Forum Discussion

ChristianMS's avatar
ChristianMS
Icon for New Contributor rankNew Contributor
1 year ago
Solved

U-boot errors when using SecureBoot with Arria10

Hello, We just want to boot to Arria10 with signed U-Boot and kernel. We are using yocto kirkstone (4.0.26), when we activate Secure Boot, we encountered different problems. With U-Boot 2021.07, U...
Hps Boot
  • ChristianMS's avatar
    ChristianMS
    1 year ago

    Hi Support team,

    Good news, we found why the sign FIT of U-Boot failed. The FIT loading strategy changed since 2021.07.

    In old U-Boots, FIT is load into the OCRAM then external binaries are loaded to RAM to 0x1000040.

    In recent U-Boots, FIT included external binaries is fully loaded to RAM at 0x1000000, then U-Boot binary and Flat DTB are loaded to the load address (0x500000) mentionned in the FIT (it was not possible to keep the same address, in order to avoid overlap).

    The jump to U-Boot failed because we forgot to change the load address of U-Boot in the U-Boot configuration. As a result, U-Boot was compiled to execute at an address different from the one to which it was copied.

    So just by setting CONFIG_TEXT_BASE=0x00500000, compile and flash. then U-Boot 2024.04 correctly boot.

    Thank you for your support. You can close this topic.

Jeet14's avatar
Jeet14
Icon for Frequent Contributor rankFrequent Contributor
1 year ago

Hi,


Let me know if you have any further query on this?


Regards

Tiwari


ChristianMS's avatar
ChristianMS
Icon for New Contributor rankNew Contributor
1 year ago

Hi,

Thank you for your help. We have re-read the links you gave us (AN759), and mostly the chapter dedicated to secure boot.

We've try to follow the AN759 instructions to recompile u-boot in version 2020.10, and also in version 2021.07 and 2024.04, without secureboot process.

Unfortunately, the application note AN759 only explain how to embed the signature of SPL, so that BootROM can authenticate the SPL binary blob.

It does not contain any information about :

- how to embed public key in the SPL

- how to embed signature into u-boot

so that SPL can authenticate the u-boot second stage (legacy or FIT image).

Neither it contains any information about :

- how to embed public key in the u-boot secondary stage

- how to embed signature into Linux kernel FIT image

so that u-boot secondary stage can authenticate the Linux kernel and its flat devicetree (legacy or FIT image).

The problems started when we activate secureboot in u-boot configuration file, by using FIT_SPL_SIGNATURE and CONFIG_FIT_SIGNATURE options, as explain in our first message.

We are still searching for a solution for a full secure-boot process, not only SPL authentication by BootROM as described in AN759, but also U-Boot and kernel authentication.

Regards

Christian & Baptiste