LayerscapeのトピックRe: Secure Boot - ROM Details

Secure Boot - ROM Details

nagarajupoliset — Fri, 22 Feb 2019 19:51:30 GMT

Hi,

I am using ls2088ardb, i was referring to documentation of the secure boot, in QORIQ-SDK-2.0-IC-REV0.pdf Section 10.3.3 gives the details of Service processor Rom and Gpp Boot Rom,

1. Where can i get the details of Service processor Rom and GPP ROM what is size of it ??

2. How public keys/private keys are programmed??

Can you please provide details regarding it?

Re: Secure Boot - ROM Details

r8070z — Tue, 26 Feb 2019 15:09:24 GMT

Have a great day,

1 I am sure that details of Service processor Rom and GPP ROM are not public. To obtain additional available information you can create a Technical Case (see https://community.freescale.com/thread/381898 )

2 The SDK provides utility to generate public /private keys. Private key is used to sign firmaware. If firmware updates are a system requirement, the private key must be maintained in the secure database for the life of the product. The public key included into the CSF header.

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!

- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: Secure Boot - ROM Details

nagarajupoliset — Tue, 26 Feb 2019 17:31:39 GMT

i am not able to access the link provided by you. i am getting the following text

Can you please confirm me whether the link is correct?

Page Not Found

The page you requested cannot be found.

Possible reasons for missing pages, and what you can do:

If you typed a URL in the Address bar, make sure the URL was spelled correctly.
If you used a bookmark, please delete it and navigate from the homepage.
If you cannot find a product or page and need technical assistance, please enter a service request.
This page may not be available in the language you selected

Re: Secure Boot - ROM Details

r8070z — Wed, 27 Feb 2019 10:46:52 GMT

I am sorry it seems I put obsoleted link. You can start from link in the error message

If you cannot find a product or page and need technical assistance, please enter a service request.

It opens page where you can start create services request for the details of the ROM. On this page click on "New Service Request". On the next page click on "Go to tickets" and at last you open page where you can create techical case using button "Add a new case"

Re: Secure Boot - ROM Details

nagarajupoliset — Sun, 03 Mar 2019 00:18:18 GMT

r8070z‌: thanks for your response.

For the question number 2.

How public keys/private keys are programmed? i still have some questions.

Following are the sequence of steps performed for secure boot and programming the fuse

I am using evaluation platform for development

1. Signed image generation.

secure boot can be enabled by RCW with SB_EN = 1. with the help of QCVS i have set the SB_EN=1, i have generated the bin file.

I have generated the LSDK secure boot image using the below command.

$flex-builder -i mkfw -m ls2088ardb -b nor -s

firmware_ls2088ardb_uboot_norboot_secure.img will be generated for secure boot.

by running the above command CSF Header, S/G table, Public Key and Encrypted Signature is added to image,

I have flashed the image duing u-boot with the help of tftp.

=> tftp a0000000 firmware_ls2088ardb_uboot_norboot_secure.img

=> protect off 584000000 +$filesize && erase 584000000 + $filesize && cp.b a0000000 584000000 $filesize

=> qixis_reset altbank

2. Preparing Evaluation platform

2.1 LS2088A RDB Board
- Put J12 to enable PWR_PROG_SFP

- SW9[3:5] to 100

2.2 Blowing OTPMK

2.2.1 Generated OTPM

./gen_otpmk_drbg 2

2.2.2 During u-boot write the values using "mw.1 address <OTPMK1..8>

verify the write md 1e90014, check the value after reset md 1e90014.

2.3 Putting the SOC to RSP

Q1. Can you please let me know how to put the RSP

2.4 Write the SRKH to SFP mirror registers and get the system out of Reset Pause via CCS.

Q2. i don't have emulator with me, Can you please let me know how to update the mirror register SRKH

Q3. Can you please let me know list of keys to fused in the fuse box to run secure-boot. Please provide the procedure as well.

Re: Secure Boot - ROM Details

r8070z — Mon, 11 Mar 2019 06:12:30 GMT

I am sorry I did generated the LSDK secure boot image yet. In original question you refer to the QORIQ-SDK-2.0. Please create new question for the LSDK procedure. It can be answered by LSDK expert.