Hi TI experts,
I am working on TI secure boot feature on ti-am62ax board.
I found there is a package named ti-sci-fw, after building this package in yocto project, there is below firmware binary in ti-sci-fw\08.06.04-r4.0\image\lib\firmware\ti-sysfw
ti-fs-firmware-am62ax-hs-cert.bin
ti-fs-firmware-am62ax-hs-enc.bin
ti-fs-firmware-am62ax-hs-fs-cert.bin
ti-fs-firmware-am62ax-hs-fs-enc.bin
when I burn the TI dumy key into eFuse, I download the otp_keywriter_am62ax-linux-installer.run addon, and install it to at location <MCU_PLUS_SDK_INSTALL_DIR>/source/security.
In the DIR <MCU_PLUS_SDK_INSTALL_DIR>/source/security/sbl_keywriter/scripts/cert_gen/am62ax/keys_devel/, there are below 4 key files
bmek.key bmpk.pem smek.key smpk.pem
About the different between these ti-fs-firmware-<xxx>.bin variant files, my understand as below.
ti-fs-firmware-am62ax-hs-fs-cert.bin: it is only signed by TI MPK, and the pub key hash of TI MPK has been burned into eFuse in TI factory, is it right?
ti-fs-firmware-am62ax-hs-fs-enc.bin: it is only encrypted by TI MEK that as been burned into eFuse in TI factory, is it right?
ti-fs-firmware-am62ax-hs-cert.bin: it is not only signed by TI MPK, but also signed by TI dummy key smpk.pem, is it right?
Another question about ti-fs-firmware-am62ax-hs-cert.bin, is it also signed by TI dummy key bmpk.pem? whether I also need to burn the pub key hash of TI dummy key bmpk.pem into eFuse?
ti-fs-firmware-am62ax-hs-enc.bin: it is not only encrypted by TI MEK, but also encrypted by TI dummy key smek.key, is it right
Another question about ti-fs-firmware-am62ax-hs-enc.bin, is it also encrypted by TI dummy key bmek.key? whether I also need to burn the TI dummy key bmpk.key into eFuse?
Another question about how to use the real customer key, not TI dummy key? If I put the real customer key into <MCU_PLUS_SDK_INSTALL_DIR>/source/security/sbl_keywriter/scripts/cert_gen/am62ax/keys_devel/, and then burn them into eFuse, how do I sign the ti-fs-firmware? should I sign the ti-fs-firmware-am62ax-hs-fs-cert.bin with the real customer key(smpk.pem) to get the ti-fs-firmware-am62ax-hs-cert.bin? or there is other solution to implement my guile doc to explain my question?
The similar question about how to encrypt the ti-fs-firmware with real customer key?
thanks,
Limeng
