• State
  • Replies 7 replies
  • Subscribers 30 subscribers
  • Views 156 views
  • Users 0 members are here
Support feedback
Options
Options
Similar topics

AM2434: AM2434: Secure Boot Implementation on AM2434 (HS-FS to HS-SE Conversion)

surabhi jain
Prodigy 55 points
Part Number: AM2434
Other Parts Discussed in Thread: AM623

Tool/software:

Hi Team,

I am working with the AM2434 board and need to implement a secure boot. My device is currently in HS-FS (High-Security Field Securable) mode, and I need to convert it to HS-SE (High-Security Secure Enforced) by flashing the key to the eFuse via the OTP keywriter as mentioned in AM243x LaunchPadTm Development Kit User's Guide (https://www.ti.com/lit/ug/spruj12f/spruj12f.pdf?ts=1740912264989&ref_url=https%253A%252F%252Fwww.google.com%252F) on page 9.

I would like confirmation on whether my understanding is correct:

  1. The HS-FS device can be converted to HS-SE by programming the necessary keys into eFuse.
  2. The images for secure boot should be built using the same key that is flashed into eFuse.

If my understanding is correct, could you please provide guidance on:

  1. The exact process to flash the key into eFuse – is there any specific TI software/tool available for this purpose?
  2. The steps to build secure boot images with this key.

Any official documentation, example procedures, or recommendations would be highly appreciated.

I find similar process for AM623 on below link.

 https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1472425/am623-secure-boot-implementation-on-am62x-evm-hs-fs-to-hs-se-conversion/5657054?tisearch=e2e-sitesearch&keymatch=how%20to%20convert%20HS-FS%20to%20HS-SE%20images%20AM2434#5657054 

Thank you for your support.

  • 0
    TI__Guru 56591 points

    Hello,

    Please go through the OTP Keywriter tool and guide available on the following secure portal:

    www.ti.com/.../AM243X-RESTRICTED-SECURITY

    Please request access to the portal using the following link:

    www.ti.com/.../AM243X-RESTRICTED-SECURITY

    Regards,

    Prashant

  • 0 in reply to Prashant Shivhare
    Prodigy 55 points

    Hi,

    Thanks for sharing the link.

    I have one more query - 

    We are developing our customized board using LP-AM243x, using IND - SDK version 9.02.00.15 https://www.ti.com/tool/IND-COMMS-SDK  for EtherNET/IP application and for flashing the firmware in UART boot mode have to change this switch (flashing - 1,2,3 -ON, and for running the application 2,6 - ON)

     

    Is there any other way to flash the firmware - 

    1) firmware upgrade over Ethernet. If yes then how can we do.

    2) firmware upgrade over UART but without changing boot mode switch.

    Because in our customized board we don't want to populate boot mode switch. It should be fixed in one position for both flashing and application running condition.

    Thanks.

  • 0 in reply to surabhi jain
    TI__Guru 56591 points

    Hello,

    The SDK does not have the support for flashing over Ethernet.

    As for the bootmode switches, I believe you are using OSPI bootmode for booting your application. In that case, you should have a reliable way for switching between the bootmodes for flashing and booting at least in the development phase.

    Regards,

    Prashant 

  • 0 in reply to Prashant Shivhare
    Prodigy 55 points

    Hi,

    I have downloaded the above mentioned tool and exe. 

    I am using SDK version - mcu_plus_sdk_am243x_09_01_00_41 and otp key writer version - 9.01.00.

    https://www.ti.com/secureresources/AM243X-RESTRICTED-SECURITY

    As mentioned in the user guide AM64X_AM243X_OTP_Keywriter_User_Guide_09_01_00.pdf I am following the steps. 

    During build process I am getting below error - 

    Boot image: am243x:r5fss0-0:nortos:ti-arm-clang C:/TI/mcu_plus_sdk_am243x_09_01_00_41/source/security/sbl_keywriter/am243x-lp/r5fss0-0_nortos/ti-arm-clang/sbl_keywriter.debug.tiimage ...
    makefile:212: recipe for target 'sbl_keywriter.debug.tiimage' failed
    gmake: *** [sbl_keywriter.debug.tiimage] Error 1

    Could you please help me to resolve this error.

    Thanks.

  • 0 in reply to surabhi jain
    TI__Guru 56591 points

    Hello,

    Please share the build output of the make command without the "-s" flag.

    Thanks!

  • 0 in reply to Prashant Shivhare
    Prodigy 55 points

    Hi,

    Please find attached file

    outputfile.txt
    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang>gmake -j PROFILE=debug
    Generating SysConfig files ...
    C:/ti/sysconfig_1.18.0/nodejs/node C:/ti/sysconfig_1.18.0/dist/cli.js --product C:/TI/mcu_plus_sdk_am243x_09_01_00_41/.metadata/product.json --context r5fss0-0 --part ALX --package ALX --output generated/ ../example.syscfg
    Running script...
    Validating...
    info: CONFIG_UART1(/drivers/uart/uart) baudRate: Actual Baudrate Possible: 115385 (0 % error)
    info: /kernel/dpl/debug_log uartLog.baudRate: Actual Baudrate Possible: 115385 (0 % error)
    Generating Code (example.syscfg)...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_dpl_config.c...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_dpl_config.h...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_drivers_config.c...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_drivers_config.h...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_drivers_open_close.c...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_drivers_open_close.h...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_pinmux_config.c...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_power_clock_config.c...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_board_config.c...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_board_config.h...
    Writing C:\TI\mcu_plus_sdk_am243x_09_01_00_41\source\security\sbl_keywriter\am243x-lp\r5fss0-0_nortos\ti-arm-clang\generated\ti_board_open_close.c...
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Please let me know if you are looking for this file only or anything else.

    Thanks.

  • 0 in reply to surabhi jain
    TI__Guru 56591 points

    Hello,

    It looks the issue is originating from the powershell script execution. The script execution is possibly blocked on your system.

    Is there a reason for using v09_01_00?

    We have the OTP Keywriter v10.00.08 as well where this should should not occur. This keywriter version is meant to be used with MCU+ SDK v10_00_00_20.

    BR, Prashant