How to flash uboot in eMMC from qspi uboot prompt on LS1043ARDB

[gandhi_999]

Hi,

I am using LS1043ARDB based custom board.

My goal is to flash uboot embedded with public key in eMMC to validate signed FIT image, without public key uboot is not verifying the FIT image signature.

I am running uboot from QSPI (PFA snap)

and from the uboot prompt I am trying to flash uboot onto the eMMC using the following commands, however the console remains blank even after changing the switch to boot from SD.

After flashing:

Could you please help me on the same.

Thanks.

[gandhi_999]

Thank you SebastianG for the response.

Earlier I made changes to enable secure boot therefore after flashing with a secure enabled pbl with rcw image and fip (uboot+bl31) image all cores got hold, hence not able to see anything on console.

I thought hold off will be in uboot console and have to write OTPMK mirror registers to authenticate all the images from uboot prompt.

But it has been on hold since reset, now to boot all the images with authentication, I have to flash OTPMK fuses with CCS using codewarrior.

Then it will boot with secure enabled pbl+rcw image and fip (uboot+bl31) image

Could you please help to get the steps to flash these fuses via CCS to boot the secure images?

[SebastianG]

Hi @gandhi_999,

Did you create your file with the public and private keys (OPTMKR and SRKHR) values for secure boot?

As you can see in the following image:

In the section 6.1.1 of the file "LLDPUG_L6.1.36_2.1.0_Approval_review.pdf" attached in this response you can find a guide for create the file of the keys if you not have the file, the way to program the OPTMKR and SRKHR trough CCS and the process for burn the fuses.

Note that once a fuse has burned out, the effect becomes permanent.

[gandhi_999]

Hi SebastianG,

Yes I have created OTPMK and SRKH.
Then after created secure headers for pbl (spl) and uboot using uni_sign from CST.

1. Now, how can I embed these headers in a respective image for secure boot?

2. Or Should I flash these separate headers in MMC (boot mode is eMMC) as uni_sign is generating a separate header? if yes please share SD card block location for the same.

[SebastianG]

Hello @gandhi_999,

Regarding to the question "2. Or Should I flash these separate headers in MMC (boot mode is eMMC) as uni_sign is generating a separate header? if yes please share SD card block location for the same."

Please check LSDK 21.08 document on the page 181 as you can see in the following image:

Table 22. Unified 64 MiB memory layout of NOR/QSPI/XSPI/NAND/SD media for composite firmware on all Layerscape platforms Secure boot headers, SD block start: 0x03000

Regards,

Sebastian

[SebastianG]

Hello @gandhi_999,

Sorry for the delayed response,

Just to inform you that I still working on your questions

Regards,

Sebastian

[SebastianG]

In the image when you do the mmc write for the block 8 and the block 800 of the SD card,

your value 69 and 637 is the wrong value of the size of your files bl2_sd.pbl and fip.bin

Your file bl2_sd.pbl size is 49060 bytes in decimal, in hexadecimal is BFA4

Your file fip.bin size is 809697 in decimal, in hexadecimal is C5AE1

The structure of the command:

mmc write $load_addr (block address) (count or size file in hexadecimal: 44952 decimal is equal to af98 in hexadecimal)

mmc write 0xa0000000 8 (size of your file bl2_sd.pbl in hexadecimal)
mmc write 0xa0000000 800 (size of your file fip.bin in hexadecimal)

And then do the next step

+---Reset the CPLD in SD---+
=> cpld reset sd (This step could be diferent in NOR flash and NAND flash)
+--CPLD--+

Have you created the public key file for your board?

The block address for sd card for secure boot headers is 0x03000

In the attached file "SD write.txt" you will find a guide for this purpose

[SebastianG]

Hi @gandhi_999,

I am already working on your question, when I have any update I will let you know

Regards,

Sebastian