1 2-------------- 3NXP Platforms: 4-------------- 5TRUSTED_BOARD_BOOT option can be enabled by specifying TRUSTED_BOARD_BOOT=1 on command line during make. 6 7 8 9Bare-Minimum Preparation to run TBBR on NXP Platforms: 10======================================================= 11- OTPMK(One Time Programable Key) needs to be burnt in fuses. 12 -- It is the 256 bit key that stores a secret value used by the NXP SEC 4.0 IP in Trusted or Secure mode. 13 14 Note: It is primarily for the purpose of decrypting additional secrets stored in system non-volatile memory. 15 16 -- NXP CST tool gives an option to generate it. 17 18 Use the below command from directory 'cst', with correct options. 19 20 .. code:: shell 21 22 ./gen_otpmk_drbg 23 24- SRKH (Super Root Key Hash) needs to be burnt in fuses. 25 -- It is the 256 bit hash of the list of the public keys of the SRK key pair. 26 -- NXP CST tool gives an option to generate the RSA key pair and its hash. 27 28 Use the below command from directory 'cst', with correct options. 29 30 .. code:: shell 31 32 ./gen_keys 33 34Refer fuse frovisioning readme 'nxp-ls-fuse-prov.rst' for steps to blow these keys. 35 36 37 38Two options are provided for TRUSTED_BOARD_BOOT: 39================================================ 40 41------------------------------------------------------------------------- 42Option 1: CoT using X 509 certificates 43------------------------------------------------------------------------- 44 45- This CoT is as provided by ARM. 46 47- Enable this option by setting ``NXP_TBBR_USE_X509=1`` on the make command line. 48 49- To generate CSF header, path of CST repository needs to be specified as CST_DIR 50 51- CSF header is embedded to each of the BL2 image. 52 53- GENERATE_COT=1 adds the tool 'cert_create' to the build environment to generate: 54 -- X509 Certificates as (.crt) files. 55 -- X509 Pem key file as (.pem) files. 56 57- SAVE_KEYS=1 saves the keys and certificates, if GENERATE_COT=1. 58 -- For this to work, file name for cert and keys are provided as part of compilation or build command. 59 60 --- default file names will be used, incase not provided as part compilation or build command. 61 --- default folder 'BUILD_PLAT' will be used to store them. 62 63- ROTPK for x.509 certificates is generated and embedded in bl2.bin and 64 verified as part of CoT by Boot ROM during secure boot. 65 66- Compilation steps: 67 68All Images 69 .. code:: shell 70 71 make PLAT=$PLAT TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 CST_DIR=$CST_DIR_PATH \ 72 NXP_TBBR_USE_X509=1 \ 73 BOOT_MODE=<platform_supported_boot_mode> \ 74 RCW=$RCW_BIN \ 75 BL32=$TEE_BIN SPD=opteed\ 76 BL33=$UBOOT_SECURE_BIN \ 77 pbl \ 78 fip 79 80Additional FIP_DDR Image (For NXP platforms like lx2160a) 81 .. code:: shell 82 83 make PLAT=$PLAT TRUSTED_BOARD_BOOT=1 GENERATE_COT=1 \ 84 NXP_TBBR_USE_X509=1 fip_ddr 85 86 Note: make target 'fip_ddr' should never be combine with other make target 'fip', 'pbl' & 'bl2'. 87 88------------------------------------------------------------------------- 89Option 2: CoT using NXP CSF headers. 90------------------------------------------------------------------------- 91 92- CSF header is embedded to each of the BL31, BL32 and BL33 image. 93 94- This is the default flow when ``NXP_TBBR_USE_X509`` is not set or is ``0``. 95 96- To generate CSF header, path of CST repository needs to be specified as CST_DIR 97 98- Default input files for CSF header generation is added in this repo. 99 100- Default input file requires user to generate RSA key pair named 101 -- srk.pri, and 102 -- srk.pub, and add them in ATF repo. 103 -- These keys can be generated using gen_keys tool of CST. 104 105- To change the input file , user can use the options BL33_INPUT_FILE, BL32_INPUT_FILE, BL31_INPUT_FILE 106 107- There are 2 paths in secure boot flow : 108 -- Development Mode (sb_en in RCW = 1, SFP->OSPR, ITS = 0) 109 110 --- In this flow , even on ROTPK comparison failure, flow would continue. 111 --- However SNVS is transitioned to non-secure state 112 113 -- Production mode (SFP->OSPR, ITS = 1) 114 115 --- Any failure is fatal failure 116 117- Compilation steps: 118 119All Images 120 .. code:: shell 121 122 make PLAT=$PLAT TRUSTED_BOARD_BOOT=1 CST_DIR=$CST_DIR_PATH \ 123 BOOT_MODE=<platform_supported_boot_mode> \ 124 RCW=$RCW_BIN \ 125 BL32=$TEE_BIN SPD=opteed\ 126 BL33=$UBOOT_SECURE_BIN \ 127 pbl \ 128 fip 129 130Additional FIP_DDR Image (For NXP platforms like lx2160a) 131 .. code:: shell 132 133 make PLAT=$PLAT TRUSTED_BOARD_BOOT=1 CST_DIR=$CST_DIR_PATH fip_ddr 134 135- Compilation Steps with build option for generic image processing filters to prepend CSF header: 136 -- Generic image processing filters to prepend CSF header 137 138 BL32_INPUT_FILE = < file name> 139 BL33_INPUT_FILE = <file name> 140 141 .. code:: shell 142 143 make PLAT=$PLAT TRUSTED_BOARD_BOOT=1 CST_DIR=$CST_DIR_PATH \ 144 BOOT_MODE=<platform_supported_boot_mode> \ 145 RCW=$RCW_BIN \ 146 BL32=$TEE_BIN SPD=opteed\ 147 BL33=$UBOOT_SECURE_BIN \ 148 BL33_INPUT_FILE = <ip file> \ 149 BL32_INPUT_FILE = <ip_file> \ 150 BL31_INPUT_FILE = <ip file> \ 151 pbl \ 152 fip 153 154 155Deploy ATF Images 156================= 157Same steps as mentioned in the readme "nxp-layerscape.rst". 158 159 160 161Verification to check if Secure state is achieved: 162================================================== 163 164+---+----------------+-----------------+------------------------+----------------------------------+-------------------------------+ 165| | Platform | SNVS_HPSR_REG | SYS_SECURE_BIT(=value) | SYSTEM_SECURE_CONFIG_BIT(=value) | SSM_STATE | 166+===+================+=================+========================+==================================+===============================+ 167| 1.| lx2160ardb or | 0x01E90014 | 15 | 14-12 | 11-8 | 168| | lx2160aqds or | | ( = 1, BootROM Booted) | ( = 010 means Intent to Secure, | (=1111 means secure boot) | 169| | lx2162aqds | | | ( = 000 Unsecure) | (=1011 means Non-secure Boot) | 170+---+----------------+-----------------+------------------------+----------------------------------+-------------------------------+ 171 172- Production mode (SFP->OSPR, ITS = 1) 173 -- Linux prompt will successfully come. if the TBBR is successful. 174 175 --- Else, Linux boot will be successful. 176 177 -- For secure-boot status, read SNVS Register $SNVS_HPSR_REG from u-boot prompt: 178 179 .. code:: shell 180 181 md $SNVS_HPSR_REG 182 183 Command Output: 184 1e90014: 8000AF00 185 186 In case it is read as 00000000, then read this register using jtag (in development mode only through CW tap). 187 +0 +4 +8 +C 188 [0x01E90014] 8000AF00 189 190 191- Development Mode (sb_en in RCW = 1, SFP->OSPR, ITS = 0) 192 -- Refer the SoC specific table to read the register to interpret whether the secure boot is achieved or not. 193 -- Using JTAG (in development environment only, using CW tap): 194 195 --- For secure-boot status, read SNVS Register $SNVS_HPSR_REG 196 197 .. code:: shell 198 199 ccs::display_regs 86 0x01E90014 4 0 1 200 201 Command Output: 202 Using the SAP chain position number 86, following is the output. 203 204 +0 +4 +8 +C 205 [0x01E90014] 8000AF00 206 207 Note: Chain position number will vary from one SoC to other SoC. 208 209- Interpretation of the value: 210 211 -- 0xA indicates BootROM booted, with intent to secure. 212 -- 0xF = secure boot, as SSM_STATE. 213