The workflow for the DDR and DDR-less systems is nearly identical. The only difference is that for systems with the DDR, FSBL copies the entire bitstream partition (bitstream and authentication certificates) to the DDR from the FLASH devices, because DDR is faster to access. FSBL then, each time, copies a chunk of bitstream from the DDR. For the DDR-less systems, FSBL copies a chunk of bitstream directly from the FLASH devices.
The following is the software workflow for authenticating the bitstream:
- FSBL identifies the availability of the DDR on the system based on the XFSBL_PS_DDR macro. FSBL has two buffers in OCM, ReadBuffer buffer of size 56 KB and HashsOfChunks to store intermediate hashs calculated for each 56 KB of 8 MB blocks.
- FSBL copies a 56 KB chunk from the first 8 MB block to ReadBuffer.
- FSBL calculates hash on 56 KB and stores in HashsOfChunks.
- FSBL repeats the previous steps until the entire 8 MB of block is completed.Note: 56 KB is taken for performance; it can be of any size.
- FSBL authenticates the bitstream.
- Once the authentication is successful, FSBL starts copying 56 KB starting from the first block which is located in DDR/FLASH to ReadBuffer, calculates the hash, and then compares it with the hash stored at HashsOfChunks.
- If hash comparison is successful, FSBL transmits data to PCAP through DMA (for unencrypted bitstream) or AES (if encryption is enabled).
- FSBL repeats the previous two steps until the entire 8 MB block is completed.
- Repeats the entire process for all the blocks of bitstream.
The bitstream is directly routed to PCAP through CSU DMA by configuring secure stream switch.
For a DDR system, the whole encrypted bitstream is copied to DDR. For DDR-less system, decryption is copied to OCM(TF-A section) in chunks.