AM6421: FIT verification in secure boot

Nagabhushan Deshpande

Part Number: AM6421
Other Parts Discussed in Thread: TMDS64EVM

Hello support team,

I am using SDK version - ti-processor-sdk-linux-rt-am64xx-evm-11.01.05.03 and board - TMDS64EVM. I am working on implementing FIT signing (ultimately complete secure boot). I have followed these steps to try it out:

Generate fitImage using signature node in the fitImage.its (I can verify that it is signed by looking at the sign value in fitImage)
Inject the key into u-boot.dtb after "make u-boot" (Can be verified by signature node/key-name-hint with fdtdump u-boot.dtb)
Replace these 2 files (u-boot.img and fitImage) in the default sd card wic image (from PROCESSOR-SDK-LINUX-AM64X Software development kit (SDK) | TI.com) inside boot.
Try booting on the evm.

I tried 2 cases:

Inject the same key and sign fitImage with the same.
Using different keys.

In both the cases the kernel is being booted (even in the 2nd case which it should NOT). And I do not observe any logs related to "FIT image", "Signature verification" that help me understand even if the verification taking place. Help me if there is any step missing. Should I copy u-boot.dtb in boot? Should I re-run make u-boot after injecting key into .dtb?

Thanks and regards

5 months ago

0 Hong Guan64 5 months ago

TI__Guru* 78250 points

Will you share/attach the full boot logs for the two test cases.
Best,
-Hong

0 Nagabhushan Deshpande 5 months ago in reply to Hong Guan64

Prodigy 10 points

Hello Hong,

Case-1.docx Case-2.docx

PFA 2 files for system logs.

Regards,

Nagabhushan

0 Nagabhushan Deshpande 5 months ago in reply to Hong Guan64

Prodigy 10 points

Hi Hong,

I would also like to add that I have set the required configurations PFA. As a53 is responsible for the u-boot.img I have set the required fields. Should the same be done in r5/.config?

Regards,

Nagabhushan

0 Hong Guan64 5 months ago in reply to Nagabhushan Deshpande

TI__Guru* 78250 points

Hi Nagabhushan,
From the attached boot log, it looks like the device type is HS-FS.
The device type is detected in u-boot
- HS-FS: unsigned kernel/dtb are loaded by u-boot
- HS-SE: FIT kernel image is verified & loaded by u-boot.
Best,
-Hong

0 Nagabhushan Deshpande 5 months ago in reply to Hong Guan64

Prodigy 10 points

Hello Hong,

Thanks for the crisp answer and yes, the SoC is HS-FS. I have a continuation question -

I understand that we need HS-SE board for verification for initial few files like tiboot3.bin, tispl.bin and u-boot.img as they need to be verified by the key from eFused OTP memory, but the key required for fitImage verification is in the u-boot.img. May I know why ONLY HS-SE boards can verify FIT kernel image/send share resources for the same.

Thanks again,

Nagabhushan

0 Nagabhushan Deshpande 5 months ago in reply to Hong Guan64

Prodigy 10 points

Hi Hong,

Is there any way to try out the working of the fitImage verification without HS-SE board? Like using TI dummy keys or using some scripts?

Regards,

Nagabhushan

0 Hong Guan64 5 months ago in reply to Nagabhushan Deshpande

TI__Guru* 78250 points

Hi Nagabhushan,

There's change in u-boot proper verifying the kernel FIT image starting from SDK 9.x, where the generic u-boot FIT signature verification with supporting the signed configuration is used to verify the kernel FIT image instead of TIFS TISCI API. The rational is verifying u-boot binary on HS-SE with ROM/TIFS to establish SoC-level RoT secure boot which make it possible to use the generic u-boot FIT signature verification flow for the rest of secure boot chain...

https://software-dl.ti.com/processor-sdk-linux/esd/AM64X/11_02_08_02/exports/docs/linux/Foundational_Components_Kernel_Users_Guide.html#generating-the-fitimage
https://software-dl.ti.com/processor-sdk-linux/esd/AM64X/11_02_08_02/exports/docs/linux/Foundational_Components_Kernel_Users_Guide.html#build-uboot-again

Best,
-Hong

Simulation, hardware & system design tools

Simulation, hardware & system design tools forum

AM6421: FIT verification in secure boot