README.imx6 5.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189
  1. U-Boot for Freescale i.MX6
  2. This file contains information for the port of U-Boot to the Freescale i.MX6
  3. SoC.
  4. 1. CONVENTIONS FOR FUSE ASSIGNMENTS
  5. -----------------------------------
  6. 1.1 MAC Address: It is stored in fuse bank 4, with the 32 lsbs in word 2 and the
  7. 16 msbs in word 3[15:0].
  8. For i.MX6SX and i.MX6UL, they have two MAC addresses. The second MAC address
  9. is stored in fuse bank 4, with the 16 lsb in word 3[31:16] and the 32 msbs in
  10. word 4.
  11. Example:
  12. For reading the MAC address fuses on a MX6Q:
  13. - The MAC address is stored in two fuse addresses (the fuse addresses are
  14. described in the Fusemap Descriptions table from the mx6q Reference Manual):
  15. 0x620[31:0] - MAC_ADDR[31:0]
  16. 0x630[15:0] - MAC_ADDR[47:32]
  17. In order to use the fuse API, we need to pass the bank and word values, which
  18. are calculated as below:
  19. Fuse address for the lower MAC address: 0x620
  20. Base address for the fuses: 0x400
  21. (0x620 - 0x400)/0x10 = 0x22 = 34 decimal
  22. As the fuses are arranged in banks of 8 words:
  23. 34 / 8 = 4 and the remainder is 2, so in this case:
  24. bank = 4
  25. word = 2
  26. And the U-Boot command would be:
  27. => fuse read 4 2
  28. Reading bank 4:
  29. Word 0x00000002: 9f027772
  30. Doing the same for the upper MAC address:
  31. Fuse address for the upper MAC address: 0x630
  32. Base address for the fuses: 0x400
  33. (0x630 - 0x400)/0x10 = 0x23 = 35 decimal
  34. As the fuses are arranged in banks of 8 words:
  35. 35 / 8 = 4 and the remainder is 3, so in this case:
  36. bank = 4
  37. word = 3
  38. And the U-Boot command would be:
  39. => fuse read 4 3
  40. Reading bank 4:
  41. Word 0x00000003: 00000004
  42. ,which matches the ethaddr value:
  43. => echo ${ethaddr}
  44. 00:04:9f:02:77:72
  45. Some other useful hints:
  46. - The 'bank' and 'word' numbers can be easily obtained from the mx6 Reference
  47. Manual. For the mx6quad case, please check the "46.5 OCOTP Memory Map/Register
  48. Definition" from the "i.MX 6Dual/6Quad Applications Processor Reference Manual,
  49. Rev. 1, 04/2013" document. For example, for the MAC fuses we have:
  50. Address:
  51. 21B_C620 Value of OTP Bank4 Word2 (MAC Address)(OCOTP_MAC0)
  52. 21B_C630 Value of OTP Bank4 Word3 (MAC Address)(OCOTP_MAC1)
  53. - The command '=> fuse read 4 2 2' reads the whole MAC addresses at once:
  54. => fuse read 4 2 2
  55. Reading bank 4:
  56. Word 0x00000002: 9f027772 00000004
  57. 2. Using imx_usb_loader for first install with SPL
  58. --------------------------------------------------
  59. imx_usb_loader is a very nice tool by Boundary Devices that
  60. allow to install U-Boot without a JTAG debugger, using
  61. the USB boot mode as described in the manual. It is
  62. a replacement for Freescale's MFGTOOLS.
  63. The sources can be found here:
  64. https://github.com/boundarydevices/imx_usb_loader.git
  65. Booting in USB mode, the i.MX6 announces itself to the Linux Host as:
  66. Bus 001 Device 111: ID 15a2:0061 Freescale Semiconductor, Inc.
  67. imx_usb_loader is able to download a single file (u-boot.imx)
  68. to the board. For boards without SPL support, it is enough to
  69. issue the command:
  70. sudo ../imx_usb_loader/imx_usb -v u-boot.imx
  71. Getting U-Boot when SPL support is active, it requires
  72. two downloads. imx_usb_loader downloads the SPL into
  73. OCRAM and starts it. SPL will check for a valid u-boot.img, and
  74. because it is not found, it will wait for it using the y-modem
  75. protocol via the console.
  76. A first install is then possible by combining imx_usb_loader with
  77. another tool such as kermit.
  78. sudo ../imx_usb_loader/imx_usb -v SPL
  79. kermit kermit_uboot
  80. and kermit_uboot contains something like this (set line should be adjusted):
  81. set line /dev/ttyUSB1
  82. set speed 115200
  83. SET CARRIER-WATCH OFF
  84. set flow-control none
  85. set handshake none
  86. set prefixing all
  87. set file type bin
  88. set protocol ymodem
  89. send u-boot.img
  90. c
  91. The last "c" command tells kermit (from ckermit package in most distros)
  92. to switch from command line mode to communication mode, and when the
  93. script is finished, the U-Boot prompt is shown in the same shell.
  94. 3. Using Secure Boot on i.MX6 machines with SPL support
  95. -------------------------------------------------------
  96. This version of U-Boot is able to build a signable version of the SPL
  97. as well as a signable version of the U-Boot image. The signature can
  98. be verified through High Assurance Boot (HAB).
  99. CONFIG_SECURE_BOOT is needed to build those two binaries.
  100. After building, you need to create a command sequence file and use
  101. Freescales Code Signing Tool to sign both binaries. After creation,
  102. the mkimage tool outputs the required information about the HAB Blocks
  103. parameter for the CSF. During the build, the information is preserved
  104. in log files named as the binaries. (SPL.log and u-boot-ivt.log).
  105. More information about the CSF and HAB can be found in the AN4581.
  106. https://cache.freescale.com/files/32bit/doc/app_note/AN4581.pdf
  107. We don't want to explain how to create a PKI tree or SRK table as
  108. this is well explained in the Application Note.
  109. Example Output of the SPL (imximage) creation:
  110. Image Type: Freescale IMX Boot Image
  111. Image Ver: 2 (i.MX53/6/7 compatible)
  112. Mode: DCD
  113. Data Size: 61440 Bytes = 60.00 kB = 0.06 MB
  114. Load Address: 00907420
  115. Entry Point: 00908000
  116. HAB Blocks: 00907400 00000000 0000cc00
  117. Example Output of the u-boot-ivt.img (firmware_ivt) creation:
  118. Image Name: U-Boot 2016.11-rc1-31589-g2a4411
  119. Created: Sat Nov 5 21:53:28 2016
  120. Image Type: ARM U-Boot Firmware with HABv4 IVT (uncompressed)
  121. Data Size: 352192 Bytes = 343.94 kB = 0.34 MB
  122. Load Address: 17800000
  123. Entry Point: 00000000
  124. HAB Blocks: 0x177fffc0 0x0000 0x00054020
  125. The CST (Code Signing Tool) can be downloaded from NXP.
  126. # Compile CSF and create signature
  127. ./cst --o csf-u-boot.bin < command_sequence_uboot.csf
  128. ./cst --o csf-SPL.bin < command_sequence_spl.csf
  129. # Append compiled CSF to Binary
  130. cat SPL csf-SPL.bin > SPL-signed
  131. cat u-boot-ivt.img csf-u-boot.bin > u-boot-signed.img
  132. These two signed binaries can be used on an i.MX6 in closed
  133. configuration when the according SRK Table Hash has been flashed.