Secure imx8qxp fastboot uuu u-boot

[grichards-vt]

Hi

I am working on secure boot for our product based on the imx8qxp. Our flash recovery processes uses uuu.

I was wondering if there was any more information available about securing the flashing process?

Ideally we would like to disable fastboot in u-boot except for the case in which Serial Download mode is activated. Is there an existing way to check if u-boot has been booted in this manner maybe via an SCU query or similar?

I see in the Security Manual (Table 3-32. Host and Device USB Serial Download Boot Flow) it mentions that the initial image is authenticated if needed - does this mean only when the device is considered closed?

[AldoG · Accepted solution]

Hello,

There is no secure mechanism for flashing, I think that it is not needed nor see any use case for this, the best usage would be secure boot that would make it that even if an image is flashed if it is not signed then it won't boot.

Also, regarding your second question if the device went under serial downloader then there is no uboot, meaning no fastboot protocol, just disable fastboot from uboot, and everytime you need to flash a new image, the Uboot image that will be run using UUU needs to have fastboot enabled.

For third question, yes you are correct the image won't be authenticated unless it is closed, as specified above secure boot enabled.

Best regards/Saludos,
Aldo.