[LS2088ARDB] RSP state for Secure Boot Test

jhkim2 — Mon, 19 Apr 2021 02:49:42 GMT

Hi,

I want to test secure boot without permanent fusing of SRKH regsters.

I programmed the NOR flash with SIGNED composite firmware.

So, I put the the LS2088a RSP state by putting SW4.8 to zero and power on reset.

The color of power button changed to orange.

I connected Codewarrior with SAFE_RCW option = true. (I don't know this is correct procedure)

The color of power button changed to green.

And, I blowed SRKH registers with CCS using following commands.

ccs::config_chain {ls2085a sap2}

....

ccs::write_mem 325 0x1e8026c 4 0 0x1736A9F1

ccs::write_mem 325 0x1e80270 4 0 0x542BF112

I don't know after blowing SRKH like above, what action can I take next.

I cannot see any message in serial console. (The firmware image does not work)

Thanks in advance.

JeongHwan Kim.

Re: [LS2088ARDB] RSP state for Secure Boot Test

yipingwang — Tue, 20 Apr 2021 06:55:26 GMT

1. Please generate NOR secure boot firmware image with flex-builder

flex-builder -i mkfw -m ls2088ardb -b nor -s

2. Deploy secure boot firmware image to bank4 at bank0.

=>tftp 0xa0000000 firmware_ls2088ardb_uboot_norboot_secure.img

=> protect off 584000000 +$filesize && erase 584000000 +$filesize && cp.b a0000000 584000000 $filesize

3. Prepare board for secure boot

a. Enable POVDD, Please refer to eth section "6.1.1.5.1.1 Enable POVDD" in LSDK 20.12 document.

b. Please refer to the section in "6.1.1.5.1.2 Program OTPMK" to program OTPMK key.

Write OTPMK fuse values on shadow registers

mw.l 1e80234 a29a0b2c

mw.l 1e80238 2c8cd201

mw.l 1e8023c 84027ca8

mw.l 1e80240 8e13c7b9

mw.l 1e80244 a0b9d347

mw.l 1e80248 50ef2622

mw.l 1e8024c 98a92efd

mw.l 1e80250 ed53d1c3

Check SNVS state again. There should be no parity errors

md 1e90014

80000900

md 1e80024

00000000

Now you will see ‘0’ in second nibble. No parity errors, i.e. bits marked in read would be all 0’s.

mw 1e80020 0x2

Reset and check that SNVS is in Check state

md 1e90014

80000900

4. Program SRKH mirror registers in through CCS environment.

a. Steps to put SoC in RSP (Reset Sequence Pause)
LS2088:
• Rev1 RDB Board Switch (Rev B): SW3.8 – 0. Switch (Rev C to Rev F): SW4.8 – 0. To boot from vbank4, change SW9[3:5] to 100.

b. After putting the SoC into RSP, reset the board. Then, use the below commands to write SRKH in the SFP mirror registers.

ccs::config_chain {<platform> sap2}
display ccs::get_config_chain
puts "Entry RSP: "
ccs::write_mem 2 0x7 0x001000D0 0x4 0x0 0x800
set ::littleendian(2) 1
ccs::write_mem <sap position> 0x1e80254 4 0 <SRKH1>
ccs::write_mem <sap position> 0x1e80258 4 0 <SRKH2>
ccs::write_mem <sap position> 0x1e8025c 4 0 <SRKH3>
ccs::write_mem <sap position> 0x1e80260 4 0 <SRKH4>
ccs::write_mem <sap position> 0x1e80264 4 0 <SRKH5>
ccs::write_mem <sap position> 0x1e80268 4 0 <SRKH6>
ccs::write_mem <sap position> 0x1e8026c 4 0 <SRKH7>
ccs::write_mem <sap position> 0x1e80270 4 0 <SRKH8>
set ::littleendian(2) 0
puts "Exiting RSP: "
ccs::write_mem 2 0x7 0x001000D0 0x4 0x0 0x400

PowerQUICC ProcessorsのトピックRe: [LS2088ARDB] RSP state for Secure Boot Test

[LS2088ARDB] RSP state for Secure Boot Test

Re: [LS2088ARDB] RSP state for Secure Boot Test