AM625: About Software Rollback

Pengfei Lu

Prodigy 120 points

Part Number: AM625

Tool/software:

I want to implement the anti-rollback feature for AM625.

There are three types of SWREV used for anti-rollback:SBL, SYSFW, and board configuration.

1.Are these three types mechanisms for MCU_SDK? Does Linux_SDK work with this mechanism?

2.In SPRUIM0C pdf, step 3.c of “8.4 Detecting Version Updates and Incrementing Revision eFuses”.
Parse each component's X.509 certificates for SW_revision?

over 1 year ago

0 Prashant Shivhare over 1 year ago

TI__Guru 71551 points

Hello,

1) The SWREV concept is agnostic of the SDKs. The only link is you would need to adapt the signing prcoess in the different SDKs to use the correct SWREV values for the different components. By default, all components are signed with the initial programmed value of 1.

2) Parsing each component's certificate for SWREV value, to detect if SWREV update is needed, is only a suggestion. You may come up with other ways probably more simpler to implement the SWREV update procedure.

Regards,

Prashant

0 Pengfei Lu over 1 year ago in reply to Prashant Shivhare

Prodigy 120 points

Thank you，

1、Could you please specify which components are associated with the API enum type of SBL, SYSFW, BRDCFG?

2、How do I get the SWREV value in the certificate and update the corresponding SWREV in efuse?

0 Prashant Shivhare over 1 year ago in reply to Pengfei Lu

TI__Guru 71551 points

Hello,

1) Following is the mapping:

SBL & other application images => OTP_REV_ID_SBL
TIFS binary => OTP_REV_ID_SYSFW
Board configuration binary => OTP_REV_ID_SEC_BRDCFG

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/security/otp_revision.html#otp-revision-identifier

2) The certificate is a public standard X.509 certificate. You may find collateral on internet to understand the X.509 certificate & accordingly implement a routine to parse the X.509 certificate for the SWREV OID.

For reference, you may look at the only available piece of code, which extracts the image length, related to parsing the X.509 certificate.

https://github.com/TexasInstruments/mcupsdk-core-k3/blob/1087fa137c8e1e1a6702609abbe4be78008fd925/source/drivers/bootloader/bootloader.c#L448

The SWREV can be updated with the following TISCI_MSG.

https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/security/otp_revision.html?highlight=tisci_msg_write_swrev#sec-api-wr-swrev-otp

Regards,

Prashant

Processors

Processors forum

AM625: About Software Rollback