blob: 4bb7c4692153a50de4242aa34e3f73876516521f [file] [log] [blame]
Peng Fanf1e0f9f2019-09-25 08:11:14 +00001// SPDX-License-Identifier: GPL-2.0+
2/*
3 * Copyright 2018-2019 NXP
4 */
5
6#include <common.h>
Simon Glassed38aef2020-05-10 11:40:03 -06007#include <command.h>
Peng Fanf1e0f9f2019-09-25 08:11:14 +00008#include <errno.h>
Simon Glass0f2af882020-05-10 11:40:05 -06009#include <log.h>
Peng Fanf1e0f9f2019-09-25 08:11:14 +000010#include <asm/io.h>
11#include <asm/arch/sci/sci.h>
12#include <asm/mach-imx/sys_proto.h>
13#include <asm/arch-imx/cpu.h>
14#include <asm/arch/sys_proto.h>
15#include <asm/arch/image.h>
16#include <console.h>
Oliver Grautef46161a2020-11-06 09:09:29 +010017#include <cpu_func.h>
Peng Fanf1e0f9f2019-09-25 08:11:14 +000018
19DECLARE_GLOBAL_DATA_PTR;
20
21#define SEC_SECURE_RAM_BASE (0x31800000UL)
22#define SEC_SECURE_RAM_END_BASE (SEC_SECURE_RAM_BASE + 0xFFFFUL)
23#define SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE (0x60000000UL)
24
25#define SECO_PT 2U
26
27static inline bool check_in_dram(ulong addr)
28{
29 int i;
Masahiro Yamadaf7ed78b2020-06-26 15:13:33 +090030 struct bd_info *bd = gd->bd;
Peng Fanf1e0f9f2019-09-25 08:11:14 +000031
32 for (i = 0; i < CONFIG_NR_DRAM_BANKS; ++i) {
33 if (bd->bi_dram[i].size) {
34 if (addr >= bd->bi_dram[i].start &&
35 addr < (bd->bi_dram[i].start + bd->bi_dram[i].size))
36 return true;
37 }
38 }
39
40 return false;
41}
42
43int authenticate_os_container(ulong addr)
44{
45 struct container_hdr *phdr;
46 int i, ret = 0;
47 int err;
48 sc_rm_mr_t mr;
49 sc_faddr_t start, end;
50 u16 length;
51 struct boot_img_t *img;
52 unsigned long s, e;
53
54 if (addr % 4) {
55 puts("Error: Image's address is not 4 byte aligned\n");
56 return -EINVAL;
57 }
58
59 if (!check_in_dram(addr)) {
60 puts("Error: Image's address is invalid\n");
61 return -EINVAL;
62 }
63
64 phdr = (struct container_hdr *)addr;
65 if (phdr->tag != 0x87 && phdr->version != 0x0) {
66 printf("Error: Wrong container header\n");
67 return -EFAULT;
68 }
69
70 if (!phdr->num_images) {
71 printf("Error: Wrong container, no image found\n");
72 return -EFAULT;
73 }
74
75 length = phdr->length_lsb + (phdr->length_msb << 8);
76
77 debug("container length %u\n", length);
78 memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)addr,
79 ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
80
Ye Lid962d562019-10-14 23:08:46 -070081 err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
Peng Fanf1e0f9f2019-09-25 08:11:14 +000082 SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
83 if (err) {
84 printf("Authenticate container hdr failed, return %d\n",
85 err);
86 ret = -EIO;
87 goto exit;
88 }
89
90 /* Copy images to dest address */
91 for (i = 0; i < phdr->num_images; i++) {
92 img = (struct boot_img_t *)(addr +
93 sizeof(struct container_hdr) +
94 i * sizeof(struct boot_img_t));
95
Oliver Graute8ad653b2020-11-06 09:09:30 +010096 debug("img %d, dst 0x%x, src 0x%lux, size 0x%x\n",
Seb Fagardc307ad02020-03-30 17:13:31 +020097 i, (uint32_t) img->dst, img->offset + addr, img->size);
Peng Fanf1e0f9f2019-09-25 08:11:14 +000098
99 memcpy((void *)img->dst, (const void *)(img->offset + addr),
100 img->size);
101
102 s = img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1);
Peng Fan194dccc2020-04-22 15:36:34 +0800103 e = ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1;
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000104
105 flush_dcache_range(s, e);
106
107 /* Find the memreg and set permission for seco pt */
108 err = sc_rm_find_memreg(-1, &mr, s, e);
109 if (err) {
Oliver Graute7d7721a2020-11-06 09:09:31 +0100110 printf("Error: can't find memreg for image load address 0x%llx, error %d\n", img->dst, err);
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000111 ret = -ENOMEM;
112 goto exit;
113 }
114
115 err = sc_rm_get_memreg_info(-1, mr, &start, &end);
116 if (!err)
117 debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
118
119 err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
120 SC_RM_PERM_FULL);
121 if (err) {
122 printf("Set permission failed for img %d, error %d\n",
123 i, err);
124 ret = -EPERM;
125 goto exit;
126 }
127
Ye Lid962d562019-10-14 23:08:46 -0700128 err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000129 (1 << i));
130 if (err) {
131 printf("Authenticate img %d failed, return %d\n",
132 i, err);
133 ret = -EIO;
134 }
135
136 err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
137 SC_RM_PERM_NONE);
138 if (err) {
139 printf("Remove permission failed for img %d, err %d\n",
140 i, err);
141 ret = -EPERM;
142 }
143
144 if (ret)
145 goto exit;
146 }
147
148exit:
Ye Lid962d562019-10-14 23:08:46 -0700149 if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0) != SC_ERR_NONE)
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000150 printf("Error: release container failed!\n");
151
152 return ret;
153}
154
Simon Glassed38aef2020-05-10 11:40:03 -0600155static int do_authenticate(struct cmd_tbl *cmdtp, int flag, int argc,
156 char *const argv[])
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000157{
158 ulong addr;
159
160 if (argc < 2)
161 return CMD_RET_USAGE;
162
163 addr = simple_strtoul(argv[1], NULL, 16);
164
165 printf("Authenticate OS container at 0x%lx\n", addr);
166
167 if (authenticate_os_container(addr))
168 return CMD_RET_FAILURE;
169
170 return CMD_RET_SUCCESS;
171}
172
173static void display_life_cycle(u16 lc)
174{
175 printf("Lifecycle: 0x%04X, ", lc);
176 switch (lc) {
177 case 0x1:
178 printf("Pristine\n\n");
179 break;
180 case 0x2:
181 printf("Fab\n\n");
182 break;
183 case 0x8:
184 printf("Open\n\n");
185 break;
186 case 0x20:
187 printf("NXP closed\n\n");
188 break;
189 case 0x80:
190 printf("OEM closed\n\n");
191 break;
192 case 0x100:
193 printf("Partial field return\n\n");
194 break;
195 case 0x200:
196 printf("Full field return\n\n");
197 break;
198 case 0x400:
199 printf("No return\n\n");
200 break;
201 default:
202 printf("Unknown\n\n");
203 break;
204 }
205}
206
207#define AHAB_AUTH_CONTAINER_REQ 0x87
208#define AHAB_VERIFY_IMAGE_REQ 0x88
209
210#define AHAB_NO_AUTHENTICATION_IND 0xee
211#define AHAB_BAD_KEY_HASH_IND 0xfa
212#define AHAB_INVALID_KEY_IND 0xf9
213#define AHAB_BAD_SIGNATURE_IND 0xf0
214#define AHAB_BAD_HASH_IND 0xf1
215
216static void display_ahab_auth_event(u32 event)
217{
218 u8 cmd = (event >> 16) & 0xff;
219 u8 resp_ind = (event >> 8) & 0xff;
220
221 switch (cmd) {
222 case AHAB_AUTH_CONTAINER_REQ:
223 printf("\tCMD = AHAB_AUTH_CONTAINER_REQ (0x%02X)\n", cmd);
224 printf("\tIND = ");
225 break;
226 case AHAB_VERIFY_IMAGE_REQ:
227 printf("\tCMD = AHAB_VERIFY_IMAGE_REQ (0x%02X)\n", cmd);
228 printf("\tIND = ");
229 break;
230 default:
231 return;
232 }
233
234 switch (resp_ind) {
235 case AHAB_NO_AUTHENTICATION_IND:
236 printf("AHAB_NO_AUTHENTICATION_IND (0x%02X)\n\n", resp_ind);
237 break;
238 case AHAB_BAD_KEY_HASH_IND:
239 printf("AHAB_BAD_KEY_HASH_IND (0x%02X)\n\n", resp_ind);
240 break;
241 case AHAB_INVALID_KEY_IND:
242 printf("AHAB_INVALID_KEY_IND (0x%02X)\n\n", resp_ind);
243 break;
244 case AHAB_BAD_SIGNATURE_IND:
245 printf("AHAB_BAD_SIGNATURE_IND (0x%02X)\n\n", resp_ind);
246 break;
247 case AHAB_BAD_HASH_IND:
248 printf("AHAB_BAD_HASH_IND (0x%02X)\n\n", resp_ind);
249 break;
250 default:
251 printf("Unknown Indicator (0x%02X)\n\n", resp_ind);
252 break;
253 }
254}
255
Simon Glassed38aef2020-05-10 11:40:03 -0600256static int do_ahab_status(struct cmd_tbl *cmdtp, int flag, int argc,
257 char *const argv[])
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000258{
259 int err;
260 u8 idx = 0U;
261 u32 event;
262 u16 lc;
263
264 err = sc_seco_chip_info(-1, &lc, NULL, NULL, NULL);
265 if (err != SC_ERR_NONE) {
266 printf("Error in get lifecycle\n");
267 return -EIO;
268 }
269
270 display_life_cycle(lc);
271
272 err = sc_seco_get_event(-1, idx, &event);
273 while (err == SC_ERR_NONE) {
274 printf("SECO Event[%u] = 0x%08X\n", idx, event);
275 display_ahab_auth_event(event);
276
277 idx++;
278 err = sc_seco_get_event(-1, idx, &event);
279 }
280
281 if (idx == 0)
282 printf("No SECO Events Found!\n\n");
283
284 return 0;
285}
286
287static int confirm_close(void)
288{
289 puts("Warning: Please ensure your sample is in NXP closed state, "
290 "OEM SRK hash has been fused, \n"
291 " and you are able to boot a signed image successfully "
292 "without any SECO events reported.\n"
293 " If not, your sample will be unrecoverable.\n"
294 "\nReally perform this operation? <y/N>\n");
295
296 if (confirm_yesno())
297 return 1;
298
299 puts("Ahab close aborted\n");
300 return 0;
301}
302
Simon Glassed38aef2020-05-10 11:40:03 -0600303static int do_ahab_close(struct cmd_tbl *cmdtp, int flag, int argc,
304 char *const argv[])
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000305{
306 int err;
307 u16 lc;
308
309 if (!confirm_close())
310 return -EACCES;
311
312 err = sc_seco_chip_info(-1, &lc, NULL, NULL, NULL);
313 if (err != SC_ERR_NONE) {
314 printf("Error in get lifecycle\n");
315 return -EIO;
316 }
317
318 if (lc != 0x20) {
319 puts("Current lifecycle is NOT NXP closed, can't move to OEM closed\n");
320 display_life_cycle(lc);
321 return -EPERM;
322 }
323
324 err = sc_seco_forward_lifecycle(-1, 16);
325 if (err != SC_ERR_NONE) {
326 printf("Error in forward lifecycle to OEM closed\n");
327 return -EIO;
328 }
329
330 printf("Change to OEM closed successfully\n");
331
332 return 0;
333}
334
335U_BOOT_CMD(auth_cntr, CONFIG_SYS_MAXARGS, 1, do_authenticate,
336 "autenticate OS container via AHAB",
337 "addr\n"
338 "addr - OS container hex address\n"
339);
340
341U_BOOT_CMD(ahab_status, CONFIG_SYS_MAXARGS, 1, do_ahab_status,
342 "display AHAB lifecycle and events from seco",
343 ""
344);
345
346U_BOOT_CMD(ahab_close, CONFIG_SYS_MAXARGS, 1, do_ahab_close,
347 "Change AHAB lifecycle to OEM closed",
348 ""
349);