TMDS64EVM: Regarding user application startup when part of the user application (hs_fs) in flash is erased.

Kiyomasa Imaizumi

Part Number: TMDS64EVM
Other Parts Discussed in Thread: SYSCONFIG

Tool/software:

Hello TI support team.

If a portion of the flash area of the user application (hs_fs) is intentionally overwritten, will the SBL OSPI reject the user application?

Normally, CA53 and CR5 user applications can be launched from SBL OSPI.
The hs_fs size of the user application is about 9.6MB.
It is located in the OSPI FLASH area.

I created a program to clear the flash in the user application program.
As a test, I cleared (Flash_eraseBlk) a portion (128KB) of the flash area where the application (HS_FS) is written.
When I restarted, I expected SBL not to start the application.
I expected SBL to output "Some tests have failed!!" but it didn't.

However, SBL OSPI's Bootloader_parseMultiCoreAppImage succeeds.
SBL results in a data abort in the following function:
Bootloader_loadCpu(bootHandle, &bootImageInfo.cpuInfo[CSL_CORE_ID_A53SS0_0]);
A Data Abort is not the desired result.

If part of the user application(hs_fs) in flash is rewritten, is it possible for SBL to detect this and generate an error?
The SBL SDK uses mcu_plus_sdk_am64x_09_01_00_41.

Best regards,
Kiyomasa Imaizumi.

4 days ago

0 Meet Thakar 3 days ago

TI__Genius 10305 points

Hi Kiyomasa,

Could you check if Disable Auth for Application Image options is enabled in your SBL OSPI's sysconfig:

Best Regards,

Meet.

0 Kiyomasa Imaizumi 2 days ago in reply to Meet Thakar

Intellectual 760 points

Hello Meet Thakar

Thank you for your reply.

I unchecked the "Disable Auth For Application Image" checkbox and created the SBL OSPI again.

However, an error occurs in
Bootloader_verifyMulticoreImage
Bootloader_socAuthImage(certLoadAddr).

Upon further investigation,
in the Sciclient_procBootAuthAndStart function,
the return value of the Sciclient_service function is 0,
but because respParam.flags is 0, retVal is SystemP_FAILURE.

Do I need to configure something on the user application side as well?
Changing the build options for the user application to authtype=0,1,2 did not improve the situation.

The problem is still not solved.

Best regards,
Kiyomasa Imaizumi.

0 Kiyomasa Imaizumi 2 days ago in reply to Kiyomasa Imaizumi

Intellectual 760 points

I will add more information.

This may be related, but I'll answer a question from Prashant Shivhare from a previous post:
e2e.ti.com/.../5131217

I checked the memory at 0x60080000 using CCS just before Bootloader_socAuthImage.
The area around 0x60080000 is 0xFFFFFFFF.

Best regard,
Kiyomasa Imaizumi.

0 Kiyomasa Imaizumi 2 days ago in reply to Kiyomasa Imaizumi

Intellectual 760 points

I also took other people's questions into consideration.

e2e.ti.com/.../5842977

e2e.ti.com/.../5350965

I just did the fix in the patch above but it didn't solve the problem.

Best regards,
Kiyomasa Imaizumi.

0 Meet Thakar 2 days ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

Hi Kiyosama,

I am not sure of what issue you are facing currently, as per my understanding you are trying to boot a corrupted image using SBL OSPI, ans you expected a failure from bootloader, which you were not observing previously due to the fact that "Disable Auth For Application Image" was checked in your case, this option would disable the authentication for appimage image and that is why SBL was not returning with a failure.

Based upon your response, It seems that you are now observing the authentication failure for the corrupted image after unchecking "Disable Auth For Application Image" parameter, which is the expected result, so, could you elaborate the what is the issue now?

Best Regards,

Meet.

0 Kiyomasa Imaizumi 2 days ago in reply to Meet Thakar

Intellectual 760 points

Hello Meet Thakar.

Let me explain the current problem.

Originally, the user application would launch even if the flash area for the user application had been tampered with.
I wanted to know if there was a way to use SBL OSPI to determine if the user application had been tampered with and prevent the user application from launching.

So I checked the SBL and found that "Disable Auth For Application Image" was checked.
I realized that this was why the SBL was not checking for tampering with the user application.

So I unchecked "Disable Auth For Application Image" and
wrote a new SBL and user application to the board.
However, the user application no longer launched, even though it had not been tampered with.

Currently, the problems I want to solve are as follows:

- After unchecking Disable Auth For Application Image, the correct user application no longer launched.

Best regards,
Kiyomasa Imaizumi.

0 Meet Thakar 2 days ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

Kiyomasa Imaizumi said:
I checked the memory at 0x60080000 using CCS just before Bootloader_socAuthImage.
The area around 0x60080000 is 0xFFFFFFFF.

This is where your appimage is supposed to be, so ideally if you have flashed the image at this address, this shouldn't be possible.

Have you flashed your application at am offset other than 0x80000, please also share the flashing logs.

0 Kiyomasa Imaizumi 2 days ago in reply to Meet Thakar

Intellectual 760 points

Hello Meet Thakar.

How should I take flashing logs?
The user application is set to be written to 0x100000 by DFU.

Best regards,

Kiyomasa Imaizumi

0 Meet Thakar 2 days ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

Please share the contents of memory at address 0x60100000 in that case.

0 Kiyomasa Imaizumi 2 days ago in reply to Meet Thakar

Intellectual 760 points

This is the content of the memory image.
Please check.

0 Kiyomasa Imaizumi 2 days ago in reply to Kiyomasa Imaizumi

Intellectual 760 points

mem_0x60100000.dat

I've also attached a 128kB dump from 0x60100000.

0 Meet Thakar 2 days ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

Please share your appimage as well, I will try to see If I can reproduce this at my end.

0 Kiyomasa Imaizumi 1 day ago in reply to Meet Thakar

Intellectual 760 points

I would like to send the binary file separately by email rather than attaching it to e2e.
Please let me know your email address.
I am using a custom board and the flash is IS25LX256.

Best regards,

Kiyomasa Imaizumi.

0 Meet Thakar 1 day ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

If there is a privacy issue then you can share the image via a direct message to me.

0 Kiyomasa Imaizumi 1 day ago in reply to Meet Thakar

Intellectual 760 points

Thank you. How can I send you an direct message?

0 Meet Thakar 1 day ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

I can not share my email on public forum, you can share it to me via a private E2E chat.

0 Kiyomasa Imaizumi 1 day ago in reply to Meet Thakar

Intellectual 760 points

So I'd like to have a private E2E chat.
I sent the app image to Private Chat.

0 Meet Thakar 1 day ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

Thanks for sharing the image, I see that you have shared an unsigned image ( .appimage file), I was expecting .appimage.hs_fs image as you have mentioned you are using a hs_fs device. Are you trying to boot the same?

Because in this case it clarifies the issue, as you are trying to boot an unsigned image the authentication will fail as the device is HS-FS and you have now enabled the appimage authentication.

0 Kiyomasa Imaizumi 1 day ago in reply to Meet Thakar

Intellectual 760 points

I'm actually using an hs_fs image.
I've attached that as well.

0 Meet Thakar 1 day ago in reply to Kiyomasa Imaizumi

TI__Genius 10305 points

Hi Kiyomasa,

I am able to boot the appimage given by you using SBL OSPI, please find the boot logs:

MSC Firmware Version 9.1.6--v09.01.06 (Kool Koala)                                                      
DMSC Firmware revision 0x9                                                                               
DMSC ABI revision 3.1                                                                                    
                                                                                                         
[BOOTLOADER_PROFILE] Boot Media       : NOR SPI FLASH                                                    
[BOOTLOADER_PROFILE] Boot Media Clock : 166.667 MHz                                                      
[BOOTLOADER_PROFILE] Boot Image Size  : 3979 KB                                                          
[BOOTLOADER_PROFILE] Cores present    :                                                                  
a530-0                                                                                                   
a530-1                                                                                                   
[BOOTLOADER PROFILE] SYSFW init                       :      12170us                                     
[BOOTLOADER PROFILE] System_init                      :        551us                                     
[BOOTLOADER PROFILE] Drivers_open                     :        281us                                     
[BOOTLOADER PROFILE] Board_driversOpen                :      22036us                                     
[BOOTLOADER PROFILE] Sciclient Get Version            :       9895us                                     
[BOOTLOADER PROFILE] CPU Load                         :     300749us                                     
[BOOTLOADER_PROFILE] SBL Total Time Taken             :     345687us                                     
                                                                                                         
Image loading done, switching to application ...

Are you using the default SBL OSPI or you have made any changes?

Processors

Processors forum

TMDS64EVM: Regarding user application startup when part of the user application (hs_fs) in flash is erased.