Professional Documents
Culture Documents
Procedure_followed_to_boot_secureOMAPL138
Procedure_followed_to_boot_secureOMAPL138
Procedure_followed_to_boot_secureOMAPL138
We are trying to boot our custom board OMAP L138 which is secure from an unsecure file. We followed
three procedures.
PROCEDUREONE
1) We created a Hello world ARM CCS project and loaded the Hello.out file into the ARM core of
the OMAPLCDK EVM( This board is in unsecure mode) with the GEL File provided by the
StarterWare..The Hello.out file loaded and we were able to see the output “Hello World” on the
console.
2) We created DSP CCS Project Hello.out for custom board on the DSP(Since our board is secure)
Core but we got the following error while connecting to core
3) After Posting above on your forum we came to know that we need to unlock the JTAG to load
binaries into the secure board. So we following the following steps
We used SecureHexAIS_OMAP-L138 to create a secure .bin file from our .out file . We followed
the following command
i) SecureHexAIS_OMAP-L138.exe –ini spi_test.ini -o typebinary -o E:\LBand\Test.bin E:\
LBand\Hello.out. The output was as follows
C:\Program Files (x86)\OMAPL138_C6748_Generic_Security\
C674x_OMAPL1x_Generic_Security_Flash_Boot_Utils\OMAP-
L138_Secure_FlashAndBootUtils_trunk\OMAP-L138_Secure\GNU\AISUtils>
SecureHexAIS_OMAP-L138.exe -ini spi_test.ini -o typebinary -o E:\LBand\Test.bin E:\LBand\
Hello.out
/* Output of the Command used*/
Creating boot image for a generic secure device.
INFO: Boot exit type has been selected as SECUREWITHSK.
WARNING: Encrypted Key Header data is absent - generating plaintext version.
The Customer Encryption Key will be transferred in plaintext!
INFO: Current SHA algorithm is SHA256.
Begining the Secure AIS file generation.
AIS file being generated for bootmode: SPIMASTER.
Signature Hash: CF-23-59-8F-48-D2-7B-EA-42-18-87-59-70-51-54-2A-E3-23-E2-5A-A1-43-A5-
84-06-28-8D-54-3D-D8-FE-21
Signature Byte Count = 68
Signature Hash: 9E-ED-33-13-EB-53-84-CC-9B-5B-43-49-E9-2E-54-BB-EE-F2-09-98-54-2F-50-
12-90-6E-01-19-43-83-25-52
Signature Byte Count = 16
Signature Hash: 35-96-3B-5C-0D-36-89-8B-E3-BE-3F-A6-99-63-67-98-F8-78-23-76-12-B2-6A-
29-B0-B1-7A-7A-52-99-76-69
Signature Byte Count = 24
Signature Hash: 85-C0-9B-71-E5-37-0B-8F-AA-8B-A8-06-16-FF-0D-0F-D9-FF-61-FD-DF-97-3B-
C8-8D-52-CB-6F-AB-73-9A-CE
Signature Byte Count = 40
Signature Hash: 35-6D-A7-4D-37-26-3E-38-AE-0B-0C-DA-91-73-68-63-4A-10-3C-3A-59-3B-
0A-76-4F-88-63-53-4A-FC-F5-DF
Signature Byte Count = 24
Signature Hash: 44-BA-AD-61-79-77-DC-E8-5E-17-C3-49-91-6F-9E-01-48-9D-10-AD-11-4B-
41-56-72-1E-A6-F4-E6-35-3A-38
Signature Byte Count = 16
Signature Hash: 8A-DD-4B-C8-83-56-4A-0F-B3-DB-14-06-79-B5-6D-A3-44-7B-4B-E8-BB-1A-
C1-90-EF-76-CC-0E-0B-8B-52-22
Signature Byte Count = 16
Signature Hash: D7-1D-EB-18-0F-32-8E-F9-C3-5B-12-FE-27-B9-FE-C9-59-43-7E-9F-7C-E9-87-
BA-EE-EA-74-B0-CE-A7-D2-E3
Signature Byte Count = 16
Signature Hash: B8-13-64-A6-66-78-FC-FE-B8-FA-42-6F-65-63-06-E0-27-34-E0-A4-BE-59-02-
9F-95-3D-45-94-8A-C2-66-C5
Signature Byte Count = 16
Signature Hash: 5D-7A-14-49-19-41-A0-56-09-FB-61-D6-1F-1C-B1-62-DC-FD-D9-58-94-29-
81-21-C9-6D-F4-7E-8B-59-09-C0
Signature Byte Count = 16
Signature Hash: 12-59-5B-FB-12-5D-D8-72-2B-26-CF-4F-AF-9C-7E-CF-89-04-34-47-84-E1-C0-
EE-E1-AF-45-7E-B9-4F-E0-D4
Signature Byte Count = 12
ERROR: Not a valid object file.
Parsing the input object file, E:\LBand\Hello.out.
Encrypting section .text, since ALL was specified for encryptSections in ini file.
Encrypting section .const, since ALL was specified for encryptSections in ini file.
Encrypting section .cinit, since ALL was specified for encryptSections in ini file.
Signature Hash: 47-AA-86-68-F5-95-1A-2C-0F-19-DC-28-1A-7F-74-C3-70-42-C2-A2-67-C3-
5A-33-3E-8B-54-36-96-16-AB-2D
Signature Byte Count = 17820
AIS file generation was successful.
Wrote 18468 bytes to file E:\LBand\Test.bin.
Conversion is complete.
ii)We used two different .ini files for creating secure imagesi.e Test.bin for loading into OMAP
L138
Since we have an SPI Flash we used following spi_test.ini
; spi_test.ini
[General]
busWidth=8
BootMode=SPIMASTER
crcCheckType=NO_CRC
seqReadEn=ON
[Security]
securityType=GENERIC
bootExitType = SECUREWITHSK
encryptSections=ALL
encryptionKey=4A7E1F56AE545D487C452388A65B0C05
genericSHASelection = SHA256
; |------24|------16|-------8|-------0|
; PLL0CFG0: | CLKMODE| PLLM | PREDIV | POSTDIV|
; PLL0CFG1: | RSVD | PLLDIV1| PLLDIV3| PLLDIV7|
[PLLANDCLOCKCONFIG]
PLL0CFG0 = 0x00180001
PLL0CFG1 = 0x00000B05
PERIPHCLKCFG = 0x00010064
; |------24|------16|-------8|-------0|
; PLL1CFG0: | PLLM| POSTDIV| PLLDIV1| PLLDIV2|
; PLL1CFG1: | RSVD | PLLDIV3|
[PLL1CONFIG]
PLL1CFG0 = 0x18010001
PLL1CFG1 = 0x00000002
; No Params required - simply include this section for the fast boot function to be called
;[FASTBOOT]
[IOPUCONFIG]
IOPUSELECT = 0x000100FF
MPPAVALUE = 0xFFFFFFFF
[IOPUCONFIG]
IOPUSELECT = 0x000200FF
MPPAVALUE = 0xFFFFFFFF
[IOPUCONFIG]
IOPUSELECT = 0x000300FF
MPPAVALUE = 0xFFFFFFFF
[IOPUCONFIG]
IOPUSELECT = 0x000600FF
MPPAVALUE = 0xFFFFFFFF
; SPIMASTER,I2CMASTER,EMIFA,NAND,EMAC,UART,PCI,HPI,USB,MMC_SD,VLYNQ,RAW
BootMode=UART
; NO_CRC,SECTION_CRC,SINGLE_CRC
crcCheckType=NO_CRC
; TRUE/ON or FALSE/OFF
seqReadEn=ON
; Option to include in the generated key header the flag to force the JTAG off
;genericJTAGForceOff=FALSE
; CEK used for AES encryption of data - must be string of 32 hexadecimal characters
encryptionKey=4A7E1F56AE545D487C452388A65B0C05
; Debug key
;keyEncryptionKey=0B94A91D33E597097F6C426F8F016872
; This section can be used to configure the PLL1 and the EMIF3a registers
; for starting the DDR2 interface.
; See PLL1CONFIG section for the format of the PLL1CFG fields.
; |------24|------16|-------8|-------0|
; PLL1CFG0: | PLL1CFG |
; PLL1CFG1: | PLL1CFG |
; DDRPHYC1R: | DDRPHYC1R |
; SDCR: | SDCR |
; SDTIMR: | SDTIMR |
; SDTIMR2: | SDTIMR2 |
; SDRCR: | SDRCR |
; CLK2XSRC: | CLK2XSRC |
[EMIF3DDR]
PLL1CFG0 = 0x15010001
PLL1CFG1 = 0x00000002
DDRPHYC1R = 0x000000C4
SDCR = 0x0A034622
SDTIMR = 0x184929C8
SDTIMR2 = 0xB80FC700
SDRCR = 0x00000406
CLK2XSRC = 0x00000000
; This section allow setting the MPU1 or MPU2. If the
; rangenum is out of the allowed range then all the ranges
; (including the fixed range) take the start, end, and
; protection values.
; |------24|------16|----------8|----------0|
; MPUSELECT: | RSVD | mpuNum | rangeNum |
; STARTADDR: | startAddr |
; ENDADDR: | endAddr |
; MPPAVALUE: | mppaValue |
;
; This MPU control must happen after the DDR init or else the
; MPU control has no effect
[MPUCONFIG]
MPUSELECT = 0x000002FF
STARTADDR = 0x00000000
ENDADDR = 0xFFFFFFFF
MPPAVALUE = 0xFFFFFFFF
[IOPUCONFIG]
IOPUSELECT = 0x000100FF
MPPAVALUE = 0xFFFFFFFF
[IOPUCONFIG]
IOPUSELECT = 0x000200FF
MPPAVALUE = 0xFFFFFFFF
[IOPUCONFIG]
IOPUSELECT = 0x000300FF
MPPAVALUE = 0xFFFFFFFF
[IOPUCONFIG]
IOPUSELECT = 0x000600FF
MPPAVALUE = 0xFFFFFFFF
4)After we built Test.bin files separately using different .ini files we tried to load into the board through
UARTusing GenericSecureUartHost utility one by one i.e Firstly we connected SPI Flash in our board and
tried to load Test.bin file created using spi_test.ini
Then we connected UART in our board and tried to load Test.bin file created using uartEcho.ini.
1)The AISgen GUI can be used to generate the StarterWare bootloader .ais. All of the critical
settings are located on the General tab of the AISgen GUI:
3. Click Start
4. ClickStart
The AISgen GUI can be used to generate the StarterWare bootloader AIS file. All of the critical
settings are located on the General tab of the AISgen GUI:
The AISgen tool has many options to configure the device at boot time, but these are generally
not necessary since the StarterWare bootloader will boot very quickly and apply its own
configuration immediately. The following screenshot shows the typical settings that should be
specified to generate the bootloader AIS file. Simply click the Generate AIS button to create the
AIS file.
The out2rprc command line utility is used to generate the application binary image. This tool
strips out the initialized sections from the executable file (i.e. *.out) and places them in a
compact format that the StarterWare bootloader can understand. Generating this binary file is
very simple:
$> out2rprc.exe Hello.out Hello.bin
The output (bin) file is typically much smaller than the original executable (out) file.
Once you have generated both binary images (i.e. the AIS and bin files described above), you are
ready to flash these images to the EVM's SPI flash memory. This can be done using the standard
serial flasher utility that's included in the tools folder of the standard StarterWare installation:
1. Set the boot switches for UART2 boot (5:8 = 0011 on EVM)
2. Run SFH from the command line:
o $> sfh_OMAP-L138.exe -spiflash boot.ais Hello.bin
The SFH tool may take several minutes to complete depending on the size of the application.
When SFH completes successfully, your application is ready to boot. But we get stuck at the
following
Our Aim is to execute the binary on our custom Secure OMAP L138. We followed the above procedures
PROCEDURE A ,PROCEDURE B and PROCEDURE C. We were unable to load the secure binaries on the
board .Please let us know if there is anything that we are doing wrong as explained above. Please let us
know what could be wrong with our Hardware connections while loading the Test.bin files or .ais or any
Hardware issues. If possible you can help us remotely also.