AnsweredAssumed Answered

bf706 secure boot not working with Si REV 1.0

Question asked by alban on Aug 12, 2015
Latest reply on Aug 13, 2015 by alban

Hello

i tried to make to EE366 work on a BF706 target

 

i managed to make it work with CCES 110 on the EZKIT lite REV1.2 (bf707 rev 0.0B)

i built a simple blinky app, and i was able to boot in standard mode and BLX secure mode using the "EE366 secureboot_openpart" dxe app

 

i'm working on a project which uses a BF706 rev1.0 date code 1452 (december 2014)

i'm able to boot a blinky app using the "EE366 secureboot_openpart"   in normal mode only !

in secure boot (BLx or BLp) the program get stuck at address 0x040026da

before it proceeds to the Hook with cause = ROM_HOOK_CALL_CONFIG_COMPLETE

 

i built the ldr file with the -nofillblock option set, and bcode = 1

 

below is detailled the content of the ADI_ROM_BOOT_CONFIG structure

please note the last field :  errorReturn _Uint32t 0x04001a26  (not documented)

and "secureBootImageType ROM_SB_IMAGE_TYPE ROM_SB_IMAGE_UNKNOWN "

 

ADI_ROM_BOOT_CONFIG *)(0x11807ccc) ADI_ROM_BOOT_CONFIG* 0x11807ccc

ADI_ROM_BOOT_CONFIG {...}

  pSource void * 0x00000010

  pDestination void * 0x00000000

  dByteCount _Int32t 0x00000000

  dFlags _Int32t 0x00040000

  ulBlockCount _Uint32t 0x00000000

  ulBlockCurrent _Uint32t 0x00000000

  pNextDxe void * 0x00000000

  pControlRegister volatile uint32_t* 0x00000000

  dControlValue _Int32t 0x00000003

  pPeripheralBase volatile uint32_t* 0x20057000

  pAuxControlRegister volatile uint32_t* 0x00000000

  pAuxPeripheralBase volatile uint32_t* 0x00000000

  pSecControlRegister volatile uint32_t* 0x20004960

  pDmaBaseRegister volatile ADI_DMA_TypeDef* 0x20085000

  loadType ROM_DMA_DONE_DETECT_METHOD ROM_DMA_DONE_POLL_IRQDONE

  MdmaCfg ROM_DMA_MDMA_CONFIG {...}

  uwDataWidth unsigned short 0

  uwSrcModifyMult unsigned short 1

  uwDstModifyMult unsigned short 1

  uwUserShort unsigned short 0

  dUserLong _Int32t 0x00000000

  dReserved _Int32t 0x00000000

  pModeData void * 0x11807dac

  dBootCommand _Int32t 0x20211202

  pHeader ADI_ROM_BOOT_HEADER* 0x08001810

  pTempBuffer void * 0x00000000

  pTempBufferPrefetch void * 0x00000000

  dTempByteCount _Int32t 0x00000400

  pTempSource void * 0xffffffff

  dPageByteCount _Int32t 0x00000004

  bootBuffers ADI_ROM_BOOT_INTER_BUFFERS {...}

  bootRegistry ADI_ROM_BOOT_REGISTRY {...}

  pErrorFunction ROM_BOOT_ERROR_FUNC* 0x00000000

  pCallBackFunction ROM_BOOT_CALLBACK_FUNC* 0x0400176c

  pCrcFunction ROM_BOOT_CALLBACK_FUNC* 0x00000000

  pForwardFunction ROM_BOOT_CALLBACK_FUNC* 0x00000000

  bootModes ADI_ROM_BOOT_MODES {...}

  pLogBuffer void * 0x00000000

  pLogCurrent void * 0x00000000

  dLogByteCount _Int32t 0x00000000

  pOtpBootInfo ADI_ROM_OTP_BOOT_INFO* 0x11807f24

  keyType ADI_ROM_BOOT_KEY_TYPE ADI_ROM_CUSTOM_SECURITY

  bootType ADI_ROM_BOOT_TYPE ADI_ROM_SECURE_BOOT

  secureBootImageType ROM_SB_IMAGE_TYPE ROM_SB_IMAGE_UNKNOWN

  reserved0 void * 0x08001820

  publicKey ADI_SBIF_ECDSA_PublicKey_t {...}

  cryptoDescriptors CRYPTO_DESCRIPTORS {...}

  reserved1 void * 0x08001aec

  secureBytesRemaining _Int32t 0x00000000

  aesKey uint32_t[] {...}

  aesWrapKey uint32_t[] {...}

  IV uint32_t[] {...}

  pHash uint8_t* 0x08001acc

  errorReturn _Uint32t 0x04001a26

 

 

i tested my proto board with and old BF706 rev0.0B (1410)

i was able to secure boot in blx mode, so i can conclude that my board and the flash i use are not part of the problem

 

below are the contents of the boot info struct after secure booting

 

as you can see the BLX image type is properly recognized,

and the dflags indicate that the image was fully loaded

 

(ADI_ROM_BOOT_CONFIG *)(0x11807ccc) ADI_ROM_BOOT_CONFIG* 0x11807ccc

ADI_ROM_BOOT_CONFIG {...}

  pSource void * 0x40002fc8

  pDestination void * 0x11a00000

  dByteCount _Int32t 0x00000000

  dFlags _Int32t 0x000c8001

  ulBlockCount _Uint32t 0x00000000

  ulBlockCurrent _Uint32t 0x00000018

  pNextDxe void * 0x40002fc8

  pControlRegister volatile uint32_t* 0x00000000

  dControlValue _Int32t 0x80000043

  pPeripheralBase volatile uint32_t* 0x20057000

  pAuxControlRegister volatile uint32_t* 0x00000000

  pAuxPeripheralBase volatile uint32_t* 0x00000000

  pSecControlRegister volatile uint32_t* 0x20004960

  pDmaBaseRegister volatile ADI_DMA_TypeDef* 0x2008d000

  loadType ROM_DMA_DONE_DETECT_METHOD ROM_DMA_DONE_NON_BLOCKING

  MdmaCfg ROM_DMA_MDMA_CONFIG {...}

  uwDataWidth unsigned short 0

  uwSrcModifyMult unsigned short 1

  uwDstModifyMult unsigned short 1

  uwUserShort unsigned short 0

  dUserLong _Int32t 0x00000000

  dReserved _Int32t 0x00000000

  pModeData void * 0x11807dac

  dBootCommand _Int32t 0x00000007

  pHeader ADI_ROM_BOOT_HEADER* 0x08001810

  pTempBuffer void * 0x00000000

  pTempBufferPrefetch void * 0x00000000

  dTempByteCount _Int32t 0x00000400

  pTempSource void * 0x40002cb4

  dPageByteCount _Int32t 0x00000004

  bootBuffers ADI_ROM_BOOT_INTER_BUFFERS {...}

  bootRegistry ADI_ROM_BOOT_REGISTRY {...}

  pErrorFunction ROM_BOOT_ERROR_FUNC* 0x00000000

  pCallBackFunction ROM_BOOT_CALLBACK_FUNC* 0x0400161c

  pCrcFunction ROM_BOOT_CALLBACK_FUNC* 0x00000000

  pForwardFunction ROM_BOOT_CALLBACK_FUNC* 0x00000000

  bootModes ADI_ROM_BOOT_MODES {...}

  pLogBuffer void * 0x00000000

  pLogCurrent void * 0x00000000

  dLogByteCount _Int32t 0x00000000

  pOtpBootInfo ADI_ROM_OTP_BOOT_INFO* 0x11807f24

  keyType ADI_ROM_BOOT_KEY_TYPE ADI_ROM_CUSTOM_SECURITY

  bootType ADI_ROM_BOOT_TYPE ADI_ROM_SECURE_BOOT

  secureBootImageType ROM_SB_IMAGE_TYPE ROM_SB_IMAGE_BLX

  reserved0 void * 0x08001820

  publicKey ADI_SBIF_ECDSA_PublicKey_t {...}

  cryptoDescriptors CRYPTO_DESCRIPTORS {...}

  reserved1 void * 0x08001ae4

  secureBytesRemaining _Int32t 0x00000000

  aesKey uint32_t[] {...}

  aesWrapKey uint32_t[] {...}

  IV uint32_t[] {...}

  pHash uint8_t* 0x08001ac4

  errorReturn _Uint32t 0x00000000

 

the question are :

does the EE366 have been tested with the BF706 rev 1.0 ?

(did AD release the EE366 app note BEFORE the bf706 si REV1.0 ? )

 

could you give me some clue on how get the thing work ?

 

thank you for your support

i'm sorry but this is very urgent

 

Alban

Outcomes