How To Create Secure Boot SD Card for LS1043ARDB

[shashikant_waka]

Hi Community,

I am working on LS1043ARDB development board and I am facing issues with secure boot.

I have performed following procedure for building secure boot sd card image,

Before performing all steps, I have made one change in configs/build_lsdk_config file I have set CONFIG_FUSE_PROVISIONING=y

1) Using Prebuilt Images

1. wget https://www.nxp.com/lgfiles/sdk/lsdk1906/app_components_LS_arm64.tgz
2. wget https://www.nxp.com/lgfiles/sdk/lsdk1906/bootpartition_LS_arm64_lts_4.14.tgz
3. wget https://www.nxp.com/lgfiles/sdk/lsdk1906/lib_modules_LS_arm64_4.14.122.tgz
4. wget https://www.nxp.com/lgfiles/sdk/lsdk1906/firmware_ls1043ardb_uboot_sdboot_secure.img
5. flex-builder -i mkrfs -a arm64
6. flex-builder -i merge-component -a arm64
7. flex-builder -i packrfs -a arm64
8. flex-installer -b bootpartition_LS_arm64_lts_4.14.tgz -r build/images/rootfs_lsdk1906_LS_arm64_main_201910171231.tgz -f build/images/firmware_ls1043ardb_uboot_sdboot_secure.img -d /dev/mmcblk0

2) Using Custom Build

1. flex-builder -c atf -m ls1043ardb -b sd -s
2. flex-builder -c linux -a arm64
3. flex-builder -i mkfw -m ls1043ardb -b sd -B uboot -s
4. flex-builder -i mkbootpartition -a arm64 -s
5. flex-builder -i merge-component -a arm64
6. flex-builder -i packrfs -a arm64
7. flex-installer -b build/images/bootpartition_LS_arm64_lts_4.14.tgz -r build/images/rootfs_lsdk1906_LS_arm64_main_201910171231.tgz -f build/images/firmware_ls1043ardb_uboot_sdboot_secure.img -d /dev/mmcblk0

After performing above steps, I have inserted sd card into LS1043ardb but board is not booting up for both the procedures. If I have used non-secure boot image(firmware_ls1043ardb_uboot_sdboot.img) in above method then board is booting-up fine.

1. As per documentation, I need to blow OTPMK fuses. But I don’t know if I blow fuses what will happen? would I be able to boot board again in normal mode (non-secure mode)?
2. What is the difference between OTPMK and SRKH?
3. If SRKH and OTPMK are different then how to program SRKH? I know the procedure for OTPMK using UBoot
4. What will happen if I have copied wrong values in OTPMK and SRKH registers?
5. When does SRKH come into picture?
6. Shall I need JTAG for secure boot process? if yes, then why?

I want to know the detail step wise procedure for secure boot with example.

Thank you!

[Pavel · Accepted solution]

See the following document about secure boot, OTPMK and SRKH:

http://cache.freescale.com/files/training/doc/ftf/2014/FTF-NET-F0070.pdf

See also the Chapter 6 of LSDK 1909 User Guide:

https://www.nxp.com/docs/en/user-guide/LSDKUG_Rev19.09.pdf

Draw attention on the Section 6.1.1.7.2.2.

Have a great day,
Pavel Chubakov

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[shashikant_waka]

Thank you PavelChubakov‌