From 00ce4153fbd01aa78b734d87f16772480c42166e Mon Sep 17 00:00:00 2001 From: Ye Li Date: Thu, 15 Jun 2023 18:09:23 +0800 Subject: [PATCH] imx: ahab: Update AHAB for iMX8 and iMX8ULP Abstract common interfaces for AHAB authentication operations. Then share some common codes for AHAB and SPL container authentication Signed-off-by: Ye Li Signed-off-by: Peng Fan --- arch/arm/include/asm/mach-imx/ahab.h | 15 ++++ arch/arm/mach-imx/imx8/ahab.c | 129 +++++++++++++++++---------- arch/arm/mach-imx/imx8ulp/Makefile | 1 - arch/arm/mach-imx/parse-container.c | 81 ++--------------- 4 files changed, 103 insertions(+), 123 deletions(-) create mode 100644 arch/arm/include/asm/mach-imx/ahab.h diff --git a/arch/arm/include/asm/mach-imx/ahab.h b/arch/arm/include/asm/mach-imx/ahab.h new file mode 100644 index 0000000000..4222e3db27 --- /dev/null +++ b/arch/arm/include/asm/mach-imx/ahab.h @@ -0,0 +1,15 @@ +/* SPDX-License-Identifier: GPL-2.0+ */ +/* + * Copyright 2020 NXP + */ + +#ifndef __IMX_AHAB_H__ +#define __IMX_AHAB_H__ + +#include + +int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length); +int ahab_auth_release(void); +int ahab_verify_cntr_image(struct boot_img_t *img, int image_index); + +#endif diff --git a/arch/arm/mach-imx/imx8/ahab.c b/arch/arm/mach-imx/imx8/ahab.c index 86b0e0b755..c878743fee 100644 --- a/arch/arm/mach-imx/imx8/ahab.c +++ b/arch/arm/mach-imx/imx8/ahab.c @@ -16,6 +16,7 @@ #include #include #include +#include DECLARE_GLOBAL_DATA_PTR; @@ -25,6 +26,84 @@ DECLARE_GLOBAL_DATA_PTR; #define SECO_PT 2U +int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length) +{ + int err; + + memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)container, + ALIGN(length, CONFIG_SYS_CACHELINE_SIZE)); + + err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER, + SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE); + if (err) + printf("Authenticate container hdr failed, return %d\n", err); + + return err; +} + +int ahab_auth_release(void) +{ + int err; + + err = sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0); + if (err) + printf("Error: release container failed!\n"); + + return err; +} + +int ahab_verify_cntr_image(struct boot_img_t *img, int image_index) +{ + sc_faddr_t start, end; + sc_rm_mr_t mr; + int err; + int ret = 0; + + debug("img %d, dst 0x%llx, src 0x%x, size 0x%x\n", + image_index, img->dst, img->offset, img->size); + + /* Find the memreg and set permission for seco pt */ + err = sc_rm_find_memreg(-1, &mr, + img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1), + ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1); + + if (err) { + printf("Error: can't find memreg for image load address 0x%llx, error %d\n", + img->dst, err); + return -ENOMEM; + } + + err = sc_rm_get_memreg_info(-1, mr, &start, &end); + if (!err) + debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end); + + err = sc_rm_set_memreg_permissions(-1, mr, + SECO_PT, SC_RM_PERM_FULL); + if (err) { + printf("Set permission failed for img %d, error %d\n", + image_index, err); + return -EPERM; + } + + err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE, + 1 << image_index); + if (err) { + printf("Authenticate img %d failed, return %d\n", + image_index, err); + ret = -EIO; + } + + err = sc_rm_set_memreg_permissions(-1, mr, + SECO_PT, SC_RM_PERM_NONE); + if (err) { + printf("Remove permission failed for img %d, error %d\n", + image_index, err); + ret = -EPERM; + } + + return ret; +} + static inline bool check_in_dram(ulong addr) { int i; @@ -46,8 +125,6 @@ int authenticate_os_container(ulong addr) struct container_hdr *phdr; int i, ret = 0; int err; - sc_rm_mr_t mr; - sc_faddr_t start, end; u16 length; struct boot_img_t *img; unsigned long s, e; @@ -76,14 +153,9 @@ int authenticate_os_container(ulong addr) length = phdr->length_lsb + (phdr->length_msb << 8); debug("container length %u\n", length); - memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)addr, - ALIGN(length, CONFIG_SYS_CACHELINE_SIZE)); - err = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER, - SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE); + err = ahab_auth_cntr_hdr(phdr, length); if (err) { - printf("Authenticate container hdr failed, return %d\n", - err); ret = -EIO; goto exit; } @@ -105,50 +177,13 @@ int authenticate_os_container(ulong addr) flush_dcache_range(s, e); - /* Find the memreg and set permission for seco pt */ - err = sc_rm_find_memreg(-1, &mr, s, e); - if (err) { - printf("Error: can't find memreg for image load address 0x%llx, error %d\n", img->dst, err); - ret = -ENOMEM; - goto exit; - } - - err = sc_rm_get_memreg_info(-1, mr, &start, &end); - if (!err) - debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end); - - err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT, - SC_RM_PERM_FULL); - if (err) { - printf("Set permission failed for img %d, error %d\n", - i, err); - ret = -EPERM; - goto exit; - } - - err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE, - (1 << i)); - if (err) { - printf("Authenticate img %d failed, return %d\n", - i, err); - ret = -EIO; - } - - err = sc_rm_set_memreg_permissions(-1, mr, SECO_PT, - SC_RM_PERM_NONE); - if (err) { - printf("Remove permission failed for img %d, err %d\n", - i, err); - ret = -EPERM; - } - + ret = ahab_verify_cntr_image(img, i); if (ret) goto exit; } exit: - if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0)) - printf("Error: release container failed!\n"); + ahab_auth_release(); return ret; } diff --git a/arch/arm/mach-imx/imx8ulp/Makefile b/arch/arm/mach-imx/imx8ulp/Makefile index f7692cf3a7..2c9938fcdf 100644 --- a/arch/arm/mach-imx/imx8ulp/Makefile +++ b/arch/arm/mach-imx/imx8ulp/Makefile @@ -5,7 +5,6 @@ obj-y += lowlevel_init.o obj-y += soc.o clock.o iomux.o pcc.o cgc.o rdc.o -obj-$(CONFIG_AHAB_BOOT) += ahab.o ifeq ($(CONFIG_SPL_BUILD),y) obj-y += upower/ diff --git a/arch/arm/mach-imx/parse-container.c b/arch/arm/mach-imx/parse-container.c index c5b3abc4f2..e2a9e2b273 100644 --- a/arch/arm/mach-imx/parse-container.c +++ b/arch/arm/mach-imx/parse-container.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0+ /* - * Copyright 2018-2019 NXP + * Copyright 2018-2021 NXP */ #include @@ -10,67 +10,7 @@ #include #include #ifdef CONFIG_AHAB_BOOT -#include -#endif - -#define SEC_SECURE_RAM_BASE 0x31800000UL -#define SEC_SECURE_RAM_END_BASE (SEC_SECURE_RAM_BASE + 0xFFFFUL) -#define SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE 0x60000000UL - -#define SECO_PT 2U - -#ifdef CONFIG_AHAB_BOOT -static int authenticate_image(struct boot_img_t *img, int image_index) -{ - sc_faddr_t start, end; - sc_rm_mr_t mr; - int err; - int ret = 0; - - debug("img %d, dst 0x%x, src 0x%x, size 0x%x\n", - image_index, (uint32_t)img->dst, img->offset, img->size); - - /* Find the memreg and set permission for seco pt */ - err = sc_rm_find_memreg(-1, &mr, - img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1), - ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1); - - if (err) { - printf("can't find memreg for image %d load address 0x%llx, error %d\n", - image_index, img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1), err); - return -ENOMEM; - } - - err = sc_rm_get_memreg_info(-1, mr, &start, &end); - if (!err) - debug("memreg %u 0x%llx -- 0x%llx\n", mr, start, end); - - err = sc_rm_set_memreg_permissions(-1, mr, - SECO_PT, SC_RM_PERM_FULL); - if (err) { - printf("set permission failed for img %d, error %d\n", - image_index, err); - return -EPERM; - } - - err = sc_seco_authenticate(-1, SC_SECO_VERIFY_IMAGE, - 1 << image_index); - if (err) { - printf("authenticate img %d failed, return %d\n", - image_index, err); - ret = -EIO; - } - - err = sc_rm_set_memreg_permissions(-1, mr, - SECO_PT, SC_RM_PERM_NONE); - if (err) { - printf("remove permission failed for img %d, error %d\n", - image_index, err); - ret = -EPERM; - } - - return ret; -} +#include #endif static struct boot_img_t *read_auth_image(struct spl_image_info *spl_image, @@ -111,10 +51,8 @@ static struct boot_img_t *read_auth_image(struct spl_image_info *spl_image, } #ifdef CONFIG_AHAB_BOOT - if (authenticate_image(&images[image_index], image_index)) { - printf("Failed to authenticate image %d\n", image_index); + if (ahab_verify_cntr_image(&images[image_index], image_index)) return NULL; - } #endif return &images[image_index]; @@ -180,15 +118,9 @@ static int read_auth_container(struct spl_image_info *spl_image, } #ifdef CONFIG_AHAB_BOOT - memcpy((void *)SEC_SECURE_RAM_BASE, (const void *)container, - ALIGN(length, CONFIG_SYS_CACHELINE_SIZE)); - - ret = sc_seco_authenticate(-1, SC_SECO_AUTH_CONTAINER, - SECO_LOCAL_SEC_SEC_SECURE_RAM_BASE); - if (ret) { - printf("authenticate container hdr failed, return %d\n", ret); + ret = ahab_auth_cntr_hdr(container, length); + if (ret) goto end_auth; - } #endif for (i = 0; i < container->num_images; i++) { @@ -209,8 +141,7 @@ static int read_auth_container(struct spl_image_info *spl_image, end_auth: #ifdef CONFIG_AHAB_BOOT - if (sc_seco_authenticate(-1, SC_SECO_REL_CONTAINER, 0)) - printf("Error: release container failed!\n"); + ahab_auth_release(); #endif end: -- 2.39.5