topic Re: IMX8-QXP-C0: tamper in i.MX Processors

IMX8-QXP-C0: tamper

PBR — Thu, 10 Mar 2022 16:10:11 GMT

Hello,

Using a IMX8QXP-C0, I want to use a tamper (SC_P_CSI_D05_SNVS_TAMPER_IN0).

I saw I could use imx_sc_seco_secvio_config() in order to configure SVNS registers from Linux.
Unfortunately (and strangely!!), this function can access to some SNVS registers (as HPSVCR, LPSR, LPTDSR...) but not at all of them.
Especially, I can not read/write LPTDC2R which is used to configure tampers.

So here is my questions:
- Why could not I read/write some SVNS registers (as LPTDC2R) with imx_sc_seco_secvio_config() function?

- Is there any other way to use tampers?

Thank you for your help.

Re: IMX8-QXP-C0: tamper

PBR — Thu, 17 Mar 2022 10:16:42 GMT

Any help ??

Re: IMX8-QXP-C0: tamper

josephzhou1 — Sun, 20 Mar 2022 03:25:07 GMT

u solved it already ?

Re: IMX8-QXP-C0: tamper

PBR — Mon, 21 Mar 2022 08:10:08 GMT

Unfortunately no.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Thu, 24 Mar 2022 06:51:12 GMT

External Tamper Detection is a special mechanism provided through a chip pin to signal when the device encounters unauthorized opening or tampering. This Linux user space application is a tool that allows tampering configuration and real time monitoring of the most important SNVS registers. Here is an Application Note for i.MX7D: https://www.nxp.com/docs/en/application-note/AN12210.pdf

Hope can do help for you

Re: IMX8-QXP-C0: tamper

PBR — Thu, 24 Mar 2022 09:29:50 GMT

Hello,

I already read this document but unfortunately, it is not for iMX8.
For example, it uses the u-boot command "fuse" but this command seems not working on iMX8.
That is why I tried to access Seco registers directly.

For example, in your documentation (and on the IMX8QXPSRM document), it is written "This register (LPTDCR) cannot be programmed when LPTDCR is locked for write."
Please could you tell me what is locking/unlocking this register?
Unlocking LPTDCR will unlock LPTDC2R which could solve my problem.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Fri, 25 Mar 2022 04:35:48 GMT

I will confirm it for you.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Mon, 28 Mar 2022 03:09:04 GMT

The registers can be configured as below:

It is possible to show the status (values) of the fuses related to tamper and security violation, the SNVS, the DGO and the pins using the command snvs_sec_status.

snvs_sec_status

It is possible to configure the SNVS using command line (if the flag ‘CONFIG_SNVS_SEC_SC_AUTO’ is not set) using the Uboot commands:

LPTDC2R register can be set by parameter <lp.tamper_det_cfg2>

snvs_cfg <hp.lock> <hp.secvio_ctl> <lp.lock> <lp.secvio_ctl> <lp.tamper_filt_cfg> <lp.tamper_det_cfg> <lp.tamper_det_cfg2> <lp.tamper_filt1_cfg> <lp.tamper_filt2_cfg> <lp.act_tamper1_cfg> <lp.act_tamper2_cfg> <lp.act_tamper3_cfg> <lp.act_tamper4_cfg> <lp.act_tamper5_cfg> <lp.act_tamper_ctl> <lp.act_tamper_clk_ctl> <lp.act_tamper_routing_ctl1> <lp.act_tamper_routing_ctl2>
snvs_dgo_cfg <tamper_offset_ctl> <tamper_pull_ctl> <tamper_ana_test_ctl> <tamper_sensor_trim_ctl> <tamper_misc_ctl> <tamper_core_volt_mon_ctl>
sn tamper_pin_cfg <pad> <value>

Example (active tamper):

snvs_cfg 1f0703ff 3000007f 1f0003ff 36 00800000 276 0 0 0 84001111 0 0 0 0 00010001 0 1 0
snvs_dgo_cfg 0 0 20000000 0 80000000 0
tamper_pin_cfg 136 1a000060
tamper_pin_cfg 141 1c000060

How did you configure SNVS register in Linux? Can you provide the steps and configuration? Thanks.

@PBR

Re: IMX8-QXP-C0: tamper

PBR — Mon, 28 Mar 2022 14:55:42 GMT

Thank you for your answer.

My need is to use tamper 5 (D05_SNVS_TAMPER_IN0) as static.
I am using call_secvio_config() function on linux but I don't mind to work directly on u-boot.

As my snvs_cfg command uses 19 parameters (adding hp.secvio_intcfg parameter), I launch the command:
snvs_cfg 1f0703ff 8000003f 3000007f 1f0003ff 36 00800000 276 0 0 0 84001111 0 0 0 0 00010001 0 1 0

I don't see any difference but after a reset (switch off/switch on the board), the init values have changed:
HPSICR (0C) used to be 8000003f and is now 00000000
LPATCTLR (E0) used to be 001f001f and is now 00000000
Q1: Do you know why init values have changed after this command?
Q2: In this command, why do you put LPTDC2R (A0)=0? Shouldn't it be FF?
Q3: In this command, why do you put "Write access is not allowed" (HPLR + LPLR)?
Q4: If I understand, in order to write on the LPTDC2R register (A0), I have to access LPTDCR (48) with size = 2. Is it correct?
Q5: Which register gives the information tamper 5 has changed? Because changing tamper5 input does change any register.

Here are the results:
=> snvs_sec_status
Pins:
- Pin 141: 18000060
- Pin 142: 00000040
- Pin 143: 00000040
- Pin 144: 00000040
- Pin 145: 00000040
- Pin 136: 00000040
- Pin 137: 00000040
- Pin 138: 00000040
- Pin 139: 00000040
- Pin 140: 00000040
Fuses:
- Fuse 14: 0000421f
- Fuse 30: f470f7c2
- Fuse 31: 0163c003
- Fuse 260: 00000000
- Fuse 261: 00000000
- Fuse 262: 00000000
- Fuse 263: 00000000
- Fuse 768: 00000000
SNVS:
- SNVS 00(1): 00000000
- SNVS 34(1): 00000000
- SNVS 0c(1): 00000000
- SNVS 10(1): 00000000
- SNVS 18(1): 00000000
- SNVS 40(1): 00000008
- SNVS 48(2): 00000000 00000000
- SNVS 4c(1): 80000000
- SNVS a4(1): 00000000
- SNVS 44(3): 00000000 00000000 00000000
- SNVS e0(1): 00000000
- SNVS e4(1): 00000000
- SNVS e8(2): 00000000 00000000
- SNVS 3c(1): 00000000
- SNVS 5c(2): 00000000 00000000
- SNVS 64(1): 41736166
- SNVS f8(2): 003e0103 06000400
DGO:
- DGO 00: 00000000
- DGO 10: 00000000
- DGO 20: 00000000
- DGO 30: 00000000
- DGO 40: 00000000
- DGO 50: 00000000
=> snvs_cfg 1f0703ff 8000003f 3000007f 1f0003ff 36 00800000 276 0 0 0 84001111 0 0 0 0 00010001 0 1 0
=> snvs_sec_status
Pins:
- Pin 141: 18000060
- Pin 142: 00000040
- Pin 143: 00000040
- Pin 144: 00000040
- Pin 145: 00000040
- Pin 136: 00000040
- Pin 137: 00000040
- Pin 138: 00000040
- Pin 139: 00000040
- Pin 140: 00000040
Fuses:
- Fuse 14: 0000421f
- Fuse 30: f470f7c2
- Fuse 31: 0163c003
- Fuse 260: 00000000
- Fuse 261: 00000000
- Fuse 262: 00000000
- Fuse 263: 00000000
- Fuse 768: 00000000
SNVS:
- SNVS 00(1): 1f0703ff
- SNVS 34(1): 1f0003ff
- SNVS 0c(1): 8000003f
- SNVS 10(1): 0000007f
- SNVS 18(1): 80000000
- SNVS 40(1): 0000003e
- SNVS 48(2): 00000276 00000000
- SNVS 4c(1): 80000200
- SNVS a4(1): 00000000
- SNVS 44(3): 00800000 00000000 00000000
- SNVS e0(1): 00010001
- SNVS e4(1): 00000000
- SNVS e8(2): 00000001 00000000
- SNVS 3c(1): 00000000
- SNVS 5c(2): 00000000 00000000
- SNVS 64(1): 41736166
- SNVS f8(2): 003e0103 06000400
DGO:
- DGO 00: 00000000
- DGO 10: 00000000
- DGO 20: 00000000
- DGO 30: 00000000
- DGO 40: 00000000
- DGO 50: 00000000

Thank you for your help.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Tue, 29 Mar 2022 05:18:18 GMT

Can you provide the steps and configuration? We can try if we can reproduce on our side.

Re: IMX8-QXP-C0: tamper

PBR — Tue, 29 Mar 2022 08:32:32 GMT

Here is my u-boot/linux DTS configuration:
fsl,pins = <
IMX8QXP_CSI_D05 3 0x00000060
>;
(as IMX8QXP_CSI_D05_SNVS_TAMPER_IN0 is not defined in pads-imx8qxp.h, I have to define "IMX8QXP_CSI_D05 3")

1) u-boot steps
If I do the configuration with u-boot, I tried 3 different commands in 3 different tests:
snvs_cfg 1f0703ff 8000003f 3000007f 1f0003ff 36 00800000 276 0 0 0 84001111 0 0 0 0 00010001 0 1 0
snvs_cfg 1f0703ff 8000003f 3000007f 1f0003ff 36 00800000 276 ff 0 0 84001111 0 0 0 0 001f001f 0 1 0
snvs_cfg 00000000 8000003f 3000007f 00000000 3f 00000000 776 ff 0 0 84001111 0 0 0 0 001f001f 0 1 0

But when I modify the tamper (with just removing a jumper on the board), it does not modify any SNVS registers (I used snvs_sec_status, you can see the result of this command in my last post)

So which snvs_cfg parameters do I need to use?
How to see any modification when I put/remove the tamper jumper?

2) linux steps
Now I tried on linux.
I am using imx-secvio-sc.c file.

I add at the beginning of the imx_secvio_sc_ioctl() function:
u32 val0=0;
u32 val1=0;
ret = call_secvio_config(dev, 0x18, SECVIO_CONFIG_WRITE, &val0, NULL, NULL, NULL, NULL, 1);
if (ret) {
printk("1-Error Reg 18: %d\n", ret);
}
ret = call_secvio_config(dev, 0x48, SECVIO_CONFIG_WRITE, &val0, &val1, NULL, NULL, NULL, 2);
if (ret) {
printk("2-Error Reg 48+A0: %d\n", ret);
}
ret = call_secvio_config(dev, 0x48, SECVIO_CONFIG_WRITE, &val0, NULL, NULL, NULL, NULL, 1);
if (ret) {
printk("3-Error Reg 48: %d\n", ret);
}
ret = call_secvio_config(dev, 0xA0, SECVIO_CONFIG_WRITE, &val0, NULL, NULL, NULL, NULL, 1);
if (ret) {
printk("4-Error Reg A0: %d\n", ret);
}
ret = call_secvio_config(dev, 0x18, SECVIO_CONFIG_WRITE, &val0, NULL, NULL, NULL, NULL, 1);
if (ret) {
printk("5-Error Reg 18: %d\n", ret);
}
return 0;// So I ignore the code after this

I launch this command on my target:
./ioctl /dev/secvio-sc 1

And here is the result:
[ 27.953802] 2-Error Reg 48+A0: -32
[ 27.957344] 3-Error Reg 48: -22
[ 27.965539] 4-Error Reg A0: -22

So I can modify Reg 18 but not 48, A0.
How can I modify Reg A0?
If I succeed, which C function which can tell me the tamper has detected something?

Just note I had to modfy imx-secvio-sc.c file as I had another issue: when opening /dev/secvio-sc, node->i_private was null and not equal to 'dev' structure.
So I did some patch.
I created :
struct device *mydev=0;
In call_secvio_config(), I add this instruction:
if (mydev==0) mydev=dev;
In imx_secvio_sc_open(), I replace this instruction:
filp->private_data = mydev;//node->i_private;

Re: IMX8-QXP-C0: tamper

Rita_Wang — Fri, 01 Apr 2022 07:19:04 GMT

@PBR

(1) uboot steps

The previous setting is just an example of active tamper, the registers should be configured as needed.

For example, if you want to use TAMPER_IN0 to check that a tamper connected to ground trigger when the line is opened. The process is like following:

We connect ET1 (tamper 0) to ground, we configure the DGO to PULL UP the line. When the line is cut, we will detect the transition GND to VCC. So, we must configure the detector to detect HIGH voltage.

HW setup: Connect the tamper to ground.

SW Configuration:

[IF LINE MUXED] Configure the IOMUX for the tamper pin: Set the IOMUX register for the pin 141 to 0xdc000060 (Open Drain input + no Pull)
[IF DGO] Configure the pull in DGO: Set the DGO register “TAMPER_PULL_CTRL” to 0x00000401 (Pull enable + Pull up).
[IF DGO] Enable the tamper pins in DGO: Set the DGO register “SNVS_TEST” to 0x20000000 (tamper enable bit).
Enable the SNVS detector: Set the SNVS register “LPTDCR” to 0x00000a00 (ET1EN + ET1P to detect HIGH voltage).
Enable the Glitch filtering: Set the SNVS register “LPTGFCR” to 0x00800000

Configuration in uboot:

=> tamper_pin_cfg 141 0xdc000060

=> snvs_dgo_cfg 0 401 20000000 0 0 0

=> snvs_cfg 0 0 0 0 0 800000 a00 0 0 0 0 0 0 0 0 0 0 0 0

=> snvs_sec_status <- in default state: tamper 0 connected to ground

Pins:

- Pin 141: 1c000060

- Pin 142: 00000040

- Pin 143: 00000040

- Pin 144: 00000040

- Pin 145: 00000040

- Pin 136: 00000040

- Pin 137: 00000040

- Pin 138: 00000040

- Pin 139: 00000040

- Pin 140: 00000040

Fuses:

- Fuse 14: 0000425f

- Fuse 30: 00000002

- Fuse 31: 1c00001d

- Fuse 260: 00000000

- Fuse 261: 00000000

- Fuse 262: 00000000

- Fuse 263: 00000000

- Fuse 768: 00000000

SNVS:

- SNVS 00(1): 000001c0

- SNVS 34(1): 00000000

- SNVS 0c(1): 00000000

- SNVS 10(1): 00000000

- SNVS 18(1): 00000000

- SNVS 40(1): 00000008

- SNVS 48(2): 00000a00 00000000

- SNVS 4c(1): 80000000 <-The bit “ET1D” in SNVS “LPSR” shall not be set (0x00000200).

- SNVS a4(1): 00000000

- SNVS 44(3): 00800000 00000000 00000000

- SNVS e0(1): 00000000

- SNVS e4(1): 00000000

- SNVS e8(2): 00000000 00000000

- SNVS 3c(1): 00000000

- SNVS 5c(2): 00000000 00000000

- SNVS 64(1): 41736166

- SNVS f8(2): 003e0103 06000400

DGO:

- DGO 00: 00000000

- DGO 10: 00000401

- DGO 20: 20000000

- DGO 30: 00000000

- DGO 40: 00000000

- DGO 50: 00000000

=> snvs_sec_status <- Open the line to trigger tamper

Pins:

- Pin 141: 1c000060

- Pin 142: 00000040

- Pin 143: 00000040

- Pin 144: 00000040

- Pin 145: 00000040

- Pin 136: 00000040

- Pin 137: 00000040

- Pin 138: 00000040

- Pin 139: 00000040

- Pin 140: 00000040

Fuses:

- Fuse 14: 0000425f

- Fuse 30: 00000002

- Fuse 31: 1c00001d

- Fuse 260: 00000000

- Fuse 261: 00000000

- Fuse 262: 00000000

- Fuse 263: 00000000

- Fuse 768: 00000000

SNVS:

- SNVS 00(1): 000001c0

- SNVS 34(1): 00000000

- SNVS 0c(1): 00000000

- SNVS 10(1): 00000000

- SNVS 18(1): 80000000

- SNVS 40(1): 00000008

- SNVS 48(2): 00000a00 00000000

- SNVS 4c(1): 80000200 <-The tamper was trigger and the bit “ET1D” in SNVS “LPSR” was set (0x00000200).

- SNVS a4(1): 00000000

- SNVS 44(3): 00800000 00000000 00000000

- SNVS e0(1): 00000000

- SNVS e4(1): 00000000

- SNVS e8(2): 00000000 00000000

- SNVS 3c(1): 00000000

- SNVS 5c(2): 00000000 00000000

- SNVS 64(1): 41736166

- SNVS f8(2): 003e0103 06000400

DGO:

- DGO 00: 00000000

- DGO 10: 00000401

- DGO 20: 20000000

- DGO 30: 00000000

- DGO 40: 00000000

- DGO 50: 00000000

(2) Linux steps

Have you ever configured LPTDCR(0x48) before in uboot? Because this register can only be written once. The register write access is marked as locked by SECO after the first write through the manage SNVS interface. If you try to write it again in Linux, there should be some error.

Re: IMX8-QXP-C0: tamper

PBR — Fri, 01 Apr 2022 15:54:48 GMT

Thank you, it is working.
Where could I have some information on DGO registers? Could you provide me a document?

My need is to automatically clear SNVS when the tamper is cut.
Is it possible to read/write SNVS from u-boot commands?
How do I configure tamper registers in order to clear SNVS when there is a violation?

Thank you for your help.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Sat, 02 Apr 2022 06:03:35 GMT

Good news it works. Other question I will help confirm.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Thu, 07 Apr 2022 10:36:58 GMT

@PBR

We don't have DGO document for customer. But If they have questions about how to configure, we can help on it.

"Is it possible to read/write SNVS from u-boot commands?"

What SNVS do you mean? If you mean SNVS configuration registers, we can just use snvs_sec_status command in uboot to read and use snvs_cfg to write.

Re: IMX8-QXP-C0: tamper

PBR — Fri, 08 Apr 2022 14:46:49 GMT

Hello,

No, I don't mean SNVS registers.
SNVS is a memory and I would like to know if it is possible to write or read on this memory with u-boot commands.
If not, what is the easiest way to do that?

Thank you for your help.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Tue, 12 Apr 2022 06:36:25 GMT

@PBR

The LP ZMK register seems cannot be read. As we tested, GPR2/3 can be written and read successfully by using L4.14.98 BSP. But in the latest lf-5.15.5-1.0.0 version, it cannot be written. I raised a jira ticket about it and to confirm whether SNVS will be cleared: [AHAB-734] Check LPCR register configuration on i.MX8QXP - NXP JIRA

Waiting for internal team's reply.

When we get update I will share to you as soon as possible.

Re: IMX8-QXP-C0: tamper

PBR — Mon, 25 Apr 2022 12:15:03 GMT

Hello,

Do you have any news?

Thank you for your help.

Re: IMX8-QXP-C0: tamper

Rita_Wang — Tue, 26 Apr 2022 02:42:31 GMT

By now no update, due to the COID-19 we have to stay at home, so some test maybe hard to do on our board. I am still wait for the update from our design team, when I have update from them I will tell you as soon as possible.

Re: IMX8-QXP-C0: tamper

PBR — Tue, 26 Apr 2022 10:08:22 GMT

Thank you for your help.

I have 2 other tickets still opened on IMX8 (https://community.nxp.com/t5/i-MX-Processors/IMX8-QXP-SXF1800-v2xse-example-app-issue/m-p/1444586/highlight/false#M189379 and https://community.nxp.com/t5/i-MX-Processors/IMX8-QXP-possibility-to-use-cm40-lpuart-by-A35/m-p/1442130/highlight/false#M189157). Is it possible for you to look at it? Thank you.