AM62A7: Question about applying MPK&MEK to u-boot and MCU+SDK

jingjie.huang

Prodigy 230 points

Part Number: AM62A7

Tool/software:

Dear Ti staff,

We have successfully burnt the eFuse with custom keys, which are generated by "gen_keywr_cert.sh -g".

Currently we have some question about how to apply the keys:

1. I copied smpk.pem into u-boot/board/ti/keys as custMpk.pem and custMpk.key, then I use "openssl req -batch -new -x509 -key custMpk.key -out custMpk.crt" to generate the crt file.

Somehow the size of the crt file is different:(.bk files are the original files in the SDK) Is this normal?

As for building the u-boot, the binman process seems to take care of the details so I just need to collect these files, right?

2. For MCU+SDK, again I copied smpk.pem and smek.key into mcu+sdk/tools/boot/signing as custMpk_am62ax.pem and custMek_am63ax.txt. Again the size and encoding of the smek is different:

The smek, as I recall should be a 256-bit random number. I don't know why the default custMek_am62ax.txt.bk is 64 bytes.

And for building and collecting the outputs, after modifying the devconfig.mak, I'm planning to make all in the root of MCU+SDK, then generate HSM.appimage.hs and linux.appimage.hs. Is this approach correct?

Regards,

Huang Jingjie

11 months ago

0 Prashant Shivhare 11 months ago

TI__Guru 71551 points

Hello,

Everything looks good.

As for the encryption key in the MCU+ SDK, it expects the key in hex format which can be obtained as shown

❯ xxd -p -c 10000 smek.key | tr -d $'\n' > smek.txt
❯ cat smek.txt
c143f03568798964d4a5769bd5a27d3adc0d6bdd8f3cc47b84229e50a54ab043

Regards,

Prashant

0 jingjie.huang 11 months ago in reply to Prashant Shivhare

Prodigy 230 points

Hi Prashant,

Thanks for the reply. We just validated the uboot work flow.

I'll try to generate the appimages and see if it works.

Regards,

Huang Jingjie

0 jingjie.huang 11 months ago in reply to jingjie.huang

Prodigy 230 points

Hi Prashant,

We encountered a new problem while trying to load appimages.

The bootloader argues "Failed to authenticate Image" when processing linux.appimage.hs:

According to the code, it's very likely that the size of attached x509 certificate is incorrect. Would you please help us debug this issue?

The size difference is as follows:

Regards,

Huang Jingjie

0 Prashant Shivhare 11 months ago in reply to jingjie.huang

TI__Guru 71551 points

Hello,

jingjie.huang said:
The bootloader argues "Failed to authenticate Image" when processing linux.appimage.hs:

Can you please clarify the following:

What all images have you flashed & at what offsets?
How & where did you flash the images?

Thanks!

Processors

Processors forum

AM62A7: Question about applying MPK&MEK to u-boot and MCU+SDK