1U-Boot for Freescale i.MX6 2 3This file contains information for the port of U-Boot to the Freescale i.MX6 4SoC. 5 61. CONVENTIONS FOR FUSE ASSIGNMENTS 7----------------------------------- 8 91.1 MAC Address: It is stored in fuse bank 4, with the 32 lsbs in word 2 and the 10 16 msbs in word 3[15:0]. 11 For i.MX6SX and i.MX6UL, they have two MAC addresses. The second MAC address 12 is stored in fuse bank 4, with the 16 lsb in word 3[31:16] and the 32 msbs in 13 word 4. 14 15Example: 16 17For reading the MAC address fuses on a MX6Q: 18 19- The MAC address is stored in two fuse addresses (the fuse addresses are 20described in the Fusemap Descriptions table from the mx6q Reference Manual): 21 220x620[31:0] - MAC_ADDR[31:0] 230x630[15:0] - MAC_ADDR[47:32] 24 25In order to use the fuse API, we need to pass the bank and word values, which 26are calculated as below: 27 28Fuse address for the lower MAC address: 0x620 29Base address for the fuses: 0x400 30 31(0x620 - 0x400)/0x10 = 0x22 = 34 decimal 32 33As the fuses are arranged in banks of 8 words: 34 3534 / 8 = 4 and the remainder is 2, so in this case: 36 37bank = 4 38word = 2 39 40And the U-Boot command would be: 41 42=> fuse read 4 2 43Reading bank 4: 44 45Word 0x00000002: 9f027772 46 47Doing the same for the upper MAC address: 48 49Fuse address for the upper MAC address: 0x630 50Base address for the fuses: 0x400 51 52(0x630 - 0x400)/0x10 = 0x23 = 35 decimal 53 54As the fuses are arranged in banks of 8 words: 55 5635 / 8 = 4 and the remainder is 3, so in this case: 57 58bank = 4 59word = 3 60 61And the U-Boot command would be: 62 63=> fuse read 4 3 64Reading bank 4: 65 66Word 0x00000003: 00000004 67 68,which matches the ethaddr value: 69=> echo ${ethaddr} 7000:04:9f:02:77:72 71 72Some other useful hints: 73 74- The 'bank' and 'word' numbers can be easily obtained from the mx6 Reference 75Manual. For the mx6quad case, please check the "46.5 OCOTP Memory Map/Register 76Definition" from the "i.MX 6Dual/6Quad Applications Processor Reference Manual, 77Rev. 1, 04/2013" document. For example, for the MAC fuses we have: 78 79Address: 8021B_C620 Value of OTP Bank4 Word2 (MAC Address)(OCOTP_MAC0) 81 8221B_C630 Value of OTP Bank4 Word3 (MAC Address)(OCOTP_MAC1) 83 84- The command '=> fuse read 4 2 2' reads the whole MAC addresses at once: 85 86=> fuse read 4 2 2 87Reading bank 4: 88 89Word 0x00000002: 9f027772 00000004 90 912. Using imx_usb_loader for first install with SPL 92-------------------------------------------------- 93 94imx_usb_loader is a very nice tool by Boundary Devices that 95allow to install U-Boot without a JTAG debugger, using 96the USB boot mode as described in the manual. It is 97a replacement for Freescale's MFGTOOLS. 98 99The sources can be found here: 100 101 https://github.com/boundarydevices/imx_usb_loader.git 102 103Booting in USB mode, the i.MX6 announces itself to the Linux Host as: 104 105Bus 001 Device 111: ID 15a2:0061 Freescale Semiconductor, Inc. 106 107imx_usb_loader is able to download a single file (u-boot.imx) 108to the board. For boards without SPL support, it is enough to 109issue the command: 110 111 sudo ../imx_usb_loader/imx_usb -v u-boot.imx 112 113Getting U-Boot when SPL support is active, it requires 114two downloads. imx_usb_loader downloads the SPL into 115OCRAM and starts it. SPL will check for a valid u-boot.img, and 116because it is not found, it will wait for it using the y-modem 117protocol via the console. 118 119A first install is then possible by combining imx_usb_loader with 120another tool such as kermit. 121 122sudo ../imx_usb_loader/imx_usb -v SPL 123kermit kermit_uboot 124 125and kermit_uboot contains something like this (set line should be adjusted): 126 127set line /dev/ttyUSB1 128set speed 115200 129SET CARRIER-WATCH OFF 130set flow-control none 131set handshake none 132set prefixing all 133set file type bin 134set protocol ymodem 135send u-boot.img 136c 137 138The last "c" command tells kermit (from ckermit package in most distros) 139to switch from command line mode to communication mode, and when the 140script is finished, the U-Boot prompt is shown in the same shell. 141 1423. Using Secure Boot on i.MX6 machines with SPL support 143------------------------------------------------------- 144 145This version of U-Boot is able to build a signable version of the SPL 146as well as a signable version of the U-Boot image. The signature can 147be verified through High Assurance Boot (HAB). 148 149CONFIG_SECURE_BOOT is needed to build those two binaries. 150After building, you need to create a command sequence file and use 151Freescales Code Signing Tool to sign both binaries. After creation, 152the mkimage tool outputs the required information about the HAB Blocks 153parameter for the CSF. During the build, the information is preserved 154in log files named as the binaries. (SPL.log and u-boot-ivt.log). 155 156More information about the CSF and HAB can be found in the AN4581. 157https://cache.freescale.com/files/32bit/doc/app_note/AN4581.pdf 158 159We don't want to explain how to create a PKI tree or SRK table as 160this is well explained in the Application Note. 161 162Example Output of the SPL (imximage) creation: 163 Image Type: Freescale IMX Boot Image 164 Image Ver: 2 (i.MX53/6/7 compatible) 165 Mode: DCD 166 Data Size: 61440 Bytes = 60.00 kB = 0.06 MB 167 Load Address: 00907420 168 Entry Point: 00908000 169 HAB Blocks: 00907400 00000000 0000cc00 170 171Example Output of the u-boot-ivt.img (firmware_ivt) creation: 172 Image Name: U-Boot 2016.11-rc1-31589-g2a4411 173 Created: Sat Nov 5 21:53:28 2016 174 Image Type: ARM U-Boot Firmware with HABv4 IVT (uncompressed) 175 Data Size: 352192 Bytes = 343.94 kB = 0.34 MB 176 Load Address: 17800000 177 Entry Point: 00000000 178 HAB Blocks: 0x177fffc0 0x0000 0x00054020 179 180The CST (Code Signing Tool) can be downloaded from NXP. 181# Compile CSF and create signature 182./cst --o csf-u-boot.bin < command_sequence_uboot.csf 183./cst --o csf-SPL.bin < command_sequence_spl.csf 184# Append compiled CSF to Binary 185cat SPL csf-SPL.bin > SPL-signed 186cat u-boot-ivt.img csf-u-boot.bin > u-boot-signed.img 187 188These two signed binaries can be used on an i.MX6 in closed 189configuration when the according SRK Table Hash has been flashed.