AM623: chain of trust between binaries

RJ DJ

Part Number: AM623

Tool/software:

Hi ,

I’m working with a Yocto build for the AM623, which generates tiboot3 images for both HS-SE and HS-FS variants. I have the following questions:

1.Why is there no specific HS-SE build for tispl.bin and u-boot.img?

2.How does the chain of trust work across these boot stages?

3.Since the same tispl.bin and u-boot.img are used for both HS-SE and HS-FS devices, does the boot process skip authentication on HS-FS?

4.On an HS-FS device, can it boot using a signed tiboot3-hs.bin image?

5. I performed a test using two builds with different keys. One build successfully boots on my HS-SE device, while the other—signed with a different SMPK key—does not. In my test, I took only the tiboot3-hs.bin file from the working build and used it to boot the device. This booted successfully. Then, I loaded the tipsl.bin from the other (incorrect) build, and encountered an error in the log. Can you explain what is actually happening here? Specifically, how do these binaries determine the root of trust? Log is attached below.

U-Boot SPL 2023.04-ti- g2bedcd265ca6 (Dec 07 2024 - 07:04:35 +0000)
SYSFW ABI: 4.0 (firmware rev 0x000a '10.1.8--v10.01.08 (Fiery Fox)')
SPL initial stack usage: 13408 bytes
Trying to boot from DFU
###########################################################DOWNLOAD ... OK
Corl+C to exit
...
ti sci system-controller@44043000: Message not acknowledgedAuthentication failed!
### ERROR ### Please RESET the board ###

Regards,

23 days ago

0 Suren Porwar 22 days ago

TI__Mastermind 29245 points

Hi,

All device types images are automatically generated as part of the U-Boot build procedure. The `tispl.bin` and `u-boot.img` remains the same for both HSFS and HSSE devices. That's the reason, we don't have separate build for these images.

The `tiboot3.bin` is generated with the name `tiboot3-am62x-hs-evm.bin` for HSSE device and cannot be used on HS-FS device.

I am also routing your other queries to our expert. Please expect a response by early next week.

Best Regards,

Suren

0 RJ DJ 21 days ago in reply to Suren Porwar

Intellectual 396 points

Hi Suren Porwar,

Thank you for the quick response! I'm looking forward to your further input. If you have any documentation or relevant links related to my questions, they'd be greatly appreciated as well.

0 Prashant Shivhare 19 days ago

TI__Guru 71551 points

Hello,

RJ DJ said:
1.Why is there no specific HS-SE build for tispl.bin and u-boot.img?

These images are signed with HSSE keys only. However, these would boot on HSFS device as well so there is no need to have separate builds for these images.

RJ DJ said:
2.How does the chain of trust work across these boot stages?

https://software-dl.ti.com/processor-sdk-linux/esd/AM64X/11_01_05_03/exports/docs/linux/Foundational_Components_Secure_Boot.html

RJ DJ said:
3.Since the same tispl.bin and u-boot.img are used for both HS-SE and HS-FS devices, does the boot process skip authentication on HS-FS?

Yes. The authentication involves comparing the SHA512 hashes only.

RJ DJ said:
4.On an HS-FS device, can it boot using a signed tiboot3-hs.bin image?

No. The `tiboot3.bin` are built separately for HSFS and HSSE devices.

RJ DJ said:
Then, I loaded the tipsl.bin from the other (incorrect) build, and encountered an error in the log. Can you explain what is actually happening here?

It is expected since the image is not signed with the programmed key so authentication fails.

https://software-dl.ti.com/tisci/esd/latest/6_topic_user_guides/authentication.html#authentication-sequence

Regards,

Prashant

0 RJ DJ 17 days ago in reply to Prashant Shivhare

Intellectual 396 points

Hi Prashant ,

Thank you for your responses! I'm using a Yocto build for signing. During the build process, the custMpk.pem file is copied to the ti/keys/ directory, and signing takes place correctly everything works as expected.

However, I would like to better understand the full process in detail starting from when the .pem file is copied, to how the binaries are appended with keys for signing, and finally how the HS-SE images are generated.

Could you please provide a detailed explanation of this entire boot sign flow? It would be greatly appreciated!

Regards,

0 Prashant Shivhare 16 days ago in reply to RJ DJ

TI__Guru 71551 points

Please see if the following helps:

software-dl.ti.com/.../Foundational_Components_Secure_Boot.html

Processors

Processors forum

AM623: chain of trust between binaries