UUU default support protocol list
UUU is scripted base multi protocol system.
Built in config:
Pctl Chip Vid Pid BcdVersion
==================================================
SDPS: MX8QXP 0x1fc9 0x012f [0x0002..0xffff]
SDPS: MX8QM 0x1fc9 0x0129 [0x0002..0xffff]
SDPS: MX8DXL 0x1fc9 0x0147
SDPS: MX28 0x15a2 0x004f
SDPS: MX815 0x1fc9 0x013e
SDPS: MX865 0x1fc9 0x0146
SDPS: MX8ULP 0x1fc9 0x014a
SDPS: MX8ULP 0x1fc9 0x014b
SDPS: MX93 0x1fc9 0x014e
SDP: MX7D 0x15a2 0x0076
SDP: MX6Q 0x15a2 0x0054
SDP: MX6D 0x15a2 0x0061
SDP: MX6SL 0x15a2 0x0063
SDP: MX6SX 0x15a2 0x0071
SDP: MX6UL 0x15a2 0x007d
SDP: MX6ULL 0x15a2 0x0080
SDP: MX6SLL 0x1fc9 0x0128
SDP: MX7ULP 0x1fc9 0x0126
SDP: MXRT106X 0x1fc9 0x0135
SDP: MX8MM 0x1fc9 0x0134
SDP: MX8MQ 0x1fc9 0x012b
SDPU: SPL 0x0525 0xb4a4 [0x0000..0x04ff]
SDPV: SPL1 0x0525 0xb4a4 [0x0500..0x9998]
SDPV: SPL1 0x1fc9 0x0151 [0x0500..0x9998]
SDPU: SPL 0x0525 0xb4a4 [0x9999..0x9999]
SDPU: SPL 0x3016 0x1001 [0x0000..0x04ff]
SDPV: SPL1 0x3016 0x1001 [0x0500..0x9998]
FBK: 0x066f 0x9afe
FBK: 0x066f 0x9bff
FBK: 0x1fc9 0x0153
FB: 0x0525 0xa4a5
FB: 0x18d1 0x0d02
FB: 0x3016 0x0001
FB: 0x1fc9 0x0152
UUU Protocol |
USB Low level transfer |
SDP |
HID i.MX6/7, i.MX8 MM, i.MX8M |
SDPU\SDPV |
HID uboot implement of SDP, SPL download uboot |
SDPS |
HID i.MX8QXP i.MX8QM |
FB |
winusb (windows), raw transfer by libusb |
FBK |
winusb (windows), raw transfer by libusb |
Run DCD from image with ivt header
dcd -f <filename>
write image to address.
write -f <filename> [-addr 0x000000] [-ivt 0]
ivt 0 means write to the address, which ivt pointer
jump to image with ivt header
jump -f <filename> [-ivt 0]
boot image, include (dcd, write and jump three commands)
boot -f <filename> [-nojump]
For boot images not including a DCD table the same image used for SDCard/eMMC boot can be used with UUU tool.
For boot images including a DCD table, the DCD is loaded in OCRAM and must be properly signed.
Since U-Boot v2017.01 a build log containing the U-Boot and DCD addresses and lengths is available just after building U-Boot:
$ cat u-boot-dtb.imx.log Image Type: Freescale IMX Boot Image Image Ver: 2 (i.MX53/6/7 compatible) Mode: DCD Data Size: 602112 Bytes = 588.00 KiB = 0.57 MiB Load Address: 877ff420 Entry Point: 87800000 HAB Blocks: 877ff400 00000000 0008ec00 DCD Blocks: 00910000 0000002c 000001c4
Users can copy the information above to create their CSF Authenticate Data command:
Block = 0x877ff400 0x00000000 0x0006DC00 "u-boot-dtb.imx", \
0x00910000 0x0000002c 0x000001c4 "u-boot-dtb.imx"
Alternatively users can also extract the DCD length from the DCD table header:
$ od -x -j 0x2c -N 4 --endian=big u-boot-dtb.imx 0000054 d201 c440 0000060 DCD Header: 0xd2, DCD Length: 0x01c4, DCD Version: 0x40
For the i.MX devices not supporting the skip DCD command (i.MX6Dual/Quad and i.MX6Sololite) the pointer to the DCD table is cleared in the IVT in order to prevent the HAB library from processing the DCD table again during the authentication process. There is no need to re-initialize memory when it already contains valid data.
Since the IVT is modified when downloading to the target the binary must be signed with a cleared DCD pointer. However, the binary must be provided with a valid DCD pointer to allow the UUU tool to locate the DCD table.
The following script can be used to used to handle the DCD pointer:
#!/bin/bash # DCD address must be cleared for signature, as UUU will clear it. if [ "$1" == "clear_dcd_addr" ]; then # store the DCD address dd if=$2 of=dcd_addr.bin bs=1 count=4 skip=12 # generate a NULL address for the DCD dd if=/dev/zero of=zero.bin bs=1 count=4 # replace the DCD address with the NULL address dd if=zero.bin of=$2 seek=12 bs=1 conv=notrunc fi # DCD address must be set for mfgtool to localize the DCD table. if [ "$1" == "set_dcd_addr" ]; then # restore the DCD address with the original address dd if=dcd_addr.bin of=$2 seek=12 bs=1 conv=notrunc rm zero.bin fi
The steps below can be used as an example:
$ ./mod_4_mfgtool.sh clear_dcd_addr u-boot-dtb.imx $ ./cst --i u-boot-csf.txt --o u-boot-csf.bin $ ./mod_4_mfgtool.sh set_dcd_addr u-boot-dtb.imx
For the i.MX devices supporting the skip DCD command (i.MX7D, i.MX6UL/ULL, i.MX8MQ and i.MX7ULP), there is no need to do any modification, UUU tool can download the binary directly.
NOTICE: For i.MX7D only, due to an erratum, the UUU download DCD address (0x00911000) is not aligned with the DCD address in u-boot (0x00910000), there are two options:
-
use the command to specify the DCD address, uuu boot -f u-boot-signed.imx -dcdaddr 0x00911000
-
change the csf DCD address when signing the u-boot: Blocks = 0x00911000 0x0000002c 0x000001c4 "u-boot-dtb.imx
Uboot implemented i.MX 6/7 ROM SDP protocol. The support command the same as SDP.
SDPV is upgrade version of SDPU, which support -skipspl option for write command
See below for uboot requirement uboot-config-requirement
send image by sdp command.
boot -f <filename> [-offset 0x0000]
refer fast boot protocol
See below for uboot requirement
getvar
ucmd <any uboot command>
acmd <any never returned uboot command, like booti, reboot>
# partition "all" means whole device.
flash [-raw2sparse] <partition> <filename>
download -f <filename>
crc -f <filename> [-format "mmc read $loadaddr"]
[-blksz 512][ -crcblock 0x4000000]
[-seek 0] [-skip 0] [-nostop]
seek skip block number from storage
skip skips byte from -f
nostop continue check even if found mismatch
**Some Uboot command need long time to finish. Default FB timeout is 2s. You can use below method to change timeout value
# time out set to 10000ms FB[-t 10000]: ucmd <any uboot command>
Variable |
Description |
|
fastboot flash device, support mmc and sata |
|
fastboot download buffer adddress |
|
fastboot download file size, new uboot provide |
|
eMMC device number |
|
sd slot device number |
FBK: Android fastboot protocol, implement at initramfs. See project imx-uuc
ucmd <any kernel command> and wait for command finish
acmd <any kernel command> don't wait for command finish
sync wait for acmlid processs finish.
ucp <soure> <destinate> copy file from/to target
T:<filename> means target board file.
T:- means copy data to target's stdio pipe.
copy image T:/root/image ;download image to path /root/image
copy T:/root/image image ;upload /root/image to file image......
Example for transfer big file
acmd tar - ; run tar background and get data from stdio ucp rootfs.tar.gz T:- ; send to target stdio pipe sync ; wait for tar process exit.
Linux environment:
Each command in separate process so environment can not be affect next command. Use below method to workaround this problem.
FBK: ucmd source /tmp/mtd.sh; flash_erase /dev/mtd${nandrootfs} 0 0
Command |
Description |
Done |
last command for finish whole flow. |
Delay |
Busy wait for millisecond |
SH/SHELL |
run external command |
< |
stdout as command, such as "< echo ucmd print", which generally used for burn serial number |
@ |
using environment variable, such as "FBK:@ ucmd echo @MSG@" MSG will be replace by OS’s environment variable. |
error |
show error message and exit |
if |
basic logic check, such as SDPS: if @chip@ == mx8qm then boot -f flash.bin. Only support == and !=. only support one logic check |
