TMDS64EVM: Enabling Secure Boot

Kiyomasa Imaizumi

Part Number: TMDS64EVM

Tool/software:

Hello TI support team.

Please tell me about secure boot for TMDS64EVM.
I am using mcu_plus_sdk_am64x_08_06_00_45 as the SDK.

When I run an SDK example from OSPI flash boot, the application firmware is executed from SBL, but where is secure boot being performed?
For example, when I start a53ss0-0_nortos hello_wold project from SBL OSPI, is secure boot being performed?
If not, please tell me how to perform secure boot.

Best regards,
Kiyomasa Imaizumi.

7 months ago

0 Prashant Shivhare 7 months ago

TI__Guru 69181 points

Hello,

Kiyomasa Imaizumi said:
For example, when I start a53ss0-0_nortos hello_wold project from SBL OSPI, is secure boot being performed?

Yes, the application image is authenticated before being loaded & run.

Please see the following code:

https://github.com/TexasInstruments/mcupsdk-core/blob/4079d05171fc43c03f17a0f0c8b96c06518cffb3/source/drivers/bootloader/bootloader.c#L1306

Additionally, please refer to the following guide as well:

https://software-dl.ti.com/mcu-plus-sdk/esd/AM64X/10_01_00_32/exports/docs/api_guide_am64x/SECURE_BOOT.html

Regards,

Prashant

0 Kiyomasa Imaizumi 7 months ago in reply to Prashant Shivhare

Intellectual 760 points

Hello Prashant Shivhare.

Thank you for your reply.

When I checked the Enabling Secure Boot document, it looks like for HS_FS devices I need to write something to the eFUSE beforehand.
Currently, TMDS64EVM is performing secure boot, but is there anything I need to do?
I'm using an HS_FS device.

Best regards,
Kiyomasa Imaizumi.

0 Prashant Shivhare 7 months ago in reply to Kiyomasa Imaizumi

TI__Guru 69181 points

Hello,

Kiyomasa Imaizumi said:
I'm using an HS_FS device.

On HSFS devices, only integrity check is done as part of the authenticating an application image.

For enforcing full secure boot, you would have to convert the device to HSSE. The secure boot would then involve verifying the application image with the programmed keys.

Regards,

Prashant

Processors

Processors forum

TMDS64EVM: Enabling Secure Boot