-
Notifications
You must be signed in to change notification settings - Fork 13
Description
While checking RTL code for EarlGrey master, I stumbled upon some wave files showing that despite the wrong key/nonce pair to validate the ROM code, the CPU was nevertheless executing code from ROM.
It appears this was due to the OTP LC, which was indicated to be in RMA (img_rma.24.vmem)
Looking at pwrmgr RTL code, it seems that in RMA LC (and some others), ROM check can be fully disabled, bypassing the ROM good signal to advance the pwrmgr FSM through the ROM done/good state up to the active state.
I do not remember having implemented this feature in early QEMU versions, and looking briefly at the ot_pwrmgr.c code this case does not seem to be handled.
Adding this ticket to track this feature whenever possible, and before I forget about it...