J721EXCPXEVM: Enable signing of Bootloader & Application images for HS-FE

Renan Santos Adriano

Part Number: J721EXCPXEVM

Hello Experts,

Is there documentation on the process to sign the bootloader & application image on the HS-FS version before testing with the HS-SE version of the board?

Currently our TIFS is signed by TI for our HS-FS' version of the board but theres no authentication for the bootloader & application image.

How would i go about enabling secure boot (testing on FS to confirm authentication works) before burning the efuses.

Regards,

Hitesh Mantha

7 days ago

0 Diwakar Dhyani 7 days ago

TI__Guru 58075 points

HI Hitesh,

On HS-FS device customer keys are not fused so it is not possible to perform actual secure boot on HS-FS device, we have to use HS-SE device for the same.

Regards
Diwakar

0 Hitesh Mantha 7 days ago

Prodigy 30 points

Hey Diwakar,

Is there any way to test the signing process (either with dummy keys, or with our own keys (without burning efuses)) so I can confirm the chain of trust for secure boot when we switch the devices to HS-SE?

Best,
Hitesh

0 Diwakar Dhyani 4 days ago in reply to Hitesh Mantha

TI__Guru 58075 points

HI Hitesh,

This is not possible, let me explain to you the reason for the same. If you see the steps 1a and 1b of the below authentication process, it needs the hash of the key to be matched with the hash present in the effuses.

Since the keys are not blown into the effuses on HS-FS device this steps will be skipped and only integrity check will be performed, in summary you can't perform secure boot on HS-FS device.

Regards
Diwakar

0 Hitesh Mantha 4 days ago in reply to Diwakar Dhyani

Prodigy 30 points

Ah I see,

Sounds good! What is the workflow then to do it on a HS-SE device? Is there a workflow to follow to switch a HS-FS to HS-SE and then sign the bootloaders, sign the image, and encrypt/decrypt the image too?

0 Diwakar Dhyani 3 days ago in reply to Hitesh Mantha

TI__Guru 58075 points

HI Hitesh,

Please go through the below app not get the details on work flow.

https://www.ti.com/lit/an/sprad04/sprad04.pdf?ts=1761627109345&ref_url=https%253A%252F%252Fwww.google.com%252F

Do let me know if you still have any other question related to this.

Regards
Diwakar

0 Hitesh Mantha 3 days ago in reply to Diwakar Dhyani

Prodigy 30 points

Thanks!

Also the doc you sent says : "The HS engineers purchase HS-FS device and use TI dummy keys or random dummy keys to double check the HS process. In order to confirm the process of keys generation, Keywriter setup, and eFuse programming."

You said we cant sign with dummy keys & test the whole HS process though? So is it doable?

0 Diwakar Dhyani 2 days ago in reply to Hitesh Mantha

TI__Guru 58075 points

Hi Hitesh,

Hitesh Mantha said:
You said we cant sign with dummy keys & test the whole HS process though? So is it doable?

Signing the image with the dummy keys is not the issue, you can sign the image with dummy or random keys and boot the HS-FS device, but it will not be a complete secure boot.

As explained in the earlier response, public key hash check will get skipped during the authentication process on HS-FS device as the keys are not blown into the effuses yet.

After writing the keys using keywriter tool into the effuses and converting the HS-FS device to HS-SE, you will be able to perform complete secure boot.

Regards
Diwakar

Processors

Processors forum

J721EXCPXEVM: Enable signing of Bootloader & Application images for HS-FE