PROCESSOR-SDK-AM62A: HS-SE R5 image not booting

Part Number: PROCESSOR-SDK-AM62A

Tool/software:

Hi,

I was able to convert my hs-fs device to hs-se using TI's dummy keys. After building the SPL images in the processor sdk with the default key provided, the tiboot3-am62ax-hs-evm.bin image doesn't boot. I referenced this guide for building the images. software-dl.ti.com/.../Foundational_Components_Migration_Guide.html

-----------------------
SoC ID Header Info:
-----------------------
NumBlocks            : 2
-----------------------
SoC ID Public ROM Info:
-----------------------
SubBlockId           : 1
SubBlockSize         : 26
DeviceName           : am62a
DeviceType           : HSSE
DMSC ROM Version     : [0, 0, 8, 0]
R5 ROM Version       : [0, 0, 8, 0]
-----------------------
SoC ID Secure ROM Info:
-----------------------
Sec SubBlockId       : 2
Sec SubBlockSize     : 166
Sec Prime            : 0
Sec Key Revision     : 1
Sec Key Count        : 2
Sec TI MPK Hash      : cb39ee39c52d0469806636ff350520fcf7065cbec5cdddfea08863506c2be9f2242ff3207f919c2edcff407261f0908459139f3c153770f
Sec Cust MPK Hash    : 1f6002b07cd9b0b7c47d9ca8d1aae57b8e8784a12f636b2b760d7d98a18f189760dfd0f23e2b0cb10ec7edc7c6edac3d9bdfefe0eddc3ff
Sec Unique ID        : 760cf9c2ab60c48458b0841818e1d1387423a70a45196ce0d2020f958bee3a22

I set device_type to hs and I'm using the correct dfu defconfig since I'm using dfu boot. I compile using make u-boot, then make sysfw-image.

I did not copy the smpk.pem from <MCU_PLUS_SDK_INSTALL_DIR>\source\security\sbl_keywriter\scripts\cert_gen\am62ax\keys_devel\ to ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\core-secdev-k3\keys\custMpk.pem because these were already the same exact default keys. The Cust MPK Hash fused on the board also matches the SMPKH from verify_hash.csv

My device is able to go into dfu boot and it accepts the image after loading but I don't see any serial output. I also can't proceed to load the next tispl.bin_HS. Is there anything else I'm supposed to copy over to the processor sdk before compiling? Is there any other way to confirm the images built are signed with the correct keys?

Thanks,
Joseph

  • 1/. Is it the TI reference board or customer board?
    2/. If it is the TI board, have we tested the tiboot3.bin (HS-SE) booting from SD?
    3/. what is the SDK version?
    Best,
    -Hong

  • Hi Hong,

    Thanks for your response. This is a custom board and I'm using the ti-processor-sdk-linux-am62axx-evm-08.06.00.45 version. I tried testing the tiboot3-am62ax-hs-evm.bin from ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\prebuilt-images and I finally got output.

    U-Boot SPL 2021.01-g2ee8efd654 (Feb 27 2023 - 11:47:43 +0000)
    SYSFW ABI: 3.1 (firmware rev 0x0008 '8.6.4--v08.06.04 (Chill Capybar')
    am62a_init: board_init_f done
    

    I tried this process again on another custom board but this time I generated my own custom keys and converted the device to hs-se.  I copied the custMpk.pem into core-secdev-k3\keys\custMpk.pem . I got no output after trying to boot the secure tiboot3-am62ax-hs-evm.bin from ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\k3-image-gen-2022.01

    $ ./dfu-util-v11.exe -l
    dfu-util 0.11
    
    Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
    Copyright 2010-2021 Tormod Volden and Stefan Schmidt
    This program is Free Software and has ABSOLUTELY NO WARRANTY
    Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
    
    Found DFU: [0451:6165] ver=0200, devnum=19, cfg=1, intf=0, path="1-2", alt=1, name="SocId", serial="01.00.00.00"
    Found DFU: [0451:6165] ver=0200, devnum=19, cfg=1, intf=0, path="1-2", alt=0, name="bootloader", serial="01.00.00.00"
    
    
    
    
    $ ./dfu-util-v11.exe -R -a bootloader -D tiboot3-am62ax-hs-evm.bin
    dfu-util 0.11
    
    Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
    Copyright 2010-2021 Tormod Volden and Stefan Schmidt
    This program is Free Software and has ABSOLUTELY NO WARRANTY
    Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
    
    Opening DFU capable USB device...
    Device ID 0451:6165
    Device DFU version 0110
    Claiming USB DFU Interface...
    Setting Alternate Interface #0 ...
    Determining device status...
    DFU state(2) = dfuIDLE, status(0) = No error condition is present
    DFU mode device DFU version 0110
    Device returned transfer size 512
    Copying data from PC to DFU device
    Download        [=========================] 100%       357451 bytes
    Download done.
    DFU state(6) = dfuMANIFEST-SYNC, status(0) = No error condition is present
    DFU state(2) = dfuIDLE, status(0) = No error condition is present
    Done!
    Resetting USB to switch back to Run-Time mode
    Warning: Invalid DFU suffix signature
    A valid DFU suffix will be required in a future dfu-util release
    
    
    
    
    
    $ ./dfu-util-v11.exe -l
    dfu-util 0.11
    
    Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
    Copyright 2010-2021 Tormod Volden and Stefan Schmidt
    This program is Free Software and has ABSOLUTELY NO WARRANTY
    Please report bugs to http://sourceforge.net/p/dfu-util/tickets/
    
    Found DFU: [0451:6165] ver=0200, devnum=24, cfg=1, intf=0, path="1-2", alt=1, name="UNKNOWN", serial="UNKNOWN"
    Found DFU: [0451:6165] ver=0200, devnum=24, cfg=1, intf=0, path="1-2", alt=0, name="UNKNOWN", serial="UNKNOWN"
    Failed to retrieve language identifiers
    Failed to retrieve language identifiers
    Failed to retrieve language identifiers
    Failed to retrieve language identifiers

    Thanks,

    Joseph

  • I tried testing the tiboot3-am62ax-hs-evm.bin from ti-processor-sdk-linux-am62axx-evm-08.06.00.45\board-support\prebuilt-images and I finally got output.

    1/. what is the boot mode?
    2/. do we have more boot message/log?
    Best,
    -Hong

  • Hi Hong,

    I'm using DFU boot. I did the same steps that I showed in the snippet above.

    2/. do we have more boot message/log?

    When using the tiboot3-am62ax-hs-evm.bin that I built, I don't see any serial output. But when using the tiboot3-am62ax-hs-evm.bin from /prebuilt-images, this is the only output. I'm not sure if this means it fully executed.

    U-Boot SPL 2021.01-g2ee8efd654 (Feb 27 2023 - 11:47:43 +0000)
    SYSFW ABI: 3.1 (firmware rev 0x0008 '8.6.4--v08.06.04 (Chill Capybar')
    am62a_init: board_init_f done

     

    Thanks,

    Joseph

  • Thanks for sharing these sample logs.

    I think my main problem is why the images don't boot after I compile them in ti-processor-sdk-linux-am62axx-evm-08.06.00.45. If I'm using a gp, or hs-fs device and I build the SPL images, everything works as expected.

    When I switch to hs device type and compile for secure boot, that's when the SPL images don't boot. My understanding is the key signing and certificate generation is handled automatically.

    Am I missing anything in my build steps?

    1. make u-boot

    2. make sysfw-image

    $ make sysfw-image
    =====================================
    Building the Linux Kernel DTBs
    =====================================
    make -C /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538 ARCH=arm64 CROSS_COMPILE=/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- tisdk_am62axx-evm_defconfig
    make[1]: Entering directory '/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538'
    #
    # No change to .config
    #
    =============================
    Building SYSFW Image
    =============================
    make[1]: Entering directory '/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'
    ./scripts/gen_x509_combined_cert.sh -b /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5/spl/u-boot-spl.bin -l 0x43c00000 -s /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin -m 0x40000 -c "/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin" -d out/soc/am62ax/evm/combined-tifs-cfg.bin -n 0x67000 -t out/soc/am62ax/evm/combined-dm-cfg.bin -y 0x43c3c800 -k /jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1 -o tiboot3-am62ax-hs-evm.bin
    Certificate being generated :
    SUCCESS: Image tiboot3-am62ax-hs-evm.bin generated.
    make[1]: Leaving directory '/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'

    Joseph

  • Was the HS-SE programmed with the TI testing key or the customer testing key?
    If it was the customer key, all binary needs to be signed with the customer key.
    Additionally ATF and OPTEE also needs to be signed with the customer key. refer to this early e2e
    https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1246915/am625-tiboot3-bin-uart-xmodem-file-transfer/4729158#4729158
    Best,
    -Hong

  • Hi Hong,

    I have two HS-SE boards.

    One board was programmed with TI testing key.

    Another board was programmed with my own generated customer key (./gen_keywr_cert.sh -g).

    I read through the e2e and it looks like the customer ensures the custMpk.pem is the correct key (TI default or generated). I've built images using both keys and the images don't work with their respective boards.

    Is there a way to manually sign ATF and OPTEE? My understanding is this is handled with the command "make sysfw-image".

    This is my complete build log after a make clean.

    1. make u-boot

    jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ make u-boot
    ===================================
    Building U-boot for A53
    ===================================
    make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- \
             am62ax_genesis_revB_a53_defconfig O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53
    make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
      GEN     ./Makefile
      HOSTCC  scripts/basic/fixdep
      LEX     scripts/kconfig/zconf.lex.c
      YACC    scripts/kconfig/zconf.tab.c
      HOSTCC  scripts/kconfig/conf.o
      HOSTCC  scripts/kconfig/zconf.tab.o
      HOSTLD  scripts/kconfig/conf
    #
    # configuration written to .config
    #
    make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
    make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    if [ am62axx-evm = am62xx-evm ] || [ am62axx-evm = am62axx-evm ] || [ am62axx-evm = am62xx-lp-evm ]; then \
            make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- \
                    CONFIG_MKIMAGE_DTC_PATH=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53/scripts/dtc/dtc \
                    ATF=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl31.bin TEE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl32.bin DM=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ipc_echo_testb_mcu1_0_release_strip.xer5f \
                    O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53; \
    else \
            make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- \
                    CONFIG_MKIMAGE_DTC_PATH=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53/scripts/dtc/dtc \
                    ATF=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl31.bin TEE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/bl32.bin \
                    O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53; \
    fi
    make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
      GEN     ./Makefile
    scripts/kconfig/conf  --syncconfig Kconfig
      UPD     include/config.h
      GEN     include/autoconf.mk.dep
      CFG     u-boot.cfg
      CFG     spl/u-boot.cfg
      GEN     include/autoconf.mk
      GEN     spl/include/autoconf.mk
      GEN     ./Makefile
      UPD     include/generated/dt.h
      UPD     include/generated/timestamp_autogenerated.h
      UPD     include/config/uboot.release
      Using /net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654 as source for U-Boot
      UPD     include/generated/version_autogenerated.h
      HOSTCC  scripts/dtc/flattree.o
      HOSTCC  scripts/dtc/dtc.o
      HOSTCC  scripts/dtc/fstree.o
      HOSTCC  scripts/dtc/data.o
      HOSTCC  scripts/dtc/livetree.o
      HOSTCC  scripts/dtc/srcpos.o
      HOSTCC  scripts/dtc/treesource.o
      HOSTCC  scripts/dtc/util.o
      HOSTCC  scripts/dtc/checks.o
      LEX     scripts/dtc/dtc-lexer.lex.c
      YACC    scripts/dtc/dtc-parser.tab.h
      YACC    scripts/dtc/dtc-parser.tab.c
      HOSTCC  scripts/dtc/dtc-parser.tab.o
      HOSTCC  scripts/dtc/dtc-lexer.lex.o
    ===================== WARNING ======================
      CC      lib/asm-offsets.s
      CC      arch/arm/lib/asm-offsets.s
    This board uses CONFIG_SPL_FIT_GENERATOR. Please migrate
    to binman instead, to avoid the proliferation of
    arch-specific scripts with no tests.
    ====================================================
      CFGCHK  u-boot.cfg
      UPD     include/generated/asm-offsets.h
      UPD     include/generated/generic-asm-offsets.h
      LDS     u-boot.lds
      HOSTLD  scripts/dtc/dtc
      HOSTCC  tools/gen_eth_addr
      HOSTCC  tools/gen_ethaddr_crc.o
      WRAP    tools/lib/crc8.c
      HOSTCC  tools/img2srec
    
    ----------------------------------------------------------
    ------------- More .o files compiled here ----------------
    ----------------------------------------------------------
    
      LD      spl/drivers/built-in.o
      LD      spl/u-boot-spl
      OBJCOPY spl/u-boot-spl-nodtb.bin
      SYM     spl/u-boot-spl.sym
      SECURE  spl/u-boot-spl-nodtb.bin_HS
      CAT     spl/u-boot-spl-dtb.bin
      COPY    spl/u-boot-spl.bin
      MKIMAGE tispl.bin_HS
      MKIMAGE tispl.bin
    FIT description: Configuration to load ATF and SPL
    Created:         Mon Nov  4 12:10:04 2024
     Image 0 (atf)
      Description:  ARM Trusted Firmware
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    45801 Bytes = 44.73 KiB = 0.04 MiB
      Architecture: AArch64
      OS:           ARM Trusted Firmware
      Load Address: 0x9e780000
     Image 1 (tee)
      Description:  OPTEE
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Trusted Execution Environment Image
      Compression:  uncompressed
      Data Size:    425713 Bytes = 415.74 KiB = 0.41 MiB
     Image 2 (dm)
      Description:  DM binary
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    471653 Bytes = 460.60 KiB = 0.45 MiB
      Architecture: Unknown Architecture
      OS:           Unknown OS
      Load Address: 0x89000000
     Image 3 (spl)
      Description:  SPL (64-bit)
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Standalone Program
      Compression:  uncompressed
      Data Size:    228001 Bytes = 222.66 KiB = 0.22 MiB
      Architecture: AArch64
      Load Address: 0x80080000
      Entry Point:  0x80080000
     Image 4 (k3-am62a7-genesis-revB.dtb)
      Description:  k3-am62a7-genesis-revB
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Flat Device Tree
      Compression:  uncompressed
      Data Size:    19749 Bytes = 19.29 KiB = 0.02 MiB
      Architecture: ARM
     Default Configuration: 'k3-am62a7-genesis-revB.dtb'
     Configuration 0 (k3-am62a7-genesis-revB.dtb)
      Description:  k3-am62a7-genesis-revB
      Kernel:       unavailable
      Firmware:     atf
      FDT:          k3-am62a7-genesis-revB.dtb
      Loadables:    tee
                    dm
                    spl
    FIT description: Configuration to load ATF and SPL
    Created:         Mon Nov  4 12:10:04 2024
     Image 0 (atf)
      Description:  ARM Trusted Firmware
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    45801 Bytes = 44.73 KiB = 0.04 MiB
      Architecture: AArch64
      OS:           ARM Trusted Firmware
      Load Address: 0x9e780000
     Image 1 (tee)
      Description:  OPTEE
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Trusted Execution Environment Image
      Compression:  uncompressed
      Data Size:    425713 Bytes = 415.74 KiB = 0.41 MiB
     Image 2 (dm)
      Description:  DM binary
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    471653 Bytes = 460.60 KiB = 0.45 MiB
      Architecture: Unknown Architecture
      OS:           Unknown OS
      Load Address: 0x89000000
     Image 3 (spl)
      Description:  SPL (64-bit)
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Standalone Program
      Compression:  uncompressed
      Data Size:    228001 Bytes = 222.66 KiB = 0.22 MiB
      Architecture: AArch64
      Load Address: 0x80080000
      Entry Point:  0x80080000
     Image 4 (k3-am62a7-genesis-revB.dtb)
      Description:  k3-am62a7-genesis-revB
      Created:      Mon Nov  4 12:10:04 2024
      Type:         Flat Device Tree
      Compression:  uncompressed
      Data Size:    19749 Bytes = 19.29 KiB = 0.02 MiB
      Architecture: ARM
     Default Configuration: 'k3-am62a7-genesis-revB.dtb'
     Configuration 0 (k3-am62a7-genesis-revB.dtb)
      Description:  k3-am62a7-genesis-revB
      Kernel:       unavailable
      Firmware:     atf
      FDT:          k3-am62a7-genesis-revB.dtb
      Loadables:    tee
                    dm
                    spl
    make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
    make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    ===================================
    Building U-boot for R5
    ===================================
    make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/arm-none-linux-gnueabihf- \
             am62ax_genesis_revB_r5_usbdfu_defconfig O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5
    make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
      GEN     ./Makefile
      HOSTCC  scripts/basic/fixdep
      YACC    scripts/kconfig/zconf.tab.c
      LEX     scripts/kconfig/zconf.lex.c
      HOSTCC  scripts/kconfig/conf.o
      HOSTCC  scripts/kconfig/zconf.tab.o
      HOSTLD  scripts/kconfig/conf
    #
    # configuration written to .config
    #
    make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
    make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    make -j 20 -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/arm-none-linux-gnueabihf- \
            O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5
    make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
      GEN     ./Makefile
    scripts/kconfig/conf  --syncconfig Kconfig
      UPD     include/config.h
      CFG     u-boot.cfg
      GEN     include/autoconf.mk.dep
      CFG     spl/u-boot.cfg
      GEN     include/autoconf.mk
      GEN     spl/include/autoconf.mk
      GEN     ./Makefile
      UPD     include/generated/dt.h
      UPD     include/generated/timestamp_autogenerated.h
      UPD     include/config/uboot.release
      Using /net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654 as source for U-Boot
      UPD     include/generated/version_autogenerated.h
      HOSTCC  scripts/dtc/dtc.o
      HOSTCC  scripts/dtc/flattree.o
      HOSTCC  scripts/dtc/fstree.o
    
    ----------------------------------------------------------
    ------------- More .o files compiled here ----------------
    ----------------------------------------------------------
    
      HOSTCC  scripts/dtc/dtc-parser.tab.o
      HOSTCC  scripts/dtc/dtc-lexer.lex.o
    ===================== WARNING ======================
      CC      lib/asm-offsets.s
      CC      arch/arm/lib/asm-offsets.s
    This board does not use CONFIG_DM_ETH (Driver Model
    for Ethernet drivers). Please update the board to use
    CONFIG_DM_ETH before the v2020.07 release. Failure to
    update by the deadline may result in board removal.
    See doc/driver-model/migration.rst for more info.
    ====================================================
    ===================== WARNING ======================
    This board uses CONFIG_SPL_FIT_GENERATOR. Please migrate
    to binman instead, to avoid the proliferation of
    arch-specific scripts with no tests.
    ====================================================
      CFGCHK  u-boot.cfg
      UPD     include/generated/asm-offsets.h
      UPD     include/generated/generic-asm-offsets.h
      LDS     u-boot.lds
      HOSTLD  scripts/dtc/dtc
      HOSTCC  tools/gen_eth_addr
    
    ----------------------------------------------------------
    ------------- More .o files compiled here ----------------
    ----------------------------------------------------------
    
    OBJCOPY spl/u-boot-spl-nodtb.bin
      SYM     spl/u-boot-spl.sym
      CAT     spl/u-boot-spl-dtb.bin
      COPY    spl/u-boot-spl.bin
    /net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654/tools/k3_gen_x509_cert.sh -c 16 -b spl/u-boot-spl.bin \
                            -o tiboot3.bin -l 0x43c00000 -r 1 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem
     SWRV = 1
    make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
    make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
    
    
    

    2. make sysfw-image

    jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ make sysfw-image
    =====================================
    Building the Linux Kernel DTBs
    =====================================
    make -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538 ARCH=arm64 CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- tisdk_am62axx-evm_defconfig
    make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/linux-5.10.168+gitAUTOINC+2c23e6c538-g2c23e6c538'
    #
    # No change to .config
    #
    
    =============================
    Building SYSFW Image
    =============================
    make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'
    ./gen_its.sh am62ax hs evm out/soc/am62ax/evm/sysfw.bin-hs out/soc/am62ax/evm/board-cfg.bin out/soc/am62ax/evm/pm-cfg.bin out/soc/am62ax/evm/rm-cfg.bin out/soc/am62ax/evm/tifs-rm-cfg.bin out/soc/am62ax/evm/sec-cfg.bin > out/soc/am62ax/evm/sysfw-am62ax-evm.its
    fatal: No names found, cannot describe anything.
    Signing the SYSFW inner certificate with /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem key...
    
    MY DEBUG HERE
    
    ./gen_x509_cert.sh -d -c m3 -b /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin -o ti-fs-firmware-am62ax-hs-certs.bin -l 0x40000 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1;
    Certificate being generated :
            LOADADDR = 0x00040000
            IMAGE_SIZE = 1684
            CERT_TYPE = 3
    SUCCESS: Image ti-fs-firmware-am62ax-hs-certs.bin generated.
    cat ti-fs-firmware-am62ax-hs-certs.bin /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin > out/soc/am62ax/evm/sysfw.bin-hs
    mkimage -f out/soc/am62ax/evm/sysfw-am62ax-evm.its -r sysfw-am62ax-evm.itb
    FIT description: SYSFW and Config Fragments
    Created:         Mon Nov  4 12:12:27 2024
     Image 0 (sysfw.bin)
      Description:  sysfw
      Created:      Mon Nov  4 12:12:27 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    163142 Bytes = 159.32 KiB = 0.16 MiB
      Architecture: ARM
      OS:           Unknown OS
      Load Address: unavailable
     Image 1 (board-cfg.bin)
      Description:  board-cfg
      Created:      Mon Nov  4 12:12:27 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    29 Bytes = 0.03 KiB = 0.00 MiB
      Architecture: ARM
      OS:           Unknown OS
      Load Address: unavailable
     Image 2 (pm-cfg.bin)
      Description:  pm-cfg
      Created:      Mon Nov  4 12:12:27 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    2 Bytes = 0.00 KiB = 0.00 MiB
      Architecture: ARM
      OS:           Unknown OS
      Load Address: unavailable
     Image 3 (rm-cfg.bin)
      Description:  rm-cfg
      Created:      Mon Nov  4 12:12:27 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    1398 Bytes = 1.37 KiB = 0.00 MiB
      Architecture: ARM
      OS:           Unknown OS
      Load Address: unavailable
     Image 4 (tifs-rm-cfg.bin)
      Description:  tifs-rm-cfg
      Created:      Mon Nov  4 12:12:27 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    1238 Bytes = 1.21 KiB = 0.00 MiB
      Architecture: ARM
      OS:           Unknown OS
      Load Address: unavailable
     Image 5 (sec-cfg.bin)
      Description:  sec-cfg
      Created:      Mon Nov  4 12:12:27 2024
      Type:         Firmware
      Compression:  uncompressed
      Data Size:    349 Bytes = 0.34 KiB = 0.00 MiB
      Architecture: ARM
      OS:           Unknown OS
      Load Address: unavailable
    python3 ./scripts/sysfw_boardcfg_blob_creator.py -b out/soc/am62ax/evm/board-cfg.bin -s out/soc/am62ax/evm/sec-cfg.bin -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/tifs-rm-cfg.bin -o out/soc/am62ax/evm/combined-tifs-cfg.bin
    INFO:root:#### Creating SYSFW data blob - out/soc/am62ax/evm/combined-tifs-cfg.bin ####
    INFO:root:#### SW Rev = 1
    INFO:root:#### Device Group = 0
    INFO:root:#### Board config binary - out/soc/am62ax/evm/board-cfg.bin
    INFO:root:#### Board config security binary - out/soc/am62ax/evm/sec-cfg.bin
    INFO:root:#### Board config PM binary - out/soc/am62ax/evm/pm-cfg.bin
    INFO:root:#### Board config RM binary - out/soc/am62ax/evm/tifs-rm-cfg.bin
    python3 ./scripts/sysfw_boardcfg_blob_creator.py -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/rm-cfg.bin -o out/soc/am62ax/evm/combined-dm-cfg.bin
    INFO:root:#### Creating SYSFW data blob - out/soc/am62ax/evm/combined-dm-cfg.bin ####
    INFO:root:#### SW Rev = 1
    INFO:root:#### Device Group = 0
    INFO:root:#### Board config PM binary - out/soc/am62ax/evm/pm-cfg.bin
    INFO:root:#### Board config RM binary - out/soc/am62ax/evm/rm-cfg.bin
    
    MY DEBUG HERE
    
    ./scripts/gen_x509_combined_cert.sh -b /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5/spl/u-boot-spl.bin -l 0x43c00000 -s /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin -m 0x40000 -c "/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin" -d out/soc/am62ax/evm/combined-tifs-cfg.bin -n 0x67000 -t out/soc/am62ax/evm/combined-dm-cfg.bin -y 0x43c3c800 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1 -o tiboot3-am62ax-hs-evm.bin
    Certificate being generated :
    SUCCESS: Image tiboot3-am62ax-hs-evm.bin generated.
    make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'

    Thanks,

    Joseph

  • Also want to add that it looks like ATF and OPTEE are all part of tispl.bin_HS and u-boot.img_HS, which happen later in the SPL boot flow.

    I think my issue is at the very start with tiboot3-am62ax-hs-evm.bin. This only requires u-boot-spl.bin and TIFS HS-SE FW, according to https://software-dl.ti.com/processor-sdk-linux/esd/AM62AX/08_06_00_45/exports/docs/linux/Foundational_Components/U-Boot/UG-General-Info.html

    Joseph

  • I'd recommend to refer to the slide "AM62x_Secure_SDK_v1.pdf" on how to build/sign tiboot3.bin/tisp.bin/u-boot.img in SDK 8.x
    https://dr-download.ti.com/authenticated/software-development/application-software-framework/MD-W5I8h4voaD/09.01.00.05/AM62x_Secure_SDK_v1.pdf?
    Best,
    -Hong

  • Thank you for sharing the slides. Starting with the R5 SPL Build and Sign (1/3) page this is what I've confirmed:

    1. R5 SPL for HS is built (done with make u-boot_r5)

    u-boot-spl.bin is generated and I see u-boot-spl-nodtb.bin and u-boot-spl.multidtb.fit in \board-support\u-boot_build\r5\spl with current timestamps

    2. Combined board configurations “combined-tifs-cfg.bin” & “combined-dm-cfg.bin” are built (done with make sysfw-image)

    I see boardcfg.bin, sec-cfg.bin, pm-cfg, rm-cfg.bin, combined-tifs-cfg.bin, and combined-dm-cfg.bin all in \k3-image-gen-2022.01\out\soc\am62ax\evm with current timestamps.

    The build output I shared above also shows me using the scripts to generate combined board configs.

    python3 ./scripts/sysfw_boardcfg_blob_creator.py -b out/soc/am62ax/evm/board-cfg.bin -s out/soc/am62ax/evm/sec-cfg.bin -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/tifs-rm-cfg.bin -o out/soc/am62ax/evm/combined-tifs-cfg.bin

    python3 ./scripts/sysfw_boardcfg_blob_creator.py -p out/soc/am62ax/evm/pm-cfg.bin -r out/soc/am62ax/evm/rm-cfg.bin -o out/soc/am62ax/evm/combined-dm-cfg.bin

    3. tiboot.bin signed (done with make sysfw-image)

    \core-secdev-k3\keys\custMpk.pem matches key generated.

    I see tiboot3-am62ax-hs-evm.bin in \k3-image-gen-2022.01 with current timestamp. The log I shared above also shows I'm using gen_x509_combined_cert.sh to sign this

    ./scripts/gen_x509_combined_cert.sh -b /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5/spl/u-boot-spl.bin -l 0x43c00000 -s /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-enc.bin -m 0x40000 -c "/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/prebuilt-images/ti-fs-firmware-am62ax-hs-cert.bin" -d out/soc/am62ax/evm/combined-tifs-cfg.bin -n 0x67000 -t out/soc/am62ax/evm/combined-dm-cfg.bin -y 0x43c3c800 -k /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/core-secdev-k3/keys/custMpk.pem -r 1 -o tiboot3-am62ax-hs-evm.bin

    Am I using the correct ti-fs-firmware-am62ax-hs-enc.bin and ti-fs-firmware-am62ax-hs-cert.bin? The script is using the files from /board-support/prebuilt-images/.

    Thanks,

    Joseph

  • I'd recommend testing first on the board you programed with the TI testing key.
    1/. Have we tried booting with the prebuilt binaries (HS-SE) included in SDK package?
    2/. Any log message?
    Best,
    -Hong

  • Hi Hong,

    Yes, I tried this first on my first board that was programmed with TI testing key. I mentioned this above in one of my earlier responses.

    1/. Have we tried booting with the prebuilt binaries (HS-SE) included in SDK package?

    I also tried this but I experienced similar results where I could not load the next tispl.bin_HS image in.

    2/. Any log message?

    Using the prebuilt binaries, I do see some log message. I shared this above but I can share it here again

    U-Boot SPL 2021.01-g2ee8efd654 (Feb 27 2023 - 11:47:43 +0000)
    SYSFW ABI: 3.1 (firmware rev 0x0008 '8.6.4--v08.06.04 (Chill Capybar')
    am62a_init: board_init_f done

    I noticed the compilation message has a warning about binman. Could this be causing issues?

    ===================== WARNING ======================
      CC      lib/asm-offsets.s
      CC      arch/arm/lib/asm-offsets.s
    This board uses CONFIG_SPL_FIT_GENERATOR. Please migrate
    to binman instead, to avoid the proliferation of
    arch-specific scripts with no tests.
    ====================================================

    Thanks,

    Joseph