• State TI Thinks Resolved
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 100 subscribers
  • Views 53 views
  • Users 0 members are here
Support feedback
Options
Options
Similar topics

AM6421: Can SBL use TI's BootLoader driver to decrypt the 'binary'?

Jenny Zhou
Prodigy 140 points
Part Number: AM6421

Tool/software:

Hi TI expert,

I'm using the MCU SDK: mcu_plus_sdk_am64x_10_00_00_20.

I have some questions for secure boot on AM64, I want to enable authenticaiton and encryption both for SBL and RTOS App.

Following screenshot shows the authentication steps while secure boot. 

If I enable the secure boot, and generated a secure image of SBL(with x509 certificate), RBL(First bootloader) will do all steps for me, right? including steps 3&4(in yellow)?

But for application's secure boot, how can I enable all the steps? will the Bootloader driver's API(Bootloader_socAuthImage) do those?

will it 'load whole app images' -->'cacluate its hash'--->'compare with x509's hash'?

and what about the 'Step 4', when will be executed in Bootloader driver?

  • 0
    TI__Guru 57561 points

    Hello,

    Jenny Zhou said:
    If I enable the secure boot, and generated a secure image of SBL(with x509 certificate), RBL(First bootloader) will do all steps for me, right? including steps 3&4(in yellow)?

    Yes, the ROM would authenticate and decrypt the SBL image (if encrypted).

    Jenny Zhou said:
    But for application's secure boot, how can I enable all the steps? will the Bootloader driver's API(Bootloader_socAuthImage) do those?

    This API requests the SYSFW for authentication of the image. The SYSFW would do the authentication and decrypt the image (if encrypted) as well.

    Please have a look at the following guide as well:

    https://software-dl.ti.com/mcu-plus-sdk/esd/AM64X/10_01_00_32/exports/docs/api_guide_am64x/SECURE_BOOT.html

    Regards,

    Prashant

  • 0 in reply to Prashant Shivhare
    Prodigy 140 points

    Hi Prashant,

    thanks a lot.

    as you mentioned "API(Bootloader_socAuthImage) would do the authentication and decrypt the image (if encrypted) as well".

    I'm curious about how it was achieved. Since after reading SBL code, I saw, after 'Bootloader_socAuthImage', '

    Bootloader_rprcImageLoad()' will directly call 'imgReadFxn()' to read from flash to DDR, I didn't see any encryption process.

  • 0 in reply to Jenny Zhou
    TI__Guru 57561 points
    Jenny Zhou said:
    I'm curious about how it was achieved. Since after reading SBL code, I saw, after 'Bootloader_socAuthImage', '

    As I mentioned, this API requests the SYSFW, running on the DMSC core, for authentication of the image. If the SYSFW returns ACK, it means the image is authenticated and optionally decrypted successfully.