抽空分析了一下IROM booting的细节。用注释的形式加在源代码里面了,大家将就着看。S3C6410的IROM支持从SD/MMC, NAND, OneNAND多种设备启动。同时支持secure boot模式。用来为设备提供更好的安全性。
几个心得:
1. how the efuse genrate random key
when the irom verify BL1, it will read the random key from address 0x7e00d000.
I guess the random key is genrated by A/D on XEFFVDD pin.
2. how to enable/disable secure booting.
secure booting mode base on the random key on address 0x7e00d000.
Ground XEFFVDD will disable the random key genrator. the data read from 0x7e00d000 is zero.
Keep the XEFFVD open, or give XEFFVDD a random votage will enable the secure booting mode.
3. sd boot
the irom will copy 8K+512Bytes from sd card to 0x0c000000-0x0c002200.
the extra 512bytes data contain the signature for secure booting. there are two keys in the signatur.
key1 at 0x0c002104,
key2 at 0x0c002188,
the matching algorithm in irom is:
key = foo(key1);
if( key == key2)
{
jump_to_BL1;
}
Suggestion:
1. Be careful to use secure booting mode, because Samsung didn't open the detials.
源代码在这里: <转载请注明出处>
//
// s3c6410 IROM source code.
// dumping from s3c6410.
// disassemble and comment by: Yujiang Zheng <yujiangzheng@gmail.com>
//
本文详细分析了S3C6410处理器IROM启动过程,包括安全启动机制和SD卡启动流程。重点介绍了随机密钥生成方式及安全启动模式的启用与禁用方法,并探讨了SD卡中签名验证的具体实现。
7208

被折叠的 条评论
为什么被折叠?



