I am trying to finalize setting up secure boot on our custom board with i.MX6.
I have generated certificates with hab4_pki_tree.sh and built a signed U-boot. Attached the CSF source.
Programmed the SRK hash fuses from U-boot, hab_status returned "No HAB events".
Tried to modify a single byte in the U-boot image, hab_status returned events (failure).
Reverted to good U-boot image, and closed the configuration (burn SEC_CONFIG fuse):
=> fuse prog 0 6 0x02
Then I tried to reset, and board does not boot now.
And just to ensure the signed U-boot has the CSF pointer set:
$ dd if=./u-boot_csf.imx bs=4 count=12 2>/dev/null | hexdump -v -e '/4 "%04_ax: "' -e '/4 "%08X" "\n"'
This is the second board i "brick", the first one I burned a lot of different fuses regarding disabling JTAG etc. at the same time, so I was not sure what caused the board not to boot. I write "brick" in quotes because I hope by making a new signed U-boot I will be able to resurrect the boards. However, since U-boot is in SPI flash, I need to use a programmer to change U-boot, so not as easy as changing an SD-card.
I welcome any suggestions for how to proceed.
Mikkel Holm Olsen
Original Attachment has been moved to: u-boot.csf.zip