• State
  • Replies 3 replies
  • Subscribers 31 subscribers
  • Views 58 views
  • Users 0 members are here
Support feedback
Options
Options
Related

AM263PX-MCAL-SDK: AM263PX HSM_CLIENT Call Issue

Addison Audette
Prodigy 135 points
Part Number: AM263PX-MCAL-SDK


I am running SDK version 11_00_00_19 and TIFS version 11_00_00_01 and have flashed my keys to my board and converted it to HS_SE mode and can validate that the hashes of the keys on the board are what is expected. 

I have been able to flash and run multiple different applications - all of the AES provided examples from the SDK in addition an application I wrote seperatly. 

A few weeks ago I was working on an AM263P board and was able to write and execute code that called upon the proc_auth_boot hsm client to validate an image and it executed correctly. I just started over with a new AM263PX board and have been able to execute everything but any HSM_Client Calls. 

Calling proc_auth_boot (HsmClient_procAuthBoot) fails with the  [HSM_CLIENT] Proc_Auth_Boot request NACKed by HSM server error but I can validate that is is reading the certificate and image in flash correctly before that call is made. 

Also running an SBL that disables the HSM debug firewall with the certificate generated for my board returns this error:

[HSM_CLIENT] OpenDbgFirewall request NACKed by HSM server

Starting OSPI Bootloader ... 
SBL failed!!

 In addition - running the hsm_services example executed correctly without any issues.

Is there anything I should look into specifically to resolve this problem or is there something I am overlooking?

  • 0
    Prodigy 135 points

    Update: through tracing I found it is failing at line 1467 of tifs_am263px_11_00_00_01\source\modules\cert_auth\asn1_parse.c

    For more insight on when this is being called here is the path traced out:

    ASN1p_end (the function failing) is being called by  ASN1P_public_key_info ~called by~ ASN1P_tbs_certificate ~called by~ ASN1P_parseX509Cert ~called by~ Cert_Auth_validateCertAgainstKey ~called by~ SEC_DBG_handleOpenDebugReq

    Does anyone have any insight at what this means in wrong? The certificate that it is validating is created using my root of trust private key. 

  • 0 in reply to Addison Audette
    TI__Guru* 87236 points

    Hi Addison,

    Addison Audette said:
    I just started over with a new AM263PX board and have been able to execute everything but any HSM_Client Calls. 

    On the new board, can you confirm if your device is in HS-SE state with the same keys as the previous board?

    The parsing typically fails if the ROT keys mismatch. 

    Thanks and Regards,

    Nikhil Dasan

  • 0 in reply to Nikhil Dasan
    Prodigy 135 points

    I confirmed it is in HS-SE with the same keys