* [U-Boot] [PATCH 1/3] imx: cpu: move common chip revision id's @ 2015-09-21 20:44 Adrian Alonso 2015-09-21 20:44 ` [U-Boot] [PATCH 2/3] hab: rework support for imx6/imx7 Adrian Alonso 2015-09-21 20:44 ` [U-Boot] [PATCH 3/3] mx7dsabresd: add secure boot support Adrian Alonso 0 siblings, 2 replies; 4+ messages in thread From: Adrian Alonso @ 2015-09-21 20:44 UTC (permalink / raw) To: u-boot Move common chip revision id's to main cpu header file mx25 generic include cpu header for chip revision Signed-off-by: Adrian Alonso <aalonso@freescale.com> --- arch/arm/cpu/arm926ejs/mx25/generic.c | 1 + arch/arm/include/asm/arch-imx/cpu.h | 12 ++++++++++++ arch/arm/include/asm/arch-mx25/imx-regs.h | 4 ---- arch/arm/include/asm/arch-mx5/imx-regs.h | 11 ----------- arch/arm/include/asm/arch-mx6/imx-regs.h | 4 ---- 5 files changed, 13 insertions(+), 19 deletions(-) diff --git a/arch/arm/cpu/arm926ejs/mx25/generic.c b/arch/arm/cpu/arm926ejs/mx25/generic.c index 8912098..0b1a8f4 100644 --- a/arch/arm/cpu/arm926ejs/mx25/generic.c +++ b/arch/arm/cpu/arm926ejs/mx25/generic.c @@ -13,6 +13,7 @@ #include <div64.h> #include <netdev.h> #include <asm/io.h> +#include <asm/arch-imx/cpu.h> #include <asm/arch/imx-regs.h> #include <asm/arch/clock.h> diff --git a/arch/arm/include/asm/arch-imx/cpu.h b/arch/arm/include/asm/arch-imx/cpu.h index 7e681e9..8a75902 100644 --- a/arch/arm/include/asm/arch-imx/cpu.h +++ b/arch/arm/include/asm/arch-imx/cpu.h @@ -27,6 +27,18 @@ #define MXC_SOC_MX6 0x60 #define MXC_SOC_MX7 0x70 +#define CHIP_REV_1_0 0x10 +#define CHIP_REV_1_1 0x11 +#define CHIP_REV_1_2 0x12 +#define CHIP_REV_1_5 0x15 +#define CHIP_REV_2_0 0x20 +#define CHIP_REV_2_5 0x25 +#define CHIP_REV_3_0 0x30 + +#define BOARD_REV_1_0 0x0 +#define BOARD_REV_2_0 0x1 +#define BOARD_VER_OFFSET 0x8 + #define CS0_128 0 #define CS0_64M_CS1_64M 1 #define CS0_64M_CS1_32M_CS2_32M 2 diff --git a/arch/arm/include/asm/arch-mx25/imx-regs.h b/arch/arm/include/asm/arch-mx25/imx-regs.h index 78c4e9b..1b00ed7 100644 --- a/arch/arm/include/asm/arch-mx25/imx-regs.h +++ b/arch/arm/include/asm/arch-mx25/imx-regs.h @@ -526,8 +526,4 @@ struct cspi_regs { IMX_CSPI2_BASE, \ IMX_CSPI3_BASE -#define CHIP_REV_1_0 0x10 -#define CHIP_REV_1_1 0x11 -#define CHIP_REV_1_2 0x12 - #endif /* _IMX_REGS_H */ diff --git a/arch/arm/include/asm/arch-mx5/imx-regs.h b/arch/arm/include/asm/arch-mx5/imx-regs.h index 5f0e1e6..e73cc07 100644 --- a/arch/arm/include/asm/arch-mx5/imx-regs.h +++ b/arch/arm/include/asm/arch-mx5/imx-regs.h @@ -291,17 +291,6 @@ #define DP_MFD_216 (4 - 1) #define DP_MFN_216 3 -#define CHIP_REV_1_0 0x10 -#define CHIP_REV_1_1 0x11 -#define CHIP_REV_2_0 0x20 -#define CHIP_REV_2_5 0x25 -#define CHIP_REV_3_0 0x30 - -#define BOARD_REV_1_0 0x0 -#define BOARD_REV_2_0 0x1 - -#define BOARD_VER_OFFSET 0x8 - #define IMX_IIM_BASE (IIM_BASE_ADDR) #if !(defined(__KERNEL_STRICT_NAMES) || defined(__ASSEMBLY__)) diff --git a/arch/arm/include/asm/arch-mx6/imx-regs.h b/arch/arm/include/asm/arch-mx6/imx-regs.h index 74512ac..6249b33 100644 --- a/arch/arm/include/asm/arch-mx6/imx-regs.h +++ b/arch/arm/include/asm/arch-mx6/imx-regs.h @@ -325,10 +325,6 @@ #define WDOG3_BASE_ADDR (is_cpu_type(MXC_CPU_MX6UL) ? \ MX6UL_WDOG3_BASE_ADDR : MX6SX_WDOG3_BASE_ADDR) -#define CHIP_REV_1_0 0x10 -#define CHIP_REV_1_2 0x12 -#define CHIP_REV_1_5 0x15 -#define CHIP_REV_2_0 0x20 #if !(defined(CONFIG_MX6SX) || defined(CONFIG_MX6UL)) #define IRAM_SIZE 0x00040000 #else -- 2.1.4 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [U-Boot] [PATCH 2/3] hab: rework support for imx6/imx7 2015-09-21 20:44 [U-Boot] [PATCH 1/3] imx: cpu: move common chip revision id's Adrian Alonso @ 2015-09-21 20:44 ` Adrian Alonso 2015-09-29 12:32 ` Stefano Babic 2015-09-21 20:44 ` [U-Boot] [PATCH 3/3] mx7dsabresd: add secure boot support Adrian Alonso 1 sibling, 1 reply; 4+ messages in thread From: Adrian Alonso @ 2015-09-21 20:44 UTC (permalink / raw) To: u-boot Signed-off-by: Adrian Alonso <aalonso@freescale.com> --- arch/arm/cpu/armv7/mx6/Makefile | 1 - arch/arm/cpu/armv7/mx6/hab.c | 502 --------------------------------------- arch/arm/imx-common/Makefile | 1 + arch/arm/imx-common/hab.c | 515 ++++++++++++++++++++++++++++++++++++++++ include/imx_hab.h | 140 +++++++++++ 5 files changed, 656 insertions(+), 503 deletions(-) delete mode 100644 arch/arm/cpu/armv7/mx6/hab.c create mode 100644 arch/arm/imx-common/hab.c create mode 100644 include/imx_hab.h diff --git a/arch/arm/cpu/armv7/mx6/Makefile b/arch/arm/cpu/armv7/mx6/Makefile index bf6effc..8af191d 100644 --- a/arch/arm/cpu/armv7/mx6/Makefile +++ b/arch/arm/cpu/armv7/mx6/Makefile @@ -9,5 +9,4 @@ obj-y := soc.o clock.o obj-$(CONFIG_SPL_BUILD) += ddr.o -obj-$(CONFIG_SECURE_BOOT) += hab.o obj-$(CONFIG_MP) += mp.o diff --git a/arch/arm/cpu/armv7/mx6/hab.c b/arch/arm/cpu/armv7/mx6/hab.c deleted file mode 100644 index 27cabe4..0000000 --- a/arch/arm/cpu/armv7/mx6/hab.c +++ /dev/null @@ -1,502 +0,0 @@ -/* - * Copyright (C) 2010-2015 Freescale Semiconductor, Inc. - * - * SPDX-License-Identifier: GPL-2.0+ - */ - -#include <common.h> -#include <asm/io.h> -#include <asm/system.h> -#include <asm/arch/hab.h> -#include <asm/arch/clock.h> -#include <asm/arch/sys_proto.h> - -/* -------- start of HAB API updates ------------*/ - -#define hab_rvt_report_event_p \ -( \ - ((is_cpu_type(MXC_CPU_MX6Q) || \ - is_cpu_type(MXC_CPU_MX6D)) && \ - (soc_rev() >= CHIP_REV_1_5)) ? \ - ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ - (is_cpu_type(MXC_CPU_MX6DL) && \ - (soc_rev() >= CHIP_REV_1_2)) ? \ - ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ - ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT) \ -) - -#define hab_rvt_report_status_p \ -( \ - ((is_cpu_type(MXC_CPU_MX6Q) || \ - is_cpu_type(MXC_CPU_MX6D)) && \ - (soc_rev() >= CHIP_REV_1_5)) ? \ - ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ - (is_cpu_type(MXC_CPU_MX6DL) && \ - (soc_rev() >= CHIP_REV_1_2)) ? \ - ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ - ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) \ -) - -#define hab_rvt_authenticate_image_p \ -( \ - ((is_cpu_type(MXC_CPU_MX6Q) || \ - is_cpu_type(MXC_CPU_MX6D)) && \ - (soc_rev() >= CHIP_REV_1_5)) ? \ - ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ - (is_cpu_type(MXC_CPU_MX6DL) && \ - (soc_rev() >= CHIP_REV_1_2)) ? \ - ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ - ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) \ -) - -#define hab_rvt_entry_p \ -( \ - ((is_cpu_type(MXC_CPU_MX6Q) || \ - is_cpu_type(MXC_CPU_MX6D)) && \ - (soc_rev() >= CHIP_REV_1_5)) ? \ - ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ - (is_cpu_type(MXC_CPU_MX6DL) && \ - (soc_rev() >= CHIP_REV_1_2)) ? \ - ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ - ((hab_rvt_entry_t *)HAB_RVT_ENTRY) \ -) - -#define hab_rvt_exit_p \ -( \ - ((is_cpu_type(MXC_CPU_MX6Q) || \ - is_cpu_type(MXC_CPU_MX6D)) && \ - (soc_rev() >= CHIP_REV_1_5)) ? \ - ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ - (is_cpu_type(MXC_CPU_MX6DL) && \ - (soc_rev() >= CHIP_REV_1_2)) ? \ - ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ - ((hab_rvt_exit_t *)HAB_RVT_EXIT) \ -) - -#define IVT_SIZE 0x20 -#define ALIGN_SIZE 0x1000 -#define CSF_PAD_SIZE 0x2000 -#define MX6DQ_PU_IROM_MMU_EN_VAR 0x009024a8 -#define MX6DLS_PU_IROM_MMU_EN_VAR 0x00901dd0 -#define MX6SL_PU_IROM_MMU_EN_VAR 0x00900a18 - -/* - * +------------+ 0x0 (DDR_UIMAGE_START) - - * | Header | | - * +------------+ 0x40 | - * | | | - * | | | - * | | | - * | | | - * | Image Data | | - * . | | - * . | > Stuff to be authenticated ----+ - * . | | | - * | | | | - * | | | | - * +------------+ | | - * | | | | - * | Fill Data | | | - * | | | | - * +------------+ Align to ALIGN_SIZE | | - * | IVT | | | - * +------------+ + IVT_SIZE - | - * | | | - * | CSF DATA | <---------------------------------------------------------+ - * | | - * +------------+ - * | | - * | Fill Data | - * | | - * +------------+ + CSF_PAD_SIZE - */ - -#define MAX_RECORD_BYTES (8*1024) /* 4 kbytes */ - -struct record { - uint8_t tag; /* Tag */ - uint8_t len[2]; /* Length */ - uint8_t par; /* Version */ - uint8_t contents[MAX_RECORD_BYTES];/* Record Data */ - bool any_rec_flag; -}; - -char *rsn_str[] = {"RSN = HAB_RSN_ANY (0x00)\n", - "RSN = HAB_ENG_FAIL (0x30)\n", - "RSN = HAB_INV_ADDRESS (0x22)\n", - "RSN = HAB_INV_ASSERTION (0x0C)\n", - "RSN = HAB_INV_CALL (0x28)\n", - "RSN = HAB_INV_CERTIFICATE (0x21)\n", - "RSN = HAB_INV_COMMAND (0x06)\n", - "RSN = HAB_INV_CSF (0x11)\n", - "RSN = HAB_INV_DCD (0x27)\n", - "RSN = HAB_INV_INDEX (0x0F)\n", - "RSN = HAB_INV_IVT (0x05)\n", - "RSN = HAB_INV_KEY (0x1D)\n", - "RSN = HAB_INV_RETURN (0x1E)\n", - "RSN = HAB_INV_SIGNATURE (0x18)\n", - "RSN = HAB_INV_SIZE (0x17)\n", - "RSN = HAB_MEM_FAIL (0x2E)\n", - "RSN = HAB_OVR_COUNT (0x2B)\n", - "RSN = HAB_OVR_STORAGE (0x2D)\n", - "RSN = HAB_UNS_ALGORITHM (0x12)\n", - "RSN = HAB_UNS_COMMAND (0x03)\n", - "RSN = HAB_UNS_ENGINE (0x0A)\n", - "RSN = HAB_UNS_ITEM (0x24)\n", - "RSN = HAB_UNS_KEY (0x1B)\n", - "RSN = HAB_UNS_PROTOCOL (0x14)\n", - "RSN = HAB_UNS_STATE (0x09)\n", - "RSN = INVALID\n", - NULL}; - -char *sts_str[] = {"STS = HAB_SUCCESS (0xF0)\n", - "STS = HAB_FAILURE (0x33)\n", - "STS = HAB_WARNING (0x69)\n", - "STS = INVALID\n", - NULL}; - -char *eng_str[] = {"ENG = HAB_ENG_ANY (0x00)\n", - "ENG = HAB_ENG_SCC (0x03)\n", - "ENG = HAB_ENG_RTIC (0x05)\n", - "ENG = HAB_ENG_SAHARA (0x06)\n", - "ENG = HAB_ENG_CSU (0x0A)\n", - "ENG = HAB_ENG_SRTC (0x0C)\n", - "ENG = HAB_ENG_DCP (0x1B)\n", - "ENG = HAB_ENG_CAAM (0x1D)\n", - "ENG = HAB_ENG_SNVS (0x1E)\n", - "ENG = HAB_ENG_OCOTP (0x21)\n", - "ENG = HAB_ENG_DTCP (0x22)\n", - "ENG = HAB_ENG_ROM (0x36)\n", - "ENG = HAB_ENG_HDCP (0x24)\n", - "ENG = HAB_ENG_RTL (0x77)\n", - "ENG = HAB_ENG_SW (0xFF)\n", - "ENG = INVALID\n", - NULL}; - -char *ctx_str[] = {"CTX = HAB_CTX_ANY(0x00)\n", - "CTX = HAB_CTX_FAB (0xFF)\n", - "CTX = HAB_CTX_ENTRY (0xE1)\n", - "CTX = HAB_CTX_TARGET (0x33)\n", - "CTX = HAB_CTX_AUTHENTICATE (0x0A)\n", - "CTX = HAB_CTX_DCD (0xDD)\n", - "CTX = HAB_CTX_CSF (0xCF)\n", - "CTX = HAB_CTX_COMMAND (0xC0)\n", - "CTX = HAB_CTX_AUT_DAT (0xDB)\n", - "CTX = HAB_CTX_ASSERT (0xA0)\n", - "CTX = HAB_CTX_EXIT (0xEE)\n", - "CTX = INVALID\n", - NULL}; - -uint8_t hab_statuses[5] = { - HAB_STS_ANY, - HAB_FAILURE, - HAB_WARNING, - HAB_SUCCESS, - -1 -}; - -uint8_t hab_reasons[26] = { - HAB_RSN_ANY, - HAB_ENG_FAIL, - HAB_INV_ADDRESS, - HAB_INV_ASSERTION, - HAB_INV_CALL, - HAB_INV_CERTIFICATE, - HAB_INV_COMMAND, - HAB_INV_CSF, - HAB_INV_DCD, - HAB_INV_INDEX, - HAB_INV_IVT, - HAB_INV_KEY, - HAB_INV_RETURN, - HAB_INV_SIGNATURE, - HAB_INV_SIZE, - HAB_MEM_FAIL, - HAB_OVR_COUNT, - HAB_OVR_STORAGE, - HAB_UNS_ALGORITHM, - HAB_UNS_COMMAND, - HAB_UNS_ENGINE, - HAB_UNS_ITEM, - HAB_UNS_KEY, - HAB_UNS_PROTOCOL, - HAB_UNS_STATE, - -1 -}; - -uint8_t hab_contexts[12] = { - HAB_CTX_ANY, - HAB_CTX_FAB, - HAB_CTX_ENTRY, - HAB_CTX_TARGET, - HAB_CTX_AUTHENTICATE, - HAB_CTX_DCD, - HAB_CTX_CSF, - HAB_CTX_COMMAND, - HAB_CTX_AUT_DAT, - HAB_CTX_ASSERT, - HAB_CTX_EXIT, - -1 -}; - -uint8_t hab_engines[16] = { - HAB_ENG_ANY, - HAB_ENG_SCC, - HAB_ENG_RTIC, - HAB_ENG_SAHARA, - HAB_ENG_CSU, - HAB_ENG_SRTC, - HAB_ENG_DCP, - HAB_ENG_CAAM, - HAB_ENG_SNVS, - HAB_ENG_OCOTP, - HAB_ENG_DTCP, - HAB_ENG_ROM, - HAB_ENG_HDCP, - HAB_ENG_RTL, - HAB_ENG_SW, - -1 -}; - -bool is_hab_enabled(void) -{ - struct ocotp_regs *ocotp = (struct ocotp_regs *)OCOTP_BASE_ADDR; - struct fuse_bank *bank = &ocotp->bank[0]; - struct fuse_bank0_regs *fuse = - (struct fuse_bank0_regs *)bank->fuse_regs; - uint32_t reg = readl(&fuse->cfg5); - - return (reg & 0x2) == 0x2; -} - -static inline uint8_t get_idx(uint8_t *list, uint8_t tgt) -{ - uint8_t idx = 0; - uint8_t element = list[idx]; - while (element != -1) { - if (element == tgt) - return idx; - element = list[++idx]; - } - return -1; -} - -void process_event_record(uint8_t *event_data, size_t bytes) -{ - struct record *rec = (struct record *)event_data; - - printf("\n\n%s", sts_str[get_idx(hab_statuses, rec->contents[0])]); - printf("%s", rsn_str[get_idx(hab_reasons, rec->contents[1])]); - printf("%s", ctx_str[get_idx(hab_contexts, rec->contents[2])]); - printf("%s", eng_str[get_idx(hab_engines, rec->contents[3])]); -} - -void display_event(uint8_t *event_data, size_t bytes) -{ - uint32_t i; - - if (!(event_data && bytes > 0)) - return; - - for (i = 0; i < bytes; i++) { - if (i == 0) - printf("\t0x%02x", event_data[i]); - else if ((i % 8) == 0) - printf("\n\t0x%02x", event_data[i]); - else - printf(" 0x%02x", event_data[i]); - } - - process_event_record(event_data, bytes); -} - -int get_hab_status(void) -{ - uint32_t index = 0; /* Loop index */ - uint8_t event_data[128]; /* Event data buffer */ - size_t bytes = sizeof(event_data); /* Event size in bytes */ - enum hab_config config = 0; - enum hab_state state = 0; - hab_rvt_report_event_t *hab_rvt_report_event; - hab_rvt_report_status_t *hab_rvt_report_status; - - hab_rvt_report_event = hab_rvt_report_event_p; - hab_rvt_report_status = hab_rvt_report_status_p; - - if (is_hab_enabled()) - puts("\nSecure boot enabled\n"); - else - puts("\nSecure boot disabled\n"); - - /* Check HAB status */ - if (hab_rvt_report_status(&config, &state) != HAB_SUCCESS) { - printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", - config, state); - - /* Display HAB Error events */ - while (hab_rvt_report_event(HAB_FAILURE, index, event_data, - &bytes) == HAB_SUCCESS) { - puts("\n"); - printf("--------- HAB Event %d -----------------\n", - index + 1); - puts("event data:\n"); - display_event(event_data, bytes); - puts("\n"); - bytes = sizeof(event_data); - index++; - } - } - /* Display message if no HAB events are found */ - else { - printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", - config, state); - puts("No HAB Events Found!\n\n"); - } - return 0; -} - -uint32_t authenticate_image(uint32_t ddr_start, uint32_t image_size) -{ - uint32_t load_addr = 0; - size_t bytes; - ptrdiff_t ivt_offset = 0; - int result = 0; - ulong start; - hab_rvt_authenticate_image_t *hab_rvt_authenticate_image; - hab_rvt_entry_t *hab_rvt_entry; - hab_rvt_exit_t *hab_rvt_exit; - - hab_rvt_authenticate_image = hab_rvt_authenticate_image_p; - hab_rvt_entry = hab_rvt_entry_p; - hab_rvt_exit = hab_rvt_exit_p; - - if (is_hab_enabled()) { - printf("\nAuthenticate image from DDR location 0x%x...\n", - ddr_start); - - hab_caam_clock_enable(1); - - if (hab_rvt_entry() == HAB_SUCCESS) { - /* If not already aligned, Align to ALIGN_SIZE */ - ivt_offset = (image_size + ALIGN_SIZE - 1) & - ~(ALIGN_SIZE - 1); - - start = ddr_start; - bytes = ivt_offset + IVT_SIZE + CSF_PAD_SIZE; -#ifdef DEBUG - printf("\nivt_offset = 0x%x, ivt addr = 0x%x\n", - ivt_offset, ddr_start + ivt_offset); - puts("Dumping IVT\n"); - print_buffer(ddr_start + ivt_offset, - (void *)(ddr_start + ivt_offset), - 4, 0x8, 0); - - puts("Dumping CSF Header\n"); - print_buffer(ddr_start + ivt_offset+IVT_SIZE, - (void *)(ddr_start + ivt_offset+IVT_SIZE), - 4, 0x10, 0); - - get_hab_status(); - - puts("\nCalling authenticate_image in ROM\n"); - printf("\tivt_offset = 0x%x\n", ivt_offset); - printf("\tstart = 0x%08lx\n", start); - printf("\tbytes = 0x%x\n", bytes); -#endif - /* - * If the MMU is enabled, we have to notify the ROM - * code, or it won't flush the caches when needed. - * This is done, by setting the "pu_irom_mmu_enabled" - * word to 1. You can find its address by looking in - * the ROM map. This is critical for - * authenticate_image(). If MMU is enabled, without - * setting this bit, authentication will fail and may - * crash. - */ - /* Check MMU enabled */ - if (get_cr() & CR_M) { - if (is_cpu_type(MXC_CPU_MX6Q) || - is_cpu_type(MXC_CPU_MX6D)) { - /* - * This won't work on Rev 1.0.0 of - * i.MX6Q/D, since their ROM doesn't - * do cache flushes. don't think any - * exist, so we ignore them. - */ - if (!is_mx6dqp()) - writel(1, MX6DQ_PU_IROM_MMU_EN_VAR); - } else if (is_cpu_type(MXC_CPU_MX6DL) || - is_cpu_type(MXC_CPU_MX6SOLO)) { - writel(1, MX6DLS_PU_IROM_MMU_EN_VAR); - } else if (is_cpu_type(MXC_CPU_MX6SL)) { - writel(1, MX6SL_PU_IROM_MMU_EN_VAR); - } - } - - load_addr = (uint32_t)hab_rvt_authenticate_image( - HAB_CID_UBOOT, - ivt_offset, (void **)&start, - (size_t *)&bytes, NULL); - if (hab_rvt_exit() != HAB_SUCCESS) { - puts("hab exit function fail\n"); - load_addr = 0; - } - } else { - puts("hab entry function fail\n"); - } - - hab_caam_clock_enable(0); - - get_hab_status(); - } else { - puts("hab fuse not enabled\n"); - } - - if ((!is_hab_enabled()) || (load_addr != 0)) - result = 1; - - return result; -} - -int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) -{ - if ((argc != 1)) { - cmd_usage(cmdtp); - return 1; - } - - get_hab_status(); - - return 0; -} - -static int do_authenticate_image(cmd_tbl_t *cmdtp, int flag, int argc, - char * const argv[]) -{ - ulong addr, ivt_offset; - int rcode = 0; - - if (argc < 3) - return CMD_RET_USAGE; - - addr = simple_strtoul(argv[1], NULL, 16); - ivt_offset = simple_strtoul(argv[2], NULL, 16); - - rcode = authenticate_image(addr, ivt_offset); - - return rcode; -} - -U_BOOT_CMD( - hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status, - "display HAB status", - "" - ); - -U_BOOT_CMD( - hab_auth_img, 3, 0, do_authenticate_image, - "authenticate image via HAB", - "addr ivt_offset\n" - "addr - image hex address\n" - "ivt_offset - hex offset of IVT in the image" - ); diff --git a/arch/arm/imx-common/Makefile b/arch/arm/imx-common/Makefile index 1698d06..4abffee 100644 --- a/arch/arm/imx-common/Makefile +++ b/arch/arm/imx-common/Makefile @@ -27,6 +27,7 @@ ifeq ($(SOC),$(filter $(SOC),mx6 mx7)) obj-y += cache.o init.o obj-$(CONFIG_CMD_SATA) += sata.o obj-$(CONFIG_IMX_VIDEO_SKIP) += video.o +obj-$(CONFIG_SECURE_BOOT) += hab.o endif ifeq ($(SOC),$(filter $(SOC),vf610)) obj-y += ddrmc-vf610.o diff --git a/arch/arm/imx-common/hab.c b/arch/arm/imx-common/hab.c new file mode 100644 index 0000000..4386e29 --- /dev/null +++ b/arch/arm/imx-common/hab.c @@ -0,0 +1,515 @@ +/* + * Copyright (C) 2015 Freescale Semiconductor, Inc. + * + * SPDX-License-Identifier: GPL-2.0+ + */ + +#include <common.h> +#include <imx_hab.h> +#include <asm/io.h> +#include <asm/system.h> +#include <asm/arch/clock.h> +#include <asm/arch/sys_proto.h> + +/* -------- start of HAB API updates ------------*/ + +#define hab_rvt_report_event_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || \ + is_cpu_type(MXC_CPU_MX6D)) && \ + (soc_rev() >= CHIP_REV_1_5)) ? \ + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ + (is_cpu_type(MXC_CPU_MX6DL) && \ + (soc_rev() >= CHIP_REV_1_2)) ? \ + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT) \ +) + +#define hab_rvt_report_status_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || \ + is_cpu_type(MXC_CPU_MX6D)) && \ + (soc_rev() >= CHIP_REV_1_5)) ? \ + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ + (is_cpu_type(MXC_CPU_MX6DL) && \ + (soc_rev() >= CHIP_REV_1_2)) ? \ + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) \ +) + +#define hab_rvt_authenticate_image_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || \ + is_cpu_type(MXC_CPU_MX6D)) && \ + (soc_rev() >= CHIP_REV_1_5)) ? \ + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ + (is_cpu_type(MXC_CPU_MX6DL) && \ + (soc_rev() >= CHIP_REV_1_2)) ? \ + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) \ +) + +#define hab_rvt_entry_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || \ + is_cpu_type(MXC_CPU_MX6D)) && \ + (soc_rev() >= CHIP_REV_1_5)) ? \ + ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ + (is_cpu_type(MXC_CPU_MX6DL) && \ + (soc_rev() >= CHIP_REV_1_2)) ? \ + ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ + ((hab_rvt_entry_t *)HAB_RVT_ENTRY) \ +) + +#define hab_rvt_exit_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || \ + is_cpu_type(MXC_CPU_MX6D)) && \ + (soc_rev() >= CHIP_REV_1_5)) ? \ + ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ + (is_cpu_type(MXC_CPU_MX6DL) && \ + (soc_rev() >= CHIP_REV_1_2)) ? \ + ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ + ((hab_rvt_exit_t *)HAB_RVT_EXIT) \ +) + +#define IVT_SIZE 0x20 +#define ALIGN_SIZE 0x1000 +#define CSF_PAD_SIZE 0x2000 +#define MX6DQ_PU_IROM_MMU_EN_VAR 0x009024a8 +#define MX6DLS_PU_IROM_MMU_EN_VAR 0x00901dd0 +#define MX6SL_PU_IROM_MMU_EN_VAR 0x00900a18 + +/* + * +------------+ 0x0 (DDR_UIMAGE_START) - + * | Header | | + * +------------+ 0x40 | + * | | | + * | | | + * | | | + * | | | + * | Image Data | | + * . | | + * . | > Stuff to be authenticated ----+ + * . | | | + * | | | | + * | | | | + * +------------+ | | + * | | | | + * | Fill Data | | | + * | | | | + * +------------+ Align to ALIGN_SIZE | | + * | IVT | | | + * +------------+ + IVT_SIZE - | + * | | | + * | CSF DATA | <---------------------------------------------------------+ + * | | + * +------------+ + * | | + * | Fill Data | + * | | + * +------------+ + CSF_PAD_SIZE + */ + +#define MAX_RECORD_BYTES (8*1024) /* 4 kbytes */ + +struct record { + uint8_t tag; /* Tag */ + uint8_t len[2]; /* Length */ + uint8_t par; /* Version */ + uint8_t contents[MAX_RECORD_BYTES];/* Record Data */ + bool any_rec_flag; +}; + +char *rsn_str[] = {"RSN = HAB_RSN_ANY (0x00)\n", + "RSN = HAB_ENG_FAIL (0x30)\n", + "RSN = HAB_INV_ADDRESS (0x22)\n", + "RSN = HAB_INV_ASSERTION (0x0C)\n", + "RSN = HAB_INV_CALL (0x28)\n", + "RSN = HAB_INV_CERTIFICATE (0x21)\n", + "RSN = HAB_INV_COMMAND (0x06)\n", + "RSN = HAB_INV_CSF (0x11)\n", + "RSN = HAB_INV_DCD (0x27)\n", + "RSN = HAB_INV_INDEX (0x0F)\n", + "RSN = HAB_INV_IVT (0x05)\n", + "RSN = HAB_INV_KEY (0x1D)\n", + "RSN = HAB_INV_RETURN (0x1E)\n", + "RSN = HAB_INV_SIGNATURE (0x18)\n", + "RSN = HAB_INV_SIZE (0x17)\n", + "RSN = HAB_MEM_FAIL (0x2E)\n", + "RSN = HAB_OVR_COUNT (0x2B)\n", + "RSN = HAB_OVR_STORAGE (0x2D)\n", + "RSN = HAB_UNS_ALGORITHM (0x12)\n", + "RSN = HAB_UNS_COMMAND (0x03)\n", + "RSN = HAB_UNS_ENGINE (0x0A)\n", + "RSN = HAB_UNS_ITEM (0x24)\n", + "RSN = HAB_UNS_KEY (0x1B)\n", + "RSN = HAB_UNS_PROTOCOL (0x14)\n", + "RSN = HAB_UNS_STATE (0x09)\n", + "RSN = INVALID\n", + NULL}; + +char *sts_str[] = {"STS = HAB_SUCCESS (0xF0)\n", + "STS = HAB_FAILURE (0x33)\n", + "STS = HAB_WARNING (0x69)\n", + "STS = INVALID\n", + NULL}; + +char *eng_str[] = {"ENG = HAB_ENG_ANY (0x00)\n", + "ENG = HAB_ENG_SCC (0x03)\n", + "ENG = HAB_ENG_RTIC (0x05)\n", + "ENG = HAB_ENG_SAHARA (0x06)\n", + "ENG = HAB_ENG_CSU (0x0A)\n", + "ENG = HAB_ENG_SRTC (0x0C)\n", + "ENG = HAB_ENG_DCP (0x1B)\n", + "ENG = HAB_ENG_CAAM (0x1D)\n", + "ENG = HAB_ENG_SNVS (0x1E)\n", + "ENG = HAB_ENG_OCOTP (0x21)\n", + "ENG = HAB_ENG_DTCP (0x22)\n", + "ENG = HAB_ENG_ROM (0x36)\n", + "ENG = HAB_ENG_HDCP (0x24)\n", + "ENG = HAB_ENG_RTL (0x77)\n", + "ENG = HAB_ENG_SW (0xFF)\n", + "ENG = INVALID\n", + NULL}; + +char *ctx_str[] = {"CTX = HAB_CTX_ANY(0x00)\n", + "CTX = HAB_CTX_FAB (0xFF)\n", + "CTX = HAB_CTX_ENTRY (0xE1)\n", + "CTX = HAB_CTX_TARGET (0x33)\n", + "CTX = HAB_CTX_AUTHENTICATE (0x0A)\n", + "CTX = HAB_CTX_DCD (0xDD)\n", + "CTX = HAB_CTX_CSF (0xCF)\n", + "CTX = HAB_CTX_COMMAND (0xC0)\n", + "CTX = HAB_CTX_AUT_DAT (0xDB)\n", + "CTX = HAB_CTX_ASSERT (0xA0)\n", + "CTX = HAB_CTX_EXIT (0xEE)\n", + "CTX = INVALID\n", + NULL}; + +uint8_t hab_statuses[5] = { + HAB_STS_ANY, + HAB_FAILURE, + HAB_WARNING, + HAB_SUCCESS, + -1 +}; + +uint8_t hab_reasons[26] = { + HAB_RSN_ANY, + HAB_ENG_FAIL, + HAB_INV_ADDRESS, + HAB_INV_ASSERTION, + HAB_INV_CALL, + HAB_INV_CERTIFICATE, + HAB_INV_COMMAND, + HAB_INV_CSF, + HAB_INV_DCD, + HAB_INV_INDEX, + HAB_INV_IVT, + HAB_INV_KEY, + HAB_INV_RETURN, + HAB_INV_SIGNATURE, + HAB_INV_SIZE, + HAB_MEM_FAIL, + HAB_OVR_COUNT, + HAB_OVR_STORAGE, + HAB_UNS_ALGORITHM, + HAB_UNS_COMMAND, + HAB_UNS_ENGINE, + HAB_UNS_ITEM, + HAB_UNS_KEY, + HAB_UNS_PROTOCOL, + HAB_UNS_STATE, + -1 +}; + +uint8_t hab_contexts[12] = { + HAB_CTX_ANY, + HAB_CTX_FAB, + HAB_CTX_ENTRY, + HAB_CTX_TARGET, + HAB_CTX_AUTHENTICATE, + HAB_CTX_DCD, + HAB_CTX_CSF, + HAB_CTX_COMMAND, + HAB_CTX_AUT_DAT, + HAB_CTX_ASSERT, + HAB_CTX_EXIT, + -1 +}; + +uint8_t hab_engines[16] = { + HAB_ENG_ANY, + HAB_ENG_SCC, + HAB_ENG_RTIC, + HAB_ENG_SAHARA, + HAB_ENG_CSU, + HAB_ENG_SRTC, + HAB_ENG_DCP, + HAB_ENG_CAAM, + HAB_ENG_SNVS, + HAB_ENG_OCOTP, + HAB_ENG_DTCP, + HAB_ENG_ROM, + HAB_ENG_HDCP, + HAB_ENG_RTL, + HAB_ENG_SW, + -1 +}; + +bool is_hab_enabled(void) +{ + struct ocotp_regs *ocotp = (struct ocotp_regs *)OCOTP_BASE_ADDR; + uint32_t reg; +#if CONFIG_MX7 + struct fuse_bank *bank = &ocotp->bank[1]; + struct fuse_bank1_regs *fuse = + (struct fuse_bank1_regs *)bank->fuse_regs; + reg = readl(&fuse->cfg0); +#elif CONFIG_MX6 + struct fuse_bank *bank = &ocotp->bank[0]; + struct fuse_bank0_regs *fuse = + (struct fuse_bank0_regs *)bank->fuse_regs; + reg = readl(&fuse->cfg5); +#endif + + if (is_soc_type(MXC_SOC_MX7)) + return (reg & 0x2000000) == 0x2000000; + else if (is_soc_type(MXC_SOC_MX6)) + return (reg & 0x2) == 0x2; + + return 0; +} + +static inline uint8_t get_idx(uint8_t *list, uint8_t tgt) +{ + uint8_t idx = 0; + uint8_t element = list[idx]; + while (element != -1) { + if (element == tgt) + return idx; + element = list[++idx]; + } + return -1; +} + +void process_event_record(uint8_t *event_data, size_t bytes) +{ + struct record *rec = (struct record *)event_data; + + printf("\n\n%s", sts_str[get_idx(hab_statuses, rec->contents[0])]); + printf("%s", rsn_str[get_idx(hab_reasons, rec->contents[1])]); + printf("%s", ctx_str[get_idx(hab_contexts, rec->contents[2])]); + printf("%s", eng_str[get_idx(hab_engines, rec->contents[3])]); +} + +void display_event(uint8_t *event_data, size_t bytes) +{ + uint32_t i; + + if (!(event_data && bytes > 0)) + return; + + for (i = 0; i < bytes; i++) { + if (i == 0) + printf("\t0x%02x", event_data[i]); + else if ((i % 8) == 0) + printf("\n\t0x%02x", event_data[i]); + else + printf(" 0x%02x", event_data[i]); + } + + process_event_record(event_data, bytes); +} + +int get_hab_status(void) +{ + uint32_t index = 0; /* Loop index */ + uint8_t event_data[128]; /* Event data buffer */ + size_t bytes = sizeof(event_data); /* Event size in bytes */ + enum hab_config config = 0; + enum hab_state state = 0; + hab_rvt_report_event_t *hab_rvt_report_event; + hab_rvt_report_status_t *hab_rvt_report_status; + + hab_rvt_report_event = hab_rvt_report_event_p; + hab_rvt_report_status = hab_rvt_report_status_p; + + if (is_hab_enabled()) + puts("\nSecure boot enabled\n"); + else + puts("\nSecure boot disabled\n"); + + /* Check HAB status */ + if (hab_rvt_report_status(&config, &state) != HAB_SUCCESS) { + printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", + config, state); + + /* Display HAB Error events */ + while (hab_rvt_report_event(HAB_FAILURE, index, event_data, + &bytes) == HAB_SUCCESS) { + puts("\n"); + printf("--------- HAB Event %d -----------------\n", + index + 1); + puts("event data:\n"); + display_event(event_data, bytes); + puts("\n"); + bytes = sizeof(event_data); + index++; + } + } + /* Display message if no HAB events are found */ + else { + printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", + config, state); + puts("No HAB Events Found!\n\n"); + } + return 0; +} + +uint32_t authenticate_image(uint32_t ddr_start, uint32_t image_size) +{ + uint32_t load_addr = 0; + size_t bytes; + ptrdiff_t ivt_offset = 0; + int result = 0; + ulong start; + hab_rvt_authenticate_image_t *hab_rvt_authenticate_image; + hab_rvt_entry_t *hab_rvt_entry; + hab_rvt_exit_t *hab_rvt_exit; + + hab_rvt_authenticate_image = hab_rvt_authenticate_image_p; + hab_rvt_entry = hab_rvt_entry_p; + hab_rvt_exit = hab_rvt_exit_p; + + if (is_hab_enabled()) { + printf("\nAuthenticate image from DDR location 0x%x...\n", + ddr_start); + + hab_caam_clock_enable(1); + + if (hab_rvt_entry() == HAB_SUCCESS) { + /* If not already aligned, Align to ALIGN_SIZE */ + ivt_offset = (image_size + ALIGN_SIZE - 1) & + ~(ALIGN_SIZE - 1); + + start = ddr_start; + bytes = ivt_offset + IVT_SIZE + CSF_PAD_SIZE; +#ifdef DEBUG + printf("\nivt_offset = 0x%x, ivt addr = 0x%x\n", + ivt_offset, ddr_start + ivt_offset); + puts("Dumping IVT\n"); + print_buffer(ddr_start + ivt_offset, + (void *)(ddr_start + ivt_offset), + 4, 0x8, 0); + + puts("Dumping CSF Header\n"); + print_buffer(ddr_start + ivt_offset+IVT_SIZE, + (void *)(ddr_start + ivt_offset+IVT_SIZE), + 4, 0x10, 0); + + get_hab_status(); + + puts("\nCalling authenticate_image in ROM\n"); + printf("\tivt_offset = 0x%x\n", ivt_offset); + printf("\tstart = 0x%08lx\n", start); + printf("\tbytes = 0x%x\n", bytes); +#endif + /* + * If the MMU is enabled, we have to notify the ROM + * code, or it won't flush the caches when needed. + * This is done, by setting the "pu_irom_mmu_enabled" + * word to 1. You can find its address by looking in + * the ROM map. This is critical for + * authenticate_image(). If MMU is enabled, without + * setting this bit, authentication will fail and may + * crash. + */ + if (is_soc_type(MXC_SOC_MX6) && (get_cr() & CR_M)) { + /* Check MMU enabled */ + if (is_cpu_type(MXC_CPU_MX6Q) || + is_cpu_type(MXC_CPU_MX6D)) { + /* + * This won't work on Rev 1.0.0 of + * i.MX6Q/D, since their ROM doesn't + * do cache flushes. don't think any + * exist, so we ignore them. + */ + if (!is_mx6dqp()) + writel(1, MX6DQ_PU_IROM_MMU_EN_VAR); + } else if (is_cpu_type(MXC_CPU_MX6DL) || + is_cpu_type(MXC_CPU_MX6SOLO)) { + writel(1, MX6DLS_PU_IROM_MMU_EN_VAR); + } else if (is_cpu_type(MXC_CPU_MX6SL)) { + writel(1, MX6SL_PU_IROM_MMU_EN_VAR); + } + } + + load_addr = (uint32_t)hab_rvt_authenticate_image( + HAB_CID_UBOOT, + ivt_offset, (void **)&start, + (size_t *)&bytes, NULL); + if (hab_rvt_exit() != HAB_SUCCESS) { + puts("hab exit function fail\n"); + load_addr = 0; + } + } else { + puts("hab entry function fail\n"); + } + + hab_caam_clock_enable(0); + + get_hab_status(); + } else { + puts("hab fuse not enabled\n"); + } + + if ((!is_hab_enabled()) || (load_addr != 0)) + result = 1; + + return result; +} + +int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) +{ + if ((argc != 1)) { + cmd_usage(cmdtp); + return 1; + } + + get_hab_status(); + + return 0; +} + +static int do_authenticate_image(cmd_tbl_t *cmdtp, int flag, int argc, + char * const argv[]) +{ + ulong addr, ivt_offset; + int rcode = 0; + + if (argc < 3) + return CMD_RET_USAGE; + + addr = simple_strtoul(argv[1], NULL, 16); + ivt_offset = simple_strtoul(argv[2], NULL, 16); + + rcode = authenticate_image(addr, ivt_offset); + + return rcode; +} + +U_BOOT_CMD( + hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status, + "display HAB status", + "" + ); + +U_BOOT_CMD( + hab_auth_img, 3, 0, do_authenticate_image, + "authenticate image via HAB", + "addr ivt_offset\n" + "addr - image hex address\n" + "ivt_offset - hex offset of IVT in the image" + ); diff --git a/include/imx_hab.h b/include/imx_hab.h new file mode 100644 index 0000000..3579292 --- /dev/null +++ b/include/imx_hab.h @@ -0,0 +1,140 @@ +/* + * Copyright (C) 2015 Freescale Semiconductor, Inc. All Rights Reserved. + * + * SPDX-License-Identifier: GPL-2.0+ + * +*/ + +#ifndef __SECURE_IMX_H__ +#define __SECURE_IMX_H__ + +#include <linux/types.h> + +/* -------- start of HAB API updates ------------*/ +/* The following are taken from HAB4 SIS */ + +/* Status definitions */ +enum hab_status { + HAB_STS_ANY = 0x00, + HAB_FAILURE = 0x33, + HAB_WARNING = 0x69, + HAB_SUCCESS = 0xf0 +}; + +/* Security Configuration definitions */ +enum hab_config { + HAB_CFG_RETURN = 0x33, /**< Field Return IC */ + HAB_CFG_OPEN = 0xf0, /**< Non-secure IC */ + HAB_CFG_CLOSED = 0xcc /**< Secure IC */ +}; + +/* State definitions */ +enum hab_state { + HAB_STATE_INITIAL = 0x33, /**< Initialising state (transitory) */ + HAB_STATE_CHECK = 0x55, /**< Check state (non-secure) */ + HAB_STATE_NONSECURE = 0x66, /**< Non-secure state */ + HAB_STATE_TRUSTED = 0x99, /**< Trusted state */ + HAB_STATE_SECURE = 0xaa, /**< Secure state */ + HAB_STATE_FAIL_SOFT = 0xcc, /**< Soft fail state */ + HAB_STATE_FAIL_HARD = 0xff, /**< Hard fail state (terminal) */ + HAB_STATE_NONE = 0xf0, /**< No security state machine */ + HAB_STATE_MAX +}; + +enum hab_reason { + HAB_RSN_ANY = 0x00, /* Match any reason */ + HAB_ENG_FAIL = 0x30, /* Engine failure */ + HAB_INV_ADDRESS = 0x22, /* Invalid address: access denied */ + HAB_INV_ASSERTION = 0x0c, /* Invalid assertion */ + HAB_INV_CALL = 0x28, /* Function called out of sequence */ + HAB_INV_CERTIFICATE = 0x21, /* Invalid certificate */ + HAB_INV_COMMAND = 0x06, /* Invalid command: command malformed */ + HAB_INV_CSF = 0x11, /* Invalid csf */ + HAB_INV_DCD = 0x27, /* Invalid dcd */ + HAB_INV_INDEX = 0x0f, /* Invalid index: access denied */ + HAB_INV_IVT = 0x05, /* Invalid ivt */ + HAB_INV_KEY = 0x1d, /* Invalid key */ + HAB_INV_RETURN = 0x1e, /* Failed callback function */ + HAB_INV_SIGNATURE = 0x18, /* Invalid signature */ + HAB_INV_SIZE = 0x17, /* Invalid data size */ + HAB_MEM_FAIL = 0x2e, /* Memory failure */ + HAB_OVR_COUNT = 0x2b, /* Expired poll count */ + HAB_OVR_STORAGE = 0x2d, /* Exhausted storage region */ + HAB_UNS_ALGORITHM = 0x12, /* Unsupported algorithm */ + HAB_UNS_COMMAND = 0x03, /* Unsupported command */ + HAB_UNS_ENGINE = 0x0a, /* Unsupported engine */ + HAB_UNS_ITEM = 0x24, /* Unsupported configuration item */ + HAB_UNS_KEY = 0x1b, /* Unsupported key type/parameters */ + HAB_UNS_PROTOCOL = 0x14, /* Unsupported protocol */ + HAB_UNS_STATE = 0x09, /* Unsuitable state */ + HAB_RSN_MAX +}; + +enum hab_context { + HAB_CTX_ANY = 0x00, /* Match any context */ + HAB_CTX_FAB = 0xff, /* Event logged in hab_fab_test() */ + HAB_CTX_ENTRY = 0xe1, /* Event logged in hab_rvt.entry() */ + HAB_CTX_TARGET = 0x33, /* Event logged in hab_rvt.check_target() */ + HAB_CTX_AUTHENTICATE = 0x0a, /* Logged in hab_rvt.authenticate_image() */ + HAB_CTX_DCD = 0xdd, /* Event logged in hab_rvt.run_dcd() */ + HAB_CTX_CSF = 0xcf, /* Event logged in hab_rvt.run_csf() */ + HAB_CTX_COMMAND = 0xc0, /* Event logged executing csf/dcd command */ + HAB_CTX_AUT_DAT = 0xdb, /* Authenticated data block */ + HAB_CTX_ASSERT = 0xa0, /* Event logged in hab_rvt.assert() */ + HAB_CTX_EXIT = 0xee, /* Event logged in hab_rvt.exit() */ + HAB_CTX_MAX +}; + +/*Function prototype description*/ +typedef enum hab_status hab_rvt_report_event_t(enum hab_status, uint32_t, + uint8_t* , size_t*); +typedef enum hab_status hab_rvt_report_status_t(enum hab_config *, + enum hab_state *); +typedef enum hab_status hab_loader_callback_f_t(void**, size_t*, const void*); +typedef enum hab_status hab_rvt_entry_t(void); +typedef enum hab_status hab_rvt_exit_t(void); +typedef void *hab_rvt_authenticate_image_t(uint8_t, ptrdiff_t, + void **, size_t *, hab_loader_callback_f_t); +typedef void hapi_clock_init_t(void); + +#define HAB_ENG_ANY 0x00 /* Select first compatible engine */ +#define HAB_ENG_SCC 0x03 /* Security controller */ +#define HAB_ENG_RTIC 0x05 /* Run-time integrity checker */ +#define HAB_ENG_SAHARA 0x06 /* Crypto accelerator */ +#define HAB_ENG_CSU 0x0a /* Central Security Unit */ +#define HAB_ENG_SRTC 0x0c /* Secure clock */ +#define HAB_ENG_DCP 0x1b /* Data Co-Processor */ +#define HAB_ENG_CAAM 0x1d /* CAAM */ +#define HAB_ENG_SNVS 0x1e /* Secure Non-Volatile Storage */ +#define HAB_ENG_OCOTP 0x21 /* Fuse controller */ +#define HAB_ENG_DTCP 0x22 /* DTCP co-processor */ +#define HAB_ENG_ROM 0x36 /* Protected ROM area */ +#define HAB_ENG_HDCP 0x24 /* HDCP co-processor */ +#define HAB_ENG_RTL 0x77 /* RTL simulation engine */ +#define HAB_ENG_SW 0xff /* Software engine */ + +#if defined(CONFIG_MX6SX) || defined(CONFIG_MX7D) +#define HAB_RVT_UNIFIED_BASE 0x00000100 +#else +#define HAB_RVT_UNIFIED_BASE 0x00000094 +#endif + +#define HAB_RVT_ENTRY (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x04)) +#define HAB_RVT_EXIT (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x08)) +#define HAB_RVT_AUTHENTICATE_IMAGE (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x10)) +#define HAB_RVT_REPORT_EVENT (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x20)) +#define HAB_RVT_REPORT_STATUS (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x24)) + +#define HAB_RVT_REPORT_EVENT_NEW (*(uint32_t *)0x000000B8) +#define HAB_RVT_REPORT_STATUS_NEW (*(uint32_t *)0x000000BC) +#define HAB_RVT_AUTHENTICATE_IMAGE_NEW (*(uint32_t *)0x000000A8) +#define HAB_RVT_ENTRY_NEW (*(uint32_t *)0x0000009C) +#define HAB_RVT_EXIT_NEW (*(uint32_t *)0x000000A0) + +#define HAB_RVT_CLOCK_INIT ((hapi_clock_init_t *)0x0000024D) + +#define HAB_CID_ROM 0 /**< ROM Caller ID */ +#define HAB_CID_UBOOT 1 /**< UBOOT Caller ID*/ +/* ----------- end of HAB API updates ------------*/ + +#endif -- 2.1.4 ^ permalink raw reply related [flat|nested] 4+ messages in thread
* [U-Boot] [PATCH 2/3] hab: rework support for imx6/imx7 2015-09-21 20:44 ` [U-Boot] [PATCH 2/3] hab: rework support for imx6/imx7 Adrian Alonso @ 2015-09-29 12:32 ` Stefano Babic 0 siblings, 0 replies; 4+ messages in thread From: Stefano Babic @ 2015-09-29 12:32 UTC (permalink / raw) To: u-boot Hi Adrian, On 21/09/2015 22:44, Adrian Alonso wrote: > Signed-off-by: Adrian Alonso <aalonso@freescale.com> > --- > arch/arm/cpu/armv7/mx6/Makefile | 1 - > arch/arm/cpu/armv7/mx6/hab.c | 502 --------------------------------------- > arch/arm/imx-common/Makefile | 1 + > arch/arm/imx-common/hab.c | 515 ++++++++++++++++++++++++++++++++++++++++ > include/imx_hab.h | 140 +++++++++++ > 5 files changed, 656 insertions(+), 503 deletions(-) > delete mode 100644 arch/arm/cpu/armv7/mx6/hab.c > create mode 100644 arch/arm/imx-common/hab.c > create mode 100644 include/imx_hab.h > I find nice that cod in hab.c is factorized, but merging this together with the changes for mx7 makes a review difficult and does not allow a real diff between version. I will propose you split this patch in two parts: - first patch simply move hab.c from cpu/armv7 to arm/imx-common/ - second patch add changes for mx7 Then it is also easy in case of git bisect to track what is changed. Best regards, Stefano Babic > diff --git a/arch/arm/cpu/armv7/mx6/Makefile b/arch/arm/cpu/armv7/mx6/Makefile > index bf6effc..8af191d 100644 > --- a/arch/arm/cpu/armv7/mx6/Makefile > +++ b/arch/arm/cpu/armv7/mx6/Makefile > @@ -9,5 +9,4 @@ > > obj-y := soc.o clock.o > obj-$(CONFIG_SPL_BUILD) += ddr.o > -obj-$(CONFIG_SECURE_BOOT) += hab.o > obj-$(CONFIG_MP) += mp.o > diff --git a/arch/arm/cpu/armv7/mx6/hab.c b/arch/arm/cpu/armv7/mx6/hab.c > deleted file mode 100644 > index 27cabe4..0000000 > --- a/arch/arm/cpu/armv7/mx6/hab.c > +++ /dev/null > @@ -1,502 +0,0 @@ > -/* > - * Copyright (C) 2010-2015 Freescale Semiconductor, Inc. > - * > - * SPDX-License-Identifier: GPL-2.0+ > - */ > - > -#include <common.h> > -#include <asm/io.h> > -#include <asm/system.h> > -#include <asm/arch/hab.h> > -#include <asm/arch/clock.h> > -#include <asm/arch/sys_proto.h> > - > -/* -------- start of HAB API updates ------------*/ > - > -#define hab_rvt_report_event_p \ > -( \ > - ((is_cpu_type(MXC_CPU_MX6Q) || \ > - is_cpu_type(MXC_CPU_MX6D)) && \ > - (soc_rev() >= CHIP_REV_1_5)) ? \ > - ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ > - (is_cpu_type(MXC_CPU_MX6DL) && \ > - (soc_rev() >= CHIP_REV_1_2)) ? \ > - ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ > - ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT) \ > -) > - > -#define hab_rvt_report_status_p \ > -( \ > - ((is_cpu_type(MXC_CPU_MX6Q) || \ > - is_cpu_type(MXC_CPU_MX6D)) && \ > - (soc_rev() >= CHIP_REV_1_5)) ? \ > - ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ > - (is_cpu_type(MXC_CPU_MX6DL) && \ > - (soc_rev() >= CHIP_REV_1_2)) ? \ > - ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ > - ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) \ > -) > - > -#define hab_rvt_authenticate_image_p \ > -( \ > - ((is_cpu_type(MXC_CPU_MX6Q) || \ > - is_cpu_type(MXC_CPU_MX6D)) && \ > - (soc_rev() >= CHIP_REV_1_5)) ? \ > - ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ > - (is_cpu_type(MXC_CPU_MX6DL) && \ > - (soc_rev() >= CHIP_REV_1_2)) ? \ > - ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ > - ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) \ > -) > - > -#define hab_rvt_entry_p \ > -( \ > - ((is_cpu_type(MXC_CPU_MX6Q) || \ > - is_cpu_type(MXC_CPU_MX6D)) && \ > - (soc_rev() >= CHIP_REV_1_5)) ? \ > - ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ > - (is_cpu_type(MXC_CPU_MX6DL) && \ > - (soc_rev() >= CHIP_REV_1_2)) ? \ > - ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ > - ((hab_rvt_entry_t *)HAB_RVT_ENTRY) \ > -) > - > -#define hab_rvt_exit_p \ > -( \ > - ((is_cpu_type(MXC_CPU_MX6Q) || \ > - is_cpu_type(MXC_CPU_MX6D)) && \ > - (soc_rev() >= CHIP_REV_1_5)) ? \ > - ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ > - (is_cpu_type(MXC_CPU_MX6DL) && \ > - (soc_rev() >= CHIP_REV_1_2)) ? \ > - ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ > - ((hab_rvt_exit_t *)HAB_RVT_EXIT) \ > -) > - > -#define IVT_SIZE 0x20 > -#define ALIGN_SIZE 0x1000 > -#define CSF_PAD_SIZE 0x2000 > -#define MX6DQ_PU_IROM_MMU_EN_VAR 0x009024a8 > -#define MX6DLS_PU_IROM_MMU_EN_VAR 0x00901dd0 > -#define MX6SL_PU_IROM_MMU_EN_VAR 0x00900a18 > - > -/* > - * +------------+ 0x0 (DDR_UIMAGE_START) - > - * | Header | | > - * +------------+ 0x40 | > - * | | | > - * | | | > - * | | | > - * | | | > - * | Image Data | | > - * . | | > - * . | > Stuff to be authenticated ----+ > - * . | | | > - * | | | | > - * | | | | > - * +------------+ | | > - * | | | | > - * | Fill Data | | | > - * | | | | > - * +------------+ Align to ALIGN_SIZE | | > - * | IVT | | | > - * +------------+ + IVT_SIZE - | > - * | | | > - * | CSF DATA | <---------------------------------------------------------+ > - * | | > - * +------------+ > - * | | > - * | Fill Data | > - * | | > - * +------------+ + CSF_PAD_SIZE > - */ > - > -#define MAX_RECORD_BYTES (8*1024) /* 4 kbytes */ > - > -struct record { > - uint8_t tag; /* Tag */ > - uint8_t len[2]; /* Length */ > - uint8_t par; /* Version */ > - uint8_t contents[MAX_RECORD_BYTES];/* Record Data */ > - bool any_rec_flag; > -}; > - > -char *rsn_str[] = {"RSN = HAB_RSN_ANY (0x00)\n", > - "RSN = HAB_ENG_FAIL (0x30)\n", > - "RSN = HAB_INV_ADDRESS (0x22)\n", > - "RSN = HAB_INV_ASSERTION (0x0C)\n", > - "RSN = HAB_INV_CALL (0x28)\n", > - "RSN = HAB_INV_CERTIFICATE (0x21)\n", > - "RSN = HAB_INV_COMMAND (0x06)\n", > - "RSN = HAB_INV_CSF (0x11)\n", > - "RSN = HAB_INV_DCD (0x27)\n", > - "RSN = HAB_INV_INDEX (0x0F)\n", > - "RSN = HAB_INV_IVT (0x05)\n", > - "RSN = HAB_INV_KEY (0x1D)\n", > - "RSN = HAB_INV_RETURN (0x1E)\n", > - "RSN = HAB_INV_SIGNATURE (0x18)\n", > - "RSN = HAB_INV_SIZE (0x17)\n", > - "RSN = HAB_MEM_FAIL (0x2E)\n", > - "RSN = HAB_OVR_COUNT (0x2B)\n", > - "RSN = HAB_OVR_STORAGE (0x2D)\n", > - "RSN = HAB_UNS_ALGORITHM (0x12)\n", > - "RSN = HAB_UNS_COMMAND (0x03)\n", > - "RSN = HAB_UNS_ENGINE (0x0A)\n", > - "RSN = HAB_UNS_ITEM (0x24)\n", > - "RSN = HAB_UNS_KEY (0x1B)\n", > - "RSN = HAB_UNS_PROTOCOL (0x14)\n", > - "RSN = HAB_UNS_STATE (0x09)\n", > - "RSN = INVALID\n", > - NULL}; > - > -char *sts_str[] = {"STS = HAB_SUCCESS (0xF0)\n", > - "STS = HAB_FAILURE (0x33)\n", > - "STS = HAB_WARNING (0x69)\n", > - "STS = INVALID\n", > - NULL}; > - > -char *eng_str[] = {"ENG = HAB_ENG_ANY (0x00)\n", > - "ENG = HAB_ENG_SCC (0x03)\n", > - "ENG = HAB_ENG_RTIC (0x05)\n", > - "ENG = HAB_ENG_SAHARA (0x06)\n", > - "ENG = HAB_ENG_CSU (0x0A)\n", > - "ENG = HAB_ENG_SRTC (0x0C)\n", > - "ENG = HAB_ENG_DCP (0x1B)\n", > - "ENG = HAB_ENG_CAAM (0x1D)\n", > - "ENG = HAB_ENG_SNVS (0x1E)\n", > - "ENG = HAB_ENG_OCOTP (0x21)\n", > - "ENG = HAB_ENG_DTCP (0x22)\n", > - "ENG = HAB_ENG_ROM (0x36)\n", > - "ENG = HAB_ENG_HDCP (0x24)\n", > - "ENG = HAB_ENG_RTL (0x77)\n", > - "ENG = HAB_ENG_SW (0xFF)\n", > - "ENG = INVALID\n", > - NULL}; > - > -char *ctx_str[] = {"CTX = HAB_CTX_ANY(0x00)\n", > - "CTX = HAB_CTX_FAB (0xFF)\n", > - "CTX = HAB_CTX_ENTRY (0xE1)\n", > - "CTX = HAB_CTX_TARGET (0x33)\n", > - "CTX = HAB_CTX_AUTHENTICATE (0x0A)\n", > - "CTX = HAB_CTX_DCD (0xDD)\n", > - "CTX = HAB_CTX_CSF (0xCF)\n", > - "CTX = HAB_CTX_COMMAND (0xC0)\n", > - "CTX = HAB_CTX_AUT_DAT (0xDB)\n", > - "CTX = HAB_CTX_ASSERT (0xA0)\n", > - "CTX = HAB_CTX_EXIT (0xEE)\n", > - "CTX = INVALID\n", > - NULL}; > - > -uint8_t hab_statuses[5] = { > - HAB_STS_ANY, > - HAB_FAILURE, > - HAB_WARNING, > - HAB_SUCCESS, > - -1 > -}; > - > -uint8_t hab_reasons[26] = { > - HAB_RSN_ANY, > - HAB_ENG_FAIL, > - HAB_INV_ADDRESS, > - HAB_INV_ASSERTION, > - HAB_INV_CALL, > - HAB_INV_CERTIFICATE, > - HAB_INV_COMMAND, > - HAB_INV_CSF, > - HAB_INV_DCD, > - HAB_INV_INDEX, > - HAB_INV_IVT, > - HAB_INV_KEY, > - HAB_INV_RETURN, > - HAB_INV_SIGNATURE, > - HAB_INV_SIZE, > - HAB_MEM_FAIL, > - HAB_OVR_COUNT, > - HAB_OVR_STORAGE, > - HAB_UNS_ALGORITHM, > - HAB_UNS_COMMAND, > - HAB_UNS_ENGINE, > - HAB_UNS_ITEM, > - HAB_UNS_KEY, > - HAB_UNS_PROTOCOL, > - HAB_UNS_STATE, > - -1 > -}; > - > -uint8_t hab_contexts[12] = { > - HAB_CTX_ANY, > - HAB_CTX_FAB, > - HAB_CTX_ENTRY, > - HAB_CTX_TARGET, > - HAB_CTX_AUTHENTICATE, > - HAB_CTX_DCD, > - HAB_CTX_CSF, > - HAB_CTX_COMMAND, > - HAB_CTX_AUT_DAT, > - HAB_CTX_ASSERT, > - HAB_CTX_EXIT, > - -1 > -}; > - > -uint8_t hab_engines[16] = { > - HAB_ENG_ANY, > - HAB_ENG_SCC, > - HAB_ENG_RTIC, > - HAB_ENG_SAHARA, > - HAB_ENG_CSU, > - HAB_ENG_SRTC, > - HAB_ENG_DCP, > - HAB_ENG_CAAM, > - HAB_ENG_SNVS, > - HAB_ENG_OCOTP, > - HAB_ENG_DTCP, > - HAB_ENG_ROM, > - HAB_ENG_HDCP, > - HAB_ENG_RTL, > - HAB_ENG_SW, > - -1 > -}; > - > -bool is_hab_enabled(void) > -{ > - struct ocotp_regs *ocotp = (struct ocotp_regs *)OCOTP_BASE_ADDR; > - struct fuse_bank *bank = &ocotp->bank[0]; > - struct fuse_bank0_regs *fuse = > - (struct fuse_bank0_regs *)bank->fuse_regs; > - uint32_t reg = readl(&fuse->cfg5); > - > - return (reg & 0x2) == 0x2; > -} > - > -static inline uint8_t get_idx(uint8_t *list, uint8_t tgt) > -{ > - uint8_t idx = 0; > - uint8_t element = list[idx]; > - while (element != -1) { > - if (element == tgt) > - return idx; > - element = list[++idx]; > - } > - return -1; > -} > - > -void process_event_record(uint8_t *event_data, size_t bytes) > -{ > - struct record *rec = (struct record *)event_data; > - > - printf("\n\n%s", sts_str[get_idx(hab_statuses, rec->contents[0])]); > - printf("%s", rsn_str[get_idx(hab_reasons, rec->contents[1])]); > - printf("%s", ctx_str[get_idx(hab_contexts, rec->contents[2])]); > - printf("%s", eng_str[get_idx(hab_engines, rec->contents[3])]); > -} > - > -void display_event(uint8_t *event_data, size_t bytes) > -{ > - uint32_t i; > - > - if (!(event_data && bytes > 0)) > - return; > - > - for (i = 0; i < bytes; i++) { > - if (i == 0) > - printf("\t0x%02x", event_data[i]); > - else if ((i % 8) == 0) > - printf("\n\t0x%02x", event_data[i]); > - else > - printf(" 0x%02x", event_data[i]); > - } > - > - process_event_record(event_data, bytes); > -} > - > -int get_hab_status(void) > -{ > - uint32_t index = 0; /* Loop index */ > - uint8_t event_data[128]; /* Event data buffer */ > - size_t bytes = sizeof(event_data); /* Event size in bytes */ > - enum hab_config config = 0; > - enum hab_state state = 0; > - hab_rvt_report_event_t *hab_rvt_report_event; > - hab_rvt_report_status_t *hab_rvt_report_status; > - > - hab_rvt_report_event = hab_rvt_report_event_p; > - hab_rvt_report_status = hab_rvt_report_status_p; > - > - if (is_hab_enabled()) > - puts("\nSecure boot enabled\n"); > - else > - puts("\nSecure boot disabled\n"); > - > - /* Check HAB status */ > - if (hab_rvt_report_status(&config, &state) != HAB_SUCCESS) { > - printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", > - config, state); > - > - /* Display HAB Error events */ > - while (hab_rvt_report_event(HAB_FAILURE, index, event_data, > - &bytes) == HAB_SUCCESS) { > - puts("\n"); > - printf("--------- HAB Event %d -----------------\n", > - index + 1); > - puts("event data:\n"); > - display_event(event_data, bytes); > - puts("\n"); > - bytes = sizeof(event_data); > - index++; > - } > - } > - /* Display message if no HAB events are found */ > - else { > - printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", > - config, state); > - puts("No HAB Events Found!\n\n"); > - } > - return 0; > -} > - > -uint32_t authenticate_image(uint32_t ddr_start, uint32_t image_size) > -{ > - uint32_t load_addr = 0; > - size_t bytes; > - ptrdiff_t ivt_offset = 0; > - int result = 0; > - ulong start; > - hab_rvt_authenticate_image_t *hab_rvt_authenticate_image; > - hab_rvt_entry_t *hab_rvt_entry; > - hab_rvt_exit_t *hab_rvt_exit; > - > - hab_rvt_authenticate_image = hab_rvt_authenticate_image_p; > - hab_rvt_entry = hab_rvt_entry_p; > - hab_rvt_exit = hab_rvt_exit_p; > - > - if (is_hab_enabled()) { > - printf("\nAuthenticate image from DDR location 0x%x...\n", > - ddr_start); > - > - hab_caam_clock_enable(1); > - > - if (hab_rvt_entry() == HAB_SUCCESS) { > - /* If not already aligned, Align to ALIGN_SIZE */ > - ivt_offset = (image_size + ALIGN_SIZE - 1) & > - ~(ALIGN_SIZE - 1); > - > - start = ddr_start; > - bytes = ivt_offset + IVT_SIZE + CSF_PAD_SIZE; > -#ifdef DEBUG > - printf("\nivt_offset = 0x%x, ivt addr = 0x%x\n", > - ivt_offset, ddr_start + ivt_offset); > - puts("Dumping IVT\n"); > - print_buffer(ddr_start + ivt_offset, > - (void *)(ddr_start + ivt_offset), > - 4, 0x8, 0); > - > - puts("Dumping CSF Header\n"); > - print_buffer(ddr_start + ivt_offset+IVT_SIZE, > - (void *)(ddr_start + ivt_offset+IVT_SIZE), > - 4, 0x10, 0); > - > - get_hab_status(); > - > - puts("\nCalling authenticate_image in ROM\n"); > - printf("\tivt_offset = 0x%x\n", ivt_offset); > - printf("\tstart = 0x%08lx\n", start); > - printf("\tbytes = 0x%x\n", bytes); > -#endif > - /* > - * If the MMU is enabled, we have to notify the ROM > - * code, or it won't flush the caches when needed. > - * This is done, by setting the "pu_irom_mmu_enabled" > - * word to 1. You can find its address by looking in > - * the ROM map. This is critical for > - * authenticate_image(). If MMU is enabled, without > - * setting this bit, authentication will fail and may > - * crash. > - */ > - /* Check MMU enabled */ > - if (get_cr() & CR_M) { > - if (is_cpu_type(MXC_CPU_MX6Q) || > - is_cpu_type(MXC_CPU_MX6D)) { > - /* > - * This won't work on Rev 1.0.0 of > - * i.MX6Q/D, since their ROM doesn't > - * do cache flushes. don't think any > - * exist, so we ignore them. > - */ > - if (!is_mx6dqp()) > - writel(1, MX6DQ_PU_IROM_MMU_EN_VAR); > - } else if (is_cpu_type(MXC_CPU_MX6DL) || > - is_cpu_type(MXC_CPU_MX6SOLO)) { > - writel(1, MX6DLS_PU_IROM_MMU_EN_VAR); > - } else if (is_cpu_type(MXC_CPU_MX6SL)) { > - writel(1, MX6SL_PU_IROM_MMU_EN_VAR); > - } > - } > - > - load_addr = (uint32_t)hab_rvt_authenticate_image( > - HAB_CID_UBOOT, > - ivt_offset, (void **)&start, > - (size_t *)&bytes, NULL); > - if (hab_rvt_exit() != HAB_SUCCESS) { > - puts("hab exit function fail\n"); > - load_addr = 0; > - } > - } else { > - puts("hab entry function fail\n"); > - } > - > - hab_caam_clock_enable(0); > - > - get_hab_status(); > - } else { > - puts("hab fuse not enabled\n"); > - } > - > - if ((!is_hab_enabled()) || (load_addr != 0)) > - result = 1; > - > - return result; > -} > - > -int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) > -{ > - if ((argc != 1)) { > - cmd_usage(cmdtp); > - return 1; > - } > - > - get_hab_status(); > - > - return 0; > -} > - > -static int do_authenticate_image(cmd_tbl_t *cmdtp, int flag, int argc, > - char * const argv[]) > -{ > - ulong addr, ivt_offset; > - int rcode = 0; > - > - if (argc < 3) > - return CMD_RET_USAGE; > - > - addr = simple_strtoul(argv[1], NULL, 16); > - ivt_offset = simple_strtoul(argv[2], NULL, 16); > - > - rcode = authenticate_image(addr, ivt_offset); > - > - return rcode; > -} > - > -U_BOOT_CMD( > - hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status, > - "display HAB status", > - "" > - ); > - > -U_BOOT_CMD( > - hab_auth_img, 3, 0, do_authenticate_image, > - "authenticate image via HAB", > - "addr ivt_offset\n" > - "addr - image hex address\n" > - "ivt_offset - hex offset of IVT in the image" > - ); > diff --git a/arch/arm/imx-common/Makefile b/arch/arm/imx-common/Makefile > index 1698d06..4abffee 100644 > --- a/arch/arm/imx-common/Makefile > +++ b/arch/arm/imx-common/Makefile > @@ -27,6 +27,7 @@ ifeq ($(SOC),$(filter $(SOC),mx6 mx7)) > obj-y += cache.o init.o > obj-$(CONFIG_CMD_SATA) += sata.o > obj-$(CONFIG_IMX_VIDEO_SKIP) += video.o > +obj-$(CONFIG_SECURE_BOOT) += hab.o > endif > ifeq ($(SOC),$(filter $(SOC),vf610)) > obj-y += ddrmc-vf610.o > diff --git a/arch/arm/imx-common/hab.c b/arch/arm/imx-common/hab.c > new file mode 100644 > index 0000000..4386e29 > --- /dev/null > +++ b/arch/arm/imx-common/hab.c > @@ -0,0 +1,515 @@ > +/* > + * Copyright (C) 2015 Freescale Semiconductor, Inc. > + * > + * SPDX-License-Identifier: GPL-2.0+ > + */ > + > +#include <common.h> > +#include <imx_hab.h> > +#include <asm/io.h> > +#include <asm/system.h> > +#include <asm/arch/clock.h> > +#include <asm/arch/sys_proto.h> > + > +/* -------- start of HAB API updates ------------*/ > + > +#define hab_rvt_report_event_p \ > +( \ > + ((is_cpu_type(MXC_CPU_MX6Q) || \ > + is_cpu_type(MXC_CPU_MX6D)) && \ > + (soc_rev() >= CHIP_REV_1_5)) ? \ > + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ > + (is_cpu_type(MXC_CPU_MX6DL) && \ > + (soc_rev() >= CHIP_REV_1_2)) ? \ > + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ > + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT) \ > +) > + > +#define hab_rvt_report_status_p \ > +( \ > + ((is_cpu_type(MXC_CPU_MX6Q) || \ > + is_cpu_type(MXC_CPU_MX6D)) && \ > + (soc_rev() >= CHIP_REV_1_5)) ? \ > + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ > + (is_cpu_type(MXC_CPU_MX6DL) && \ > + (soc_rev() >= CHIP_REV_1_2)) ? \ > + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) :\ > + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) \ > +) > + > +#define hab_rvt_authenticate_image_p \ > +( \ > + ((is_cpu_type(MXC_CPU_MX6Q) || \ > + is_cpu_type(MXC_CPU_MX6D)) && \ > + (soc_rev() >= CHIP_REV_1_5)) ? \ > + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ > + (is_cpu_type(MXC_CPU_MX6DL) && \ > + (soc_rev() >= CHIP_REV_1_2)) ? \ > + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ > + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) \ > +) > + > +#define hab_rvt_entry_p \ > +( \ > + ((is_cpu_type(MXC_CPU_MX6Q) || \ > + is_cpu_type(MXC_CPU_MX6D)) && \ > + (soc_rev() >= CHIP_REV_1_5)) ? \ > + ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ > + (is_cpu_type(MXC_CPU_MX6DL) && \ > + (soc_rev() >= CHIP_REV_1_2)) ? \ > + ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ > + ((hab_rvt_entry_t *)HAB_RVT_ENTRY) \ > +) > + > +#define hab_rvt_exit_p \ > +( \ > + ((is_cpu_type(MXC_CPU_MX6Q) || \ > + is_cpu_type(MXC_CPU_MX6D)) && \ > + (soc_rev() >= CHIP_REV_1_5)) ? \ > + ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ > + (is_cpu_type(MXC_CPU_MX6DL) && \ > + (soc_rev() >= CHIP_REV_1_2)) ? \ > + ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ > + ((hab_rvt_exit_t *)HAB_RVT_EXIT) \ > +) > + > +#define IVT_SIZE 0x20 > +#define ALIGN_SIZE 0x1000 > +#define CSF_PAD_SIZE 0x2000 > +#define MX6DQ_PU_IROM_MMU_EN_VAR 0x009024a8 > +#define MX6DLS_PU_IROM_MMU_EN_VAR 0x00901dd0 > +#define MX6SL_PU_IROM_MMU_EN_VAR 0x00900a18 > + > +/* > + * +------------+ 0x0 (DDR_UIMAGE_START) - > + * | Header | | > + * +------------+ 0x40 | > + * | | | > + * | | | > + * | | | > + * | | | > + * | Image Data | | > + * . | | > + * . | > Stuff to be authenticated ----+ > + * . | | | > + * | | | | > + * | | | | > + * +------------+ | | > + * | | | | > + * | Fill Data | | | > + * | | | | > + * +------------+ Align to ALIGN_SIZE | | > + * | IVT | | | > + * +------------+ + IVT_SIZE - | > + * | | | > + * | CSF DATA | <---------------------------------------------------------+ > + * | | > + * +------------+ > + * | | > + * | Fill Data | > + * | | > + * +------------+ + CSF_PAD_SIZE > + */ > + > +#define MAX_RECORD_BYTES (8*1024) /* 4 kbytes */ > + > +struct record { > + uint8_t tag; /* Tag */ > + uint8_t len[2]; /* Length */ > + uint8_t par; /* Version */ > + uint8_t contents[MAX_RECORD_BYTES];/* Record Data */ > + bool any_rec_flag; > +}; > + > +char *rsn_str[] = {"RSN = HAB_RSN_ANY (0x00)\n", > + "RSN = HAB_ENG_FAIL (0x30)\n", > + "RSN = HAB_INV_ADDRESS (0x22)\n", > + "RSN = HAB_INV_ASSERTION (0x0C)\n", > + "RSN = HAB_INV_CALL (0x28)\n", > + "RSN = HAB_INV_CERTIFICATE (0x21)\n", > + "RSN = HAB_INV_COMMAND (0x06)\n", > + "RSN = HAB_INV_CSF (0x11)\n", > + "RSN = HAB_INV_DCD (0x27)\n", > + "RSN = HAB_INV_INDEX (0x0F)\n", > + "RSN = HAB_INV_IVT (0x05)\n", > + "RSN = HAB_INV_KEY (0x1D)\n", > + "RSN = HAB_INV_RETURN (0x1E)\n", > + "RSN = HAB_INV_SIGNATURE (0x18)\n", > + "RSN = HAB_INV_SIZE (0x17)\n", > + "RSN = HAB_MEM_FAIL (0x2E)\n", > + "RSN = HAB_OVR_COUNT (0x2B)\n", > + "RSN = HAB_OVR_STORAGE (0x2D)\n", > + "RSN = HAB_UNS_ALGORITHM (0x12)\n", > + "RSN = HAB_UNS_COMMAND (0x03)\n", > + "RSN = HAB_UNS_ENGINE (0x0A)\n", > + "RSN = HAB_UNS_ITEM (0x24)\n", > + "RSN = HAB_UNS_KEY (0x1B)\n", > + "RSN = HAB_UNS_PROTOCOL (0x14)\n", > + "RSN = HAB_UNS_STATE (0x09)\n", > + "RSN = INVALID\n", > + NULL}; > + > +char *sts_str[] = {"STS = HAB_SUCCESS (0xF0)\n", > + "STS = HAB_FAILURE (0x33)\n", > + "STS = HAB_WARNING (0x69)\n", > + "STS = INVALID\n", > + NULL}; > + > +char *eng_str[] = {"ENG = HAB_ENG_ANY (0x00)\n", > + "ENG = HAB_ENG_SCC (0x03)\n", > + "ENG = HAB_ENG_RTIC (0x05)\n", > + "ENG = HAB_ENG_SAHARA (0x06)\n", > + "ENG = HAB_ENG_CSU (0x0A)\n", > + "ENG = HAB_ENG_SRTC (0x0C)\n", > + "ENG = HAB_ENG_DCP (0x1B)\n", > + "ENG = HAB_ENG_CAAM (0x1D)\n", > + "ENG = HAB_ENG_SNVS (0x1E)\n", > + "ENG = HAB_ENG_OCOTP (0x21)\n", > + "ENG = HAB_ENG_DTCP (0x22)\n", > + "ENG = HAB_ENG_ROM (0x36)\n", > + "ENG = HAB_ENG_HDCP (0x24)\n", > + "ENG = HAB_ENG_RTL (0x77)\n", > + "ENG = HAB_ENG_SW (0xFF)\n", > + "ENG = INVALID\n", > + NULL}; > + > +char *ctx_str[] = {"CTX = HAB_CTX_ANY(0x00)\n", > + "CTX = HAB_CTX_FAB (0xFF)\n", > + "CTX = HAB_CTX_ENTRY (0xE1)\n", > + "CTX = HAB_CTX_TARGET (0x33)\n", > + "CTX = HAB_CTX_AUTHENTICATE (0x0A)\n", > + "CTX = HAB_CTX_DCD (0xDD)\n", > + "CTX = HAB_CTX_CSF (0xCF)\n", > + "CTX = HAB_CTX_COMMAND (0xC0)\n", > + "CTX = HAB_CTX_AUT_DAT (0xDB)\n", > + "CTX = HAB_CTX_ASSERT (0xA0)\n", > + "CTX = HAB_CTX_EXIT (0xEE)\n", > + "CTX = INVALID\n", > + NULL}; > + > +uint8_t hab_statuses[5] = { > + HAB_STS_ANY, > + HAB_FAILURE, > + HAB_WARNING, > + HAB_SUCCESS, > + -1 > +}; > + > +uint8_t hab_reasons[26] = { > + HAB_RSN_ANY, > + HAB_ENG_FAIL, > + HAB_INV_ADDRESS, > + HAB_INV_ASSERTION, > + HAB_INV_CALL, > + HAB_INV_CERTIFICATE, > + HAB_INV_COMMAND, > + HAB_INV_CSF, > + HAB_INV_DCD, > + HAB_INV_INDEX, > + HAB_INV_IVT, > + HAB_INV_KEY, > + HAB_INV_RETURN, > + HAB_INV_SIGNATURE, > + HAB_INV_SIZE, > + HAB_MEM_FAIL, > + HAB_OVR_COUNT, > + HAB_OVR_STORAGE, > + HAB_UNS_ALGORITHM, > + HAB_UNS_COMMAND, > + HAB_UNS_ENGINE, > + HAB_UNS_ITEM, > + HAB_UNS_KEY, > + HAB_UNS_PROTOCOL, > + HAB_UNS_STATE, > + -1 > +}; > + > +uint8_t hab_contexts[12] = { > + HAB_CTX_ANY, > + HAB_CTX_FAB, > + HAB_CTX_ENTRY, > + HAB_CTX_TARGET, > + HAB_CTX_AUTHENTICATE, > + HAB_CTX_DCD, > + HAB_CTX_CSF, > + HAB_CTX_COMMAND, > + HAB_CTX_AUT_DAT, > + HAB_CTX_ASSERT, > + HAB_CTX_EXIT, > + -1 > +}; > + > +uint8_t hab_engines[16] = { > + HAB_ENG_ANY, > + HAB_ENG_SCC, > + HAB_ENG_RTIC, > + HAB_ENG_SAHARA, > + HAB_ENG_CSU, > + HAB_ENG_SRTC, > + HAB_ENG_DCP, > + HAB_ENG_CAAM, > + HAB_ENG_SNVS, > + HAB_ENG_OCOTP, > + HAB_ENG_DTCP, > + HAB_ENG_ROM, > + HAB_ENG_HDCP, > + HAB_ENG_RTL, > + HAB_ENG_SW, > + -1 > +}; > + > +bool is_hab_enabled(void) > +{ > + struct ocotp_regs *ocotp = (struct ocotp_regs *)OCOTP_BASE_ADDR; > + uint32_t reg; > +#if CONFIG_MX7 > + struct fuse_bank *bank = &ocotp->bank[1]; > + struct fuse_bank1_regs *fuse = > + (struct fuse_bank1_regs *)bank->fuse_regs; > + reg = readl(&fuse->cfg0); > +#elif CONFIG_MX6 > + struct fuse_bank *bank = &ocotp->bank[0]; > + struct fuse_bank0_regs *fuse = > + (struct fuse_bank0_regs *)bank->fuse_regs; > + reg = readl(&fuse->cfg5); > +#endif > + > + if (is_soc_type(MXC_SOC_MX7)) > + return (reg & 0x2000000) == 0x2000000; > + else if (is_soc_type(MXC_SOC_MX6)) > + return (reg & 0x2) == 0x2; > + > + return 0; > +} > + > +static inline uint8_t get_idx(uint8_t *list, uint8_t tgt) > +{ > + uint8_t idx = 0; > + uint8_t element = list[idx]; > + while (element != -1) { > + if (element == tgt) > + return idx; > + element = list[++idx]; > + } > + return -1; > +} > + > +void process_event_record(uint8_t *event_data, size_t bytes) > +{ > + struct record *rec = (struct record *)event_data; > + > + printf("\n\n%s", sts_str[get_idx(hab_statuses, rec->contents[0])]); > + printf("%s", rsn_str[get_idx(hab_reasons, rec->contents[1])]); > + printf("%s", ctx_str[get_idx(hab_contexts, rec->contents[2])]); > + printf("%s", eng_str[get_idx(hab_engines, rec->contents[3])]); > +} > + > +void display_event(uint8_t *event_data, size_t bytes) > +{ > + uint32_t i; > + > + if (!(event_data && bytes > 0)) > + return; > + > + for (i = 0; i < bytes; i++) { > + if (i == 0) > + printf("\t0x%02x", event_data[i]); > + else if ((i % 8) == 0) > + printf("\n\t0x%02x", event_data[i]); > + else > + printf(" 0x%02x", event_data[i]); > + } > + > + process_event_record(event_data, bytes); > +} > + > +int get_hab_status(void) > +{ > + uint32_t index = 0; /* Loop index */ > + uint8_t event_data[128]; /* Event data buffer */ > + size_t bytes = sizeof(event_data); /* Event size in bytes */ > + enum hab_config config = 0; > + enum hab_state state = 0; > + hab_rvt_report_event_t *hab_rvt_report_event; > + hab_rvt_report_status_t *hab_rvt_report_status; > + > + hab_rvt_report_event = hab_rvt_report_event_p; > + hab_rvt_report_status = hab_rvt_report_status_p; > + > + if (is_hab_enabled()) > + puts("\nSecure boot enabled\n"); > + else > + puts("\nSecure boot disabled\n"); > + > + /* Check HAB status */ > + if (hab_rvt_report_status(&config, &state) != HAB_SUCCESS) { > + printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", > + config, state); > + > + /* Display HAB Error events */ > + while (hab_rvt_report_event(HAB_FAILURE, index, event_data, > + &bytes) == HAB_SUCCESS) { > + puts("\n"); > + printf("--------- HAB Event %d -----------------\n", > + index + 1); > + puts("event data:\n"); > + display_event(event_data, bytes); > + puts("\n"); > + bytes = sizeof(event_data); > + index++; > + } > + } > + /* Display message if no HAB events are found */ > + else { > + printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", > + config, state); > + puts("No HAB Events Found!\n\n"); > + } > + return 0; > +} > + > +uint32_t authenticate_image(uint32_t ddr_start, uint32_t image_size) > +{ > + uint32_t load_addr = 0; > + size_t bytes; > + ptrdiff_t ivt_offset = 0; > + int result = 0; > + ulong start; > + hab_rvt_authenticate_image_t *hab_rvt_authenticate_image; > + hab_rvt_entry_t *hab_rvt_entry; > + hab_rvt_exit_t *hab_rvt_exit; > + > + hab_rvt_authenticate_image = hab_rvt_authenticate_image_p; > + hab_rvt_entry = hab_rvt_entry_p; > + hab_rvt_exit = hab_rvt_exit_p; > + > + if (is_hab_enabled()) { > + printf("\nAuthenticate image from DDR location 0x%x...\n", > + ddr_start); > + > + hab_caam_clock_enable(1); > + > + if (hab_rvt_entry() == HAB_SUCCESS) { > + /* If not already aligned, Align to ALIGN_SIZE */ > + ivt_offset = (image_size + ALIGN_SIZE - 1) & > + ~(ALIGN_SIZE - 1); > + > + start = ddr_start; > + bytes = ivt_offset + IVT_SIZE + CSF_PAD_SIZE; > +#ifdef DEBUG > + printf("\nivt_offset = 0x%x, ivt addr = 0x%x\n", > + ivt_offset, ddr_start + ivt_offset); > + puts("Dumping IVT\n"); > + print_buffer(ddr_start + ivt_offset, > + (void *)(ddr_start + ivt_offset), > + 4, 0x8, 0); > + > + puts("Dumping CSF Header\n"); > + print_buffer(ddr_start + ivt_offset+IVT_SIZE, > + (void *)(ddr_start + ivt_offset+IVT_SIZE), > + 4, 0x10, 0); > + > + get_hab_status(); > + > + puts("\nCalling authenticate_image in ROM\n"); > + printf("\tivt_offset = 0x%x\n", ivt_offset); > + printf("\tstart = 0x%08lx\n", start); > + printf("\tbytes = 0x%x\n", bytes); > +#endif > + /* > + * If the MMU is enabled, we have to notify the ROM > + * code, or it won't flush the caches when needed. > + * This is done, by setting the "pu_irom_mmu_enabled" > + * word to 1. You can find its address by looking in > + * the ROM map. This is critical for > + * authenticate_image(). If MMU is enabled, without > + * setting this bit, authentication will fail and may > + * crash. > + */ > + if (is_soc_type(MXC_SOC_MX6) && (get_cr() & CR_M)) { > + /* Check MMU enabled */ > + if (is_cpu_type(MXC_CPU_MX6Q) || > + is_cpu_type(MXC_CPU_MX6D)) { > + /* > + * This won't work on Rev 1.0.0 of > + * i.MX6Q/D, since their ROM doesn't > + * do cache flushes. don't think any > + * exist, so we ignore them. > + */ > + if (!is_mx6dqp()) > + writel(1, MX6DQ_PU_IROM_MMU_EN_VAR); > + } else if (is_cpu_type(MXC_CPU_MX6DL) || > + is_cpu_type(MXC_CPU_MX6SOLO)) { > + writel(1, MX6DLS_PU_IROM_MMU_EN_VAR); > + } else if (is_cpu_type(MXC_CPU_MX6SL)) { > + writel(1, MX6SL_PU_IROM_MMU_EN_VAR); > + } > + } > + > + load_addr = (uint32_t)hab_rvt_authenticate_image( > + HAB_CID_UBOOT, > + ivt_offset, (void **)&start, > + (size_t *)&bytes, NULL); > + if (hab_rvt_exit() != HAB_SUCCESS) { > + puts("hab exit function fail\n"); > + load_addr = 0; > + } > + } else { > + puts("hab entry function fail\n"); > + } > + > + hab_caam_clock_enable(0); > + > + get_hab_status(); > + } else { > + puts("hab fuse not enabled\n"); > + } > + > + if ((!is_hab_enabled()) || (load_addr != 0)) > + result = 1; > + > + return result; > +} > + > +int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) > +{ > + if ((argc != 1)) { > + cmd_usage(cmdtp); > + return 1; > + } > + > + get_hab_status(); > + > + return 0; > +} > + > +static int do_authenticate_image(cmd_tbl_t *cmdtp, int flag, int argc, > + char * const argv[]) > +{ > + ulong addr, ivt_offset; > + int rcode = 0; > + > + if (argc < 3) > + return CMD_RET_USAGE; > + > + addr = simple_strtoul(argv[1], NULL, 16); > + ivt_offset = simple_strtoul(argv[2], NULL, 16); > + > + rcode = authenticate_image(addr, ivt_offset); > + > + return rcode; > +} > + > +U_BOOT_CMD( > + hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status, > + "display HAB status", > + "" > + ); > + > +U_BOOT_CMD( > + hab_auth_img, 3, 0, do_authenticate_image, > + "authenticate image via HAB", > + "addr ivt_offset\n" > + "addr - image hex address\n" > + "ivt_offset - hex offset of IVT in the image" > + ); > diff --git a/include/imx_hab.h b/include/imx_hab.h > new file mode 100644 > index 0000000..3579292 > --- /dev/null > +++ b/include/imx_hab.h > @@ -0,0 +1,140 @@ > +/* > + * Copyright (C) 2015 Freescale Semiconductor, Inc. All Rights Reserved. > + * > + * SPDX-License-Identifier: GPL-2.0+ > + * > +*/ > + > +#ifndef __SECURE_IMX_H__ > +#define __SECURE_IMX_H__ > + > +#include <linux/types.h> > + > +/* -------- start of HAB API updates ------------*/ > +/* The following are taken from HAB4 SIS */ > + > +/* Status definitions */ > +enum hab_status { > + HAB_STS_ANY = 0x00, > + HAB_FAILURE = 0x33, > + HAB_WARNING = 0x69, > + HAB_SUCCESS = 0xf0 > +}; > + > +/* Security Configuration definitions */ > +enum hab_config { > + HAB_CFG_RETURN = 0x33, /**< Field Return IC */ > + HAB_CFG_OPEN = 0xf0, /**< Non-secure IC */ > + HAB_CFG_CLOSED = 0xcc /**< Secure IC */ > +}; > + > +/* State definitions */ > +enum hab_state { > + HAB_STATE_INITIAL = 0x33, /**< Initialising state (transitory) */ > + HAB_STATE_CHECK = 0x55, /**< Check state (non-secure) */ > + HAB_STATE_NONSECURE = 0x66, /**< Non-secure state */ > + HAB_STATE_TRUSTED = 0x99, /**< Trusted state */ > + HAB_STATE_SECURE = 0xaa, /**< Secure state */ > + HAB_STATE_FAIL_SOFT = 0xcc, /**< Soft fail state */ > + HAB_STATE_FAIL_HARD = 0xff, /**< Hard fail state (terminal) */ > + HAB_STATE_NONE = 0xf0, /**< No security state machine */ > + HAB_STATE_MAX > +}; > + > +enum hab_reason { > + HAB_RSN_ANY = 0x00, /* Match any reason */ > + HAB_ENG_FAIL = 0x30, /* Engine failure */ > + HAB_INV_ADDRESS = 0x22, /* Invalid address: access denied */ > + HAB_INV_ASSERTION = 0x0c, /* Invalid assertion */ > + HAB_INV_CALL = 0x28, /* Function called out of sequence */ > + HAB_INV_CERTIFICATE = 0x21, /* Invalid certificate */ > + HAB_INV_COMMAND = 0x06, /* Invalid command: command malformed */ > + HAB_INV_CSF = 0x11, /* Invalid csf */ > + HAB_INV_DCD = 0x27, /* Invalid dcd */ > + HAB_INV_INDEX = 0x0f, /* Invalid index: access denied */ > + HAB_INV_IVT = 0x05, /* Invalid ivt */ > + HAB_INV_KEY = 0x1d, /* Invalid key */ > + HAB_INV_RETURN = 0x1e, /* Failed callback function */ > + HAB_INV_SIGNATURE = 0x18, /* Invalid signature */ > + HAB_INV_SIZE = 0x17, /* Invalid data size */ > + HAB_MEM_FAIL = 0x2e, /* Memory failure */ > + HAB_OVR_COUNT = 0x2b, /* Expired poll count */ > + HAB_OVR_STORAGE = 0x2d, /* Exhausted storage region */ > + HAB_UNS_ALGORITHM = 0x12, /* Unsupported algorithm */ > + HAB_UNS_COMMAND = 0x03, /* Unsupported command */ > + HAB_UNS_ENGINE = 0x0a, /* Unsupported engine */ > + HAB_UNS_ITEM = 0x24, /* Unsupported configuration item */ > + HAB_UNS_KEY = 0x1b, /* Unsupported key type/parameters */ > + HAB_UNS_PROTOCOL = 0x14, /* Unsupported protocol */ > + HAB_UNS_STATE = 0x09, /* Unsuitable state */ > + HAB_RSN_MAX > +}; > + > +enum hab_context { > + HAB_CTX_ANY = 0x00, /* Match any context */ > + HAB_CTX_FAB = 0xff, /* Event logged in hab_fab_test() */ > + HAB_CTX_ENTRY = 0xe1, /* Event logged in hab_rvt.entry() */ > + HAB_CTX_TARGET = 0x33, /* Event logged in hab_rvt.check_target() */ > + HAB_CTX_AUTHENTICATE = 0x0a, /* Logged in hab_rvt.authenticate_image() */ > + HAB_CTX_DCD = 0xdd, /* Event logged in hab_rvt.run_dcd() */ > + HAB_CTX_CSF = 0xcf, /* Event logged in hab_rvt.run_csf() */ > + HAB_CTX_COMMAND = 0xc0, /* Event logged executing csf/dcd command */ > + HAB_CTX_AUT_DAT = 0xdb, /* Authenticated data block */ > + HAB_CTX_ASSERT = 0xa0, /* Event logged in hab_rvt.assert() */ > + HAB_CTX_EXIT = 0xee, /* Event logged in hab_rvt.exit() */ > + HAB_CTX_MAX > +}; > + > +/*Function prototype description*/ > +typedef enum hab_status hab_rvt_report_event_t(enum hab_status, uint32_t, > + uint8_t* , size_t*); > +typedef enum hab_status hab_rvt_report_status_t(enum hab_config *, > + enum hab_state *); > +typedef enum hab_status hab_loader_callback_f_t(void**, size_t*, const void*); > +typedef enum hab_status hab_rvt_entry_t(void); > +typedef enum hab_status hab_rvt_exit_t(void); > +typedef void *hab_rvt_authenticate_image_t(uint8_t, ptrdiff_t, > + void **, size_t *, hab_loader_callback_f_t); > +typedef void hapi_clock_init_t(void); > + > +#define HAB_ENG_ANY 0x00 /* Select first compatible engine */ > +#define HAB_ENG_SCC 0x03 /* Security controller */ > +#define HAB_ENG_RTIC 0x05 /* Run-time integrity checker */ > +#define HAB_ENG_SAHARA 0x06 /* Crypto accelerator */ > +#define HAB_ENG_CSU 0x0a /* Central Security Unit */ > +#define HAB_ENG_SRTC 0x0c /* Secure clock */ > +#define HAB_ENG_DCP 0x1b /* Data Co-Processor */ > +#define HAB_ENG_CAAM 0x1d /* CAAM */ > +#define HAB_ENG_SNVS 0x1e /* Secure Non-Volatile Storage */ > +#define HAB_ENG_OCOTP 0x21 /* Fuse controller */ > +#define HAB_ENG_DTCP 0x22 /* DTCP co-processor */ > +#define HAB_ENG_ROM 0x36 /* Protected ROM area */ > +#define HAB_ENG_HDCP 0x24 /* HDCP co-processor */ > +#define HAB_ENG_RTL 0x77 /* RTL simulation engine */ > +#define HAB_ENG_SW 0xff /* Software engine */ > + > +#if defined(CONFIG_MX6SX) || defined(CONFIG_MX7D) > +#define HAB_RVT_UNIFIED_BASE 0x00000100 > +#else > +#define HAB_RVT_UNIFIED_BASE 0x00000094 > +#endif > + > +#define HAB_RVT_ENTRY (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x04)) > +#define HAB_RVT_EXIT (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x08)) > +#define HAB_RVT_AUTHENTICATE_IMAGE (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x10)) > +#define HAB_RVT_REPORT_EVENT (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x20)) > +#define HAB_RVT_REPORT_STATUS (*(uint32_t *) (HAB_RVT_UNIFIED_BASE + 0x24)) > + > +#define HAB_RVT_REPORT_EVENT_NEW (*(uint32_t *)0x000000B8) > +#define HAB_RVT_REPORT_STATUS_NEW (*(uint32_t *)0x000000BC) > +#define HAB_RVT_AUTHENTICATE_IMAGE_NEW (*(uint32_t *)0x000000A8) > +#define HAB_RVT_ENTRY_NEW (*(uint32_t *)0x0000009C) > +#define HAB_RVT_EXIT_NEW (*(uint32_t *)0x000000A0) > + > +#define HAB_RVT_CLOCK_INIT ((hapi_clock_init_t *)0x0000024D) > + > +#define HAB_CID_ROM 0 /**< ROM Caller ID */ > +#define HAB_CID_UBOOT 1 /**< UBOOT Caller ID*/ > +/* ----------- end of HAB API updates ------------*/ > + > +#endif > -- ===================================================================== DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de ===================================================================== ^ permalink raw reply [flat|nested] 4+ messages in thread
* [U-Boot] [PATCH 3/3] mx7dsabresd: add secure boot support 2015-09-21 20:44 [U-Boot] [PATCH 1/3] imx: cpu: move common chip revision id's Adrian Alonso 2015-09-21 20:44 ` [U-Boot] [PATCH 2/3] hab: rework support for imx6/imx7 Adrian Alonso @ 2015-09-21 20:44 ` Adrian Alonso 1 sibling, 0 replies; 4+ messages in thread From: Adrian Alonso @ 2015-09-21 20:44 UTC (permalink / raw) To: u-boot Add secure boot support for mx7dsabresd target board Signed-off-by: Adrian Alonso <aalonso@freescale.com> --- board/freescale/mx7dsabresd/imximage.cfg | 7 +++++++ include/configs/mx7dsabresd.h | 4 ++++ 2 files changed, 11 insertions(+) diff --git a/board/freescale/mx7dsabresd/imximage.cfg b/board/freescale/mx7dsabresd/imximage.cfg index 91b70ee..76574ff 100644 --- a/board/freescale/mx7dsabresd/imximage.cfg +++ b/board/freescale/mx7dsabresd/imximage.cfg @@ -23,6 +23,13 @@ IMAGE_VERSION 2 BOOT_FROM sd /* + * Secure boot support + */ +#ifdef CONFIG_SECURE_BOOT +CSF CONFIG_CSF_SIZE +#endif + +/* * Device Configuration Data (DCD) * * Each entry must have the format: diff --git a/include/configs/mx7dsabresd.h b/include/configs/mx7dsabresd.h index 2a736c4..7e32b5a 100644 --- a/include/configs/mx7dsabresd.h +++ b/include/configs/mx7dsabresd.h @@ -14,6 +14,10 @@ #define CONFIG_DBG_MONITOR #define PHYS_SDRAM_SIZE SZ_1G +/* Uncomment to enable secure boot support */ +/* #define CONFIG_SECURE_BOOT */ +#define CONFIG_CSF_SIZE 0x4000 + /* Network */ #define CONFIG_CMD_MII #define CONFIG_FEC_MXC -- 2.1.4 ^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-09-29 12:32 UTC | newest] Thread overview: 4+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2015-09-21 20:44 [U-Boot] [PATCH 1/3] imx: cpu: move common chip revision id's Adrian Alonso 2015-09-21 20:44 ` [U-Boot] [PATCH 2/3] hab: rework support for imx6/imx7 Adrian Alonso 2015-09-29 12:32 ` Stefano Babic 2015-09-21 20:44 ` [U-Boot] [PATCH 3/3] mx7dsabresd: add secure boot support Adrian Alonso
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.