This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

AM6412: Signing kernel FIT image for secure boot

Part Number: AM6412

Tool/software:

Hi Team

We are implementing secure boot our custom board. So far, the boot process works until U-Boot pure. However, U-Boot fails to boot the kernel. We get the following output:

## Loading kernel from FIT Image at 82000000 ...
   Using 'conf-ti_dg-board.dtb' configuration
   Verifying Hash Integrity ... OK
   Trying 'kernel-1' kernel subimage
     Description:  Linux kernel
     Type:         Kernel Image
     Compression:  gzip compressed
     Data Start:   0x820000e4
     Data Size:    5954329 Bytes = 5.7 MiB
     Architecture: AArch64
     OS:           Linux
     Load Address: 0x80000000
     Entry Point:  0x80000000
     Hash algo:    sha512
     Hash value:   93b5489c28f8462035163ccee32fe202127622a43bd6684db78bc8b4c0e12885f9578c172c1dd24588ef137ec7c9d893c31a86e75786b154ea32f
   Verifying Hash Integrity ... sha512+ OK
ti_sci system-controller@44043000: Message not acknowledgedAuthentication failed!
### ERROR ### Please RESET the board ###

We very much think, that we did not sign the kernel correctly. However, we found little and even inconsistent information on the TI webpages.

  1. The document here https://software-dl.ti.com/processor-sdk-linux-rt/esd/AM64X/09_00_00_03/exports/docs/linux/Foundational_Components_Secure_Boot.html#secure-boot-flow suggests, that the kernel is wrapped into a X509 certificate and authenticated by TIFS.
  2. The document here https://software-dl.ti.com/processor-sdk-linux-rt/esd/AM64X/10_00_07_04/exports/docs/linux/Foundational_Components_Kernel_Users_Guide.html#creating-the-kernel-fitimage-for-high-security-device-gp-devices suggests, that the FIT image is signed by adding a signature node to the FIT image.

We think that (1) would be the TI mechanism of signing and verifying images because tiboot3.bin and tispl.bin follows this approach (and this actually works on or board). Mechanism (2) is probably what U-Boot supports by default. Looking at the TI Yocto layers (tisdk 10.00.07.04), you only support method (2), correct ?

Could you please bring some light into the situation ? What is the recommended method of signing the kernel ?

Regards

Walter Stoll

  • Hi Water,
    Which Linux SDK release is used?
    Best,
    -Hong

  • We use "Processor SDK for Linux AM64X 09_00_00_03". However, we think the latest version 10_00_07_04 behaves the same.

  • Hi Water,
    I'm attaching a working boot log I captured with Linux SDK 10.0.7.4 on AM64x EVM (HS-SE).
    Best,
    -Hong

    U-Boot SPL 2024.04-ti-gfda88f8bcea3 (Jul 26 2024 - 11:00:12 +0000)
    Resetting on cold boot to workaround ErrataID:i2331
    Please resend tiboot3.bin in case of UART/DFU boot
    resetting ...
    
    U-Boot SPL 2024.04-ti-gfda88f8bcea3 (Jul 26 2024 - 11:00:12 +0000)
    SYSFW ABI: 4.0 (firmware rev 0x000a '10.0.8--v10.00.08 (Fiery Fox)')
    SPL initial stack usage: 13392 bytes
    Trying to boot from MMC2
    Authentication passed
    Authentication passed
    Loading Environment from MMC... *** Warning - No MMC card found, using default environment
    
    Authentication passed
    Authentication passed
    Starting ATF on ARM64 core...
    
    NOTICE:  BL31: v2.10.0(release):v2.10.0-367-g00f1ec6b87-dirty
    NOTICE:  BL31: Built : 16:09:05, Feb  9 2024
    I/TC: 
    I/TC: OP-TEE version: 4.2.0-dev (gcc version 13.3.0 (GCC)) #1 Fri Apr 12 09:51:21 UTC 2024 aarch64
    I/TC: WARNING: This OP-TEE configuration might be insecure!
    I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
    I/TC: Primary CPU initializing
    I/TC: GIC redistributor base address not provided
    I/TC: Assuming default GIC group status and modifier
    I/TC: SYSFW ABI: 4.0 (firmware rev 0x000a '10.0.8--v10.00.08 (Fiery Fox)')
    I/TC: Secure Board Configuration Software: Rev 1
    I/TC: Secure Boot Keys: Count 1, Rev 1
    I/TC: HUK Initialized
    I/TC: Activated SA2UL device
    I/TC: Enabled firewalls for SA2UL TRNG device
    I/TC: SA2UL TRNG initialized
    I/TC: SA2UL Drivers initialized
    I/TC: Primary CPU switching to normal world boot
    
    U-Boot SPL 2024.04-ti-gfda88f8bcea3 (Jul 26 2024 - 11:00:12 +0000)
    SYSFW ABI: 4.0 (firmware rev 0x000a '10.0.8--v10.00.08 (Fiery Fox)')
    Trying to boot from MMC2
    Authentication passed
    Authentication passed
    
    
    U-Boot 2024.04-ti-gfda88f8bcea3 (Jul 26 2024 - 11:00:12 +0000)
    
    SoC:   AM64X SR2.0 HS-SE
    Model: Texas Instruments AM642 EVM
    Board: AM64-GPEVM rev E2
    DRAM:  2 GiB
    Core:  98 devices, 31 uclasses, devicetree: separate
    NAND:  0 MiB
    MMC:   mmc@fa10000: 0, mmc@fa00000: 1
    Loading Environment from nowhere... OK
    In:    serial@2800000
    Out:   serial@2800000
    Err:   serial@2800000
    Net:   eth0: ethernet@8000000port@1, eth2: icssg1-eth-port@0
    Hit any key to stop autoboot:  2  0 
    => md.l 0x43000030 1
    43000030: 00000243                             C...
    => printenv boot_fit
    boot_fit=1
    => boot
    switch to partitions #0, OK
    mmc1 is current device
    SD/MMC found on device 1
    574 bytes read in 42 ms (12.7 KiB/s)
    Loaded env from uEnv.txt
    Importing environment from mmc1 ...
    8757010 bytes read in 411 ms (20.3 MiB/s)
    ## Loading kernel from FIT Image at 90000000 ...
       Using 'conf-ti_k3-am642-evm.dtb' configuration
       Verifying Hash Integrity ... sha512,rsa4096:custMpk+ OK
       Trying 'kernel-1' kernel subimage
         Description:  Linux kernel
         Type:         Kernel Image
         Compression:  gzip compressed
         Data Start:   0x900000e0
         Data Size:    8491536 Bytes = 8.1 MiB
         Architecture: AArch64
         OS:           Linux
         Load Address: 0x81000000
         Entry Point:  0x81000000
         Hash algo:    sha512
         Hash value:   ffa845c8f7a060a65e67255882558f29befb8fc11e049383e4ec98303dc991fa3fc82df760394b9dcfced8484ddcc55011596a03a938305f069a239e07614889
       Verifying Hash Integrity ... sha512+ OK
    ## Loading fdt from FIT Image at 90000000 ...
       Using 'conf-ti_k3-am642-evm.dtb' configuration
       Verifying Hash Integrity ... sha512,rsa4096:custMpk+ OK
       Trying 'fdt-ti_k3-am642-evm.dtb' fdt subimage
         Description:  Flattened Device Tree blob
         Type:         Flat Device Tree
         Compression:  uncompressed
         Data Start:   0x90819424
         Data Size:    64278 Bytes = 62.8 KiB
         Architecture: AArch64
         Load Address: 0x83000000
         Hash algo:    sha512
         Hash value:   8daba83ac0badd6804fc3b1e43b72f936ea02817ca5413ab1bccad63c21911f389be217663f3207f3ff431be43c81ace362655cd919b93f5c7441fc43386e9c3
       Verifying Hash Integrity ... sha512+ OK
       Loading fdt from 0x90819424 to 0x83000000
       Booting using the fdt blob at 0x83000000
    Working FDT set to 83000000
       Uncompressing Kernel Image to 81000000
       Loading Device Tree to 000000008ffed000, end 000000008ffffb15 ... OK
    Working FDT set to 8ffed000
    
    Starting kernel ...
    
    [    0.000000] Booting Linux on physical CPU 0x0000000000 [0x410fd034]
    [    0.000000] Linux version 6.6.32-ti-g6de6e418c80e-dirty (oe-user@oe-host) (aarch64-oe-linux-gcc (GCC) 13.3.0, GNU ld (GNU Binutils) 2.42.0.20240716) #1 SMP PREEMPT Fri Jul 26 14:32:20 UTC 2024
    [    0.000000] KASLR disabled due to lack of seed
    [    0.000000] Machine model: Texas Instruments AM642 EVM
    [    0.000000] earlycon: ns16550a0 at MMIO32 0x0000000002800000 (options '')
    [    0.000000] printk: bootconsole [ns16550a0] enabled
    [    0.000000] efi: UEFI not found.
    [    0.000000] OF: reserved mem: 0x000000009e800000..0x000000009fffffff (24576 KiB) nomap non-reusable optee@9e800000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a0000000, size 1 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-dma-memory@a0000000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a0000000..0x00000000a00fffff (1024 KiB) nomap non-reusable r5f-dma-memory@a0000000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a0100000, size 15 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-memory@a0100000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a0100000..0x00000000a0ffffff (15360 KiB) nomap non-reusable r5f-memory@a0100000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a1000000, size 1 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-dma-memory@a1000000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a1000000..0x00000000a10fffff (1024 KiB) nomap non-reusable r5f-dma-memory@a1000000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a1100000, size 15 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-memory@a1100000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a1100000..0x00000000a1ffffff (15360 KiB) nomap non-reusable r5f-memory@a1100000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a2000000, size 1 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-dma-memory@a2000000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a2000000..0x00000000a20fffff (1024 KiB) nomap non-reusable r5f-dma-memory@a2000000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a2100000, size 15 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-memory@a2100000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a2100000..0x00000000a2ffffff (15360 KiB) nomap non-reusable r5f-memory@a2100000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a3000000, size 1 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-dma-memory@a3000000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a3000000..0x00000000a30fffff (1024 KiB) nomap non-reusable r5f-dma-memory@a3000000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a3100000, size 15 MiB
    [    0.000000] OF: reserved mem: initialized node r5f-memory@a3100000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a3100000..0x00000000a3ffffff (15360 KiB) nomap non-reusable r5f-memory@a3100000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a4000000, size 1 MiB
    [    0.000000] OF: reserved mem: initialized node m4f-dma-memory@a4000000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a4000000..0x00000000a40fffff (1024 KiB) nomap non-reusable m4f-dma-memory@a4000000
    [    0.000000] Reserved memory: created DMA memory pool at 0x00000000a4100000, size 15 MiB
    [    0.000000] OF: reserved mem: initialized node m4f-memory@a4100000, compatible id shared-dma-pool
    [    0.000000] OF: reserved mem: 0x00000000a4100000..0x00000000a4ffffff (15360 KiB) nomap non-reusable m4f-memory@a4100000
    [    0.000000] OF: reserved mem: 0x00000000a5000000..0x00000000a57fffff (8192 KiB) nomap non-reusable ipc-memories@a5000000
    [    0.000000] Zone ranges:
    [    0.000000]   DMA      [mem 0x0000000080000000-0x00000000ffffffff]
    [    0.000000]   DMA32    empty
    [    0.000000]   Normal   empty
    [    0.000000] Movable zone start for each node
    [    0.000000] Early memory node ranges
    [    0.000000]   node   0: [mem 0x0000000080000000-0x000000009e7fffff]
    [    0.000000]   node   0: [mem 0x000000009e800000-0x00000000a57fffff]
    [    0.000000]   node   0: [mem 0x00000000a5800000-0x00000000ffffffff]
    [    0.000000] Initmem setup node 0 [mem 0x0000000080000000-0x00000000ffffffff]
    [    0.000000] cma: Reserved 32 MiB at 0x00000000fba00000 on node -1
    [    0.000000] psci: probing for conduit method from DT.
    [    0.000000] psci: PSCIv1.1 detected in firmware.
    [    0.000000] psci: Using standard PSCI v0.2 function IDs
    [    0.000000] psci: Trusted OS migration not required
    [    0.000000] psci: SMC Calling Convention v1.4
    [    0.000000] percpu: Embedded 20 pages/cpu s42920 r8192 d30808 u81920
    [    0.000000] Detected VIPT I-cache on CPU0
    [    0.000000] CPU features: detected: GIC system register CPU interface
    [    0.000000] CPU features: detected: ARM erratum 845719
    [    0.000000] alternatives: applying boot alternatives
    [    0.000000] Kernel command line: console=ttyS2,115200n8 earlycon=ns16550a,mmio32,0x02800000 omap2-nand.0:2m(NAND.tiboot3),2m(NAND.tispl),2m(NAND.tiboot3.backup),4m(NAND.u-boot),256k(NAND.u-boot-env),256k(NAND.u-boot-env.backup),-(NAND.file-system) root=PARTUUID=f8739cc1-02 rw rootfstype=ext4 rootwait
    [    0.000000] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear)
    [    0.000000] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
    [    0.000000] Built 1 zonelists, mobility grouping on.  Total pages: 516096
    [    0.000000] mem auto-init: stack:all(zero), heap alloc:off, heap free:off
    [    0.000000] software IO TLB: area num 2.
    [    0.000000] software IO TLB: mapped [mem 0x00000000f7800000-0x00000000fb800000] (64MB)
    [    0.000000] Memory: 1822792K/2097152K available (11968K kernel code, 1250K rwdata, 4036K rodata, 2432K init, 502K bss, 241592K reserved, 32768K cma-reserved)
    [    0.000000] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=2, Nodes=1
    [    0.000000] rcu: Preemptible hierarchical RCU implementation.
    [    0.000000] rcu: 	RCU event tracing is enabled.
    [    0.000000] rcu: 	RCU restricting CPUs from NR_CPUS=256 to nr_cpu_ids=2.
    [    0.000000] 	Trampoline variant of Tasks RCU enabled.
    [    0.000000] 	Tracing variant of Tasks RCU enabled.
    [    0.000000] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
    [    0.000000] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=2
    [    0.000000] NR_IRQS: 64, nr_irqs: 64, preallocated irqs: 0
    [    0.000000] GICv3: GIC: Using split EOI/Deactivate mode
    [    0.000000] GICv3: 256 SPIs implemented
    [    0.000000] GICv3: 0 Extended SPIs implemented
    [    0.000000] Root IRQ handler: gic_handle_irq
    [    0.000000] GICv3: GICv3 features: 16 PPIs
    [    0.000000] GICv3: CPU0: found redistributor 0 region 0:0x0000000001840000
    [    0.000000] ITS [mem 0x01820000-0x0182ffff]
    [    0.000000] GIC: enabling workaround for ITS: Socionext Synquacer pre-ITS
    [    0.000000] ITS@0x0000000001820000: Devices Table too large, reduce ids 20->19
    [    0.000000] ITS@0x0000000001820000: allocated 524288 Devices @80800000 (flat, esz 8, psz 64K, shr 0)
    [    0.000000] ITS: using cache flushing for cmd queue
    [    0.000000] GICv3: using LPI property table @0x0000000080040000
    [    0.000000] GIC: using cache flushing for LPI property table
    [    0.000000] GICv3: CPU0: using allocated LPI pending table @0x0000000080050000
    [    0.000000] rcu: srcu_init: Setting srcu_struct sizes based on contention.
    [    0.000000] arch_timer: cp15 timer(s) running at 200.00MHz (phys).
    [    0.000000] clocksource: arch_sys_counter: mask: 0x3ffffffffffffff max_cycles: 0x2e2049d3e8, max_idle_ns: 440795210634 ns
    [    0.000001] sched_clock: 58 bits at 200MHz, resolution 5ns, wraps every 4398046511102ns
    [    0.008650] Console: colour dummy device 80x25
    [    0.013261] Calibrating delay loop (skipped), value calculated using timer frequency.. 400.00 BogoMIPS (lpj=800000)
    [    0.023943] pid_max: default: 32768 minimum: 301
    [    0.028771] LSM: initializing lsm=capability,integrity
    [    0.034165] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
    [    0.041748] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
    [    0.051880] RCU Tasks: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1.
    [    0.059237] RCU Tasks Trace: Setting shift to 1 and lim to 1 rcu_task_cb_adjust=1.
    [    0.067231] rcu: Hierarchical SRCU implementation.
    [    0.072142] rcu: 	Max phase no-delay instances is 1000.
    [    0.077801] Platform MSI: msi-controller@1820000 domain created
    [    0.084191] PCI/MSI: /bus@f4000/interrupt-controller@1800000/msi-controller@1820000 domain created
    [    0.093751] EFI services will not be available.
    [    0.098757] smp: Bringing up secondary CPUs ...
    I/TC: Secondary CPU 1 initializing
    I/TC: Secondary CPU 1 switching to normal world boot
    [    0.112434] Detected VIPT I-cache on CPU1
    [    0.112544] GICv3: CPU1: found redistributor 1 region 0:0x0000000001860000
    [    0.112564] GICv3: CPU1: using allocated LPI pending table @0x0000000080060000
    [    0.112624] CPU1: Booted secondary processor 0x0000000001 [0x410fd034]
    [    0.112772] smp: Brought up 1 node, 2 CPUs
    [    0.142158] SMP: Total of 2 processors activated.
    [    0.146971] CPU features: detected: 32-bit EL0 Support
    [    0.152240] CPU features: detected: CRC32 instructions
    [    0.157560] CPU: All CPU(s) started at EL2
    [    0.161747] alternatives: applying system-wide alternatives
    [    0.169434] devtmpfs: initialized
    [    0.183553] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
    [    0.193550] futex hash table entries: 512 (order: 3, 32768 bytes, linear)
    [    0.201963] pinctrl core: initialized pinctrl subsystem
    [    0.207998] DMI not present or invalid.
    [    0.212773] NET: Registered PF_NETLINK/PF_ROUTE protocol family
    [    0.219978] DMA: preallocated 256 KiB GFP_KERNEL pool for atomic allocations
    [    0.227422] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA pool for atomic allocations
    [    0.235528] DMA: preallocated 256 KiB GFP_KERNEL|GFP_DMA32 pool for atomic allocations
    [    0.243746] audit: initializing netlink subsys (disabled)
    [    0.249588] audit: type=2000 audit(0.160:1): state=initialized audit_enabled=0 res=1
    [    0.250176] thermal_sys: Registered thermal governor 'step_wise'
    [    0.257541] thermal_sys: Registered thermal governor 'power_allocator'
    [    0.263952] cpuidle: using governor menu
    [    0.274891] hw-breakpoint: found 6 breakpoint and 4 watchpoint registers.
    [    0.281903] ASID allocator initialised with 65536 entries
    [    0.300803] platform a40000.pinctrl: Fixed dependency cycle(s) with /bus@f4000/pinctrl@a40000/cpsw-cpts-pps
    [    0.316051] Modules: 27680 pages in range for non-PLT usage
    [    0.316073] Modules: 519200 pages in range for PLT usage
    [    0.322827] HugeTLB: registered 1.00 GiB page size, pre-allocated 0 pages
    [    0.335227] HugeTLB: 0 KiB vmemmap can be freed for a 1.00 GiB page
    [    0.341633] HugeTLB: registered 32.0 MiB page size, pre-allocated 0 pages
    [    0.348569] HugeTLB: 0 KiB vmemmap can be freed for a 32.0 MiB page
    [    0.354975] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
    [    0.361910] HugeTLB: 0 KiB vmemmap can be freed for a 2.00 MiB page
    [    0.368315] HugeTLB: registered 64.0 KiB page size, pre-allocated 0 pages
    [    0.375250] HugeTLB: 0 KiB vmemmap can be freed for a 64.0 KiB page
    [    0.383602] k3-chipinfo 43000014.chipid: Family:AM64X rev:SR2.0 JTAGID[0x1bb3802f] Detected
    [    0.393348] iommu: Default domain type: Translated
    [    0.398305] iommu: DMA domain TLB invalidation policy: strict mode
    [    0.405012] SCSI subsystem initialized
    [    0.409400] usbcore: registered new interface driver usbfs
    [    0.415065] usbcore: registered new interface driver hub
    [    0.420544] usbcore: registered new device driver usb
    [    0.426380] pps_core: LinuxPPS API ver. 1 registered
    [    0.431468] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
    [    0.440814] PTP clock support registered
    [    0.445031] EDAC MC: Ver: 3.0.0
    [    0.449147] scmi_core: SCMI protocol bus registered
    [    0.454668] FPGA manager framework
    [    0.458318] Advanced Linux Sound Architecture Driver Initialized.
    [    0.465821] vgaarb: loaded
    [    0.469140] clocksource: Switched to clocksource arch_sys_counter
    [    0.475707] VFS: Disk quotas dquot_6.6.0
    [    0.479765] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
    [    0.494769] NET: Registered PF_INET protocol family
    [    0.500102] IP idents hash table entries: 32768 (order: 6, 262144 bytes, linear)
    [    0.509864] tcp_listen_portaddr_hash hash table entries: 1024 (order: 2, 16384 bytes, linear)
    [    0.518648] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
    [    0.526583] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear)
    [    0.534806] TCP bind hash table entries: 16384 (order: 7, 524288 bytes, linear)
    [    0.542833] TCP: Hash tables configured (established 16384 bind 16384)
    [    0.549785] UDP hash table entries: 1024 (order: 3, 32768 bytes, linear)
    [    0.556740] UDP-Lite hash table entries: 1024 (order: 3, 32768 bytes, linear)
    [    0.564279] NET: Registered PF_UNIX/PF_LOCAL protocol family
    [    0.570739] RPC: Registered named UNIX socket transport module.
    [    0.576846] RPC: Registered udp transport module.
    [    0.581655] RPC: Registered tcp transport module.
    [    0.586464] RPC: Registered tcp-with-tls transport module.
    [    0.592069] RPC: Registered tcp NFSv4.1 backchannel transport module.
    [    0.598660] NET: Registered PF_XDP protocol family
    [    0.603578] PCI: CLS 0 bytes, default 64
    [    0.609097] Initialise system trusted keyrings
    [    0.614013] workingset: timestamp_bits=46 max_order=19 bucket_order=0
    [    0.621076] squashfs: version 4.0 (2009/01/31) Phillip Lougher
    [    0.627514] NFS: Registering the id_resolver key type
    [    0.632751] Key type id_resolver registered
    [    0.637029] Key type id_legacy registered
    [    0.641157] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
    [    0.648011] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
    [    0.696191] Key type asymmetric registered
    [    0.700397] Asymmetric key parser 'x509' registered
    [    0.705466] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 244)
    [    0.713031] io scheduler mq-deadline registered
    [    0.717687] io scheduler kyber registered
    [    0.721837] io scheduler bfq registered
    [    0.729376] pinctrl-single 4084000.pinctrl: 33 pins, size 132
    [    0.735836] pinctrl-single f4000.pinctrl: 180 pins, size 720
    [    0.743643] pinctrl-single a40000.pinctrl: 512 pins, size 2048
    [    0.757588] Serial: 8250/16550 driver, 12 ports, IRQ sharing enabled
    [    0.777493] loop: module loaded
    [    0.782168] megasas: 07.725.01.00-rc1
    [    0.790911] tun: Universal TUN/TAP device driver, 1.6
    [    0.797674] VFIO - User Level meta-driver version: 0.3
    [    0.804410] usbcore: registered new interface driver usb-storage
    [    0.811302] i2c_dev: i2c /dev entries driver
    [    0.817096] sdhci: Secure Digital Host Controller Interface driver
    [    0.823465] sdhci: Copyright(c) Pierre Ossman
    [    0.828235] sdhci-pltfm: SDHCI platform and OF driver helper
    [    0.834948] ledtrig-cpu: registered to indicate activity on CPUs
    [    0.841550] SMCCC: SOC_ID: ARCH_SOC_ID not implemented, skipping ....
    [    0.849098] usbcore: registered new interface driver usbhid
    [    0.854814] usbhid: USB HID core driver
    [    0.859193] omap-mailbox 29020000.mailbox: omap mailbox rev 0x66fc9100
    [    0.866156] omap-mailbox 29040000.mailbox: omap mailbox rev 0x66fc9100
    [    0.873002] omap-mailbox 29060000.mailbox: omap mailbox rev 0x66fc9100
    [    0.881657] hw perfevents: enabled with armv8_cortex_a53 PMU driver, 7 counters available
    [    0.890885] optee: probing for conduit method.
    I/TC: Reserved shared memory is enabled
    I/TC: Dynamic shared memory is enabled
    I/TC: Normal World virtualization support is disabled
    I/TC: Asynchronous notifications are disabled
    [    0.895478] optee: revision 4.2 (12d7c4ee)
    [    0.912166] optee: dynamic shared memory is enabled
    [    0.922384] random: crng init done
    [    0.926060] optee: initialized driver
    [    0.932502] NET: Registered PF_PACKET protocol family
    [    0.937825] Key type dns_resolver registered
    [    0.951732] registered taskstats version 1
    [    0.956298] Loading compiled-in X.509 certificates
    [    0.977197] ti-sci 44043000.system-controller: ABI: 4.0 (firmware rev 0x000a '10.0.8--v10.00.08 (Fiery Fox)')
    [    1.129460] pca953x 0-0038: supply vcc not found, using dummy regulator
    [    1.136419] pca953x 0-0038: using no AI
    [    1.153974] omap_i2c 20000000.i2c: bus 0 rev0.12 at 400 kHz
    [    1.162199] pca953x 1-0022: supply vcc not found, using dummy regulator
    [    1.169194] pca953x 1-0022: using AI
    [    1.194469] omap_i2c 20010000.i2c: bus 1 rev0.12 at 400 kHz
    [    1.200734] ti-sci-intr bus@f4000:interrupt-controller@a00000: Interrupt Router 3 domain created
    [    1.210143] ti-sci-inta 48000000.interrupt-controller: Interrupt Aggregator domain 28 created
    [    1.222586] ti-udma 485c0100.dma-controller: Number of rings: 68
    [    1.230582] ti-udma 485c0100.dma-controller: Channels: 24 (bchan: 12, tchan: 6, rchan: 6)
    [    1.240929] ti-udma 485c0000.dma-controller: Number of rings: 288
    [    1.258781] ti-udma 485c0000.dma-controller: Channels: 44 (tchan: 29, rchan: 15)
    [    1.270179] printk: console [ttyS2] disabled
    [    1.275061] 2800000.serial: ttyS2 at MMIO 0x2800000 (irq = 317, base_baud = 3000000) is a 8250
    [    1.283990] printk: console [ttyS2] enabled
    [    1.283990] printk: console [ttyS2] enabled
    [    1.292502] printk: bootconsole [ns16550a0] disabled
    [    1.292502] printk: bootconsole [ns16550a0] disabled
    [    1.310207] spi-nor spi0.0: s28hs512t (65536 Kbytes)
    [    1.315323] 7 fixed-partitions partitions found on MTD device fc40000.spi.0
    [    1.322290] Creating 7 MTD partitions on "fc40000.spi.0":
    [    1.327687] 0x000000000000-0x000000100000 : "ospi.tiboot3"
    [    1.334710] 0x000000100000-0x000000300000 : "ospi.tispl"
    [    1.341526] 0x000000300000-0x000000700000 : "ospi.u-boot"
    [    1.348310] 0x000000700000-0x000000740000 : "ospi.env"
    [    1.354899] 0x000000740000-0x000000780000 : "ospi.env.backup"
    [    1.362110] 0x000000800000-0x000003fc0000 : "ospi.rootfs"
    [    1.368950] 0x000003fc0000-0x000004000000 : "ospi.phypattern"
    [    1.378363] davinci_mdio 8000f00.mdio: Configuring MDIO in manual mode
    [    1.425152] davinci_mdio 8000f00.mdio: davinci mdio revision 9.7, bus freq 1000000
    [    1.435436] davinci_mdio 8000f00.mdio: phy[0]: device 8000f00.mdio:00, driver TI DP83867
    [    1.443614] am65-cpsw-nuss 8000000.ethernet: initializing am65 cpsw nuss version 0x6BA00903, cpsw version 0x6BA80903 Ports: 3 quirks:00000006
    [    1.456527] am65-cpsw-nuss 8000000.ethernet: initialized cpsw ale version 1.4
    [    1.463661] am65-cpsw-nuss 8000000.ethernet: ALE Table size 512
    [    1.470420] pps pps0: new PPS source ptp0
    [    1.474899] am65-cpsw-nuss 8000000.ethernet: CPTS ver 0x4e8a010c, freq:500000000, add_val:1 pps:1
    [    1.492767] am65-cpsw-nuss 8000000.ethernet: set new flow-id-base 16
    [    1.505932] am65-cpts 39000000.cpts: CPTS ver 0x4e8a010c, freq:500000000, add_val:1 pps:0
    [    1.517013] mmc0: CQHCI version 5.10
    [    1.533122] j721e-pcie f102000.pcie: host bridge /bus@f4000/pcie@f102000 ranges:
    [    1.540627] j721e-pcie f102000.pcie:       IO 0x0068001000..0x0068010fff -> 0x0068001000
    [    1.548731] j721e-pcie f102000.pcie:      MEM 0x0068011000..0x006fffffff -> 0x0068011000
    [    1.556831] j721e-pcie f102000.pcie:   IB MEM 0x0000000000..0x0fffffffff -> 0x0000000000
    [    1.557159] mmc0: SDHCI controller on fa10000.mmc [fa10000.mmc] using ADMA 64-bit
    [    1.653674] mmc0: Command Queue Engine enabled
    [    1.658210] mmc0: new HS200 MMC card at address 0001
    [    1.664042] mmcblk0: mmc0:0001 S0J56X 14.8 GiB
    [    1.670302]  mmcblk0: p1 p2 p3
    [    1.674275] mmcblk0boot0: mmc0:0001 S0J56X 31.5 MiB
    [    1.680534] mmcblk0boot1: mmc0:0001 S0J56X 31.5 MiB
    [    1.686674] mmcblk0rpmb: mmc0:0001 S0J56X 4.00 MiB, chardev (239:0)
    [    2.577524] j721e-pcie f102000.pcie: PCI host bridge to bus 0000:00
    [    2.583872] pci_bus 0000:00: root bus resource [bus 00-ff]
    [    2.589364] pci_bus 0000:00: root bus resource [io  0x0000-0xffff] (bus address [0x68001000-0x68010fff])
    [    2.598836] pci_bus 0000:00: root bus resource [mem 0x68011000-0x6fffffff]
    [    2.605745] pci 0000:00:00.0: [104c:b010] type 01 class 0x060400
    [    2.611761] pci 0000:00:00.0: reg 0x10: [mem 0x00000000-0xfffffffff 64bit pref]
    [    2.619143] pci 0000:00:00.0: supports D1
    [    2.623153] pci 0000:00:00.0: PME# supported from D0 D1 D3hot
    [    2.631572] pci 0000:00:00.0: bridge configuration invalid ([bus 00-00]), reconfiguring
    [    2.639875] pci_bus 0000:01: busn_res: [bus 01-ff] end is updated to 01
    [    2.646551] pci 0000:00:00.0: BAR 0: no space for [mem size 0x1000000000 64bit pref]
    [    2.654293] pci 0000:00:00.0: BAR 0: failed to assign [mem size 0x1000000000 64bit pref]
    [    2.662379] pci 0000:00:00.0: PCI bridge to [bus 01]
    [    2.667529] pcieport 0000:00:00.0: of_irq_parse_pci: failed with rc=-22
    [    2.674573] pcieport 0000:00:00.0: PME: Signaling with IRQ 520
    [    2.680825] pcieport 0000:00:00.0: AER: enabled with IRQ 520
    [    2.689255] mmc1: CQHCI version 5.10
    [    2.691867] clk: Disabling unused clocks
    [    2.724736] ALSA device list:
    [    2.727826]   No soundcards found.
    [    2.731826] mmc1: SDHCI controller on fa00000.mmc [fa00000.mmc] using ADMA 64-bit
    [    2.739646] Waiting for root device PARTUUID=f8739cc1-02...
    [    2.797770] mmc1: new ultra high speed SDR104 SDHC card at address aaaa
    [    2.805389] mmcblk1: mmc1:aaaa SC16G 14.8 GiB
    [    2.815015]  mmcblk1: p1 p2
    [    2.862987] EXT4-fs (mmcblk1p2): mounted filesystem 9b70056c-e02c-416d-b5ae-fc4f8714a530 r/w with ordered data mode. Quota mode: none.
    [    2.875247] VFS: Mounted root (ext4 filesystem) on device 179:98.
    [    2.888930] devtmpfs: mounted
    [    2.893595] Freeing unused kernel memory: 2432K
    [    2.898244] Run /sbin/init as init process
    [    3.192110] systemd[1]: System time before build time, advancing clock.
    [    3.255873] NET: Registered PF_INET6 protocol family
    [    3.262402] Segment Routing with IPv6
    [    3.266174] In-situ OAM (IOAM) with IPv6
    [    3.313741] systemd[1]: systemd 255.4^ running in system mode (+PAM -AUDIT -SELINUX -APPARMOR +IMA -SMACK +SECCOMP -GCRYPT -GNUTLS -OPENSSL +ACL +BLKID -CURL -ELFUTILS -FIDO2 -IDN2 -IDN -IPTC +KMOD -LIBCRYPTSETUP +LIBFDISK -PCRE2 -PWQUALITY -P11KIT -QRENCODE -TPM2 -BZIP2 -LZ4 -XZ -ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified)
    [    3.345578] systemd[1]: Detected architecture arm64.
    
    Welcome to Arago 2023.10!
    
    
    [    3.368082] systemd[1]: Hostname set to <am64xx-evm>.
    [    3.854308] systemd[1]: /usr/lib/systemd/system/bt-enable.service:9: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
    [    4.028654] systemd[1]: /etc/systemd/system/sync-clocks.service:11: Standard output type syslog is obsolete, automatically updating to journal. Please update your unit file, and consider removing the setting altogether.
    [    4.142374] systemd[1]: Queued start job for default target Graphical Interface.
    [    4.185619] systemd[1]: Created slice Slice /system/getty.
    [  OK  ] Created slice Slice /system/getty.
    
    [    4.212415] systemd[1]: Created slice Slice /system/modprobe.
    [  OK  ] Created slice Slice /system/modprobe.
    
    [    4.236446] systemd[1]: Created slice Slice /system/serial-getty.
    [  OK  ] Created slice Slice /system/serial-getty.
    
    [    4.259688] systemd[1]: Created slice User and Session Slice.
    [  OK  ] Created slice User and Session Slice.
    
    [    4.281899] systemd[1]: Started Dispatch Password Requests to Console Directory Watch.
    [  OK  ] Started Dispatch Password Requests to Console Directory Watch.
    
    [    4.305839] systemd[1]: Started Forward Password Requests to Wall Directory Watch.
    [  OK  ] Started Forward Password Requests to Wall Directory Watch.
    
    [    4.329580] systemd[1]: Expecting device /dev/ttyS2...
             Expecting device /dev/ttyS2...
    
    [    4.349588] systemd[1]: Reached target Path Units.
    [  OK  ] Reached target Path Units.
    
    [    4.369481] systemd[1]: Reached target Remote File Systems.
    [  OK  ] Reached target Remote File Systems.
    
    [    4.389480] systemd[1]: Reached target Slice Units.
    [  OK  ] Reached target Slice Units.
    
    [    4.409505] systemd[1]: Reached target Swaps.
    [  OK  ] Reached target Swaps.
    
    [    4.475516] systemd[1]: Listening on RPCbind Server Activation Socket.
    [  OK  ] Listening on RPCbind Server Activation Socket.
    
    [    4.497633] systemd[1]: Reached target RPC Port Mapper.
    [  OK  ] Reached target RPC Port Mapper.
    
    [    4.529496] systemd[1]: Listening on Process Core Dump Socket.
    [  OK  ] Listening on Process Core Dump Socket.
    
    [    4.554003] systemd[1]: Listening on initctl Compatibility Named Pipe.
    [  OK  ] Listening on initctl Compatibility Named Pipe.
    
    [    4.579199] systemd[1]: Listening on Journal Audit Socket.
    [  OK  ] Listening on Journal Audit Socket.
    
    [    4.602412] systemd[1]: Listening on Journal Socket (/dev/log).
    [  OK  ] Listening on Journal Socket (/dev/log).
    
    [    4.626490] systemd[1]: Listening on Journal Socket.
    [  OK  ] Listening on Journal Socket.
    
    [    4.642758] systemd[1]: Listening on Network Service Netlink Socket.
    [  OK  ] Listening on Network Service Netlink Socket.
    
    [    4.671769] systemd[1]: Listening on udev Control Socket.
    [  OK  ] Listening on udev Control Socket.
    
    [    4.694361] systemd[1]: Listening on udev Kernel Socket.
    [  OK  ] Listening on udev Kernel Socket.
    
    [    4.718413] systemd[1]: Listening on User Database Manager Socket.
    [  OK  ] Listening on User Database Manager Socket.
    
    [    4.765753] systemd[1]: Mounting Huge Pages File System...
             Mounting Huge Pages File System...
    
    [    4.807477] systemd[1]: Mounting POSIX Message Queue File System...
             Mounting POSIX Message Queue File System...
    
    [    4.835390] systemd[1]: Mounting Kernel Debug File System...
             Mounting Kernel Debug File System...
    
    [    4.858114] systemd[1]: Kernel Trace File System was skipped because of an unmet condition check (ConditionPathExists=/sys/kernel/tracing).
    [    4.880031] systemd[1]: Mounting Temporary Directory /tmp...
             Mounting Temporary Directory /tmp...
    
    [    4.910639] systemd[1]: Starting Create List of Static Device Nodes...
             Starting Create List of Static Device Nodes...
    
    [    4.962190] systemd[1]: Starting Load Kernel Module configfs...
             Starting Load Kernel Module configfs...
    
    [    4.995846] systemd[1]: Starting Load Kernel Module drm...
             Starting Load Kernel Module drm...
    
    [    5.022556] systemd[1]: Starting Load Kernel Module fuse...
             Starting Load Kernel Module fuse...
    
    [    5.050671] systemd[1]: Starting RPC Bind...
             Starting RPC Bind...
    [    5.056348] systemd[1]: File System Check on Root Device was skipped because of an unmet condition check (ConditionPathIsReadWrite=!/).
    
    [    5.094279] systemd[1]: Starting Journal Service...
             Starting Journal Service...
    
    [    5.128986] fuse: init (API version 7.39)
    [    5.154286] systemd[1]: Starting Load Kernel Modules...
             Starting Load Kernel Modules...
    
    [    5.174700] systemd[1]: Starting Generate network units from Kernel command line...
             Starting Generate network units from Kernel command line...
    
    [    5.230433] systemd[1]: Starting Remount Root and Kernel File Systems...
             Starting Remount Root and Kernel File Systems...
    
    [    5.282386] systemd[1]: Starting Coldplug All udev Devices...
             Starting Coldplug All udev Devices...
    
    [    5.294927] cryptodev: loading out-of-tree module taints kernel.
    [    5.320113] systemd[1]: Started RPC Bind.
    [  OK  ] Started RPC Bind.
    
    [    5.339956] cryptodev: driver 1.13 loaded.
    [    5.346401] systemd[1]: Mounted Huge Pages File System.
    [  OK  ] Mounted Huge Pages File System.
    
    [    5.362781] systemd[1]: Mounted POSIX Message Queue File System.
    [  OK  ] Mounted POSIX Message Queue File System.
    
    [    5.382228] systemd-journald[105]: Collecting audit messages is enabled.
    [    5.394820] systemd[1]: Mounted Kernel Debug File System.
    [    5.400472] EXT4-fs (mmcblk1p2): re-mounted 9b70056c-e02c-416d-b5ae-fc4f8714a530 r/w. Quota mode: none.
    [  OK  ] Mounted Kernel Debug File System.
    
    [    5.428912] systemd[1]: Mounted Temporary Directory /tmp.
    [  OK  ] Mounted Temporary Directory /tmp.
    
    [    5.457764] systemd[1]: Finished Create List of Static Device Nodes.
    [  OK  ] Finished Create List of Static Device Nodes.
    
    [    5.487395] systemd[1]: modprobe@configfs.service: Deactivated successfully.
    [    5.502753] systemd[1]: Finished Load Kernel Module configfs.
    [  OK  ] Finished Load Kernel Module configfs.
    
    [    5.531297] systemd[1]: modprobe@drm.service: Deactivated successfully.
    [    5.541780] systemd[1]: Finished Load Kernel Module drm.
    [  OK  ] Finished Load Kernel Module drm.
    
    [    5.567507] systemd[1]: modprobe@fuse.service: Deactivated successfully.
    [    5.582799] systemd[1]: Finished Load Kernel Module fuse.
    [  OK  ] Finished Load Kernel Module fuse.
    
    [    5.610312] systemd[1]: Started Journal Service.
    [  OK  ] Started Journal Service.
    
    [  OK  ] Finished Load Kernel Modules.
    
    [  OK  ] Finished Generate network units from Kernel command line.
    
    [  OK  ] Finished Remount Root and Kernel File Systems.
    
             Mounting FUSE Control File System...
    
             Mounting Kernel Configuration File System...
    
             Starting Flush Journal to Persistent Storage...
    
             Starting Apply Kernel Variables...
    
             Starting Create Static Device Nodes in /dev gracefully...
    
    [    5.926296] systemd-journald[105]: Received client request to flush runtime journal.
    [  OK  ] Mounted FUSE Control File System.
    
    [  OK  ] Mounted Kernel Configuration File System.
    
    [  OK  ] Finished Flush Journal to Persistent Storage.
    
    [  OK  ] Finished Apply Kernel Variables.
    
    [  OK  ] Finished Create Static Device Nodes in /dev gracefully.
    
             Starting Create Static Device Nodes in /dev...
    
    [  OK  ] Finished Create Static Device Nodes in /dev.
    
    [  OK  ] Reached target Preparation for Local File Systems.
    
             Mounting /var/volatile...
    
    [    6.412884] audit: type=1334 audit(1709054767.216:2): prog-id=6 op=LOAD
    [    6.420628] audit: type=1334 audit(1709054767.224:3): prog-id=7 op=LOAD
             Starting Rule-based Manager for Device Events and Files...
    
    [  OK  ] Finished Coldplug All udev Devices.
    
    [  OK  ] Mounted /var/volatile.
    
             Starting Load/Save OS Random Seed...
    
    [  OK  ] Reached target Local File Systems.
    
             Starting Create Volatile Files and Directories...
    
    [  OK  ] Finished Load/Save OS Random Seed.
    
    [  OK  ] Started Rule-based Manager for Device Events and Files.
    
    [  OK  ] Finished Create Volatile Files and Directories.
    
    [    6.808474] audit: type=1334 audit(1709054767.612:4): prog-id=8 op=LOAD
             Starting Network Name Resolution...
    
    [    6.860851] audit: type=1334 audit(1709054767.664:5): prog-id=9 op=LOAD
             Starting Network Time Synchronization...
    
             Starting Record System Boot/Shutdown in UTMP...
    
    [    6.981971] audit: type=1334 audit(1709054767.788:6): prog-id=10 op=LOAD
    [    6.995412] audit: type=1334 audit(1709054767.800:7): prog-id=11 op=LOAD
    [    7.008382] audit: type=1334 audit(1709054767.800:8): prog-id=12 op=LOAD
             Starting User Database Manager...
    
    [  OK  ] Finished Record System Boot/Shutdown in UTMP.
    
    [  OK  ] Started User Database Manager.
    
    [  OK  ] Found device /dev/ttyS2.
    
    [  OK  ] Started Network Time Synchronization.
    
    [  OK  ] Reached target System Time Set.
    
    [  OK  ] Started Network Name Resolution.
    
    [  OK  ] Reached target Host and Network Name Lookups.
    
    [  OK  ] Reached target System Initialization.
    
    [  OK  ] Started Daily rotation of log files.
    
    [  OK  ] Started Timer service to update the IP on OLED each 10s.
    
    [  OK  ] Started Daily Cleanup of Temporary Directories.
    
    [  OK  ] Reached target Timer Units.
    
    [  OK  ] Listening on Avahi mDNS/DNS-SD Stack Activation Socket.
    
    [  OK  ] Listening on D-Bus System Message Bus Socket.
    
             Starting Docker Socket for the API...
    
    [  OK  ] Listening on dropbear.socket.
    
    [  OK  ] Listening on PC/SC Smart Card Daemon Activation Socket.
    
    [    8.451184] audit: type=1334 audit(1709061968.808:9): prog-id=13 op=LOAD
             Starting D-Bus System Message Bus...
    
             Starting Reboot and dump vmcore via kexec...
    
    [  OK  ] Listening on Docker Socket for the API.
    
    [  OK  ] Reached target Socket Units.
    
    [  OK  ] Finished Reboot and dump vmcore via kexec.
    
    [  OK  ] Started D-Bus System Message Bus.
    
    [  OK  ] Reached target Basic System.
    
    [    8.852457] dbus-broker-lau[294]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set
    [  OK  ] Started Job spooling tools.
    
             Starting Avahi mDNS/DNS-SD Stack...
    
    [  OK  ] Started Periodic Command Scheduler.
    
             Starting Print notice about GPLv3 packages...
    
             Starting IPv6 Packet Filtering Framework...
    
             Starting IPv4 Packet Filtering Framework...
    
    [  OK  ] Started irqbalance daemon.
    
             Starting Telephony service...
    
             Starting Expand the rootfs partiti�to full size of the boot device....
    
    [    9.202644] audit: type=1334 audit(1709061969.560:10): prog-id=14 op=LOAD
    [    9.217283] audit: type=1334 audit(1709061969.568:11): prog-id=15 op=LOAD
             Starting User Login Management...
    
             Starting Telnet Server...
    
    [  OK  ] Started Avahi mDNS/DNS-SD Stack.
    
    [  OK  ] Finished IPv6 Packet Filtering Framework.
    
    [  OK  ] Finished Telnet Server.
    
    [  OK  ] Finished IPv4 Packet Filtering Framework.
    
    [  OK  ] Reached target Preparation for Network.
    
             Starting Network Configuration...
    
    [  OK  ] Started Telephony service.
    
    [   10.206371] Bluetooth: Core ver 2.22
    [   10.213452] NET: Registered PF_BLUETOOTH protocol family
    [   10.225204] Bluetooth: HCI device and connection manager initialized
    [   10.237064] Bluetooth: HCI socket layer initialized
    [   10.249277] Bluetooth: L2CAP socket layer initialized
    [   10.255150] Bluetooth: SCO socket layer initialized
    [  OK  ] Finished Expand the rootfs partition to full size of the boot device..
    
    [  OK  ] Started User Login Management.
    
    [   10.745753] cfg80211: Loading compiled-in X.509 certificates for regulatory database
    [   10.786034] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
    [   10.792940] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
    [  OK  ] Started Network Configuration.
    
    [  OK  ] Reached target Network.
    
             Starting Enable and configure wl18xx bluetooth stack...
    
    [   11.086780] am65-cpsw-nuss 8000000.ethernet eth0: PHY [8000f00.mdio:00] driver [TI DP83867] (irq=POLL)
             Starting containerd container runtime...
    
    [  OK  ] Started Netperf Benchmark Server.
    
             Starting Simple Network Management Protocol (S[   11.145361] am65-cpsw-nuss 8000000.ethernet eth0: configuring for phy/rgmii-rxid link mode
    NMP) Daemon....
    
             Starting Wait for Network to be Configured...
    
             Starting Permit User Sessions...
    
    [  OK  ] Finished Permit User Sessions.
    
    [  OK  ] Started Getty on tty1.
    
    [  OK  ] Started Serial Getty on ttyS2.
    
    [  OK  ] Reached target Login Prompts.
    
             Starting Synchronize System and HW clocks...
    
    [  OK  ] Finished Enable and configure wl18xx bluetooth stack.
    
    [FAILED] Failed to start Synchronize System and HW clocks.
    
    See 'systemctl status sync-clocks.service' for details.
    
    [   12.603231] CAN device driver interface
    [   12.624060] at24 0-0050: supply vcc not found, using dummy regulator
    [   12.666598] at24 0-0050: 131072 byte 24c1024 EEPROM, writable, 1 bytes/write
    [  OK  ] Started Simple Network Management Protocol (SNMP) Daemon..
    
    [   12.913099] davinci_mdio 300b2400.mdio: Configuring MDIO in manual mode
    [   13.006193] davinci_mdio 300b2400.mdio: davinci mdio revision 1.7, bus freq 1000000
    [   13.068151] k3-m4-rproc 5000000.m4fss: assigned reserved memory node m4f-dma-memory@a4000000
    [   13.110706] davinci_mdio 300b2400.mdio: phy[15]: device 300b2400.mdio:0f, driver TI DP83869
    [   13.144167] k3-m4-rproc 5000000.m4fss: configured M4 for remoteproc mode
    [   13.183740] k3-m4-rproc 5000000.m4fss: local reset is deasserted for device
    [   13.193737] remoteproc remoteproc0: 5000000.m4fss is available
    [   13.218254] remoteproc remoteproc0: powering up 5000000.m4fss
    [   13.224222] remoteproc remoteproc0: Booting fw image am64-mcu-m4f0_0-fw, size 88248
    [   13.253866] rproc-virtio rproc-virtio.0.auto: assigned reserved memory node m4f-dma-memory@a4000000
    [   13.253911] platform 78000000.r5f: configured R5F for remoteproc mode
    [   13.266266] virtio_rpmsg_bus virtio0: creating channel ti.ipc4.ping-pong addr 0xd
    [   13.277414] virtio_rpmsg_bus virtio0: creating channel rpmsg_chrdev addr 0xe
    [   13.287981] virtio_rpmsg_bus virtio0: rpmsg host is online
    [   13.293694] rproc-virtio rproc-virtio.0.auto: registered virtio0 (type 7)
    [   13.300632] remoteproc remoteproc0: remote processor 5000000.m4fss is now up
    [   13.309067] platform 78000000.r5f: assigned reserved memory node r5f-dma-memory@a0000000
    [   13.321834] remoteproc remoteproc1: 78000000.r5f is available
    [   13.333934] remoteproc remoteproc1: powering up 78000000.r5f
    [   13.339767] remoteproc remoteproc1: Booting fw image am64-main-r5f0_0-fw, size 86352
    [   13.353635] rproc-virtio rproc-virtio.1.auto: assigned reserved memory node r5f-dma-memory@a0000000
    [   13.363795] virtio_rpmsg_bus virtio1: rpmsg host is online
    [   13.369445] virtio_rpmsg_bus virtio1: creating channel rpmsg_chrdev addr 0xe
    [   13.378997] platform 78200000.r5f: configured R5F for remoteproc mode
    [   13.386717] platform 78200000.r5f: assigned reserved memory node r5f-dma-memory@a1000000
    [   13.409584] rproc-virtio rproc-virtio.1.auto: registered virtio1 (type 7)
    [   13.418461] remoteproc remoteproc1: remote processor 78000000.r5f is now up
    [   13.491851] remoteproc remoteproc2: 78200000.r5f is available
    [   13.514148] remoteproc remoteproc2: powering up 78200000.r5f
    [   13.520410] remoteproc remoteproc2: Booting fw image am64-main-r5f0_1-fw, size 141772
    [   13.535211] rproc-virtio rproc-virtio.2.auto: assigned reserved memory node r5f-dma-memory@a1000000
    [   13.546901] virtio_rpmsg_bus virtio2: creating channel rpmsg_chrdev addr 0xe
    [   13.554457] virtio_rpmsg_bus virtio2: rpmsg host is online
    [   13.560303] rproc-virtio rproc-virtio.2.auto: registered virtio2 (type 7)
    [   13.567323] remoteproc remoteproc2: remote processor 78200000.r5f is now up
    [   13.675479] platform 78400000.r5f: configured R5F for remoteproc mode
    [   13.781456] platform 78400000.r5f: assigned reserved memory node r5f-dma-memory@a2000000
    [   14.103960] remoteproc remoteproc3: 78400000.r5f is available
    [   14.196469] remoteproc remoteproc3: powering up 78400000.r5f
    [   14.198124] m_can_platform 20701000.can: m_can device registered (irq=528, version=32)
    [   14.202303] remoteproc remoteproc3: Booting fw image am64-main-r5f1_0-fw, size 93260
    [   14.228107] rproc-virtio rproc-virtio.3.auto: assigned reserved memory node r5f-dma-memory@a2000000
    [   14.240616] virtio_rpmsg_bus virtio3: rpmsg host is online
    [   14.246385] virtio_rpmsg_bus virtio3: creating channel rpmsg_chrdev addr 0xe
    [   14.254843] rproc-virtio rproc-virtio.3.auto: registered virtio3 (type 7)
    [   14.261943] remoteproc remoteproc3: remote processor 78400000.r5f is now up
    [   14.284819] m_can_platform 20711000.can: m_can device registered (irq=529, version=32)
    [   14.295791] platform 78600000.r5f: configured R5F for remoteproc mode
    [   14.328887] platform 78600000.r5f: assigned reserved memory node r5f-dma-memory@a3000000
    [   14.338907] remoteproc remoteproc4: 78600000.r5f is available
    [   14.358889] remoteproc remoteproc4: powering up 78600000.r5f
    [   14.364743] remoteproc remoteproc4: Booting fw image am64-main-r5f1_1-fw, size 91520
    [   14.375487] rproc-virtio rproc-virtio.4.auto: assigned reserved memory node r5f-dma-memory@a3000000
    [   14.394085] virtio_rpmsg_bus virtio4: rpmsg host is online
    [   14.394940] virtio_rpmsg_bus virtio4: creating channel rpmsg_chrdev addr 0xe
    [   14.400859] rproc-virtio rproc-virtio.4.auto: registered virtio4 (type 7)
    [   14.421260] remoteproc remoteproc4: remote processor 78600000.r5f is now up
    [   14.584553] remoteproc remoteproc5: 3000a000.txpru is available
    [   14.602558] gpio-mux mux-controller: 2-way mux-controller registered
    [   14.656112] remoteproc remoteproc6: 3000c000.txpru is available
    [   14.667830] remoteproc remoteproc7: 3008a000.txpru is available
    [   14.701321] remoteproc remoteproc8: 3008c000.txpru is available
    [  OK  ] Created slice Slice /system/systemd-fsck.
    
             Expecting device /dev/mmcblk0p1...
    
             Expecting device /dev/mmcblk0p3...
    
             Expecting device /dev/mmcblk0p2...
    
    [  OK  ] Started containerd container runtime.
    
    [  OK  ] Found device /dev/mmcblk0p2.
    
    [  OK  ] Listening on Load/Save RF Kill Switch Status /dev/rfkill Watch.
    
             Starting File System Check on /dev/mmcblk0p2...
    
    [  OK  ] Finished File System Check on /dev/mmcblk0p2.
    
             Mounting /run/media/mmcblk0p2...
    
             Expecting device /dev/mmcblk1p1...
    
    [   16.284529] remoteproc remoteproc9: 30034000.pru is available
    [   16.300398] remoteproc remoteproc10: 30004000.rtu is available
    [   16.315073] remoteproc remoteproc11: 30038000.pru is available
    [   16.329916] remoteproc remoteproc12: 30006000.rtu is available
    [  OK  ] Mounted /run/media/mmcblk0p2.
    
    [   16.416341] remoteproc remoteproc13: 300b4000.pru is available
    [   16.441329] remoteproc remoteproc14: 30084000.rtu is available
    [   16.458573] remoteproc remoteproc15: 300b8000.pru is available
    [  OK  ] Found device /dev/mmcblk0p3.
    
    [   16.713291] remoteproc remoteproc16: 30086000.rtu is available
    [   17.485621] TI DP83869 300b2400.mdio:0f: attached PHY driver (mii_bus:phy_addr=300b2400.mdio:0f, irq=POLL)
    [   17.505085] icssg-prueth icssg1-eth: TI PRU ethernet driver initialized: single EMAC mode
    
    
     _____                    _____           _         _   
    |  _  |___ ___ ___ ___   |  _  |___ ___  |_|___ ___| |_ 
    |     |  _| .'| . | . |  |   __|  _| . | | | -_|  _|  _|
    |__|__|_| |__,|_  |___|  |__|  |_| |___|_| |___|___|_|  
                  |___|                    |___|            
    
    Arago Project am64xx-evm ttyS2
    
    Arago 2023.10 am64xx-evm ttyS2
    
    am64xx-evm login: [   17.751857] m_can_platform 20701000.can main_mcan0: renamed from can0
    [   17.830293] m_can_platform 20711000.can main_mcan1: renamed from can1
    [   17.869489] EXT4-fs (mmcblk0p3): mounted filesystem db6aafb8-f14d-4e82-bb3e-10e2af863ceb r/w with ordered data mode. Quota mode: none.
    [   18.553698] remoteproc remoteproc13: powering up 300b4000.pru
    [   18.573525] remoteproc remoteproc13: Booting fw image ti-pruss/am65x-sr2-pru0-prueth-fw.elf, size 39464
    [   18.592008] remoteproc remoteproc13: unsupported resource 5
    [   18.611322] remoteproc remoteproc13: remote processor 300b4000.pru is now up
    [   18.619597] remoteproc remoteproc14: powering up 30084000.rtu
    [   18.629656] remoteproc remoteproc14: Booting fw image ti-pruss/am65x-sr2-rtu0-prueth-fw.elf, size 31140
    [   18.639299] remoteproc remoteproc14: remote processor 30084000.rtu is now up
    [   18.646711] remoteproc remoteproc7: powering up 3008a000.txpru
    [   18.656673] remoteproc remoteproc7: Booting fw image ti-pruss/am65x-sr2-txpru0-prueth-fw.elf, size 39068
    [   18.666520] remoteproc remoteproc7: remote processor 3008a000.txpru is now up
    [   18.679024] pps pps1: new PPS source ptp2
    ***************************************************************
    ***************************************************************
    NOTICE: This file system contains the following GPL-3.0 packages:
    	adwaita-icon-theme-symbolic
    	autoconf
    	bash-dev
    	bash
    	bc
    	binutils
    	cifs-utils
    	coreutils-stdbuf
    	coreutils
    	cpio
    	cpp-symlinks
    	cpp
    	dosfstools
    	elfutils
    	findutils
    	g++-symlinks
    	g++
    	gawk
    	gcc-symlinks
    	gcc
    	gdb
    	gdbserver
    	gettext
    	glmark2
    	gnu-config
    	grub-common
    	grub-editenv
    	grub-efi
    	gzip
    	hidapi
    	kbd-dev
    	kbd-keymaps-pine
    	less
    	libasm1
    	libatomic-dev
    	libatomic1
    	libbfd
    	libdebuginfod1
    	libdw1
    	libelf1
    	libgcc-s-dev
    	libgcc1
    	libgdbm-compat4
    	libgdbm-dev
    	libgdbm6
    	libgettextlib
    	libgettextsrc
    	libgmp10
    	libidn2-0
    	libmpc3
    	libmpfr6
    	libopcodes
    	libqt5charts-examples
    	libqt5charts-plugins
    	libqt5charts-qmlplugins
    	libqt5charts5
    	libqt5serialport-examples
    	libqt5serialport-plugins
    	libqt5serialport-qmlplugins
    	libqt5serialport5
    	libqt5svg-examples
    	libqt5svg-plugins
    	libqt5svg-qmlplugins
    	libqt5svg5
    	libqt5virtualkeyboard-plugins
    	libqt5virtualkeyboard-qmlplugins
    	libqt5virtualkeyboard5
    	libreadline-dev
    	libreadline8
    	libstdc++-dev
    	libstdc++6
    	libunistring5
    	m4
    	make
    	nettle
    	parted
    	piglit
    	qt3d-plugins
    	qt3d-qmlplugins
    	qt3d
    	qtbase-examples
    	qtbase-plugins
    	qtbase-qmlplugins
    	qtbase
    	qtconnectivity-plugins
    	qtconnectivity-qmlplugins
    	qtconnectivity
    	qtdeclarative-plugins
    	qtdeclarative-qmlplugins
    	qtdeclarative-tools
    	qtdeclarative
    	qtgraphicaleffects-qmlplugins
    	qtlocation-examples
    	qtlocation-plugins
    	qtlocation-qmlplugins
    	qtlocation
    	qtmultimedia-examples
    	qtmultimedia-plugins
    	qtmultimedia-qmlplugins
    	qtmultimedia
    	qtquics-qmlplugins.control
    	qtquics2-plugins.control
    	qtquics2-qmlplugins.control
    	qtquics2.control
    	qtscript-examples
    	qtscript-plugins
    	qtscript-qmlplugins
    	qtscript
    	qtwayland-examples
    	qtwayland-plugins
    	qtwayland-qmlplugins
    	qtwayland
    	tar
    	which
    
    If you do not wish to distribute GPL-3.0 components please remove
    the above packages prior to distribution.  This can be done using
    the opkg remove command.  i.e.:
        opkg remove <package>
    Where <package> is the name printed in the list above
    
    NOTE: If the package is a dependency of another package you
          will be notified of the dependent packages.  You should
          use the --force-removal-of-dependent-packages option to
          also remove the dependent packages as well
    ***************************************************************
    ***************************************************************
    
    
    am64xx-evm login: root
    
    [   30.118601] kauditd_printk_skb: 2 callbacks suppressed
    [   30.118619] audit: type=1006 audit(1709061990.476:14): pid=1111 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=1 res=1
    [   30.137326] audit: type=1300 audit(1709061990.476:14): arch=c00000b7 syscall=64 success=yes exit=1 a0=8 a1=ffffe4576568 a2=1 a3=1 items=0 ppid=1 pid=1111 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="(systemd)" exe="/usr/lib/systemd/systemd-executor" key=(null)
    [   30.164106] audit: type=1327 audit(1709061990.476:14): proctitle="(systemd)"
    [   30.182627] audit: type=1334 audit(1709061990.540:15): prog-id=18 op=LOAD
    [   30.190552] audit: type=1300 audit(1709061990.540:15): arch=c00000b7 syscall=280 success=yes exit=8 a0=5 a1=fffffdd0ae08 a2=90 a3=0 items=0 ppid=1 pid=1111 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="systemd" exe="/usr/lib/systemd/systemd" key=(null)
    [   30.217557] audit: type=1327 audit(1709061990.540:15): proctitle="(systemd)"
    [   30.225723] audit: type=1334 audit(1709061990.540:16): prog-id=18 op=UNLOAD
    [   30.233574] audit: type=1300 audit(1709061990.540:16): arch=c00000b7 syscall=57 success=yes exit=0 a0=8 a1=1 a2=0 a3=ffff9ddd4c60 items=0 ppid=1 pid=1111 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=1 comm="systemd" exe="/usr/lib/systemd/systemd" key=(null)
    [   30.259701] audit: type=1327 audit(1709061990.540:16): proctitle="(systemd)"
    [   30.267024] audit: type=1334 audit(1709061990.540:17): prog-id=19 op=LOAD
    root@am64xx-evm:~# uname -a
    Linux am64xx-evm 6.6.32-ti-g6de6e418c80e-dirty #1 SMP PREEMPT Fri Jul 26 14:32:20 UTC 2024 aarch64 GNU/Linux
    root@am64xx-evm:~# 

  • Hi Hong

    This log does not prove that the kernel image is authenticated. I do not see any according message in the log. What I would expect is a log as documented here https://software-dl.ti.com/processor-sdk-linux-rt/esd/AM64X/10_00_07_04/exports/docs/linux/Foundational_Components_Secure_Boot.html#secure-boot-flow (see section "U-Boot").

    Here I see the following log snippet (please note the "Authentication passed" message):

    # Loading kernel from FIT Image at 90000000 ...
    Using 'k3-am642-evm.dtb' configuration
    Trying 'kernel@1' kernel subimage
        Description:  Linux kernel
        Type:         Kernel Image
        Compression:  gzip compressed
        Data Start:   0x900000f8
        Data Size:    7743643 Bytes = 7.4 MiB
        Architecture: AArch64
        OS:           Linux
        Load Address: 0x80080000
        Entry Point:  0x80080000
    Verifying Hash Integrity ... OK
    Authentication passed

    # Loading fdt from FIT Image at 90000000 ...
    Using 'k3-am642-evm.dtb' configuration
    Trying 'k3-am642-evm.dtb' fdt subimage
        Description:  Flattened Device Tree blob
        Type:         Flat Device Tree
        Compression:  uncompressed
        Data Start:   0x90762a54
        Data Size:    56436 Bytes = 55.1 KiB
        Architecture: AArch64
        Load Address: 0x83000000
    Verifying Hash Integrity ... OK
    Authentication passed

  • Hi Water,
    Let me add clarifications.
    There's change (enhancement) when verifying the kernel FIT image starting from SDK 9.x, where the FIT signed configuration is used.
    https://git.ti.com/cgit/ti-u-boot/ti-u-boot/tree/doc/usage/fit/signature.rst?h=10.00.08#n283
    "To solve this problem, we support signed configurations. In this case it
    is the configurations that are signed, not the image. Each image has its
    own hash, and we include the hash in the configuration signature."

    Please note that the signed configuration verification on the kernel FIT image is supported with the u-boot FIT utility functions instead of TISCI API.
    In reference to the boot log in my last reply:
    - line #73 is from verifying the signature of the kernel FIT signed configuration
    - line #86 is from verifying the hash of the kernel binary
    - line #100 is from verifying the hash of the board DTB

    The flow as described in the below link is applicable to SDK 8.x, but the last step on verifying the kernel FIT image needs to be updated as noted above with the FIT secure configuration scheme for the newer SDK starting from SDK 9.x.
    https://software-dl.ti.com/processor-sdk-linux-rt/esd/AM64X/10_00_07_04/exports/docs/linux/Foundational_Components_Secure_Boot.html#secure-boot-flow

    Best,
    -Hong

  • Hi Hong

    Ok.

    So based on your reply and reading the references my understanding is, that TI modified the kernel signing procedure due to security concerns (prevent "mix and match attacks" by signing configurations instead of signing images).

    However, if this is a real concern, then the same holds for U-Boot pure as well. There the u-boot.img binary is constructed by binman and the individual images are signed not the configurations. Same is true for tispl.bin.

    Are there any plans to change this ?

  • Hi Water,
    For R5-SPL (tiboot3.bin), it is special combinged image format required by ROM.
    I'm not aware of near-term SDK plan to make changes on tispl.bin, and u-boot.img.
    Best,
    -Hong