AM2432: SYSFW keyring support

Hi Hong,

Hong Zhang said:

Is there a guide that we can refer to to use the debug keyring from latest SYSFW release? 

The already shared resources like the FAQ and the TISCI documentation aren't helpful?

Hong Zhang said:

Do we need to generate new keywriter certificate or the change is limited on the signing for the sbl?  

The keyring neither affects the keywriter not the SBL signing. The keyring concept is supported by SYSFW so it comes into the picture after the SBL boot.

The use cases supported by keyring are described here:

https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/keyring.html#background-on-use-cases

Regards,

Prashant

Hello Prashant, 

I am still not very clear about the process. 

In our current FW, sbl_ospi has JTAG disabled. To enable this debug key ring support, what do we need to do in our sbl_ospi bootloader?   I think the SBL is a combined build with the SYSFW, what do you mean by it comes after the SBL boots?

Thanks, 
Hong 

Hello,

Hong Zhang said:

To enable this debug key ring support, what do we need to do in our sbl_ospi bootloader?

The flow is desribed here:

https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/keyring.html#user-flow

For debug certificate, the last two steps would involve signing the debug certificate with one of the keys in the keyring and passing it to the SYSFW with TISCI_MSG_OPEN_DEBUG_FWLS.

Regards,

Prashant

Hello Prashant, 

What is the exact step to boot a FW that is signed with debug certificate? 

When AM243 is in HS-SE mode, and it has images in its bootable device like SPI. What is the step to switch to a debug FW signed with debug certificate? 

Thanks, 
Hong 

Hong Zhang said:

What is the exact step to boot a FW that is signed with debug certificate?

I am not sure how are you relating the debug certificate with a FW.

The debug certificate is a standalone certificate passed to SYSFW using TISCI_MSG_OPEN_DEBUG_FWLS for unlocking the JTAG:

software-dl.ti.com/.../secure_debug.html

What is the procedure to revoke a key in keyring?

Hi, I don't think keys once imported can be revoked in a keyring. However, I will once check with the team & get back to you.

Prashant Shivhare said:

However, I will once check with the team & get back to you.

I have checked with the team and indeed there is no support for revoking keys in the keyring once imported.