MCU-PLUS-SDK-AM263X: MCU-PLUS-SDK-AM263X

Hi Aakash Kedia,

thank you for your support.

I tried to follow the Academy section you mentioned, but there is some step not completely clear to me.

For example, do I need to insert the HSM runtime code upload stage in my SBL_UART_UNIFLASH project?

The aim of this project is only to provide an XMODEM server to burn a QSPI_SBL on flash, so I didn't add any encripted HSM image load on it.

Considering the HF-SE state of my board, should I still consider the HSM firmware upload as mandatory for the SBL_UART_UNIFLASH t as well?  I've just signed this  code with my SMPK key at the moment.

BR,

Vanni

Hi Aakash Kedia,

I imported the HSM project on CCS and set the build behaviour as follow:

I also modified the TIFS devconfig.mak file to use my custom keys:

Here the compiler output.  You can see the used custom keys are correct and the hsmRtImg.h is correctly copied in the relevant SDK_PLUS folder:

After that, I modified the SBL_UART_UNIFLASH example to upload the HSM code this way:

In this project I set the following build behavior on CCS: DEVICE=am263x DEVICE_TYPE=HS DEBUG_TIFS=no DEBUG_OPTION=DBG_PUBLIC_ENABLE

but again, after having sent it to the board via XMODEM, I'm still not able to connect to it with JTAG. I already excluded any GEL file execution and any reset option on connect and you can also notice that I added an infinite loop after the HSM load to allow an easy debug's attachment.

I also modified the SDK's devconfig.mak file to point to the same customer keys. 

Did I miss some point?

BR,

Vanni Vinti

Hi,

I'm using the following SSL library:

Please consider that I was able to build and run others SBL projects for different QSPI flash devices support and if the library was not correct, they shouldn't run even on HS-FS device, correct?

BR,

Vanni

Hi Vanni,

Let's have a short debug call to address this issue. Please send an invite via the TI contact or send me a Friend Request.

Best Regards,
Aakash

Hi Vanni,

I think the device is flashed with dummy keys provided via SDK i.e. 

SMEK : https://github.com/TexasInstruments/mcupsdk-core/blob/next/tools/boot/signing/mcu_custMek.key
SMPK : https://github.com/TexasInstruments/mcupsdk-core/blob/next/tools/boot/signing/mcu_custMpk.pem

Can you try using the same ? I can confirm that the SMPK is still the same, so you can try without encryption first.

Can you reassess your steps ? Looks like you did some mistake while using the OTP Key Writer.

Best Regards,
Aakash

Hi Aakash,

if my device is flashed with dummy TI keys, why the boot log shows the HASH of my custom key?

Anyway, I'll do this test and let you know,

BR,

Vanni

Hi Aakash,

I've just completed the test you suggested me, but the SBL code is still not running and the JTAG port remain locked.

BR,

Vanni

Hi Aakash,

I also have an AM263x dev board, and I have the following RBL dump:

---------------------------
SoC ID HW Info:
---------------------------
partID               : 0x0
partNumber           : 0x2
PGVer                : 0x3
ROMVer               : 0x2
MetalVer             : 0x1
---------------------------
SoC ID R5 ROM Info:
---------------------------
r5 ROM Ver           : 0x10100
---------------------------
SoC ID HSM Pub ROM Info:
---------------------------
devName              : AM263X      
devType              : 0xabcd0004  -->  HS_FS
hsm ROM Ver          : 0x10100
---------------------------
SoC ID HSM Sec ROM Info:
---------------------------
Prime                : 0x1
Key Rev              : 0x0
Key Count            : 0x0
SWRV SBL             : 0x0
SWRV HSM             : 0x0
TI MPK Hash          : ec54cc16cd1ffccab7fd81fd82c998b305c6ac0c12cccf21a610fc1ad7159b1ad20acd69adabf72f1eed15021e26766d2f212d135b6bebf5e5e76c06ac87a6e4
Cust MPK Hash        : 00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Unique ID            : b916a72593008043265c284fbde951627208866f98e1d288f587de06ddb1b2232935701ad819afc99479d14d23e2e474aeb5b015725c72f2a0495b2d563100cf

I have never used any of the security features of this board (we're trying to replicate the security flow with this brand new board) and as can be seen in the dump the hash for the "Cust MPK Hash" is all zeroes. If there is no way to verify the encryption key, what does that indicate?

Thanks for the insight,

Riccardo

Hi,

Vanni already did the test with the encryption feature disabled, as he mentioned in 5121959, but the board still doesn't work in that state.

What do you suggest we try next? Maybe we can schedule another debug call to further clarify the issue?

BR

Riccardo

Hi Riccardo Belli,

Sure. Please send the invite for the same.

Same time as the last time.

Best Regards,
Aakash

Hi,

I just sent you a private message.

BR

Riccardo