TDA4VH-Q1: where is the latest security development doc work with the PSDK 10.0

Hi Peng ,

Peng Cheng said:

And there is a question after reading <Jacinto7 High-Security Device Development>, GP, HS-SE-TIDK, and HS-FS(can later convert to HS-SE) are 3 different hardware types, right? can't change to each other by software settings.

Yes these are three different device type, GP there is no provision to burn the keys so it can't be used for secure boot.HS-SE-TIDK is the HS-SE device fused with the TI dummy keys in the customer field of the effuses(TI dummy keys in SMPK field).HS-FS is the field secureable device which can be converted to the HS-SE device by blowing the keys into the effuses using keywriter tool.

Device type can not be controlled through software.

Peng Cheng said:

But seems they are a little bit outdated, where can I find the latest docs to work with the PSDK 10.0?

The working flow remain the same for latest SDK as well, to enable the secure boot.

Regards
Diwakar

Hi Diwakar,

Thank you for your quick response!

I was a bit confused about how to sign SPL, U-Boot, and Linux until I found this one https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1265911/processor-sdk-am64x-a53-u-boot-img-sign/4798300#4798300.

If I am correct, things became simpler when BINMAN was introduced to SDK9.0.

The only thing I need to do is replace these files, and then make u-boot. Am I right?

$ ls ./ti-u-boot-2024.04/arch/arm/mach-k3/keys
custMpk.crt custMpk.key custMpk.pem ti-degenerate-key.pem

And custMpk.key which equals to custMpk.pem is the SMPK-priv mentioned in here https://software-dl.ti.com/jacinto7/esd/processor-sdk-rtos-jacinto7/08_00_00_12/exports/docs/pdk_jacinto_08_00_00_37/docs/userguide/jacinto/modules/keywriter.html#building-pdk-keywriter-app, am I right?

Two more questions,

1. what is ti-degenerate-key.pem? do I need to change it?

2. Here https://software-dl.ti.com/processor-sdk-linux/esd/AM62X/09_00_00_03/exports_AM62SIP/docs/linux/Foundational_Components_Kernel_Users_Guide.html#creating-the-kernel-fitimage-for-high-security-device-gp-devices, it only explains how to sign and encrypt the Linux fit image, but if it is uImage, how to sign and encrypt it?

Thank you!

BR,

Peng

HI Peng,

Peng Cheng said:

If I am correct, things became simpler when BINMAN was introduced to SDK9.0.

Yes you are correct after SDK 9.X it uses binman to package and sign the binary. How to package and sign the binary defined in the arch/arm/dts/k3-j784s4-binman.dtsi file.

You need to replace the keys accordingly . Customer can place their keys at <Linux_SDK>/board-support/ti-u-boot/arch/arm/mach-k3/keys.

Peng Cheng said:

And custMpk.key which equals to custMpk.pem is the SMPK-priv mentioned in here https://software-dl.ti.com/jacinto7/esd/processor-sdk-rtos-jacinto7/08_00_00_12/exports/docs/pdk_jacinto_08_00_00_37/docs/userguide/jacinto/modules/keywriter.html#building-pdk-keywriter-app, am I right?

That is correct.

Peng Cheng said:

1. what is ti-degenerate-key.pem? do I need to change it?

ROM degenerate keys is the regular keys which is used to sign the image on GP and HS-FS device. If the image is signed with these keys ROM will perform the integrity check else will ignore.

Peng Cheng said:

2. Here https://software-dl.ti.com/processor-sdk-linux/esd/AM62X/09_00_00_03/exports_AM62SIP/docs/linux/Foundational_Components_Kernel_Users_Guide.html#creating-the-kernel-fitimage-for-high-security-device-gp-devices, it only explains how to sign and encrypt the Linux fit image, but if it is uImage, how to sign and encrypt it?

currently only Fit image is supported.

Regards
Diwakar

Thank you! Diwakar

Hi, I also tried to close but seems I can't.