blob: ece3462f450eaa0ddc09534ecd4c347bf7a6b767 [file] [log] [blame]
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +02001/*
Toshiyuki Ogasaharae67848f2019-05-20 11:25:41 +09002 * Copyright (c) 2015-2019, Renesas Electronics Corporation. All rights
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +02003 * reserved.
4 *
5 * SPDX-License-Identifier: BSD-3-Clause
6 */
7
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +02008#include <stddef.h>
9
Antonio Nino Diaze0f90632018-12-14 00:18:21 +000010#include <platform_def.h>
11
12#include <arch_helpers.h>
13#include <common/debug.h>
14#include <lib/mmio.h>
15#include <plat/common/platform.h>
16
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +020017#include "rom_api.h"
18
19typedef int32_t(*secure_boot_api_f) (uint32_t a, uint32_t b, void *c);
20extern int32_t rcar_get_certificate(const int32_t name, uint32_t *cert_addr);
21
22#define RCAR_IMAGE_ID_MAX (10)
23#define RCAR_CERT_MAGIC_NUM (0xE291F358U)
24#define RCAR_BOOT_KEY_CERT (0xE6300C00U)
25#define RCAR_BOOT_KEY_CERT_NEW (0xE6300F00U)
26#define RST_BASE (0xE6160000U)
27#define RST_MODEMR (RST_BASE + 0x0060U)
Toshiyuki Ogasaharae67848f2019-05-20 11:25:41 +090028#define MFISOFTMDR (0xE6260600U)
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +020029#define MODEMR_MD5_MASK (0x00000020U)
30#define MODEMR_MD5_SHIFT (5U)
31#define SOFTMD_BOOTMODE_MASK (0x00000001U)
32#define SOFTMD_NORMALBOOT (0x1U)
33
34static secure_boot_api_f secure_boot_api;
35
36int auth_mod_get_parent_id(unsigned int img_id, unsigned int *parent_id)
37{
38 return 1;
39}
40
41int auth_mod_verify_img(unsigned int img_id, void *ptr, unsigned int len)
42{
43 int32_t ret = 0, index = 0;
44 uint32_t cert_addr = 0U;
45 static const struct img_to_cert_t {
46 uint32_t id;
47 int32_t cert;
48 const char *name;
49 } image[RCAR_IMAGE_ID_MAX] = {
50 { BL31_IMAGE_ID, SOC_FW_CONTENT_CERT_ID, "BL31" },
51 { BL32_IMAGE_ID, TRUSTED_OS_FW_CONTENT_CERT_ID, "BL32" },
52 { BL33_IMAGE_ID, NON_TRUSTED_FW_CONTENT_CERT_ID, "BL33" },
53 { BL332_IMAGE_ID, BL332_CERT_ID, "BL332" },
54 { BL333_IMAGE_ID, BL333_CERT_ID, "BL333" },
55 { BL334_IMAGE_ID, BL334_CERT_ID, "BL334" },
56 { BL335_IMAGE_ID, BL335_CERT_ID, "BL335" },
57 { BL336_IMAGE_ID, BL336_CERT_ID, "BL336" },
58 { BL337_IMAGE_ID, BL337_CERT_ID, "BL337" },
59 { BL338_IMAGE_ID, BL338_CERT_ID, "BL338" },
60 };
61
62#if IMAGE_BL2
63 switch (img_id) {
64 case TRUSTED_KEY_CERT_ID:
65 case SOC_FW_KEY_CERT_ID:
66 case TRUSTED_OS_FW_KEY_CERT_ID:
67 case NON_TRUSTED_FW_KEY_CERT_ID:
68 case BL332_KEY_CERT_ID:
69 case BL333_KEY_CERT_ID:
70 case BL334_KEY_CERT_ID:
71 case BL335_KEY_CERT_ID:
72 case BL336_KEY_CERT_ID:
73 case BL337_KEY_CERT_ID:
74 case BL338_KEY_CERT_ID:
75 case SOC_FW_CONTENT_CERT_ID:
76 case TRUSTED_OS_FW_CONTENT_CERT_ID:
77 case NON_TRUSTED_FW_CONTENT_CERT_ID:
78 case BL332_CERT_ID:
79 case BL333_CERT_ID:
80 case BL334_CERT_ID:
81 case BL335_CERT_ID:
82 case BL336_CERT_ID:
83 case BL337_CERT_ID:
84 case BL338_CERT_ID:
85 return ret;
86 case BL31_IMAGE_ID:
87 case BL32_IMAGE_ID:
88 case BL33_IMAGE_ID:
89 case BL332_IMAGE_ID:
90 case BL333_IMAGE_ID:
91 case BL334_IMAGE_ID:
92 case BL335_IMAGE_ID:
93 case BL336_IMAGE_ID:
94 case BL337_IMAGE_ID:
95 case BL338_IMAGE_ID:
96 goto verify_image;
97 default:
98 return -1;
99 }
100
101verify_image:
102 for (index = 0; index < RCAR_IMAGE_ID_MAX; index++) {
103 if (img_id != image[index].id)
104 continue;
105
106 ret = rcar_get_certificate(image[index].cert, &cert_addr);
107 break;
108 }
109
110 if (ret || (index == RCAR_IMAGE_ID_MAX)) {
111 ERROR("Verification Failed for image id = %d\n", img_id);
112 return ret;
113 }
114#if RCAR_BL2_DCACHE == 1
115 /* clean and disable */
Marek Vasut290a4002018-12-27 20:26:01 +0100116 write_sctlr_el3(read_sctlr_el3() & ~SCTLR_C_BIT);
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +0200117 dcsw_op_all(DCCISW);
118#endif
119 ret = (mmio_read_32(RCAR_BOOT_KEY_CERT_NEW) == RCAR_CERT_MAGIC_NUM) ?
120 secure_boot_api(RCAR_BOOT_KEY_CERT_NEW, cert_addr, NULL) :
121 secure_boot_api(RCAR_BOOT_KEY_CERT, cert_addr, NULL);
122 if (ret)
123 ERROR("Verification Failed 0x%x, %s\n", ret, image[index].name);
124
125#if RCAR_BL2_DCACHE == 1
126 /* enable */
Marek Vasut290a4002018-12-27 20:26:01 +0100127 write_sctlr_el3(read_sctlr_el3() | SCTLR_C_BIT);
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +0200128#endif
129
130#endif
131 return ret;
132}
133
134static int32_t normal_boot_verify(uint32_t a, uint32_t b, void *c)
135{
136 return 0;
137}
138
139void auth_mod_init(void)
140{
141#if RCAR_SECURE_BOOT
Toshiyuki Ogasaharae67848f2019-05-20 11:25:41 +0900142 uint32_t soft_md = mmio_read_32(MFISOFTMDR) & SOFTMD_BOOTMODE_MASK;
Jorge Ramirez-Ortiz3f464d92018-09-23 09:38:24 +0200143 uint32_t md = mmio_read_32(RST_MODEMR) & MODEMR_MD5_MASK;
144 uint32_t lcs, ret;
145
146 secure_boot_api = (secure_boot_api_f) &rcar_rom_secure_boot_api;
147
148 ret = rcar_rom_get_lcs(&lcs);
149 if (ret) {
150 ERROR("BL2: Failed to get the LCS. (%d)\n", ret);
151 panic();
152 }
153
154 switch (lcs) {
155 case LCS_SE:
156 if (soft_md == SOFTMD_NORMALBOOT)
157 secure_boot_api = &normal_boot_verify;
158 break;
159 case LCS_SD:
160 secure_boot_api = &normal_boot_verify;
161 break;
162 default:
163 if (md >> MODEMR_MD5_SHIFT)
164 secure_boot_api = &normal_boot_verify;
165 }
166
167 NOTICE("BL2: %s boot\n",
168 secure_boot_api == &normal_boot_verify ? "Normal" : "Secure");
169#else
170 NOTICE("BL2: Normal boot\n");
171 secure_boot_api = &normal_boot_verify;
172#endif
173}