Part Number: AM62L
Refer old thread: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1641521/am62l-am62l-secure-boot-keywriter-lite
Going forward, we are trying to secure the filesystem, for that we are referring below link,
Currently, we have the p1(rootfs), p2(rootfs) and p3(datafs) eMMC partition scheme and only, USB DFU and eMMC boot mode is available on the board.
Please find the below logs, using that we have created the .hash file and put it on the p3 partition, as we don't have the extra partition.
root@am62lxx-evm:~# mkdir /old_mnt
root@am62lxx-evm:~# mount /dev/mmcblk0p1 /old_mnt
[ 55.388613] EXT4-fs (mmcblk0p1): mounted filesystem f7067c97-aee1-4ea1-b5fd-7b68ecc8a599 r/w with ordered data mode. Quota mode: none.
root@am62lxx-evm:~# cryptsetup luksFormat /dev/mmcblk0p2 --key-file=/home/pass_key --batch-mode
root@am62lxx-evm:~# cryptsetup luksOpen /dev/mmcblk0p2 crypt_root --key-file=/home/pass_key
root@am62lxx-evm:~# cryptsetup -v status crypt_root
/dev/mapper/crypt_root is active.
type: LUKS1
cipher: aes-xts-plain64
keysize: 512 bits
key location: dm-crypt
device: /dev/mmcblk0p2
sector size: 512
offset: 4096 sectors
size: 4190208 sectors
mode: read/write
Command successful.
root@am62lxx-evm:~# cryptsetup luksDump /dev/mmcblk0p2
LUKS header information for /dev/mmcblk0p2
Version: 1
Cipher name: aes
Cipher mode: xts-plain64
Hash spec: sha256
Payload offset: 4096
MK bits: 512
MK digest: 17 db 68 29 a4 2c 4c 2d d9 aa 24 70 47 12 d3 d2 79 d2 ec 61
MK salt: 0c eb ac 18 aa 6c 28 4b e4 c5 8f d1 fa 5b 21 3f
51 1e cd a4 67 ca 02 6b 90 17 32 01 4c 28 0c 3d
MK iterations: 22692
UUID: 111847ab-cfc5-4a69-a90a-0fead7bd0535
Key Slot 0: ENABLED
Iterations: 363080
Salt: 0e 64 e4 d8 28 ae e0 ea 97 b9 b5 f6 46 45 4a c1
92 b4 82 d9 26 09 d0 86 71 51 e1 69 d0 55 19 5c
Key material offset: 8
AF stripes: 4000
Key Slot 1: DISABLED
Key Slot 2: DISABLED
Key Slot 3: DISABLED
Key Slot 4: DISABLED
Key Slot 5: DISABLED
Key Slot 6: DISABLED
Key Slot 7: DISABLED
root@am62lxx-evm:~# mkfs.ext4 /dev/mapper/crypt_root
mke2fs 1.47.0 (5-Feb-2023)
Creating filesystem with 523776 4k blocks and 131072 inodes
Filesystem UUID: 972ef60e-7583-4c14-8da6-0debfe244cfd
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912
Allocating group tables: done
Writing inode tables: done
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done
root@am62lxx-evm:~# mkfs.ext4 /dev/mapper/crypt_root
mke2fs 1.47.0 (5-Feb-2023)
/dev/mapper/crypt_root contains a ext4 file system
created on Thu May 29 18:50:02 2025
Proceed anyway? (y,N) y
Creating filesystem with 523776 4k blocks and 131072 inodes
Filesystem UUID: 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7
Superblock backups stored on blocks:
32768, 98304, 163840, 229376, 294912
Allocating group tables: done
Writing inode tables: done
Creating journal (8192 blocks): done
Writing superblocks and filesystem accounting information: done
root@am62lxx-evm:~# mount /dev/mapper/crypt_root /mnt
[ 123.516522] EXT4-fs (dm-0): mounted filesystem 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7 r/w with ordered data mode. Quota mode: none.
root@am62lxx-evm:~# cp -ar /old_mnt/. /mnt
root@am62lxx-evm:~# sync
root@am62lxx-evm:~# umount /mnt
[ 200.706389] EXT4-fs (dm-0): unmounting filesystem 2abe3070-b79f-4c82-b90c-7d4be9bbe5f7.
root@am62lxx-evm:~# veritysetup format /dev/mapper/crypt_root ver.hash
VERITY header information for ver.hash
UUID: c57eee25-6ae2-4060-ae64-5f5e62c7b28d
Hash type: 1
Data blocks: 523776
Data block size: 4096
Hash blocks: 4125
Hash block size: 4096
Hash algorithm: sha256
Salt: cd9db64878c65fa8ae09b0b59095f903ab781482fe7d9f9d63cbca3a7cac6888
Root hash: 85a11d07a423552a34ddb3196f11110f8967c74d46dc07da35553e97af9c32f5
Hash device size: 16900096 [bytes]
root@am62lxx-evm:~# we also modify the init file of the initramfs for the booting,
# Fix ownership
chown root:root /bin/mount.util-linux
# Mount virtual filesystems
mount -t devtmpfs none /dev
mount -t proc none /proc
mount -t sysfs none /sys
# Mount partition containing verity.hash
mkdir -p /verity
mount /dev/mmcblk0p3 /verity
# Open encrypted rootfs
cryptsetup luksOpen \
--key-file=/home/pass_key \
/dev/mmcblk0p2 \
crypt_root
# Open dm-verity mapping
veritysetup open \
/dev/mapper/crypt_root \
verity_root \
--root-hash-file /verity/ver.hash \
85a11d07a423552a34ddb3196f11110f8967c74d46dc07da35553e97af9c32f5
# Mount verified rootfs
mount -o ro /dev/mapper/verity_root /mnt
# Optional cleanup
umount /verity
# Switch to verified rootfs
exec switch_root /mnt /sbin/initWhile booting from it, the kernel is getting panic, as you can see in below logs
[ 1.791770] am65-cpsw-nuss 8000000.ethernet: initializing am65 cpsw nuss version 0x6BA00103, cpsw version 0x6BA80103 Ports: 3 quirks:00000006
[ 1.804668] am65-cpsw-nuss 8000000.ethernet: /bus@f0000/ethernet@8000000/ethernet-ports/port@1 read phy-mode err -22
[ 1.815403] am65-cpsw-nuss 8000000.ethernet: probe with driver am65-cpsw-nuss failed with error -22
[ 1.831633] mmc0: CQHCI version 5.10
[ 1.831692] input: gpio-keys as /devices/platform/gpio-keys/input/input0
[ 1.838232] mmc2: CQHCI version 5.10
[ 1.842866] clk: Disabling unused clocks
[ 1.856074] PM: genpd: Disabling unused power domains
[ 1.861625] ALSA device list:
[ 1.864647] No soundcards found.
[ 1.868142] Warning: unable to open an initial console.
[ 1.889455] mmc0: SDHCI controller on fa10000.mmc [fa10000.mmc] using ADMA 64-bit
[ 1.904031] mmc2: SDHCI controller on fa20000.mmc [fa20000.mmc] using ADMA 64-bit
[ 1.916888] sdhci-am654 fa20000.mmc: card claims to support voltages below defined range
[ 1.932581] Freeing unused kernel memory: 28672K
[ 1.937453] Run /init as init process
[ 1.946523] mmc2: new high speed SDIO card at address 0001
[ 1.949956] mmc0: new HS200 MMC card at address 0001
[ 1.958805] mmcblk0: mmc0:0001 IS008G 7.30 GiB
[ 1.967358] mmcblk0: p1 p2 p3
[ 1.971425] mmcblk0boot0: mmc0:0001 IS008G 4.00 MiB
[ 1.977938] mmcblk0boot1: mmc0:0001 IS008G 4.00 MiB
[ 1.984332] mmcblk0rpmb: mmc0:0001 IS008G 4.00 MiB, chardev (239:0)
[ 7.126453] EXT4-fs (mmcblk0p3): mounted filesystem cba1d45b-891e-48c6-b739-af652390f887 r/w with ordered data mode. Quota mode: none.
[ 9.300359] EXT4-fs (mmcblk0p3): unmounting filesystem cba1d45b-891e-48c6-b739-af652390f887.
[ 9.319321] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
[ 9.326995] CPU: 0 UID: 0 PID: 1 Comm: switch_root Not tainted 6.12.57-havnam #1
[ 9.334383] Hardware name: Texas Instruments AM62L3 Evaluation Module (DT)
[ 9.341242] Call trace:
[ 9.343678] dump_backtrace+0x90/0xe8
[ 9.347348] show_stack+0x18/0x24
[ 9.350657] dump_stack_lvl+0x34/0x8c
[ 9.354314] dump_stack+0x18/0x24
[ 9.357621] panic+0x390/0x3a4
[ 9.360672] do_exit+0x824/0x8f8
[ 9.363894] do_group_exit+0x34/0x90
[ 9.367462] pid_child_should_wake+0x0/0x60
[ 9.371636] invoke_syscall+0x48/0x10c
[ 9.375379] el0_svc_common.constprop.0+0x40/0xe0
[ 9.380074] do_el0_svc+0x1c/0x28
[ 9.383382] el0_svc+0x28/0x98
[ 9.386431] el0t_64_sync_handler+0x120/0x12c
[ 9.390780] el0t_64_sync+0x190/0x194
[ 9.394436] SMP: stopping secondary CPUs
[ 9.398355] Kernel Offset: disabled
[ 9.401832] CPU features: 0x00,00000080,00200000,4200420b
[ 9.407219] Memory Limit: none
[ 9.410267] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]---Do any steps need to be updated?
Thanks,
Dharmik
