Hi Xeniter, Replying on behalf of Pratik. Thank you for quick reply.
We followed below steps. We also took care of addressing for H6 SoC.
1. We used the private key of @spitfire and generate public key from that. Private key can be found here.
$ openssl rsa -in privkey.pem -pubout -out pubkey.pem // Public key
2. Took jemk script from https://gist.github.com/jemk/8e1006a44c7a2c796fc3fc2f74f7c6c3/revisions
Using mkrotpk.rb script, computed SHA256 of public key. We can also use your described method to generate ROTPK. Both generate the same output.
$ ruby mkrotpk.rb pubkey.pem rotpk.bin
We got ROTPK in hex format as:
1A18E6E98F9AB15F626E1DF9D89F2B659EE87335213D9C6F4729F9A8C56A32F5
3. Now, We used fel_write_key.sh script to write rotpk hash (in little endian format) and secure bit into eFuse with help of "sunxi-fel" using fel_write_key.sh script.
(Note: At first we wrote 0x8000 by mistake in LCJS field and then we modified script to make it to 0x800. So after reading, we are getting 0x8800. This shouldn't be a problem as per LCJS format, I guess).
$ ./fel_write_key.sh
4. We read back all values to confirm whether they are written perfectly or not. We used eFuseReaderr.c to read eFuse values. We got following output. Output looks OK.
Hello from Allwinner H6!
chip_id: 82c00007:3c004708:140dd58:8761f91:
rotpk_hash: e9e6181a:5fb19a8f:f91d6e62:652b9fd8:3573e89e:6f9c3d21:a8f92947:f5326ac5:
LCJS: 00008800:
try read sram A2:0x40004!=0 secure
Returning back to FEL.
5. Then we used mktoc0.rb jemk script from https://gist.github.com/jemk/2abcab1359c4bce793679c5854062331.
NOTE: Before executing a script, following changes are required in mktoc0.rb.
1. Replace the ".sum" method with ".reduce(:+)" at line number 139
2. Change entry address of H6 from 0x0 to 0x20000 at line number 167, because entry address of H6 is 0x20000.
You can find updated mktoc0.rb here.
- Using that mktoc0.rb script, converted spl image from bin format to TOC0 format.
$ ruby mktoc0.rb privkey.pem sunxi-spl.bin sunxi-spl.toc0
6. Flash sunxi-spl.toc0 file into sdcard:
$ sudo dd if=/dev/zero of=/dev/sdX bs=1k count=1023 seek=1
$ sudo dd if=sunxi-spl.toc0 of=/dev/sdX bs=1024 seek=8
Output: After writing TOC0 image into sdcard, insert the sdcard with board. Board is stucked on booting of SPL image. There are no prints in serial console.
Regards,
Nilesh Vora
