LayerscapeのトピックRe: RTIC Configuration on LS1046ARDB

RTIC Configuration on LS1046ARDB

Faizanbaig — Wed, 17 Nov 2021 12:14:00 GMT

Hi,

We are trying to configure RTIC(Run time integrity Checker) on LS1046ARDB board. I have attached C code file along with the Memory dump of RTIC Status Register (RSTA-Address:0x01760004)and RTIC Memory Block a c Endian Hash Result Word d (RAMDB_0 - RDMDL_31- Address:0x01760200).

When I run attached C Code the status in the RTIC status register is as shown in image1 and the Hash result stored by RTIC in Hash register is as shown in image2(All Zeros)

My concern is Why are we not able to see hash being stored by RTIC in Hash register? Why are we getting zero values as Stored hash? Are we Missing any additional settings/steps?

Any help would be appreciated.

Thanks

Faizanbaig Inamdar @chitra_amzarewa

Re: RTIC Configuration on LS1046ARDB

yipingwang — Fri, 19 Nov 2021 05:32:25 GMT

From the register dump, it seems you set the run time memory (RCTL)

incorrectly.

Instead of

10010000

you set it to

10100000

i.e. did not enable Run Time Memory Enable(RTME block A).

Below is a register level prototype to enable RTIC to monitor a pre-defined

memory region.

command is executed from uboot. you can match it with your C code.

=> mw.l a0000000 11112222 100 <-# init RAM address

=> md 0x1760000 4 <-display RTIC status

01760000: 00000000 00000400 00000000 00000000 ................

=> mw.l 0x176001c 0xff000000 <- # set RTIC Throttle (RTHR)

=> mw.l 0x176002c 0xffff0000 <- # set RTIC Watchdog Timer (RWDOG)

=> mw.l 0x1760104 000000a0 <- # set RTIC monitor address (RMAA)

=> mw.l 0x176010c 00010000 <- # set RTIC monitor length (RMAL)

=> mw.l 0x1760014 10010000 <- Enable and unlock run time memory (RCTL)

=> mw.l 0x176000c 02000000 <- Hash block A once (RMAL)

=> mw.l 0x176000c 04000000 <- Enable Run Time Check (RMAL)

=> md 0x1760000; md 0x1760000 <- display RTIC Status (RSTA)

01760000: 00000000 01000004 00000000 00000000 ................

01760000: 00000000 01000a04 00000000 00000000 ................

01 = RTIC Busy, 02 = Hash Once Operation Completed. 04=sec violation

00 = no address error for all four blocks

0a = RTD, RTIC is in Run Time mode, All blocks hashed (ABH)

04 = run time state, 02 Single Hash State, 06 = Error State

When the RTIC monitored memory region is modified, the SECMON changes the

state to non-secure and locks out black key access for further cryptographic

operations.

=> md 0x1760000; echo; md 01e90000;

01760000: 00000000 01000004 00000000 00000000 ................

01760010: 00000000 10110000 00000000 ff000000 ................

01e90000: 00000000 00000000 00000000 00000000 ................

01e90010: 00000000 00ad0080 00000000 00000000 ................ <-

Trusted state, OTPMK programmed

=> mw.l a0000000 01234567 <- modify any area monitored

by RTIC block A

=> md 0x1760000; echo; md 01e90000; <- take few cycles for RTIC

to update state!

01760000: 00000000 14000206 00000000 00000000 ................

01760010: 00000000 10100000 00000000 ff000000 ................

01e90000: 00000000 00000000 00000000 00000000 ................

01e90010: 00000000 00a30088 01000000 00000000 ................ <- HPSR:

SSM = Soft fail.OTPMK=0

Recall for the SecMon_HP Status register (HPSR), 0x88 means both OPTMK and

ZMK, and 0x03 means that the security monitor is in a soft fail state.

Re: RTIC Configuration on LS1046ARDB

Faizanbaig — Fri, 19 Nov 2021 11:24:30 GMT

Thanks for the response.

As suggested I tried value 10010000 in RTIC Control Register (RCTL) but couldn't see any hash being stored in Hash Registers(Zero Values). I have attached the memory dump of Status Register(0x01760004) please check and let me know any additional settings/configurations that need to be done.

Thanks.

Re: RTIC Configuration on LS1046ARDB

yipingwang — Tue, 23 Nov 2021 04:55:52 GMT

Here is the log from uboot on a LS1046ARDB. Everything works.

I notice in your c code, you may not have the correct endianess.

i.e.

sec_out32(0x176000c, 0x00000002); //<- Hash block A once (RMAL)

vs uboot command

=> mw.l 0x176000c 02000000

Keep in mind the SEC engine (RTIC) is running in big endian, your c code

running in the ARM A72 is in little endian mode by default. My log below

show the hash is written to

6_0200h RTIC Memory Block A Big Endian Hash Result Word 0 (RAMDB_0)

### console log ###

U-Boot 2019.04-gce862bb2d2 (Oct 17 2019 - 17:01:15 +0800)

SoC: LS1046AE Rev1.0 (0x87070010)

Clock Configuration:

CPU0(A72):1800 MHz CPU1(A72):1800 MHz CPU2(A72):1800 MHz

CPU3(A72):1800 MHz

Bus: 700 MHz DDR: 2100 MT/s FMAN: 800 MHz

Reset Configuration Word (RCW):

00000000: 0e150012 10000000 00000000 00000000

00000010: 11335559 40005012 40025000 c1000000

00000020: 00000000 00000000 00000000 00238800

00000030: 20124000 00003101 00000096 00000001

Model: LS1046A RDB Board

Board: LS1046ARDB, boot from QSPI vBank 0

CPLD: V2.3

PCBA: V2.0

SERDES Reference Clocks:

SD1_CLK1 = 156.25MHZ, SD1_CLK2 = 100.00MHZ

I2C: ready

DRAM: 7.9 GiB (DDR4, 64-bit, CL=15, ECC on)

DDR Chip-Select Interleaving Mode: CS0+CS1

SEC0: RNG instantiated

Using SERDES1 Protocol: 4403 (0x1133)

Using SERDES2 Protocol: 21849 (0x5559)

NAND: 512 MiB

MMC: FSL_SDHC: 0

Loading Environment from SPI Flash... SF: Detected s25fl512s with page size

256 Bytes, erase size 256 KiB, total 64 MiB

EEPROM: NXID v1

In: serial

Out: serial

Err: serial

Net: SF: Detected s25fl512s with page size 256 Bytes, erase size 256 KiB,

total 64 MiB

Fman1: Uploading microcode version 106.4.18

FM1@TGEC1 running firmware version 3.2.3

FM1@TGEC1: system interface XFI

FM1@TGEC1: Aquantia AQR107 Firmware Version 3.2.3

PCIe0: pcie@3400000 Root Complex: no link

PCIe1: pcie@3500000 Root Complex: no link

PCIe2: pcie@3600000 Root Complex: x1 gen1

e1000: 00:1b:21:7a:d0:9c

FM1@DTSEC3, FM1@DTSEC4, FM1@DTSEC5, FM1@DTSEC6, FM1@TGEC1, FM1@TGEC2,

e1000#0 [PRIME]

Hit any key to stop autoboot: 0

=> mw.l a0000000 11112222 100

=> md 0x1760000 4

01760000: 00000000 00000400 00000000 00000000 ................

=> mw.l 0x176001c 0xff000000

=> mw.l 0x176002c 0xffff0000

=> mw.l 0x1760104 000000a0

=> mw.l 0x176010c 00010000

=> mw.l 0x1760014 10010000

=> mw.l 0x176000c 02000000

=> md 0x1760000 80

01760000: 00000000 02000000 00000000 00000000 ................

01760010: 00000000 10010000 00000000 ff000000 ................

01760020: 00000000 00000000 00000000 ffff0000 ................

01760030: 00000000 00000000 00000000 00000000 ................

01760040: 00000000 00000000 00000000 00000000 ................

01760050: 00000000 00000000 00000000 00000000 ................

01760060: 00000000 00000000 00000000 00000000 ................

01760070: 00000000 00000000 00000000 00000000 ................

01760080: 00000000 00000000 00000000 00000000 ................

01760090: 00000000 00000000 00000000 00000000 ................

017600a0: 00000000 00000000 00000000 00000000 ................

017600b0: 00000000 00000000 00000000 00000000 ................

017600c0: 00000000 00000000 00000000 00000000 ................

017600d0: 00000000 00000000 00000000 00000000 ................

017600e0: 00000000 00000000 00000000 00000000 ................

017600f0: 00000000 00000000 00000000 00000000 ................

01760100: 00000000 000000a0 00000000 00010000 ................

01760110: 00000000 00000000 00000000 00000000 ................

01760120: 00000000 00000000 00000000 00000000 ................

01760130: 00000000 00000000 00000000 00000000 ................

01760140: 00000000 00000000 00000000 00000000 ................

01760150: 00000000 00000000 00000000 00000000 ................

01760160: 00000000 00000000 00000000 00000000 ................

01760170: 00000000 00000000 00000000 00000000 ................

01760180: 00000000 00000000 00000000 00000000 ................

01760190: 00000000 00000000 00000000 00000000 ................

017601a0: 00000000 00000000 00000000 00000000 ................

017601b0: 00000000 00000000 00000000 00000000 ................

017601c0: 00000000 00000000 00000000 00000000 ................

017601d0: 00000000 00000000 00000000 00000000 ................

017601e0: 00000000 00000000 00000000 00000000 ................

017601f0: 00000000 00000000 00000000 00000000 ................

=> md 0x1760100