PROCESSOR-SDK-AM62A: HS-SE R5 image not booting

Joseph Tingin

Tool/software:

Hi,

I was able to convert my hs-fs device to hs-se using TI's dummy keys. After building the SPL images in the processor sdk with the default key provided, the tiboot3-am62ax-hs-evm.bin image doesn't boot. I referenced this guide for building the images. software-dl.ti.com/.../Foundational_Components_Migration_Guide.html

-----------------------
SoC ID Header Info:
-----------------------
NumBlocks            : 2
-----------------------
SoC ID Public ROM Info:
-----------------------
SubBlockId           : 1
SubBlockSize         : 26
DeviceName           : am62a
DeviceType           : HSSE
DMSC ROM Version     : [0, 0, 8, 0]
R5 ROM Version       : [0, 0, 8, 0]
-----------------------
SoC ID Secure ROM Info:
-----------------------
Sec SubBlockId       : 2
Sec SubBlockSize     : 166
Sec Prime            : 0
Sec Key Revision     : 1
Sec Key Count        : 2
Sec TI MPK Hash      : cb39ee39c52d0469806636ff350520fcf7065cbec5cdddfea08863506c2be9f2242ff3207f919c2edcff407261f0908459139f3c153770f
Sec Cust MPK Hash    : 1f6002b07cd9b0b7c47d9ca8d1aae57b8e8784a12f636b2b760d7d98a18f189760dfd0f23e2b0cb10ec7edc7c6edac3d9bdfefe0eddc3ff
Sec Unique ID        : 760cf9c2ab60c48458b0841818e1d1387423a70a45196ce0d2020f958bee3a22

I set device_type to hs and I'm using the correct dfu defconfig since I'm using dfu boot. I compile using make u-boot, then make sysfw-image.

I did not copy the smpk.pem from <MCU_PLUS_SDK_INSTALL_DIR>\source\security\sbl_keywriter\scripts\cert_gen\am62ax\keys_devel\ to ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\core-secdev-k3\keys\custMpk.pem because these were already the same exact default keys. The Cust MPK Hash fused on the board also matches the SMPKH from verify_hash.csv

My device is able to go into dfu boot and it accepts the image after loading but I don't see any serial output. I also can't proceed to load the next tispl.bin_HS. Is there anything else I'm supposed to copy over to the processor sdk before compiling? Is there any other way to confirm the images built are signed with the correct keys?

Thanks,
Joseph

1 month ago

0 Hong Guan64 1 month ago

TI__Guru 61675 points

1/. Is it the TI reference board or customer board?
2/. If it is the TI board, have we tested the tiboot3.bin (HS-SE) booting from SD?
3/. what is the SDK version?
Best,
-Hong

0 Joseph Tingin 1 month ago in reply to Hong Guan64

Prodigy 100 points

Hi Hong,

Thanks for your response. This is a custom board and I'm using the ti-processor-sdk-linux-am62axx-evm-08.06.00.45 version. I tried testing the tiboot3-am62ax-hs-evm.bin from ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\prebuilt-images and I finally got output.

U-Boot SPL 2021.01-g2ee8efd654 (Feb 27 2023 - 11:47:43 +0000)
SYSFW ABI: 3.1 (firmware rev 0x0008 '8.6.4--v08.06.04 (Chill Capybar')
am62a_init: board_init_f done

I tried this process again on another custom board but this time I generated my own custom keys and converted the device to hs-se. I copied the custMpk.pem into core-secdev-k3\keys\custMpk.pem . I got no output after trying to boot the secure tiboot3-am62ax-hs-evm.bin from ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\k3-image-gen-2022.01

$ ./dfu-util-v11.exe -l
dfu-util 0.11

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0451:6165] ver=0200, devnum=19, cfg=1, intf=0, path="1-2", alt=1, name="SocId", serial="01.00.00.00"
Found DFU: [0451:6165] ver=0200, devnum=19, cfg=1, intf=0, path="1-2", alt=0, name="bootloader", serial="01.00.00.00"




$ ./dfu-util-v11.exe -R -a bootloader -D tiboot3-am62ax-hs-evm.bin
dfu-util 0.11

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Opening DFU capable USB device...
Device ID 0451:6165
Device DFU version 0110
Claiming USB DFU Interface...
Setting Alternate Interface #0 ...
Determining device status...
DFU state(2) = dfuIDLE, status(0) = No error condition is present
DFU mode device DFU version 0110
Device returned transfer size 512
Copying data from PC to DFU device
Download        [=========================] 100%       357451 bytes
Download done.
DFU state(6) = dfuMANIFEST-SYNC, status(0) = No error condition is present
DFU state(2) = dfuIDLE, status(0) = No error condition is present
Done!
Resetting USB to switch back to Run-Time mode
Warning: Invalid DFU suffix signature
A valid DFU suffix will be required in a future dfu-util release





$ ./dfu-util-v11.exe -l
dfu-util 0.11

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0451:6165] ver=0200, devnum=24, cfg=1, intf=0, path="1-2", alt=1, name="UNKNOWN", serial="UNKNOWN"
Found DFU: [0451:6165] ver=0200, devnum=24, cfg=1, intf=0, path="1-2", alt=0, name="UNKNOWN", serial="UNKNOWN"
Failed to retrieve language identifiers
Failed to retrieve language identifiers
Failed to retrieve language identifiers
Failed to retrieve language identifiers

Thanks,

Joseph

0 Hong Guan64 1 month ago in reply to Joseph Tingin

TI__Guru 61675 points

Joseph Tingin said:
I tried testing the tiboot3-am62ax-hs-evm.bin from ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\prebuilt-images and I finally got output.

1/. what is the boot mode?
2/. do we have more boot message/log?
Best,
-Hong

0 Joseph Tingin 1 month ago in reply to Hong Guan64

Prodigy 100 points

Hi Hong,

I'm using DFU boot. I did the same steps that I showed in the snippet above.

Hong Guan64 said:
2/. do we have more boot message/log?

When using the tiboot3-am62ax-hs-evm.bin that I built, I don't see any serial output. But when using the tiboot3-am62ax-hs-evm.bin from /prebuilt-images, this is the only output. I'm not sure if this means it fully executed.

U-Boot SPL 2021.01-g2ee8efd654 (Feb 27 2023 - 11:47:43 +0000)
SYSFW ABI: 3.1 (firmware rev 0x0008 '8.6.4--v08.06.04 (Chill Capybar')
am62a_init: board_init_f done

Thanks,

Joseph

0 Hong Guan64 1 month ago in reply to Joseph Tingin

TI__Guru 61675 points

Here is an early e2e with logs for your reference
https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1109517/sk-am62-fail-to-load-rootfs-using-usb-dfu/4124594#4124594
Best,
-Hong

0 Joseph Tingin 1 month ago in reply to Hong Guan64

Prodigy 100 points

Thanks for sharing these sample logs.

I think my main problem is why the images don't boot after I compile them in ti-processor-sdk-linux-am62axx-evm-08.06.00.45. If I'm using a gp, or hs-fs device and I build the SPL images, everything works as expected.

When I switch to hs device type and compile for secure boot, that's when the SPL images don't boot. My understanding is the key signing and certificate generation is handled automatically.

Am I missing anything in my build steps?

1. make u-boot

2. make sysfw-image

$ make sysfw-image
=====================================
Building the Linux Kernel DTBs
=====================================
make -C /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538 ARCH=arm64 CROSS_COMPILE=/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- tisdk_am62axx-evm_defconfig
make[1]: Entering directory '/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538'
#
# No change to .config
#
=============================
Building SYSFW Image
=============================
make[1]: Entering directory '/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'
./scripts/gen_x509_combined_cert.sh -b /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5/spl/u-boot-spl.bin -l 0x43c00000 -s /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin -m 0x40000 -c "/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin" -d out/soc/am62ax/evm/combined-tifs-cfg.bin -n 0x67000 -t out/soc/am62ax/evm/combined-dm-cfg.bin -y 0x43c3c800 -k /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1 -o tiboot3-am62ax-hs-evm.bin
Certificate being generated :
SUCCESS: Image tiboot3-am62ax-hs-evm.bin generated.
make[1]: Leaving directory '/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'

Joseph

0 Hong Guan64 28 days ago in reply to Joseph Tingin

TI__Guru 61675 points

Was the HS-SE programmed with the TI testing key or the customer testing key?
If it was the customer key, all binary needs to be signed with the customer key.
Additionally ATF and OPTEE also needs to be signed with the customer key. refer to this early e2e
https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1246915/am625-tiboot3-bin-uart-xmodem-file-transfer/4729158#4729158
Best,
-Hong

0 Joseph Tingin 27 days ago in reply to Hong Guan64

Prodigy 100 points

Hi Hong,

I have two HS-SE boards.

One board was programmed with TI testing key.

Another board was programmed with my own generated customer key (./gen_keywr_cert.sh -g).

I read through the e2e and it looks like the customer ensures the custMpk.pem is the correct key (TI default or generated). I've built images using both keys and the images don't work with their respective boards.

Is there a way to manually sign ATF and OPTEE? My understanding is this is handled with the command "make sysfw-image".

This is my complete build log after a make clean.

1. make u-boot

jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ make u-boot
===================================
Building U-boot for A53
===================================
make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- \
         am62ax_genesis_revB_a53_defconfig O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
  GEN     ./Makefile
  HOSTCC  scripts/basic/fixdep
  LEX     scripts/kconfig/zconf.lex.c
  YACC    scripts/kconfig/zconf.tab.c
  HOSTCC  scripts/kconfig/conf.o
  HOSTCC  scripts/kconfig/zconf.tab.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
if [ am62axx-evm = am62xx-evm ] || [ am62axx-evm = am62axx-evm ] || [ am62axx-evm = am62xx-lp-evm ]; then \
        make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- \
                CONFIG_MKIMAGE_DTC_PATH=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53/scripts/dtc/dtc \
                ATF=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl31.bin TEE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl32.bin DM=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ipc_echo_testb_mcu1_0_release_strip.xer5f \
                O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53; \
else \
        make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- \
                CONFIG_MKIMAGE_DTC_PATH=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53/scripts/dtc/dtc \
                ATF=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl31.bin TEE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl32.bin \
                O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53; \
fi
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
  GEN     ./Makefile
scripts/kconfig/conf  --syncconfig Kconfig
  UPD     include/config.h
  GEN     include/autoconf.mk.dep
  CFG     u-boot.cfg
  CFG     spl/u-boot.cfg
  GEN     include/autoconf.mk
  GEN     spl/include/autoconf.mk
  GEN     ./Makefile
  UPD     include/generated/dt.h
  UPD     include/generated/timestamp_autogenerated.h
  UPD     include/config/uboot.release
  Using /net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654 as source for U-Boot
  UPD     include/generated/version_autogenerated.h
  HOSTCC  scripts/dtc/flattree.o
  HOSTCC  scripts/dtc/dtc.o
  HOSTCC  scripts/dtc/fstree.o
  HOSTCC  scripts/dtc/data.o
  HOSTCC  scripts/dtc/livetree.o
  HOSTCC  scripts/dtc/srcpos.o
  HOSTCC  scripts/dtc/treesource.o
  HOSTCC  scripts/dtc/util.o
  HOSTCC  scripts/dtc/checks.o
  LEX     scripts/dtc/dtc-lexer.lex.c
  YACC    scripts/dtc/dtc-parser.tab.h
  YACC    scripts/dtc/dtc-parser.tab.c
  HOSTCC  scripts/dtc/dtc-parser.tab.o
  HOSTCC  scripts/dtc/dtc-lexer.lex.o
===================== WARNING ======================
  CC      lib/asm-offsets.s
  CC      arch/arm/lib/asm-offsets.s
This board uses CONFIG_SPL_FIT_GENERATOR. Please migrate
to binman instead, to avoid the proliferation of
arch-specific scripts with no tests.
====================================================
  CFGCHK  u-boot.cfg
  UPD     include/generated/asm-offsets.h
  UPD     include/generated/generic-asm-offsets.h
  LDS     u-boot.lds
  HOSTLD  scripts/dtc/dtc
  HOSTCC  tools/gen_eth_addr
  HOSTCC  tools/gen_ethaddr_crc.o
  WRAP    tools/lib/crc8.c
  HOSTCC  tools/img2srec

----------------------------------------------------------
------------- More .o files compiled here ----------------
----------------------------------------------------------

  LD      spl/drivers/built-in.o
  LD      spl/u-boot-spl
  OBJCOPY spl/u-boot-spl-nodtb.bin
  SYM     spl/u-boot-spl.sym
  SECURE  spl/u-boot-spl-nodtb.bin_HS
  CAT     spl/u-boot-spl-dtb.bin
  COPY    spl/u-boot-spl.bin
  MKIMAGE tispl.bin_HS
  MKIMAGE tispl.bin
FIT description: Configuration to load ATF and SPL
Created:         Mon Nov  4 12:10:04 2024
 Image 0 (atf)
  Description:  ARM Trusted Firmware
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    45801 Bytes = 44.73 KiB = 0.04 MiB
  Architecture: AArch64
  OS:           ARM Trusted Firmware
  Load Address: 0x9e780000
 Image 1 (tee)
  Description:  OPTEE
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Trusted Execution Environment Image
  Compression:  uncompressed
  Data Size:    425713 Bytes = 415.74 KiB = 0.41 MiB
 Image 2 (dm)
  Description:  DM binary
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    471653 Bytes = 460.60 KiB = 0.45 MiB
  Architecture: Unknown Architecture
  OS:           Unknown OS
  Load Address: 0x89000000
 Image 3 (spl)
  Description:  SPL (64-bit)
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Standalone Program
  Compression:  uncompressed
  Data Size:    228001 Bytes = 222.66 KiB = 0.22 MiB
  Architecture: AArch64
  Load Address: 0x80080000
  Entry Point:  0x80080000
 Image 4 (k3-am62a7-genesis-revB.dtb)
  Description:  k3-am62a7-genesis-revB
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Flat Device Tree
  Compression:  uncompressed
  Data Size:    19749 Bytes = 19.29 KiB = 0.02 MiB
  Architecture: ARM
 Default Configuration: 'k3-am62a7-genesis-revB.dtb'
 Configuration 0 (k3-am62a7-genesis-revB.dtb)
  Description:  k3-am62a7-genesis-revB
  Kernel:       unavailable
  Firmware:     atf
  FDT:          k3-am62a7-genesis-revB.dtb
  Loadables:    tee
                dm
                spl
FIT description: Configuration to load ATF and SPL
Created:         Mon Nov  4 12:10:04 2024
 Image 0 (atf)
  Description:  ARM Trusted Firmware
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    45801 Bytes = 44.73 KiB = 0.04 MiB
  Architecture: AArch64
  OS:           ARM Trusted Firmware
  Load Address: 0x9e780000
 Image 1 (tee)
  Description:  OPTEE
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Trusted Execution Environment Image
  Compression:  uncompressed
  Data Size:    425713 Bytes = 415.74 KiB = 0.41 MiB
 Image 2 (dm)
  Description:  DM binary
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    471653 Bytes = 460.60 KiB = 0.45 MiB
  Architecture: Unknown Architecture
  OS:           Unknown OS
  Load Address: 0x89000000
 Image 3 (spl)
  Description:  SPL (64-bit)
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Standalone Program
  Compression:  uncompressed
  Data Size:    228001 Bytes = 222.66 KiB = 0.22 MiB
  Architecture: AArch64
  Load Address: 0x80080000
  Entry Point:  0x80080000
 Image 4 (k3-am62a7-genesis-revB.dtb)
  Description:  k3-am62a7-genesis-revB
  Created:      Mon Nov  4 12:10:04 2024
  Type:         Flat Device Tree
  Compression:  uncompressed
  Data Size:    19749 Bytes = 19.29 KiB = 0.02 MiB
  Architecture: ARM
 Default Configuration: 'k3-am62a7-genesis-revB.dtb'
 Configuration 0 (k3-am62a7-genesis-revB.dtb)
  Description:  k3-am62a7-genesis-revB
  Kernel:       unavailable
  Firmware:     atf
  FDT:          k3-am62a7-genesis-revB.dtb
  Loadables:    tee
                dm
                spl
make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
===================================
Building U-boot for R5
===================================
make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/arm-none-linux-gnueabihf- \
         am62ax_genesis_revB_r5_usbdfu_defconfig O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
  GEN     ./Makefile
  HOSTCC  scripts/basic/fixdep
  YACC    scripts/kconfig/zconf.tab.c
  LEX     scripts/kconfig/zconf.lex.c
  HOSTCC  scripts/kconfig/conf.o
  HOSTCC  scripts/kconfig/zconf.tab.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/arm-none-linux-gnueabihf- \
        O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
  GEN     ./Makefile
scripts/kconfig/conf  --syncconfig Kconfig
  UPD     include/config.h
  CFG     u-boot.cfg
  GEN     include/autoconf.mk.dep
  CFG     spl/u-boot.cfg
  GEN     include/autoconf.mk
  GEN     spl/include/autoconf.mk
  GEN     ./Makefile
  UPD     include/generated/dt.h
  UPD     include/generated/timestamp_autogenerated.h
  UPD     include/config/uboot.release
  Using /net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654 as source for U-Boot
  UPD     include/generated/version_autogenerated.h
  HOSTCC  scripts/dtc/dtc.o
  HOSTCC  scripts/dtc/flattree.o
  HOSTCC  scripts/dtc/fstree.o

----------------------------------------------------------
------------- More .o files compiled here ----------------
----------------------------------------------------------

  HOSTCC  scripts/dtc/dtc-parser.tab.o
  HOSTCC  scripts/dtc/dtc-lexer.lex.o
===================== WARNING ======================
  CC      lib/asm-offsets.s
  CC      arch/arm/lib/asm-offsets.s
This board does not use CONFIG_DM_ETH (Driver Model
for Ethernet drivers). Please update the board to use
CONFIG_DM_ETH before the v2020.07 release. Failure to
update by the deadline may result in board removal.
See doc/driver-model/migration.rst for more info.
====================================================
===================== WARNING ======================
This board uses CONFIG_SPL_FIT_GENERATOR. Please migrate
to binman instead, to avoid the proliferation of
arch-specific scripts with no tests.
====================================================
  CFGCHK  u-boot.cfg
  UPD     include/generated/asm-offsets.h
  UPD     include/generated/generic-asm-offsets.h
  LDS     u-boot.lds
  HOSTLD  scripts/dtc/dtc
  HOSTCC  tools/gen_eth_addr

----------------------------------------------------------
------------- More .o files compiled here ----------------
----------------------------------------------------------

OBJCOPY spl/u-boot-spl-nodtb.bin
  SYM     spl/u-boot-spl.sym
  CAT     spl/u-boot-spl-dtb.bin
  COPY    spl/u-boot-spl.bin
/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654/tools/k3_gen_x509_cert.sh -c 16 -b spl/u-boot-spl.bin \
                        -o tiboot3.bin -l 0x43c00000 -r 1 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem
 SWRV = 1
make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'

2. make sysfw-image

jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ make sysfw-image
=====================================
Building the Linux Kernel DTBs
=====================================
make -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538 ARCH=arm64 CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- tisdk_am62axx-evm_defconfig
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538'
#
# No change to .config
#

=============================
Building SYSFW Image
=============================
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'
./gen_its.sh am62ax hs evm out/soc/am62ax/evm/sysfw.bin-hs out/soc/am62ax/evm/board-cfg.bin out/soc/am62ax/evm/pm-cfg.bin out/soc/am62ax/evm/rm-cfg.bin out/soc/am62ax/evm/tifs-rm-cfg.bin out/soc/am62ax/evm/sec-cfg.bin > out/soc/am62ax/evm/sysfw-am62ax-evm.its
fatal: No names found, cannot describe anything.
Signing the SYSFW inner certificate with /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem key...

MY DEBUG HERE

./gen_x509_cert.sh -d -c m3 -b /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin -o ti-fs-firmware-am62ax-hs-certs.bin -l 0x40000 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1;
Certificate being generated :
        LOADADDR = 0x00040000
        IMAGE_SIZE = 1684
        CERT_TYPE = 3
SUCCESS: Image ti-fs-firmware-am62ax-hs-certs.bin generated.
cat ti-fs-firmware-am62ax-hs-certs.bin /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin > out/soc/am62ax/evm/sysfw.bin-hs
mkimage -f out/soc/am62ax/evm/sysfw-am62ax-evm.its -r sysfw-am62ax-evm.itb
FIT description: SYSFW and Config Fragments
Created:         Mon Nov  4 12:12:27 2024
 Image 0 (sysfw.bin)
  Description:  sysfw
  Created:      Mon Nov  4 12:12:27 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    163142 Bytes = 159.32 KiB = 0.16 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
 Image 1 (board-cfg.bin)
  Description:  board-cfg
  Created:      Mon Nov  4 12:12:27 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    29 Bytes = 0.03 KiB = 0.00 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
 Image 2 (pm-cfg.bin)
  Description:  pm-cfg
  Created:      Mon Nov  4 12:12:27 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    2 Bytes = 0.00 KiB = 0.00 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
 Image 3 (rm-cfg.bin)
  Description:  rm-cfg
  Created:      Mon Nov  4 12:12:27 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    1398 Bytes = 1.37 KiB = 0.00 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
 Image 4 (tifs-rm-cfg.bin)
  Description:  tifs-rm-cfg
  Created:      Mon Nov  4 12:12:27 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    1238 Bytes = 1.21 KiB = 0.00 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
 Image 5 (sec-cfg.bin)
  Description:  sec-cfg
  Created:      Mon Nov  4 12:12:27 2024
  Type:         Firmware
  Compression:  uncompressed
  Data Size:    349 Bytes = 0.34 KiB = 0.00 MiB
  Architecture: ARM
  OS:           Unknown OS
  Load Address: unavailable
python3 ./scripts/sysfw_boardcfg_blob_creator.py -b out/soc/am62ax/evm/board-cfg.bin -s out/soc/am62ax/evm/sec-cfg.bin -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/tifs-rm-cfg.bin -o out/soc/am62ax/evm/combined-tifs-cfg.bin
INFO:root:#### Creating SYSFW data blob - out/soc/am62ax/evm/combined-tifs-cfg.bin ####
INFO:root:#### SW Rev = 1
INFO:root:#### Device Group = 0
INFO:root:#### Board config binary - out/soc/am62ax/evm/board-cfg.bin
INFO:root:#### Board config security binary - out/soc/am62ax/evm/sec-cfg.bin
INFO:root:#### Board config PM binary - out/soc/am62ax/evm/pm-cfg.bin
INFO:root:#### Board config RM binary - out/soc/am62ax/evm/tifs-rm-cfg.bin
python3 ./scripts/sysfw_boardcfg_blob_creator.py -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/rm-cfg.bin -o out/soc/am62ax/evm/combined-dm-cfg.bin
INFO:root:#### Creating SYSFW data blob - out/soc/am62ax/evm/combined-dm-cfg.bin ####
INFO:root:#### SW Rev = 1
INFO:root:#### Device Group = 0
INFO:root:#### Board config PM binary - out/soc/am62ax/evm/pm-cfg.bin
INFO:root:#### Board config RM binary - out/soc/am62ax/evm/rm-cfg.bin

MY DEBUG HERE

./scripts/gen_x509_combined_cert.sh -b /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5/spl/u-boot-spl.bin -l 0x43c00000 -s /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin -m 0x40000 -c "/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin" -d out/soc/am62ax/evm/combined-tifs-cfg.bin -n 0x67000 -t out/soc/am62ax/evm/combined-dm-cfg.bin -y 0x43c3c800 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1 -o tiboot3-am62ax-hs-evm.bin
Certificate being generated :
SUCCESS: Image tiboot3-am62ax-hs-evm.bin generated.
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'

Thanks,

Joseph

0 Joseph Tingin 27 days ago in reply to Joseph Tingin

Prodigy 100 points

Also want to add that it looks like ATF and OPTEE are all part of tispl.bin_HS and u-boot.img_HS, which happen later in the SPL boot flow.

I think my issue is at the very start with tiboot3-am62ax-hs-evm.bin. This only requires u-boot-spl.bin and TIFS HS-SE FW, according to https://software-dl.ti.com/processor-sdk-linux/esd/AM62AX/08_06_00_45/exports/docs/linux/Foundational_Components/U-Boot/UG-General-Info.html

Joseph

0 Hong Guan64 27 days ago in reply to Joseph Tingin

TI__Guru 61675 points

I'd recommend to refer to the slide "AM62x_Secure_SDK_v1.pdf" on how to build/sign tiboot3.bin/tisp.bin/u-boot.img in SDK 8.x
https://dr-download.ti.com/authenticated/software-development/application-software-framework/MD-W5I8h4voaD/09.01.00.05/AM62x_Secure_SDK_v1.pdf?
Best,
-Hong

0 Joseph Tingin 27 days ago in reply to Hong Guan64

Prodigy 100 points

Thank you for sharing the slides. Starting with the R5 SPL Build and Sign (1/3) page this is what I've confirmed:

1. R5 SPL for HS is built (done with make u-boot_r5)

u-boot-spl.bin is generated and I see u-boot-spl-nodtb.bin and u-boot-spl.multidtb.fit in \board-support\u-boot_build\r5\spl with current timestamps

2. Combined board configurations “combined-tifs-cfg.bin” & “combined-dm-cfg.bin” are built (done with make sysfw-image)

I see boardcfg.bin, sec-cfg.bin, pm-cfg, rm-cfg.bin, combined-tifs-cfg.bin, and combined-dm-cfg.bin all in \k3-image-gen-2022.01\out\soc\am62ax\evm with current timestamps.

The build output I shared above also shows me using the scripts to generate combined board configs.

python3 ./scripts/sysfw_boardcfg_blob_creator.py -b out/soc/am62ax/evm/board-cfg.bin -s out/soc/am62ax/evm/sec-cfg.bin -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/tifs-rm-cfg.bin -o out/soc/am62ax/evm/combined-tifs-cfg.bin

python3 ./scripts/sysfw_boardcfg_blob_creator.py -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/rm-cfg.bin -o out/soc/am62ax/evm/combined-dm-cfg.bin

3. tiboot.bin signed (done with make sysfw-image)

\core-secdev-k3\keys\custMpk.pem matches key generated.

I see tiboot3-am62ax-hs-evm.bin in \k3-image-gen-2022.01 with current timestamp. The log I shared above also shows I'm using gen_x509_combined_cert.sh to sign this

./scripts/gen_x509_combined_cert.sh -b /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5/spl/u-boot-spl.bin -l 0x43c00000 -s /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin -m 0x40000 -c "/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin" -d out/soc/am62ax/evm/combined-tifs-cfg.bin -n 0x67000 -t out/soc/am62ax/evm/combined-dm-cfg.bin -y 0x43c3c800 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1 -o tiboot3-am62ax-hs-evm.bin

Am I using the correct ti-fs-firmware-am62ax-hs-enc.bin and ti-fs-firmware-am62ax-hs-cert.bin? The script is using the files from /board-support/prebuilt-images/.

Thanks,

Joseph

0 Hong Guan64 25 days ago in reply to Joseph Tingin

TI__Guru 61675 points

I'd recommend testing first on the board you programed with the TI testing key.
1/. Have we tried booting with the prebuilt binaries (HS-SE) included in SDK package?
2/. Any log message?
Best,
-Hong

0 Joseph Tingin 20 days ago in reply to Hong Guan64

Prodigy 100 points

Hi Hong,

Yes, I tried this first on my first board that was programmed with TI testing key. I mentioned this above in one of my earlier responses.

Hong Guan64 said:
1/. Have we tried booting with the prebuilt binaries (HS-SE) included in SDK package?

I also tried this but I experienced similar results where I could not load the next tispl.bin_HS image in.

Hong Guan64 said:
2/. Any log message?

Using the prebuilt binaries, I do see some log message. I shared this above but I can share it here again

U-Boot SPL 2021.01-g2ee8efd654 (Feb 27 2023 - 11:47:43 +0000)
SYSFW ABI: 3.1 (firmware rev 0x0008 '8.6.4--v08.06.04 (Chill Capybar')
am62a_init: board_init_f done

I noticed the compilation message has a warning about binman. Could this be causing issues?

===================== WARNING ======================
  CC      lib/asm-offsets.s
  CC      arch/arm/lib/asm-offsets.s
This board uses CONFIG_SPL_FIT_GENERATOR. Please migrate
to binman instead, to avoid the proliferation of
arch-specific scripts with no tests.
====================================================

Thanks,

Joseph

Processors

Processors forum

PROCESSOR-SDK-AM62A: HS-SE R5 image not booting