fuses at (bank:0, row:0) = 0x11
Read fuse at bank:0 row:0
sense_fuse: addr_h=0x00, addr_l=0x00
fuses at (bank:0, row:0) = 0x11
MX25 U-Boot > reset
resetting ...
//No boot! It goes to UART boot

Here becomes the problem. The board is not booting anymore, it goes to UART boot. When I power on the board, the windows pc identifies the USB driver from board.

On ATK MAX, when I send any command (such as memory dump), it comes the error attached.

Can anyone help how to use ATK for download a signed u-boot image and how to figure out why this board is not booting anymore? As far as I know, if HAB state was in 0xf0 in Engineering Mode, then in production mode it should work, too.

Another question, if Dryice  enables an alarm, would be also possible to download a signed u-boot image?

I appreciate your help!

Leonardo

[maheshmahadeva1]

Could you take a look at the below App note related to Secure boot and see if you are missing anything:

http://cache.freescale.com/files/32bit/doc/app_note/AN4547.pdf?fpsp=1&WT_TYPE=Application%20Notes&WT...

Best regards,

-Mahesh

[leonardoalmeida]

Hi, Mahesh.

Thanks for answering. I've noticed that the signed u-boot inboard was signed with CST_boot set for Engineering, not Production. In order to be more specific, in field [Header], the parameter "Security Configuration" was Engineering instead of Production (visible in section 9 from the document you've sent).

I think it might cause a HAB error, 0x2e or 0x35.

I really don't know for sure this is the reason for not booting and how to fix it in that board. Now, I'm trying to sign the ATK image for inserting a Production signed image into that board.

That is the only thing I miss following this link: https://community.freescale.com/docs/DOC-94911

Best Regards,

Leonardo

[maheshmahadeva1 · Accepted solution]

Can you re-sign the U-Boot and program the new signed U-Boot to your boot media?

Best regards,

-Mahesh

[leonardoalmeida]

HI, Mahesh.

I've signed an u-boot image for Production mode configuration. When I insert it into an Engineering mode board, I got 0x2e HAB error, then I suppose the signed u-boot image is fine. I've tried to sign the ATK Image in order to insert this image into the production mode board. I've followed the example inside the ATK MAX for imx51, changing addresses. Unfortunatly, the ATK image is not working in production mode board.

What I really need now is this, having a way for inserting a new signed image into a production mode board.

Thanks again for replying.

Best Regards,

Leonardo

[YixingKong]

Leo

Had your issue got resolved? If yes, we are going to close the discussion in 3 days. If you still need help, please feel

free to reply with an update to this discussion.

Thanks,
Yixing

[leonardoalmeida]

Hello, Yixing.

I'm almost sure that it has been solved. The problem might be about EEPROM_CFG fuse that has not been blowed. I've blown only one board for production mode after it, but I've not erased the boot device for testing if the signed u-boot will be stored correctly into the device again using MFGTools. Following Bruno Castelucci 's advice, it should work.

Anyway, you may close this thread if you desire. I will contact you again if I get the problem again.

Thanks.

[bfac]

karinavalencia, can you help us prioritizing this issue?

[karina_valencia]

hi Bruno,

This question was not created into i.MX Community.

Please create it in the right space to  receive support.

[bfac]

Done. on imxcommunity now.

[karina_valencia]

MaheshMahadevan can you help on this case?