AM2432: Does RBL checks SBL image CRC or signature before booting in HS-FS mode

Aravind kumar

Part Number: AM2432

Tool/software:

As I know, AM243x has two bootup location. One is primary SBL 0x0 and another if backup SBL 0x400000.

In case SBL image at primary SBL got corrupted like some addresses in the middle of the booflash image, does AM243x RBL has a mechanism to check primary image integrity using CRC or other ways? And, fallback to backup SBL location and bootup it?

I mean, is there any fully image CRC check or some other type of check in HS-FS mode, before booting SBL image from primary SBL location?

3 months ago

0 Meet Thakar 3 months ago

TI__Genius 10675 points

Hi Aravind,

Yes, the ROM Code does perform a image integrity check before loading the image to the on-chip RAM. Please refer to section 4.2.3 Boot Process Flow of TRM where this is mentioned.

Best Regards,
Meet.

0 Aravind kumar 3 months ago in reply to Meet Thakar

Prodigy 30 points

It appears that the AM243x does not verify the integrity of the image in HS-FS mode using CRC or other validation methods; it only checks the image header.
I performed an experiment by deleting a 64KB sector in the boot flash (primary SBL) at address 0x20000 and then triggered a reboot. Following this, the AM243x did not fall back to the backup SBL. AM243x in hung state.

are you talking about below bootflow

https://software-dl.ti.com/mcu-plus-sdk/esd/AM243X/latest/exports/docs/api_guide_am243x/BOOTFLOW_GUIDE.html

0 Meet Thakar 3 months ago in reply to Aravind kumar

TI__Genius 10675 points

Aravind kumar said:
are you talking about below bootflow

https://software-dl.ti.com/mcu-plus-sdk/esd/AM243X/latest/exports/docs/api_guide_am243x/BOOTFLOW_GUIDE.html

No I am referring to ection 4.2.3 of TRM: https://www.ti.com/lit/ug/spruim2h/spruim2h.pdf?ts=1748423994825&ref_url=https%253A%252F%252Fwww.ti.com%252Fproduct%252FAM2434

Aravind kumar said:
I performed an experiment by deleting a 64KB sector in the boot flash (primary SBL) at address 0x20000 and then triggered a reboot. Following this, the AM243x did not fall back to the backup SBL. AM243x in hung state.

Could you let me know which MCU+SDK version you are testing this on?

Best regards,

Meet.

0 Aravind kumar 3 months ago in reply to Meet Thakar

Prodigy 30 points

We are using below SDK version

The SDK version we are at is 9.0.0.35, and MCU is AM2432

0 Prashant Shivhare 3 months ago in reply to Aravind kumar

TI__Guru 69581 points

Hello,

Aravind kumar said:
The SDK version we are at is 9.0.0.35, and MCU is AM2432

The issue is then expected. Upto this version, the SDK used a random key to sign images for HSFS which resulted in ROM skipping integrity checks.

This was fixed starting SDK v9.1 by the following commit:

https://github.com/TexasInstruments/mcupsdk-core/commit/89c780b1d1

Regards,

Prashant

0 Aravind kumar 3 months ago in reply to Prashant Shivhare

Prodigy 30 points

Curious to know, how does AM243x will bypass image integrity checking? Are there registers to do it?
Adding to above point, how does AM243x ROM bootloader does integrity checking? What parameter in the header it checks? Can you please share header structure? Does integrity check is done along header?
Please let me know on these above point.

0 Hong Zhang 3 months ago in reply to Aravind kumar

Intellectual 782 points

The key point we would like to understand is:

For HS-FS image case,
1) When ROM checks the integrity, how does it exactly do? We like to know under what circumstances, ROM will fall back on the 0x400,000 address.
2) Another question is how we can prevent from having a SBL that is loaded, which passes the ROM's integrity check, but fails to boot up. During the integrity check, is the SHA of the image being calculated?
3) I am also not clear how the ROM skips the integrity check, instead of falling back to backup address as the bug you pointed above. If that is the case, does it mean that we can sign any random key, which will cause it bypasses the check to be able to boot from ROM?

For HS-SE image case,
1) Can the ROM be able to skip integrity check as well?
2) What is the criteria here to have ROM fall back to 0x400,000?
3) Can we leverage SYSFW's API to check the image's integrity before accept the SBL image? If so, could you please help to point the example or instruction?

Thanks,
Hong

0 Prashant Shivhare 3 months ago in reply to Hong Zhang

TI__Guru 69581 points

Hello,

For HSFS case:

1) The integrity check involves comparing the calculated SHA512 hash of the different binaries with the expected SHA512 hash of those binaries contained in the X.509 certificate. This integrity check is performed only if the ROM degenerate key is used for signing the certificate otherwise the binaries are simply loaded at their respective load addresses.

2) If the integrity check passes then the ROM does not have any notion of jumping to redundant or backup boot. The ROM would load the SBL and reset the R5F core to its entry point. If the SBL fails to boot then this is a fault of SBL only. There is nothing ROM can do here.

3) This integrity check is performed only if the ROM degenerate key is used for signing the certificate otherwise the binaries are simply loaded at their respective load addresses.

For HSSE case:

1) No. The secure boot is always enforced on HSSE devices.

2) If the authentication fails then the ROM tries to boot from redundant or backup boot.

3) No.

Regards,

Prashant

0 Hong Zhang 3 months ago in reply to Prashant Shivhare

Intellectual 782 points

Thanks a lot, Prashant.

This information is very helpful,
Hong

Arm-based microcontrollers

Arm-based microcontrollers forum

AM2432: Does RBL checks SBL image CRC or signature before booting in HS-FS mode