Forum Discussion

rdrr's avatar
rdrr
Icon for Occasional Contributor rankOccasional Contributor
2 months ago

Agilex 5 with HPS Cryptographic services and bootflow

Hi I have a question regarding boot flow on agilex 5 with HPS with security in mind. I am aware how this is typically implemented on other SoCs like NXP but as for the Agilex - I just started working...
Arm Processor
embedded peripheral
Hps Arch
Hps Boot
SueC_Altera's avatar
SueC_Altera
Icon for Contributor rankContributor
2 months ago

Hi rdrr,

Your replies disappeared - I don't know why.  I will alert the forum team.  But I got the emails.

I'm so sorry you are confused! The part number decoder shows this, in part:

The dev kit is not shown on here because it is an ES device.  You can see this by the 0 in the 4th digit place and the ES at the end.  Security features are not enabled on ES devices.

For the other two devices you showed, you should look at the Agilex 5 C column for the first one and the Agilex 5 B column for the second device (using the 4th digit again) in the document I linked above.

All security features except for the Cryptographic Services are available on both B and C devices.  The table in part shows: 

 

Does that help?

Sue

rdrr's avatar
rdrr
Icon for Occasional Contributor rankOccasional Contributor
2 months ago

Thanks, but still have some questions. 

  1. Engineering sample, it's code is MK-A5E065BB32AES1, when you look at the doc I attached (here is the link https://cdrdv2-public.intel.com/820978/ug-820977-820978.pdf) in the Table 1 you see that for the following engineering sample MK-A5E065BB32AES1, the device part number is A5ED065BB32AE6SR0. 
    Decoding the 4tf digit of the ordering number and looking at the part number decoder we have A5ED, with D implying Quad HPS and Cryptographic Services. Where can I find the information that Cryptographic Services are disabled on ES?
  2. As  for the A5EC065BB32AE6S, looking at the 4th digit and part number decoder it seems that this variant does not feature Cryptographic Services am I right?
  3. As for the Terasic board (https://www.terasic.com.tw/cgi-bin/page/archive.pl?Language=English&CategoryNo=123&No=1384&PartNo=2#contents) with FPGA: A5EB013BB23BE4SCS and again looking at the 4th digit and product table code it seems that this product should have HPS as well as Cryptographic services, yes?

The thing I'm the most interested in is - whether or not will I be able to run full chain of trust on HPS on these particular product numbers.

I guess that on the variant with no Cryptographic services I will be able to authenticate fsbl only, but won't be able to authenticate further boot stages namely BL31, BL33, Linux, yes?

I will be very grateful for some guidance. 

Ps. sorry for spamming your mailbox but I've sent I guess 20 replies and each of them got deleted I guess due to the fact I originally used Cryptographic without "graphic" thus the content was filtered.