Secure Debug on ls1028a

[tomzy_0]

Hi,

I want to test Secure Debug on a ls1028a based custom board. For now, I performed following steps:

1. Fuse registers using fuse_fip and the following input_fuse_file

/*

* Copyright 2018 NXP

*/

---------------------------------------------------

PLATFORM=LS1028

---------------------------------------------------

POVDD_GPIO=

---------------------------------------------------

OTPMK_FLAGS=0010

OTPMK_0=11111111

OTPMK_1=22222222

OTPMK_2=33333333

OTPMK_3=44444444

OTPMK_4=aab702d7

OTPMK_5=f9506757

OTPMK_6=cfb3b401

OTPMK_7=b5462445

---------------------------------------------------

SRKH_0=9f05646d

SRKH_1=eb7e034b

SRKH_2=a5c8da66

SRKH_3=0215ce65

SRKH_4=34bec8dd

SRKH_5=500d48bb

SRKH_6=665582c0

SRKH_7=8b826a4f

---------------------------------------------------

OEM_UID_0=11223344

OEM_UID_1=55667788

OEM_UID_2=99001122

OEM_UID_3=33445566

OEM_UID_4=77889900

---------------------------------------------------

DCV_0=68686868

DCV_1=67676767

DRV_0=6168745f

DRV_1=5f726e6e

---------------------------------------------------

DBG_LVL=001

---------------------------------------------------

WP=

ITS=

NSEC=

ZD=

K0=

K1=

K2=

K3=

K4=

K5=

K6=

FR0=

FR1=

---------------------------------------------------

OUTPUT_FUSE_FILENAME=fuse_scr.bin

---------------------------------------------------

DRV created with gen_drv_drbg

λ ./gen_drv_drbg A2 6168745f5f726e6e

#----------------------------------------------------#
#------- -------- -------- -------#
#------- CST (Code Signing Tool) Version 2.0 -------#
#------- -------- -------- -------#
#----------------------------------------------------#

DRV[63:0] after Hamming Code is:
6168745f5f726e6e
NAME | BITS | VALUE
_________|______________|____________
DRV 0 | 63 - 32 | 6168745f
DRV 1 | 31 - 0 | 5f726e6e

I am able to confirm that those were correctly fused, by booting, and checking from U-Boot shell

no hamming code error

md 0x1e80024 1
01e80024: 00000000 ....

dblev set to 1, dcvr also fused

=> md 0x1e80204 3
01e80204: 00000001 68686868 67676767 ....hhhhgggg

drvr set to 1

=> md 0x1e80210 2
01e80210: ffffffff ffffffff ........

Yet I am not able to connect. When I try with code warrior (Version: 11.5.12; Build Id: 221209), in target connection configuration I set `Secure debug key:` and provide the key there  `0x6e6e725f5f746861` (reversed endianness) and try to inspect i got an error with info
[CCS: subcore error during multicore operation]

I was trying to follow Secure_boot.pptx presentation (link: https://community.nxp.com/t5/Layerscape-Knowledge-Base/Secure-boot-Fuse-Provisioning-Secure-debug/ta...) and test it from CCS but got the following

(bin) 54 % delete all
(bin) 55 % config cc cwtap:192.168.0.32
(bin) 56 % show cc
0: CodeWarrior TAP (cwtap:192.168.0.32) CC software ver. {0.0}
(bin) 57 %
(bin) 57 % ccs::config_chain {ls1028a dap}
SAP2: Secure debug violation
(bin) 58 % display ccs::get_config_chain
Chain Position 0: LS1028A
Chain Position 1: DAP
Chain Position 2: SAP2
(bin) 59 %
(bin) 59 % ccs::config_chain {ls1028a dap sap2}
LS1028A: std::bad_alloc
(bin) 60 % ccs::config_chain {ls1028a dap}
SAP2: Secure debug violation
(bin) 61 % display ccs::get_config_chain
Chain Position 0: LS1028A
Chain Position 1: DAP
Chain Position 2: SAP2
(bin) 62 % display ccs::read_reg 0 sdcr 1 8
SAP2 error - read SAP_STATUS

what is SAP2 error? I am unable to find any kind of information about it.

Is there something I am doing wrongly?

[tomzy_0]

Is there something more I can try? Or maybe challenge/response procedure cannot be executed on ls1028a? Right now it behave like I had closed the jtag, but IIUC configuration used in input_fuse_file should set it to conditionally closed without notification. Also register read from U-Boot shell tell me the same information.

[LFGP]

dear @tomzy_0 ,

Please be sure that your device partnumber nomenclature has a letter E on it.

On the other hand, please be sure regarding the "debug level" register has not been closet, see below

--------------------------------------------------
# Specify Debug Level in binary form. [Optional]
# 000 -> Wide open: Debug portals are enabled unconditionally.
# 001 -> Conditionally open via challenge response, without notification.
# 01x -> Conditionally open via challenge response, with notification.
# 1xx -> Closed. All debug portals are disabled.
DBG_LVL=
---------------------------------------------------

best regards

LFGP

[tomzy_0]

@LFGP 

IIUC SoC with E in part number means that security is on? I will confirm that tomorrow, but I am nearly sure that it has to have E since I am able to run Secure Boot procedure on it.

As for debug level.. I mentioned in my original post that right now I have lvl 001 which is
# 001 -> Conditionally open via challenge response, without notification.

Below output from U-Boot shell.

=> md 0x1e80204 3
01e80204: 00000001 68686868 67676767 ....hhhhgggg

So 0x1e80204 is 00000001 -> DB_LVL set to 001.

@LFGP  What else can be wrong here? How I can debug this further?

[tomzy_0]

@LFGP I am using https://www.nxp.com/part/LS1027AXE7NQA so it has a letter E on it.

[LFGP]

dear @tomzy_0 ,

What is SAP2 meaning? ans. it is the Secure Access Port.

If the device is set to open the JTAG port, the SAP2 stays locked until you authenticate by the challenge/response event.

Any attempt to enumerate or access it before you passed the challenge/response event, it will yield a “Secure debug violation”, that’s why your are seeing the CCS logs message "Secure debug violation” and “SAP2 error – read SAP_STATUS”.

please review the next case, it is related your case.

https://community.nxp.com/t5/CodeWarrior-for-QorIQ/JTAG-debug-challenge-response-in-CodeWarrior-conn...

BR

LFGP

[tomzy_0]

@LFGP thanks for quick reply. Unfortunately I already followed the steps provided in thread that you mentioned - the same were in the presentation I linked in my post. I also posted results of running such commands. I am even unable to read DCV as CCS in return print error log.

@yipingwang hello. Sorry for direct mention but I saw you was the one who replied in the thread. If I am not mistaken, you was also responsible for making the Secure Boot presentation.

Would you be able to help? Difference between presentation and my case is that I am using ls1028a.

The chain needs to be configured differently ({ls1028a dap/sap2} vs {ls1043a dap sap2}). But it is hard to tell if this is a real issue here. I guess there is no such thing as CCS documentation - without this it is hard to even debug further.

I will go back to one of my questions. Does Secure Debug needs additional conditions under which it can work? ITS set? Maybe SB_EN will be enough? Maybe other bit of RCW should be set?

[tomzy_0]

Are there any additional conditions under which the Secure Debug can work? Do I need to boot with Secure Boot? Be in any kind of SECMON state?

[LFGP]

dear @tomzy_0,

you need to set the SB_EN = 1 and
IT_S =0
download the SEC reference manual
https://www.nxp.com/webapp/sps/download/preDownload.jsp?render=true

you could try the next approach (adjust it for LS1028a) :
Check the SecMon_HP Status Register (location 0x1e90014), Bits OTPMK_ZERO, OTMPK_SYNDROME and PE should be 0 otherwise there is some error in the OTPMK fuse blown by you.
b. If OTMPK fuse is correct (see Step 1), check the SCRATCHRW2(0x1ee0204) register for errors.
c. If Error code of step b is 0 then check the System Security Monitor State filed of HPSR.
System Security Monitor State (0x9)
If ITS fuse = 1, then it means ISBC code has reset the board. This may be due to the following reasons:
Hash of the public key used to sign the ESBC u-boot doesn't match with the value in SRK Hash Fuse
Or
Signature verification of the image failed.
SSM_STATE (0xd) or Non Secure State (0xb)
Check the entry point field in the ESBC header.

If entry point is correct, ensure that u-boot image has been compiled with the required secure boot configuration.

BR
LFGP

[tomzy_0]

@LFGP 

Hi, sorry for late reply. Below are outputs from the U-Boot shell.

```
=> md 0x1e90014 1
01e90014: 80002900 .)..
```

So, SecMon State set to Check. OTPMK_ZERO is 0. I do not know what is the OTPMK_SYNDROM or PE.

```
=> md 0x1ee0204 1
01ee0204: 00000000 ....
```

SCRATCHRW2 set to 0 so no errors. BTW, Hamming code is also zero - so everything should be ok.

```
=> md 0x1e80024
01e80024: 00000000 ....
```

Should the Secure Monitor be in different state?

[tomzy_0]

I also checked the connection from CodeWarrior GUI with CCS logs set to DEBUG - this is what I found

ccs_get_config_chain
serverh = 0
device_list: (size = 3)
ccs_get_config_chain; ccs_error = 0
ccs_get_config_chain
serverh = 0
device_list: (size = 3)
device[0]:: core_type=LS1028A(301)
device[1]:: core_type=DAP(232)
device[2]:: core_type=SAP2(272)
ccs_get_config_chain; ccs_error = 0
ccs_read_register
coreh = [serverh:0;cc_index:0;chain_pos:0]
index = 8192
count = 1
size = 8
value: (size =
00000000 00000000
ccs_read_register; ccs_error = 56
Error message: SAP2 error - read SAP_STATUS
ccs_get_config_chain
serverh = 0
device_list: (size = 3)
ccs_get_config_chain; ccs_error = 0
ccs_get_config_chain
serverh = 0
device_list: (size = 3)
device[0]:: core_type=LS1028A(301)
device[1]:: core_type=DAP(232)
device[2]:: core_type=SAP2(272)
ccs_get_config_chain; ccs_error = 0
ccs_write_register
coreh = [serverh:0;cc_index:0;chain_pos:0]
index = 8193
count = 1
size = 8
value: (size =
6168745F 5F726E6E
ccs_write_register; ccs_error = 56
Error message: SAP2 error - read SAP_STATUS


It looks like reading Challenge Value return all 0's and SAP2 error where it should return the challenge value that I am able to read from U-Boot shell. Why is that happening?