imx: ahab: Update AHAB for iMX8 and iMX8ULP

Abstract common interfaces for AHAB authentication operations.
Then share some common codes for AHAB and SPL container authentication

Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>

diff --git a/arch/arm/include/asm/mach-imx/ahab.h b/arch/arm/include/asm/mach-imx/ahab.h
new file mode 100644 (file)
index 0000000..4222e3d
--- /dev/null
+++ b/arch/arm/include/asm/mach-imx/ahab.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * Copyright 2020 NXP
+ */
+
+#ifndef __IMX_AHAB_H__
+#define __IMX_AHAB_H__
+
+#include <asm/mach-imx/image.h>
+
+int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length);
+int ahab_auth_release(void);
+int ahab_verify_cntr_image(struct boot_img_t *img, int image_index);
+
+#endif

diff --git a/arch/arm/mach-imx/imx8/ahab.c b/arch/arm/mach-imx/imx8/ahab.c
index 86b0e0b755f55d03028c1414c44ca5f5dcc11116..c878743feeb0dba3536d1aefdea60078ed579ed6 100644 (file)
--- a/arch/arm/mach-imx/imx8/ahab.c
+++ b/arch/arm/mach-imx/imx8/ahab.c
@@ -16,6 +16,7 @@
 #include <asm/mach-imx/image.h>
 #include <console.h>
 #include <cpu_func.h>
+#include <asm/mach-imx/ahab.h>
 
 DECLARE_GLOBAL_DATA_PTR;
 
@@ -25,6 +26,84 @@ DECLARE_GLOBAL_DATA_PTR;
 
 #define SECO_PT                 2U
 
+int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length)
+{
+       int err;
+
+       memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)container,
+              ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
+
+       err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
+                                  SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
+       if (err)
+               printf("Authenticate container hdr failed, return %d\n", err);
+
+       return err;
+}
+
+int ahab_auth_release(void)
+{
+       int err;
+
+       err = sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0);
+       if (err)
+               printf("Error: release container failed!\n");
+
+       return err;
+}
+
+int ahab_verify_cntr_image(struct boot_img_t *img, int image_index)
+{
+       sc_faddr_t start, end;
+       sc_rm_mr_t mr;
+       int err;
+       int ret = 0;
+
+       debug("img %d, dst 0x%llx, src 0x%x, size 0x%x\n",
+             image_index, img->dst, img->offset, img->size);
+
+       /* Find the memreg and set permission for seco pt */
+       err = sc_rm_find_memreg(-1, &mr,
+                               img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
+                               ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1);
+
+       if (err) {
+               printf("Error: can't find memreg for image load address 0x%llx, error %d\n",
+                      img->dst, err);
+               return -ENOMEM;
+       }
+
+       err = sc_rm_get_memreg_info(-1, mr, &start, &end);
+       if (!err)
+               debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
+
+       err = sc_rm_set_memreg_permissions(-1, mr,
+                                          SECO_PT, SC_RM_PERM_FULL);
+       if (err) {
+               printf("Set permission failed for img %d, error %d\n",
+                      image_index, err);
+               return -EPERM;
+       }
+
+       err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
+                                  1 << image_index);
+       if (err) {
+               printf("Authenticate img %d failed, return %d\n",
+                      image_index, err);
+               ret = -EIO;
+       }
+
+       err = sc_rm_set_memreg_permissions(-1, mr,
+                                          SECO_PT, SC_RM_PERM_NONE);
+       if (err) {
+               printf("Remove permission failed for img %d, error %d\n",
+                      image_index, err);
+               ret = -EPERM;
+       }
+
+       return ret;
+}
+
 static inline bool check_in_dram(ulong addr)
 {
        int i;
@@ -46,8 +125,6 @@ int authenticate_os_container(ulong addr)
        struct container_hdr *phdr;
        int i, ret = 0;
        int err;
-       sc_rm_mr_t mr;
-       sc_faddr_t start, end;
        u16 length;
        struct boot_img_t *img;
        unsigned long s, e;
@@ -76,14 +153,9 @@ int authenticate_os_container(ulong addr)
        length = phdr->length_lsb + (phdr->length_msb << 8);
 
        debug("container length %u\n", length);
-       memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)addr,
-              ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
 
-       err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
-                                  SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
+       err = ahab_auth_cntr_hdr(phdr, length);
        if (err) {
-               printf("Authenticate container hdr failed, return %d\n",
-                      err);
                ret = -EIO;
                goto exit;
        }
@@ -105,50 +177,13 @@ int authenticate_os_container(ulong addr)
 
                flush_dcache_range(s, e);
 
-               /* Find the memreg and set permission for seco pt */
-               err = sc_rm_find_memreg(-1, &mr, s, e);
-               if (err) {
-                       printf("Error: can't find memreg for image load address 0x%llx, error %d\n", img->dst, err);
-                       ret = -ENOMEM;
-                       goto exit;
-               }
-
-               err = sc_rm_get_memreg_info(-1, mr, &start, &end);
-               if (!err)
-                       debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
-
-               err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
-                                                  SC_RM_PERM_FULL);
-               if (err) {
-                       printf("Set permission failed for img %d, error %d\n",
-                              i, err);
-                       ret = -EPERM;
-                       goto exit;
-               }
-
-               err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
-                                          (1 << i));
-               if (err) {
-                       printf("Authenticate img %d failed, return %d\n",
-                              i, err);
-                       ret = -EIO;
-               }
-
-               err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT,
-                                                  SC_RM_PERM_NONE);
-               if (err) {
-                       printf("Remove permission failed for img %d, err %d\n",
-                              i, err);
-                       ret = -EPERM;
-               }
-
+               ret = ahab_verify_cntr_image(img, i);
                if (ret)
                        goto exit;
        }
 
 exit:
-       if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0))
-               printf("Error: release container failed!\n");
+       ahab_auth_release();
 
        return ret;
 }

diff --git a/arch/arm/mach-imx/imx8ulp/Makefile b/arch/arm/mach-imx/imx8ulp/Makefile
index f7692cf3a78f81797367edd1ccff250a63be2299..2c9938fcdf0ab2ae9ee2a5d6847255b82fdd6649 100644 (file)
--- a/arch/arm/mach-imx/imx8ulp/Makefile
+++ b/arch/arm/mach-imx/imx8ulp/Makefile
@@ -5,7 +5,6 @@
 
 obj-y += lowlevel_init.o
 obj-y += soc.o clock.o iomux.o pcc.o cgc.o rdc.o
-obj-$(CONFIG_AHAB_BOOT) += ahab.o
 
 ifeq ($(CONFIG_SPL_BUILD),y)
 obj-y += upower/

diff --git a/arch/arm/mach-imx/parse-container.c b/arch/arm/mach-imx/parse-container.c
index c5b3abc4f29d0c0779f0fdc079b606945bed8db8..e2a9e2b273282c287b5eb9830936dc00f646d6a8 100644 (file)
--- a/arch/arm/mach-imx/parse-container.c
+++ b/arch/arm/mach-imx/parse-container.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
- * Copyright 2018-2019 NXP
+ * Copyright 2018-2021 NXP
  */
 
 #include <common.h>
@@ -10,67 +10,7 @@
 #include <spl.h>
 #include <asm/mach-imx/image.h>
 #ifdef CONFIG_AHAB_BOOT
-#include <firmware/imx/sci/sci.h>
-#endif
-
-#define SEC_SECURE_RAM_BASE            0x31800000UL
-#define SEC_SECURE_RAM_END_BASE                (SEC_SECURE_RAM_BASE + 0xFFFFUL)
-#define SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE     0x60000000UL
-
-#define SECO_PT         2U
-
-#ifdef CONFIG_AHAB_BOOT
-static int authenticate_image(struct boot_img_t *img, int image_index)
-{
-       sc_faddr_t start, end;
-       sc_rm_mr_t mr;
-       int err;
-       int ret = 0;
-
-       debug("img %d, dst 0x%x, src 0x%x, size 0x%x\n",
-             image_index, (uint32_t)img->dst, img->offset, img->size);
-
-       /* Find the memreg and set permission for seco pt */
-       err = sc_rm_find_memreg(-1, &mr,
-                               img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
-                               ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1);
-
-       if (err) {
-               printf("can't find memreg for image %d load address 0x%llx, error %d\n",
-                      image_index, img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1), err);
-               return -ENOMEM;
-       }
-
-       err = sc_rm_get_memreg_info(-1, mr, &start, &end);
-       if (!err)
-               debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end);
-
-       err = sc_rm_set_memreg_permissions(-1, mr,
-                                          SECO_PT, SC_RM_PERM_FULL);
-       if (err) {
-               printf("set permission failed for img %d, error %d\n",
-                      image_index, err);
-               return -EPERM;
-       }
-
-       err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE,
-                                  1 << image_index);
-       if (err) {
-               printf("authenticate img %d failed, return %d\n",
-                      image_index, err);
-               ret = -EIO;
-       }
-
-       err = sc_rm_set_memreg_permissions(-1, mr,
-                                          SECO_PT, SC_RM_PERM_NONE);
-       if (err) {
-               printf("remove permission failed for img %d, error %d\n",
-                      image_index, err);
-               ret = -EPERM;
-       }
-
-       return ret;
-}
+#include <asm/mach-imx/ahab.h>
 #endif
 
 static struct boot_img_t *read_auth_image(struct spl_image_info *spl_image,
@@ -111,10 +51,8 @@ static struct boot_img_t *read_auth_image(struct spl_image_info *spl_image,
        }
 
 #ifdef CONFIG_AHAB_BOOT
-       if (authenticate_image(&images[image_index], image_index)) {
-               printf("Failed to authenticate image %d\n", image_index);
+       if (ahab_verify_cntr_image(&images[image_index], image_index))
                return NULL;
-       }
 #endif
 
        return &images[image_index];
@@ -180,15 +118,9 @@ static int read_auth_container(struct spl_image_info *spl_image,
        }
 
 #ifdef CONFIG_AHAB_BOOT
-       memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)container,
-              ALIGN(length, CONFIG_SYS_CACHELINE_SIZE));
-
-       ret = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER,
-                                  SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE);
-       if (ret) {
-               printf("authenticate container hdr failed, return %d\n", ret);
+       ret = ahab_auth_cntr_hdr(container, length);
+       if (ret)
                goto end_auth;
-       }
 #endif
 
        for (i = 0; i < container->num_images; i++) {
@@ -209,8 +141,7 @@ static int read_auth_container(struct spl_image_info *spl_image,
 
 end_auth:
 #ifdef CONFIG_AHAB_BOOT
-       if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0))
-               printf("Error: release container failed!\n");
+       ahab_auth_release();
 #endif
 
 end: