Forum Discussion

RVCA's avatar
RVCA
Icon for New Contributor rankNew Contributor
4 years ago

Arria10 HPS secure boot from FPGA

Hi, For bootstrapping in production and as a rescue mechanism for 'bricked' boards, we use an FPGA image, with a U-boot image embedded in ROM. The FPGA image is loaded over JTAG and forces the HPS ...
aikeu's avatar
aikeu
Icon for Regular Contributor rankRegular Contributor
3 years ago

Hi RVCA,


  1. The boot ROM determines the boot flash partition and verifies the security header settings of the second-stage boot loader image. The second-stage boot loader requires a signed certificate to be authenticated.
  2. The Boot ROM determines the source of the root key by reading the security header.


From the above statement, the boot ROM may not support booting from FPGA ROM.

The link from the above information:

https://www.intel.com/content/www/us/en/docs/programmable/683060/20-4/an-759-using-secure-boot-in-soc-devices.html


May I know if there is any error logs from the boot up failure?


Thanks.

Regards,

Aik Eu


RVCA's avatar
RVCA
Icon for New Contributor rankNew Contributor
3 years ago

Hi,

There are no boot logs, the device refuses to boot.

We know the Boot ROM supports booting from FPGA ROM when secure boot is not enforced (authen_en=0 and aes_en=0) and the bootloader in the FPGA ROM is not encrypted or signed. My question is:

Is there a way to boot from FPGA ROM when secure boot is enforced by the HPS secure fuses?

Kind regards,

Robbe