Setting up Secure Boot on PBL Based Platforms in Prototype Stage

[#1]

This document introduces secure boot setting up methods and procedures for QorIQ PBL based PowerPC and ARM architecture platforms. It explains the basic concept of secure boot; describes how to create PBL, CSF headers and ESBC images for secure boot; introduces how to deploy secure boot related images on the target and how to blow OTPMK and write SRK hash keys to the mirror registers in the prototype stage; provides the step by step troubleshooting method when secure boot fails without any message printed out on the UART console.

LS1043 is used as an example in this document, if the user uses different processor, it is need to change registers and images deployment addresses according to the processor reference manual and QorIQ SDK user manual.

1. Basic Concept of Secure Boot on PBL Based Platform

2. Preparing Images for Secure BOOT

    2.1 Create RCW Supporting Secure Boot

          2.1.1 Create Secure boot RCW in Linux SDK

          2.1.2 Create Secure Boot RCW with QCVS tool

   2.2 Generate RSA keys and Signing Images to Create CSF Header with CST tool

3. Deploy Secure Boot Images to the Target and Write SRKH Mirror Register

4. Secure boot Trouble Shooting.

[jerrymorrow]

Hello, We've gone through this process for secure boot on the LS1043ARDB.  The boot holdoff is working, and we're able to check all values are properly set before releasing the core(s).  After the cores are released, u-boot does not start, and our error code in scratch register 2 is 0x00000101

[yipingwang]

Hello Jerry,

Would you please create a customer service request in our system or create a new thread in community to describe your procedure in more details?

I will do more investigation for you.

Thanks,

Yiping

[pratik_vadher]

Is there any way I can use Code Signing Tool in Codewarrior itself?