Quectel LTE Module Series Bedienungsanleitung

SC20 Secure Boot

User Guide

LTE Module Series

Rev. SC20_Secure_Boot_User_Guide_V1.0

Date: 2016-09-26

www.quectel.com

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 1 / 15

Our aim is to provide customers with timely and comprehensive service. For any

assistance, please contact our company headquarters:

Quectel Wireless Solutions Co., Ltd.

Office 501, Building 13, No.99, Tianzhou Road, Shanghai, China, 200233

Tel: +86 21 5108 6236

Email: [email protected]

Or our local office. For more information, please visit:

http://www.quectel.com/support/salesupport.aspx

For technical support, or to report documentation errors, please visit:

http://www.quectel.com/support/techsupport.aspx

Or email to: [email protected]

GENERAL NOTES

QUECTEL OFFERS THE INFORMATION AS A SERVICE TO ITS CUSTOMERS. THE INFORMATION

PROVIDED IS BASED UPON CUSTOMERS’ REQUIREMENTS. QUECTEL MAKES EVERY EFFORT

TO ENSURE THE QUALITY OF THE INFORMATION IT MAKES AVAILABLE. QUECTEL DOES NOT

MAKE ANY WARRANTY AS TO THE INFORMATION CONTAINED HEREIN, AND DOES NOT ACCEPT

ANY LIABILITY FOR ANY INJURY, LOSS OR DAMAGE OF ANY KIND INCURRED BY USE OF OR

RELIANCE UPON THE INFORMATION. ALL INFORMATION SUPPLIED HEREIN IS SUBJECT TO

CHANGE WITHOUT PRIOR NOTICE.

THE INFORMATION CONTAINED HERE IS PROPRIETARY TECHNICAL INFORMATION OF

QUECTEL CO., LTD. TRANSMITTING, REPRODUCTION, DISSEMINATION AND EDITING OF THIS

DOCUMENT AS WELL AS UTILIZATION OF THE CONTENT ARE FORBIDDEN WITHOUT

PERMISSION. OFFENDERS WILL BE HELD LIABLE FOR PAYMENT OF DAMAGES. ALL RIGHTS

ARE RESERVED IN THE EVENT OF A PATENT GRANT OR REGISTRATION OF A UTILITY MODEL

OR DESIGN.

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 2 / 15

About the Document

History

Revision

Date

Author

Description

1.0

2016-09-26

Barret YUAN

Initial

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 3 / 15

Contents

About the Document................................................................................................................................ 2

Contents.................................................................................................................................................... 3

Table Index ............................................................................................................................................... 4

Figure Index.............................................................................................................................................. 5

1Introduction....................................................................................................................................... 6

2MSM8909 Secure Boot Flowchart.................................................................................................... 7

3Configure OEM Key .......................................................................................................................... 9

4Generate Secure Images ................................................................................................................ 10

5Generate sec.dat ............................................................................................................................. 13

6Download Image via QFIL............................................................................................................... 14

7Appendix A Reference.................................................................................................................... 15

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 4 / 15

Table Index

TABLE 1: OEM KEY LIST.................................................................................................................................... 9

TABLE 2: DIRECTORY LIST OF SIGNED IMAGE AND SOURCE IMAGE.......................................................11

TABLE 3: TERMS AND ABBREVIATIONS........................................................................................................ 15

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 5 / 15

Figure Index

FIGURE 1: MSM8909 SECURE BOOT FLOWCHART ...................................................................................... 7

FIGURE 2: SIGNED IMAGE STORAGE DIRECTORY..................................................................................... 10

FIGURE 3: SEC.DAT CONSTRUCTION........................................................................................................... 13

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 6 / 15

1Introduction

This document mainly introduces how to use the secure boot function of Quectel SC20 module.

Secure boot refers to the boot up sequence that establishes a trusted platform for secure applications. It

starts as an immutable sequence that validates the origin of the code using cryptographic authentication

so only authorized software can be executed. The boot up sequence places SC20 in a known security

state and protects it against binary manipulation of software and reflashing attacks.

A secure boot system adds cryptographic checks to each stage of the boot up process. This process

asserts the authenticity of all secure software images that are executed by SC20. The additional check

prevents any unauthorized or maliciously modified software from running on SC20. Secure boot is

enabled through a set of hardware fuses. For the code to be executed, it must be signed by the trusted

entity identified in the hardware fuses.

The flow to enable secure boot:

1. Configure OEM Key. The new keys can be used to sign images and generate sec.dat

2. Generate secure images, download signed images (use fastboot or QFIL tool)

3. Generate sec.dat and download it to SC20. Once secure boot fuses are blown, the device cannot

use other keys.

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 7 / 15

2MSM8909 Secure Boot Flowchart

Figure 1: MSM8909 Secure Boot Flowchart

1. Power on the system and take MSM8909AP CPU out from RESET.

2. Cortex-A7 APPS PBL:

a. Loads, executes, and authenticates the SBL1 segment #1 from SC20 to L2 (as TCM).

b. Loads, executes, and authenticates SBL1 segment #2* (DDR/SDI equivalent) to RPM code RAM,

then jumps to SBL1.

3. SBL1#1

a. Loads and authenticates the QSEE/TZ image from the boot device to DDR.

b. Loads and authenticates the RPM firmware image from the boot device to RPM code RAM.

c. Loads and authenticates the HLOS APPSBL image from the boot device to DDR.

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 8 / 15

4. SBL1 #1 transfers execution to QSEE/TZ.

5. QSEE/TZ sets up secure environment and brings RPM out of RESET to start execution of RPM

firmware.

6. QSEE/TZ jumps to HLOSAPPSBL to start execution.

SBL1 segment#2 is equal to DDR driver + SDI equivalent copied to RPM code RAM.

DDR is initialized by SBL1 segment#2 and part of the SDI functionality included in SBL1 segment#2.

7. HLOS APPSBL loads and authenticates the HLOS kernel.

8. HLOS kernel:

a. Loads the Modem Boot Authenticator (MBA) to DDR via PIL.

b. Brings modem DSP Q6 out of RESET.

c. Loads the AMSS modem image to DDR via PIL.

c’. Modem PBL copies the MBA from DDR to modem TCM, authenticates MBA and finally jumps to

MBA image.

c”. MBA authenticates modem image and then jumps to modem.

d. HLOS loads the Pronto image to DDR via PIL.

d’. HLOS brings Pronto out of RESET and Pronto image starts execution.

Quectel

Confidential

LTE Module Series

SC20 Secure Boot User Guide

SC20_Secure_Boot_User_Guide Confidential / Released 9 / 15

3Configure OEM Key

The flow to configure OEM key is illustrated below:

1. Extract sectool.tar, and then overwrite the directory “common/tools/sectools”.

2. Extract makeCrt.tar, run makecrt.dat, and then copy new keys to

“common/tools/sectools/resources/data_prov_assets/Signing/Local/oem_certs”

sectool.tar and makeCrt.tar are available in the “Tools”directory.

Table 1: OEM Key List

Keys

Path

Description

qpsa_rootca.key

common\tools\sectools\resources\data_prov_assets\

Signing\Local\oem_certs

Root CA private key

qpsa_rootca.cer

common\tools\sectools\resources\data_prov_assets\

Signing\Local\oem_certs

Root certificate

qpsa_attestca.key

common\tools\sectools\resources\data_prov_assets\

Signing\Local\oem_certs

Attestation CAprivate key

qpsa_attestca.cer

common\tools\sectools\resources\data_prov_assets\

Signing\Local\oem_certs

Attestation CA certificate

NOTE

Quectel

Confidential

Andere Handbücher für LTE Module Series

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Quectel Steuereinheit Handbücher

Quectel

Quectel EC25-AUX Beilage

Quectel

Quectel L76 Leitfaden

Quectel

Quectel EG91 Series Beilage

Quectel

Quectel EC25 series Leitfaden

Quectel

Quectel Smart EVB Bedienungsanleitung

Quectel

Quectel M.2 EVB Bedienungsanleitung

Quectel

Quectel SC20-A Bedienungsanleitung

Quectel

Quectel LTE Module Series Bedienungsanleitung

Quectel

Quectel EC25 Mini PCIe Beilage

Quectel

Quectel M85 Bedienungsanleitung

Quectel

Quectel EG915U-EU Bedienungsanleitung

Quectel

Quectel MC60-TE-A Bedienungsanleitung

Quectel

Quectel EM05 Beilage

Quectel

Quectel BG96-NA Beilage

Quectel

Quectel EM12-G Beilage

Quectel

Quectel BG96 Bedienungsanleitung

Quectel

Quectel Smart Wi-Fi Module Series Bedienungsanleitung

Quectel

Quectel LTE-A Series Beilage

Quectel

Quectel SC206E Series Beilage

Quectel

Quectel SG560D Series Beilage

Quectel

Quectel RM502Q-GL Beilage

Quectel

Quectel LC79D Beilage

Quectel

Quectel M66 Beilage

Quectel

Quectel EG915U Series Beilage

Beliebte Steuereinheit Handbücher anderer Marken

Festo

Festo Compact Performance CP-FB6-E Stücklistenhandbuch

Elo TouchSystems

Elo TouchSystems DMS-SA19P-EXTME Bedienungsanleitung

JS Automation

JS Automation MPC3034A Bedienungsanleitung

JAUDT

JAUDT SW GII 6406 Series Kurzanleitung

Spektrum

Spektrum Air Module System Bedienungsanleitung

BOC Edwards

BOC Edwards Q Series Bedienungsanleitung

KHADAS

KHADAS BT Magic Bedienungsanleitung

Etherma

Etherma eNEXHO-IL Bedienungsanleitung

PMFoundations

PMFoundations Attenuverter Bedienungsanleitung

GEA

GEA VARIVENT Bedienungsanleitung

Walther Systemtechnik

Walther Systemtechnik VMS-05 Bedienungsanleitung

Altronix

Altronix LINQ8PD Montageanleitung

Eaton

Eaton Powerware Series Bedienungsanleitung

WAGO

WAGO 750-407/040-000 Bedienungsanleitung

Sony

Sony CCU-590 Bedienungsanleitung

Graco

Graco 25D614 Bedienungsanleitung

Task Force Tips

Task Force Tips YE-RF-900 Programmierhandbuch

Shini

Shini SPV-U Series Bedienungsanleitung