Changes between Version 6 and Version 7 of newport/secure_boot

Timestamp:

08/27/2026 08:40:49 PM (25 hours ago)

Author:

Tim Harvey

Comment:

added troubleshooting section showing result of flashing a secured board

newport/secure_boot

@@ -70 +70 @@
 == Blowing Fuses to lock a device to use trusted boot
 
-**Important Note: Once boards have been configured for trusted-mode boot by hard blowing fuses the JTAG chain is disabled and boards can not be re-tested by Gateworks and as a result returns (RMA) will not be accepted. It is recommended that OEM's test board functionality before permanently setting trusted-mode boot fuses.**
+**Important Note: Once boards have been configured for trusted-mode boot by hard blowing fuses JTAG is disabled and boards can not be re-tested by Gateworks and as a result returns (RMA) will not be accepted. It is recommended that OEM's test board functionality before permanently setting trusted-mode boot fuses.**
 
 In order to enable trusted boot you must:
@@ -311 +311 @@
 
 You can continue the process of securing your firmware image by locking down U-Boot's environment and using a ramdisk to mount an encrypted filesystem. For detailed examples of that see [wiki:/venice/secure_boot venice/secure_boot]
+
+
+== Troubleshooting
+If you have blown fuses to enable secure boot, while the JTAG chain still functions and allows programming of the GSC firmware and identification of the GSC and CN80xx, JTAG access to the CN80xx registers is disabled and you will not be able to program the eMMC flash:
+
+Here is an example of failing to program eMMC flash:
+{{{#!bash
+$ jtag_usbv4 -p firmware-newport.bin
+
+Channel #      S01                                            
+--------------------------------------------------------------------------------
+USB Open Rev    r0                                            
+JTAG_ID #00    CN8                                            
+JTAG_ID #01    MSP                                            
+Load Debugger  fS1 
+}}}
+ * Note the JTAG chain scans (and does allow programming of the GSC) but CN80xx registers are not available which is why Load Debugger fails.
+
+Programming the GSC however does work with a locked board:
+{{{#!bash
+$ jtag_usbv4 -m gw6400.txt
+
+
+Channel #      S01                                                            
+
+-----------------------------------------------------------------------------
+USB Open Rev    r0                                                            
+JTAG_ID #00    CN8                                                            
+JTAG_ID #01    MSP                                                            
+MSP PROG        OK                                                            
+MSP VERIFY      OK                                                            
+Load Debugger  fS1 
+}}}
+ * Note that 'MSP PROG' is 'OK' indicating the GSC was programmed. The Load Debugger failure does not matter when programming the GSC