AM625: How to secure boot sequence when using primary and backup boot mode ?

Alexis, which eMMC type boot will you be using?

-eMMC boot using the eMMC boot partitions  BOOTMODE[6:3]=1001b

-eMMC boot using UDA boot mode  BOOTMODE[6:3]=1000b

In what you show, you have selected booting from eMMC boot partitions

If you are booting eMMC, ensure you are using port 0 (ie MMC0) pins.

During production, if the eMMC is empty, the ROM will skip over the primary boot source and attempt to boot from the secondary source, in this case Ethernet.  Note that there is a bug in the ROM code and the timeout to determine the empty eMMC can be up to a 180sec depending on the type of eMMC boot mode that you are using (see my first question).  Please consider this in your production, this may be too long to wait.

You can change the bootmode settings in the MAIN_DEVSTAT register, and the new settings would be applied after a warm reset.  So this could be a way to disable the backup boot mode.  However, on a cold reset, the bootmode pins would get relatched.  The only way to change the backup boot mode on a cold reset would be to change the BOOTMODE signals state on the board.

Regards,

james

Alexis, what flexibility on the board do you have?  For example, do you have the opportunity to change the board before or after flashing the eMMC (eg, change bootmode settings) 

JTAG should work, but I'm not sure we have developed a flash utility to flash eMMC thru JTAG.  I will check

Regards,

James

Hello James,

I discussed with the design team, and we can't change the hardware configuration after flashing.

What are you thinking about before flashing ?

Could you confirm that the bug is present for the eMMc we will use ?

Regards,

Alexis.

Alexis, the bug isn't dependent on the type of eMMC, it is dependent on the bootmode you are using. 

You can avoid the timeout delay if you use eMMC Boot using UDA, raw mode (BOOTMODE[13:0]=0_110X_1100_0011).  With this bootmode the detection of the empty flash is almost immediate, and the ROM will attempt to boot from the secondary boot mode without any delay.  Other eMMC bootmodes will incur a multisecond timeout delay as mentioned above before executing the secondary boot mode.

Regards,

James

Hi James

thank you very much 

please we need some help :

- Could you give me more information about this mode and the constraint.

In particular:

• Is there a specific procedure for secure boot to apply different from before ? 

• Does it request to modify yocto image to make it boot from eMMC.

• Could you provide an app note regarding how to use this bootmode.

 thank you 

BR
Carlo

Hello Carlo, James,

I read the TRM about the boots mode eMMC and MMCSD.

I wondering if it is possible to bypass the issue by adding a dip switch for BOOTMODE[3] on the board in order to switch from  MMCSD boot to eMMC boot after we flashed the eMMC during production cycle.

Could you confirm that the configuration BOOTMODE[3:9] differ only from only 1 bit ?

BOOTMODE[3] = DIP SWITCH (ON eMMC Boot , OFF MMCSD Boot)

BOOTMODE[6:4] = 100b

BOOTMODE[9:7] = 000b (Port 0, Reserved, FS Mode)

Let me know as soon possible.

Thanks for you help.

Regards,

Alexis.

Alexis,

ok, i thought you mentioned you could not change the bootmode pins after flashing.  But if you could, that would be great.  I think you would want to have the flexibility to change bit7:

You would choose BOOTMODE[13:0]=01_000X_1100_0011 for production flashing.  For an empty eMMC, the primary boot mode would be skipped right away and the ROM would move to the secondary boot mode.  Then you would flash the device, and change BOOTMODE7 for FS mode (if that is what you desire), which is BOOTMODE[13:0]=01_000X_0100_0011

My color coding is:

Blue: Secondary boot mode: Ethernet RGMII with internal TX delay

Green: Primary boot config: eMMC on port 0, bit 7 is either raw mode (for production flashing) or FS mode (for normal booting)

Pink: Primary boot mode: eMMC Boot using UDA

Black: Crystal selection (25MHz)

 Let me know if this makes sense

Regards,

James

Hello James,

I was also thinking that it could be possible to keep a dip switch on the board to boot the first time in UDA, then go back to eMMC Boot after flashing.

But it won't be possible.

The solution will be to short cut to bit 3 to ground during the flashing sequence to make the boot in UDA mode, and make the boot mode switch to backup mode in ethernet in less that 180 sec.

The pullup on the bit 3 is 470 Ohm, so could you confirms that this shortcut to ground will not have negative impact ?

Regards,

Alexis.

Hi Alexis, is that pin only connected to the pullup?  That's a really strong pull (usually see something on the order of 10k), but i think grounding it temporarily at power up should be ok.

Regards,

James

Hi James,

The pullup is 470 ohm and there is also a pulldown a 47kOhm.

I will give a try to test the behavior, I will keep you updated.

Regards,

Alexis.