Part Number: AM6412
Tool/software:
Hi Team
We are implementing secure boot our custom board. So far, the boot process works until U-Boot pure. However, U-Boot fails to boot the kernel. We get the following output:
## Loading kernel from FIT Image at 82000000 ...
Using 'conf-ti_dg-board.dtb' configuration
Verifying Hash Integrity ... OK
Trying 'kernel-1' kernel subimage
Description: Linux kernel
Type: Kernel Image
Compression: gzip compressed
Data Start: 0x820000e4
Data Size: 5954329 Bytes = 5.7 MiB
Architecture: AArch64
OS: Linux
Load Address: 0x80000000
Entry Point: 0x80000000
Hash algo: sha512
Hash value: 93b5489c28f8462035163ccee32fe202127622a43bd6684db78bc8b4c0e12885f9578c172c1dd24588ef137ec7c9d893c31a86e75786b154ea32f
Verifying Hash Integrity ... sha512+ OK
ti_sci system-controller@44043000: Message not acknowledgedAuthentication failed!
### ERROR ### Please RESET the board ###
We very much think, that we did not sign the kernel correctly. However, we found little and even inconsistent information on the TI webpages.
- The document here https://software-dl.ti.com/processor-sdk-linux-rt/esd/AM64X/09_00_00_03/exports/docs/linux/Foundational_Components_Secure_Boot.html#secure-boot-flow suggests, that the kernel is wrapped into a X509 certificate and authenticated by TIFS.
- The document here https://software-dl.ti.com/processor-sdk-linux-rt/esd/AM64X/10_00_07_04/exports/docs/linux/Foundational_Components_Kernel_Users_Guide.html#creating-the-kernel-fitimage-for-high-security-device-gp-devices suggests, that the FIT image is signed by adding a signature node to the FIT image.
We think that (1) would be the TI mechanism of signing and verifying images because tiboot3.bin and tispl.bin follows this approach (and this actually works on or board). Mechanism (2) is probably what U-Boot supports by default. Looking at the TI Yocto layers (tisdk 10.00.07.04), you only support method (2), correct ?
Could you please bring some light into the situation ? What is the recommended method of signing the kernel ?
Regards
Walter Stoll