rk3399_rockchip-uboot/doc/README.armada-secureboot

12 7. Work to be done
19 a specially prepared boot image. This can be used to establish a chain of trust
25 one-time-writeable memory) need to be configured in the correct way.
49 be addressed:
56 (1) will be addressed later, (2) will be taken care of by U-Boot's build
58 data (essentially a series of U-Boot commands to be entered at the U-Boot
59 command prompt) will be created by the build system as well.
166 mode may be entered there, but since this mode is untested in the current
174 To employ the trusted boot framework, cryptographic key material needs to be
176 secured boot image: The KAK private key and a CSK private key (both have to be
180 NOTE: Since the public key can be generated from the private key, it is
183 OpenSSL can be used to generate the needed files kwb_kak.key and kwb_csk.key
184 (the names of these files have to be configured, see the next section on
190 The generated files have to be placed in the U-Boot root directory.
193 be placed in the U-Boot root directory.
197 should be carefully guarded.
215 	     BOX_ID - The BoxID to be used for trusted debugging (a integer
217 	   FLASH_ID - The FlashID to be used for trusted debugging (a integer
219 	 JTAG_DELAY - The JTAG delay to be used for trusted debugging (a
234 The parameter values may be hardcoded into the file, but it is also possible to
243 needs to be activated, and a index for the active CSK needs to be selected as
246 Furthermore, eFuse writing support has to be activated in order to burn the
260 image u-boot-spl.kwb can then be tested, if so desired. The hdrparser from [5]
261 can be used for this purpose. To build the tool, invoke make in the
263 hdrparser executable. A test can be conducted by calling hdrparser with the
278 | operation! Should wrong or corrupted values be used, the |
284 the kwbimage.cfg was set, a text file kwb_fuses_a38x.txt should be present in
293 have to be crafted by hand. The needed fuse lines can be looked up in [1]; a
296 * Burn the KAK public key hash. The hash itself can be found in the file
297   pub_kak_hash.txt in the U-Boot top-level directory; be careful to account for
300 * Enable trusted boot by burning the corresponding fuse (WARNING: this must be
308 ARMADA SoC demands that whole fuse lines (64 bit values) have to be written as
309 a whole. The fuse prog command itself allows lists of 32 bit words to be
315 (0-2): The first and second words are the values to be written to the fuse
330 Here 10 is the fuse line number, 0 is the index of the first word to be
331 written, 00112233 and 44556677 are the values to be written to the fuse line
339 Here 11 is the fuse number, 2 is the index of the first word to be written
343 WARNING: According to application note [4], the VHV pin of the SoC must be
344 connected to a 1.8V source during eFuse programming, but *must* be disconnected
348 chosen circuit, the issue needs to be addressed accordingly!
350 7. Work to be done