Cannot update secured uboot after having closed device - bricked device

gasmbas · August 6, 2019, 8:41pm

Hello,
I have an issue trying to recover my module. I was trying to assure that my device was secure and this is the test I did.

Reach a proper uboot with HAB features OK, and no HAB events.
Close the device programming proper fuse
Restart, everything was fine.

Now I wanted to load an untrusted uboot on purpose to simulate a hack try. Since I couldn’t get into recovery mode to load a new uboot, I started the board regularly, reboot into uboot menu, and then lauch Toradex Easy Installer from external SD (by running run distro_bootcmd)

The installation was performed correctly.
After the reboot, no output at stdout in debug serial port. Good sign. The new uboot doesn’t work as expected.
So, now, I want to load a working uboot again.

Now the module is bricked!

Here comes the problem: I couldn’t make it boot in uboot neither recovery mode.
I also tried with update.sh -d with no luck.

What can I do?

Thanks and best regards,
Gaston

jeremias.tx · August 6, 2019, 11:39pm

Greetings @gasmbas,

Unfortunately this fix won’t be very trivial. You can put your module into recovery mode via a hardware method as specified here.

Next in order to load software you could use the same method that our Easy Installer tool uses. The Toradex Easy Installer uses a utility that makes use of the i.MX SDP (serial download protocol) in order to load the Easy Installer image to the module. This utility does have the capability of loading signed binaries as well.

There is a good blog here where towards the bottom they talk about using the imx_usb_loader utility (similar utility to what Easy Installer uses) to load a HAB signed binary.

Unfortunately I don’t believe anyone here at Toradex including myself has ever tried this. So I will be unable to elaborte any further on this method.

I hope this helps lead you in the right direction where you are able to recover your module.

Best Regards,
Jeremias

gasmbas · August 7, 2019, 1:25pm

Hi Jeremias,

Procedure 1 - through recovery mode:

lsusb
Bus 002 Device 007: ID 15a2:0080 Freescale Semiconductor, Inc.

However, when I try

./recovery-linux.sh   
Downloading Toradex Easy Installer...
[sudo] password for gaston: 
Could not open device vid=0x1b67 pid=0x4000

Downloading Toradex Easy Installer failed...

That is what I get.

Procedure 2 - Flashing from scratch

link text
And this is the output:

./update.sh -d     
Colibri iMX6 rootfs detected
[sudo] password for gaston: 
config file </home/gaston/Downloads/vloud/Colibri-iMX6_LXDE-Image_2.8.6/imx_flash//imx_usb.conf>
vid=0x15a2 pid=0x0054 file_name=mx6_usb_rom.conf
-> vid=0x1b67 pid=0x4fff file_name=mx6_usb_sdp_spl.conf
vid=0x15a2 pid=0x0061 file_name=mx6_usb_rom.conf
-> vid=0x1b67 pid=0x4fff file_name=mx6_usb_sdp_spl.conf
vid=0x15a2 pid=0x0076 file_name=mx7_usb_rom.conf
vid=0x15a2 pid=0x0080 file_name=mx6ull_usb_rom.conf
vid=0x15a2 pid=0x006a file_name=vybrid_usb_rom.conf
mx6ull_usb_rom.conf not found

Procedure 3 - through imx_usb_loader
I downloaded from git following the steps from the site.
I think it is not working correctly since I tried to load different u-boot.imx (to my bricked board and another sample) and there is no change reflected.

(in my sample)

sudo ./imx_usb u-boot-nand.imx       
config file <.//imx_usb.conf>
vid=0x066f pid=0x3780 file_name=mx23_usb_work.conf
vid=0x15a2 pid=0x004f file_name=mx28_usb_work.conf
vid=0x15a2 pid=0x0052 file_name=mx50_usb_work.conf
vid=0x15a2 pid=0x0054 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0061 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0063 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0071 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x007d file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0080 file_name=mx6ull_usb_work.conf
vid=0x1fc9 pid=0x0128 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0076 file_name=mx7_usb_work.conf
vid=0x1fc9 pid=0x0126 file_name=mx7ulp_usb_work.conf
vid=0x15a2 pid=0x0041 file_name=mx51_usb_work.conf
vid=0x15a2 pid=0x004e file_name=mx53_usb_work.conf
vid=0x15a2 pid=0x006a file_name=vybrid_usb_work.conf
vid=0x066f pid=0x37ff file_name=linux_gadget.conf
vid=0x1b67 pid=0x4fff file_name=mx6_usb_sdp_spl.conf
vid=0x0525 pid=0xb4a4 file_name=mx6_usb_sdp_spl.conf
vid=0x1fc9 pid=0x012b file_name=mx8mq_usb_work.conf
vid=0x1fc9 pid=0x0134 file_name=mx8mm_usb_work.conf
vid=0x3016 pid=0x1000 file_name=mx8mm_usb_sdp_spl.conf
config file <.//mx6ull_usb_work.conf>
parse .//mx6ull_usb_work.conf
Trying to open device vid=0x15a2 pid=0x0080
Interface 0 claimed
HAB security state: production mode (0x12343412)
== work item
filename u-boot-nand.imx
load_size 0 bytes
load_addr 0x00000000
dcd 1
clear_dcd 0
plug 1
jump_mode 3
jump_addr 0x00000000
== end work item
loading DCD table @0x910000

<<<488, 488 bytes>>>
succeeded (security 0x12343412, status 0x128a8a12)
clear dcd_ptr=0x877ff42c

loading binary file(u-boot-nand.imx) to 877ff000, skip=0, fsize=87000 type=aa

<<<552960, 552960 bytes>>>
succeeded (security 0x12343412, status 0x88888888)
jumping to 0x877ff400
failed (security 0x12343412, status 0x33220a00)

(in another sample)

sudo ./imx_usb u-boot-nand-signed.imx
config file <.//imx_usb.conf>
vid=0x066f pid=0x3780 file_name=mx23_usb_work.conf
vid=0x15a2 pid=0x004f file_name=mx28_usb_work.conf
vid=0x15a2 pid=0x0052 file_name=mx50_usb_work.conf
vid=0x15a2 pid=0x0054 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0061 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0063 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0071 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x007d file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0080 file_name=mx6ull_usb_work.conf
vid=0x1fc9 pid=0x0128 file_name=mx6_usb_work.conf
vid=0x15a2 pid=0x0076 file_name=mx7_usb_work.conf
vid=0x1fc9 pid=0x0126 file_name=mx7ulp_usb_work.conf
vid=0x15a2 pid=0x0041 file_name=mx51_usb_work.conf
vid=0x15a2 pid=0x004e file_name=mx53_usb_work.conf
vid=0x15a2 pid=0x006a file_name=vybrid_usb_work.conf
vid=0x066f pid=0x37ff file_name=linux_gadget.conf
vid=0x1b67 pid=0x4fff file_name=mx6_usb_sdp_spl.conf
vid=0x0525 pid=0xb4a4 file_name=mx6_usb_sdp_spl.conf
vid=0x1fc9 pid=0x012b file_name=mx8mq_usb_work.conf
vid=0x1fc9 pid=0x0134 file_name=mx8mm_usb_work.conf
vid=0x3016 pid=0x1000 file_name=mx8mm_usb_sdp_spl.conf
config file <.//mx6ull_usb_work.conf>
parse .//mx6ull_usb_work.conf
Trying to open device vid=0x15a2 pid=0x0080
Interface 0 claimed
HAB security state: development mode (0x56787856)
== work item
filename u-boot-nand-signed.imx
load_size 0 bytes
load_addr 0x00000000
dcd 1
clear_dcd 0
plug 1
jump_mode 3
jump_addr 0x00000000
== end work item
loading DCD table @0x910000

<<<488, 488 bytes>>>
succeeded (security 0x56787856, status 0x128a8a12)
clear dcd_ptr=0x877ff42c

loading binary file(u-boot-nand-signed.imx) to 877ff000, skip=0, fsize=8b938 type=aa

<<<571704, 571704 bytes>>>
succeeded (security 0x56787856, status 0x88888888)
jumping to 0x877ff400

gasmbas · August 7, 2019, 2:27pm

I think it is not working correctly since I tried to load different u-boot.imx (to my bricked board and another sample) and there is no change reflected.

I say this because in the “another sample”, I first load a regular uboot with no hab features (so hab_status command was not available) using Toradex Easy installer. Then, I tried to load a signed uboot containing hab features using imx_usb_loader and even showing correct flash, the hab_status command was not present either.

jeremias.tx · August 7, 2019, 6:03pm

Procedure 1
Yes I would expect this outcome since the easy installer image doesn’t have a proper CSF attached.

Procedure 2
I don’t believe the update.sh script has support for signed binaries.

Procedure 3
Where did you get the imx_usb_loader source from? The one we use at Toradex for the easy installer is a separate fork located here:GitHub - toradex/imx_loader: USB/UART serial loader for i.MX51/53/6x/7/Vybrid. Also I’m not quite sure why you’re seeing that result on your other sample. Have you burned any fuses on your this other sample?

Also the binary you’re trying to flash with the loader tool. Has the CSF been modified as suggested in the boundary devices blog I linked in my original post?

Either way the hab_status command should be dependent on whether it was compiled into the U-Boot binary so this result is unexpected.

Jayanth · January 14, 2020, 12:58pm

Hello,
Even I am facing the exact similar issue in I.MX7D module.
After closing the device I tried to flash an unsigned image to my board via easy installer application. The device didn’t booted up and is freezed.
So any solution to this .
How to recover the module back so that i can test both my signed and unsignd images via easy installer application .
Kindly address this at the earliest plz.

Jayanth · January 14, 2020, 1:00pm

Hello @gasmbas did you find any solution to the above specified
problem .