OMAP-L138: Secure UART BOOT suspended at the line " (AIS Parse): Waiting for DONE..."

tien ngoc

Part Number: OMAP-L138
Other Parts Discussed in Thread: OMAPL138

Hello e2e memebers,

I am working on basic security device OMAP-L138 E. I am trying to boot it from a PC UART host using SECDEV Tools as instructed here (http://processors.wiki.ti.com/index.php/Basic_Secure_Boot_for_OMAP-L138_C6748)

1. First, I install SECDEVTOOL for OMAP-L138 from package downloaded from here (http://www.ti.com/tool/secdevtool-omapl138c6748

2. I use SecureHexAIS_OMAP-L138.exe to create secure AIS image from an application object file, say "uartEcho.out" file (built from TI examples). INI file is available in installed folder, I didn't write it.

SecureHexAIS_OMAP-L138.exe -ini applications\uartEcho_ini.ini -otype binary -o applications\uartEcho.bin applications\uartEcho.out

3. The generation process succeeds, I boot the secure OMAP-L138 with "uartEcho.bin" using GenericSecureUartHost.exe. I run into problem here, where the booting process is always stopping at the line " (AIS Parse): Waiting for DONE...".

This is the log from UART tool.

(File IO): Read 6248 bytes from file C:\ti\OMAPL138_C6748_Generic_Security\GNU\AISUtils\applications\uartEcho.bin.
(Serial Port): Opening COM7 at 115200 baud...
(AIS Parse): Read magic word 0x41504954.
(AIS Parse): Waiting for BOOTME... (power on or reset target now)
(AIS Parse): BOOTME received!
(AIS Parse): Performing Start-Word Sync...
(AIS Parse): Performing Ping Opcode Sync...
(AIS Parse): Processing command 0: 0x58535920.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Secure key loading, entering secure mode.
(AIS Parse): Processing command 1: 0x58535923.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Setting boot exit mode...
(AIS Parse): Set exit mode to 0x00000000.
(AIS Parse): Processing command 2: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 3: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 4: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 5: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 6: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 7: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 8: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 9: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 10: 0x5853590D.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Executing function...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): Processing command 11: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 156-Byte section to address 0xC1080000.
(AIS Parse): Processing command 12: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 5344-Byte section to address 0xC108009C.
(AIS Parse): Processing command 13: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 92-Byte section to address 0xC1081710.
(AIS Parse): Processing command 14: 0x58535921.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Loading encoded section...
(AIS Parse): Loaded 52-Byte section to address 0xC1081770.
(AIS Parse): Processing command 15: 0x58535906.
(AIS Parse): Performing Opcode Sync...
(AIS Parse): Performing jump and close...
(AIS Parse): Secure mode; sending signature.
(AIS Parse): AIS complete. Jump to address 0xC1080000.
(AIS Parse): Waiting for DONE...

Could anyone told me what is the reason and how can I tackle it?

Thank you.

over 8 years ago

0 Yordan Kovachev over 8 years ago

TI__Guru**** 161600 points

Hi,

I've notified the rtos team. Their feedback will be posted here.

Best Regards,
Yordan

0 Rahul Prabhu over 8 years ago

TI__Guru** 116740 points

Based on your log it appears that the boot ROM is unable to validate the signature that you have on your secure boot image. Please provide your INI file here for analysis.

what hardware are you trying this on.

Regards,
Rahul

0 tien ngoc over 8 years ago in reply to Rahul Prabhu

Intellectual 345 points

Thank you Rahul Prahu,

Here is my INI file, I also thought that there was a problem in it, but I don't know what it is. My hardware configuration is quite similar to that of OMAPL138_LCDK kit, excepted the secure part OMAP-L138 E

https://e2e.ti.com/cfs-file/__key/communityserver-discussions-components-files/791/uartEcho_5F00_ini.ini

; General settings that can be overwritten in the host code
; that calls the AISGen library.
[General]
; Can be 8 or 16 - used in emifa
busWidth=8            

; SPIMASTER,I2CMASTER,EMIFA,NAND,EMAC,UART,PCI,HPI,USB,MMC_SD,VLYNQ,RAW
BootMode=NAND

; 8,16,24 - used for SPI,I2C
;AddrWidth=8          

; NO_CRC,SECTION_CRC,SINGLE_CRC
crcCheckType=NO_CRC

; TRUE/ON or FALSE/OFF
seqReadEn=ON

; Specify the symbol name for the boot finalize function
;FinalFxnSymbolName=none


; Security settings (keys, options, list of sections to encrypt, etc.)
[Security]

; Security Type: GENERIC, CUSTOM, NONE
securityType=GENERIC

; Boot Exit Type: NONSECURE, SECUREWITHSK, SECURENOSK
; NONSECURE = Device switches from secure type to non-secure type, jumping to loaded code 
;             (no secure kernel since no longer secure device).
; SECUREWITHSK = Device remains as secure type, secure kernel is loaded, allowing run-time
;                security context switching.
bootExitType = NONSECURE

; Option to include in the generated key header the flag to force the JTAG off
;genericJTAGForceOff=FALSE

; Encrypt section list (ALL or comma-separated list of section names)
encryptSections=ALL

; CEK used for AES encryption of data - must be string of 32 hexadecimal characters
encryptionKey=4A7E1F56AE545D487C452388A65B0C05

; Debug key
;keyEncryptionKey=0B94A91D33E597097F6C426F8F016872

; SHA Algorithm Selection
genericSHASelection = SHA256

; Binary file containing secure key header for generic device
;genKeyHeaderFileName=key_hdr_sha256_enc.bin



; This section allows setting the PLL0 system clock with a  
; specified multiplier and divider as shown. The clock source
; can also be chosen for internal or external.
;           |------24|------16|-------8|-------0|
; PLL0CFG0: | CLKMODE| PLLM   | PREDIV | POSTDIV|
; PLL0CFG1: | RSVD   | PLLDIV1| PLLDIV3| PLLDIV7|
;[PLL0CONFIG]
;PLL0CFG0 = 0x00130001
;PLL0CFG1 = 0x00000104

; This section allows setting up the PLL1. Usually this will 
; take place as part of the EMIF3a DDR setup. The format of
; the input args is as follows:
;           |------24|------16|-------8|-------0|
; PLL1CFG0: |    PLLM| POSTDIV| PLLDIV1| PLLDIV2|
; PLL1CFG1: |           RSVD           | PLLDIV3|
;[PLL1CONFIG]
;PLL1CFG0 = 0x00000000
;PLL1CFG1 = 0x00000000

; This section lets us configure the peripheral interface
; of the current booting peripheral (I2C, SPI, or UART).
; Use with caution. The format of the PERIPHCLKCFG field 
; is as follows:
; SPI:        |------24|------16|-------8|-------0|
;             |           RSVD           |PRESCALE|
;
; I2C:        |------24|------16|-------8|-------0|
;             |  RSVD  |PRESCALE|  CLKL  |  CLKH  |
;
; UART:       |------24|------16|-------8|-------0|
;             | RSVD   |  OSR   |  DLH   |  DLL   |
;[PERIPHCLKCFG]
;PERIPHCLKCFG = 0x00000000


; This section allow setting the MPU1 or MPU2. If the 
; rangenum is out of the allowed range then all the ranges
; (including the fixed range) take the start, end, and 
; protection values.
;            |------24|------16|----------8|----------0|
; MPUSELECT: |      RSVD       |   mpuNum  | rangeNum  |
; STARTADDR: |              startAddr                  |
; ENDADDR:   |               endAddr                   |
; MPPAVALUE: |              mppaValue                  |
[MPUCONFIG]
MPUSELECT = 0x000001FF
STARTADDR = 0x00000000
ENDADDR   = 0xFFFFFFFF
MPPAVALUE = 0xFFFFFFFF



; This section can be used to configure the PLL1 and the EMIF3a registers
; for starting the DDR2 interface. 
; See PLL1CONFIG section for the format of the PLL1CFG fields.
;            |------24|------16|-------8|-------0|
; PLL1CFG0:  |              PLL1CFG              |
; PLL1CFG1:  |              PLL1CFG              |
; DDRPHYC1R: |             DDRPHYC1R             |
; SDCR:      |              SDCR                 |
; SDTIMR:    |              SDTIMR               |
; SDTIMR2:   |              SDTIMR2              |
; SDRCR:     |              SDRCR                |
; CLK2XSRC:  |             CLK2XSRC              |
[EMIF3DDR]
PLL1CFG0 = 0x15010001
PLL1CFG1 = 0x00000002
DDRPHYC1R = 0x000000C4
SDCR = 0x0A034622
SDTIMR = 0x184929C8
SDTIMR2 = 0xB80FC700
SDRCR = 0x00000406
CLK2XSRC = 0x00000000

; This section allow setting the MPU1 or MPU2. If the 
; rangenum is out of the allowed range then all the ranges
; (including the fixed range) take the start, end, and 
; protection values.
;            |------24|------16|----------8|----------0|
; MPUSELECT: |      RSVD       |   mpuNum  | rangeNum  |
; STARTADDR: |              startAddr                  |
; ENDADDR:   |               endAddr                   |
; MPPAVALUE: |              mppaValue                  |
;
; This MPU control must happen after the DDR init or else the
; MPU control has no effect
[MPUCONFIG]
MPUSELECT = 0x000002FF
STARTADDR = 0x00000000
ENDADDR   = 0xFFFFFFFF
MPPAVALUE = 0xFFFFFFFF

; This section can be used to configure the EMIFA to use 
; CS0 as an SDRAM interface.  The fields required to do this
; are given below.
;                     |------24|------16|-------8|-------0|
; SDBCR:              |               SDBCR               |
; SDTIMR:             |               SDTIMR              |
; SDRSRPDEXIT:        |             SDRSRPDEXIT           |
; SDRCR:              |               SDRCR               |
; DIV4p5_CLK_ENABLE:  |         DIV4p5_CLK_ENABLE         |
;[EMIF25SDRAM]
;SDBCR = 0x00004421
;SDTIMR = 0x42215810
;SDRSRPDEXIT = 0x00000009
;SDRCR = 0x00000410
;DIV4p5_CLK_ENABLE = 0x00000001

; This section can be used to configure the async chip selects
; of the EMIFA (CS2-CS5).  The fields required to do this
; are given below.
;           |------24|------16|-------8|-------0|
; A1CR:     |                A1CR               |
; A2CR:     |                A2CR               |
; A3CR:     |                A3CR               |
; A4CR:     |                A4CR               |
; NANDFCR:  |              NANDFCR              |
;[EMIF25ASYNC]
;A1CR = 0x00000000
;A2CR = 0x00000000
;A3CR = 0x00000000
;A4CR = 0x00000000
;NANDFCR = 0x00000000

; This section should be used in place of PLL0CONFIG when
; the I2C, SPI, or UART modes are being used.  This ensures that 
; the system PLL and the peripheral's clocks are changed together.
; See PLL0CONFIG section for the format of the PLL0CFG fields.
; See PERIPHCLKCFG section for the format of the CLKCFG field.
;               |------24|------16|-------8|-------0|
; PLL0CFG0:     |              PLL0CFG              |
; PLL0CFG1:     |              PLL0CFG              |
; PERIPHCLKCFG: |              CLKCFG               |
;[PLLANDCLOCKCONFIG]
;PLL0CFG0 = 0x00000000
;PLL0CFG1 = 0x00000000
;PERIPHCLKCFG = 0x00000000

; This section should be used to setup the power state of modules
; of the two PSCs.  This section can be included multiple times to
; allow the configuration of any or all of the device modules.
;           |------24|------16|-------8|-------0|
; LPSCCFG:  | PSCNUM | MODULE |   PD   | STATE  |
;[PSCCONFIG]
;LPSCCFG = 0x01030003

; This section allows setting of a single PINMUX register.
; This section can be included multiple times to allow setting
; as many PINMUX registers as needed.
;         |------24|------16|-------8|-------0|
; REGNUM: |              regNum               |
; MASK:   |               mask                |
; VALUE:  |              value                |
;[PINMUX]
;REGNUM = 5
;MASK = 0x00FF0000
;VALUE = 0x00880000

; No Params required - simply include this section for the fast boot function to be called
;[FASTBOOT]

; This section allows configuration of one the systme IOPUs.
; The iopuNum field must be valid (0-5) and then mppaStart
; and mppaend fields allow setting a range of mppa MMRs to the 
; same supplied mppa value.
; IOPUSELECT: |  RSVD  | iopuNum| mppaStart |  mppaEnd  |
; MPPAVALUE:  |              mppaValue                  |
[IOPUCONFIG]
IOPUSELECT = 0x000000FF
MPPAVALUE  = 0xFFFFFFFF

[IOPUCONFIG]
IOPUSELECT = 0x000100FF
MPPAVALUE  = 0xFFFFFFFF

[IOPUCONFIG]
IOPUSELECT = 0x000200FF
MPPAVALUE  = 0xFFFFFFFF

[IOPUCONFIG]
IOPUSELECT = 0x000300FF
MPPAVALUE  = 0xFFFFFFFF

[IOPUCONFIG]
IOPUSELECT = 0x000600FF
MPPAVALUE  = 0xFFFFFFFF

; This section allow setting the MPU1 or MPU2. If the 
; rangenum is out of the allowed range then all the ranges
; (including the fixed range) take the start, end, and 
; protection values.
;            |------24|------16|----------8|----------0|
; MPUSELECT: |      RSVD       |   mpuNum  | rangeNum  |
; STARTADDR: |              startAddr                  |
; ENDADDR:   |               endAddr                   |
; MPPAVALUE: |              mppaValue                  |
;[MPUCONFIG]
;MPUSELECT = 0x000001FF
;STARTADDR = 0x00000000
;ENDADDR   = 0x00000000
;MPPAVALUE = 0xFFFFFFFF

; This function allows the user to selectively open up the
; the debug TAPs of the device.  Since the function is not
; executed until the signature is checked, it does not 
; pose a security issue.
;          |------24|------16|----------8|----------0|
; TAPSCFG: |      RSVD       |       tapscfg         |
[TAPSCONFIG]
TAPSCFG = 0x0000FFFF

0 tien ngoc over 8 years ago in reply to Rahul Prabhu

Intellectual 345 points

Hi Rahul,

I have debug C# source code of GenericSecureUartHost tool using Visual Studio 2015 to find out what happened after the line "Waiting for DONE ..."

I found that after that line (code line: 801, file: AISParse.cs)

                logFxn("(AIS Parse): Waiting for DONE...");

the tool tries to send a string of " DONE" to OMAP-L138 and receive a string stored in variable named rcvEnd (type Byte[] ). In this command (code line: 802, file: AISParse.cs)

status = readFxn(rcvEnd, 0, 8, -1);

I set a break point here and figured out that the program cannot go over this function. I thought that there was a problem in transmitting/receiving UART data between PC and OMAP. But if that was true, why could other data be loaded successfully?

Do you have any idea?

0 Rahul Prabhu over 8 years ago in reply to tien ngoc

TI__Guru** 116740 points

Is the uartEcho function that you have placing code in DDR or from shared RAM on the device?

I also noticed that you are configuring PLL1 and DDR is configured but not PLL0. Can you also add PLL0 settings and try this again. Also, please correct the boot mode to UART or None and also add the MPU settings back into the INI file.

Regards,
Rahul

Processors

Processors forum

OMAP-L138: Secure UART BOOT suspended at the line " (AIS Parse): Waiting for DONE..."