blob: 5dbe1d56e02f536e629ef6a9861c86631af79832 [file] [log] [blame]
Peng Fanf1e0f9f2019-09-25 08:11:14 +00001// SPDX-License-Identifier: GPL-2.0+
2/*
3 * Copyright 2018-2019 NXP
4 */
5
6#include <common.h>
Simon Glassed38aef2020-05-10 11:40:03 -06007#include <command.h>
Peng Fanf1e0f9f2019-09-25 08:11:14 +00008#include <errno.h>
Simon Glass0f2af882020-05-10 11:40:05 -06009#include <log.h>
Peng Fanf1e0f9f2019-09-25 08:11:14 +000010#include <asm/io.h>
11#include <asm/arch/sci/sci.h>
12#include <asm/mach-imx/sys_proto.h>
13#include <asm/arch-imx/cpu.h>
14#include <asm/arch/sys_proto.h>
15#include <asm/arch/image.h>
16#include <console.h>
17
18DECLARE_GLOBAL_DATA_PTR;
19
20#define SEC_SECURE_RAM_BASE (0x31800000UL)
21#define SEC_SECURE_RAM_END_BASE (SEC_SECURE_RAM_BASE + 0xFFFFUL)
22#define SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE (0x60000000UL)
23
24#define SECO_PT 2U
25
26static inline bool check_in_dram(ulong addr)
27{
28 int i;
Masahiro Yamadaf7ed78b2020-06-26 15:13:33 +090029 struct bd_info *bd = gd->bd;
Peng Fanf1e0f9f2019-09-25 08:11:14 +000030
31 for (i = 0; i < CONFIG_NR_DRAM_BANKS; ++i) {
32 if (bd->bi_dram[i].size) {
33 if (addr >= bd->bi_dram[i].start &&
34 addr < (bd->bi_dram[i].start + bd->bi_dram[i].size))
35 return true;
36 }
37 }
38
39 return false;
40}
41
42int authenticate_os_container(ulong addr)
43{
44 struct container_hdr *phdr;
45 int i, ret = 0;
46 int err;
47 sc_rm_mr_t mr;
48 sc_faddr_t start, end;
49 u16 length;
50 struct boot_img_t *img;
51 unsigned long s, e;
52
53 if (addr % 4) {
54 puts("Error: Image's address is not 4 byte aligned\n");
55 return -EINVAL;
56 }
57
58 if (!check_in_dram(addr)) {
59 puts("Error: Image's address is invalid\n");
60 return -EINVAL;
61 }
62
63 phdr = (struct container_hdr *)addr;
64 if (phdr->tag != 0x87 && phdr->version != 0x0) {
65 printf("Error: Wrong container header\n");
66 return -EFAULT;
67 }
68
69 if (!phdr->num_images) {
70 printf("Error: Wrong container, no image found\n");
71 return -EFAULT;
72 }
73
74 length = phdr->length_lsb + (phdr->length_msb << 8);
75
76 debug("container length %u\n", length);
77 memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)addr,
78 ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
79
Ye Lid962d562019-10-14 23:08:46 -070080 err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
Peng Fanf1e0f9f2019-09-25 08:11:14 +000081 SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
82 if (err) {
83 printf("Authenticate container hdr failed, return %d\n",
84 err);
85 ret = -EIO;
86 goto exit;
87 }
88
89 /* Copy images to dest address */
90 for (i = 0; i < phdr->num_images; i++) {
91 img = (struct boot_img_t *)(addr +
92 sizeof(struct container_hdr) +
93 i * sizeof(struct boot_img_t));
94
Seb Fagardc307ad02020-03-30 17:13:31 +020095 debug("img %d, dst 0x%x, src 0x%x, size 0x%x\n",
96 i, (uint32_t) img->dst, img->offset + addr, img->size);
Peng Fanf1e0f9f2019-09-25 08:11:14 +000097
98 memcpy((void *)img->dst, (const void *)(img->offset + addr),
99 img->size);
100
101 s = img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1);
Peng Fan194dccc2020-04-22 15:36:34 +0800102 e = ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1;
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000103
104 flush_dcache_range(s, e);
105
106 /* Find the memreg and set permission for seco pt */
107 err = sc_rm_find_memreg(-1, &mr, s, e);
108 if (err) {
Seb Fagardc307ad02020-03-30 17:13:31 +0200109 printf("Error: can't find memreg for image load address 0x%x, error %d\n", img->dst, err);
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000110 ret = -ENOMEM;
111 goto exit;
112 }
113
114 err = sc_rm_get_memreg_info(-1, mr, &start, &end);
115 if (!err)
116 debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
117
118 err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
119 SC_RM_PERM_FULL);
120 if (err) {
121 printf("Set permission failed for img %d, error %d\n",
122 i, err);
123 ret = -EPERM;
124 goto exit;
125 }
126
Ye Lid962d562019-10-14 23:08:46 -0700127 err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000128 (1 << i));
129 if (err) {
130 printf("Authenticate img %d failed, return %d\n",
131 i, err);
132 ret = -EIO;
133 }
134
135 err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
136 SC_RM_PERM_NONE);
137 if (err) {
138 printf("Remove permission failed for img %d, err %d\n",
139 i, err);
140 ret = -EPERM;
141 }
142
143 if (ret)
144 goto exit;
145 }
146
147exit:
Ye Lid962d562019-10-14 23:08:46 -0700148 if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0) != SC_ERR_NONE)
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000149 printf("Error: release container failed!\n");
150
151 return ret;
152}
153
Simon Glassed38aef2020-05-10 11:40:03 -0600154static int do_authenticate(struct cmd_tbl *cmdtp, int flag, int argc,
155 char *const argv[])
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000156{
157 ulong addr;
158
159 if (argc < 2)
160 return CMD_RET_USAGE;
161
162 addr = simple_strtoul(argv[1], NULL, 16);
163
164 printf("Authenticate OS container at 0x%lx\n", addr);
165
166 if (authenticate_os_container(addr))
167 return CMD_RET_FAILURE;
168
169 return CMD_RET_SUCCESS;
170}
171
172static void display_life_cycle(u16 lc)
173{
174 printf("Lifecycle: 0x%04X, ", lc);
175 switch (lc) {
176 case 0x1:
177 printf("Pristine\n\n");
178 break;
179 case 0x2:
180 printf("Fab\n\n");
181 break;
182 case 0x8:
183 printf("Open\n\n");
184 break;
185 case 0x20:
186 printf("NXP closed\n\n");
187 break;
188 case 0x80:
189 printf("OEM closed\n\n");
190 break;
191 case 0x100:
192 printf("Partial field return\n\n");
193 break;
194 case 0x200:
195 printf("Full field return\n\n");
196 break;
197 case 0x400:
198 printf("No return\n\n");
199 break;
200 default:
201 printf("Unknown\n\n");
202 break;
203 }
204}
205
206#define AHAB_AUTH_CONTAINER_REQ 0x87
207#define AHAB_VERIFY_IMAGE_REQ 0x88
208
209#define AHAB_NO_AUTHENTICATION_IND 0xee
210#define AHAB_BAD_KEY_HASH_IND 0xfa
211#define AHAB_INVALID_KEY_IND 0xf9
212#define AHAB_BAD_SIGNATURE_IND 0xf0
213#define AHAB_BAD_HASH_IND 0xf1
214
215static void display_ahab_auth_event(u32 event)
216{
217 u8 cmd = (event >> 16) & 0xff;
218 u8 resp_ind = (event >> 8) & 0xff;
219
220 switch (cmd) {
221 case AHAB_AUTH_CONTAINER_REQ:
222 printf("\tCMD = AHAB_AUTH_CONTAINER_REQ (0x%02X)\n", cmd);
223 printf("\tIND = ");
224 break;
225 case AHAB_VERIFY_IMAGE_REQ:
226 printf("\tCMD = AHAB_VERIFY_IMAGE_REQ (0x%02X)\n", cmd);
227 printf("\tIND = ");
228 break;
229 default:
230 return;
231 }
232
233 switch (resp_ind) {
234 case AHAB_NO_AUTHENTICATION_IND:
235 printf("AHAB_NO_AUTHENTICATION_IND (0x%02X)\n\n", resp_ind);
236 break;
237 case AHAB_BAD_KEY_HASH_IND:
238 printf("AHAB_BAD_KEY_HASH_IND (0x%02X)\n\n", resp_ind);
239 break;
240 case AHAB_INVALID_KEY_IND:
241 printf("AHAB_INVALID_KEY_IND (0x%02X)\n\n", resp_ind);
242 break;
243 case AHAB_BAD_SIGNATURE_IND:
244 printf("AHAB_BAD_SIGNATURE_IND (0x%02X)\n\n", resp_ind);
245 break;
246 case AHAB_BAD_HASH_IND:
247 printf("AHAB_BAD_HASH_IND (0x%02X)\n\n", resp_ind);
248 break;
249 default:
250 printf("Unknown Indicator (0x%02X)\n\n", resp_ind);
251 break;
252 }
253}
254
Simon Glassed38aef2020-05-10 11:40:03 -0600255static int do_ahab_status(struct cmd_tbl *cmdtp, int flag, int argc,
256 char *const argv[])
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000257{
258 int err;
259 u8 idx = 0U;
260 u32 event;
261 u16 lc;
262
263 err = sc_seco_chip_info(-1, &lc, NULL, NULL, NULL);
264 if (err != SC_ERR_NONE) {
265 printf("Error in get lifecycle\n");
266 return -EIO;
267 }
268
269 display_life_cycle(lc);
270
271 err = sc_seco_get_event(-1, idx, &event);
272 while (err == SC_ERR_NONE) {
273 printf("SECO Event[%u] = 0x%08X\n", idx, event);
274 display_ahab_auth_event(event);
275
276 idx++;
277 err = sc_seco_get_event(-1, idx, &event);
278 }
279
280 if (idx == 0)
281 printf("No SECO Events Found!\n\n");
282
283 return 0;
284}
285
286static int confirm_close(void)
287{
288 puts("Warning: Please ensure your sample is in NXP closed state, "
289 "OEM SRK hash has been fused, \n"
290 " and you are able to boot a signed image successfully "
291 "without any SECO events reported.\n"
292 " If not, your sample will be unrecoverable.\n"
293 "\nReally perform this operation? <y/N>\n");
294
295 if (confirm_yesno())
296 return 1;
297
298 puts("Ahab close aborted\n");
299 return 0;
300}
301
Simon Glassed38aef2020-05-10 11:40:03 -0600302static int do_ahab_close(struct cmd_tbl *cmdtp, int flag, int argc,
303 char *const argv[])
Peng Fanf1e0f9f2019-09-25 08:11:14 +0000304{
305 int err;
306 u16 lc;
307
308 if (!confirm_close())
309 return -EACCES;
310
311 err = sc_seco_chip_info(-1, &lc, NULL, NULL, NULL);
312 if (err != SC_ERR_NONE) {
313 printf("Error in get lifecycle\n");
314 return -EIO;
315 }
316
317 if (lc != 0x20) {
318 puts("Current lifecycle is NOT NXP closed, can't move to OEM closed\n");
319 display_life_cycle(lc);
320 return -EPERM;
321 }
322
323 err = sc_seco_forward_lifecycle(-1, 16);
324 if (err != SC_ERR_NONE) {
325 printf("Error in forward lifecycle to OEM closed\n");
326 return -EIO;
327 }
328
329 printf("Change to OEM closed successfully\n");
330
331 return 0;
332}
333
334U_BOOT_CMD(auth_cntr, CONFIG_SYS_MAXARGS, 1, do_authenticate,
335 "autenticate OS container via AHAB",
336 "addr\n"
337 "addr - OS container hex address\n"
338);
339
340U_BOOT_CMD(ahab_status, CONFIG_SYS_MAXARGS, 1, do_ahab_status,
341 "display AHAB lifecycle and events from seco",
342 ""
343);
344
345U_BOOT_CMD(ahab_close, CONFIG_SYS_MAXARGS, 1, do_ahab_close,
346 "Change AHAB lifecycle to OEM closed",
347 ""
348);