• State TI Thinks Resolved
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 31 subscribers
  • Views 342 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM2634: HS-FS SBL Verification Clarification

Kier
Mastermind 9470 points
Part Number: AM2634


Hello,

With reference to this document: AM263x MCU+ SDK: Understanding the bootflow and bootloaders (ti.com)

There is this excerpt:

This .bin file is then signed using the Signing Scripts to create the final .tiimage bootable image.

  • The .tiimage file extension is kept to separate the SBL boot image from a normal application image
  • The rom_degenerateKey.pem is used for this.
  • This is a ROM bootloader requirement and is needed even on a non-secure device.

But then there is this table:

If the text says that the SBL shall always be signed regardless of device type, what is meant by Certificate Verification "Not Performed" for HS-FS in the above table?

In other words, if verification is not performed by HS-FS RBL why is it necessary to sign the SBL in this case please?

Thank you.

  • 0
    TI__Expert 8165 points

    Hi,

    The ROM doesn't expect the SBL image to be in any particular format, it is just plain binary. So the x509 certificate which is produced after the signing is also used for metadata on the SBL image like the size of the image etc. Verification not performed just means that you don't need to sign the image with a dedicated key, and RSA degenerate key will work. There is also the optional image integrity check which computes the SHA of the image and compares it with the value in the certificate. Hope that answered your question.

    Regards,
    Anand Mahadevan SS