Forum Discussion

ChristianMS's avatar
ChristianMS
Icon for New Contributor rankNew Contributor
5 months ago

Arria10 Secure Boot : unable to boot SPL FUSE

On the Arria10, a signed SPL using the FUSE method does not boot at all, but it does boot when using the USER method. The behavior is the same as if we had not programmed the fuses.


Details :

Using the alt_authtool.py utility found in the repository, the SPL is signed.
The tool accepts the following options:

- fuse: embed root pubkey in image. BootROM verifies its hash against device fuses.
- fpga: fetch trusted root pubkey from location in FPGA memory.
- user: embed root pubkey in image. BootROM does not verify.

read EC key
Private-Key: (256 bit)
priv:
9e:e1:55:ec:b6:be:bd:15:22:80:73:3a:66:ee:07:
fa:58:26:1f:d0:13:c8:e5:6a:b0:05:bc:23:f7:dc:
58:46
pub:
04:0d:b3:cf:29:e9:54:60:7a:1c:d2:99:ca:5e:dd:
d0:72:98:0c:5f:89:33:2c:16:35:24:4f:65:ad:ba:
23:45:9d:ec:5e:22:06:9f:b6:b2:bd:d0:19:8c:53:
aa:af:20:1c:df:72:0f:02:e9:44:b0:86:1a:d5:b5:
7a:2c:81:65:dd
ASN1 OID: prime256v1
NIST CURVE: P-256

First, we generate the SPL using the user option, then follow the Application Note, and the Arria10 board boots correctly.

python3 -B -E $(which alt_authtool.py) sign -t user -k ${ROOT_KEY_PEM} -i ${DEPLOYDIR}/u-boot-spl-public-key.sfp -o ${DEPLOYDIR}/u-boot-spl-public-key-signed.sfp --fuseout ${DEPLOYDIR}/u-boot-spl-public-key-signed.fuse

The following text is displayed:

SHA256 digest of root public key: 3dfe63cab8b3657db2ebdeaca234f0d6ec3744a3905d7e04dfa63a5a6721dfe7

==> The SPL with USER option boots correctly.

Next, we generate the SPL using the fuse option. With this, the FPGA should only be able to boot if the fuses are programmed (volatile or non-volatile). When alt_authtool.py is executed, it displays the SHA256 hash of the public key. We use this public key to construct a file containing:

key1 3DFE63CAB8B3657DB2EBDEACA234F0D6EC3744A3905D7E04DFA63A5A6721DFE7

Using this key file, we generate an EKP file with Quartus (compressed into a zip and attached to the present message).

In the end, using the Quartus Prime Programmer, we program the Arria10 board with EKP file (this takes less than one second).

 

Immediately after programming the volatile fuses, the board resets (the power supply current drops from 1A to 0.8A, and then returns to 1A), and the fan stops and restarts.

==> However, on the serial console, the SPL signed with the FUSE method does not display any messages, and neither U-Boot nor the kernel is loaded.

On the other hand, the SPL signed with the USER method is still able to boot, even with the volatile fuses programmed (boot messages appear, and both U-Boot and the kernel are loaded).

Question:

Can you help us to solve this boot issue with the FUSE method ? The behavior is like volatile fuses are not programmed !

If you need more information and details, please tell us.

Thanks in advance.

Christian & Baptiste

Hps Boot

30 Replies

  • nareshrkumar's avatar
    nareshrkumar
    Icon for New Contributor rankNew Contributor
    5 months ago

    Hi Christian

    Thanks for bringing the issue to our notice.

    I have internally started working on it; will keep you posted on the progress.

    Kind Regards

    Naresh

  • nareshrkumar's avatar
    nareshrkumar
    Icon for New Contributor rankNew Contributor
    5 months ago

    Hi Christian

    Immediately after programming the volatile fuses, the board resets (the power supply current drops from 1A to 0.8A, and then returns to 1A), and the fan stops and restarts.

    Preliminary impressions of the issue are, since the board resets after programming the volatile fuses, the saved hash is also lost. Hence, the hash comparison step fails, leading to no prints on the console.

    So, basically we need to avoid reset once the fuse is flashed, this I believe is happening because reset is initiated by the Quartus tool or your programmer.

    There are 2 points for us to check, one with Quartus tool and the other with your programmer:

    1. From my end, I am checking whether Quartus is initiating the reset, and if there is a way to avoid it.
    2. I believe you are using JTAG as your programmer, can you please check if the programmer is initiating the reset?

    Thanks

    Naresh

    • ChristianMS's avatar
      ChristianMS
      Icon for New Contributor rankNew Contributor
      5 months ago

      Thank you for your involvement.

      1. Just for your information, I was using the Programmer from Quartus Prime 23.1 (Standard Edition), while the EKP file was generated using Quartus Prime 24.2 (Pro Edition). I will try installing the same version to ensure compatibility.
      2. We are using the "JTAG Altera USB Blaster." We’ll investigate the reset pin behavior, but if the reset does not occur, there should be an alternative way to boot the SPL (such as jumping to the entry address directly).

      Best regards,

      Christian & Baptiste

    • ThFo's avatar
      ThFo
      Icon for New Contributor rankNew Contributor
      5 months ago

      Hi @nareshrkumar,

      Thanks you for your feedback.

      I'm working with Christian and Baptiste. Without further information, the project, that we working on is currently at a deadlock situation.
      Do you have new information about how to bypass the reset that can be triggered by quartus ?

      - Have you encountered/known issues with certain Quartus version ? (standard, pro or specific version number)
      - If the USB blaster forces the reset, is there a method to bypass it using Quartus?


      Thanks,
      Théo

      • nareshrkumar's avatar
        nareshrkumar
        Icon for New Contributor rankNew Contributor
        4 months ago

        Hi Theo, Christian and Baptiste

        Thank you for the information shared.

        As of today, I am not aware of any known issues with a Quartus version.

        As the issue involves multiple components, U-Boot, Quartus, programmer and signing tool etc., I am working with different teams internally to get definitive information. Please give me some more time, I will update you on the status.

        Thanks

        Naresh

  • Jeet14's avatar
    Jeet14
    Icon for Frequent Contributor rankFrequent Contributor
    4 months ago

    Hi Theo & Christian,


    Any update on the previous post by Naresh Kumar.


    Regards

    Tiwari