Hi all,
I have a LS1021a setup, where I implemented secure boot and it is working fine. The board is booting from QSPI flash.
I have done this by programming OTPMK, using BOOT_HO and SB_EN in the RCW, and writing SRKH with the help of the debugger.
Once this was OK, i started programming the SRKH and setting ITS fuse.
Additionally, JTAG was closed by setting it to conditionally open via challenge/response, without notification.
The secure debug feature works too, I can use the debugger to perform debugging once the SDCR has been read and the SDDR has been written.
So far, everything works as expected.
Now I was trying to hold the CPU again in boot, so setting BOOT_HO in the RCW again, with secure debug enabled.
But now I'm seeing that the CPU is not even fetching the RCW as before (where secure debug was not enabled yet).
The strange thing is that in this scenario reading or writing other registers via DAP/SAP2 does not work.
A CCS console trace of this behavior:
(bin) 687 % ccs::config_chain {ls1020a dap sap2}
LS1020A: Secure debug violation
(bin) 687 % display ccs::read_reg 0 sdcr 1 8
sdcr=0xC0C0C0C0 D0D0D0D0
(bin) 688 % ccs::write_reg 0 sdrr 8 {0xXXXXXXXX 0xXXXXXXXX}
(bin) 689 % ccs::config_chain {ls1020a dap sap2}
(bin) 690 % ccs::config_chain {ls1020a dap sap2}
(bin) 690 % display ccs::get_config_chain
Chain Position 0: LS1020A
Chain Position 1: CoreSight ATB Funnel
Chain Position 2: CoreSight TMC
Chain Position 3: CoreSight TMC
Chain Position 4: CoreSight TMC
Chain Position 5: CoreSight CTI
Chain Position 6: CoreSight CTI
Chain Position 7: CoreSight CTI
Chain Position 8: CoreSight ATB Funnel
Chain Position 9: Cortex-A7
Chain Position 10: Cortex-A7 PMU
Chain Position 11: Cortex-A7
Chain Position 12: Cortex-A7 PMU
Chain Position 13: CoreSight CTI
Chain Position 14: CoreSight CTI
Chain Position 15: Cortex-A7 ETM
Chain Position 16: Cortex-A7 ETM
Chain Position 17: DAP
Chain Position 18: SAP2
(bin) 691 % disp ccs::read_mem 18 0x1e90014 4 0 1
+0 +4 +8 +C
[0x01E90014] 00000000
(bin) 692 % disp ccs::read_reg 0 rcw0 15
rcw0=0x00000000 rcw1=0x00000000 rcw2=0x00000000 rcw3=0x00000000
rcw4=0x00000000 rcw5=0x00000000 rcw6=0x00000000 rcw7=0x00000000
rcw8=0x00000000 rcw9=0x00000000 rcw10=0x00000000 rcw11=0x00000000
rcw12=0x00000000 rcw13=0x00000000 rcw14=0x00000000
Again, the exact same sequence (setting BOOT_HO=1) works without having secure debug in place:
(bin) 696 % ccs::config_chain {ls1020a dap sap2}
(bin) 697 % disp ccs::read_mem 18 0x1e90014 4 0 1
+0 +4 +8 +C
[0x01E90014] 80002900
Is there any additional step I need to perform to be able to read/write registers with secure debug in place?
