mfgtool not working for iMX6Q after programming to close the device

[shunnianzhai]

Hi All,

We have a custom board with iMX6Quad processor. Everything is currently working well except that the mfgtool does NOT work any more after the chip is programmed to close the device. The board can boot successfully with the signed u-boot and kernel images without any problem.

To resolve this issue, we follow the instructions provided in Section 5.2 HABv4 closed chip support in the latest UUU doc as followed.

However, we are still not able to make it work. After sending command "boot -f u-boot.imx", nothing is happened in the console. Maybe due to the authentication failed with the u-boot image. 

Does anyone have any idea what could be wrong or any suggestion for us to try out?

Your help will be appreciated.

Thanks and regards,

Shunnian

----------------------------------

Followed is from UUU doc:

5.2 HABv4 closed chip support
For boot images not including a DCD table the same image used for SDCard/eMMC boot can be used with UUU tool.
For boot images including a DCD table, the DCD is loaded in OCRAM and must be properly signed.

For the i.MX devices not supporting the skip DCD command (i.MX6Dual/Quad and i.MX6Sololite) the pointer to the DCD table
is cleared in the IVT in order to prevent the HAB library from processing the DCD table again during the authentication process.
There is no need to re-initialize memory when it already contains valid data.
Since the IVT is modified when downloading to the target the binary must be signed with a cleared DCD pointer. However, the
binary must be provided with a valid DCD pointer to allow the UUU tool to locate the DCD table.
The following script can be used to used to handle the DCD pointer:
#!/bin/bash
# DCD address must be cleared for signature, as UUU will clear it.
if [ "$1" == "clear_dcd_addr" ]; then
# store the DCD address
dd if=$2 of=dcd_addr.bin bs=1 count=4 skip=12
# generate a NULL address for the DCD
dd if=/dev/zero of=zero.bin bs=1 count=4
# replace the DCD address with the NULL address
dd if=zero.bin of=$2 seek=12 bs=1 conv=notrunc
fi
# DCD address must be set for mfgtool to localize the DCD table.
if [ "$1" == "set_dcd_addr" ]; then
# restore the DCD address with the original address

dd if=dcd_addr.bin of=$2 seek=12 bs=1 conv=notrunc
rm zero.bin
fi
The steps below can be used as an example:
$ ./mod_4_mfgtool.sh clear_dcd_addr u-boot-dtb.imx
$ ./cst --i u-boot-csf.txt --o u-boot-csf.bin
$ ./mod_4_mfgtool.sh set_dcd_addr u-boot-dtb.imx

[Harvey021]

Hi,

"boot -f u-boot.imx. -> here, should boot signed image

Regards

Harvey

[shunnianzhai]

Hi Harvey021,

Thanks for your reply. Yes, we run this command with the signed image. However, it doesn't work as expected. Any other suggestion or area for us to look into?

We dump the ROM log buffer as below:

ROM log buffer data after "SDP: boot command" and hung:
0x00902190: 0x00010002 0x000200CC 0x00030001 0x00040000
0x009021A0: 0x00050000 0x00060001 0x00070000 0x00070033
0x009021B0: 0x00061FFF 0x000C0000 0x00090000 0x00A00C33
0x009021C0: 0x00000000 0x00000000 0x00000000 0x00000000

HAB Log:
0x00904000: 0x4214000C 0x00000033 0x000000A0 0x0093FE50
0x00904010: 0x0000000C 0x42080009 0x0006360F 0x422400DB
0x00904020: 0x1DE13069 0x02000400 0x06360040 0x03005555
0x00904030: 0x00000000 0x00000000 0x00000000 0x01000000

Do you know the meaning of data "0x00A00C33" after 0x090000 Image authentication result?

Thanks and regards,

Shunnian