AM6442: Is it possible to include OTP key writer in boot media such as eMMC?

Tetsuro Kasai

Part Number: AM6442
Other Parts Discussed in Thread: AM62P

Tool/software:

Hi,

Now customer is investigating where they should store OTP keywriter.

If they store OTP keywriter other media than boot media, they might be asked to verify security risk for the media of OTP key writer to follow CRA.

Here is the question.

Is it possible to include both OTP keywriter together with boot loader, RTOS and Linux rootfs? When boot up 1st time, OTP keywirter runs and program keys. 2nd time or after, boot Linux and RTOS runs. Is it possible to support this use-case?
As another way, is it possible to program keys in OTP using JTAG? After OTP is programmed, JTAG is disabled, so there is no security risk for the path to program OTP keywriter. This is ideal case for customer. After that, only boot loader, RTOS and Linux runs.

Best Regards,

Kasai

2 months ago

0 Prashant Shivhare 2 months ago

TI__Guru 73261 points

Hello,

1) It is not possible.

2) Yes, the keywriter can be run over JTAG as well.

0 Tetsuro Kasai 2 months ago in reply to Prashant Shivhare

TI__Expert 5505 points

Hi Prashant,

Thank you for your reply.

Do you have any document which shows how to run OTP keywriter over JTAG?

Best Regards,

Kasai

0 Prashant Shivhare 2 months ago in reply to Tetsuro Kasai

TI__Guru 73261 points

Tetsuro Kasai said:
Do you have any document which shows how to run OTP keywriter over JTAG?

This is mentioned in the OTP Keywriter user guide. If the customer doesn't have access to the keywriter package, they may request the same with: https://www.ti.com/drr/opn/AM64X-HS-RESTRICTED-SW

Once the access is granted, the resources would be available at: www.ti.com/.../AM64X-HS-RESTRICTED-SW

0 Tetsuro Kasai 1 month ago in reply to Prashant Shivhare

TI__Expert 5505 points

Hi Prashant,

I hear from my co-worker that AM62P is trying to support OTP-KEY-WRITER + user BSL and application in single eMMC.

It looks like only eMMC can have both primary image and back image.

eMMC address 0x0000000 primary: HS-SE Signed image

eMMC address 0x400000 backup: Key writer for HS-FS

Can you check if AM64 has this plan? This is quite important to meet CRA. CRA requires to reduce the attack interface as much as possible.

Best Regards,

Kasai

+1 Prashant Shivhare 1 month ago in reply to Tetsuro Kasai

TI__Guru 73261 points

Hello,

Tetsuro Kasai said:
I hear from my co-worker that AM62P is trying to support OTP-KEY-WRITER + user BSL and application in single eMMC.

There are no such plans. This is not possible as well. The ROM does not support the redundant boot (address 0x400000) for eMMC boot partitions. Even if the ROM did support, the keywriter image cannot be at the redundant boot address (0x400000) as the ROM would boot the HSSE image from the primary boot address (0x0) so it would not jump to the keywriter image in the HSFS state.

Regards,

Prashant

0 Tetsuro Kasai 1 month ago in reply to Prashant Shivhare

TI__Expert 5505 points

Hi Prashant,

Sorry for my wrong information. I double checked with my co-worker. Actually it is idea base but there is no clear plan.

Prashant Shivhare said:
There are no such plans. This is not possible as well. The ROM does not support the redundant boot (address 0x400000) for eMMC boot partitions. Even if the ROM did support, the keywriter image cannot be at the redundant boot address (0x400000) as the ROM would boot the HSSE image from the primary boot address (0x0) so it would not jump to the keywriter image in the HSFS state

I will check TRM for AM64 more details.

Best Regards,

Kasai

Processors

Processors forum

AM6442: Is it possible to include OTP key writer in boot media such as eMMC?