AM62A7: am62x encrypt and decrypt

Hi Hong,

thanks for your reply. I know the encryption/decryption is optional. Since our products need to enable linux recovery kernel and normal kernel being encrypted and decrypted after loading, could you provide suggestion or method to do that? Since the encryption and decryption is handled by TI firmware automatically, so I don't know what format of the image to be. Any documentation or SDK code example would be helpful, Thanks Aiping

Hi Aiping,
In the extended secure boot flow, TI OM/TIFS is used to verify spl/u-boot, and the next stage u-boot proper verifying kernel/dtb is done via the community u-boot FIT signature verification scheme.
https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1477353/am6442-processor-sdk-linux-secure-boot-authentication-u-boot-proper---linux/5671474#5671474
https://git.ti.com/cgit/ti-u-boot/ti-u-boot/tree/doc/usage/fit/signature.rst
Best,
-Hong

Hi Hong,

My question is about linux kernel image encryption and decryption support, not authentication (signature verification). Your reply does not cover anything about encryption/decryption. Could you provide the information about how to add image encryption/decryption support on TI platform?

Thanks Aiping

Hi Aiping,
Yes, with u-boot proper verification of kernel/dtb moving to the new u-boot FIT scheme, only signature authentication is performed for integrity check, but not confidentiality check. u-boot FIT code is maintained by community, not TI SDK specifics.
Best,
-Hong

Hi Hong,

I understand your point. But TI's documents clearly shows that TI's firmware/ROM supports both authentication AND decryption. We want to use TI's firmware/ROM to decrypt recovery kernel or linux kernel, which should be more safe and the decrypt key should be able to be burned in the fuses? Please  support us and provide interface or documents of how we can accomplish this.

Thanks Aiping

Hi Aiping,
Here's an alternative option
1/. refer to the Linux SDK 8.x, where u-boot proper verify the kernel/dtb using the TIFS API (the mandatory signature verification is used, but not optional binary blob decryption)
2/. refer to the secure boot flow in MCU+SDK, where it is configurable to enable the optional binary blob decryption in addition to the mandatory signature verification.
https://software-dl.ti.com/mcu-plus-sdk/esd/AM62AX/10_01_00_33/exports/docs/api_guide_am62ax/SECURE_BOOT.html#autotoc_md192
# Encryption option (yes/no)
ENC_ENABLED?=no

For example, taking 2/. as a reference, and applying it to 1/. to enable signature verification + binary blob decryption in the TIFS API call. This is for your reference only to enable your use case.
Best,
-Hong