ls1043a is it possible to prototype secure boot without blowing any fuses?

[endrunner_smw]

Between documentation and even cross referencing with some Ai agents I can't get a definitive answer on this.

Can secure boot be setup on LS1043A without blowing any fuses? If yes, how? If no, what are the minimum fuses I have to blow in order to step the process along for secure boot.

I seem to be stuck where I setup secure boot in the RCW for SB_EN = 1 and BOOT_HO = 1, but when connecting to CCS when I try to write in the SRK registers those registers are locked and I can't write to them. And obviously secure boot isn't working.

[endrunner_smw]

Was reviewing the Secure Boot.pptx by Yiping Wang from August 2024,

In the secure boot troubleshooting section it lists to check the SecMon_HP Status Register (0x1e90014) bits OTPMK_ZERO should be 0. Which I have (0x81D0AB00 is value returned). And to check SFP_SVHESR(0x1e80024) should be 0, mine however returns 0x00068400.

The powerpoint says if this is the case then there was an error in the way I tried to blow the OTPMK fuse. Is this the case? Is this recoverable? I read a document that said as long as the parity bit was 0 then it should be ok, but after seeing this presentation is that not the case?

Should the jump be attached to the board before power on? From documentation it sounds like it should not be, but rather put the jumper on while the system is running, burn the fuses, then remove the jumper while the system is still running before removing power and power cycling.

When I attempt to use CCS to put the SRK hashes in it appears that the registers are locked, because they don't take the values I'm entering. I try to put in the values and then set the board to release the CPU to boot, but I get no activity on the console (minicom).

For my attempt at secure boot on the LS1043A-RDB is my attempt with this board is this board done? It will still boot with a non-secure image as I didn't try setting the ITS fuse.

[June_Lu]

Secure boot requires the fuse to be blown.

Some secure boot–related documents are not publicly available. Please kindly create a support case at

https://support.nxp.com/s/?language=en_US

to request access to the Trust Architecture documents.

Thanks.

[endrunner_smw]

My manager has access to the Qoriq Trust Architecture 2.x document, I'm still waiting on my approval from NXP (already got the secure rights access, but that document hasn't been included).

Can you please provide confirmation of the OTPMK and SRKHR offsets?

I see a couple different values between multiple documents.

For OTPMK I see both offsets between 0x21C-0x238, and 0x234-0x250

For SRKHR I see both offsets between 0x23C-0x258, and 0x254-0x270

As you can see there between the two sets they overlap on a couple of registers.

[endrunner_smw · Accepted solution]

Memory Map for SFP in Qoriq Trust Architecture 2.x has incorrect register range. Tried with other values from LSDUK_Rev21.08 and document 'Setting up Secure Boot on PBL Based Platforms in Prototype Stage', and Secure_boot.pptx. And after entering SRK hash values into registers and releasing the CPU finally got life on the console. I still have errors, but its a step in the right direction

[endrunner_smw]

Marked as solved since I was able to get output on the console, will open a new issue for the SEC/CAAM not initializing

[endrunner_smw]

If anyone is curious these are the errors I am receiving after putting the SRK hash in and releasing the cpu

[kenli]

Did you eventually use CodeWarrior or U-Boot to fuse the OTPMK? This is mandatory. Later, if you need to verify the SRKH effects, you can skip the actual fusing and just use the mirror registers instead. You'll need CodeWarrior to assist with this—halt the main CPU, configure the mirror registers properly, then release the CPU. Refer to the corresponding sections in the LSDK documentation for detailed descriptions.

[endrunner_smw]

Yes, I used CCS to fuse the OTPMK. Then with BOOT_HO = 1 and SB_EN = 1 in RCW I booted and in CCS set the SRKH mirror registers and released the cpu. That is the screenshot I posted above. Though apparently I still have an issue of SEC/CAAM not initializing?