How To Create Secure Boot SD Card for LS1043ARDB

shashikant_waka — Thu, 17 Oct 2019 13:01:02 GMT

Hi Community,

I am working on LS1043ARDB development board and I am facing issues with secure boot.

I have performed following procedure for building secure boot sd card image,

Before performing all steps, I have made one change in configs/build_lsdk_config file I have set CONFIG_FUSE_PROVISIONING=y

1) Using Prebuilt Images

wget https://www.nxp.com/lgfiles/sdk/lsdk1906/app_components_LS_arm64.tgz
wget https://www.nxp.com/lgfiles/sdk/lsdk1906/bootpartition_LS_arm64_lts_4.14.tgz
wget https://www.nxp.com/lgfiles/sdk/lsdk1906/lib_modules_LS_arm64_4.14.122.tgz
wget https://www.nxp.com/lgfiles/sdk/lsdk1906/firmware_ls1043ardb_uboot_sdboot_secure.img
flex-builder -i mkrfs -a arm64
flex-builder -i merge-component -a arm64
flex-builder -i packrfs -a arm64
flex-installer -b bootpartition_LS_arm64_lts_4.14.tgz -r build/images/rootfs_lsdk1906_LS_arm64_main_201910171231.tgz -f build/images/firmware_ls1043ardb_uboot_sdboot_secure.img -d /dev/mmcblk0

2) Using Custom Build

flex-builder -c atf -m ls1043ardb -b sd -s
flex-builder -c linux -a arm64
flex-builder -i mkfw -m ls1043ardb -b sd -B uboot -s
flex-builder -i mkbootpartition -a arm64 -s
flex-builder -i merge-component -a arm64
flex-builder -i packrfs -a arm64
flex-installer -b build/images/bootpartition_LS_arm64_lts_4.14.tgz -r build/images/rootfs_lsdk1906_LS_arm64_main_201910171231.tgz -f build/images/firmware_ls1043ardb_uboot_sdboot_secure.img -d /dev/mmcblk0

After performing above steps, I have inserted sd card into LS1043ardb but board is not booting up for both the procedures. If I have used non-secure boot image(firmware_ls1043ardb_uboot_sdboot.img) in above method then board is booting-up fine.

As per documentation, I need to blow OTPMK fuses. But I don’t know if I blow fuses what will happen? would I be able to boot board again in normal mode (non-secure mode)?
What is the difference between OTPMK and SRKH?
If SRKH and OTPMK are different then how to program SRKH? I know the procedure for OTPMK using UBoot
What will happen if I have copied wrong values in OTPMK and SRKH registers?
When does SRKH come into picture?
Shall I need JTAG for secure boot process? if yes, then why?

I want to know the detail step wise procedure for secure boot with example.

Thank you!

Re: How To Create Secure Boot SD Card for LS1043ARDB

Pavel — Fri, 18 Oct 2019 06:51:11 GMT

See the following document about secure boot, OTPMK and SRKH:

http://cache.freescale.com/files/training/doc/ftf/2014/FTF-NET-F0070.pdf

See also the Chapter 6 of LSDK 1909 User Guide:

https://www.nxp.com/docs/en/user-guide/LSDKUG_Rev19.09.pdf

Draw attention on the Section 6.1.1.7.2.2.

Have a great day,
Pavel Chubakov

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: How To Create Secure Boot SD Card for LS1043ARDB

shashikant_waka — Wed, 23 Oct 2019 12:20:24 GMT

Thank you PavelChubakov‌

topic How To Create Secure Boot SD Card for LS1043ARDB in Layerscape

How To Create Secure Boot SD Card for LS1043ARDB

Re: How To Create Secure Boot SD Card for LS1043ARDB

Re: How To Create Secure Boot SD Card for LS1043ARDB