LS1021a - Secure Debug and BOOT_HO setting

stefanhauser — Mon, 23 Jun 2025 11:03:28 GMT

Hi all,

I have a LS1021a setup, where I implemented secure boot and it is working fine. The board is booting from QSPI flash.

I have done this by programming OTPMK, using BOOT_HO and SB_EN in the RCW, and writing SRKH with the help of the debugger.

Once this was OK, i started programming the SRKH and setting ITS fuse.

Additionally, JTAG was closed by setting it to conditionally open via challenge/response, without notification.

The secure debug feature works too, I can use the debugger to perform debugging once the SDCR has been read and the SDDR has been written.

So far, everything works as expected.

Now I was trying to hold the CPU again in boot, so setting BOOT_HO in the RCW again, with secure debug enabled.

But now I'm seeing that the CPU is not even fetching the RCW as before (where secure debug was not enabled yet).

The strange thing is that in this scenario reading or writing other registers via DAP/SAP2 does not work.

A CCS console trace of this behavior:

(bin) 687 % ccs::config_chain {ls1020a dap sap2}
LS1020A: Secure debug violation
(bin) 687 % display ccs::read_reg 0 sdcr 1 8
sdcr=0xC0C0C0C0 D0D0D0D0
(bin) 688 % ccs::write_reg 0 sdrr 8 {0xXXXXXXXX 0xXXXXXXXX}
(bin) 689 % ccs::config_chain {ls1020a dap sap2}
(bin) 690 % ccs::config_chain {ls1020a dap sap2}
(bin) 690 % display ccs::get_config_chain
Chain Position 0: LS1020A
Chain Position 1: CoreSight ATB Funnel
Chain Position 2: CoreSight TMC
Chain Position 3: CoreSight TMC
Chain Position 4: CoreSight TMC
Chain Position 5: CoreSight CTI
Chain Position 6: CoreSight CTI
Chain Position 7: CoreSight CTI
Chain Position 8: CoreSight ATB Funnel
Chain Position 9: Cortex-A7
Chain Position 10: Cortex-A7 PMU
Chain Position 11: Cortex-A7
Chain Position 12: Cortex-A7 PMU
Chain Position 13: CoreSight CTI
Chain Position 14: CoreSight CTI
Chain Position 15: Cortex-A7 ETM
Chain Position 16: Cortex-A7 ETM
Chain Position 17: DAP
Chain Position 18: SAP2
(bin) 691 % disp ccs::read_mem 18 0x1e90014 4 0 1
+0 +4 +8 +C
[0x01E90014] 00000000
(bin) 692 % disp ccs::read_reg 0 rcw0 15
rcw0=0x00000000 rcw1=0x00000000 rcw2=0x00000000 rcw3=0x00000000
rcw4=0x00000000 rcw5=0x00000000 rcw6=0x00000000 rcw7=0x00000000
rcw8=0x00000000 rcw9=0x00000000 rcw10=0x00000000 rcw11=0x00000000
rcw12=0x00000000 rcw13=0x00000000 rcw14=0x00000000

Again, the exact same sequence (setting BOOT_HO=1) works without having secure debug in place:

(bin) 696 % ccs::config_chain {ls1020a dap sap2}
(bin) 697 % disp ccs::read_mem 18 0x1e90014 4 0 1
+0 +4 +8 +C
[0x01E90014] 80002900

Is there any additional step I need to perform to be able to read/write registers with secure debug in place?

Re: LS1021a - Secure Debug and BOOT_HO setting

yipingwang — Thu, 03 Jul 2025 03:25:50 GMT

I discussed with the AE team.

If I get customer's idea, when they set BOOT_HO=0, secure debug can't work any more? please help confirm.
when set BOOT_HO=1, both secure boot and secure debug can work well?

Re: LS1021a - Secure Debug and BOOT_HO setting

stefanhauser — Thu, 03 Jul 2025 11:07:17 GMT

The issue is like this:

I enabled secure debug and programmed OTPMK as a first step.

Then I wanted to test the SRKH via JTAG by enabling BOOT_HO and SB_EN in the RCW.

But somehow the CPU does not even load the RCW with secure debug in place (or I'm missing some step after doing the challenge/response via JTAG, which works).

The issue is not really important anymore to me, because I used a 2nd CPU module to test the SRKH via JTAG, where I did not enable secure JTAG.

Thanks anyway,
Stefan

topic LS1021a - Secure Debug and BOOT_HO setting in QorIQ

LS1021a - Secure Debug and BOOT_HO setting

Re: LS1021a - Secure Debug and BOOT_HO setting

Re: LS1021a - Secure Debug and BOOT_HO setting