This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM623: eFuse keywriter can't run

Part Number: AM623


Hi expert,

We are running DFU download to burn eFuse. Our board is customize AM6234. We find one board can't run the tiboot3 key writer . It seems reset itself after we download tiboot3 key writer. The DFU log is below. We also try to use the normal tiboot3.bin(support dfu) to download to the same board. We can get debug message from debug console and download tispl.bin/u-boot.bin. Do you have any suggestion for this board? 

PS C:\Users\TEST\Desktop\ECSFactoryDfuTool> .\dfu-util.exe -l
dfu-util 0.11-msvc

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0451:6165] ver=0200, devnum=51, cfg=1, intf=0, path="1-5.4", alt=0, name="bootloader", serial="01.00.00.00"
Found DFU: [0451:6165] ver=0200, devnum=51, cfg=1, intf=0, path="1-5.4", alt=1, name="SocId", serial="01.00.00.00"
PS C:\Users\TEST\Desktop\ECSFactoryDfuTool> .\dfu-util.exe -c 1 -i 0 -a bootloader -D C:\Users\TEST\Desktop\ECSFactoryDfuTool\tiboot3_keywriter2.bin
dfu-util 0.11-msvc

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Warning: Invalid DFU suffix signature
A valid DFU suffix will be required in a future dfu-util release
Opening DFU capable USB device...
Device ID 0451:6165
Device DFU version 0110
Claiming USB DFU Interface...
Setting Alternate Interface #0 ...
Determining device status...
DFU state(2) = dfuIDLE, status(0) = No error condition is present
DFU mode device DFU version 0110
Device returned transfer size 512
Copying data from PC to DFU device
Download        [=========================] 100%       279323 bytes
Download done.
DFU state(6) = dfuMANIFEST-SYNC, status(0) = No error condition is present
unable to read DFU status after completion (LIBUSB_ERROR_PIPE)
PS C:\Users\TEST\Desktop\ECSFactoryDfuTool> .\dfu-util.exe -l
dfu-util 0.11-msvc

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0451:6165] ver=0200, devnum=59, cfg=1, intf=0, path="1-5.4", alt=0, name="bootloader", serial="01.00.00.00"
Found DFU: [0451:6165] ver=0200, devnum=59, cfg=1, intf=0, path="1-5.4", alt=1, name="SocId", serial="01.00.00.00"

best regards,

Neil

  • Hi Neil,

    Can you once check the device type of the board on which keywriter binary is supposedly not working.

    ~/ti
    ❯ dfu-util -l
    dfu-util 0.11
    
    Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
    Copyright 2010-2021 Tormod Volden and Stefan Schmidt
    This program is Free Software and has ABSOLUTELY NO WARRANTY
    Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
    
    Found DFU: [0451:6165] ver=0200, devnum=32, cfg=1, intf=0, path="1-7.3", alt=1, name="SocId", serial="01.00.00.00"
    Found DFU: [0451:6165] ver=0200, devnum=32, cfg=1, intf=0, path="1-7.3", alt=0, name="bootloader", serial="01.00.00.00"
    Found DFU: [0451:6165] ver=0200, devnum=28, cfg=1, intf=0, path="1-3.4", alt=1, name="SocId", serial="01.00.00.00"
    Found DFU: [0451:6165] ver=0200, devnum=28, cfg=1, intf=0, path="1-3.4", alt=0, name="bootloader", serial="01.00.00.00"
    
    ~/ti
    ❯ dfu-util -p 1-3.4 -a SocId -U socid.bin
    dfu-util 0.11
    
    Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
    Copyright 2010-2021 Tormod Volden and Stefan Schmidt
    This program is Free Software and has ABSOLUTELY NO WARRANTY
    Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
    
    Opening DFU capable USB device...
    Device ID 0451:6165
    Device DFU version 0110
    Claiming USB DFU Interface...
    Setting Alternate Interface #1 ...
    Determining device status...
    DFU state(2) = dfuIDLE, status(0) = No error condition is present
    DFU mode device DFU version 0110
    Device returned transfer size 512
    Copying data from DFU device to PC
    Upload  [=========================] 100%          200 bytes
    Upload done.
    Received a total of 200 bytes
    
    ~/ti
    ❯ xxd socid.bin
    00000000: 0200 0000 011a 0000 616d 3632 7800 0000  ........am62x...
    00000010: 0000 0000 4853 4653 0100 0100 0100 0100  ....HSFS........
    00000020: 02a6 0000 0000 0000 d68e cb2c 055d ff11  ...........,.]..
    00000030: ade9 5bd9 27e8 37d2 a53b c23b 0a28 00ce  ..[.'.7..;.;.(..
    00000040: bce4 f106 bcf3 09df 2213 912d 77a1 57a8  ........"..-w.W.
    00000050: b7c2 df40 672a 06a9 1803 4aa4 c7d6 03e4  ...@g*....J.....
    00000060: 6248 1475 225d 49b8 ad0b c40b 0000 0000  bH.u"]I.........
    00000070: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000080: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    00000090: 0000 0000 0000 0000 0000 0000 0000 0000  ................
    000000a0: 0000 0000 0000 0000 3ce3 196f 42d0 f57f  ........<..oB...
    000000b0: 4aee 9f71 56b4 225d 2dec 3410 0458 bff5  J..qV."]-.4..X..
    000000c0: af16 e0cf 2823 2b4e                      ....(#+N
    

    Regards,

    Prashant

  • Hi Prashant,

    Following your steps to get the device type, it is HS-SE. But we do not burn eFuse on this board before. We also can't use our HS-SE image to boot this board.  It is very strange.

    00000000: 0200 0000 011a 0000 616d 3632 7800 0000  ........am62x...
    00000010: 0000 0000 4853 5345 0100 0100 0100 0100  ....HSSE........
    00000020: 02a6 0000 0100 0200 d68e cb2c 055d ff11  ...........,.]..
    00000030: ade9 5bd9 27e8 37d2 a53b c23b 0a28 00ce  ..[.'.7..;.;.(..
    00000040: bce4 f106 bcf3 09df 2213 912d 77a1 57a8  ........"..-w.W.
    00000050: b7c2 df40 672a 06a9 1803 4aa4 c7d6 03e4  ...@g*....J.....
    00000060: 6248 1475 225d 49b8 3ef5 1224 299e 8e45  bH.u"]I.>..$)..E
    00000070: 5baf 11bd 5025 d108 783a f743 2997 a6f2  [...P%..x:.C)...
    00000080: 1f60 7a1b ee5b caa6 7cd9 a589 c145 32e8  .`z..[..|....E2.
    00000090: 65d8 b514 3904 ef99 d7f4 f333 3618 91c8  e...9......36...
    000000a0: 24c5 9bcc b856 03a6 a248 9e6f 542e 3d7b  $....V...H.oT.={
    000000b0: b9ca 37e6 16be f65d 0257 f9a7 e993 c5cb  ..7....].W......
    000000c0: b90d bfd1 ae06 431d                      ......C.
    

    Best regards,

    Neil

  • Hi Neil,

    Okay, so this explains why the keywriter binary is not booting as it is only supposed to boot on HSFS devices.

    But we do not burn eFuse on this board before.

    The SoCs leave in HSFS state from TI factory. So, the only possibility is you might have sometime run the keywriter binary successfully and converted the device to HSSE but didn't notice it.

    So, the device is HSSE, we can focus on why you are not able to boot your HSSE image.

    The most probable reason is you are not using the programmed keys to sign the image and so the ROM rejects the image resulting in boot failure. You would want to once confirm if you are using the right keys. The way to do this is:

    1) Parse the SoCId dump from ROM and note down the SHA512 hash of the active MPK ("Sec Cust MPK Hash" field).

    /cfs-file/__key/communityserver-discussions-components-files/791/0825.uart_5F00_boot_5F00_socid.py

    ~/ti
    ❯ xxd -p -c 10000 socid.bin > socid.txt
    
    ~/ti
    ❯ python3 7080.uart_boot_socid.py socid.txt
    -----------------------
    SoC ID Header Info:
    -----------------------
    NumBlocks            : [2]
    -----------------------
    SoC ID Public ROM Info:
    -----------------------
    SubBlockId           :
    SubBlockSize         :
    DeviceName           : am62x
    DeviceType           : HSFS
    DMSC ROM Version     : [0, 1, 0, 1]
    R5 ROM Version       : [0, 1, 0, 1]
    -----------------------
    SoC ID Secure ROM Info:
    -----------------------
    Sec SubBlockId       : 2
    Sec SubBlockSize     : 166
    Sec Prime            : 0
    Sec Key Revision     : 0
    Sec Key Count        : 0
    Sec TI MPK Hash      : d68ecb2c055dff11ade95bd927e837d2a53bc23b0a2800cebce4f106bcf309df2213912d77a157a8b7c2df40672a06a918034aa4c7d603e462481475225d49b8
    Sec Cust MPK Hash    : ad0bc40b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
    Sec Unique ID        : 3ce3196f42d0f57f4aee9f7156b4225d2dec34100458bff5af16e0cf28232b4e
    

    2) Check the SHA512 hash of the public key corresponding to the private key you are using to sign the image. An example on how to extract the public key & get the SHA512 hash is shown below:

    ~/ti/otp_keywriter/am62x/09_00_00/sbl_keywriter/scripts/cert_gen/am62x/keys_devel
    ❯ openssl rsa -in smpk.pem -outform der -pubout -out smpk.pubkey
    writing RSA key
    
    ~/ti/otp_keywriter/am62x/09_00_00/sbl_keywriter/scripts/cert_gen/am62x/keys_devel
    ❯ openssl dgst -sha512 -binary smpk.pubkey | xxd -c 10000 -p
    1f6002b07cd9b0b7c47d9ca8d1aae57b8e8784a12f636b2b760d7d98a18f189760dfd0f23e2b0cb10ec7edc7c6edac3d9bdfefe0eddc3fff7fe9ad875195527d
    

    If the SHA512 hash dumped in the Step 2 matches with the SHA512 hash of the active programmed public key as reported by ROM then you are using the right key otherwise you are using the wrong key explaining why the image won't boot.

    Note: Please do not share any custom keys specifically private and symmetric AES encryption key on this public forum.

    Regards,

    Prashant

  • Hi Prashant,

    The SHA512 hash are all the same. I will discuss this issue with our hardware engineer. Thank for your help and reminder.

    Best regards,

    Neil

  • Hi Neil,

    Thank you for the update. Let me know in case you need further support related to this thread.

    Regards,

    Prashant