AM6442: Combined Keyring (Signed and Encrypted) Import Failure

ZHEN BEI SIN

Prodigy 20 points

Part Number: AM6442

Issue : Combined Keyring (Signed and Encrypted) Import Failure

A combined keyring (asymmetric key + symmetric key) was generated and packaged as a signed-and-encrypted image. (keyring.bin)
The KEYRING import operation fails with return code -19.

Reference:

KEYRING Documentation: https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/keyring.html

TI E2E FAQ: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1484330/faq-sysfw-keyring-importing-support-on-am62x

Patch: 0001-calling-sysfw-keyring-import-API-in-r5-spl.patch: calling sysfw keyring import API in r5-spl

The example provided in keyring_init.h appears to cover only:

Single keyring images (Signed-only)

Question

Can TI provide a valid combined keyring (asymmetric key + symmetric key) signed by SMPK and encrypted by SMEK sample image for reference?
Is importing a combined keyring in signed-and-encrypted format supported on AM64x HS-SE devices?
Is there any known limitation or additional requirement when importing a signed-and-encrypted combined keyring on AM64x HS-SE devices?

16 days ago

0 Meet Thakar 15 days ago

TI__Mastermind 22625 points

Hi,

I am assigning this thread to the concerned expert, please wait for their response.

Best Regards,
Meet.

0 Hong Guan64 14 days ago in reply to Meet Thakar

TI__Guru* 77970 points

The symmetric keyring support was recently added in TIFS 12.0.2 (Linux SDK 12.0.0.7.4).
Which Linux SDK version was used in your testing?
Best,
-Hong

0 ZHEN BEI SIN 14 days ago in reply to Hong Guan64

Prodigy 20 points

We are using

U-Boot 2026.01
ATF 2.14+
OPTEE 4.9.0+
TIFS Firmware v12.00.02

Component	Branch Info	Tag Info	Config Info
U-Boot	ti-u-boot-2026.01	12.00.00.07	Build Config
TF-A	master	v2.14+
OPTEE	master	4.9.0+	k3-am64x

From the boot log:
U-Boot SPL 2026.01 (Jul 08 2026 - 18:18:36 +0800)
SYSFW ABI: 4.0 (firmware rev 0x000c '12.0.2--v12.00.02 (Clever Cat)')

0 ZHEN BEI SIN 14 days ago in reply to Hong Guan64

Prodigy 20 points

As referenced in the TI Keyring documentation:
software-dl.ti.com/.../keyring.html

We have tested the following keyring import scenarios:
- Case 1: Combined Asymm + Symm → Not working
- Case 5: Independent Asymm + Independent Symm → Working

Based on the successful Case 5 test, we believe our TIFS version does support both asymmetric and symmetric keyring import.

The main issue appears to be that the keyring_gen_sign patch provided only generates keyrings containing the asymmetric key.
We do not currently have a method to generate a Combined Asymm + Symm keyring for Case 1 testing.

Could you please provide:
- A script/tool that can generate a valid Combined Asymm + Symm keyring (Case 1), or
- A sample valid Combined Asymm + Symm keyring blob that can be passed to TISCI_MSG_KEYRING_IMPORT for validation/testing?

This would help us determine whether the issue is related to the keyring generation process or the keyring import handling.

0 Hong Guan64 13 days ago in reply to ZHEN BEI SIN

TI__Guru* 77970 points

Hi Zhen,
Let me run some testing on my side, and get back to you.
Best,
-Hong

**Attention** This is a public forum

API solutions

API solutions Forum

AM6442: Combined Keyring (Signed and Encrypted) Import Failure