1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright 2018-2019 NXP
10 #include <asm/global_data.h>
12 #include <firmware/imx/sci/sci.h>
13 #include <asm/mach-imx/sys_proto.h>
14 #include <asm/arch-imx/cpu.h>
15 #include <asm/arch/sys_proto.h>
16 #include <asm/mach-imx/image.h>
20 DECLARE_GLOBAL_DATA_PTR
;
22 #define SEC_SECURE_RAM_BASE (0x31800000UL)
23 #define SEC_SECURE_RAM_END_BASE (SEC_SECURE_RAM_BASE + 0xFFFFUL)
24 #define SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE (0x60000000UL)
28 static inline bool check_in_dram(ulong addr
)
31 struct bd_info
*bd
= gd
->bd
;
33 for (i
= 0; i
< CONFIG_NR_DRAM_BANKS
; ++i
) {
34 if (bd
->bi_dram
[i
].size
) {
35 if (addr
>= bd
->bi_dram
[i
].start
&&
36 addr
< (bd
->bi_dram
[i
].start
+ bd
->bi_dram
[i
].size
))
44 int authenticate_os_container(ulong addr
)
46 struct container_hdr
*phdr
;
50 sc_faddr_t start
, end
;
52 struct boot_img_t
*img
;
56 puts("Error: Image's address is not 4 byte aligned\n");
60 if (!check_in_dram(addr
)) {
61 puts("Error: Image's address is invalid\n");
65 phdr
= (struct container_hdr
*)addr
;
66 if (phdr
->tag
!= 0x87 && phdr
->version
!= 0x0) {
67 printf("Error: Wrong container header\n");
71 if (!phdr
->num_images
) {
72 printf("Error: Wrong container, no image found\n");
76 length
= phdr
->length_lsb
+ (phdr
->length_msb
<< 8);
78 debug("container length %u\n", length
);
79 memcpy((void *)SEC_SECURE_RAM_BASE
, (const void *)addr
,
80 ALIGN(length
, CONFIG_SYS_CACHELINE_SIZE
));
82 err
= sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER
,
83 SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE
);
85 printf("Authenticate container hdr failed, return %d\n",
91 /* Copy images to dest address */
92 for (i
= 0; i
< phdr
->num_images
; i
++) {
93 img
= (struct boot_img_t
*)(addr
+
94 sizeof(struct container_hdr
) +
95 i
* sizeof(struct boot_img_t
));
97 debug("img %d, dst 0x%x, src 0x%lux, size 0x%x\n",
98 i
, (uint32_t) img
->dst
, img
->offset
+ addr
, img
->size
);
100 memcpy((void *)img
->dst
, (const void *)(img
->offset
+ addr
),
103 s
= img
->dst
& ~(CONFIG_SYS_CACHELINE_SIZE
- 1);
104 e
= ALIGN(img
->dst
+ img
->size
, CONFIG_SYS_CACHELINE_SIZE
) - 1;
106 flush_dcache_range(s
, e
);
108 /* Find the memreg and set permission for seco pt */
109 err
= sc_rm_find_memreg(-1, &mr
, s
, e
);
111 printf("Error: can't find memreg for image load address 0x%llx, error %d\n", img
->dst
, err
);
116 err
= sc_rm_get_memreg_info(-1, mr
, &start
, &end
);
118 debug("memreg %u 0x%llx -- 0x%llx\n", mr
, start
, end
);
120 err
= sc_rm_set_memreg_permissions(-1, mr
, SECO_PT
,
123 printf("Set permission failed for img %d, error %d\n",
129 err
= sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE
,
132 printf("Authenticate img %d failed, return %d\n",
137 err
= sc_rm_set_memreg_permissions(-1, mr
, SECO_PT
,
140 printf("Remove permission failed for img %d, err %d\n",
150 if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER
, 0) != SC_ERR_NONE
)
151 printf("Error: release container failed!\n");
156 static int do_authenticate(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
162 return CMD_RET_USAGE
;
164 addr
= hextoul(argv
[1], NULL
);
166 printf("Authenticate OS container at 0x%lx\n", addr
);
168 if (authenticate_os_container(addr
))
169 return CMD_RET_FAILURE
;
171 return CMD_RET_SUCCESS
;
174 static void display_life_cycle(u16 lc
)
176 printf("Lifecycle: 0x%04X, ", lc
);
179 printf("Pristine\n\n");
188 printf("NXP closed\n\n");
191 printf("OEM closed\n\n");
194 printf("Partial field return\n\n");
197 printf("Full field return\n\n");
200 printf("No return\n\n");
203 printf("Unknown\n\n");
208 #define AHAB_AUTH_CONTAINER_REQ 0x87
209 #define AHAB_VERIFY_IMAGE_REQ 0x88
211 #define AHAB_NO_AUTHENTICATION_IND 0xee
212 #define AHAB_BAD_KEY_HASH_IND 0xfa
213 #define AHAB_INVALID_KEY_IND 0xf9
214 #define AHAB_BAD_SIGNATURE_IND 0xf0
215 #define AHAB_BAD_HASH_IND 0xf1
217 static void display_ahab_auth_event(u32 event
)
219 u8 cmd
= (event
>> 16) & 0xff;
220 u8 resp_ind
= (event
>> 8) & 0xff;
223 case AHAB_AUTH_CONTAINER_REQ
:
224 printf("\tCMD = AHAB_AUTH_CONTAINER_REQ (0x%02X)\n", cmd
);
227 case AHAB_VERIFY_IMAGE_REQ
:
228 printf("\tCMD = AHAB_VERIFY_IMAGE_REQ (0x%02X)\n", cmd
);
236 case AHAB_NO_AUTHENTICATION_IND
:
237 printf("AHAB_NO_AUTHENTICATION_IND (0x%02X)\n\n", resp_ind
);
239 case AHAB_BAD_KEY_HASH_IND
:
240 printf("AHAB_BAD_KEY_HASH_IND (0x%02X)\n\n", resp_ind
);
242 case AHAB_INVALID_KEY_IND
:
243 printf("AHAB_INVALID_KEY_IND (0x%02X)\n\n", resp_ind
);
245 case AHAB_BAD_SIGNATURE_IND
:
246 printf("AHAB_BAD_SIGNATURE_IND (0x%02X)\n\n", resp_ind
);
248 case AHAB_BAD_HASH_IND
:
249 printf("AHAB_BAD_HASH_IND (0x%02X)\n\n", resp_ind
);
252 printf("Unknown Indicator (0x%02X)\n\n", resp_ind
);
257 static int do_ahab_status(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
265 err
= sc_seco_chip_info(-1, &lc
, NULL
, NULL
, NULL
);
266 if (err
!= SC_ERR_NONE
) {
267 printf("Error in get lifecycle\n");
271 display_life_cycle(lc
);
273 err
= sc_seco_get_event(-1, idx
, &event
);
274 while (err
== SC_ERR_NONE
) {
275 printf("SECO Event[%u] = 0x%08X\n", idx
, event
);
276 display_ahab_auth_event(event
);
279 err
= sc_seco_get_event(-1, idx
, &event
);
283 printf("No SECO Events Found!\n\n");
288 static int confirm_close(void)
290 puts("Warning: Please ensure your sample is in NXP closed state, "
291 "OEM SRK hash has been fused, \n"
292 " and you are able to boot a signed image successfully "
293 "without any SECO events reported.\n"
294 " If not, your sample will be unrecoverable.\n"
295 "\nReally perform this operation? <y/N>\n");
300 puts("Ahab close aborted\n");
304 static int do_ahab_close(struct cmd_tbl
*cmdtp
, int flag
, int argc
,
307 int confirmed
= argc
>= 2 && !strcmp(argv
[1], "-y");
311 if (!confirmed
&& !confirm_close())
314 err
= sc_seco_chip_info(-1, &lc
, NULL
, NULL
, NULL
);
315 if (err
!= SC_ERR_NONE
) {
316 printf("Error in get lifecycle\n");
321 puts("Current lifecycle is NOT NXP closed, can't move to OEM closed\n");
322 display_life_cycle(lc
);
326 err
= sc_seco_forward_lifecycle(-1, 16);
327 if (err
!= SC_ERR_NONE
) {
328 printf("Error in forward lifecycle to OEM closed\n");
332 printf("Change to OEM closed successfully\n");
337 U_BOOT_CMD(auth_cntr
, CONFIG_SYS_MAXARGS
, 1, do_authenticate
,
338 "autenticate OS container via AHAB",
340 "addr - OS container hex address\n"
343 U_BOOT_CMD(ahab_status
, CONFIG_SYS_MAXARGS
, 1, do_ahab_status
,
344 "display AHAB lifecycle and events from seco",
348 U_BOOT_CMD(ahab_close
, CONFIG_SYS_MAXARGS
, 1, do_ahab_close
,
349 "Change AHAB lifecycle to OEM closed",