u-boot/doc/README.ti-secure

1 README on how boot images are created for secure TI devices
4 Secure TI devices require a boot image that is authenticated by ROM
7 a secure device from TI, the initial public software image must be signed
11 from Texas Instruments. The tools used to generate boot images for secure
12 devices are part of a secure development package (SECDEV) that can be
17 The secure development package is access controlled due to NDA and export
22 Booting of U-Boot SPL
25 	When CONFIG_TI_SECURE_DEVICE is set, the U-Boot SPL build process
31 	warning is issued during the build to indicate that a final secure
36 	${TI_SECURE_DEV_PKG}/scripts/create-boot-image.sh
38 	This is called as part of the SPL/u-boot build process. As the secure
39 	boot image formats and requirements differ between secure SOC from TI,
43 	The script is basically the only required interface to the TI SECDEV
44 	package for creating a bootable SPL image for secure TI devices.
46 	Invoking the script for AM33xx Secure Devices
49 	create-boot-image.sh \
55 		SPI_X-LOADER - Generates an image for SPI flash (byte swapped)
56 		X-LOADER - Generates an image for non-XIP flash
57 		MLO - Generates an image for SD/MMC/eMMC media
58 		2ND - Generates an image for USB, UART and Ethernet
59 		XIP_X-LOADER - Generates a single stage u-boot for NOR/QSPI XiP
63 	either u-boot-spl.bin or u-boot.bin).
65 	<OUTPUT_FILE> is the full path and filename of the final secure
67 	non-secure binary images (see the platform-specific user's guides and
68 	releases notes for how the non-secure images are typically used)
69 	u-boot-spl_HS_SPI_X-LOADER - byte swapped boot image for SPI flash
70 	u-boot-spl_HS_X-LOADER - boot image for NAND or SD/MMC/eMMC rawmode
71 	u-boot-spl_HS_MLO - boot image for SD/MMC/eMMC media
72 	u-boot-spl_HS_2ND - boot image for USB, UART and Ethernet
73 	u-boot_HS_XIP_X-LOADER - boot image for NOR or QSPI Xip flash
78 	Invoking the script for AM43xx Secure Devices
81 	create-boot-image.sh \
87 		SPI_X-LOADER - Generates an image for SPI flash (byte
89 		XIP_X-LOADER - Generates a single stage u-boot for
91 		ISSW - Generates an image for all other boot modes
95 	either u-boot-spl.bin or u-boot.bin).
97 	<OUTPUT_FILE> is the full path and filename of the final secure
99 	non-secure binary images (see the platform-specific user's guides and
100 	releases notes for how the non-secure images are typically used)
101 	u-boot-spl_HS_SPI_X-LOADER - byte swapped boot image for SPI flash
102 	u-boot_HS_XIP_X-LOADER - boot image for NOR or QSPI flash
103 	u-boot-spl_HS_ISSW - boot image for all other boot media
108 	Invoking the script for DRA7xx/AM57xx Secure Devices
111 	create-boot-image.sh <IMAGE_TYPE> <INPUT_FILE> <OUTPUT_FILE>
116 		X-LOADER - Generates an image for NOR or QSPI boot modes
117 		MLO - Generates an image for SD/MMC/eMMC boot modes
118 		ULO - Generates an image for USB/UART peripheral boot modes
119 		Note: ULO is not yet used by the u-boot build process
122 	loader binary file (for this platform, this is always u-boot-spl.bin).
124 	<OUTPUT_FILE> is the full path and filename of the final secure image.
126 	non-secure binary images (see the platform-specific user's guides
127 	and releases notes for how the non-secure images are typically used)
128 	u-boot-spl_HS_MLO - boot image for SD/MMC/eMMC. This image is
132 		non-secure devices)
133 	u-boot-spl_HS_X-LOADER - boot image for all other flash memories
136 	Invoking the script for Keystone2 Secure Devices
139 	create-boot-image.sh \
145 	loader binary file (only u-boot.bin is currently supported on
146 	Keystone2 devices, u-boot-spl.bin is not currently supported).
148 	<OUTPUT_FILE> is the full path and filename of the final secure image.
150 	non-secure binary images (see the platform-specific user's guides
151 	and releases notes for how the non-secure images are typically used)
152 	u-boot_HS_MLO - signed and encrypted boot image that can be used to
153 		boot from all media. Secure boot from SPI NOR flash is not
156 Booting of Primary U-Boot (u-boot.img)
160 	which is the main u-boot image. For secure TI devices, the SPL will
162 	device's ROM boot process. In order to continue the secure boot
163 	process, the authenticated SPL must authenticate the main u-boot
166 	The configurations for secure TI platforms are written to make the boot
167 	process use the FIT image format for the u-boot.img (CONFIG_SPL_FRAMEWORK
169 	components that the SPL loads include a specific DTB image and u-boot
171 	process. In order to secure these components so that they can be
173 	build procedure for secure TI devices will secure these images before
175 	from the FIT image at boot time, they are post-processed to verify that
176 	they are still secure. The outlined security-related SPL post-processing
178 	must be enabled for the secure boot scheme to work. In order to allow
179 	verifying proper operation of the secure boot chain in case of successful
180 	authentication messages like "Authentication passed: CERT_U-BOOT-NOD" are
189 	${TI_SECURE_DEV_PKG}/scripts/secure-binary-image.sh
191 	This is called as part of the u-boot build process. As the secure
192 	image formats and requirements can differ between the various secure
194 	details. This script is essentially the only required interface to the
195 	TI SECDEV package for creating a u-boot.img image for secure TI
198 	The SPL/u-boot code contains calls to dedicated secure ROM functions
201 	is that they are accessed by invoking an ARM secure monitor call to
202 	the device's secure ROM (fixed read-only-memory that is secure and
203 	only accessible when the ARM core is operating in the secure mode).
205 	Invoking the secure-binary-image script for Secure Devices
208 	secure-binary-image.sh <INPUT_FILE> <OUTPUT_FILE>
212 	<OUTPUT_FILE> is the full path and filename of the output secure image.