AM62P-Q1: Source code and demo for HSM

Hello,

Changxing Du said:

Where can I download the source project for hsm.appimage.hs_fs?

There is no source code for this image from TI. The HSM firmware, to be converted to this appimage, needs to be procured from 3P HSM vendors.

How TI generate this binary?  We have 3P hsm from Vector already, but we want know if hsm has relation with Sci server? How we should handle this on 3p firmware.

Changxing Du said:

How TI generate this binary?

The SDK comes with the dummy HSM binary which does not do anything. If you have your HSM binary, you could replace the dummy one with yours and generate the HSM appimage for the SBL to boot it.

The HSM does not have any relation to Sciserver. If HSM wants to communicate with the TIFS for any TISCI services, it must have its own Sciclient driver and communicate directly with the TIFS.

How can I connect HSM core via debuger? Any steps i should follow?

Yes, you would need to follow the JTAG unlock procedure to unlock the HSM core.

software-dl.ti.com/.../secure_debug.html

Yes, in the doc, the M3 means which core? For HS-SE , HSM core debug is closed by default, right?

By the way, what's  the PC address for HSM core after reset?

Changxing Du said:

Yes, in the doc, the M3 means which core? For HS-SE , HSM core debug is closed by default, right?

M3 is the TIFS core running the TI provided TIFS firmware. HSM core debug is closed by default on both HSFS and HSSE.

Changxing Du said:

By the way, what's  the PC address for HSM core after reset?

The HSM firmware is loaded in the HSM RAM and the boot vector after reset is the base address of the HSM RAM.

But in some other doc  (AM62x_Security_Overview_1Q23_v1.pdf), it mentioned that the secure core is M4F, not M3. We're confused about this.

See the screeshot below: we're confused about which is applicable for AM62p.

That's reason we request to update this doc for AM62p.

Changxing Du said:

But in some other doc  (AM62x_Security_Overview_1Q23_v1.pdf), it mentioned that the secure core is M4F, not M3. We're confused about this.

The information in the screenshot or AM62x_Security_Overview_1Q23_v1.pdf is correct. The use of the term "M3" in the TISCI docs is more a generic term that the cores in the Security Subsystem are Cortex-M cores.

How CAN I check the RAM for AM62P HSM? Why you have no plan to update the doc?

Changxing Du said:

How CAN I check the RAM for AM62P HSM?

What do you mean by checking the RAM? Do you want to know where it is located on the SoC address space?

Changxing Du said:

Why you have no plan to update the doc?

AM62P has the same SMS architecture as AM62x so you may refer to the information next to AM62x in the docs on the secure portal. We will review and plan to explicitly state the devices in the documents.

Thanks for your support. I mean the base RAM address for HSM. Is it possible to run some code of HSM in DDR?

Changxing Du said:

I mean the base RAM address for HSM.

Please refer the "10.2.3.4.13 Memory Map" section of the K3 Security TRM.

Changxing Du said:

Is it possible to run some code of HSM in DDR?

Theoretically, yes.

One more question: If the device type is HS-FS, how can we get the private key which is used to sign the cert which is used for unlocking jtag?

What's the mearning for below keys : 

1. SMPK
2. BMPK

Changxing Du said:

One more question: If the device type is HS-FS, how can we get the private key which is used to sign the cert which is used for unlocking jtag?

For HSFS, you can sign the debug certificate with any random valid key.

Changxing Du said:

What's the mearning for below keys : 

Please see the following

software-dl.ti.com/.../key_writer.html

For HS-FS， how the TIFS verify the signature, because there is no publick key in it if i used any random valid key. Do i need write key before unlocking jtag?

Changxing Du said:

For HS-FS， how the TIFS verify the signature, because there is no publick key in it if i used any random valid key.

There is no verification performed on HSFS devices. Simply sign the certificate with any random valid key.

Whether the two options is still used for coreDbgEn and secCoreDbgEn, specially for HS-FS, the jtags of non-secure cores is already opened?

It is confused from the doc. Does it applicable for AM62p?

For HSFS, you only need to mention the HSM processor id in the secCoreDbgEn as the other cores are already unlocked.

Hello 

I tried to unlock HSM via CCS 20.02.

I can see in the console that the unlock success:

Successfully opened certificate file D:\TI\Trunk\veHsm_Am62p\debug_cert\debug_unlock_cert.der.
Read 1588 bytes from certificate file D:\TI\Trunk\veHsm_Am62p\debug_cert\debug_unlock_cert.der.
The target device is unlocked.

But when I try to connect HSM core, i still got following error:

SMS0_HSM_0: Error connecting to the target: (Error -1170 @ 0x0) Unable to access the DAP. Reset the device, and retry the operation. If error persists, confirm configuration, power-cycle the board, and/or try more reliable JTAG settings (e.g. lower TCLK). (Emulation package 20.2.0.3536) 

My steps are:

1 Lauch CCS debuger

2 run unlock bat file

3 connect HSM core.

Do you have any idear for this?

PS: my cert is below:

30 82 06 30 30 82 04 18 A0 03 02 01 02 02 14 76
D4 94 3A C1 C6 5B C5 DE CF 35 2E E9 AD 60 C8 1F
DA 7E 9F 30 0D 06 09 2A 86 48 86 F7 0D 01 01 0D
05 00 30 81 8F 31 0B 30 09 06 03 55 04 06 13 02
43 4E 31 11 30 0F 06 03 55 04 08 0C 08 53 68 61
6E 67 68 61 69 31 11 30 0F 06 03 55 04 07 0C 08
53 68 61 6E 67 68 61 69 31 0F 30 0D 06 03 55 04
0A 0C 06 56 65 63 74 6F 72 31 0C 30 0A 06 03 55
04 0B 0C 03 48 53 4D 31 1B 30 19 06 03 55 04 03
0C 12 41 4D 36 32 50 2D 44 65 62 75 67 2D 55 6E
6C 6F 63 6B 31 1E 30 1C 06 09 2A 86 48 86 F7 0D
01 09 01 16 0F 68 73 6D 40 65 78 61 6D 70 6C 65
2E 63 6F 6D 30 1E 17 0D 32 36 30 39 30 39 30 36
30 34 30 39 5A 17 0D 32 36 31 30 30 39 30 36 30
34 30 39 5A 30 81 8F 31 0B 30 09 06 03 55 04 06
13 02 43 4E 31 11 30 0F 06 03 55 04 08 0C 08 53
68 61 6E 67 68 61 69 31 11 30 0F 06 03 55 04 07
0C 08 53 68 61 6E 67 68 61 69 31 0F 30 0D 06 03
55 04 0A 0C 06 56 65 63 74 6F 72 31 0C 30 0A 06
03 55 04 0B 0C 03 48 53 4D 31 1B 30 19 06 03 55
04 03 0C 12 41 4D 36 32 50 2D 44 65 62 75 67 2D
55 6E 6C 6F 63 6B 31 1E 30 1C 06 09 2A 86 48 86
F7 0D 01 09 01 16 0F 68 73 6D 40 65 78 61 6D 70
6C 65 2E 63 6F 6D 30 82 02 22 30 0D 06 09 2A 86
48 86 F7 0D 01 01 01 05 00 03 82 02 0F 00 30 82
02 0A 02 82 02 01 00 BF 14 AE 49 D8 7F 72 D3 6B
23 CD EB 48 0E 65 DC 22 4D F2 0E 4F 82 F6 ED B5
F2 DD DB 7C 91 FA 6E 59 FF D5 F7 B6 DE 04 1D 8A
CC D2 95 D9 D1 E0 C4 C1 F8 50 BF FF 48 0C 91 22
50 9A 4C 7B 8B F3 96 0A 28 26 B3 A4 D9 E0 A9 55
41 1A FB 3E 5B 27 6C BF CA C0 71 AF 2F 72 22 EE
46 01 25 62 AD 3E C7 04 F6 B1 18 B6 2C C0 12 6E
0F E2 9B 3E E5 A6 A0 A8 06 45 03 41 17 4E 16 1F
A9 74 D6 84 4E D6 79 A7 10 B8 11 A9 0E 92 1F 25
DD 7F B1 F2 D1 B9 F2 68 D8 33 59 4B 82 7D 77 CC
D1 9C FA 23 B4 FB 58 88 F2 CD EA D5 16 F2 2C 75
2D FA 62 C3 C1 09 6E E0 06 70 E0 B5 07 09 99 62
D9 D6 E4 E7 6C 6D C8 82 07 50 93 F7 E2 D8 ED D1
5F E3 D0 9E CF 93 54 D9 5F DD 5D CE 37 60 F1 AB
14 8A 04 7B 65 A7 BA 7F DF 45 45 7C 4B A1 5B AE
4E C6 94 3D 8C 4E 87 D2 94 3C A4 F3 9F DA FC F2
36 7C E7 0D AD 5A 42 37 F1 2A 81 D0 6E A1 A7 67
03 1E 87 ED 00 BB 73 4A 68 28 31 A2 82 9A A3 04
C1 E8 87 FF 45 7E AA C1 9F D4 3B 05 C7 83 FD 21
71 FE BD 7F 38 C9 16 19 52 0E E6 03 33 8D 1D 1E
C9 36 1C CD 4E 9D 82 29 88 CD 9B 2A BE 6C 5F 7B
B2 B2 3A 79 00 6A 7D F5 AD 1A 9D 1E CD 58 2A CF
5E F4 4E 80 AB 3B 4F DD F8 D4 DE 34 A2 C4 20 D9
59 19 2D 85 02 5E 1F 68 B1 4C 8D B9 11 06 E9 2D
76 B5 58 8C 50 A8 37 6E 66 78 6F 83 30 46 4D 34
9F B4 18 4A B9 BB FA 7B C5 AE D6 32 10 84 84 6C
3F 9A 80 33 35 FC 4D BC D5 6E 60 54 50 CF 7E 6D
80 97 04 FA 8F 0B 20 FD BD 98 2B A1 37 BD 59 FD
4A EC 45 A1 09 8B 17 C9 72 14 33 B7 05 5E 12 5D
E2 5A 1D CE 21 54 F6 E1 EA D5 55 AA 27 EB 4D 09
DF 19 40 82 2E 66 89 17 65 D9 6E B3 D6 38 4E 8D
61 16 D6 74 D4 DE 16 5F 51 19 D5 42 B8 83 D2 C8
DE 4B A9 69 97 B6 8D 02 03 01 00 01 A3 81 81 30
7F 30 0C 06 03 55 1D 13 04 05 30 03 01 01 FF 30
12 06 09 2B 06 01 04 01 82 26 01 03 04 05 30 03
02 01 00 30 3C 06 09 2B 06 01 04 01 82 26 01 08
04 2F 30 2D 04 20 C3 BB 93 77 FA 80 34 FA BD 10
A6 0D 06 A6 87 98 99 0F 87 D4 F9 2B 60 11 90 97
82 68 E7 6E 4A 5C 02 01 04 02 02 00 80 02 02 00
80 30 1D 06 03 55 1D 0E 04 16 04 14 04 DF BB B3
84 14 77 25 0C CB 2E 33 A4 7D 4D 85 59 12 FB E5
30 0D 06 09 2A 86 48 86 F7 0D 01 01 0D 05 00 03
82 02 01 00 0B 3D F2 78 75 ED 50 C7 59 1F 99 AA
E0 C6 8E AC 61 C7 01 31 28 83 64 7C AE 46 5F 81
36 B0 34 D8 1D 3E EE 11 54 FC DB 54 C2 05 D9 7B
BC 92 26 33 DC 96 15 89 DC 49 93 2D 10 4A 44 6B
05 8D D3 3D BE EA E3 8C D8 D5 BB 1E 8A 71 23 4C
36 8B 17 DC 65 0A 65 6C 1E D0 C8 8B E2 A3 B9 BE
CA CC 74 5C 65 91 7B C7 F7 A9 C7 53 0B FE 6D D4
F2 FD 31 24 15 64 BD 9B 4F 52 AF 98 FC B8 09 CE
3B 39 C8 20 CB F3 CC 6D CB E3 A9 C4 56 1D AA BA
7E DB 98 93 D9 49 55 B4 9A 63 1A 38 26 30 E8 EF
13 12 D1 F9 9F D5 E4 CF BA FA 13 F1 B4 EE 89 54
16 FE 02 A6 47 0D A2 B8 07 FA 6C 74 9F CC F1 78
68 62 7E 28 A7 91 FC FC DB 96 4D C1 4A 3F BB C1
E4 F5 FA DC 92 35 74 E5 86 A7 4A C5 DB B6 E5 1D
9C 33 9C 85 7F 90 BB A8 3B D7 A7 61 6E 32 EE 55
54 11 3D A1 C2 17 31 CA CA DC 6C 3A 8A E2 83 36
30 08 AA D7 26 86 B7 AA 0F 94 4E C3 E5 85 8A 03
C8 19 5C 02 FE 2B 51 3D 66 00 39 89 5A EC 8E 2C
74 CE 78 6A FF 2A 9A 62 52 22 63 E0 EF 49 F0 63
45 68 A7 8E EF 4D 8E DD ED B8 C3 B3 66 8D AA 72
AC 33 15 EE 4D 0A 46 EB 58 41 27 D9 C5 B5 85 4C
AD 72 D3 9F C2 74 57 E7 D6 2C EC 24 31 2F 6A 15
E8 03 C8 33 99 DE DB 40 C9 8E 6B 1C 86 8C 68 42
FD CE A8 83 67 B0 DC 89 8D 56 11 DE 36 9C 3F F3
B6 6F C9 4E 9E 7C 10 36 BA 02 EE 50 70 28 28 1A
AE A8 67 FB 08 B4 53 15 46 F7 67 2D 5F BE AC 4C
77 1A 88 1C CC D0 13 6F 98 41 AD 3B E2 A7 C7 98
7E 90 BC B8 65 6C 1F 92 22 81 BE 3E 71 65 89 C9
BC F3 25 03 D5 01 B2 A4 30 93 3A 99 F6 73 10 84
BE 4F F2 CE 6A 14 B9 6D 3D AA 10 51 D4 19 D8 97
BE AD 80 56 5A 1D 93 A7 0D 24 90 A0 5D D9 81 38
D2 83 1A 71 99 A6 7C E2 0A F2 F9 B5 AC 80 7D E7
36 BA 32 A7

Changxing Du said:

But when I try to connect HSM core, i still got following error:

Please note the HSM core, like any core, must be initialised before trying to connect to the core via the debugger.

The init is done already by the wakeup core. Because we download the demo from SDK .

But we use the following SCI, then the debuger can be connected.

Additionally, we 're confused about the ram address mentioned in the mem layout session.

In CCS debuger， if we change the content at zero address, it's ok. If we change the Soc Phy address 0x43c00000, it failed.

Which value we should use in our linker script?

tisci_msg_proc_set_config_req cfg = {0};
cfg.processor_id       = SCICLIENT_PROC_ID_HSM_M4FSS0_CORE0;   /* 0x80 */
cfg.bootvector_lo      = HSM_LOAD_ADDR;                         /* 0x43C00000 */
cfg.config_flags_1_set = TISCI_MSG_VAL_PROC_BOOT_CFG_FLAG_HSM_DBG_EN  /* 0x04 */
                       | TISCI_MSG_VAL_PROC_BOOT_CFG_FLAG_M4F_DBG_EN    /* 0x01, 若有 */
                       | TISCI_MSG_VAL_PROC_BOOT_CFG_FLAG_M4F_DBG_NIDEN;/* 0x02, 若有 */
Sciclient_procBootRequestProcessor(cfg.processor_id, timeout);
Sciclient_procBootSetProcessorCfg(&cfg, timeout);

At last, why my cert. doesnot work? Or it's not needed for HS-FS?

Thanks!

Changxing Du said:

In CCS debuger， if we change the content at zero address, it's ok. If we change the Soc Phy address 0x43c00000, it failed.

From which core, you are writing to these addresses that 0x0 works but 0x43C00000 fails?

Changxing Du said:

Which value we should use in our linker script?

Which linker script you are referring to?

Changxing Du said:

At last, why my cert. doesnot work? Or it's not needed for HS-FS?

If the certificate didn't work, you would not get the "The target device is unlocked". And no modifications are required to be able to connect to the HSM core. Please make sure the SBL is actually booting the HSM core. It might be the case SBL silently failed to boot the HSM core for some reasons.

The SBL statege 2 did the righting already. We're using SDK 12.

At last, why debug is unlocked without the cert only using the Sci service mentioned in my previous comment. This is the evidence  that Spl 2 did right thing already.

Changxing Du said:

At last, why debug is unlocked without the cert only using the Sci service mentioned in my previous comment.

Do you mean that you are able to connect to the HSM core without using the debug certificate to unlock the HSM core first?

Exactly.

I will check and get back to you.

Can you update on this questions？

I don't have the final conclusion yet. The understanding is the SoC tap for HSM core is not locked on HSFS device so you don't need to unlock the core. The debugger cannot attach to the HSM core possibly because of the core specific signals which gets enabled when the SET_CONFIG message is sent with those specific flags. The same procedure doesn't work on HSSE because the SoC taps are closed which needs to be unlocked first with the secure debug unlock procedure.