AM62L: AM62L Secure boot, keywriter-lite

Dharmik Vaghasana

Part Number: AM62L

Old case:https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1619993/am62l-enable-secure-boot-in-am62l

Hi,
Going back to the last thread,

I am facing an issue when writing the bin file. Please see the logs below.

NOTICE:  bl1_plat_arch_setup arch setup 
NOTICE:  Booting Trusted Firmware
NOTICE:  BL1: v2.12.0(release):11.02.08-dirty
NOTICE:  BL1: Built : 19:27:42, Dec  4 2025
NOTICE:  BL1: dram_class: 11
NOTICE:  lpddr4: post start - PI training status=0x27c0a000 
NOTICE:  bl1_platform_setup DDR init done
NOTICE:  k3_bl1_handoff ENTERING WFI - end of bl1
NOTICE:  BL31: v2.12.0(release):11.02.08-dirty
NOTICE:  BL31: Built : 19:27:42, Dec  4 2025
NOTICE:  SYSFW ABI: 4.0 (firmware rev 0x000b '11.2.5-v11.02.05a (Fancy Rat)')
get_device_type a0a
ERROR:   Agent 0 Protocol 0x10 Message 0x7: not supported

U-Boot SPL 2025.01-00766-g7493977a537f-dirty (Dec 03 2025 - 15:20:36 +0000)
SPL initial stack usage: 1984 bytes
Trying to boot from MMC1
ERROR:   Agent 0 Protocol 0x10 Message 0x7: not supported


U-Boot 2025.01-00766-g7493977a537f-dirty (Dec 03 2025 - 15:20:36 +0000)

SoC:   AM62LX SR1.1 HS-FS
Model: Texas Instruments AM62L3 Evaluation Module
DRAM:  1 GiB
ERROR:   Agent 0 Protocol 0x10 Message 0x7: not supported
Core:  85 devices, 32 uclasses, devicetree: separate
MMC:   mmc@fa10000: 0, mmc@fa00000: 1
Loading Environment from MMC... Reading from MMC(0)... OK
In:    serial@2800000
Out:   serial@2800000
Err:   serial@2800000
Net:   Could not get PHY for mdio@f00: addr 0
am65_cpsw_nuss_port ethernet@8000000port@1: phy_connect() failed
Could not get PHY for mdio@f00: addr 1
am65_cpsw_nuss_port ethernet@8000000port@2: phy_connect() failed
No ethernet found.

Hit any key to stop autoboot:  0 
=> 
=> mw 0x82000000 0 0x400
=> ext2load mmc 0:1 0x82000000 /root/keywrlite.bin
636 bytes read in 1 ms (621.1 KiB/s)
=> dcache flush
=> md 0x82000000
82000000: 00000001 00009045 02209012 00000100  ....E..... .....
82000010: 00000000 00000000 00000000 00004a7e  ............~J..
82000020: a5a5a55a 00000000 00000000 00000000  Z...............
82000030: 00001234 a5a5a55a b002601f b7b0d97c  4...Z....`..|...
82000040: a89c7dc4 7be5aad1 a184878e 2b6b632f  .}.....{..../ck+
82000050: 987d0d76 97188fa1 f2d0df60 b10c2b3e  v.}.....`...>+..
82000060: c7edc70e 3dacedc6 e0efdf9b ff3fdced  .......=......?.
82000070: 87ade97f 7d529551 00000000 00000000  ....Q.R}........
82000080: 00009ffc a5a5a55a b002601f b7b0d97c  ....Z....`..|...
82000090: a89c7dc4 7be5aad1 a184878e 2b6b632f  .}.....{..../ck+
820000a0: 987d0d76 97188fa1 f2d0df60 b10c2b3e  v.}.....`...>+..
820000b0: c7edc70e 3dacedc6 e0efdf9b ff3fdced  .......=......?.
820000c0: 87ade97f 7d529551 00000000 00000000  ....Q.R}........
820000d0: 00005678 a5a5a55a 00000001 00000000  xV..Z...........
820000e0: 00000000 000062c8 a5a5a55a 00000001  .....b..Z.......
820000f0: 00000000 00000000 00008bad a5a5a55a  ............Z...
=> gpio set gpio@600000_72
gpio: pin gpio@600000_72 (gpio 72) value is 1
   Warning: value of pin is still 0
=> fuse writebuff -y 0x82000000
Programming fuses using a structured buffer in memory starting at addr 0x82000000
NOTICE:  Writebuff version info: 0x1
ERROR:   Failed to get response (-19)
ERROR:   Transfer send failed (-19)
ERROR:   Keywriter Lite Failed: (-19)
SMC call failed: Error code -1
ERROR
=>

Thanks,

Dharmik

2 months ago

0 Prashant Shivhare 2 months ago

TI__Guru* 84401 points

Hello,

How did you create the keywriter blob? Could you please also share the TIFS traces?

0 Dharmik Vaghasana 2 months ago in reply to Prashant Shivhare

Intellectual 260 points

Hi Prashant,

we have created the keywrite.bin from the security-utils utility and the reference keywrlite.c is attached.

// Uncomment and modify the following definitions as per the compiler used
// typedef char uint8_t;
// typedef unsigned short uint16_t;
// typedef unsigned int uint32_t;
// typedef unsigned long uint64_t;

struct uboot_header {
    uint32_t version_info;
    uint32_t fuse_mode;
} __attribute__((packed));
        
struct keywriter_lite_header {
    uint16_t magic;
    uint16_t size;
    uint8_t abi_major;
    uint8_t abi_minor;
    uint16_t reserved0;
    uint32_t cmd_id;
    uint32_t reserved1[2];
} __attribute__((packed));
        
struct mpk_opts {
    uint32_t field_header;
    uint32_t action_flags;
    uint16_t options;
    uint16_t reserved_field;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct mpkh {
    uint32_t field_header;
    uint32_t action_flags;
    uint8_t mpkh[64];
    uint32_t reserved[2];
} __attribute__((packed));
        
struct key_cnt {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t count;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct key_rev {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t revision;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct sbl_revision {
    uint32_t field_header;
    uint32_t action_flags;
    uint64_t swrev;
    uint32_t reserved[3];
} __attribute__((packed));
        
struct sysfw_revision {
    uint32_t field_header;
    uint32_t action_flags;
    uint64_t swrev;
    uint32_t reserved[3];
} __attribute__((packed));
        
struct brdcfg_revision {
    uint32_t field_header;
    uint32_t action_flags;
    uint64_t swrev;
    uint32_t reserved[4];
} __attribute__((packed));
        
struct msv {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t msv;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct jtag_disable {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t jtag_disable;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct boot_mode {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t fuse_id;
    uint32_t boot_mode;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct ext_otp {
    uint32_t field_header;
    uint32_t action_flags;
    uint16_t ext_otp_size;
    uint16_t ext_otp_index;
    uint8_t ext_otp_rpwp[16];
    uint8_t ext_otp[128];
    uint32_t reserved[4];
} __attribute__((packed));
        
struct checksum {
    uint8_t hash[64];
} __attribute__((packed));
        
struct keywrlite_blob {
    struct uboot_header ubheader;
    struct keywriter_lite_header header;
    struct mpk_opts mpkopts;
    struct mpkh smpkh;
    struct mpkh bmpkh;
    struct key_cnt keycnt;
    struct key_rev keyrev;
    struct sbl_revision sblswrev;
    struct sysfw_revision sysfwswrev;
    struct brdcfg_revision brdcfgswrev;
    struct msv msv;
    struct jtag_disable jtagdisable;
    struct boot_mode bootmode;
    struct ext_otp extotp;
    struct checksum chksum;
}__attribute__((packed));

struct keywrlite_blob blob = {
    .ubheader =
        {
            .version_info = 0x1,
            .fuse_mode = 0x9045,
        }
        ,
    .header =
        {
            .magic = 0x9012,
            .size = 544,
            .abi_major = 0,
            .abi_minor = 1,
            .reserved0 = 0,
            .cmd_id = 0,
            .reserved1 = {0x0, 0x0},
        }
        ,
    .mpkopts =
        {
            .field_header = 0x4a7e,
            .action_flags = 0xa5a5a55a,
            .options = 0x0,
            .reserved_field = 0x0,
            .reserved = {0x0, 0x0},
        }
        ,
    .smpkh =
        {
            .field_header = 0x1234,
            .action_flags = 0xa5a5a55a,
            .mpkh = {0x1f, 0x60, 0x2, 0xb0, 0x7c, 0xd9, 0xb0, 0xb7, 0xc4, 0x7d, 0x9c, 0xa8, 0xd1, 0xaa, 0xe5, 0x7b, 0x8e, 0x87, 0x84, 0xa1, 0x2f, 0x63, 0x6b, 0x2b, 0x76, 0xd, 0x7d, 0x98, 0xa1, 0x8f, 0x18, 0x97, 0x60, 0xdf, 0xd0, 0xf2, 0x3e, 0x2b, 0xc, 0xb1, 0xe, 0xc7, 0xed, 0xc7, 0xc6, 0xed, 0xac, 0x3d, 0x9b, 0xdf, 0xef, 0xe0, 0xed, 0xdc, 0x3f, 0xff, 0x7f, 0xe9, 0xad, 0x87, 0x51, 0x95, 0x52, 0x7d},
            .reserved = {0x0, 0x0},
        }
        ,
    .bmpkh =
        {
            .field_header = 0x9ffc,
            .action_flags = 0xa5a5a55a,
            .mpkh = {0x1f, 0x60, 0x2, 0xb0, 0x7c, 0xd9, 0xb0, 0xb7, 0xc4, 0x7d, 0x9c, 0xa8, 0xd1, 0xaa, 0xe5, 0x7b, 0x8e, 0x87, 0x84, 0xa1, 0x2f, 0x63, 0x6b, 0x2b, 0x76, 0xd, 0x7d, 0x98, 0xa1, 0x8f, 0x18, 0x97, 0x60, 0xdf, 0xd0, 0xf2, 0x3e, 0x2b, 0xc, 0xb1, 0xe, 0xc7, 0xed, 0xc7, 0xc6, 0xed, 0xac, 0x3d, 0x9b, 0xdf, 0xef, 0xe0, 0xed, 0xdc, 0x3f, 0xff, 0x7f, 0xe9, 0xad, 0x87, 0x51, 0x95, 0x52, 0x7d},
            .reserved = {0x0, 0x0},
        }
        ,
    .keycnt =
        {
            .field_header = 0x5678,
            .action_flags = 0xa5a5a55a,
            .count = 1,
            .reserved = {0x0, 0x0},
        }
        ,
    .keyrev =
        {
            .field_header = 0x62c8,
            .action_flags = 0xa5a5a55a,
            .revision = 1,
            .reserved = {0x0, 0x0},
        }
        ,
    .sblswrev =
        {
            .field_header = 0x8bad,
            .action_flags = 0xa5a5a55a,
            .swrev = 1,
            .reserved = {0x0, 0x0, 0x0},
        }
        ,
    .sysfwswrev =
        {
            .field_header = 0x45a9,
            .action_flags = 0xa5a5a55a,
            .swrev = 1,
            .reserved = {0x0, 0x0, 0x0},
        }
        ,
    .brdcfgswrev =
        {
            .field_header = 0x98dc,
            .action_flags = 0xa5a5a55a,
            .swrev = 1,
            .reserved = {0x0, 0x0, 0x0, 0x0},
        }
        ,
    .msv =
        {
            .field_header = 0x1337,
            .action_flags = 0xa5a5a55a,
            .msv = 0x0,
            .reserved = {0x0, 0x0},
        }
        ,
    .jtagdisable =
        {
            .field_header = 0x7421,
            .action_flags = 0xa5a5a55a,
            .jtag_disable = 0xf,
            .reserved = {0x0, 0x0},
        }
        ,
    .bootmode =
        {
            .field_header = 0xa1b2,
            .action_flags = 0xa5a5a55a,
            .fuse_id = 1,
            .boot_mode = 0x0,
            .reserved = {0x0, 0x0},
        }
        ,
    .extotp =
        {
            .field_header = 0xd0e5,
            .action_flags = 0xa5a5a55a,
            .ext_otp_size = 1,
            .ext_otp_index = 0,
            .ext_otp_rpwp = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
            .ext_otp = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
            .reserved = {0x0, 0x0, 0x0, 0x0},
        }
        ,
    .chksum =
        {
            .hash = {0x33, 0x62, 0x83, 0xdb, 0xf1, 0xb, 0xfa, 0x91, 0x16, 0x29, 0xb9, 0x62, 0x49, 0xc9, 0x44, 0x44, 0xa7, 0xc, 0x94, 0x5a, 0x89, 0xee, 0x30, 0x3e, 0x24, 0x95, 0xe2, 0x29, 0xca, 0x27, 0x6c, 0xf6, 0x2d, 0xf3, 0xf5, 0x9e, 0x25, 0x89, 0xa5, 0xcb, 0x62, 0x65, 0xc4, 0xbf, 0xf9, 0xcb, 0x16, 0x43, 0x4f, 0x3c, 0x78, 0x49, 0x18, 0xe3, 0x8d, 0xa6, 0xd1, 0x87, 0x4a, 0xde, 0xa1, 0x75, 0x22, 0x8c},
        }
        ,

};

I have made the following modifications to the board/ti/am62lx/board-cfg.yaml file in order to enable sysfw traces.

trace_dst_enables : 0x01
trace_src_enables : 0x1F

no changes in u-boot log

=> fuse writebuff -y 0x82000000
Programming fuses using a structured buffer in memory starting at addr 0x82000000
NOTICE: Writebuff version info: 0x1
ERROR: Failed to get response (-19)
ERROR: Transfer send failed (-19)
ERROR: Keywriter Lite Failed: (-19)
SMC call failed: Error code -1
ERROR
=>

we are using the 11.02.08.02 SDK version as old version having the kernel booting issue(refer old thread), let me know if more information is needed.

Thanks,

Dharmik

0 Prashant Shivhare 2 months ago in reply to Dharmik Vaghasana

TI__Guru* 84401 points

Hello,

Dharmik Vaghasana said:
no changes in u-boot log

The TIFS traces come on the UART port described here which is WKUP_UART0 for AM62L

https://software-dl.ti.com/tisci/esd/latest/4_trace/trace.html#trace-uart-allocation

Please capture the logs from this UART and share the same.

0 Prashant Shivhare 2 months ago in reply to Prashant Shivhare

TI__Guru* 84401 points

Additionally, how do you confirm the VPP is at 1.8V only before key programming?

Also, I see in the C file that you are using the same hash for both SMPK/BMPKH and programming the KEYCNT as 1 only. Please check your configuration before programming.

0 Dharmik Vaghasana 2 months ago in reply to Prashant Shivhare

Intellectual 260 points

We have TP, where we can probe the voltage, and we get the 1.8V on it.

If BKPHS is not set, the tool is not creating the bin in one-short. So, could you please suggest, which one we can got with,

1) Change KEYCNT as 2 in existing.

2) Change to command id as multi-short and only set SMPK, KEYCNT and KEYREV.

Thanks,
Dharmik

0 Prashant Shivhare 2 months ago in reply to Prashant Shivhare

TI__Guru* 84401 points

Prashant Shivhare said:
Also, I see in the C file that you are using the same hash for both SMPK/BMPKH and programming the KEYCNT as 1 only. Please check your configuration before programming.

There is no issue with this certificate. It was just for your information that you may want to check the configuration. Ideally, you should be programming both the SMPKH/BMPKH and setting the KEYCNT to 2.

Given two different keys (SMPK and BMPK), you may generate the BMPKH just like you generated the SMPKH.

0 Dharmik Vaghasana 2 months ago in reply to Prashant Shivhare

Intellectual 260 points

Please find my wkup_uart0 log:

keywrlite: type keywriter lite
                              keywrlite: check cmd id
                                                     Op Success
                                                               keywrlite: checksum passed
                                                                                         SBL SWREV:  0x1
                                                                                                        SYSFW SWREV:  0x1
                                                                                                                         keywrlite: program msv
                                                                                                                                               [u32] bch + msv:  0x0
                                                                                                                                                                    Programmed 2/2 rows successfully
                                                                                                                                                                                                    [u32] bch + msv
:  0x0
      Op Success
                keywrlite: program jtag disable
                                               [u32] JTAG DISABLE:  0xF
                                                                       Error: override not specified
                                                                                                    debug_response:  0x44000000
                                                                                                                               Error: JTAG disable failed
                                                                                                                                                         debug_response:  0xC4000000
                                                                                                                                                                                    Op Failed

with created the keywrite.bin from the security-utils utility

// Uncomment and modify the following definitions as per the compiler used
// typedef char uint8_t;
// typedef unsigned short uint16_t;
// typedef unsigned int uint32_t;
// typedef unsigned long uint64_t;

struct uboot_header {
    uint32_t version_info;
    uint32_t fuse_mode;
} __attribute__((packed));
        
struct keywriter_lite_header {
    uint16_t magic;
    uint16_t size;
    uint8_t abi_major;
    uint8_t abi_minor;
    uint16_t reserved0;
    uint32_t cmd_id;
    uint32_t reserved1[2];
} __attribute__((packed));
        
struct mpk_opts {
    uint32_t field_header;
    uint32_t action_flags;
    uint16_t options;
    uint16_t reserved_field;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct mpkh {
    uint32_t field_header;
    uint32_t action_flags;
    uint8_t mpkh[64];
    uint32_t reserved[2];
} __attribute__((packed));
        
struct key_cnt {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t count;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct key_rev {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t revision;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct sbl_revision {
    uint32_t field_header;
    uint32_t action_flags;
    uint64_t swrev;
    uint32_t reserved[3];
} __attribute__((packed));
        
struct sysfw_revision {
    uint32_t field_header;
    uint32_t action_flags;
    uint64_t swrev;
    uint32_t reserved[3];
} __attribute__((packed));
        
struct brdcfg_revision {
    uint32_t field_header;
    uint32_t action_flags;
    uint64_t swrev;
    uint32_t reserved[4];
} __attribute__((packed));
        
struct msv {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t msv;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct jtag_disable {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t jtag_disable;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct boot_mode {
    uint32_t field_header;
    uint32_t action_flags;
    uint32_t fuse_id;
    uint32_t boot_mode;
    uint32_t reserved[2];
} __attribute__((packed));
        
struct ext_otp {
    uint32_t field_header;
    uint32_t action_flags;
    uint16_t ext_otp_size;
    uint16_t ext_otp_index;
    uint8_t ext_otp_rpwp[16];
    uint8_t ext_otp[128];
    uint32_t reserved[4];
} __attribute__((packed));
        
struct checksum {
    uint8_t hash[64];
} __attribute__((packed));
        
struct keywrlite_blob {
    struct uboot_header ubheader;
    struct keywriter_lite_header header;
    struct mpk_opts mpkopts;
    struct mpkh smpkh;
    struct mpkh bmpkh;
    struct key_cnt keycnt;
    struct key_rev keyrev;
    struct sbl_revision sblswrev;
    struct sysfw_revision sysfwswrev;
    struct brdcfg_revision brdcfgswrev;
    struct msv msv;
    struct jtag_disable jtagdisable;
    struct boot_mode bootmode;
    struct ext_otp extotp;
    struct checksum chksum;
}__attribute__((packed));

struct keywrlite_blob blob = {
    .ubheader =
        {
            .version_info = 0x1,
            .fuse_mode = 0x9045,
        }
        ,
    .header =
        {
            .magic = 0x9012,
            .size = 544,
            .abi_major = 0,
            .abi_minor = 1,
            .reserved0 = 0,
            .cmd_id = 0,
            .reserved1 = {0x0, 0x0},
        }
        ,
    .mpkopts =
        {
            .field_header = 0x4a7e,
            .action_flags = 0xa5a5a55a,
            .options = 0x0,
            .reserved_field = 0x0,
            .reserved = {0x0, 0x0},
        }
        ,
    .smpkh =
        {
            .field_header = 0x1234,
            .action_flags = 0xa5a5a55a,
            .mpkh = {0x1f, 0x60, 0x2, 0xb0, 0x7c, 0xd9, 0xb0, 0xb7, 0xc4, 0x7d, 0x9c, 0xa8, 0xd1, 0xaa, 0xe5, 0x7b, 0x8e, 0x87, 0x84, 0xa1, 0x2f, 0x63, 0x6b, 0x2b, 0x76, 0xd, 0x7d, 0x98, 0xa1, 0x8f, 0x18, 0x97, 0x60, 0xdf, 0xd0, 0xf2, 0x3e, 0x2b, 0xc, 0xb1, 0xe, 0xc7, 0xed, 0xc7, 0xc6, 0xed, 0xac, 0x3d, 0x9b, 0xdf, 0xef, 0xe0, 0xed, 0xdc, 0x3f, 0xff, 0x7f, 0xe9, 0xad, 0x87, 0x51, 0x95, 0x52, 0x7d},
            .reserved = {0x0, 0x0},
        }
        ,
    .bmpkh =
        {
            .field_header = 0x9ffc,
            .action_flags = 0xa5a5a55a,
            .mpkh = {0x8e, 0xdc, 0xc3, 0xb, 0xda, 0xd, 0xaf, 0x36, 0x3, 0x7b, 0x58, 0x80, 0x41, 0x63, 0x4c, 0x51, 0xad, 0xa, 0x64, 0xff, 0x7e, 0x48, 0x34, 0xf5, 0xb3, 0x8, 0xce, 0xa2, 0x5e, 0xd1, 0x3a, 0x10, 0xd3, 0x49, 0xc6, 0x17, 0x53, 0x4e, 0x83, 0x33, 0x13, 0x6a, 0x85, 0x95, 0x0, 0xb4, 0x92, 0x92, 0xb5, 0xcf, 0x88, 0x79, 0xcf, 0xa9, 0xfd, 0xfc, 0x41, 0xe, 0x6d, 0xb, 0xd0, 0xd, 0xcf, 0x19},
            .reserved = {0x0, 0x0},
        }
        ,
    .keycnt =
        {
            .field_header = 0x5678,
            .action_flags = 0xa5a5a55a,
            .count = 3,
            .reserved = {0x0, 0x0},
        }
        ,
    .keyrev =
        {
            .field_header = 0x62c8,
            .action_flags = 0xa5a5a55a,
            .revision = 1,
            .reserved = {0x0, 0x0},
        }
        ,
    .sblswrev =
        {
            .field_header = 0x8bad,
            .action_flags = 0xa5a5a55a,
            .swrev = 1,
            .reserved = {0x0, 0x0, 0x0},
        }
        ,
    .sysfwswrev =
        {
            .field_header = 0x45a9,
            .action_flags = 0xa5a5a55a,
            .swrev = 1,
            .reserved = {0x0, 0x0, 0x0},
        }
        ,
    .brdcfgswrev =
        {
            .field_header = 0x98dc,
            .action_flags = 0xa5a5a55a,
            .swrev = 1,
            .reserved = {0x0, 0x0, 0x0, 0x0},
        }
        ,
    .msv =
        {
            .field_header = 0x1337,
            .action_flags = 0xa5a5a55a,
            .msv = 0x0,
            .reserved = {0x0, 0x0},
        }
        ,
    .jtagdisable =
        {
            .field_header = 0x7421,
            .action_flags = 0xa5a5a55a,
            .jtag_disable = 0xf,
            .reserved = {0x0, 0x0},
        }
        ,
    .bootmode =
        {
            .field_header = 0xa1b2,
            .action_flags = 0xa5a5a55a,
            .fuse_id = 1,
            .boot_mode = 0x0,
            .reserved = {0x0, 0x0},
        }
        ,
    .extotp =
        {
            .field_header = 0xd0e5,
            .action_flags = 0xa5a5a55a,
            .ext_otp_size = 1,
            .ext_otp_index = 0,
            .ext_otp_rpwp = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
            .ext_otp = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0},
            .reserved = {0x0, 0x0, 0x0, 0x0},
        }
        ,
    .chksum =
        {
            .hash = {0x19, 0xa0, 0x9f, 0x42, 0x9b, 0x31, 0x3f, 0x93, 0x2e, 0x59, 0xc2, 0x35, 0x98, 0x42, 0xcb, 0x5, 0x4b, 0x29, 0xca, 0x6a, 0x3b, 0x79, 0x53, 0xfa, 0x79, 0xef, 0x17, 0x58, 0x41, 0x89, 0x91, 0x4d, 0x71, 0x42, 0x2c, 0xe3, 0xd1, 0x83, 0xc, 0x7b, 0x3b, 0xc1, 0x77, 0x72, 0x56, 0x4d, 0x2d, 0x25, 0x8b, 0x94, 0x7c, 0xbf, 0xd3, 0x57, 0xd5, 0xb4, 0x6e, 0x88, 0xc4, 0xbf, 0x55, 0x30, 0xaa, 0x6b},
        }
        ,

};

Thanks,

Dharmik

0 Prashant Shivhare 2 months ago in reply to Dharmik Vaghasana

TI__Guru* 84401 points

Dharmik Vaghasana said:
with created the keywrite.bin from the security-utils utility

Can you please use the "multi-shot" mode to program the SMPKH/BMPKH, KEYCNT, and KEYREV only and disable any other fields?

keywrlite: program jtag disable
[u32] JTAG DISABLE: 0xF
Error: override not specified
debug_response: 0x44000000
Error: JTAG disable failed

From these logs, it looks like the previously used "one-shot" certificates programmed the JTAG DISABLE field which means you will not be able to connect the debugger to any core after converting the device to HSSE.

0 Dharmik Vaghasana 2 months ago in reply to Prashant Shivhare

Intellectual 260 points

I thank the analysis and will use multi-shot to confirm.

However, since I failed to perform the secure boot on a a new board and that is in the HS-FS state, is there another issue or is One-shot not working?

Thanks,

Dharmik

0 Dharmik Vaghasana 2 months ago in reply to Dharmik Vaghasana

Intellectual 260 points

We are getting the error while flashing, when SMPKH, BMPKH, KEYCNT, and KEYREV are set in multi-shot.

Find find the logs,

0x4003007
         0x4400B25
                  0x20800000
                            0x20800001
                                      0x4003007
                                               0x4400B25
                                                        keywrlite: type keywriter lite
                                                                                      keywrlite: check cmd id
                                                                                                             Op Success
                                                                                                                       keywrlite: checksum passed

Thanks,

Dharmik

0 Prashant Shivhare 2 months ago in reply to Dharmik Vaghasana

TI__Guru* 84401 points

Dharmik Vaghasana said:
We are getting the error while flashing, when SMPKH, BMPKH, KEYCNT, and KEYREV are set in multi-shot.

I do not see any errors in the logs. Did you capture the full logs?

0 Dharmik Vaghasana 2 months ago in reply to Prashant Shivhare

Intellectual 260 points

Yes, that's all I get on the terminal.

If any way is there to enable the more debug logs, please suggest the steps I will do it.

0 Prashant Shivhare 2 months ago in reply to Dharmik Vaghasana

TI__Guru* 84401 points

Noted.

Dharmik Vaghasana said:
=> fuse writebuff -y 0x82000000
Programming fuses using a structured buffer in memory starting at addr 0x82000000
NOTICE: Writebuff version info: 0x1
ERROR: Failed to get response (-19)
ERROR: Transfer send failed (-19)
ERROR: Keywriter Lite Failed: (-19)
SMC call failed: Error code -1
ERROR

Are you still getting this error with this multishot certificate?

0 Dharmik Vaghasana 2 months ago in reply to Prashant Shivhare

Intellectual 260 points

I have couple of question, could you please address it,

1. According to the tool, we can make many changes to the field before enable to write protect. Is this the right interpretation? If so, we see an error when attempting to update that file for the second time.

2. How do the tool's Write Protect, Read Protect, and Override functions work?

3. Since we have set the KEYREV to 1, we must change it to 2 when we need to choose the BMPKH, assuming that there won't be an issue. but right now we are unable to set 1 again at this time.

Thanks,

Dharmik

0 Prashant Shivhare 2 months ago in reply to Dharmik Vaghasana

TI__Guru* 84401 points

Dharmik Vaghasana said:
1. According to the tool, we can make many changes to the field before enable to write protect. Is this the right interpretation? If so, we see an error when attempting to update that file for the second time.

Not exactly. The field can be overwritten but only if the programming of the latest value does not lead to a bit flip from 1 -> 0 as the efuse bits can only be flipped once from 0 to 1.

Dharmik Vaghasana said:
2. How do the tool's Write Protect, Read Protect, and Override functions work?

The WP/RP, if enabled, sets the flags for the particular field to prevent the field from writing or reading respectively.

Dharmik Vaghasana said:
3. Since we have set the KEYREV to 1, we must change it to 2 when we need to choose the BMPKH,

The KEYREV change to 2 is irreversible.

0 Prashant Shivhare 2 months ago in reply to Prashant Shivhare

TI__Guru* 84401 points

More explanation here:

software-dl.ti.com/.../key_writer_lite.html

0 Dharmik Vaghasana 1 month ago in reply to Prashant Shivhare

Intellectual 260 points

Going forward, we are trying to secure the filesystem, for that we are referring below link,

https://software-dl.ti.com/processor-sdk-linux/esd/AM62LX/11_02_08_02/exports/docs/linux/Foundational_Components/System_Security/Auth_boot.html

Currently, we have the p1(rootfs), p2(rootfs) and p3(datafs) eMMC partition scheme and only, USB DFU and eMMC boot mode is available on the board.

Please find the below logs, using that we have created the .hash file and put it on the p3 partition, as we don't have the extra partition.

root@am62lxx-evm:~# mkdir /old_mnt
root@am62lxx-evm:~# mount /dev/mmcblk0p1 /old_mnt                                                                                                                                                                  
[   55.388613] EXT4-fs (mmcblk0p1): mounted filesystem f7067c97-aee1-4ea1-b5fd-7b68ecc8a599 r/w with ordered data mode. Quota mode: none.
root@am62lxx-evm:~# cryptsetup luksFormat /dev/mmcblk0p2 --key-file=/home/pass_key --batch-mode                                                                                                                    
root@am62lxx-evm:~# cryptsetup luksOpen /dev/mmcblk0p2 crypt_root --key-file=/home/pass_key                                                                                                                        
root@am62lxx-evm:~# cryptsetup -v status crypt_root
/dev/mapper/crypt_root is active.
  type:    LUKS1
  cipher:  aes-xts-plain64
  keysize: 512 bits
  key location: dm-crypt
  device:  /dev/mmcblk0p2
  sector size:  512
  offset:  4096 sectors
  size:    4190208 sectors
  mode:    read/write
Command successful.
root@am62lxx-evm:~# cryptsetup luksDump /dev/mmcblk0p2                                                                                                                                                             
LUKS header information for /dev/mmcblk0p2

Version:        1
Cipher name:    aes
Cipher mode:    xts-plain64
Hash spec:      sha256
Payload offset: 4096
MK bits:        512
MK digest:      17 db 68 29 a4 2c 4c 2d d9 aa 24 70 47 12 d3 d2 79 d2 ec 61 
MK salt:        0c eb ac 18 aa 6c 28 4b e4 c5 8f d1 fa 5b 21 3f 
                51 1e cd a4 67 ca 02 6b 90 17 32 01 4c 28 0c 3d 
MK iterations:  22692
UUID:           111847ab-cfc5-4a69-a90a-0fead7bd0535

Key Slot 0: ENABLED
        Iterations:             363080
        Salt:                   0e 64 e4 d8 28 ae e0 ea 97 b9 b5 f6 46 45 4a c1 
                                92 b4 82 d9 26 09 d0 86 71 51 e1 69 d0 55 19 5c 
        Key material offset:    8
        AF stripes:             4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
root@am62lxx-evm:~# mkfs.ext4 /dev/mapper/crypt_root
mke2fs 1.47.0 (5-Feb-2023)
Creating filesystem with 523776 4k blocks and 131072 inodes
Filesystem UUID: 972ef60e-7583-4c14-8da6-0debfe244cfd
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done 

root@am62lxx-evm:~# mkfs.ext4 /dev/mapper/crypt_root
mke2fs 1.47.0 (5-Feb-2023)
/dev/mapper/crypt_root contains a ext4 file system
        created on Thu May 29 18:50:02 2025
Proceed anyway? (y,N) y
Creating filesystem with 523776 4k blocks and 131072 inodes
Filesystem UUID: 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7
Superblock backups stored on blocks: 
        32768, 98304, 163840, 229376, 294912

Allocating group tables: done                            
Writing inode tables: done                            
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done 

root@am62lxx-evm:~# mount /dev/mapper/crypt_root /mnt
[  123.516522] EXT4-fs (dm-0): mounted filesystem 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7 r/w with ordered data mode. Quota mode: none.
root@am62lxx-evm:~# cp -ar /old_mnt/. /mnt
root@am62lxx-evm:~# sync
root@am62lxx-evm:~# umount /mnt
[  200.706389] EXT4-fs (dm-0): unmounting filesystem 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7.
root@am62lxx-evm:~# veritysetup format /dev/mapper/crypt_root ver.hash      
VERITY header information for ver.hash
UUID:                   c57eee25-6ae2-4060-ae64-5f5e62c7b28d
Hash type:              1
Data blocks:            523776
Data block size:        4096
Hash blocks:            4125
Hash block size:        4096
Hash algorithm:         sha256
Salt:                   cd9db64878c65fa8ae09b0b59095f903ab781482fe7d9f9d63cbca3a7cac6888
Root hash:              85a11d07a423552a34ddb3196f11110f8967c74d46dc07da35553e97af9c32f5
Hash device size:       16900096 [bytes]
root@am62lxx-evm:~#

we also modify the init file of the initramfs for the booting,

# Fix ownership
chown root:root /bin/mount.util-linux

# Mount virtual filesystems
mount -t devtmpfs none /dev
mount -t proc none /proc
mount -t sysfs none /sys

# Mount partition containing verity.hash
mkdir -p /verity
mount /dev/mmcblk0p3 /verity

# Open encrypted rootfs
cryptsetup luksOpen \
    --key-file=/home/pass_key \
    /dev/mmcblk0p2 \
    crypt_root

# Open dm-verity mapping
veritysetup open \
    /dev/mapper/crypt_root \
    verity_root \
    --root-hash-file /verity/ver.hash \
    85a11d07a423552a34ddb3196f11110f8967c74d46dc07da35553e97af9c32f5

# Mount verified rootfs
mount -o ro /dev/mapper/verity_root /mnt

# Optional cleanup
umount /verity

# Switch to verified rootfs
exec switch_root /mnt /sbin/init

While booting from it, the kernel is getting panic, as you can see in below logs

[    1.791770] am65-cpsw-nuss 8000000.ethernet: initializing am65 cpsw nuss version 0x6BA00103, cpsw version 0x6BA80103 Ports: 3 quirks:00000006
[    1.804668] am65-cpsw-nuss 8000000.ethernet: /bus@f0000/ethernet@8000000/ethernet-ports/port@1 read phy-mode err -22
[    1.815403] am65-cpsw-nuss 8000000.ethernet: probe with driver am65-cpsw-nuss failed with error -22
[    1.831633] mmc0: CQHCI version 5.10
[    1.831692] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[    1.838232] mmc2: CQHCI version 5.10
[    1.842866] clk: Disabling unused clocks
[    1.856074] PM: genpd: Disabling unused power domains
[    1.861625] ALSA device list:
[    1.864647]   No soundcards found.
[    1.868142] Warning: unable to open an initial console.
[    1.889455] mmc0: SDHCI controller on fa10000.mmc [fa10000.mmc] using ADMA 64-bit
[    1.904031] mmc2: SDHCI controller on fa20000.mmc [fa20000.mmc] using ADMA 64-bit
[    1.916888] sdhci-am654 fa20000.mmc: card claims to support voltages below defined range
[    1.932581] Freeing unused kernel memory: 28672K
[    1.937453] Run /init as init process
[    1.946523] mmc2: new high speed SDIO card at address 0001
[    1.949956] mmc0: new HS200 MMC card at address 0001
[    1.958805] mmcblk0: mmc0:0001 IS008G 7.30 GiB
[    1.967358]  mmcblk0: p1 p2 p3
[    1.971425] mmcblk0boot0: mmc0:0001 IS008G 4.00 MiB
[    1.977938] mmcblk0boot1: mmc0:0001 IS008G 4.00 MiB
[    1.984332] mmcblk0rpmb: mmc0:0001 IS008G 4.00 MiB, chardev (239:0)
[    7.126453] EXT4-fs (mmcblk0p3): mounted filesystem cba1d45b-891e-48c6-b739-af652390f887 r/w with ordered data mode. Quota mode: none.
[    9.300359] EXT4-fs (mmcblk0p3): unmounting filesystem cba1d45b-891e-48c6-b739-af652390f887.
[    9.319321] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
[    9.326995] CPU: 0 UID: 0 PID: 1 Comm: switch_root Not tainted 6.12.57-havnam #1
[    9.334383] Hardware name: Texas Instruments AM62L3 Evaluation Module (DT)
[    9.341242] Call trace:
[    9.343678]  dump_backtrace+0x90/0xe8
[    9.347348]  show_stack+0x18/0x24
[    9.350657]  dump_stack_lvl+0x34/0x8c
[    9.354314]  dump_stack+0x18/0x24
[    9.357621]  panic+0x390/0x3a4
[    9.360672]  do_exit+0x824/0x8f8
[    9.363894]  do_group_exit+0x34/0x90
[    9.367462]  pid_child_should_wake+0x0/0x60
[    9.371636]  invoke_syscall+0x48/0x10c
[    9.375379]  el0_svc_common.constprop.0+0x40/0xe0
[    9.380074]  do_el0_svc+0x1c/0x28
[    9.383382]  el0_svc+0x28/0x98
[    9.386431]  el0t_64_sync_handler+0x120/0x12c
[    9.390780]  el0t_64_sync+0x190/0x194
[    9.394436] SMP: stopping secondary CPUs
[    9.398355] Kernel Offset: disabled
[    9.401832] CPU features: 0x00,00000080,00200000,4200420b
[    9.407219] Memory Limit: none
[    9.410267] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]---

Do any steps need to be updated?

Thanks,

Dharmik

0 Prashant Shivhare 1 month ago in reply to Dharmik Vaghasana

TI__Guru* 84401 points

Please create a separate thread for the latest query, which is different from the original query discussed in this thread, for it to be addressed by the subject matter expert.

Please let me know the issue discussed in this thread is resolved so that I could close thread.

Thanks!

Processors

Processors forum

AM62L: AM62L Secure boot, keywriter-lite