Hi,
I want to test secure boot without permanent fusing of SRKH regsters.
I programmed the NOR flash with SIGNED composite firmware.
So, I put the the LS2088a RSP state by putting SW4.8 to zero and power on reset.
The color of power button changed to orange.
I connected Codewarrior with SAFE_RCW option = true. (I don't know this is correct procedure)
The color of power button changed to green.
And, I blowed SRKH registers with CCS using following commands.
ccs::config_chain {ls2085a sap2}
....
ccs::write_mem 325 0x1e8026c 4 0 0x1736A9F1
ccs::write_mem 325 0x1e80270 4 0 0x542BF112
I don't know after blowing SRKH like above, what action can I take next.
I cannot see any message in serial console. (The firmware image does not work)
Thanks in advance.
JeongHwan Kim.
1. Please generate NOR secure boot firmware image with flex-builder
flex-builder -i mkfw -m ls2088ardb -b nor -s
2. Deploy secure boot firmware image to bank4 at bank0.
=>tftp 0xa0000000 firmware_ls2088ardb_uboot_norboot_secure.img
=> protect off 584000000 +$filesize && erase 584000000 +$filesize && cp.b a0000000 584000000 $filesize
3. Prepare board for secure boot
a. Enable POVDD, Please refer to eth section "6.1.1.5.1.1 Enable POVDD" in LSDK 20.12 document.
b. Please refer to the section in "6.1.1.5.1.2 Program OTPMK" to program OTPMK key.
Write OTPMK fuse values on shadow registers
mw.l 1e80234 a29a0b2c
mw.l 1e80238 2c8cd201
mw.l 1e8023c 84027ca8
mw.l 1e80240 8e13c7b9
mw.l 1e80244 a0b9d347
mw.l 1e80248 50ef2622
mw.l 1e8024c 98a92efd
mw.l 1e80250 ed53d1c3
Check SNVS state again. There should be no parity errors
md 1e90014
80000900
md 1e80024
00000000
Now you will see ‘0’ in second nibble. No parity errors, i.e. bits marked in read would be all 0’s.
mw 1e80020 0x2
Reset and check that SNVS is in Check state
md 1e90014
80000900
4. Program SRKH mirror registers in through CCS environment.
a. Steps to put SoC in RSP (Reset Sequence Pause)
LS2088:
• Rev1 RDB Board Switch (Rev B): SW3.8 – 0. Switch (Rev C to Rev F): SW4.8 – 0. To boot from vbank4, change SW9[3:5] to 100.
b. After putting the SoC into RSP, reset the board. Then, use the below commands to write SRKH in the SFP mirror registers.
ccs::config_chain {<platform> sap2}
display ccs::get_config_chain
puts "Entry RSP: "
ccs::write_mem 2 0x7 0x001000D0 0x4 0x0 0x800
set ::littleendian(2) 1
ccs::write_mem <sap position> 0x1e80254 4 0 <SRKH1>
ccs::write_mem <sap position> 0x1e80258 4 0 <SRKH2>
ccs::write_mem <sap position> 0x1e8025c 4 0 <SRKH3>
ccs::write_mem <sap position> 0x1e80260 4 0 <SRKH4>
ccs::write_mem <sap position> 0x1e80264 4 0 <SRKH5>
ccs::write_mem <sap position> 0x1e80268 4 0 <SRKH6>
ccs::write_mem <sap position> 0x1e8026c 4 0 <SRKH7>
ccs::write_mem <sap position> 0x1e80270 4 0 <SRKH8>
set ::littleendian(2) 0
puts "Exiting RSP: "
ccs::write_mem 2 0x7 0x001000D0 0x4 0x0 0x400