LayerscapeのトピックRe: LS1043A Secure Boot from QSPI

LS1043A Secure Boot from QSPI

Teddy1 — Fri, 11 Mar 2022 16:53:17 GMT

I am trying to implement Secure Boot on a custom board with a LS1043A and QSPI NOR Flash and I can't manage to have any output in Secure Mode ( SB_EN=1 + BOOT_HOLD=1) with this in RCW set to 0 my board boot.

In document "QorIQ Trust Architecture 2.1 User Guide" chapter 6.1.1 it show a table where Soc LS1043A with RCW in QSPI is in "N/A"

Does this confirm that it is impossible to do some Secure boot in this case ?

Re: LS1043A Secure Boot from QSPI

yipingwang — Tue, 15 Mar 2022 09:37:16 GMT

Would you please describe in details how you generated QSPI secure boot image?

Do you use CodeWarrior CCS to connect to your target board to input SRKH key? Have you programmed OPTMK on the target board?

Re: LS1043A Secure Boot from QSPI

Teddy1 — Tue, 15 Mar 2022 09:52:44 GMT

I am building from scratch with LSDK-20.12 packages : rcw, atf, u-boot and cst from codeaurora repository at tag LSDK-20.12.

RCW is simply build with "make" on my custom target with SB_EN=1 and BOOT_HO=1 (inspired from ls1043aqds)
U-Boot is build with

make ARCH=arm CROSS_COMPILE=aarch64-zds-linux-gnueabi- -C /home/teddy/tmp/git/u-boot-bare-lsdk2012 -j 4 KBUILD_OUTPUT=/home/teddy/tmp/git/u-boot-bare-lsdk2012_build mrproper ls1043a_ps4c_tfa_defconfig all

cst has simply been build with make, a srk.pri/srk.pub key paire generated
ATF is build with:

CROSS_COMPILE=aarch64-zds-linux-gnueabi- ARCH=aarch64 make PLAT=ls1043aps4c CSF_HEADER_PREPENDED=1 TRUSTED_BOARD_BOOT=1 CST_DIR=/home/teddy/tmp/git/cst-head_dev all fip pbl RCW=rcw_1200_qspiboot_atf_sb.bin LOG_LEVEL=40 BL33=u-boot.bin

Then I have bl2_qspi_sec.pbl flashed at addresse 0x00 of QSPI and fip.bin to offset 0x100000 in QSPI.

I am working in developpement, so for now not writing all the OTP things, so I use the CCS JTAG probe and do script to set all the SRKH mirror registers and release boot hold.

After boot hold release, there is no message on UART debug console and registers don't show me obvious error of configuration

Same process without Secure Boot configured in RCW and ATF build without "CSF_HEADER_PREPENDED=1 TRUSTED_BOARD_BOOT=1" and U-boot build without "CONFIG_NXP_ESBC" lead to a correct non-secure boot.

Re: LS1043A Secure Boot from QSPI

yipingwang — Wed, 16 Mar 2022 07:23:44 GMT

Blowing of OTPMK is essential to run secure boot for both Production and Development phases.

Please refer to the attached document for Blowing OTPMK.

Re: LS1043A Secure Boot from QSPI

Teddy1 — Fri, 18 Mar 2022 14:39:25 GMT

Yes, even in development mode, when you don't want to blow OTP things, you SHALL blow OTPMK at least.

I just booted in trusted boot.

Thank you for your support.