AM2634: HSM Client TRNG only works once after power up

Tom Tatakis

Part Number: AM2634
Other Parts Discussed in Thread: AM2632-Q1, AM2632

Tool/software:

I am calling HsmClient_getRandomNum() as shown below. This code works once after a power up, but never works more than once. When it fails, I see this in the debugger console.

Cortex_R5_0: [HSM_CLIENT] New Client Registered with Client Id = 0
Cortex_R5_0:
Cortex_R5_0: [HSM_CLIENT] Get Random Number request NACKed by HSM server

If I call HsmClient_getRandomNum() twice after a power up, the first one works but not the second call. Note this is a 'power cycle'. Even if I reconnect with the debugger and start the program over without a power cycle, the call will fail. I have verified that HsmClient_config() is being called from SystemInit() and I included that source below as well (even though generated by syscfg). We are using API 10_02_00_13.

What am I missing with how this is supposed to be used? I have tried building the hsmclient example app but have yet to get it to build- it appears there is a missing include in the generated source files...

uint32_t length __attribute__((aligned(32))) = HSM_VALUE_SIZE_IN_BYTES;
uint8_t val[HSM_VALUE_SIZE_IN_BYTES] __attribute__((aligned(32)));
uint32_t s_uiRngDrbgSeed[HSM_SEED_SIZE_IN_DWORDS]  __attribute__((aligned(32))) = {0x949db311, 0x1b53c4bf, 0x1d6cb9de, 0x75c85f23,
                            0xfe6bfe37, 0xae1c6462, 0x9e45f958, 0x62493581,
                            0x8b5df32b, 0x7bc94d49, 0xa8e69e31, 0x9237ca9f} ;
extern HsmClient_t gHSMClient;
int32_t hsmGetRandomNumber(uint8_t *pRandomBytes, uint32_t uiNumBytes)
{
    int32_t iResult;
    RNGReq_t getRNG;

    iResult= -1;
    length= HSM_VALUE_SIZE_IN_BYTES;
    memset(val,0,sizeof(val));
    if (pRandomBytes != NULL)
    {
        getRNG.DRBGMode = 0x5A;
        getRNG.seedSizeInDWords = HSM_SEED_SIZE_IN_DWORDS;
        getRNG.seedValue = (uint32_t *)&s_uiRngDrbgSeed;
        getRNG.resultLengthPtr = &length;
        getRNG.resultPtr = (uint8_t *)val;

        iResult = HsmClient_getRandomNum(&gHSMClient, &getRNG);
        if (SystemP_SUCCESS == iResult)
        {
            if (uiNumBytes > HSM_VALUE_SIZE_IN_BYTES)
            {
                uiNumBytes= HSM_VALUE_SIZE_IN_BYTES;
            }
            memcpy(pRandomBytes, val, uiNumBytes);
            iResult= uiNumBytes;
        }
        else 
        {
            iResult= -1;
        }
    }
 
    return(iResult);
}

void HsmClient_config(void)
{
    SIPC_Params sipcParams;
    int32_t status;

    /* initialize parameters to default */
    SIPC_Params_init(&sipcParams);

    sipcParams.ipcQueue_eleSize_inBytes = SIPC_MSG_SIZE;
    sipcParams.ipcQueue_length = SIPC_QUEUE_LENGTH ;
    /* list the cores that will do SIPC communication with this core
    * Make sure to NOT list 'self' core in the list below
    */
    sipcParams.numCores = 1;
    sipcParams.coreIdList[0] = CORE_INDEX_HSM;

    /* specify the priority of SIPC Notify interrupt */
    sipcParams.intrPriority = 7U;


    /* This is HSM -> R5F queue */
    sipcParams.tx_SipcQueues[CORE_INDEX_HSM] = (uintptr_t)gQueue_SecureHostToHsm[0] ;
    sipcParams.rx_SipcQueues[CORE_INDEX_HSM] = (uintptr_t)gQueue_HsmToSecureHost[0] ;
    sipcParams.secHostCoreId[CORE_INDEX_SEC_MASTER_0] = CORE_ID_R5FSS0_0;

    /* initialize the HsmClient module */
    status = HsmClient_init(&sipcParams);
    HsmClient_SecureBootQueueInit(HSM_CLIENT_MSG_QUEUE_SIZE);
    DebugP_assert(status==SystemP_SUCCESS);

    /* register a hsm client to detect bootnotify message and keyring import from HSM */
    status = HsmClient_register(&gHSMClient, HSM_BOOT_NOTIFY_CLIENT_ID);
    DebugP_assert(status==SystemP_SUCCESS);
}

2 months ago

0 Nikhil Dasan 2 months ago

TI__Guru* 85086 points

Hi,

Are you using the same clientID for both the service calls?

The TIFS SDK has a reference example for HsmClient_getRandomNum(). Could you let me know if you have referred the same?

Thanks and Regards,

Nikhil Dasan

0 Tom Tatakis 2 months ago in reply to Nikhil Dasan

Intellectual 280 points

yes- same client ID for both service calls.

I do not have the TIFS SDK- nor can I find it. I used the example code in the mcu_plus_sdk_am263x_10_02_00_13 SDK.

Can you provide a link to the TIFS SDK?

0 Nikhil Dasan 2 months ago in reply to Tom Tatakis

TI__Guru* 85086 points

Please apply access for the TIFS SDK below

ti.com/secureresources/AM263X-RESTRICTED-SECURITY

Thanks and Regards,

Nikhil Dasan

0 Tom Tatakis 2 months ago in reply to Nikhil Dasan

Intellectual 280 points

I was able to download and build the rng_service/am263x/r5fss0-0_nortos example and run it on the CC dev kit board. I added a loop to call HsmClient_getRandomNum()

repeatedly and it works as expected. When I build that same code and run it on our board, the second call fails,

as do all subsequent calls. Our board runs all kinds of code so I'm fairly certain it's not a board issue. The difference

is that the CC Dev board has a AM2634 and our board has a AM2632-Q1. I did change the part in syscfg for our board when

I built it and everything looked good for the build. Are there some extra steps needed for the AM2632-Q1 part that need to happen?

0 Nikhil Dasan 2 months ago in reply to Tom Tatakis

TI__Guru* 85086 points

Hi,

Are you seeing this with only this service or any hsmclient service running twice causing this issue on your board?

Just to see if this is a service related issue or the ipc issue between R5 and HSM

Thanks and Regards,

Nikhil Dasan

0 Tom Tatakis 2 months ago in reply to Nikhil Dasan

Intellectual 280 points

I built and ran the TIFS hsm_getversion sample on the dev board with no issues (adding a loop to call successively). I rebuilt and ran on the board with the AM2632 and it hangs on the third call. It is hanging in HsmClient_SendAndRecv(), line 302, waiting on a semaphore. The output I see is

Cortex_R5_0:
Cortex_R5_0: [HSM_CLIENT] New Client Registered with Client Id = 0
Cortex_R5_0:
Cortex_R5_0: [HSM_CLIENT] New Client Registered with Client Id = 2
Cortex_R5_0: 0: [HSM CLIENT] TIFS-MCU 64bit version string = 0x0015501000a0000
Cortex_R5_0:
Cortex_R5_0: [HSM CLIENT] TIFS-MCU Information
Cortex_R5_0: [Soc Type] = AM263x
Cortex_R5_0: [Device Type] = HS-FS
Cortex_R5_0: [HSM Type] = HSM_V1
Cortex_R5_0: [Bin Type] = STANDARD
Cortex_R5_0: [TIFS-MCU Version] = 10.0.0
Cortex_R5_0: ***********
Cortex_R5_0: 1: [HSM CLIENT] TIFS-MCU 64bit version string = 0x0015501000a0000
Cortex_R5_0:
Cortex_R5_0: [HSM CLIENT] TIFS-MCU Information
Cortex_R5_0: [Soc Type] = AM263x
Cortex_R5_0: [Device Type] = HS-FS
Cortex_R5_0: [HSM Type] = HSM_V1
Cortex_R5_0: [Bin Type] = STANDARD
Cortex_R5_0: [TIFS-MCU Version] = 10.0.00.0
Cortex_R5_0: ***********

Here is the code with the loop modification in hsm_client_app.c (from the getversion sample).

#define APP_CLIENT_ID                  (0x02)
#define PARSED_VER_SIZE                (0X96)

/* Demo Application code on R5 */
void HsmClientApp_start(void)
{
    /* loop through and request get version from HSM */
    /* also calculate the time spent doing get version */
    int32_t status ;
    HsmClient_t client ;
    char parsedVer[PARSED_VER_SIZE];
    memset(parsedVer, '\0' , PARSED_VER_SIZE);
    HsmVer_t hsmVer;
    status = HsmClient_register(&client,APP_CLIENT_ID);
    DebugP_assert(status == SystemP_SUCCESS);

    for (uint32_t i=0; i<5; ++i)
    {
        status = HsmClient_getVersion(&client,&hsmVer,SystemP_WAIT_FOREVER);
        DebugP_assert(status == SystemP_SUCCESS);

        DebugP_log("%d: [HSM CLIENT] TIFS-MCU 64bit version string = 0x00%llx\r\n", i, hsmVer.HsmrtVer);
        DebugP_log("\r\n     [HSM CLIENT] TIFS-MCU Information");
        status = HsmClient_parseVersion(&hsmVer, parsedVer);
        DebugP_log(" %s\r\n***********\r\n", parsedVer);
    }
}

The syscfg for this as built and run on the AM2632 is below. The only things I change between the Dev kit and the AM2632 board is the --device option and --part option. For the dev kit, --device AM2634, --part AM263x

/**
* These arguments were used when this file was generated. They will be automatically applied on subsequent loads
* via the GUI or CLI. Run CLI with '--help' for additional information on how to override these arguments.
* @cliArgs --device "AM2632-Q1" --package "ZCZ" --part "AM2632-Q1" --context "r5fss0-0" --product "TIFS@07.03.01" --product "MCU_PLUS_SDK@07.03.01"
* @v2CliArgs --device "AM2632-Q1" --package "NFBGA (ZCZ)" --context "r5fss0-0" --product "TIFS@07.03.01" --product "MCU_PLUS_SDK@07.03.01"
* @versions {"tool":"1.18.0+3266"}
*/

/**
* Import the modules used in this configuration.
*/
const hsmclient = scripting.addModule("/drivers/hsmclient/hsmclient", {}, false);
const hsmclient1 = hsmclient.addInstance();
const clock = scripting.addModule("/kernel/dpl/clock");
const debug_log = scripting.addModule("/kernel/dpl/debug_log");
const dpl_cfg = scripting.addModule("/kernel/dpl/dpl_cfg");
const mpu_armv7 = scripting.addModule("/kernel/dpl/mpu_armv7", {}, false);
const mpu_armv71 = mpu_armv7.addInstance();
const mpu_armv72 = mpu_armv7.addInstance();
const mpu_armv73 = mpu_armv7.addInstance();
const mpu_armv74 = mpu_armv7.addInstance();
const mpu_armv75 = mpu_armv7.addInstance();
const mpu_armv76 = mpu_armv7.addInstance();
const mpu_armv77 = mpu_armv7.addInstance();
const mpu_armv78 = mpu_armv7.addInstance();
const mpu_armv79 = mpu_armv7.addInstance();
const default_linker = scripting.addModule("/memory_configurator/default_linker", {}, false);
const default_linker1 = default_linker.addInstance();
const general = scripting.addModule("/memory_configurator/general", {}, false);
const general1 = general.addInstance();
const region = scripting.addModule("/memory_configurator/region", {}, false);
const region1 = region.addInstance();
const section = scripting.addModule("/memory_configurator/section", {}, false);
const section1 = section.addInstance();
const section2 = section.addInstance();
const section3 = section.addInstance();
const section4 = section.addInstance();
const section5 = section.addInstance();
const section6 = section.addInstance();
const section7 = section.addInstance();
const section8 = section.addInstance();
const section9 = section.addInstance();
const section10 = section.addInstance();
const section11 = section.addInstance();
const section12 = section.addInstance();

/**
* Write custom configuration values to the imported modules.
*/
hsmclient1.$name = "CONFIG_HSMCLIENT0";

clock.timerInputClkHz = 200000000;
clock.clkSource = "SYS_CLK";

debug_log.enableLogZoneWarning = false;
debug_log.enableLogZoneError = false;
debug_log.enableUartLog = true;
debug_log.uartLog.$name = "CONFIG_UART0";
debug_log.uartLog.UART.$assign = "UART0";
debug_log.uartLog.UART.RXD.$assign = "UART0_RXD";
debug_log.uartLog.UART.TXD.$assign = "UART0_TXD";

mpu_armv71.$name = "CONFIG_MPU_REGION0";
mpu_armv71.size = 31;
mpu_armv71.attributes = "Device";
mpu_armv71.accessPermissions = "Supervisor RD+WR, User RD";
mpu_armv71.allowExecute = false;

mpu_armv72.$name = "CONFIG_MPU_REGION1";
mpu_armv72.size = 15;
mpu_armv72.accessPermissions = "Supervisor RD+WR, User RD";

mpu_armv73.$name = "CONFIG_MPU_REGION2";
mpu_armv73.baseAddr = 0x80000;
mpu_armv73.size = 15;
mpu_armv73.accessPermissions = "Supervisor RD+WR, User RD";

mpu_armv74.$name = "CONFIG_MPU_REGION3";
mpu_armv74.accessPermissions = "Supervisor RD+WR, User RD";
mpu_armv74.baseAddr = 0x70000000;
mpu_armv74.size = 21;
mpu_armv74.attributes = "Cached+Sharable";

mpu_armv75.$name = "CONFIG_MPU_REGION4";
mpu_armv75.size = 14;
mpu_armv75.baseAddr = 0x50D00000;
mpu_armv75.allowExecute = false;
mpu_armv75.attributes = "Device";

mpu_armv76.$name = "CONFIG_MPU_REGION5";
mpu_armv76.size = 14;
mpu_armv76.allowExecute = false;
mpu_armv76.baseAddr = 0x72000000;
mpu_armv76.attributes = "Device";

mpu_armv77.$name = "CONFIG_MPU_REGION6";
mpu_armv77.baseAddr = 0x701D0000;
mpu_armv77.size = 15;
mpu_armv77.attributes = "Device";
mpu_armv77.allowExecute = false;

mpu_armv78.$name = "CONFIG_MPU_REGION7";
mpu_armv78.baseAddr = 0x72000000;
mpu_armv78.size = 14;
mpu_armv78.attributes = "Device";
mpu_armv78.allowExecute = false;

mpu_armv79.$name = "CONFIG_MPU_REGION8";
mpu_armv79.baseAddr = 0x44000000;
mpu_armv79.size = 11;
mpu_armv79.attributes = "Cached+Sharable";

default_linker1.$name = "memory_configurator_default_linker0";

general1.$name = "CONFIG_GENERAL0";
general1.linker.$name = "TIARMCLANG0";

region1.$name = "MEMORY_REGION_CONFIGURATION0";
region1.memory_region.create(11);
region1.memory_region[0].type = "TCMA";
region1.memory_region[0].$name = "R5F_VECS";
region1.memory_region[0].size = 0x40;
region1.memory_region[0].auto = false;
region1.memory_region[1].type = "TCMA";
region1.memory_region[1].$name = "R5F_TCMA";
region1.memory_region[1].size = 0x7FC0;
region1.memory_region[2].type = "TCMB";
region1.memory_region[2].size = 0x8000;
region1.memory_region[2].$name = "R5F_TCMB";
region1.memory_region[3].$name = "SBL";
region1.memory_region[3].auto = false;
region1.memory_region[3].size = 0x40000;
region1.memory_region[4].$name = "OCRAM";
region1.memory_region[4].auto = false;
region1.memory_region[4].manualStartAddress = 0x70040000;
region1.memory_region[4].size = 0x40000;
region1.memory_region[5].type = "FLASH";
region1.memory_region[5].auto = false;
region1.memory_region[5].size = 0x80000;
region1.memory_region[5].$name = "FLASH";
region1.memory_region[6].$name = "USER_SHM_MEM";
region1.memory_region[6].auto = false;
region1.memory_region[6].manualStartAddress = 0x701D0000;
region1.memory_region[6].size = 0x4000;
region1.memory_region[6].isShared = true;
region1.memory_region[6].shared_cores = ["r5fss0-1","r5fss1-0","r5fss1-1"];
region1.memory_region[7].$name = "LOG_SHM_MEM";
region1.memory_region[7].auto = false;
region1.memory_region[7].manualStartAddress = 0x701D4000;
region1.memory_region[7].size = 0x4000;
region1.memory_region[7].isShared = true;
region1.memory_region[7].shared_cores = ["r5fss0-1","r5fss1-0","r5fss1-1"];
region1.memory_region[8].type = "CUSTOM";
region1.memory_region[8].$name = "RTOS_NORTOS_IPC_SHM_MEM";
region1.memory_region[8].auto = false;
region1.memory_region[8].manualStartAddress = 0x72000000;
region1.memory_region[8].size = 0x3E80;
region1.memory_region[8].isShared = true;
region1.memory_region[8].shared_cores = ["r5fss0-1","r5fss1-0","r5fss1-1"];
region1.memory_region[9].type = "CUSTOM";
region1.memory_region[9].$name = "MAILBOX_HSM";
region1.memory_region[9].auto = false;
region1.memory_region[9].manualStartAddress = 0x44000000;
region1.memory_region[9].size = 0x3CE;
region1.memory_region[9].isShared = true;
region1.memory_region[9].shared_cores = ["r5fss0-1","r5fss1-0","r5fss1-1"];
region1.memory_region[10].type = "CUSTOM";
region1.memory_region[10].$name = "MAILBOX_R5F";
region1.memory_region[10].auto = false;
region1.memory_region[10].manualStartAddress = 0x44000400;
region1.memory_region[10].size = 0x3CE;
region1.memory_region[10].isShared = true;
region1.memory_region[10].shared_cores = ["r5fss0-1","r5fss1-0","r5fss1-1"];

section1.load_memory = "R5F_VECS";
section1.group = false;
section1.$name = "Vector Table";
section1.output_section.create(1);
section1.output_section[0].$name = ".vectors";
section1.output_section[0].palignment = true;

section2.load_memory = "OCRAM";
section2.$name = "Text Segments";
section2.output_section.create(5);
section2.output_section[0].$name = ".text.hwi";
section2.output_section[0].palignment = true;
section2.output_section[1].$name = ".text.cache";
section2.output_section[1].palignment = true;
section2.output_section[2].$name = ".text.mpu";
section2.output_section[2].palignment = true;
section2.output_section[3].$name = ".text.boot";
section2.output_section[3].palignment = true;
section2.output_section[4].$name = ".text:abort";
section2.output_section[4].palignment = true;

section3.load_memory = "OCRAM";
section3.$name = "Code and Read-Only Data";
section3.output_section.create(2);
section3.output_section[0].$name = ".text";
section3.output_section[0].palignment = true;
section3.output_section[1].$name = ".rodata";
section3.output_section[1].palignment = true;

section4.load_memory = "OCRAM";
section4.$name = "Data Segment";
section4.output_section.create(1);
section4.output_section[0].$name = ".data";
section4.output_section[0].palignment = true;

section5.load_memory = "OCRAM";
section5.$name = "Memory Segments";
section5.output_section.create(3);
section5.output_section[0].$name = ".bss";
section5.output_section[0].output_sections_start = "__BSS_START";
section5.output_section[0].output_sections_end = "__BSS_END";
section5.output_section[0].palignment = true;
section5.output_section[1].$name = ".sysmem";
section5.output_section[1].palignment = true;
section5.output_section[2].$name = ".stack";
section5.output_section[2].palignment = true;

section6.load_memory = "OCRAM";
section6.$name = "Stack Segments";
section6.output_section.create(5);
section6.output_section[0].$name = ".irqstack";
section6.output_section[0].output_sections_start = "__IRQ_STACK_START";
section6.output_section[0].output_sections_end = "__IRQ_STACK_END";
section6.output_section[0].input_section.create(1);
section6.output_section[0].input_section[0].$name = ". = . + __IRQ_STACK_SIZE;";
section6.output_section[1].$name = ".fiqstack";
section6.output_section[1].output_sections_start = "__FIQ_STACK_START";
section6.output_section[1].output_sections_end = "__FIQ_STACK_END";
section6.output_section[1].input_section.create(1);
section6.output_section[1].input_section[0].$name = ". = . + __FIQ_STACK_SIZE;";
section6.output_section[2].$name = ".svcstack";
section6.output_section[2].output_sections_start = "__SVC_STACK_START";
section6.output_section[2].output_sections_end = "__SVC_STACK_END";
section6.output_section[2].input_section.create(1);
section6.output_section[2].input_section[0].$name = ". = . + __SVC_STACK_SIZE;";
section6.output_section[3].$name = ".abortstack";
section6.output_section[3].output_sections_start = "__ABORT_STACK_START";
section6.output_section[3].output_sections_end = "__ABORT_STACK_END";
section6.output_section[3].input_section.create(1);
section6.output_section[3].input_section[0].$name = ". = . + __ABORT_STACK_SIZE;";
section6.output_section[4].$name = ".undefinedstack";
section6.output_section[4].output_sections_start = "__UNDEFINED_STACK_START";
section6.output_section[4].output_sections_end = "__UNDEFINED_STACK_END";
section6.output_section[4].input_section.create(1);
section6.output_section[4].input_section[0].$name = ". = . + __UNDEFINED_STACK_SIZE;";

section7.load_memory = "OCRAM";
section7.$name = "Initialization and Exception Handling";
section7.output_section.create(3);
section7.output_section[0].$name = ".ARM.exidx";
section7.output_section[0].palignment = true;
section7.output_section[1].$name = ".init_array";
section7.output_section[1].palignment = true;
section7.output_section[2].$name = ".fini_array";
section7.output_section[2].palignment = true;

section8.load_memory = "USER_SHM_MEM";
section8.type = "NOLOAD";
section8.$name = "User Shared Memory";
section8.group = false;
section8.output_section.create(1);
section8.output_section[0].$name = ".bss.user_shared_mem";
section8.output_section[0].alignment = 0;

section9.load_memory = "LOG_SHM_MEM";
section9.$name = "Log Shared Memory";
section9.group = false;
section9.type = "NOLOAD";
section9.output_section.create(1);
section9.output_section[0].$name = ".bss.log_shared_mem";
section9.output_section[0].alignment = 0;

section10.load_memory = "RTOS_NORTOS_IPC_SHM_MEM";
section10.type = "NOLOAD";
section10.$name = "IPC Shared Memory";
section10.group = false;
section10.output_section.create(1);
section10.output_section[0].$name = ".bss.ipc_vring_mem";
section10.output_section[0].alignment = 0;

section11.load_memory = "MAILBOX_HSM";
section11.type = "NOLOAD";
section11.$name = "SIPC HSM Queue Memory";
section11.group = false;
section11.output_section.create(1);
section11.output_section[0].$name = ".bss.sipc_hsm_queue_mem";
section11.output_section[0].alignment = 0;

section12.load_memory = "MAILBOX_R5F";
section12.$name = "SIPC R5F Queue Memory";
section12.group = false;
section12.type = "NOLOAD";
section12.output_section.create(1);
section12.output_section[0].$name = ".bss.sipc_secure_host_queue_mem";
section12.output_section[0].alignment = 0;

0 Nikhil Dasan 2 months ago in reply to Tom Tatakis

TI__Guru* 85086 points

Hi,

Let me look into this and get back to you early next week.

Thanks and regards

Nikhil Dasan

0 AJ Favela 23 days ago in reply to Nikhil Dasan

TI__Prodigy 480 points

Hi Tom,

I apologize for the late response as the expert has been occupied with other work. Do you still require help?

If so it may take some time for our experts to respond

Kind regards,

AJ Favela

0 Tom Tatakis 22 days ago in reply to AJ Favela

Intellectual 280 points

Yes, this is still an issue. We have applied a work around for he time being but would like to get this resolved.

0 AJ Favela 22 days ago in reply to Tom Tatakis

TI__Prodigy 480 points

I see, let me reassign this to a different expert. I appreciate your patience with this

0 Nikhil Dasan 11 hours ago in reply to AJ Favela

TI__Guru* 85086 points

Hi Tom,

Sorry for the delay here,

I was able to recreate this at my end with SDK 10.1 HSFS, but was not able to see on HSSE.

In the latest SDK 11.0, I was not able to reproduce the on HSFS, considering many firewall fixes that went in to the TIFS firmware on the HSFS side.

Could you try the same on the latest SDK and let me know if you are facing this issue.

More details in the e2e below

(+) AM2634: HSM Client TRNG only works once after power up - Arm-based microcontrollers forum - Arm-based microcontrollers - TI E2E support forums

Thanks and Regards,

Nikhil Dasan