AM6421: Can SBL use TI's BootLoader driver to decrypt the 'binary'?

Jenny Zhou

Part Number: AM6421

Tool/software:

Hi TI expert,

I'm using the MCU SDK: mcu_plus_sdk_am64x_10_00_00_20.

I have some questions for secure boot on AM64, I want to enable authenticaiton and encryption both for SBL and RTOS App.

Following screenshot shows the authentication steps while secure boot.

If I enable the secure boot, and generated a secure image of SBL(with x509 certificate), RBL(First bootloader) will do all steps for me, right? including steps 3&4(in yellow)?

But for application's secure boot, how can I enable all the steps? will the Bootloader driver's API(Bootloader_socAuthImage) do those?

will it 'load whole app images' -->'cacluate its hash'--->'compare with x509's hash'?

and what about the 'Step 4', when will be executed in Bootloader driver?

3 days ago

0 Prashant Shivhare 3 days ago

TI__Guru 57591 points

Hello,

Jenny Zhou said:
If I enable the secure boot, and generated a secure image of SBL(with x509 certificate), RBL(First bootloader) will do all steps for me, right? including steps 3&4(in yellow)?

Yes, the ROM would authenticate and decrypt the SBL image (if encrypted).

Jenny Zhou said:
But for application's secure boot, how can I enable all the steps? will the Bootloader driver's API(Bootloader_socAuthImage) do those?

This API requests the SYSFW for authentication of the image. The SYSFW would do the authentication and decrypt the image (if encrypted) as well.

Please have a look at the following guide as well:

https://software-dl.ti.com/mcu-plus-sdk/esd/AM64X/10_01_00_32/exports/docs/api_guide_am64x/SECURE_BOOT.html

Regards,

Prashant

0 Jenny Zhou 2 days ago in reply to Prashant Shivhare

Prodigy 140 points

Hi Prashant,

thanks a lot.

as you mentioned "API(Bootloader_socAuthImage) would do the authentication and decrypt the image (if encrypted) as well".

I'm curious about how it was achieved. Since after reading SBL code, I saw, after 'Bootloader_socAuthImage', '

Bootloader_rprcImageLoad()' will directly call 'imgReadFxn()' to read from flash to DDR, I didn't see any encryption process.

0 Prashant Shivhare 2 days ago in reply to Jenny Zhou

TI__Guru 57591 points

Jenny Zhou said:
I'm curious about how it was achieved. Since after reading SBL code, I saw, after 'Bootloader_socAuthImage', '

As I mentioned, this API requests the SYSFW, running on the DMSC core, for authentication of the image. If the SYSFW returns ACK, it means the image is authenticated and optionally decrypted successfully.

Processors

Processors forum

AM6421: Can SBL use TI's BootLoader driver to decrypt the 'binary'?