Secure U-Boot failed on LS1043A

[justinchen]

Hello,

I have been followed the process from the documents "Setting up Secure Boot on PBL Based Platform in Prototype Stage" and QorIQ LS1043A Reference Manual to boot up the Secure U-Boot on LS1043ARDB. After SRKH mirror registers had been programed from CCS and CPU core 0 release from boot off mode.   The Secure U-Boot does not start. The followings How the procedures to deploy all secure related images to bank 4 flash memory .

I. Deploy Secure related images

1. Open the file “/etc/default/tftpd-hpa”,  modify TFTP_DIRECTORY, which point to folder that has all secure related images. e.g. “TFTP_DIRECTORY=<build>/tmp/deploy/images/ls1043ardb”
2. Bring up tftp server, at host Linux shell prompt type “sudo service tftpd-hpa restart”.
3. On the host Linux shell prompt, type “minicom –D /dev/ttyACM1”.  Bring up a XTerm that has serial communication to LS1043A development board.
4. Check u-boot environments,  type “printenv”. Make sure the ipaddr and serverip have valid IP address and the serverip address match with TFTP_ADDRESS in tftpd-hpa.
5. Check tftp communication, type “=>Tftp a0000000 PBL_SB_bank_4.bin”,The log message shows xxx bytes transferred. i.e. tftp communication is OK. The PBL_SB_ban_4.bin is generated from RCW/PBI Configuration.
6. Deploy RCW/PCI image type “=>Tftp a0000000 PBL_SB_bank_4.bin && erase 64000000 +$filesize && cp.b a0000000 64000000 $filesize”

7. Program CSF Header. type "=>Tftp a0000 hdr_uboot.out && erase 64080000 +$filesize && cp.b a0000000 64080000 $filesize"

8. Program Secure U-Boot image type “=>Tftp a0000 u-boot.bin && erase 64100000 +$filesize && cp.b a0000000 64100000 $filesize”

9. Bring up bank 4 secure uboot by Power On reset. type “=>cpld reset altbank”. This should put Secure U-Boot at hold off position waiting SRKH mirror registers programming. 

 II Program SRKH Mirror Registers

To temporary program SRKH mirror registers will go through CodeWarior Connection Server (CCS) when all the cores are in boot hold off.

1. Open CodeWarior Connection Server (CCS) window. The followings are step to program SRKH mirror registers.

        “(bin) 11 % findcc cwtaps”

        “(bin) 11 % source IDcode.tcl”, select the following setting

             Specify connection: 2

             Specify IP Address: <ip address found in previous command> 

     2. skip the following 2 instructions, if "(bin) 11 % show cc" has the correct configuration. e.g. ("0: CodeWarrior TAP (cwtap:192:168.1.26) CC software ver{0.0} ").

        “(bin) 12 % delete all”

        “(bin) 13 % config cc cwtap:FSLXXXXXX”    Note: To get FSLXXXXXX, see NXP Training Summary - U-BOOT DEBUG, LINUX KERNEL AND MODULE DEBUG, LINUX APPLICATION DEBUG.

      3. Using Text editor to open u_boot_srk_pub_key_hash.txt, the text editor shows the value of SFP SRKHR0~7, all those value will be used to the following registers write operation.  see RCW/PBI/CSF Header Configuration on how to generate hash of Public key.

        “(bin) 14 % ccs::config_chain {ls1034a dap sap2}

        “(bin) 15 % ccs::write_mem 32 0x1e80254 4 0 xxxxxxxx” - xxxxxxxx is from SFP SRKHR0

        “(bin) 11 % ccs::write_mem 32 0x1e80258 4 0 xxxxxxxx” – xxxxxxxx is from SFP SRKHR1

        “(bin) 16 % ccs::write_mem 32 0x1e8025c 4 0 xxxxxxxx” – xxxxxxxx is from SFP SRKHR2

        “(bin) 17 % ccs::write_mem 32 0x1e80260 4 0 xxxxxxxx” – xxxxxxxx is from SFP SRKHR3

        “(bin) 18 % ccs::write_mem 32 0x1e80264 4 0 xxxxxxxx” – xxxxxxxx is from SFP SRKHR4

        “(bin) 19 % ccs::write_mem 32 0x1e80268 4 0 xxxxxxxx” – xxxxxxxx is from SFP SRKHR5

        “(bin) 20 % ccs::write_mem 32 0x1e8026c 4 0 xxxxxxxx” – xxxxxxxx is from SFP SRKHR6

        “(bin) 21 % ccs::write_mem 32 0x1e80270 4 0 xxxxxxxx” – xxxxxxxx is from SFP SRKHR7

    3.   Release all cores from Boot hold off.

        “(bin) 22 % ccs::write_mem 32 0x1ee00e4 4 0 0000000f” – release all CPU cores from hold off

    4.   After all cores are released. Secure U-Boot Prompt appeared on Minicom window.

III Image Verification and Status Check

(1) This is reading for RCW/PBI on bank 4 from bank 0 u-boot prompt.

=> md.l 64000000 28
64000000: 55aa55aa 0001ee01 10001008 0000000a   
64000010: 00000000 00000000 02005514 12400080   
64000020: 005062e0 00200061 00000000 00000000   
64000030: 00000000 00880300 00000000 00110000   
64000040: 96000000 00000000 78015709 10e00000   
64000050: 00001809 08000000 18045709 9e000000   
64000060: 1c045709 9e000000 20045709 9e000000   
64000070: 0002ee09 00000864 c000ee09 00440000    //00000864 is point to CSF header
64000080: 58015709 00220000 40800089 01000000   
64000090: 40006108 b5928cce ffffffff ffffffff  

(2) This is reading of CSF Header from bank 0 u-boot command prompt after the header is programmed to bank 4 flash memory

=> md.l 0x64080000 8
64080000: 81273968 00000200 00000100 00000600   
64080010: 00000080 00000400 00000001 64100000  //64100000 is ENTRY_POINT

> md.l 0x64080400 8
64080400: 0009869b 00000000 64100000 ffffffff //64100000 is IMAGE_1 SRC_ADDR
64080410: 00000000 00000000 00000000 00000000 

(3) The hash of public key generate from CST signature tool.

RK (Public Key) Hash:
78079b52ece7f3bd4710c9570c3e385178c06f88ef1540d9c715173059e67f2b
         SFP SRKHR0 = 78079b52
         SFP SRKHR1 = ece7f3bd
         SFP SRKHR2 = 4710c957
         SFP SRKHR3 = 0c3e3851
         SFP SRKHR4 = 78c06f88
         SFP SRKHR5 = ef1540d9
         SFP SRKHR6 = c7151730
         SFP SRKHR7 = 59e67f2b

(4) read from SRKH mirror registers after reset from bank 4 and Hash value written to mirror registers

(bin) 84 % source rdSRKH.tcl
                   +0       +4       +8       +C
[0x01E80254] 78079B52 ECE7F3BD 4710C957 0C3E3851
[0x01E80264] 78C06F88 EF1540D9 C7151730 59E67F2B

(5) read Secure relate registers after CPU core is released from Hold off mode.

Check SSM_State(20-23) ... ;MSB=bit0
                   +0       +4       +8       +C
[0x01E90014] 8800AB00                               // 0xB i.e. Non-Secure
Check SCRATCHRW reisters 1-4
                   +0       +4       +8       +C
[0x01EE0200] 64080000 00000101 00000000 00000000 // 0x6408000 is SCRATCHRW1, 0x101 failure code
RCWSR registers 0~15
                   +0       +4       +8       +C
[0x01EE0100] 08100010 0A000000 00000000 00000000
[0x01EE0110] 14550002 80004012 E0625000 61002000
[0x01EE0120] 00000000 00000000 00000000 00038800
[0x01EE0130] 00000000 00001100 00000096 00000000

[bpe]

The diagnostic registers show a very typical picture:

HPSR[OTPMK_ZERO] = 1, error code is ERROR_STATE_NOT_CHECK, hardware - signaled error.

This means you did not program OTPMK into the fuses or this procedure failed. OTPMK fuses _must_ be blown.

Unlike with SRK Hash, putting a value into the corresponding mirror registers is _not_ sufficient.

Have a great day,
Platon

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[justinchen]

>HPSR[OTPMK_ZERO] = 1, error code is ERROR_STATE_NOT_CHECK, hardware - signaled error.

>This means you did not program OTPMK into the fuses or this procedure failed. OTPMK fuses _must_ be blown.

[JC]The Engineers who attended LS1043A U-Boot training class from NXP were told that the test key would be provided if our project is needed for LS1043ARDB. This gave us an impression that OTPMK is already programmed to the development board. What is the test key? I know Code Signing Tool has a feature to generate OTPMK. Does this OTPMK have Hamming Code inserted?

Thanks,

-JC

[jerrymorrow]

hi yipingwang‌ This page is in response to your request for us to create a page for our secure boot issue.  Any ideas welcome.

This is the original page I left a comment on.  Please contact justinchen‌ if you can.

https://community.nxp.com/docs/DOC-332248