From 0802947cfb94789cdb6b8a402a7c4523549c2a12 Mon Sep 17 00:00:00 2001 From: Nitin Garg Date: Tue, 27 May 2014 08:37:44 -0500 Subject: ENGR00315499-3: Support i.MX6 HAB authentication of kernel image Support HAB authentication of kernel or secondary images via bootm or hab_auth_img u-boot command. Signed-off-by: Nitin Garg --- arch/arm/cpu/armv7/mx6/clock.c | 38 +++++++ arch/arm/cpu/armv7/mx6/hab.c | 241 +++++++++++++++++++++++++++++++++++++++-- arch/arm/cpu/armv7/mx6/soc.c | 15 +++ 3 files changed, 287 insertions(+), 7 deletions(-) (limited to 'arch/arm/cpu') diff --git a/arch/arm/cpu/armv7/mx6/clock.c b/arch/arm/cpu/armv7/mx6/clock.c index bd65a08..fd6248d 100644 --- a/arch/arm/cpu/armv7/mx6/clock.c +++ b/arch/arm/cpu/armv7/mx6/clock.c @@ -498,6 +498,44 @@ int enable_pcie_clock(void) BM_ANADIG_PLL_ENET_ENABLE_PCIE); } +#ifdef CONFIG_SECURE_BOOT +void hab_caam_clock_enable(void) +{ + struct mxc_ccm_reg *ccm_regs = (struct mxc_ccm_reg *)CCM_BASE_ADDR; + u32 reg = 0; + + /*CG4 ~ CG6, enable CAAM clocks*/ + reg = readl(ccm_regs->CCGR0); + reg |= (MXC_CCM_CCGR0_CAAM_WRAPPER_IPG_MASK | + MXC_CCM_CCGR0_CAAM_WRAPPER_ACLK_MASK | + MXC_CCM_CCGR0_CAAM_SECURE_MEM_MASK); + writel(reg, ccm_regs->CCGR0); + + /* Enable EMI slow clk */ + reg = readl(ccm_regs->CCGR6); + reg |= MXC_CCM_CCGR6_EMI_SLOW_MASK; + writel(reg, ccm_regs->CCGR6); +} + +void hab_caam_clock_disable(void) +{ + struct mxc_ccm_reg *ccm_regs = (struct mxc_ccm_reg *)CCM_BASE_ADDR; + u32 reg = 0; + + /*CG4 ~ CG6, disable CAAM clocks*/ + reg = readl(ccm_regs->CCGR0); + reg &= ~(MXC_CCM_CCGR0_CAAM_WRAPPER_IPG_MASK | + MXC_CCM_CCGR0_CAAM_WRAPPER_ACLK_MASK | + MXC_CCM_CCGR0_CAAM_SECURE_MEM_MASK); + writel(reg, ccm_regs->CCGR0); + + /* Disable EMI slow clk */ + reg = readl(ccm_regs->CCGR6); + reg &= ~MXC_CCM_CCGR6_EMI_SLOW_MASK; + writel(reg, ccm_regs->CCGR6); +} +#endif + unsigned int mxc_get_clock(enum mxc_clock clk) { switch (clk) { diff --git a/arch/arm/cpu/armv7/mx6/hab.c b/arch/arm/cpu/armv7/mx6/hab.c index 5187775..e1d10b9 100644 --- a/arch/arm/cpu/armv7/mx6/hab.c +++ b/arch/arm/cpu/armv7/mx6/hab.c @@ -7,15 +7,98 @@ #include #include #include +#include +#include /* -------- start of HAB API updates ------------*/ -#define hab_rvt_report_event ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT) -#define hab_rvt_report_status ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) -#define hab_rvt_authenticate_image \ - ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) -#define hab_rvt_entry ((hab_rvt_entry_t *)HAB_RVT_ENTRY) -#define hab_rvt_exit ((hab_rvt_exit_t *)HAB_RVT_EXIT) -#define hab_rvt_clock_init HAB_RVT_CLOCK_INIT +#define hab_rvt_report_event_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || is_cpu_type(MXC_CPU_MX6D)) \ + && (is_soc_rev(CHIP_REV_1_5) >= 0)) ? \ + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ + (is_cpu_type(MXC_CPU_MX6DL) && (is_soc_rev(CHIP_REV_1_2) >= 0)) ? \ + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_NEW) : \ + ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT) \ +) + +#define hab_rvt_report_status_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || is_cpu_type(MXC_CPU_MX6D)) \ + && (is_soc_rev(CHIP_REV_1_5) >= 0)) ? \ + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) : \ + ((is_cpu_type(MXC_CPU_MX6DL) || is_cpu_type(MXC_CPU_MX6SOLO)) \ + && (is_soc_rev(CHIP_REV_1_2) >= 0)) ? \ + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_NEW) : \ + ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) \ +) + +#define hab_rvt_authenticate_image_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || is_cpu_type(MXC_CPU_MX6D)) \ + && (is_soc_rev(CHIP_REV_1_5) >= 0)) ? \ + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) : \ + ((is_cpu_type(MXC_CPU_MX6DL) || is_cpu_type(MXC_CPU_MX6SOLO)) \ + && (is_soc_rev(CHIP_REV_1_2) >= 0)) ? \ + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_NEW) :\ + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) \ +) + +#define hab_rvt_entry_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || is_cpu_type(MXC_CPU_MX6D)) \ + && (is_soc_rev(CHIP_REV_1_5) >= 0)) ? \ + ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ + ((is_cpu_type(MXC_CPU_MX6DL) || is_cpu_type(MXC_CPU_MX6SOLO)) \ + && (is_soc_rev(CHIP_REV_1_2) >= 0)) ? \ + ((hab_rvt_entry_t *)HAB_RVT_ENTRY_NEW) : \ + ((hab_rvt_entry_t *)HAB_RVT_ENTRY) \ +) + +#define hab_rvt_exit_p \ +( \ + ((is_cpu_type(MXC_CPU_MX6Q) || is_cpu_type(MXC_CPU_MX6D)) \ + && (is_soc_rev(CHIP_REV_1_5) >= 0)) ? \ + ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ + ((is_cpu_type(MXC_CPU_MX6DL) || is_cpu_type(MXC_CPU_MX6SOLO)) \ + && (is_soc_rev(CHIP_REV_1_2) >= 0)) ? \ + ((hab_rvt_exit_t *)HAB_RVT_EXIT_NEW) : \ + ((hab_rvt_exit_t *)HAB_RVT_EXIT) \ +) + +#define IVT_SIZE 0x20 +#define ALIGN_SIZE 0x1000 +#define CSF_PAD_SIZE 0x2000 + +/* + * +------------+ 0x0 (DDR_UIMAGE_START) - + * | Header | | + * +------------+ 0x40 | + * | | | + * | | | + * | | | + * | | | + * | Image Data | | + * . | | + * . | > Stuff to be authenticated ----+ + * . | | | + * | | | | + * | | | | + * +------------+ | | + * | | | | + * | Fill Data | | | + * | | | | + * +------------+ Align to ALIGN_SIZE | | + * | IVT | | | + * +------------+ + IVT_SIZE - | + * | | | + * | CSF DATA | <---------------------------------------------------------+ + * | | + * +------------+ + * | | + * | Fill Data | + * | | + * +------------+ + CSF_PAD_SIZE + */ bool is_hab_enabled(void) { @@ -52,12 +135,17 @@ int get_hab_status(void) size_t bytes = sizeof(event_data); /* Event size in bytes */ enum hab_config config = 0; enum hab_state state = 0; + hab_rvt_report_event_t *hab_rvt_report_event; + hab_rvt_report_status_t *hab_rvt_report_status; if (is_hab_enabled()) puts("\nSecure boot enabled\n"); else puts("\nSecure boot disabled\n"); + hab_rvt_report_event = hab_rvt_report_event_p; + hab_rvt_report_status = hab_rvt_report_status_p; + /* Check HAB status */ if (hab_rvt_report_status(&config, &state) != HAB_SUCCESS) { printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", @@ -85,6 +173,120 @@ int get_hab_status(void) return 0; } +#ifdef DEBUG_AUTHENTICATE_IMAGE +void dump_mem(uint32_t addr, int size) +{ + int i; + + for (i = 0; i < size; i += 4) { + if (i != 0) { + if (i % 16 == 0) + printf("\n"); + else + printf(" "); + } + + printf("0x%08x", *(uint32_t *)addr); + addr += 4; + } + + printf("\n"); + + return; +} +#endif + +uint32_t authenticate_image(uint32_t ddr_start, uint32_t image_size) +{ + uint32_t load_addr = 0; + size_t bytes; + ptrdiff_t ivt_offset = 0; + int result = 0; + ulong start; + hab_rvt_authenticate_image_t *hab_rvt_authenticate_image; + hab_rvt_entry_t *hab_rvt_entry; + hab_rvt_exit_t *hab_rvt_exit; + + hab_rvt_authenticate_image = hab_rvt_authenticate_image_p; + hab_rvt_entry = hab_rvt_entry_p; + hab_rvt_exit = hab_rvt_exit_p; + + if (is_hab_enabled()) { + printf("\nAuthenticate uImage from DDR location 0x%x...\n", + ddr_start); + + hab_caam_clock_enable(); + + if (hab_rvt_entry() == HAB_SUCCESS) { + /* If not already aligned, Align to ALIGN_SIZE */ + ivt_offset = (image_size + ALIGN_SIZE - 1) & + ~(ALIGN_SIZE - 1); + + start = ddr_start; + bytes = ivt_offset + IVT_SIZE + CSF_PAD_SIZE; + +#ifdef DEBUG_AUTHENTICATE_IMAGE + printf("\nivt_offset = 0x%x, ivt addr = 0x%x\n", + ivt_offset, ddr_start + ivt_offset); + printf("Dumping IVT\n"); + dump_mem(ddr_start + ivt_offset, 0x20); + + printf("Dumping CSF Header\n"); + dump_mem(ddr_start + ivt_offset + 0x20, 0x40); + + get_hab_status(); + + printf("\nCalling authenticate_image in ROM\n"); + printf("\tivt_offset = 0x%x\n\tstart = 0x%08x" + "\n\tbytes = 0x%x\n", ivt_offset, start, bytes); +#endif + /* + * If the MMU is enabled, we have to notify the ROM + * code, or it won't flush the caches when needed. + * This is done, by setting the "pu_irom_mmu_enabled" + * word to 1. You can find its address by looking in + * the ROM map. This is critical for + * authenticate_image(). If MMU is enabled, without + * setting this but, authentication will fail and may + * crash. + */ + if (is_cpu_type(MXC_CPU_MX6Q) || + is_cpu_type(MXC_CPU_MX6D)) { + /* + * This won't work on Rev 1.0.0 of i.MX6Q/D, + * since their ROM doesn't do cache flushes. + * I don't think any exist, so we ignore them. + */ + writel(1, 0x009024a8); + } else if (is_cpu_type(MXC_CPU_MX6DL) || + is_cpu_type(MXC_CPU_MX6SOLO)) { + writel(1, 0x00901dd0); + } else if (is_cpu_type(MXC_CPU_MX6SL)) { + writel(1, 0x00900a18); + } + + load_addr = (uint32_t)hab_rvt_authenticate_image( + HAB_CID_UBOOT, + ivt_offset, (void **)&start, + (size_t *)&bytes, NULL); + if (hab_rvt_exit() != HAB_SUCCESS) { + printf("hab exit function fail\n"); + load_addr = 0; + } + } else + printf("hab entry function fail\n"); + + hab_caam_clock_disable(); + + get_hab_status(); + } + + if ((!is_hab_enabled()) || (load_addr != 0)) + result = 1; + + return result; +} + int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { if ((argc != 1)) { @@ -97,8 +299,33 @@ int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) return 0; } +static int do_authenticate_image(cmd_tbl_t *cmdtp, int flag, int argc, + char * const argv[]) +{ + ulong addr, ivt_offset; + int rcode = 0; + + if (argc < 3) + return CMD_RET_USAGE; + + addr = simple_strtoul(argv[1], NULL, 16); + ivt_offset = simple_strtoul(argv[2], NULL, 16); + + rcode = authenticate_image(addr, ivt_offset); + + return rcode; +} + U_BOOT_CMD( hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status, "display HAB status", "" ); + +U_BOOT_CMD( + hab_auth_img, 3, 1, do_authenticate_image, + "authenticate image via HAB", + "addr ivt_offset\n" + "addr - image hex address\n" + "ivt_offset - hex offset of IVT in the image" + ); diff --git a/arch/arm/cpu/armv7/mx6/soc.c b/arch/arm/cpu/armv7/mx6/soc.c index b29973f..c5f3b22 100644 --- a/arch/arm/cpu/armv7/mx6/soc.c +++ b/arch/arm/cpu/armv7/mx6/soc.c @@ -377,10 +377,25 @@ int board_postclk_init(void) #ifndef CONFIG_SYS_DCACHE_OFF void enable_caches(void) { +#if defined(CONFIG_SYS_ARM_CACHE_WRITETHROUGH) + enum dcache_option option = DCACHE_WRITETHROUGH; +#else + enum dcache_option option = DCACHE_WRITEBACK; +#endif + /* Avoid random hang when download by usb */ invalidate_dcache_all(); + /* Enable D-cache. I-cache is already enabled in start.S */ dcache_enable(); + + /* Enable caching on OCRAM and ROM */ + mmu_set_region_dcache_behaviour(ROMCP_ARB_BASE_ADDR, + ROMCP_ARB_END_ADDR, + option); + mmu_set_region_dcache_behaviour(IRAM_BASE_ADDR, + IRAM_SIZE, + option); } #endif -- cgit v1.1