AM6421: Application is failed to boot if 'ENC_ENABLED=yes'

Jenny Zhou

Prodigy 230 points

Part Number: AM6421
Other Parts Discussed in Thread: SYSCONFIG

Tool/software:

Hi TI Expert,

I'm using the MCU SDK: mcu_plus_sdk_am64x_10_00_00_20.

I've already use the OPT Keywriter to program the TI's dummpy keys into SMPK, SMEK.

and I've built secure 'SBL' and secure 'FreeRTOS Application'.

I can boot the secure 'SBL' but failed to boot secure application. SBL boot failed at 'Bootloader_socAuthImage', specifically, "respParam.flag = 0x0", refer to following screenshot:

My SBL's build command is:

python C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/security/security_common/tools/boot/signing/rom_image_gen.py
--swrv 1 --sbl-enc
--enc-key C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/security/security_common/tools/boot/signing/custMek_am64x_am243x.txt
--sbl-bin C:/git/ark-mpu-2-7-snarc/App/BL/im_pmc/sbl_qspi_flash/Debug/sbl_qspi_flash.bin --sysfw-bin C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/drivers/sciclient/soc/am64x_am243x/sysfw-hs-enc.bin
--sysfw-inner-cert C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/drivers/sciclient/soc/am64x_am243x/sysfw-hs-enc-cert.bin
--boardcfg-blob C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/drivers/sciclient/sciclient_default_boardcfg/am64x/boardcfg_blob_flex.bin
--sbl-loadaddr 0x70000000 --sysfw-loadaddr 0x44000 --bcfg-loadaddr 0x7B000
--key C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/security/security_common/tools/boot/signing/custMpk_am64x_am243x.pem
--debug DBG_FULL_ENABLE --rom-image sbl_qspi.Debug.hs.tiimage

My Application's build command is:

python C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/security/security_common/tools/boot/signing/appimage_x509_cert_gen.py
--bin C:/git/ark-mpu-2-7-snarc/App/PM/dsp/Project/CCS/A53/Release/pm_am64x-a53ss0-0.appimage
--authtype 1 --key C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/security/security_common/tools/boot/signing/custMpk_am64x_am243x.pem
--enc y
--enckey C:/git/ark-mpu-2-7-snarc/Environment/Bsp/AM64x/SDK/mcu_plus_sdk_am64x_10_00_00_20/source/security/security_common/tools/boot/signing/custMek_am64x_am243x.txt
--output C:/git/ark-mpu-2-7-snarc/App/PM/dsp/Project/CCS/A53/Release/pm_am64x-a53ss0-0.appimage.hs

One more information is that: if I tried not to encrypt the application image by setting 'ENC_ENABLED?=no' in 'devconfig.mak', application can be booted.

5 months ago

0 Prashant Shivhare 5 months ago

TI__Guru 70041 points

Hello,

Jenny Zhou said:
I'm using the MCU SDK: mcu_plus_sdk_am64x_10_00_00_20.

This SDK version does not support encrypted boot.

The encrypted boot is supported starting the SDK v10_01_00_32.

https://e2e.ti.com/support/microcontrollers/arm-based-microcontrollers-group/arm-based-microcontrollers/f/arm-based-microcontrollers-forum/1415720/am2432-am2432-secure-boot-encryption-with-ospi-flash-expected-date

Regards,

Prashant

0 Jenny Zhou 5 months ago in reply to Prashant Shivhare

Prodigy 230 points

Hi Prashant,

thanks for your information, I'll give it a try.

0 Jenny Zhou 4 months ago in reply to Jenny Zhou

Prodigy 230 points

Hi Prashant,

I've tried the new MCU SDK, I can secure boot the SBL, but SBL still failed to secure boot the application.

I'm using 'mcu_plus_sdk_am64x_11_00_00_15' & 'sysconfig_1.22.0'.

Within SBL, I found there's some important config parameters inside 'Bootloader_Config_s', I config as following:

Bootloader_Config gBootloaderConfig[CONFIG_BOOTLOADER_NUM_INSTANCES] =
{
{
&gBootloaderFlashFxns,
&gBootloader0Args,
BOOTLOADER_MEDIA_FLASH,
0,
0,
(uint8_t *)(0x84000000), //DDR addr
.socCoreOpMode= (void *)&operatingMode,
.isAppimageSigned = TRUE,
.disableAppImageAuth = FALSE,
.initICSSCores = TRUE,
1, //enableScratchMem
},
};

Assert occurs as following:

TR Response failed for transfer : SRC = 0x61000000, DST = 0x84000000, SIZE = 32
ASSERT: 50.276492s: ospi/v0/lld/dma/udma/ospi_udma_lld.c:OSPI_udmaUpdateSubmitTR:259: FALSE failed !!!

I found the line following cause above assertion.:

One more information, on a HS-FS device(with unprogramed OTP), I can boot the application only by setting the 'enableScratchMem=0', and sbl also can not boot application if 'enableScratchMem=1'

0 Prashant Shivhare 4 months ago in reply to Jenny Zhou

TI__Guru 70041 points

Jenny Zhou said:
TR Response failed for transfer : SRC = 0x61000000, DST = 0x84000000, SIZE = 32
ASSERT: 50.276492s: ospi/v0/lld/dma/udma/ospi_udma_lld.c:OSPI_udmaUpdateSubmitTR:259: FALSE failed !!!

If you disable the DMA in the OSPI module of the SBL through Sysconfg, does it work?

Jenny Zhou said:
One more information, on a HS-FS device(with unprogramed OTP), I can boot the application only by setting the 'enableScratchMem=0',

The encrypted boot is possible only on the HSSE devices.

0 Jenny Zhou 4 months ago in reply to Prashant Shivhare

Prodigy 230 points

to boot a encrypted application, should I set the 'enableScratchMem=1', and give the 'scratchMemPtr'?

0 Jenny Zhou 4 months ago in reply to Jenny Zhou

Prodigy 230 points

Hi Prashant,

One good news: I can boot the unencrypted application by 'disable the DMA in OSPI module'.

But I still can not boot the encrypted application.

No matter with 'enableScratchMem=0' or 'enableScratchMem=1' & 'scratchMemPtr=0x84000000'

I got 'respParams.flag=0' within 'Sciclient_procBootAuthAndStart', I've already modified application's x509 certificate as SBL, I don't why it doesn't work, is there a way to get more detail log?

0 Prashant Shivhare 4 months ago in reply to Jenny Zhou

TI__Guru 70041 points

Hello,

Jenny Zhou said:
I've already modified application's x509 certificate as SBL,

May I know more details about these modifications?

To boot an encrypted application, all you need to do is integrate the encryption key in the SDK and enable the ENC_ENABLED flag in the `devconfig/devconfig.mak` file.

Regards,

Prashant

0 Jenny Zhou 4 months ago in reply to Prashant Shivhare

Prodigy 230 points

Hi Prashant,

Yes, you are right, I've integrate the encryption key in the SDK and enable the 'ENC_ENABLE' in devconfig.mak as following:

I've already boot the encrypted SBL successfully, but SBL failed to boot the encrypted applicaiton.

I tried to debug the SBL, and saw 'Sciclient_procBootAuthAndStart' returned with failure as I said at last thread.

0 Prashant Shivhare 4 months ago in reply to Jenny Zhou

TI__Guru 70041 points

Hi Jenny,

Those changes looks good. Can you please share both the SBL and Application images that you are booting?

Thanks!

0 Jenny Zhou 4 months ago in reply to Prashant Shivhare

Prodigy 230 points

Hi Parashant,

I've already fixed the issue and successfully secure boot both SBL and Application.

One remaining issue is that: boot failed with 'enable QSPI flash DMA mode', I've opened a new thread to trace.

Failed to secure boot application if SBL enable QSPI flash's DMA mode - Processors forum - Processors - TI E2E support forums

0 Prashant Shivhare 4 months ago in reply to Jenny Zhou

TI__Guru 70041 points

Thank you for the update!

The subject matter expert would follow on the other thread.