topic Re: How to start the P4080DS/T2080 secure boot in P-Series

How to start the P4080DS/T2080 secure boot

liyan — Tue, 14 Jun 2016 02:13:26 GMT

Hello ,we are working on a P4080ds secure boot project . According to the Document of SDK 2.0, we have generate keys and some header , but we don't know how to modify the uboot souce code for supporting secure boot ,and we don't know how to set the hardware to supporting secure boot ,and we don't know where are the header and the bin file should be load ? It seems the imx6 have the detailed documents for this , do you have a detailed documents for P4080 & T2080 ? We are desperate to get it ,thank you very much.

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Thu, 16 Jun 2016 09:59:46 GMT

Hello Li Yan,

In the file meta-freescale/conf/machine/p4080ds.conf of SDK 2.0, secure boot option has already been included in UBOOT_CONFIG, when you run "bitbake u-boot", the secure u-boot should been deployed in build_p4080ds/tmp/deploy/images/p4080ds/ folder.

The target board configuration to support secure boot, program the ITS fuse or use RCW with SB_EN=1.

For protyping phase, please don't blow the ITS fuse, and use RCW with SB_EN=1.

For images deployment, please refer to QorIQ SDK 2.0 Document->Boot Loaders->U-Boot->Secure Boot->PBL Based Platforms->Address Map used for demo.

Here are some steps for running a basic secure boot test.

1. Generate a public/private RSA key pair.

2. Sign the image to be validated (U-Boot) using the private key.

3. Create a header containing information regarding the image, keys, signature etc.

4. Deploy the U-Boot and header image on to the target memory.

5. Configure PBL(RCW) with SB_EN=1, BOOT_HO = 1 and location of header programmed in DCFG SCRATCHRW1 register via PBI commands. For PBI commands, please refer to the section QorIQ SDK 2.0 Document->Boot Loaders->U-Boot->Secure Boot->PBL Based Platforms->Pre-Boot Phase.

6. Use CCS to connect to the target, to write OTPMK and SFP_SRKRH to shadow registers.

7. Write the register to get the core out of boot hold off. Boot ROM will read the SCRATCH REGISTER for location of the HEADER and then perform the validation.

Have a great day,
Yiping

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

Re: How to start the P4080DS/T2080 secure boot

liyan — Fri, 17 Jun 2016 09:06:19 GMT

Hi Yiping,

Thank you for your feedback ,and It seems the chapter of t”QorIQ SDK 2.0 Document->Boot Loaders->U-Boot->Secure Boot->” is missing ,could you please provide us a whole one ?

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Fri, 17 Jun 2016 09:23:50 GMT

You need to login then access SDK 2.0 Web page.

Please refer to the following content

NOR SECURE BOOT

P3/P4/P5

#LAW for ESBC

09000cd0 00000000

09138000 00000000 (Flush command)

09000cd4 c0000000

09138000 00000000 (Flush command)

09000cd8 81f0001d

09138000 00000000(FLUSH command)

# Scratch Register

090e0200 c0b00000

T1/T2/T4/B4

#LAW for ESBC

09000c10 00000000

09000c14 c0000000

09000c18 81f0001b

# LAW for CPC/SRAM

09000d00 00000000

09000d04 bff00000

09000d08 81000013

# Scratch Registers

090e0200 c0b00000

090e0208 c0c00000

# CPC SRAM

09010100 00000000

09010104 bff00009

# CPC Configuration

09010f00 08000000

09010000 80000000

Have a great day,
Yiping

Re: How to start the P4080DS/T2080 secure boot

liyan — Fri, 17 Jun 2016 09:35:25 GMT

#LAW for ESBC

09000cd0 00000000

09138000 00000000 (Flush command)

Do you mean use “mm” command in uboot to write the register ?

what is the mean of 09138000 00000000 (Flush command) ？ After write 09000cd0 ，write 09138000 to 0 ， am I right？

And I use the default secure boot u-boot and rcw which is in SDK 2.0 ? But it seems the board cannot be boot , ,there is no any output in com1, is this problem disapper after I set the register correctly ? Or the default secure boot cannot be used in P4080DS board ?

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Fri, 17 Jun 2016 09:53:51 GMT

Hello Li Yan,

The following commands are PBI commands, you need to generate PBL image(including RCW+PBI), you could use QCVS Tool to generate PBL, SDK document contains detailed description regarding how to use QCVS.

#LAW for ESBC

09000cd0 00000000

09138000 00000000 (Flush command)

09000cd4 c0000000

09138000 00000000 (Flush command)

09000cd8 81f0001d

09138000 00000000(FLUSH command)

# Scratch Register

090e0200 c0b00000

The condition of secure u-boot executing is that he validation is success.

Please refer the procedure in my first post, these steps are all necessary for secure boot setting up.

Have a great day,
Yiping

Re: How to start the P4080DS/T2080 secure boot

liyan — Mon, 20 Jun 2016 09:27:28 GMT

Hi Yiping，

Could you please give me a link for QCVS , I am not sure which one is suitable for P4080, and do you have a estimate version ?

By the way , where can we find a default P4080 PBL image which have enable the secure boot , we can have a try first .

About the OTPMKR[0:7] , I can use the "mm" command to modify it , but after I write it , use "md" command to display ,it shows zero , It seems write failed .the same problem exsits in LS1021.

> mm fe0e805c

> fe0e805c: 00000000 ? ef0f928b

> fe0e8060: 00000000 ? 52255d2b

...

About the CCSR SRKHR[0:7],I can use the "mm" command to modify it , and after write ,use "md" command , I can see the value has been wrote correctly .But after I reboot the board ,The value was changed to 0.

Could you please tell me If I miss some steps , or there is bug in P4080 ?

thank you very much.

Re: How to start the P4080DS/T2080 secure boot

liyan — Wed, 22 Jun 2016 09:34:30 GMT

Hi Yiping，

Is any feedback ?

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Wed, 22 Jun 2016 11:02:07 GMT

Please download QCVS for PowerPC from CodeWarriorNetworked Applications : QCVS|NXP .

Please refer to the attached RCW file.

Please note that in the designing stage, please only write value to SRKHR and OTPMKR mirror registers without writing the permanent registers to blow the fuse array.

Would you please provide your detailed log to do deployment? I will check it for you.

Have a great day,
Yiping

Re: How to start the P4080DS/T2080 secure boot

liyan — Tue, 28 Jun 2016 09:26:59 GMT

Thank you very much , Now I have a question about T2080.

we try to use u-boot to write the OTPMKR and the SRKHR into the flash.but after reboot the device ,the value cannot be saved . I think maybe we after or before use "mm" comand to write register ,we should set the write protect register , do you have a guider to writer OTPMKR and the SRKHR ,we want write it into flash and don't need modify. I know in P4080 board ,after "mm" command ,also need write

=> mm fe0e8020

fe0e8020: 00000000 ? 00000002

and In T2080, which register should be set to fuse the OTPMKR and SRKHR.

Thank you very much.

Re: How to start the P4080DS/T2080 secure boot

liyan — Wed, 29 Jun 2016 09:34:04 GMT

Hi Yiping ,

Is any feedback , after write the OTPMKR and the SRKHR ,I set the SFP_INGR to 2 to write them to fuse array ,but It seems failed too , the value was cleared after board reset . Is any write protect bit was not be set or clear? could you please guild me ? Thank you very much .

=> mm fe0e8020

fe0e8020: 00000000 ? 00000002

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Thu, 30 Jun 2016 09:01:18 GMT

Hello Li Yan,

No protection for register SFP_INGR, please check whether the register SFP_FSWPR is set.

In the designing stage, it is not recommended to program the shadow registers values to the fuse array, because after this operation, OTPMK and SRKH keys cannot be changed any more.

After reset these mirror registers would be cleared, so we use CCS to connect to the target board to write mirror registers before executing u-boot, the procedure is as the following.

1. Configure RCW to enable boot hold off bit. The purpose is to wait for CCS connecting to the target board to write mirror registers.

2. Deploy image to bank4 at bank0, and switch to bank4.

3. Use CCS to connect to the target and write mirror registers and open CCS console to use the following commands to write mirror registes.

% config cc cwtap

% ccs::config_chain p4080

% ccs::get_config_chain

% ccs::write_mem 0 <address> 4 0 <value>

4. Configure registers DCFG_CCSR_BRR to release the core to boot from hold off mode.

Have a great day,
Yiping

Re: How to start the P4080DS/T2080 secure boot

liyan — Thu, 30 Jun 2016 09:10:57 GMT

Hi Yiping,

P4080 board has finished , we are work on T2080QDS board.

I have check the SFP_FSWPR register, It is zero . Now we want to write it to fuse array and don't want to change it .

=> md fe0e8204

fe0e8204: 00000000 00000000 00000000 00000000 ................

fe0e8214: 00000000 00000000 00000000 00000000 ................

fe0e8224: 00000000 00000000 00000000 00000000 .......

below is my step , could you please tell me if I miss some operation?

Enable POVDD = 1.8V.

Set SW9[8]= 1 (POVDD enabled)

2. Write the OTPMK and SRKH

=> mm 0xfe0e821c

fe0e821c: 00000000 ? 88888888

fe0e8220: ffffffff ?77777777

fe0e8224: ffffffff ?66666666

fe0e8228: ffffffff ?55555555

fe0e822c: ffffffff ?44444444

fe0e8230: ffffffff ?33333333

fe0e8234: ffffffff ? 22222222

fe0e8238: ffffffff ? 11111111

fe0e823c: 00000000 ? e814394d

fe0e8240: 00000000 ? eb4b3c5e

fe0e8244: 00000000 ? a74d8688

fe0e8248: 00000000 ? 0c92fa19

fe0e824c: 00000000 ? 58173dfa

fe0e8250: 00000000 ? 67a8f87b

fe0e8254: 00000000 ? 89750515

fe0e8258: 00000000 ? 34487261

fe0e825c: 00000000 ? 99999999

=> mm
0xfe0e8270 (UID)

fe0e821c: 00000000 ?00000001

=>mm 0xfe0e8020

0xfe0e8020: 00000000 ? 00000002

3.
power off the board

4.Disable POVDD and power on the board

SetSW9[8] = 0 (POVDD enabled)

5.Display the OTPMK and SRKH

=> md fe0e821c

fe0e821c: 00000000 00000000 00000000 00000000 ................

fe0e822c: 00000000 00000000 00000000 00000000 ................

fe0e823c: 00000000 00000000 00000000 00000000 ................

fe0e824c: 00000000 00000000 00000000 00000000 ................

fe0e825c: 00000000 00000000 00000000 00000000 ................

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Thu, 30 Jun 2016 10:18:15 GMT

Hello Li Yan,

If you feel everything is OK, you also need to configure Intent to secure (ITS) bit to configure the board used as secure boot.

Please refer to SFP_OSPR[ITS]

In addition, please try write OTPMK shadow registers and program to the fuse array, then write SRKH shadow registers and program to the fuse array.

Thanks,

Yiping

Re: How to start the P4080DS/T2080 secure boot

liyan — Fri, 01 Jul 2016 03:30:13 GMT

Hello Yiping ,
It seems the OTPMK and SRKH cannot be program to the fuse array, when I reboot the board , the OTPMK and SRKH changed to zero , It have confused us one week .Did we miss some steps ? Could you please help to check it ? thank you.

we try to set ITS , but after board reset ,It disapper too .

=> mw 0xfe0e8200 00000004

=> mw 0xfe0e8020 00000002

after board reset , the value changed to zero , and the write protect is OK.

=> md 0xfe0e8200

fe0e8200: 00000000 00000000 00000000 00000000

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Fri, 01 Jul 2016 04:24:32 GMT

Hello Li Yan,

After programing mirror register values to fuse array, please write SFP_INGR[INST] to 01 to Read the entire fusebox and load the contents into the corresponding mirror registers back. Then read mirror registers to check whether blowing fuse operation took effect.

Thanks,

Yiping

Re: How to start the P4080DS/T2080 secure boot

liyan — Fri, 01 Jul 2016 04:50:17 GMT

Hi Yiping,

It seems the value have not be set to fuse array

=> mm 0xfe0e821c

fe0e821c: 00000000 ? 88888888

fe0e8220: ffffffff ? 77777777

fe0e8224: ffffffff ? 66666666

fe0e8228: ffffffff ? 55555555

fe0e822c: ffffffff ? 44444444

fe0e8230: ffffffff ? 33333333

fe0e8234: ffffffff ? 22222222

fe0e8238: ffffffff ? 11111111

fe0e823c: 00000000 ? e814394d

fe0e8240: 00000000 ? eb4b3c5e

fe0e8244: 00000000 ? a74d8688

fe0e8248: 00000000 ? 0c92fa19

fe0e824c: 00000000 ? 58173dfa

fe0e8250: 00000000 ? 67a8f87b

fe0e8254: 00000000 ? 89750515

fe0e8258: 00000000 ? 34487261

fe0e825c: 00000000 ? => <INTERRUPT>

=> mm 0xfe0e8020

fe0e8020: 00000000 ? 00000002

fe0e8024: 00000000 ? => <INTERRUPT>

=> mm 0xfe0e8020

fe0e8020: 00000000 ? 00000001

fe0e8024: 00000000 ? => <INTERRUPT>

=> md 0xfe0e821c

fe0e821c: 00000000 00000000 00000000 00000000 ................

fe0e822c: 00000000 00000000 00000000 00000000 ................

fe0e823c: 00000000 00000000 00000000 00000000 ................

fe0e824c: 00000000 00000000 00000000 00000000 ................

fe0e825c: 00000000 00000000 00000000 00000000 ................

fe0e826c: 00000000 00000000 00000000 b0c4e314 ................

fe0e827c: 00000000 00000000 00000000 00000000 ................

fe0e828c: 00000000 00000000 00000000 00000000 ................

fe0e829c: 00000000 00000000 00000000 00000000 ................

fe0e82ac: 00000000 00000000 00000000 00000000 ................

fe0e82bc: 00000000 00000000 00000000 00000000 ................

fe0e82cc: 00000000 00000000 00000000 00000000 ................

fe0e82dc: 00000000 00000000 00000000 00000000 ................

fe0e82ec: 00000000 00000000 00000000 00000000 ................

fe0e82fc: 00000000 00000000 00000000 00000000 ................

fe0e830c: 00000000 00000000 00000000 00000000 ................

Re: How to start the P4080DS/T2080 secure boot

liyan — Fri, 01 Jul 2016 06:12:42 GMT

Hi Yiping,

It seems the value have not be set to fuse array

=> mm 0xfe0e821c

fe0e821c: 00000000 ? 88888888

fe0e8220: ffffffff ? 77777777

fe0e8224: ffffffff ? 66666666

fe0e8228: ffffffff ? 55555555

fe0e822c: ffffffff ? 44444444

fe0e8230: ffffffff ? 33333333

fe0e8234: ffffffff ? 22222222

fe0e8238: ffffffff ? 11111111

fe0e823c: 00000000 ? e814394d

fe0e8240: 00000000 ? eb4b3c5e

fe0e8244: 00000000 ? a74d8688

fe0e8248: 00000000 ? 0c92fa19

fe0e824c: 00000000 ? 58173dfa

fe0e8250: 00000000 ? 67a8f87b

fe0e8254: 00000000 ? 89750515

fe0e8258: 00000000 ? 34487261

fe0e825c: 00000000 ? =>

Re: How to start the P4080DS/T2080 secure boot

yipingwang — Fri, 01 Jul 2016 07:48:44 GMT

Please check whether SFP_SFPCR[PPW] makes sense on your target board.

16–31 PPW

Program pulse width. PPW determines the length of the program strobe used by the fusebox. The reset

value is a safe default for programming under typical conditions (at top frequency bin)

The optimal value for PPW is calculated as the SFP module input clock frequency (in MHz) * 12 where the

SFP module input clock is platform clock/4.

Thanks,

Yiping

Re: How to start the P4080DS/T2080 secure boot

liyan — Fri, 01 Jul 2016 08:28:15 GMT

Where can find the SFP clock frequency for T2080QDS?