RTIC Configuration on LS1046ARDB

[Faizanbaig]

Hi,

We are trying to configure RTIC(Run time integrity Checker) on LS1046ARDB board. I have attached  C code file along with the Memory dump of RTIC Status Register (RSTA-Address:0x01760004)and RTIC Memory Block a c Endian Hash Result Word d (RAMDB_0 - RDMDL_31- Address:0x01760200).

When I run attached C Code the status in the RTIC status register is as shown in image1 and the Hash result stored by RTIC in Hash register is as shown in image2(All Zeros)

My concern is Why are we not able to see hash being stored by RTIC in Hash register? Why are we getting zero values as Stored hash?  Are we Missing any additional settings/steps?

Any help would be appreciated.

Thanks

Faizanbaig Inamdar @chitra_amzarewa 

[yipingwang]

From the register dump, it seems you set the run time memory (RCTL)

incorrectly.

Instead of

10010000

you set it to

10100000

i.e. did not enable Run Time Memory Enable(RTME block A).

Below is a register level prototype to enable RTIC to monitor a pre-defined

memory region.

command is executed  from uboot. you can match it with your C code.

=> mw.l a0000000 11112222 100  <-# init RAM address

=> md 0x1760000 4        <-display RTIC status

01760000: 00000000 00000400 00000000 00000000    ................

=> mw.l 0x176001c 0xff000000     <- # set RTIC Throttle (RTHR)

=> mw.l 0x176002c 0xffff0000       <- # set RTIC Watchdog Timer (RWDOG)

=> mw.l 0x1760104 000000a0       <- # set RTIC monitor address (RMAA)

=> mw.l 0x176010c 00010000        <- # set RTIC monitor length (RMAL)

=> mw.l 0x1760014 10010000       <- Enable and unlock run time memory (RCTL)

=> mw.l 0x176000c 02000000        <- Hash block A once (RMAL)

=> mw.l 0x176000c 04000000        <- Enable Run Time Check (RMAL)

=> md 0x1760000; md 0x1760000 <- display RTIC Status (RSTA)

01760000: 00000000 01000004 00000000 00000000    ................

01760000: 00000000 01000a04 00000000 00000000    ................

01 = RTIC Busy, 02 = Hash Once Operation Completed. 04=sec violation

00 = no address error for all four blocks

0a = RTD, RTIC is in Run Time mode, All blocks hashed (ABH)

04 = run time state, 02 Single Hash State, 06 = Error State

When the RTIC monitored memory region is modified, the SECMON changes the

state to non-secure and locks out black key access for further cryptographic

operations.

=> md 0x1760000; echo; md 01e90000;

01760000: 00000000 01000004 00000000 00000000    ................

01760010: 00000000 10110000 00000000 ff000000    ................

01e90000: 00000000 00000000 00000000 00000000    ................

01e90010: 00000000 00ad0080 00000000 00000000    ................  <-

Trusted state, OTPMK programmed

=> mw.l a0000000 01234567                  <- modify any area monitored

by RTIC block A

=> md 0x1760000; echo; md 01e90000;                <- take few cycles for RTIC

to update state!

01760000: 00000000 14000206 00000000 00000000    ................

01760010: 00000000 10100000 00000000 ff000000    ................

01e90000: 00000000 00000000 00000000 00000000    ................

01e90010: 00000000 00a30088 01000000 00000000    ................ <- HPSR:

SSM = Soft fail.OTPMK=0

Recall for the SecMon_HP Status register (HPSR), 0x88 means both OPTMK and

ZMK, and 0x03 means that the security monitor is in a soft fail state.

[Faizanbaig]

Thanks for the response.

As suggested I tried value 10010000 in RTIC Control Register (RCTL) but couldn't see any hash being stored in Hash Registers(Zero Values). I have attached the memory dump of Status Register(0x01760004) please check and let me know any additional settings/configurations that need to be done.

Thanks.

[yipingwang · Accepted solution]

Here is the log from uboot on a LS1046ARDB. Everything works.

I notice in your c code, you may not have the correct endianess.

i.e.

          sec_out32(0x176000c, 0x00000002);  //<- Hash block A once (RMAL)

vs uboot command

          => mw.l 0x176000c 02000000

Keep in mind the SEC engine (RTIC) is running in big endian, your c code

running in the ARM A72 is in little endian mode by default. My log below

show the hash is written to

6_0200h RTIC Memory Block A Big Endian Hash Result Word 0 (RAMDB_0)

### console log ###

U-Boot 2019.04-gce862bb2d2 (Oct 17 2019 - 17:01:15 +0800)

SoC:  LS1046AE Rev1.0 (0x87070010)

Clock Configuration:

       CPU0(A72):1800 MHz  CPU1(A72):1800 MHz  CPU2(A72):1800 MHz 

       CPU3(A72):1800 MHz 

       Bus:      700  MHz  DDR:      2100 MT/s  FMAN:     800  MHz

Reset Configuration Word (RCW):

       00000000: 0e150012 10000000 00000000 00000000

       00000010: 11335559 40005012 40025000 c1000000

       00000020: 00000000 00000000 00000000 00238800

       00000030: 20124000 00003101 00000096 00000001

Model: LS1046A RDB Board

Board: LS1046ARDB, boot from QSPI vBank 0

CPLD:  V2.3

PCBA:  V2.0

SERDES Reference Clocks:

SD1_CLK1 = 156.25MHZ, SD1_CLK2 = 100.00MHZ

I2C:   ready

DRAM:  7.9 GiB (DDR4, 64-bit, CL=15, ECC on)

       DDR Chip-Select Interleaving Mode: CS0+CS1

SEC0: RNG instantiated

Using SERDES1 Protocol: 4403 (0x1133)

Using SERDES2 Protocol: 21849 (0x5559)

NAND:  512 MiB

MMC:   FSL_SDHC: 0

Loading Environment from SPI Flash... SF: Detected s25fl512s with page size

256 Bytes, erase size 256 KiB, total 64 MiB

OK

EEPROM: NXID v1

In:    serial

Out:   serial

Err:   serial

Net:   SF: Detected s25fl512s with page size 256 Bytes, erase size 256 KiB,

total 64 MiB

Fman1: Uploading microcode version 106.4.18

FM1@TGEC1 running firmware version 3.2.3

FM1@TGEC1: system interface XFI

FM1@TGEC1: Aquantia AQR107 Firmware Version 3.2.3

PCIe0: pcie@3400000 Root Complex: no link

PCIe1: pcie@3500000 Root Complex: no link

PCIe2: pcie@3600000 Root Complex: x1 gen1

e1000: 00:1b:21:7a:d0:9c

       FM1@DTSEC3, FM1@DTSEC4, FM1@DTSEC5, FM1@DTSEC6, FM1@TGEC1, FM1@TGEC2,

e1000#0 [PRIME]

Hit any key to stop autoboot:  0

=>  mw.l a0000000 11112222 100

=> md 0x1760000 4   

01760000: 00000000 00000400 00000000 00000000    ................

=> mw.l 0x176001c 0xff000000 

=> mw.l 0x176002c 0xffff0000

=> mw.l 0x1760104 000000a0

=> mw.l 0x176010c 00010000

=> mw.l 0x1760014 10010000

=> mw.l 0x176000c 02000000

=> md 0x1760000 80

01760000: 00000000 02000000 00000000 00000000    ................

01760010: 00000000 10010000 00000000 ff000000    ................

01760020: 00000000 00000000 00000000 ffff0000    ................

01760030: 00000000 00000000 00000000 00000000    ................

01760040: 00000000 00000000 00000000 00000000    ................

01760050: 00000000 00000000 00000000 00000000    ................

01760060: 00000000 00000000 00000000 00000000    ................

01760070: 00000000 00000000 00000000 00000000    ................

01760080: 00000000 00000000 00000000 00000000    ................

01760090: 00000000 00000000 00000000 00000000    ................

017600a0: 00000000 00000000 00000000 00000000    ................

017600b0: 00000000 00000000 00000000 00000000    ................

017600c0: 00000000 00000000 00000000 00000000    ................

017600d0: 00000000 00000000 00000000 00000000    ................

017600e0: 00000000 00000000 00000000 00000000    ................

017600f0: 00000000 00000000 00000000 00000000    ................

01760100: 00000000 000000a0 00000000 00010000    ................

01760110: 00000000 00000000 00000000 00000000    ................

01760120: 00000000 00000000 00000000 00000000    ................

01760130: 00000000 00000000 00000000 00000000    ................

01760140: 00000000 00000000 00000000 00000000    ................

01760150: 00000000 00000000 00000000 00000000    ................

01760160: 00000000 00000000 00000000 00000000    ................

01760170: 00000000 00000000 00000000 00000000    ................

01760180: 00000000 00000000 00000000 00000000    ................

01760190: 00000000 00000000 00000000 00000000    ................

017601a0: 00000000 00000000 00000000 00000000    ................

017601b0: 00000000 00000000 00000000 00000000    ................

017601c0: 00000000 00000000 00000000 00000000    ................

017601d0: 00000000 00000000 00000000 00000000    ................

017601e0: 00000000 00000000 00000000 00000000    ................

017601f0: 00000000 00000000 00000000 00000000    ................

=> md 0x1760100  

01760100: 00000000 000000a0 00000000 00010000    ................

01760110: 00000000 00000000 00000000 00000000    ................

01760120: 00000000 00000000 00000000 00000000    ................

01760130: 00000000 00000000 00000000 00000000    ................

01760140: 00000000 00000000 00000000 00000000    ................

01760150: 00000000 00000000 00000000 00000000    ................

01760160: 00000000 00000000 00000000 00000000    ................

01760170: 00000000 00000000 00000000 00000000    ................

01760180: 00000000 00000000 00000000 00000000    ................

01760190: 00000000 00000000 00000000 00000000    ................

017601a0: 00000000 00000000 00000000 00000000    ................

017601b0: 00000000 00000000 00000000 00000000    ................

017601c0: 00000000 00000000 00000000 00000000    ................

017601d0: 00000000 00000000 00000000 00000000    ................

017601e0: 00000000 00000000 00000000 00000000    ................

017601f0: 00000000 00000000 00000000 00000000    ................

01760200: 974720ea ab0cee31 3e658977 97a2e30f    . G.1...w.e>....

01760210: 346b9ac7 abaf1aa4 c8ac5987 d302e946    ..k4.....Y..F...

01760220: 00000000 00000000 00000000 00000000    ................

01760230: 00000000 00000000 00000000 00000000    ................

01760240: 00000000 00000000 00000000 00000000    ................

01760250: 00000000 00000000 00000000 00000000    ................

01760260: 00000000 00000000 00000000 00000000    ................

01760270: 00000000 00000000 00000000 00000000    ................

01760280: ea204797 31ee0cab 7789653e 0fe3a297    .G ....1>e.w....

01760290: c79a6b34 a41aafab 8759acc8 46e902d3    4k........Y....F

017602a0: 00000000 00000000 00000000 00000000    ................

017602b0: 00000000 00000000 00000000 00000000    ................

017602c0: 00000000 00000000 00000000 00000000    ................

017602d0: 00000000 00000000 00000000 00000000    ................

017602e0: 00000000 00000000 00000000 00000000    ................

017602f0: 00000000 00000000 00000000 00000000    ................

=>

[Faizanbaig]

Thanks for the suggestion . I had to add few micro second delay just after setting Hash Block A once and then enable Runtime Check.