• State
  • Locked Locked
  • Replies 2 replies
  • Subscribers 99 subscribers
  • Views 757 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM6422: AM6422 HS-SE secure boot u-boot + linux stalls when encrypted

Stefan Strobel
Prodigy 30 points

Part Number: AM6422

Hi everyone,

I am trying to get secure boot running on our platform using an AM6422 chip.

We managed to program SMPK and SMEK to the efuses using the otp-keywriter.

Using the SMPK I managed to sign all binaries in our boot process to be authenticated by the device.

Now I try to enable encryption as well for IP protection.

This is where it gets a bit sketchy.

I enabled the "System Firmware Encryption Extension", encrypted the binary using AES256-CBC with the programmed SMEK and patched the "System Firmware Image Integrity Extension" following Signing binaries for Secure Boot on HS Devices — TISCI User Guide.

I did this for all binaries.

We are booting multiple stages of U-Boot until U-Boot starts a Linux kernel.

So we have tiboot3.bin, tispl.bin as well as u-boot.img which are built using yocto/bitbake.

I can successfully boot encrypted binaries as long as I do not encrypt any of the executable u-boot binaries.

tiboot3.bin

The certificate does not use the extensions documented here: Signing binaries for Secure Boot on HS Devices — TISCI User Guide, but instead use ext_boot_info extension with oid 1.3.6.1.4.1.294.1.9

When encrypting this file while populating the enrcyption extension the device does not boot anymore.

So my question:

  • Is is possible to encrypt the tiboot3.bin file at all - is there a documentation on how to do so?

tispl.bin / u-boot.img

 

When encrypting the spl or uboot image inside the two fitimages the device stalls during boot.

When encrypting the last stage uboot I get the following logs before the boot stalls:

Trying to boot from MMC2
Authentication passed
Authentication passed

When using a different encryption key, or manipulating the magic value populated in the encryption extension lead to an authentication error.

So I assume the device can successfully decrypt and authenticate the binary but fails to execute it.

All other binaries (optee, atf as well as the device trees) work with enabled encryption.

Question:

  • What can cause the stalling boot process when encrypting the u-boot binaries? Is there any way to debug what is happening on the device?

Thanks a lot!

Stefan