• State Resolved
  • Locked Locked
  • Replies 3 replies
  • Answers 1 answer
  • Subscribers 97 subscribers
  • Views 574 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM6546: Secure boot in GP devices

Nikita_Nikita
Prodigy 165 points

Part Number: AM6546

Hi there,

I went through TRM and http://software-dl.ti.com/processor-sdk-linux/esd/docs/latest/linux/Foundational_Components_U-Boot.html to read more about secure boot in sitara processors .

I have few basic questions for GP devices:

Does  DMSC ROM code and then SYSFW authenticates all SPLs (tiboot3.bin, tispl.bin,sysfw.itb ) in GP devices ?  I also read that  "System Firmware does not include a X509 parser on GP devices."

Does boot flow mentioned here for  k3 architecture  ,http://software-dl.ti.com/processor-sdk-linux/esd/docs/latest/linux/Foundational_Components_U-Boot.html is valid for both GP and HS devices  ?

How can this verified in my device ? 

Thank you.

 

  • 0
    TI__Guru**** 171230 points

    Hi,

    1) ROM verifies the checksum of the SPL and SYSFW on GP devices.
    2) System Firmware does not include a X509 parser on GP devices. That is correct.
    3) On HS, SYSFW requires two certificates

    1. an inner - delivered by TI, signed with TI MPK
    2. an outer - generated by customer by countersigning the inner with SMPK
    3. Additionally the SYSFW binary is encrypted with TI MEK

    On GP, SYSFW has only one certificate
    An inner – signed by customer with any RSA/EC key – Our recommendation is to use a RSA degenerate key to save on boot time.
    Otherwise RoM boot flow is the same.

    Hope this answers all your questions.

    Regards,
    Keerthy

  • 0 in reply to Keerthy J
    Prodigy 165 points

    Thank you Keerthy.

    I checked on my device , with default SDK options,  tiboot3.bin has been included X509 certificate ,which is signed with degenerated RSA/EC key. This binary will be validated by ROM code.

    In other binaries, tispl.bin ,u-boot.img and sysfw.itb only checksum is validated .

    Is above understanding correct ?

      

  • 0 in reply to Nikita_Nikita
    TI__Guru**** 171230 points

    Hello Nikita,

    On GP device, there is checksum validation only for tiboot3.bin (SPL/MLO) and sysfw(included as one component in sysfw.itb). There is no checksum validation for the rest. Other binaries do not need an X509 certificate.

    If there are no further questions please resolve the issues.

    Regards,
    Keerthy