The k3_gen_x509_cert.sh script produced this warning on gitlab and also
on my machine, e.g. with j7200_evm_r5:
awk: cmd. line:1: warning: regexp escape sequence `\ ' is not a known
regexp operator
There is no need to escape spaces, so drop the backslashes. Also split
the line so it is a more reasonable length.
This script should really be deleted and binman used instead.
Signed-off-by: Simon Glass <sjg@chromium.org>
The x509 certificate SWRV is currently hard-coded to 0. This need to be
updated to 1 for j721e 1.1, j7200 and am64x. It is don't care for other
k3 devices.
Added new config K3_X509_SWRV to k3. Default is set to 1.
Signed-off-by: Yogesh Siraswar <yogeshs@ti.com>
Reviewed-by: Dave Gerlach <d-gerlach@ti.com>
When authenticating the initial boot binary the ROM will check a debug
type value in the certificate and based on that open JTAG access to that
core. This only effects HS devices as non-HS device ROM allows JTAG
by default.
This can be useful for HS developers working in the early boot stage,
before SYSFW is loaded. After that point the JTAG access can be
changed based on board configurations passed to SYSFW.
This access can also be a large security problem as JTAG access on
HS devices can be used to circumvent the chain-of-trust controls.
Accidentally leaving this open defeats the security on HS, due to this
change the default to disabled.
This should only effect those working on early HS boot code, which
is a limited crowd who will already know how to re-enable this access
as needed.
Signed-off-by: Andrew F. Davis <afd@ti.com>
When authenticating the initial boot binary the ROM will check a debug
type value in the certificate and based on that open JTAG access to that
core.
Make this selectable in the signing tool to allow it to be enabled or
disabled based on user command line input.
This does not change the default behavior.
Signed-off-by: Andrew F. Davis <afd@ti.com>
TI's K3 boot architecture mandates a x509 certificate for every boot image.
While signing the image K3 ROM allows for two types of keys based on which
the boot image gets loaded in different ways:
- Degenerate RSA keys: This generates a signature which is equal to the digest.
When ROM sees this, it does a DMA for copying the images,
which significantly improves the boot time.
- Any other key: Does a memcpy to load the image. This is introduced as a
fallback for DMA copy.
Add a script for generating boot images with the above options. Default
generates image using rsa degenerate key in order to improve boot time.
Signed-off-by: Lokesh Vutla <lokeshvutla@ti.com>
Signed-off-by: Dave Gerlach <d-gerlach@ti.com>
Signed-off-by: Andreas Dannenberg <dannenberg@ti.com>
