This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

TMDS64EVM: Is it possible to write a different image to 0x60000000 address in the sbl project?

Part Number: TMDS64EVM
Other Parts Discussed in Thread: SYSCONFIG

Hi TI Experts!

I know that there is authentication support for the application image on HS_FS devices. In fact, I think that the ability to turn this feature on and off has been brought to Sysconfig since the mcu_plus_sdk_08_00_06_45 version. The authentication part I mentioned is done in the Bootloader_parseMultiCoreAppImage() function in the {mcu_plus_sdk_path}/source/drivers/bootloader/bootloader.c source file, as I added below.

Fullscreen
1
2
3
4
5
6
7
8
9
10
11
12
13
14
Bootloader_MetaHeaderStart mHdrStr;
Bootloader_MetaHeaderCore mHdrCore[BOOTLOADER_MAX_INPUT_FILES];
/* Verify the multicore image if authentication is required */
if((Bootloader_socIsAuthRequired() == TRUE) && (config->isAppimageSigned == TRUE))
{
/* Device is HS, verify image. */
status = Bootloader_verifyMulticoreImage(handle);
}
else
{
/* Device is GP, no authentication required OR appimage is not signed, boot like GP */
status = SystemP_SUCCESS;
}
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

In order to find the certLoadAddr address value in case the boot device is BOOT_MEDIA_FLASH, the Bootloader_verifyMulticoreImage() function adds the application image offset value we specified in the Sysconfig->Bootloader section to the 0x60000000 address I specified in the title. In the continuation of this function, it performs operations on this certLoadAddr address to complete the authentication process. When I look at the address 0x60000000 + flashArgs->appImageOffset from the memory browser screen, I see that the application image is written.

I want to slightly change this file written to flash, write the changed file to 0x60000000 + flashArgs->appImageOffset and authenticate through the changed file. To do this, I opened a 128MB memory region at 0x60000000 in Sysconfig. I tried to change the application image at that address. However, halfway through the writing process, the values ​​at this address begin to reset. Additionally, this address is completely reset in the CacheP_wbInv() function within the BootloaderVerifyMulticoreImage() function. Such a situation does not occur during the normal boot process. I do not want this address to be reset after changing it. Is this possible?

Thanks

  • Hi Ahmet,

    This is not possible. The memory mapped OSPI address (0x60000000) is available for reading only & so writing can't be directly done.

    Regards,

    Prashant

  • Hi

    The memory mapped OSPI address (0x60000000) is available for reading only & so writing can't be directly done.

    OK, I understand. I guessed this, so I tried a different method. Accordingly, I wrote the application image for which I wanted to authenticate to a section in DDR(like 0xA4300000). Then I assigned this address value to the certLoadAddr value. (Just like the entire image is present in the address value 0x60000000 + flashArgs->appImageOffset).

    We know that the Bootloader_socAuthImage() function takes a certLoadAddr parameter.

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    int32_t Bootloader_verifyMulticoreImage(Bootloader_Handle handle)
    {
    int32_t status = SystemP_FAILURE, authStatus = SystemP_FAILURE;
    uint32_t certLen = 0U, imageLen = 0U;
    uint32_t certLoadAddr = 0xFFFFFFFFU;
    Bootloader_Config *config = (Bootloader_Config *)handle;
    if(config->fxns->imgReadFxn == NULL || config->fxns->imgSeekFxn == NULL)
    {
    status = SystemP_FAILURE;
    }
    else
    {
    uint8_t x509Header[4];
    if((config->bootMedia == BOOTLOADER_MEDIA_MEM) ||
    (config->bootMedia == BOOTLOADER_MEDIA_PCIE))
    {
    Bootloader_MemArgs *memArgs = (Bootloader_MemArgs *)(config->args);
    certLoadAddr = memArgs->appImageBaseAddr;
    }
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Even though I give the address of the application image as a parameter to Bootloader_socAuthImage() function, like the default SBL project, the pRespPrm->flags value returned from Sciclient_secProxyReadThread32() function in the Bootloader_socAuthImage() -> Sciclient_procBootAuthAndStart()->Sciclient_service()->function is 0 instead of 2. In this case the authentication operation fails.

    Why does this problem occur even though I give the address of the application image as a parameter to the Bootloader_socAuthImage() function?

    Thanks

  • Hi Ahmet,

    May I know how are you writing your custom appimage at the address 0xA4300000?The written appimage may be residing in cache & not in the actual memory which will explain why the authentication fails.

    Additionally, could you please share the appimage? I will once try it on my side & see if the authentication is failing.

    Regards,

    Prashant

  • Hi

    May I know how are you writing your custom appimage at the address 0xA4300000?The written appimage may be residing in cache & not in the actual memory which will explain why the authentication fails.

    Fullscreen
    1
    Flash_read(gFlashHandle[CONFIG_FLASH0], 0x140000 , (uint8_t *)DDR_APPIMAGE_ADDR, appimage_size)
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    0x140000 address is the flash address where the application image is located.

     The DDR_APPIMAGE_ADDRESS address where I will write the file is (0xA4300000)

    Additionally, could you please share the appimage? I will once try it on my side & see if the authentication is failing.

    In fact, you can do this by taking the prebuilt linux.appimage.hs_fs image in PSDK and moving it to DDR_APPIMAGE_ADDRESS after reading from flash, you can do this by giving this address as a parameter to the Bootloader_socAuthImage() function.  Since the function I mentioned is in the SDK, I implemented a few layer functions(like Bootloader_parseMultiCoreAppImage() and Bootloader_verifyMulticoreImage() ) again in the source code of my bootloader project.

    Thanks.

  • Hi Ahmet,

    Thank you for the details.

    I see you are reading the image from Flash to DDR. Have you made sure the Cache Writeback Invalidation is being performed to make sure the image is actually present in DDR before handing the control to System Firmware for authentication.

    I was also thinking about why do the reading manually. We can add a Bootloader instance in the Sysconfig to tell it where our custom appimage is flashed. Then you can simply call the `Bootloader_verifyMulticoreImage` function passing it the bootloader handle of your appimage. This way most of the reading & other things will be abstracted.

    Regards,

    Prashant

  • Hi

    Have you made sure the Cache Writeback Invalidation is being performed to make sure the image is actually present in DDR before handing the control to System Firmware for authentication.

    How can i be sure? After the  CacheP_wbInv((void *)certLoadAddr, cacheAlignedLen, CacheP_TYPE_ALL)
    function runs, the application imgae in the DDR is still there.

    I was also thinking about why do the reading manually.

    Because before writing to flash, I change the image a little and write it that way.

    Thanks...

  • Hi Ahmet,

    How can i be sure?

    A simple way is to connect to A53 core & read the DDR address just before handing the control over to System Firmware.

    Because before writing to flash, I change the image a little and write it that way.

    I am not sure if I am following here. Let me understand your use case here. What I understand is you have a signed image (not necessarily an appimage) & flashed already at the address 0x140000. Then you boot your SBL & at run time authenticate this flashed image before using it. The flow is basically same as the normal SBL booting an appimage flashed at the default address 0x80000.

    Please correct me if my understanding is somewhere wrong.

    Rerds,

    Prashant

  • Hi Prashant

    A simple way is to connect to A53 core & read the DDR address just before handing the control over to System Firmware.

    Isn't it enough to debug SBL and look at the DDR address from the memory browser tab?

    I am not sure if I am following here. Let me understand your use case here. What I understand is you have a signed image (not necessarily an appimage) & flashed already at the address 0x140000. Then you boot your SBL & at run time authenticate this flashed image before using it. The flow is basically same as the normal SBL booting an appimage flashed at the default address 0x80000.

    Yes actually, the only difference is that I gave the image address differently.

    Thanks.

  • Hi Ahmet,

    Isn't it enough to debug SBL and look at the DDR address from the memory browser tab?

    Not really sure. If the memory browser tab is using the core for reading the values then the value at a particular address may not really reflect if is actually present in the memory & not being read from the cache. If we use A53 core to read then it will make sure the values shown are really being read from the actual memory.

    Yes actually, the only difference is that I gave the image address differently.

    If this is the case then I have a successfully tested code. I make the following changes in the SBL OSPI's Sysconfig file which records an image flashed at 0x140000. The actual image I have flashed at this offset is Hello World HSFS appimage.

    Then, I have the following `test_func` included in the SBL OSPI's `main.c` file

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    void test_func()
    {
    DebugP_log("/* Begin testing */\r\n");
    Bootloader_BootImageInfo bootImageInfo;
    Bootloader_Params bootParams;
    Bootloader_Handle bootHandle;
    Bootloader_Params_init(&bootParams);
    Bootloader_BootImageInfo_init(&bootImageInfo);
    bootHandle = Bootloader_open(CONFIG_BOOTLOADER_FLASH1, &bootParams);
    Bootloader_Config* config = (Bootloader_Config*)bootHandle;
    DebugP_log("Flash image offset: 0x%x\r\n", ((Bootloader_FlashArgs*)(config->args))->appImageOffset);
    extern int32_t Bootloader_verifyMulticoreImage(Bootloader_Handle);
    int32_t status = Bootloader_verifyMulticoreImage(bootHandle);
    if(status == SystemP_SUCCESS) { DebugP_log("Image authentication successful!!\r\n"); }
    else { DebugP_log("Image authentication failed!!\r\n"); }
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    With these changes, I boot the SBL OSPI & it boots successfully with the below logs

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    DMSC Firmware Version 9.0.7--v09.00.07 (Kool Koala)
    DMSC Firmware revision 0x9
    DMSC ABI revision 3.1
    /* Begin testing */
    Flash image offset: 0x140000
    Image authentication successful!!
    /* End testing */
    [BOOTLOADER_PROFILE] Boot Media : NOR SPI FLASH
    [BOOTLOADER_PROFILE] Boot Media Clock : 166.667 MHz
    [BOOTLOADER_PROFILE] Boot Image Size : 0 KB
    [BOOTLOADER_PROFILE] Cores present :
    r5f0-0
    [BOOTLOADER PROFILE] SYSFW init : 12149us
    [BOOTLOADER PROFILE] System_init : 692us
    [BOOTLOADER PROFILE] Drivers_open : 277us
    [BOOTLOADER PROFILE] Board_driversOpen : 22068us
    [BOOTLOADER PROFILE] Sciclient Get Version : 9845us
    [BOOTLOADER PROFILE] CPU Load : 122407us
    [BOOTLOADER_PROFILE] SBL Total Time Taken : 167444us
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    As we can see in the logs, the authentication of the image at 0x140000 was successful & the control proceeds booting hello world appimage also flashed at 0x80000.

    Regards,

    Prashant

  • Hi Ahmet,

    Following your way, the following code snippet which uses the same `Flash_read` API to read image from Flash into DDR & then perform the authentication also works.

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    void test_func()
    {
    DebugP_log("/* Begin testing */\r\n");
    #define MAX_IMAGE_SIZE 28000
    #define DDR_APPIMAGE_ADDR 0xA4300000
    Flash_read(gFlashHandle[CONFIG_FLASH0], 0x140000, (uint8_t*)DDR_APPIMAGE_ADDR, MAX_IMAGE_SIZE);
    int32_t status = Bootloader_socAuthImage(DDR_APPIMAGE_ADDR);
    if(status == SystemP_SUCCESS) { DebugP_log("Image authentication successful!!\r\n"); }
    else { DebugP_log("Image authentication failed!!\r\n"); }
    DebugP_log("/* End testing */\r\n");
    }
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Fullscreen
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    MSC Firmware Version 9.0.7--v09.00.07 (Kool Koala)
    DMSC Firmware revision 0x9
    DMSC ABI revision 3.1
    /* Begin testing */
    Image authentication successful!!
    /* End testing */
    [BOOTLOADER_PROFILE] Boot Media : NOR SPI FLASH
    [BOOTLOADER_PROFILE] Boot Media Clock : 166.667 MHz
    [BOOTLOADER_PROFILE] Boot Image Size : 0 KB
    [BOOTLOADER_PROFILE] Cores present :
    r5f0-0
    [BOOTLOADER PROFILE] SYSFW init : 12149us
    [BOOTLOADER PROFILE] System_init : 700us
    [BOOTLOADER PROFILE] Drivers_open : 277us
    [BOOTLOADER PROFILE] Board_driversOpen : 22425us
    [BOOTLOADER PROFILE] Sciclient Get Version : 9845us
    [BOOTLOADER PROFILE] CPU Load : 118844us
    [BOOTLOADER_PROFILE] SBL Total Time Taken : 164245us
    Image loading done, switching to application ...
    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    Regards,

    Prashant

  • Hi

    I solved the problem. There was a problem with the application image I was trying to install.

    Therefore, the authentication process could not be performed.

    Thanks for your support.

  • Hi Ahmet,

    Thank you for the note. Glad that you have solved the issue & so closing the thread now.

    Regards,

    Prashant