Since the whole anwser to the question is split over several answers in this thread, I want to summarize it briefly.
The SPT does not support building images for serial boot. However one can select SD card as boot device and build the image this way.
Since serial boot and booting from SD card both load to image to RAM the generated image works for serial boot.
The image alone does not guarantee secure boot. The OTP configuration (respectifly their shadow register furing development) must be done correctly in order for the signature to be checked at boot.
One can use the SPT for this even though it does not support serial boot as follows:
Is there a way to use the SPT for this even though I don't write the image with the SPT?
- You have to have the workspace to be configured to "Development" life-cycle (on the toolbar). This you should already have, just for completeness.
- On Build tab in the "OTP Configuration" configure the fuses. You can check if the fuse can be written into the shadow register:
- Click on the "Build" button, it is required intermediate step
- Go to Write tab and click on the label "write_image_win.bat" (On Linux/Mac it will be *.sh).
This will update all necessary files, including the write script and also the write_shadows.bat script that can be found in the gen_scripts\ folder - double check the content of the script.
In order to verify that the signature check actually works, flipping one bit in the image and tring to boot it is sufficient. If secure boot works the image is loaded over the serial interface but is not executed and the chip is locked up. To check wether the chip is really locked one can try to reupload the shadow register config. It should fail with the following error:
### Execute application, that will configure shadow registers ###
blhost -t 5000 -u 0x1FC9,0x0020 -j -- execute 0x00080159 0x00080000 0x00200000
{
"command": "execute",
"response": [],
"status": {
"description": "10006 (0x2716) Unsupported Command.",
"value": 10006
}
}
blhost failed
### RESULT of the script `Writing shadow registers`: FAILURE (return code = [2]ERROR)
Hope this saves someone else some time
Thank you Marek and Libor for your help!
Since the whole anwser to the question is split over several answers in this thread, I want to summarize it briefly.
The SPT does not support building images for serial boot. However one can select SD card as boot device and build the image this way.
Since serial boot and booting from SD card both load to image to RAM the generated image works for serial boot.
The image alone does not guarantee secure boot. The OTP configuration (respectifly their shadow register furing development) must be done correctly in order for the signature to be checked at boot.
One can use the SPT for this even though it does not support serial boot as follows:
Is there a way to use the SPT for this even though I don't write the image with the SPT?
- You have to have the workspace to be configured to "Development" life-cycle (on the toolbar). This you should already have, just for completeness.
- On Build tab in the "OTP Configuration" configure the fuses. You can check if the fuse can be written into the shadow register:
- Click on the "Build" button, it is required intermediate step
- Go to Write tab and click on the label "write_image_win.bat" (On Linux/Mac it will be *.sh).
This will update all necessary files, including the write script and also the write_shadows.bat script that can be found in the gen_scripts\ folder - double check the content of the script.
In order to verify that the signature check actually works, flipping one bit in the image and tring to boot it is sufficient. If secure boot works the image is loaded over the serial interface but is not executed and the chip is locked up. To check wether the chip is really locked one can try to reupload the shadow register config. It should fail with the following error:
### Execute application, that will configure shadow registers ###
blhost -t 5000 -u 0x1FC9,0x0020 -j -- execute 0x00080159 0x00080000 0x00200000
{
"command": "execute",
"response": [],
"status": {
"description": "10006 (0x2716) Unsupported Command.",
"value": 10006
}
}
blhost failed
### RESULT of the script `Writing shadow registers`: FAILURE (return code = [2]ERROR)
Hope this saves someone else some time
Thank you Marek and Libor for your help!
Hello David,
Is there a way to use the SPT for this even though I don't write the image with the SPT?
- You have to have the workspace to be configured to "Development" life-cycle (on the toolbar). This you should already have, just for completeness.
- On Build tab in the "OTP Configuration" configure the fuses. You can check if the fuse can be written into the shadow register:
- Click on the "Build" button, it is required intermediate step
- Go to Write tab and click on the label "write_image_win.bat" (On Linux/Mac it will be *.sh).
This will update all necessary files, including the write script and also the write_shadows.bat script that can be found in the gen_scripts\ folder - double check the content of the script.
Regards,
Libor
