i.MX8M Nano Secure Boot (HABv4) UUU Tool Flash Error with Signed Firmware

[Nethaji1510]

Hello,

We have successfully enabled secure boot on the i.Mx8M Nano board using the below command.

       $ fuse prog 1 3 0x02000000

In this case, the board successfully booted up with signed images.

Issue:  We are not able to flash the new signed firmware onto the device via USB (UUU command).

Query: Once secure boot is enabled, is USB flash also blocked ? Is there any mechanism available(Eg: GPIO HIGH/LOW) to enable the USB flash(UUU Tool) in the device.

[kef2]

• Once secure boot is enabled, is USB flash also blocked ?

No, it isn't blocked, but things are complicated "a bit". 

First of all uuu needs to load U-Boot to RAM, then launch it and finally let U-Boot receive OS image over USB and flash it. 

Unless your U-Boot binary has no DCD (which may be the case for SOC with enough startic SRAM), uuu has to upload DCD struct to SRAM, make target HAB auth DCD in SRAM, make set of commands specified in DCD initialize DDR controller, then upload the rest of U-Boot image to DDR, HAB auth it and launch U-Boot. The problem is, your normally signed image authenticates only U-Boot in DDR and doesn't provide auth records for DCD in SRAM. If you add auth records for DCD, your target won't boot, since boot ROM (most likely) doesn't copy DCD to the same address like uuu does. So you need differently signed U-Boot images to be flashed to target and to be used with uuu. Until you close your target (burn HAB fuse), the same image is OK for both uuu and native boot. But once you close it, uuu won't work with the same U-Boot. 

Here about uuu csf changes for iMX6ULL. You need to determine DCD SRAM address, DCD offset in your U-Boot image and DCD size, then replace numbers in second "Blocks=" line in suggested csf.

i.MX6UL bootloader code signing method for UUU tool - NXP Community

[Nethaji1510]

Thanks for your reply @kef2 

Did you tried of the of the same in I.Mx8MNano? It has worked?

Because it is a locked device, if anything is wrong on the bootloader board, it will go into a dead state. Is that correct?