colin/u-boot
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

imx: ahab: Update AHAB for iMX8 and iMX8ULP

Browse Source 
Abstract common interfaces for AHAB authentication operations.
Then share some common codes for AHAB and SPL container authentication

Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
This commit is contained in:
Ye Li
2023-06-15 18:09:23 +08:00
committed by Stefano Babic
parent 6e81ca220e
commit 00ce4153fb
4 changed files with 103 additions and 123 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
arch/arm/include/asm/mach-imx/ahab.h Normal file
View File

@@ -0,0 +1,15 @@
/* SPDX-License-Identifier: GPL-2.0+ */
/*
* Copyright 2020 NXP
*/
#ifndef __IMX_AHAB_H__
#define __IMX_AHAB_H__
#include <asm/mach-imx/image.h>
int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length);
int ahab_auth_release(void);
int ahab_verify_cntr_image(struct boot_img_t *img, int image_index);
#endif

129
arch/arm/mach-imx/imx8/ahab.c
View File

@@ -16,6 +16,7 @@
#include <asm/mach-imx/image.h>
#include <console.h>
#include <cpu_func.h>
#include <asm/mach-imx/ahab.h>
DECLARE_GLOBAL_DATA_PTR;
@@ -25,6 +26,84 @@ DECLARE_GLOBAL_DATA_PTR;
#define SECO_PT 2U
int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
{
int err;
memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)container,
ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
if (err)
printf("Authenticate container hdr failed, return %d\n", err);
return err;
}
int ahab_auth_release(void)
{
int err;
err = sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0);
if (err)
printf("Error: release container failed!\n");
return err;
}
int ahab_verify_cntr_image(struct boot_img_t *img, int image_index)
{
sc_faddr_t start, end;
sc_rm_mr_t mr;
int err;
int ret = 0;
debug("img %d, dst 0x%llx, src 0x%x, size 0x%x\n",
image_index, img->dst, img->offset, img->size);
/* Find the memreg and set permission for seco pt */
err = sc_rm_find_memreg(-1, &mr,
img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1);
if (err) {
printf("Error: can't find memreg for image load address 0x%llx, error %d\n",
img->dst, err);
return -ENOMEM;
}
err = sc_rm_get_memreg_info(-1, mr, &start, &end);
if (!err)
debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
err = sc_rm_set_memreg_permissions(-1, mr,
SECO_PT, SC_RM_PERM_FULL);
if (err) {
printf("Set permission failed for img %d, error %d\n",
image_index, err);
return -EPERM;
}
err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
1 << image_index);
if (err) {
printf("Authenticate img %d failed, return %d\n",
image_index, err);
ret = -EIO;
}
err = sc_rm_set_memreg_permissions(-1, mr,
SECO_PT, SC_RM_PERM_NONE);
if (err) {
printf("Remove permission failed for img %d, error %d\n",
image_index, err);
ret = -EPERM;
}
return ret;
}
static inline bool check_in_dram(ulong addr)
{
int i;
@@ -46,8 +125,6 @@ int authenticate_os_container(ulong addr)
struct container_hdr *phdr;
int i, ret = 0;
int err;
sc_rm_mr_t mr;
sc_faddr_t start, end;
u16 length;
struct boot_img_t *img;
unsigned long s, e;
@@ -76,14 +153,9 @@ int authenticate_os_container(ulong addr)
length = phdr->length_lsb + (phdr->length_msb << 8);
debug("container length %u\n", length);
memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)addr,
ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
err = ahab_auth_cntr_hdr(phdr, length);
if (err) {
printf("Authenticate container hdr failed, return %d\n",
err);
ret = -EIO;
goto exit;
}
@@ -105,50 +177,13 @@ int authenticate_os_container(ulong addr)
flush_dcache_range(s, e);
/* Find the memreg and set permission for seco pt */
err = sc_rm_find_memreg(-1, &mr, s, e);
if (err) {
printf("Error: can't find memreg for image load address 0x%llx, error %d\n", img->dst, err);
ret = -ENOMEM;
goto exit;
}
err = sc_rm_get_memreg_info(-1, mr, &start, &end);
if (!err)
debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
SC_RM_PERM_FULL);
if (err) {
printf("Set permission failed for img %d, error %d\n",
i, err);
ret = -EPERM;
goto exit;
}
err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
(1 << i));
if (err) {
printf("Authenticate img %d failed, return %d\n",
i, err);
ret = -EIO;
}
err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
SC_RM_PERM_NONE);
if (err) {
printf("Remove permission failed for img %d, err %d\n",
i, err);
ret = -EPERM;
}
ret = ahab_verify_cntr_image(img, i);
if (ret)
goto exit;
}
exit:
if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0))
printf("Error: release container failed!\n");
ahab_auth_release();
return ret;
}

1
arch/arm/mach-imx/imx8ulp/Makefile
View File

@@ -5,7 +5,6 @@
obj-y += lowlevel_init.o
obj-y += soc.o clock.o iomux.o pcc.o cgc.o rdc.o
obj-$(CONFIG_AHAB_BOOT) += ahab.o
ifeq ($(CONFIG_SPL_BUILD),y)
obj-y += upower/

81
arch/arm/mach-imx/parse-container.c
View File

@@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0+
/*
* Copyright 2018-2019 NXP
* Copyright 2018-2021 NXP
*/
#include <common.h>
@@ -10,67 +10,7 @@
#include <spl.h>
#include <asm/mach-imx/image.h>
#ifdef CONFIG_AHAB_BOOT
#include <firmware/imx/sci/sci.h>
#endif
#define SEC_SECURE_RAM_BASE 0x31800000UL
#define SEC_SECURE_RAM_END_BASE (SEC_SECURE_RAM_BASE + 0xFFFFUL)
#define SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE 0x60000000UL
#define SECO_PT 2U
#ifdef CONFIG_AHAB_BOOT
static int authenticate_image(struct boot_img_t *img, int image_index)
{
sc_faddr_t start, end;
sc_rm_mr_t mr;
int err;
int ret = 0;
debug("img %d, dst 0x%x, src 0x%x, size 0x%x\n",
image_index, (uint32_t)img->dst, img->offset, img->size);
/* Find the memreg and set permission for seco pt */
err = sc_rm_find_memreg(-1, &mr,
img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1);
if (err) {
printf("can't find memreg for image %d load address 0x%llx, error %d\n",
image_index, img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1), err);
return -ENOMEM;
}
err = sc_rm_get_memreg_info(-1, mr, &start, &end);
if (!err)
debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
err = sc_rm_set_memreg_permissions(-1, mr,
SECO_PT, SC_RM_PERM_FULL);
if (err) {
printf("set permission failed for img %d, error %d\n",
image_index, err);
return -EPERM;
}
err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
1 << image_index);
if (err) {
printf("authenticate img %d failed, return %d\n",
image_index, err);
ret = -EIO;
}
err = sc_rm_set_memreg_permissions(-1, mr,
SECO_PT, SC_RM_PERM_NONE);
if (err) {
printf("remove permission failed for img %d, error %d\n",
image_index, err);
ret = -EPERM;
}
return ret;
}
#include <asm/mach-imx/ahab.h>
#endif
static struct boot_img_t *read_auth_image(struct spl_image_info *spl_image,
@@ -111,10 +51,8 @@ static struct boot_img_t *read_auth_image(struct spl_image_info *spl_image,
}
#ifdef CONFIG_AHAB_BOOT
if (authenticate_image(&images[image_index], image_index)) {
printf("Failed to authenticate image %d\n", image_index);
if (ahab_verify_cntr_image(&images[image_index], image_index))
return NULL;
}
#endif
return &images[image_index];
@@ -180,15 +118,9 @@ static int read_auth_container(struct spl_image_info *spl_image,
}
#ifdef CONFIG_AHAB_BOOT
memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)container,
ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
ret = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
if (ret) {
printf("authenticate container hdr failed, return %d\n", ret);
ret = ahab_auth_cntr_hdr(container, length);
if (ret)
goto end_auth;
}
#endif
for (i = 0; i < container->num_images; i++) {
@@ -209,8 +141,7 @@ static int read_auth_container(struct spl_image_info *spl_image,
end_auth:
#ifdef CONFIG_AHAB_BOOT
if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0))
printf("Error: release container failed!\n");
ahab_auth_release();
#endif
end: