TDA4VM: How to keywrite with a custom key.

youngwoo lee

Part Number: TDA4VM

I'm doing key programming. I succeeded keywriting with Ti dummy key.

I used keys (k3_dev_mpk.pem, k3_dev_mek.txt, ti_fek_public.pem from Ti korea, ti-fs-keywriter-j721e.bin from Ti korea) for Ti dummy key.

I tried to generate a custom keys so I used command "gen_keywr_cert.sh -g".

That creates some files(aes256.key, smek.key, smpk.pem) and I copied ti_fek_public.pem to keys/tifekpub.pem.

Finally, I get keywrite app but it has error.

Could you tell me reason?

Thank you.

over 2 years ago

0 Keerthy J over 2 years ago

TI__Guru**** 162770 points

Hi,

http://downloads.ti.com/tisci/esd/latest/2_tisci_msgs/security/keywriter.html#sec-api-keywr-program-keys

So the debug response 0x200000 points to bit 21 set & hence the inference above.

https://software-dl.ti.com/jacinto7/esd/processor-sdk-rtos-jacinto7/08_00_00_12/exports/docs/pdk_jacinto_08_00_00_37/docs/userguide/jacinto/modules/keywriter.html#debugging

Replace custom keys in the above steps.

Regards,
Keerthy

0 youngwoo lee over 2 years ago in reply to Keerthy J

Intellectual 560 points

I'd like to use custom keys not ti dummy key.

I checked to boot with ti dummy key.

Q1. How can I create smpk, smek keys?

Thank you.

0 Keerthy J over 2 years ago in reply to youngwoo lee

TI__Guru**** 162770 points

youngwoo lee said:
Q1. How can I create smpk, smek keys?

Hi,

Please take a look at this:

./gen_keywr_cert.sh -g will generate dummy keys for testing, in keys/ folder

Have you tried the above?

- Keerthy

0 youngwoo lee over 2 years ago in reply to Keerthy J

Intellectual 560 points

Hi,

I created the custom keys below command.

./gen_keywr_cert.sh -g will generate dummy keys for testing, in keys/ folder

I think that smpk, smek which are created with "./gen_keywr_cert.sh -g" are custom keys and coping k3_dev_mpk.pem, k3_dev_mek.txt is ti dummy keys.

I keywrited with ti dummy keys but custom keys failed.

Could you guide full process(command) creating custom keys?

Thank you.

0 Suman Anna over 2 years ago in reply to youngwoo lee

TI__Guru** 111595 points

Hi Youngwoo,

The sequence of KeyWriter programming is exactly the same between TI Dummy Keys and using some custom keys.

The ./gen_keywr_cert.sh -g command is already generating some random custom keys. I am not sure if you are asking for specific commands to generate a random SMPK and SMEK, or if you already have some keys and trying to use them. Please give the exact command(s) you followed on the SDK.

The overall process is described in the OTP KeyWriter section of the PDK documentation. The following are high-level steps.

1. Generate keys. The <PDK>/packages/ti/boot/keywriter/scripts/keys folder will have the keys that the build uses. Please ensure you retain these keys, as these are needed to sign your bootloader and other binaries once a device is converted to HS-SE.

2. Ensure the KeyWriter TIFS image and ti_fek_public.pem are copied into the appropriate locations under the <PDK>/packages/ti/boot/keywriter folder

3. Generate the KeyWriter certificate using the gen_keywr_cert.sh script with the appropriate arguments for the fuses you want to program.

4. Generate the keywriter image.

If you have already converted a sample from HS-FS to HS-SE using TI Dummy Keys (or any other keys), you cannot run KeyWriter again to program a different set of SMPK/SMEK/BMPK/BMEK keys.

regards

Suman

0 youngwoo lee over 2 years ago in reply to Suman Anna

Intellectual 560 points

Hi,

Suman Anna said:
The ./gen_keywr_cert.sh -g command is already generating some random custom keys

-> Can I use this random custom keys for product?

Suman Anna said:
1. Generate keys. The <PDK>/packages/ti/boot/keywriter/scripts/keys folder will have the keys that the build uses. Please ensure you retain these keys, as these are needed to sign your bootloader and other binaries once a device is converted to HS-SE.

Suman Anna said:
2. Ensure the KeyWriter TIFS image and ti_fek_public.pem are copied into the appropriate locations under the <PDK>/packages/ti/boot/keywriter folder

-> I appropriately copied the ti_fek_public.pem and ti-fs-keywriter-j721e.bin that are used in ti dummy keys.

Suman Anna said:
Generate the KeyWriter certificate using the gen_keywr_cert.sh script with the appropriate arguments for the fuses you want to program.