Secure Boot Management

# LAN96xx Secure boot management

### Warning!

You seem not to be using a supported browser. Please use only Google 'Chrome' or Microsoft 'Edge' browsers, and if so - a current version. This tool will not work otherwise.

## Select communication port

First you need to connect your device to your computer, using an USB or RS-232 port as defined by your PC and the device you want to manage.

The device you have connected should be strapped for using "Bootstrap Mode" using board DIP switches. Refer to hardware documentation for details.

- LAN966X: '1000'b or '0111'b
- LAN969X: '1010'b.

You should also make sure your browser support HTML5 and has JavaScript enabled. Chrome or MS Edge is recommended.

You may also wish to enable the JavaScript console for detailed insight into device interaction. For 'Chrome' this is key `Ctrl-Shift-I`.

## BL1 bootstrap

You are now in the built-in BL1 context, and you may select the functions supported here. You will most likely want to change to the BL2U context.

BL2U

To perform firmware upgrade, and other functions such as device firmware encryption you should change to the BL2U context. This implies uploading the associated BL2U `fwu_fip` which will then be replacing BL1 temporarily.

SJTAG

Secure JTAG (SJTAG) is a feature that allow you to unlock a secured JTAG port, providing the SJTAG key for this particular device. The JTAG port can be locked by writing certain fields in the OTP.
In order to unlock, first obtain the challenge from the device. If SJTAG is enabled, you can then provide the key (copy/paste), and then unlock.

Key |

OTP

Note that all OTP Program Random/Set operations cannot be undone, and may render your device inoperable. Use with caution!
Note: You may also use BL2U to program OTP, this context also allow you to read back OTP data for verification.

to |
to Data |

Settings

These settings are mostly usable for advanced users. Use at own risk.

Enable trace | Enabling this will add detailed trace output of all messages between the managed device in the JavaScript console of your browser. This is typically found in `Settings|Developer Tools` (or F-12 on MS Edge).

## BL2U bootstrap

You are in the downloaded BL2U context, which enables firmware associated functions and OTP read/write/randomize capabilities. You can also enter DDR configuration or
mode if desired.

Image types

For firmware update you should start by uploading either the `FIP` with a firmware upgrade, or a full Flash image.

- Updating NOR flash differ per platform, depending if GPT is used on the NOR device:
  - LAN966X: No GPT. The FIP is the Flash image. Image is called `x.fip` or `x.fip.gz`.
  - LAN969X: GPT is used. The NOR flash image is called `nor.gpt` or `nor.gpt.gz`.
- For eMMC the Flash image is a GPT image called `mmc.gpt` or `mmc.gpt.gz`.

Upload

Note: You may upload `GZIP`'ed files, and they will automatically be unzipped when received.

First choose the appropriate file for the operation you wish to perform, the hit `Upload file`.

Use binary upload

Write

The binding operation re-encrypts a FIP image with the BSSK key. The uploaded FIP must be encrypted with the SSK. This will ensure firmware cannot be copied from the device. Binding is optional, and can only be used on FIP images.

to Verify: |
to Verify: |

Incremental

This operation provides a combined upload and write where the SRAM of the device is used for intermediate storage. The image file is incrementally uploaded in chunks according to the SRAM capacity. Chunks are compressed, de-compressed, written and verified sequentially.

The Bind function operates directly on the flash device selected. The fimware in the flash need to be SSK encrypted. It will re-encrypted using the device BSSK key.
Verify: |

Notice: SRAM may be limited or not available on a given platform. (Pre-) Compressed files are not supported.

OTP

Note that all OTP Program Random/Set operations cannot be undone, and may render your device inoperable. Use with caution!

from |
to |
to Data |

DDR

DDR configuration mode allow you to tweak the existing DDR configuration parameters, upload and save DDR configurations to `YAML` format.

## DDR configuration mode

You are now in the DDR configuration mode, which allows you to load alternate DDR configurations and test out the behaviour. You can
to the normal BL2U mode if desired.

Configuration I/O
Load
Load
Load
Save
Deployment
Cache:
Diagnostics

## Booting

The device is now booting. Remember to reset device strappings for automatic boot at next reset if so desired.

|  | ## Status: Disconnected

### Transaction Log