AM62X-PET-CALC: Example u-boot and binman commands for building TI AM62x serial boards

Thanks, Prashant, for your valuable inputs. Following links you provided, I was able to build u-boot successfully for "board-support/u-boot-build/r5". Looking into the certificate, it seemed not the one as specified in Signing binaries for Secure Boot on HS Devices — TISCI User Guide for customer encrypted or unencrypted images. If I would like to build and sign a customized bootloader image (encrypted) containing the TI secure boot required certificate extensions in certificates, how shall I do? Any example commands to share ? Thanks again, really appreciate your help that brought me to the current stage.

TI secure boot certificate extensions

1.3.6.1.4.1.294.1.3

1.3.6.1.4.1.294.1.4

1.3.6.1.4.1.294.1.33

1.3.6.1.4.1.294.1.34

1.3.6.1.4.1.294.1.35

- James

Hi James,

The X.509 certificate format for the image (tiboot3.bin) authenticated by the ROM is different from the X.509 certificate format for the other images authenticated by the TIFS. The former is described in the TRM while the later is described the following TISCI documentation page

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/security/sec_cert_format.html

The implementation of these in the Binman tool are as follows:

• ROM X.509 cert: https://git.ti.com/cgit/ti-u-boot/ti-u-boot/tree/tools/binman/btool/openssl.py?h=09.02.00.010&id=83660642085462346fbeb410f83bc99448ec7042#n235
• Sysfs X.509 cert: https://git.ti.com/cgit/ti-u-boot/ti-u-boot/tree/tools/binman/btool/openssl.py?h=09.02.00.010&id=83660642085462346fbeb410f83bc99448ec7042#n84

At present, we don't have the official support for the encrypted boot in the U-Boot.

Regards,

Prashant

Thanks a lot, Prashant. The above information is very helpful.

From  the two python file, I can see how the certificates are formatted.

As my goal is able to sign TIFS authenticated encrypted images, do you by any chance have the high level command that I can use to do so?

I did find a script (~/ti/core-secdev-k3/scripts/secure-binary-image-cs.sh) that can be used to sign, but it does not include encryption.

Since TI has already switched totally to u-boot/binman, I would assume that the signing of TIFS authenticated images are also the case. If so, a reference command like "make u-boot" for making the ROM authenticated tiboot3.bin will be very helpful.

Thanks again and best regards

James

Hi James,

Are you looking to manually sign the images?

If yes, may I know why the automated signing of the different images by the Binman does not work for you?

The "make u-boot" command will automatically generate the properly signed U-Boot images (tiboot3.bin/tispl.bin/u-boot.img).

Regards,

Prashant

Hi Prashant,

Thanks for you swift response. I am not specifically looking for manual signing. Any signing methods are acceptable to me as long as they will yield the same result for signing TIFS authenticated images.

My goal is to be able to sign encrypted TIFS authenticated image using the latest TI recommended signing method, either manual or through "u-boot make"-like automated method. Since my TI business contact told me that TI has switch all to u-boot/binman signing. I would like to catch up with the latest TI approach. I am not sure if this u-boot/binman signing is only for TI ROM authenticated tiboot3.bin or it also works for TIFS authenticated image signing. If TIFS authenticated image signing is also covered, what is the command for doing so? If not, do you have any execution reference that I can follow? By the way, I am aware of the certificate specification as you pointed to me in earlier response, and thanks for that.

If the manual signing using script (~/ti/core-secdev-k3/scripts/secure-binary-image-cs.sh) will yield the same certificates, I am good with using it. However, this script is missing all encryption related extensions.

Best

James

Hi James,

Could you help me understand what exactly is this image you are looking to sign and be authenticated at run time by TIFS?

I have communicated since the start that the single "make u-boot" command generates all the three U-Boot images (tiboot3.bin/tispl.bin/u-boot.img) properly signed. The R5 SPL (tiboot.3bin) is authenticated by the ROM while the A53 SPL (tispl.bin) and A53 U-Boot (u-boot.img) are authenticated by the TIFS at run time.

I don't know may be the following response be of help

https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1346434/am62a7-q1-why-is-there-so-many-authentications-during-the-boot-process-and-can-i-reduce-the-number-of-authentications-to-improve-the-boot-time/5131641#5131641

Regards,

Prashant

Thanks, Prashant, for the explanation.

All I would like to achieve is to sign the TI customer's secondary bootloader image with encryption enabled using the customer's encryption and signing keys. In the case, the following extensions have to be populated into the X.509 certificate according the the TISCI users guide. I checked the tispl.bin and u-boot.img generted and did not see the follows.

1.3.6.1.4.1.294.1.3

1.3.6.1.4.1.294.1.4

1.3.6.1.4.1.294.1.33

1.3.6.1.4.1.294.1.34

1.3.6.1.4.1.294.1.35

Thanks again.

James

Hi James,

As I mentioned earlier, the Processor SDK doesn't have the support for Encryption (1.3.6.1.4.1.294.1.4) as of now.

For the other extensions, I am not sure what you are checking that suggests they are not there. If you check the TIFS X.509 certificate template, you will find the extensions

Just in case, the A53 SPL (tispl.bin) and A53 U-Boot (u-boot.img) are FIT images containing different components binaries. Each individual binary is signed and authenticated at run time.

Regards,

Prashant