Boot Mode 2 (User Secure Boot)

[utku1998]

Hello,

I am currently working with the "PolarFire SoC FPGA Icicle Kit". I have configured the device with the newest "Reference Design".

I want to implement the full boot flow of the "Boot Mode = 2 (User Secure Boot)". According to the documentation here, in this boot mode we flash our own code to the "sNVM". In the run time, the system controller authenticates the content of the "sNVM", copies it to "On-chip RAM" and executes from there.

In the documentation, it is also specified that after running the code in "sNVM", which typically authenticates the content of the "eNVM" before executing it.

So, I have 2 questions:

1. How can I program the "sNVM" and "eNVM" seperately? For instance, we can seperately program the "eNVM" with the option "Boot Mode = 1" and the "sNVM" with the option "Boot Mode = 2 (User Secure Boot)" using "PolarFire SoC/Libero." But each of them sets the boot mode to either 1 or 2. However, what I want to do is program both of them (eNVM and sNVM) using the Boot Mode = 2 (User Secure Boot).

2. Which configurations should I make that after the device executes the code in "sNVM", it moves on with the "eNVM"?

Best regards!

[TommyMurphyTM1234]

You should be able to create two programs - one for eNVM and one for sNVM. The former is the "main" program that you want to run. The latter is the boot mode 2 user secure bootloader that runs from startup after the normal boot mode 2 secure checks, does whatever init it needs to do, then transfers control to the "main" program in eNVM. When using SoftConsole you should be able to use the boot mode 1 support to get the "main" program into eNVM. (It will also configure the target for boot mode 1, but this is just temporary and will be overridden in the next step). Once that is done and the "main" program stored in eNVM, you can use the boot mode 2 support to get the bootloader into sNVM and the target configured for boot mode 2.

If using Libero/FlashPro etc. you configure the boot mode (2) there and the sNVM and eNVM program payloads in the relevant project and program them from there (most likely along with the hardware design - MSS configuration, FPGA bitfile etc.).

My recollection is also that the HSS (https://github.com/polarfire-soc/hart-software-services) may have its own way of booting from sNVM in user secure boot mode 2 and then transferring control to code stored in eNVM. So it may be worth having a look at the HSS in case its approach is more appropriate for your needs.

[TommyMurphyTM1234]

Yeah, this is really interesting. And as I said, I can not do it with the "SoftConsole IDE" (since it is buggy for the Boot Mode = 2, although the Boot Mode = 0/1 works!).

I didn't think that it's a SoftConsole bug. I linked to the relevant SoftConsole documentation in your other thread. The issue is almost certainly that the SMK (sNVM Master Key) needs to be (re)initialised via Libero before boot mode 2 programming from SoftConsole can succeed.

Do you mean directly changing the "PC" (Program Counter) to the memory address of the eNVM using "inline assembly" etc. (or to whereever the code starts executing in "eNVM"). I have searched for this "jump/call" instruction in the "HSS" (which may be helpful for my case to jump from the "sNVM" to "eNVM"), but unfortunately I could not find that "jump/call" instruction in the HSS. I would be happy to hear, if you have an idea for where it could be or how can I jump from the "sNVM" to "eNVM" in my case? :)

Sort of - I mean something like a jump to the relevant eNVM address. Jump is a RISC-V (pseudo) instruction.

https://web.eecs.utk.edu/~smarz1/courses/ece356/notes/assembly/

In my previous post (which you have also answered), I have explained detailed the error that I got, while I am trying the "Boot Mode = 2". And the engineers from the Microchip tried also the option "Boot Mode = 2" with "SoftConsole IDE" and they got the same problem. Then, they told me that there is a bug with the "SoftConsole IDE", which they will try to fix internally for the next release of the "SoftConsole IDE".

See above and in the other thread. I don't think it's a bug but rather that the SMK simply hasn't been initialised.

[utku1998]

I didn't think that it's a SoftConsole bug. I linked to the relevant SoftConsole documentation in your other thread. The issue is almost certainly that the SMK (sNVM Master Key) needs to be (re)initialised via Libero before boot mode 2 programming from SoftConsole can succeed.

I do not know. But a Microchip engineer and his collegue have checked this "Boot Mode = 2" option for me in the "SoftConsole IDE". And they have told me that it does not work on them either and they get the same error. But for your solution, do you know how to (re)initiliaze the "SMK" key to "PolarFire SoC"? I do not see any option for that in "Libero" in the "sNVM" section (see below!).

Sort of - I mean something like a jump to the relevant eNVM address. Jump is a RISC-V (pseudo) instruction.

If it is the way to jump from one memory element to another (e.g. from "eNVM" to "sNVM" in my case, and from "eNVM" to "SD Card" for the case of "HSS"), where has this "jump/call" done in "HSS". I could not figure it out in the source code of the "HSS". Can you guide me, if you could see that place in the source code (https://github.com/polarfire-soc/hart-software-services). If I can find it, I can simply use the same code/instruction for my case.

[TommyMurphyTM1234]

I do not know. But a Microchip engineer and his collegue have checked this "Boot Mode = 2" option for me in the "SoftConsole IDE". And they have told me that it does not work on them either and they get the same error. But for your solution, do you know how to (re)initiliaze the "SMK" key to "PolarFire SoC"? I do not see any option for that in "Libero" in the "sNVM" section (see below!).

You need to create a simple design in Libero with security enabled and when that's programmed it will (re)initialise the SMK. You'll then need to reprogram it with the security options disabled unless you're actively using them. This will leave the SMK as it was and boot mode 2 programming from SoftConsole should then work. I presume that the security options and SMK initialisation process are covered in the Libero documentation.

If it is the way to jump from one memory element to another (e.g. from "eNVM" to "sNVM" in my case, and from "eNVM" to "SD Card" for the case of "HSS"), where has this "jump/call" done in "HSS". I could not figure it out in the source code of the "HSS". Can you guide me, if you could see that place in the source code (https://github.com/polarfire-soc/hart-software-services). If I can find it, I can simply use the same code/instruction for my case.

I'm not really sure where the confusion arises. It's simply a jump to the relevant address.

[utku1998]

You need to create a simple design in Libero with security enabled and when that's programmed it will (re)initialise the SMK. You'll then need to reprogram it with the security options disabled unless you're actively using them. This will leave the SMK as it was and boot mode 2 programming from SoftConsole should then work. I presume that the security options and SMK initialisation process are covered in the Libero documentation.

You mean firsty, choosing the option "custom security options" (see picture below). This will automatically initiliaze the "SMK"? And then what you mean with disabling is: creating a new design and configuring the bord with the opton "Bitstream Encryption with the Defaul Key" right? Otherwise, we can not reprogram the device using "SoftConsole IDE", since it has not the keys that we have initialized, while choosing the option "custom security options". So, we need to disable it first.

I'm not really sure where the confusion arises. It's simply a jump to the relevant address.

I have understood the idea of "jump" from the "sNVM" to "eNVM". But I could not find that "jump" instruction/C-code in the source of the HSS (https://github.com/polarfire-soc/hart-software-services). So, in the case of HSS, there should be also a "jump" from the "eNVM" to "SD Card" or "eMMC". But, the question is: where is it?

[TommyMurphyTM1234]

You mean firsty, choosing the option "custom security options" (see picture below). This will automatically initiliaze the "SMK"? And then what you mean with disabling is: creating a new design and configuring the bord with the opton "Bitstream Encryption with the Defaul Key" right? Otherwise, we can not reprogram the device using "SoftConsole IDE", since it has not the keys that we have initialized, while choosing the option "custom security options". So, we need to disable it first.

Something like that, but you'll need to consult the Libero documentation for the exact details of how to enable security (so that the SMK gets (re)initialised) and how to then disable security leaving the SMK set and the target accessible from SoftConsole for boot mode 2 programming. You are correct that if security is left enabled then SoftConsole debugging/boot mode programming will be locked out.

I have understood the idea of "jump" from the "sNVM" to "eNVM". But I could not find that "jump" instruction/C-code in the source of the HSS (https://github.com/polarfire-soc/hart-software-services). So, in the case of HSS, there should be also a "jump" from the "eNVM" to "SD Card" or "eMMC". But, the question is: where is it?

Sorry, I don't know about the HSS hand-off to non-bootloader code, but the fact remains that if you want to start executing code in eNVM you should be able to just jump to it or use a predefined symbol with the correct address to call into it.