PROCESSOR-SDK-AM62A: HS-SE R5 image build issue with SDK?

Hello,

In the previous thread, you have mentioned the prebuilt image is at least booting. If this is still the case, could you please share the prebuilt image (booting) and the manually built image (not booting)?

Regars,

Prashant

Hi Prashant,

Thanks for your response and happy new year. Sure I can send those over but it's not allowing me to attach them to this thread. Can I send you a message or email instead? It's also not allowing me to send you a direct message here.

Thanks,

Joseph

Happy New Year, Joseph!!

I have just sent you the friend request. Once you have accepted the request, you would be able to send me private messages.

Thanks! Just sent you the binaries.

Joseph

Hello,

Thanks for sharing the binaries.

I did compare them & think that the issue is possibly originating from the incompatible OpenSSL version. I think you might be using the OpenSSL v3.x. If yes, could you please install the OpenSSL v1.1.x & then build the U-Boot?

Regards,

Prashant

Hi Prashant,

Yes the binary I sent you was built with OpenSSL v3.0.2 15 Mar 2022. I actually tried building with OpenSSL v1.1.1 before upgrading and I had the same results where it didn't boot. I added this image in the folder I shared with you if you want to see it too.

jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ openssl version -a
OpenSSL 1.1.1  11 Sep 2018
built on: Wed May 24 17:14:51 2023 UTC
platform: debian-amd64
options:  bn(64,64) rc4(16x,int) des(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -fdebug-prefix-map=/build/openssl-rFFxFC/openssl-1.1.1=. -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPADLOCK_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
Seeding source: os-specific

Thanks,

Joseph

Hi Joseph,

Joseph Tingin said:

I actually tried building with OpenSSL v1.1.1 before upgrading and I had the same results where it didn't boot.

Then the issue might just be with the R5 SPL binary. Can you try with the clean build of the U-Boot?

On another note,

Do you have backup bootmode pins on your custom board? If yes, could you please drive high the B10, B11 pins to configure backup boot as UART.

If the ROM is rejecting the image over primary bootmode (DFU) then it would try the backup boot (UART) so you should see hex characters on the UART console. This would confirm if the issue is with the authentication failure.

Regards,

Prashant

Hi Prashant,

I tried doing a "make u-boot_clean" and "make sysfw-image_clean" to make sure all spl files were deleted and I rebuilt them using the same commands above.

jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ make u-boot_clean
===================================
Cleaining U-boot for A53
===================================
make -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/aarch64-none-linux-gnu- \
        O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53 distclean
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
  CLEAN   dts/../arch/arm/dts
  CLEAN   dts
  CLEAN   tools
  CLEAN   tools/lib tools/common
  CLEAN   spl/arch spl/board spl/cmd spl/common spl/disk spl/drivers spl/dts spl/env spl/fs spl/lib spl/u-boot-spl spl/u-boot-spl-dtb.bin spl/u-boot-spl-nodtb.bin spl/u-boot-spl-nodtb.bin_HS spl/u-boot-spl.bin spl/u-boot-spl.lds spl/u-boot-spl.map spl/u-boot-spl.multidtb.fit spl/u-boot-spl.sym spl/u-boot.cfg
  CLEAN   u-boot-nodtb.bin u-boot.lds u-boot-nodtb.bin_HS u-boot-dtb.img u-boot.img_HS u-boot.map u-boot.cfg.configs u-boot.cfg u-boot-spl-k3_HS.its u-boot.bin u-boot.srec u-boot-dtb.bin u-boot u-boot.dtb u-boot.img u-boot.sym System.map tispl.bin tispl.bin_HS
  CLEAN   scripts/basic
  CLEAN   scripts/dtc
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated spl
  CLEAN   .config .config.old include/autoconf.mk include/autoconf.mk.dep include/config.h
make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/a53'
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
===================================
Cleaining U-boot for R5
===================================
make -C /exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-* CROSS_COMPILE=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/linux-devkit/sysroots/x86_64-arago-linux/usr/bin/arm-none-linux-gnueabihf- \
        O=/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5 distclean
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
make[2]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
  CLEAN   dts/../arch/arm/dts
  CLEAN   dts
  CLEAN   tools
  CLEAN   tools/lib tools/common
  CLEAN   spl/arch spl/board spl/cmd spl/common spl/disk spl/drivers spl/dts spl/env spl/fs spl/lib spl/u-boot-spl spl/u-boot-spl-dtb.bin spl/u-boot-spl-nodtb.bin spl/u-boot-spl.bin spl/u-boot-spl.lds spl/u-boot-spl.map spl/u-boot-spl.multidtb.fit spl/u-boot-spl.sym spl/u-boot.cfg
  CLEAN   u-boot-nodtb.bin u-boot.lds u-boot-nodtb.bin_HS u-boot-dtb.img u-boot.map u-boot.cfg.configs u-boot.cfg u-boot.bin u-boot.img_HS u-boot.srec u-boot-dtb.bin u-boot u-boot.dtb u-boot.img u-boot.sym System.map
  CLEAN   scripts/basic
  CLEAN   scripts/dtc
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated spl
  CLEAN   .config .config.old include/autoconf.mk include/autoconf.mk.dep include/config.h
make[2]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot_build/r5'
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654'
jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$
jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$
jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$
jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ make sysfw-image_clean
=============================
Cleaning SYSFW Image
=============================
make[1]: Entering directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'
Makefile:166: warning: overriding recipe for target 'all'
soc/am62ax/Makefile:42: warning: ignoring old recipe for target 'all'
rm -f out/soc/am62ax/evm/sysfw.bin-hs out/soc/am62ax/evm/board-cfg.bin-signed out/soc/am62ax/evm/pm-cfg.bin-signed out/soc/am62ax/evm/rm-cfg.bin-signed out/soc/am62ax/evm/tifs-rm-cfg.bin-signed out/soc/am62ax/evm/sec-cfg.bin-signed out/soc/am62ax/evm/board-cfg.o-pre-validated out/soc/am62ax/evm/pm-cfg.o-pre-validated out/soc/am62ax/evm/rm-cfg.o-pre-validated out/soc/am62ax/evm/tifs-rm-cfg.o-pre-validated out/soc/am62ax/evm/sec-cfg.o-pre-validated out/soc/am62ax/evm/board-cfg.o.log out/soc/am62ax/evm/pm-cfg.o.log out/soc/am62ax/evm/rm-cfg.o.log out/soc/am62ax/evm/tifs-rm-cfg.o.log out/soc/am62ax/evm/sec-cfg.o.log
rm -f out/soc/am62ax/evm/combined-sysfw-cfg.bin out/soc/am62ax/evm/combined-tifs-cfg.bin out/soc/am62ax/evm/combined-dm-cfg.bin
rm -f ./sysfw-am62ax-evm.itb ./sysfw.itb
rm -f out/soc/am62ax/evm/sysfw-am62ax-evm.its
rm -f ./tiboot3-am62ax-hs-evm.bin ./tiboot3.bin
rm -f ti-fs-firmware-am62ax-hs-certs.bin
rm -df .
rm: cannot remove '.': Directory not empty
Makefile:269: recipe for target 'clean' failed
make[1]: [clean] Error 1 (ignored)
rm -df out/soc/am62ax/evm && \
 rm -df out/soc/am62ax && \
 rm -df out/soc && \
 rm -df out
rm: cannot remove 'out/soc/am62ax/evm': Directory not empty
Makefile:269: recipe for target 'clean' failed
make[1]: [clean] Error 1 (ignored)
make[1]: Leaving directory '/net/lockbox/home/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01'

I also tied B10 and B11 high and tried DFU booting again. I'm seeing the same problem and I'm not seeing anything on my console.

$ ./dfu-util-v11.exe -R -a bootloader -D /d/ti-processor-sdk-linux-am62axx-evm-08.06.00.45/board-support/k3-image-gen-2022.01/tiboot3-am62ax-hs-evm.bin
dfu-util 0.11

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Opening DFU capable USB device...
Device ID 0451:6165
Device DFU version 0110
Claiming USB DFU Interface...
Setting Alternate Interface #0 ...
Determining device status...
DFU state(2) = dfuIDLE, status(0) = No error condition is present
DFU mode device DFU version 0110
Device returned transfer size 512
Copying data from PC to DFU device
Download        [=========================] 100%       357463 bytes
Download done.
DFU state(6) = dfuMANIFEST-SYNC, status(0) = No error condition is present
DFU state(2) = dfuIDLE, status(0) = No error condition is present
Done!
Resetting USB to switch back to Run-Time mode
Warning: Invalid DFU suffix signature
A valid DFU suffix will be required in a future dfu-util release

JTingin@JTINGIN-US-LE01 MINGW64 ~/Desktop/Tools
$ ./dfu-util-v11.exe -l
dfu-util 0.11

Copyright 2005-2009 Weston Schmidt, Harald Welte and OpenMoko Inc.
Copyright 2010-2021 Tormod Volden and Stefan Schmidt
This program is Free Software and has ABSOLUTELY NO WARRANTY
Please report bugs to http://sourceforge.net/p/dfu-util/tickets/

Found DFU: [0451:6165] ver=0200, devnum=17, cfg=1, intf=0, path="1-2", alt=1, name="UNKNOWN", serial="UNKNOWN"
Found DFU: [0451:6165] ver=0200, devnum=17, cfg=1, intf=0, path="1-2", alt=0, name="UNKNOWN", serial="UNKNOWN"
Failed to retrieve language identifiers
Failed to retrieve language identifiers
Failed to retrieve language identifiers
Failed to retrieve language identifiers

Want to add when doing these same exact steps with a hs-fs board, I'm able to boot it. I've also tried a second hs-se board using custom keys and I still see the same behavior.

Thanks,

Joseph

Hi Prashant,

I compared the x509 certificates of the prebuilt image and image I built and I noticed while the first signature algorithm matches, the second one has a diff. Does the second section store the actual digital signature and do these have to match?

Prebuilt image certificate text:

jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ openssl x509 -noout -in board-support/prebuilt-images/tiboot3-am62ax-hs-evm.bin -text -inform DER
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            4f:c4:cd:e1:03:53:0e:56:cb:07:e4:19:bf:e8:00:38:ad:8a:0f:c7
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = US, ST = TX, L = Dallas, O = Texas Instruments Incorporated, OU = Processors, CN = TI Support, emailAddress = support@ti.com
        Validity
            Not Before: Feb 27 11:50:10 2023 GMT
            Not After : Mar 29 11:50:10 2023 GMT
        Subject: C = US, ST = TX, L = Dallas, O = Texas Instruments Incorporated, OU = Processors, CN = TI Support, emailAddress = support@ti.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:bf:14:ae:49:d8:7f:72:d3:6b:23:cd:eb:48:0e:
                    65:dc:22:4d:f2:0e:4f:82:f6:ed:b5:f2:dd:db:7c:
                    91:fa:6e:59:ff:d5:f7:b6:de:04:1d:8a:cc:d2:95:
                    d9:d1:e0:c4:c1:f8:50:bf:ff:48:0c:91:22:50:9a:
                    4c:7b:8b:f3:96:0a:28:26:b3:a4:d9:e0:a9:55:41:
                    1a:fb:3e:5b:27:6c:bf:ca:c0:71:af:2f:72:22:ee:
                    46:01:25:62:ad:3e:c7:04:f6:b1:18:b6:2c:c0:12:
                    6e:0f:e2:9b:3e:e5:a6:a0:a8:06:45:03:41:17:4e:
                    16:1f:a9:74:d6:84:4e:d6:79:a7:10:b8:11:a9:0e:
                    92:1f:25:dd:7f:b1:f2:d1:b9:f2:68:d8:33:59:4b:
                    82:7d:77:cc:d1:9c:fa:23:b4:fb:58:88:f2:cd:ea:
                    d5:16:f2:2c:75:2d:fa:62:c3:c1:09:6e:e0:06:70:
                    e0:b5:07:09:99:62:d9:d6:e4:e7:6c:6d:c8:82:07:
                    50:93:f7:e2:d8:ed:d1:5f:e3:d0:9e:cf:93:54:d9:
                    5f:dd:5d:ce:37:60:f1:ab:14:8a:04:7b:65:a7:ba:
                    7f:df:45:45:7c:4b:a1:5b:ae:4e:c6:94:3d:8c:4e:
                    87:d2:94:3c:a4:f3:9f:da:fc:f2:36:7c:e7:0d:ad:
                    5a:42:37:f1:2a:81:d0:6e:a1:a7:67:03:1e:87:ed:
                    00:bb:73:4a:68:28:31:a2:82:9a:a3:04:c1:e8:87:
                    ff:45:7e:aa:c1:9f:d4:3b:05:c7:83:fd:21:71:fe:
                    bd:7f:38:c9:16:19:52:0e:e6:03:33:8d:1d:1e:c9:
                    36:1c:cd:4e:9d:82:29:88:cd:9b:2a:be:6c:5f:7b:
                    b2:b2:3a:79:00:6a:7d:f5:ad:1a:9d:1e:cd:58:2a:
                    cf:5e:f4:4e:80:ab:3b:4f:dd:f8:d4:de:34:a2:c4:
                    20:d9:59:19:2d:85:02:5e:1f:68:b1:4c:8d:b9:11:
                    06:e9:2d:76:b5:58:8c:50:a8:37:6e:66:78:6f:83:
                    30:46:4d:34:9f:b4:18:4a:b9:bb:fa:7b:c5:ae:d6:
                    32:10:84:84:6c:3f:9a:80:33:35:fc:4d:bc:d5:6e:
                    60:54:50:cf:7e:6d:80:97:04:fa:8f:0b:20:fd:bd:
                    98:2b:a1:37:bd:59:fd:4a:ec:45:a1:09:8b:17:c9:
                    72:14:33:b7:05:5e:12:5d:e2:5a:1d:ce:21:54:f6:
                    e1:ea:d5:55:aa:27:eb:4d:09:df:19:40:82:2e:66:
                    89:17:65:d9:6e:b3:d6:38:4e:8d:61:16:d6:74:d4:
                    de:16:5f:51:19:d5:42:b8:83:d2:c8:de:4b:a9:69:
                    97:b6:8d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:TRUE
            1.3.6.1.4.1.294.1.3:
                0....
            1.3.6.1.4.1.294.1.9:
                0......u....0a...........C.......N..`.H.e.....@.Y<N4C.... ..}...Z..:...W..W.......H.U<X/....2.|.N.........*...j0a..................p...`.H.e.....@.p~F....X.].y .....q.....P...1.{...&.'6T....`.`..%~7...I..0P..N.0`.....0`.....................`.H.e.....@.{.L......Z^".hqO`!.....2.#...,(y.U...I.............s.....9y.-w.0`...........C.........`.H.e.....@....=dg6...5Q...........o....J..A..U.EI......[......t.....cc....
    Signature Algorithm: sha512WithRSAEncryption
         18:c1:16:c6:73:b7:5d:28:c6:56:c0:99:47:64:14:f3:26:37:
         fb:eb:b3:36:36:90:f5:47:1c:d5:3a:41:28:18:46:d1:cd:b1:
         98:01:81:fa:7a:d1:bf:04:6c:88:34:13:2b:87:88:cd:ac:f1:
         db:14:ce:a9:a1:fc:22:45:e3:36:dc:42:0b:fa:05:51:51:d4:
         ce:ef:80:12:73:b6:47:1c:5f:93:e5:17:be:6b:54:6b:b7:b0:
         e1:e4:d9:a6:2c:14:a9:83:29:79:4c:ea:f5:72:cd:a8:01:7e:
         4a:f2:18:2c:78:97:27:8b:73:cf:61:92:9e:a2:d0:86:01:4c:
         e6:85:a0:c1:97:d3:71:d2:fe:a9:32:90:80:89:69:bd:19:f9:
         8e:56:9c:81:50:af:96:60:7c:ed:33:2f:a2:0e:85:e4:2c:ae:
         61:37:f1:d6:fc:c2:6e:c3:49:db:a3:c8:a1:b9:a3:4d:6f:10:
         18:2d:ab:c0:dd:43:b0:e7:6d:ef:56:c8:41:e8:ca:bd:42:2c:
         2e:2a:a2:ad:71:2e:18:24:b3:28:02:ba:5c:37:be:6f:e4:8c:
         48:bc:5b:c6:19:61:0e:fd:58:cd:c3:80:13:6c:2a:3a:32:00:
         8b:2d:ff:08:7d:4e:ee:2f:d2:bd:75:22:ae:cd:6c:c6:76:d7:
         a0:b7:3d:9e:da:8d:66:04:c1:e6:8a:12:73:39:88:ee:53:03:
         b4:6d:b0:4a:ae:61:5e:5d:86:53:ba:b0:57:17:69:42:d1:36:
         11:23:8b:71:fb:a6:7a:dc:ee:88:31:65:d9:4c:e3:6c:90:c7:
         f8:d0:43:33:df:89:ec:24:07:e7:c4:25:9f:5c:16:9e:be:c4:
         41:d3:69:ed:1c:c8:c3:a0:09:06:02:95:ef:48:66:ef:17:bd:
         29:ac:1e:f5:4a:2b:6e:2a:bc:ee:7c:14:75:bc:e4:f3:39:0a:
         e5:1d:0c:9c:c2:2b:92:30:68:b1:8b:f6:35:ea:e5:04:ee:79:
         96:ff:f4:78:2b:48:57:ae:cd:84:a6:08:bf:fb:7a:12:fe:a7:
         c3:fe:80:29:97:a9:40:07:4a:47:3c:34:20:28:bc:21:12:c4:
         8d:70:4f:67:dc:84:e6:35:d4:f2:28:3c:91:35:bb:7b:60:ae:
         fe:95:1a:8e:89:c8:5f:e9:b3:5e:f0:64:d7:8d:42:ad:8a:8f:
         f4:36:42:ad:49:48:97:38:80:58:0b:4d:2c:c3:76:02:c7:e0:
         77:0a:f4:0f:36:3e:30:62:29:23:b3:94:f6:e3:b5:09:11:b5:
         bc:cc:eb:67:86:09:1f:54:44:52:ce:df:e8:5d:ec:44:ab:ad:
         e6:8e:c8:95:ae:8e:8d:d9

My built image certificate text:

jtingin@fermion:/exthome/jtingin/ti-processor-sdk-linux-am62axx-evm-08.06.00.45$ openssl x509 -noout -in board-support/k3-image-gen-2022.01/tiboot3-am62ax-hs-evm.bin -inform DER -text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            73:66:48:7f:fb:6f:88:9d:f8:5c:81:e2:e4:24:b6:72:eb:86:9b:2e
        Signature Algorithm: sha512WithRSAEncryption
        Issuer: C = US, ST = TX, L = Dallas, O = Texas Instruments Incorporated, OU = Processors, CN = TI Support, emailAddress = support@ti.com
        Validity
            Not Before: Jan  8 01:10:02 2025 GMT
            Not After : Feb  7 01:10:02 2025 GMT
        Subject: C = US, ST = TX, L = Dallas, O = Texas Instruments Incorporated, OU = Processors, CN = TI Support, emailAddress = support@ti.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (4096 bit)
                Modulus:
                    00:bf:14:ae:49:d8:7f:72:d3:6b:23:cd:eb:48:0e:
                    65:dc:22:4d:f2:0e:4f:82:f6:ed:b5:f2:dd:db:7c:
                    91:fa:6e:59:ff:d5:f7:b6:de:04:1d:8a:cc:d2:95:
                    d9:d1:e0:c4:c1:f8:50:bf:ff:48:0c:91:22:50:9a:
                    4c:7b:8b:f3:96:0a:28:26:b3:a4:d9:e0:a9:55:41:
                    1a:fb:3e:5b:27:6c:bf:ca:c0:71:af:2f:72:22:ee:
                    46:01:25:62:ad:3e:c7:04:f6:b1:18:b6:2c:c0:12:
                    6e:0f:e2:9b:3e:e5:a6:a0:a8:06:45:03:41:17:4e:
                    16:1f:a9:74:d6:84:4e:d6:79:a7:10:b8:11:a9:0e:
                    92:1f:25:dd:7f:b1:f2:d1:b9:f2:68:d8:33:59:4b:
                    82:7d:77:cc:d1:9c:fa:23:b4:fb:58:88:f2:cd:ea:
                    d5:16:f2:2c:75:2d:fa:62:c3:c1:09:6e:e0:06:70:
                    e0:b5:07:09:99:62:d9:d6:e4:e7:6c:6d:c8:82:07:
                    50:93:f7:e2:d8:ed:d1:5f:e3:d0:9e:cf:93:54:d9:
                    5f:dd:5d:ce:37:60:f1:ab:14:8a:04:7b:65:a7:ba:
                    7f:df:45:45:7c:4b:a1:5b:ae:4e:c6:94:3d:8c:4e:
                    87:d2:94:3c:a4:f3:9f:da:fc:f2:36:7c:e7:0d:ad:
                    5a:42:37:f1:2a:81:d0:6e:a1:a7:67:03:1e:87:ed:
                    00:bb:73:4a:68:28:31:a2:82:9a:a3:04:c1:e8:87:
                    ff:45:7e:aa:c1:9f:d4:3b:05:c7:83:fd:21:71:fe:
                    bd:7f:38:c9:16:19:52:0e:e6:03:33:8d:1d:1e:c9:
                    36:1c:cd:4e:9d:82:29:88:cd:9b:2a:be:6c:5f:7b:
                    b2:b2:3a:79:00:6a:7d:f5:ad:1a:9d:1e:cd:58:2a:
                    cf:5e:f4:4e:80:ab:3b:4f:dd:f8:d4:de:34:a2:c4:
                    20:d9:59:19:2d:85:02:5e:1f:68:b1:4c:8d:b9:11:
                    06:e9:2d:76:b5:58:8c:50:a8:37:6e:66:78:6f:83:
                    30:46:4d:34:9f:b4:18:4a:b9:bb:fa:7b:c5:ae:d6:
                    32:10:84:84:6c:3f:9a:80:33:35:fc:4d:bc:d5:6e:
                    60:54:50:cf:7e:6d:80:97:04:fa:8f:0b:20:fd:bd:
                    98:2b:a1:37:bd:59:fd:4a:ec:45:a1:09:8b:17:c9:
                    72:14:33:b7:05:5e:12:5d:e2:5a:1d:ce:21:54:f6:
                    e1:ea:d5:55:aa:27:eb:4d:09:df:19:40:82:2e:66:
                    89:17:65:d9:6e:b3:d6:38:4e:8d:61:16:d6:74:d4:
                    de:16:5f:51:19:d5:42:b8:83:d2:c8:de:4b:a9:69:
                    97:b6:8d
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:TRUE
            1.3.6.1.4.1.294.1.3:
                0....
            1.3.6.1.4.1.294.1.9:
                0......lV...0a...........C..........`.H.e.....@..a..?...H..........L.W.......(...+h....fh..
...0`.....................`.H.e.....@.{.L......Z^".hqO`!.....2.#...,(y.U...I.............s.....9y.-w.0`...........C.........`.H.e.....@....=dg6...5Q...........o....J..A..U.EI......[......t.....cc......^s.).=|L.i.
    Signature Algorithm: sha512WithRSAEncryption
         95:3a:68:53:c2:7a:25:ac:ec:b7:bc:4a:f5:78:28:c7:6c:ed:
         0b:ef:78:53:1f:70:97:fd:2f:3e:20:94:7a:df:f4:8d:14:f8:
         f9:2f:40:f0:bc:44:07:f9:b8:a1:80:c6:18:bc:10:be:a6:28:
         93:3b:05:91:3c:3d:d0:65:e7:9c:f4:f0:3b:23:2d:5f:34:7f:
         e8:ae:65:81:ac:b6:50:bb:f1:5c:aa:ce:84:52:37:42:57:b0:
         46:39:c8:af:ad:8b:03:17:56:b0:0c:75:30:4c:d4:47:d6:bc:
         fe:b2:d6:78:02:8c:1a:6d:02:73:8c:63:aa:67:ff:47:e5:1f:
         57:a1:40:0b:93:52:3d:5f:83:ad:b6:40:fa:77:bd:05:4c:5d:
         4c:e2:14:ff:d1:13:16:72:ef:49:50:aa:f1:a1:5b:c6:d9:bd:
         5f:f6:74:c4:f3:00:83:3e:7d:c6:c0:69:2f:ca:6d:37:cb:9c:
         9e:78:91:f8:39:f9:85:1f:32:23:c3:4d:a9:95:65:ec:0f:c1:
         a4:67:69:2c:2d:e1:d2:cb:f6:fe:7c:b8:28:1f:9f:32:ee:a7:
         3f:e8:1c:28:d1:6a:a0:e1:22:e6:41:88:20:d0:0d:4f:9d:d8:
         8f:e2:4b:b8:f2:89:ec:60:d3:8e:47:18:88:65:92:e5:33:94:
         b2:71:16:e1:1d:99:36:43:a4:9c:ae:f2:78:b2:0e:8b:a3:7a:
         90:3d:e0:15:9c:35:6e:3c:0d:a2:bf:b5:63:83:ad:89:f1:ff:
         12:e1:8d:be:dd:77:78:72:a1:46:0d:67:8f:85:9b:8d:fc:a5:
         96:91:48:6e:12:f7:1f:34:41:5e:de:0d:ec:d4:74:f7:68:25:
         40:48:a3:1e:65:1a:75:a7:63:48:2e:98:85:ef:a8:4a:92:c7:
         79:11:00:e0:cc:fd:11:d9:bd:c6:51:a4:cb:b1:b7:0a:f7:94:
         ca:8b:bc:73:69:79:f2:95:dd:1a:c7:b7:d1:5e:31:fb:a4:6a:
         1d:5d:95:cb:2b:b2:8e:7e:14:ab:5e:cc:9a:36:88:b1:f4:17:
         e7:f5:15:a5:24:3d:59:a9:dd:8e:f0:84:d1:41:83:89:28:cb:
         56:b4:82:32:ae:85:74:95:b4:8c:64:be:96:1d:94:f7:a9:5a:
         99:1d:1f:00:17:af:45:61:3c:35:31:c0:a4:52:e8:97:36:86:
         06:04:30:7a:db:d3:2f:34:ac:b6:d4:9c:6d:b8:f1:41:f8:b2:
         cf:85:ec:84:f9:a0:f4:9c:5a:10:b0:7d:ea:e8:65:59:a9:0b:
         64:66:0c:5f:b5:36:c7:8d:86:f5:08:c3:06:18:1d:31:8e:a6:
         48:3c:2c:c2:af:07:ea:57

Thanks,

Joseph

Hello,

Joseph Tingin said:

Does the second section store the actual digital signature and do these have to match?

Yes, that is expected.

Do you have JTAG available on your custom board? This will be helpful in checking the execution state of the WKUP R5F core.

Regards,

Prashant

Hi Prashant,

Thanks for your response to my questions.

Prashant Shivhare said:

Yes, that is expected.

Since the second section does not have the same signature, doesn't that mean the certificate is not getting generated properly? Not sure if this points to authentication failure.

I have JTAG available. I'll follow these steps to unlock JTAG for HS-SE device.

https://dev.ti.com/tirex/explore/node?node=A__AS.MqbU8ShyzoaAVGWKQRQ__AM62A-ACADEMY__WeZ9SsL__LATEST&placeholder=true

After unlocking JTAG, how would I check the execution state while performing DFU boot?

Thanks,

Joseph

Hi Joseph,

Joseph Tingin said:

Since the second section does not have the same signature, doesn't that mean the certificate is not getting generated properly?

No. The signature will always be different even for signing of the same data multiple times.

Joseph Tingin said:

I'll follow these steps to unlock JTAG for HS-SE device.

Those steps would not work as they work with the TIFS up and running.

You may apply the following patch to have the debug extension in the X.509 certificate itself. If the issue is not due to the authentication failure then the ROM would unlock the JTAG.

diff --git a/board-support/k3-image-gen-2022.01/scripts/gen_x509_combined_cert.sh b/board-support/k3-image-gen-2022.01/scripts/gen_x509_combined_cert.sh
index 8cc214d..1f09bfb 100755
--- a/board-support/k3-image-gen-2022.01/scripts/gen_x509_combined_cert.sh
+++ b/board-support/k3-image-gen-2022.01/scripts/gen_x509_combined_cert.sh
@@ -277,6 +277,7 @@ cat << 'EOF' > $TEMP_X509
  basicConstraints = CA:true
  1.3.6.1.4.1.294.1.3=ASN1:SEQUENCE:swrv
  1.3.6.1.4.1.294.1.9=ASN1:SEQUENCE:ext_boot_info
+ 1.3.6.1.4.1.294.1.8 = ASN1:SEQUENCE:debug
 
  [swrv]
  swrv=INTEGER:SW_REV
@@ -318,6 +319,12 @@ cat << 'EOF' > $TEMP_X509
  shaValue = FORMAT:HEX,OCT:SYSFW_DATA_IMAGE_SHA_VAL
  SYSFW_INNER_CERT_EXT_BOOT_BLOCK
  DM_DATA_EXT_BOOT_BLOCK
+
+ [ debug ]
+ debugUID = FORMAT:HEX,OCT:0000000000000000000000000000000000000000000000000000000000000000
+ debugType = INTEGER:4
+ coreDbgEn = INTEGER:0
+ coreDbgSecEn = INTEGER:0
 EOF
 }
 

After booting the image, try connecting to the WKUP R5F.

If you are able to connect, it should ideally be suspended at 0x43Cxxxxx address which confirms the R5 SPL is at least booting but gets into trouble very early leading to no UART logs at all.

Regards,

Prashant

Hi Prashant,

I copied your patch and rebuilt my images. I attempted to DFU boot the first binary in and saw no console output. So I setup the AM62A target configuration with XDS110 debugger.

I was able to connect to WKUP_R5FSS0_0 however I'm only suspended at 0x0000000C and not the 0x43Cxxxxx address you mentioned. I tried these multiple times and it seems it's always this address. I'm attaching a picture below that also shows the disassembly.

Does this mean it's an authentication issue?

Thanks,

Joseph

Hi Joseph,

If you are able to connect then the ROM is definitely booting the R5 SPL. I think the issue is originating from the R5 SPL itself. It is possibly going into some abort very early in the execution.

Could you please apply the following patch to trap the execution assuming it is at least reaching the board_init_f function:

diff --git a/arch/arm/mach-k3/am62a7_init.c b/arch/arm/mach-k3/am62a7_init.c
index 926585725a8..dea8d3c2cce 100644
--- a/arch/arm/mach-k3/am62a7_init.c
+++ b/arch/arm/mach-k3/am62a7_init.c
@@ -98,6 +98,9 @@ void board_init_f(ulong dummy)
 	struct udevice *dev;
 	int ret;
 
+    volatile uint8_t halt = 1;
+    while(halt);
+
 #if defined(CONFIG_CPU_V7R)
 	setup_k3_mpu_regions();
 #endif

Then, try the previous procedure again & let me know the CCS state.

Regards,

Prashant

Hi Prashant,

Thanks for sharing this debug. I applied your patch and you're right that I'm now halted at the address range you mentioned prior.

Note that board_init_f() was never modified in our code and this code executes hs-fs devices normally. Are there any changes here required for hs-se devices?

Also is there a way I can step through this with the debugger with the way I'm loading the R5 SPL in? I can try sprinkling this halt debug (and some prints) in the meantime to see if I can find where it errors out.

Regards,

Joseph

I was able to find where it's erroring out and it looks like it crashes in board-support/u-boot-2021.01+gitAUTOINC+2ee8efd654-g2ee8efd654/lib/fdtdec.c in fdtdec_setup() when it tries to locate_dtb_in_fit(). 

This is the execution flow:

board_init_f() -> spl_early_init() -> spl_common_init() -> fdtdec_setup() -> locate_dtb_in_fit()

My understanding is it's looking for the device tree in the image. Does the device tree need any changes for secure boot?

Thanks,

Joseph