bf70x Si rev1.0 how to secure boot SPI Master ? (for mass production)

Question

hello 
 i would like to know what do i need to write in otp for BLx secure boot a BF706 Si REV1.0 
 my application uses a standard flash memory connected to SPI2 and /SPI_SEL2 pin ( not the default SS/SEL1 pin) 
 for normal non secure boot i just need to write 0x20211202 at dBootCmd, and the booting process is ok 
 here is the CLDP command i use : 
 cldp -proc ADSP-BF706 -emu 200 -driver "bf707_otp_driver.dxe" -device otp -cmd prog -file otp_spi2_sel2_boot.bin -format bin -offset 0x288 -numbyte 4 -quiet 
 
 the binary file contains only the following bytes (LSB first): 
 02 12 21 20 
 for performing the SPI boot process at full speed, i need to write an "initcode" that sets the spi clock register at the right speed. 
 this acts like a first stage boot. this is a very convenient way for setting the CPU and SPI clock speed, turning on the memory. etc 
 for secure booting i have three big problems : 
 first there is no "initcode" available therefore i'm not sure how set the SPI speed for booting at the maximum speed available 
 Q : is it in the uwClkLower field of the ADI_ROM_BOOT_SPI structure ? 
 secondly due the 19000026 bug we need to boot using the undocumented BCMD_DEVICE mode 7, instead of the SPI device. 
 in the last anomaly list revision (12-22-2014) i received, this bug was not resolved 
 the workaround is : use adi_boot_rom(0x40000000,0,0,0,,0x207); 
 Q : but how do i use this information ? do i need to write in OTP 0x207 as dBootCmd and 0x40000000 at pSource ? how do we activate MDMA ? 
 thirdly i do not know how to lock the part yet using CLDP. i managed to lock the part using the EE366 app note "program OTP", but i do not know what exactly need to be written in the OTP to perform the locking. once locked i have no mean to dump the OTP memory yet, thus i'm kind of blind 
 Q : i know this lock bit at OTP offset 0x48C, but what is the actual BYTE value to be written ? are there other registers to be set for activating the secure boot and locking the part ? 
 i wish to bring at your attention that the flash and OTP programming will be performed in mass production 
 the step are the following: 
 1> flash programming of the secured application using CLDP and the dxe flash driver, via JTAG 
 2> writing of the SPIM boot commands, the BLx mode keys, using the CLDP and the dxe OTP driver, via JTAG 
 3> locking the part using CLDP and the dxe OTP driver, via JTAG 
 in mass production we cannot open CCES and start a debug session for programming the keys and locking the part. 
 thus we prefer to use a convenient tool like CLDP, that can be made fully automatable 
 this is an urgent request 
 thanks for your support 
 Alban

Harshit.Gaharwar · Accepted Answer

Hi Alban, 
 It looks like we have already communicated regarding the above issues through private support. So in order to avoid any further duplication of effort I am closing this thread. 
 I would request you to ask all future queries related to this issue through private support only. 
 However, I am posting the response for the above two queries raised by you for other customers as a guidance. 
 For “Q1> how do i set the OTP field for making the part boot in secure mode AT FULL SPEED ?” 
 >> In order to boot a secure bootstream, the public and the private keys with which the boot image was signed and encrypted should be stored in the OTP. 
 The boot ROM provides a mechanism via available non-volatile programmable memory (OTP on this processor) to customize boot process like configuring CGU, initializing DMC0, storing keys for the Secure boot etc. The ROM provides a set of functions to access OTP field. 
 All OTP accesses are allowed using the OTP APIs only as shown below: 
 
 To Program the OTP data field 
 
 bool adi_rom_otp_pgm(otp_data* data); 
 
 To read the OTP data field 
 
 bool adi_rom_otp_get( OTPCMD cmd, uint32_t*data); 
 
 To lock the ADSP-SC58x processor (For Secure Booting) 
 
 bool adi_rom_lock(); 
 
 Q2> how do i lock the part using CLDP ? 
 >> Instead of using the bool adi_rom_lock(); API, CLDP can be used to program the lock bit in the OTP as shown below: 
 …\Analog Devices\CrossCore Embedded Studio 2.0.0> cldp -proc ADSP-BF707 -emu ice-1000 -driver "C:\Analog Devices\CrossCore Embedded Studio 2.0.0\Blackfin\Examples\Device_Programmer\bf70x\otp\Debug\bf707_otp_driver.dxe" -device otp -cmd prog -file "D:\otp_lock_bit.txt" -format ascii -offset 0x48C -numbyte 1 
 The otp_lock_bit.txt file has only 0x1 in it. 
 Hope this helps. 
 Thanks, 
 Harshit)

alban · Answer

Hello ! 
 Now i am sure that all things work with secure boot , i am able to give a walkthrough for people that still have some issues with the ADSP-BF70x 
 first, paste this lines of code at the very beginning of your main.c (self-explanatory ) 
 /*disable write protect for all the peripherals under secure boot mode */ 
 *pREG_SPU0_SECUREP0=3; *pREG_SPU0_SECUREP1=3; *pREG_SPU0_SECUREP2=3; *pREG_SPU0_SECUREP3=3; *pREG_SPU0_SECUREP4=3; *pREG_SPU0_SECUREP5=3; *pREG_SPU0_SECUREP6=3; *pREG_SPU0_SECUREP7=3; *pREG_SPU0_SECUREP8=3; *pREG_SPU0_SECUREP9=3; *pREG_SPU0_SECUREP10=3; *pREG_SPU0_SECUREP11=3; *pREG_SPU0_SECUREP12=3; *pREG_SPU0_SECUREP13=3; *pREG_SPU0_SECUREP14=3; *pREG_SPU0_SECUREP15=3; *pREG_SPU0_SECUREP16=3; *pREG_SPU0_SECUREP17=3; *pREG_SPU0_SECUREP18=3; *pREG_SPU0_SECUREP19=3; *pREG_SPU0_SECUREP20=3; *pREG_SPU0_SECUREP21=3; *pREG_SPU0_SECUREP22=3; *pREG_SPU0_SECUREP23=3; *pREG_SPU0_SECUREP24=3; *pREG_SPU0_SECUREP25=3; *pREG_SPU0_SECUREP26=3; *pREG_SPU0_SECUREP27=3; *pREG_SPU0_SECUREP28=3; *pREG_SPU0_SECUREP29=3; *pREG_SPU0_SECUREP30=3; *pREG_SPU0_SECUREP31=3; *pREG_SPU0_SECUREP32=3; *pREG_SPU0_SECUREP33=3; *pREG_SPU0_SECUREP34=3; *pREG_SPU0_SECUREP35=3; *pREG_SPU0_SECUREP36=3; *pREG_SPU0_SECUREP37=3; *pREG_SPU0_SECUREP38=3; *pREG_SPU0_SECUREP39=3; *pREG_SPU0_SECUREP40=3; *pREG_SPU0_SECUREP41=3; *pREG_SPU0_SECUREP42=3; *pREG_SPU0_SECUREP43=3; *pREG_SPU0_SECUREP44=3; *pREG_SPU0_SECUREP45=3; *pREG_SPU0_SECUREP46=3; *pREG_SPU0_SECUREP47=3; *pREG_SPU0_SECUREP48=3; *pREG_SPU0_SECUREP49=3; *pREG_SPU0_SECUREP50=3; *pREG_SPU0_SECUREP51=3; *pREG_SPU0_SECUREP52=3; *pREG_SPU0_SECUREP53=3; *pREG_SPU0_SECUREP54=3; *pREG_SPU0_SECUREP55=3; *pREG_SPU0_SECUREP56=3; *pREG_SPU0_SECUREP57=3; *pREG_SPU0_SECUREP58=3; *pREG_SPU0_SECUREP59=3; *pREG_SPU0_SECUREP60=3; *pREG_SPU0_SECUREP61=3; *pREG_SPU0_SECUREP62=3; *pREG_SPU0_SECUREP63=3; *pREG_SPU0_SECUREP64=3; *pREG_SPU0_SECUREP65=3; *pREG_SPU0_SECUREP66=3; *pREG_SPU0_SECUREP67=3; *pREG_SPU0_SECUREP68=3; *pREG_SPU0_SECUREP69=3; *pREG_SPU0_SECUREP70=3; *pREG_SPU0_SECUREP71=3; *pREG_SPU0_SECUREP72=3; *pREG_SPU0_SECUREP73=3; *pREG_SPU0_SECUREP74=3; *pREG_SPU0_SECUREP75=3; *pREG_SPU0_SECUREP76=3; *pREG_SPU0_SECUREP77=3; 
 adi_initComponents(); 
 ... -> your application starts here <- bf706_clock_init(); init_gpio(); 
 init_blabla(); 
 and so on... 
 ... 
 there are some error in the HRM 
 
 Hi Alban, 
 It does indeed go up to 77 as you see in cdefBF706.h. As I mentioned earlier, everything if offset by 1 for n=7 and on in the HRM. So, 77 is the PKIC (which is erroneously labeled as 76). In cdefBF706.h, SPU0_SECUREP7 should not be present as it’s reserved. 
 Regards, 
 second, follow the EE366 tutorial and generate you keys . i use BLX secure because it is enough for both code authentication and confidentiality 
 authentication : uses a pair of private and public keys, protects your code against binary errors 
 confidentiality : uses an encryption key that is stored in the OTP memory for automated decryption on boot 
 once fully programmed the OTP memory is locked so there is no mean for read back the keys 
 for those who want to test the secure boot on an open part, there is a crippled part of the code I used. 
 (sorry i did not find how to setup the text editor for verbatim code copy/paste) 
 i set up the dBootCmd for SPI boot using SPI_SEL2 pin (default is SS/SPI_SEL1) 
 int32_t ConfigureForSecureBoot ( ADI_ROM_BOOT_CONFIG * pBootConfig, ROM_HOOK_CALL_CAUSE cause) { 
 if (cause == ROM_HOOK_CALL_INIT_COMPLETE ) { 
 pBootConfig-> bootType = ADI_ROM_SECURE_BOOT ; 
 pBootConfig-> keyType = ADI_ROM_CUSTOM_SECURITY ; 
 configureBlx(pBootConfig); 
 } else { 
 } 
 return 0; 
 } 
 int main ( void ) 
 { 
 *pREG_L1IM_ICTL = 1; 
 adi_rom_Boot(0x40000000,BITM_ROM_BFLAG_HOOK,0,&ConfigureForSecureBoot,0x00061207); 
 } 
 third, sign your code using the signtool 
 signtool sign -type BLx -prikey auth_key.bin -enckey encrypt_key.bin -infile "debug\your_project.ldr" -outfile the_firmware.bin 
 finally, program your part using the bf707_otp_driver.dxe 
 cldp -driver "Device_programmer_flash_m25px16.dxe" -emu ice-2000 -proc ADSP-BF706 -verbose -cmd prog -erase affected -format bin -file "the_firmware.bin" cldp -proc ADSP-BF706 -emu ice-2000 -driver "bf707_otp_driver.dxe" -device otp -cmd prog -file encrypt_key.bin -format bin -offset 0x168 -numbyte 16 -quiet cldp -proc ADSP-BF706 -emu ice-2000 -driver "bf707_otp_driver.dxe" -device otp -cmd prog -file jtag_key.bin -format bin -offset 0x1C8 -numbyte 16 -quiet cldp -proc ADSP-BF706 -emu ice-2000 -driver "bf707_otp_driver.dxe" -device otp -cmd prog -file auth_public_key.bin -format bin -offset 0x200 -numbyte 56 -quiet cldp -proc ADSP-BF706 -emu ice-2000 -driver "bf707_otp_driver.dxe" -device otp -cmd prog -file otp_cgu.bin -format bin -offset 0x280 -numbyte 12 -quiet cldp -proc ADSP-BF706 -emu ice-2000 -driver "bf707_otp_driver.dxe" -device otp -cmd prog -file otp_spi2_sel2_MMMode_bcode6.bin -format bin -offset 0x288 -numbyte 4 -quiet cldp -proc ADSP-BF706 -emu ice-2000 -driver "bf707_otp_driver.dxe" -device otp -cmd lock -quiet 
 i Hope this helps 
 Alban

Electronic Design Services - PartnerZone

Products Mentioned

bf70x Si rev1.0 how to secure boot SPI Master ? (for mass production)