LP-AM261: MPU/HSM related

Hi Adwaith,

I have a few questions:

1. This is not a modified SBL, rather a tertiary bootloader, which is loaded by SBL, right? If so, we call Bootloader_verifyMulticoreImage() once from SBL before loading Tertiary Bootloader and once we call Bootloader_verifyMulticoreImage() from the tertiary bootloader. I'm verifying with the Security team if there are any issues with calling this API twice.

2. Since the code gets stuck at HsmClient_SendAndRecv(), i believe the HSM is not responding and hitting timeout. Is the HsmRt loaded correctly in the SBL?

Regards,
Shaunak

Hi Shaunak,

1.This is not a modified SBL , a tertiary one, but i was trying to use the bootloader related calls to get firmware image verified, In case if it can't be used, can you please suggest what function should I use in this case, that is readily available, iam also not using keyring . Iam also adding a bootloader Initialization like wise in sbl so that i can use the available Bootloader verification function which uses bootloader structures.

2.The sequence flow is like...  initally sbl gets the signed tertiary bootloader verified by using HSMRT loaded into the HSM core and then after verification it jumps from the sbl to bootloader , already sbl loads the hsmrt into hsm and NO power on reset is given ,So HSMRT is present. Also verified by loading a version read example by halting bootloader via debug

To get an idea iam adding a code snippet  iam using please have a look and check if this can be utilized like this, 

#--------------------------------------------------------------------------------------------------------------------------------------------------------------------

Thanks and Regards

Adwaith

Hi Shaunak,

I want to clarify one more doubt along with the previously mentioned ones, Is there any kind of maximum size limitation for the image (non sbl), so that if it exceeds it may affect the verification

Thanks and Regards

Adwaith

Hi Adwaith, no there is no limitation as such for image size as long as you process it in chunks as done in the SBL's case. Do you have anymore findings on where exactly it is failing in the Bootloader_verifyMulticoreImage() API, looks like the communication between the HSM core and R5F core might not be happening properly since it gets stuck in HsmClient_SendAndRecv()

Regards,
Shaunak

Hi Shaunak,

I am able to verify the image, Initially while bootloader is loaded iam having one MPU setting which supports USB flashing.The MPU settings are changed to support verification as per SDK exapmle just before verification is going to happen, in this way i was able to flash the image and then verify it.

I avoided altering the current general MPU setting for bootloader and just changes it only when verification is needed. 

please suggest if there is another better way or Is there any security risk involved in this approach 

For now my issue is resolved

Thanks and Regards

Adwaith

Hi Adwaith, 

Glad to know it is working now. Based on what we discussed on call yesterday, I had a look at both the MPU configs and I've tried to unify both of them.

const MpuP_RegionConfig gMpuRegionConfigUnified[CONFIG_MPU_UNIFIED_NUM_REGIONS] RODATA_CFG_SECTION =
  {
      {
          // Region 0: Default region (2GB)
          .baseAddr = 0x0u,
          .size = MpuP_RegionSize_2G,
          .attrs = {
              .isEnable = 1,
              .isCacheable = 0,
              .isBufferable = 0,
              .isSharable = 1,
              .isExecuteNever = 1,
              .tex = 0,
              .accessPerm = MpuP_AP_S_RW_U_R,
              .subregionDisableMask = 0x0u
          },
      },
      {
          // Region 1: TCMA (128KB)
          .baseAddr = 0x0u,
          .size = MpuP_RegionSize_128K,
          .attrs = {
              .isEnable = 1,
              .isCacheable = 1,
              .isBufferable = 1,
              .isSharable = 0,
              .isExecuteNever = 0,
              .tex = 1,
              .accessPerm = MpuP_AP_S_RW_U_R,
              .subregionDisableMask = 0x0u
          },
      },
      {
          // Region 2: TCMB (128KB)
          .baseAddr = 0x80000u,
          .size = MpuP_RegionSize_128K,
          .attrs = {
              .isEnable = 1,
              .isCacheable = 1,
              .isBufferable = 1,
              .isSharable = 0,
              .isExecuteNever = 0,
              .tex = 1,
              .accessPerm = MpuP_AP_S_RW_U_R,
              .subregionDisableMask = 0x0u
          },
      },
      {
          // Region 3: OCRAM - 2MB - IMPORTANT: Always set as shareable for HSM communication
          .baseAddr = 0x70000000u,
          .size = MpuP_RegionSize_2M,
          .attrs = {
              .isEnable = 1,
              .isCacheable = 1,
              .isBufferable = 1,
              .isSharable = 1, // Always set to 1 for HSM to work
              .isExecuteNever = 0,
              .tex = 1,
              .accessPerm = MpuP_AP_S_RW_U_R,
              .subregionDisableMask = 0x0u
          },
      },
      {
          // Region 4: USB/DMA Buffer Region at 0x70100000 (32KB)
          .baseAddr = 0x70100000u,
          .size = MpuP_RegionSize_32K,
          .attrs = {
              .isEnable = 1,
              .isCacheable = 0,
              .isBufferable = 0,
              .isSharable = 1,
              .isExecuteNever = 1,
              .tex = 1,
              .accessPerm = MpuP_AP_ALL_RW,
              .subregionDisableMask = 0x0u
          },
      },
      {
          // Region 5: HSM DTHE region (16MB) - Required for image verification
          .baseAddr = 0xCE000000u,
          .size = MpuP_RegionSize_16M,
          .attrs = {
              .isEnable = 1,
              .isCacheable = 0,
              .isBufferable = 0,
              .isSharable = 1,
              .isExecuteNever = 1,
              .tex = 0,
              .accessPerm = MpuP_AP_ALL_RW,
              .subregionDisableMask = 0x0u
          },
      },
      {
          // Region 6: USB Controller (Optional, can add if needed)
          .baseAddr = 0x53900000u, // USB_OTGSS_C2_U_BASE
          .size = MpuP_RegionSize_64K,
          .attrs = {
              .isEnable = 1,
              .isCacheable = 0,
              .isBufferable = 0,
              .isSharable = 1,
              .isExecuteNever = 1,
              .tex = 0,
              .accessPerm = MpuP_AP_ALL_RW,
              .subregionDisableMask = 0x0u
          },
      },
  };

Can you try to use this config for both USB image receiving and image verification.

Regards,
Shaunak