| Message ID | 1373548001-19728-8-git-send-email-sbabic@denx.de |
|---|---|
| State | Superseded |
| Headers | show |
Hi Stefano, On Thu, Jul 11, 2013 at 10:06 AM, Stefano Babic <sbabic@denx.de> wrote: > --- a/arch/arm/cpu/armv7/mx6/Makefile > +++ b/arch/arm/cpu/armv7/mx6/Makefile > @@ -27,7 +27,7 @@ include $(TOPDIR)/config.mk > > LIB = $(obj)lib$(SOC).o Whole series looks good. Only a minor comment: > -COBJS = soc.o clock.o > +COBJS = soc.o clock.o hab.o What about: COBJS-y += soc.o clock.o COBJS-$(CONFIG_SECURE_BOOT) += hab.o > > SRCS := $(SOBJS:.o=.S) $(COBJS:.o=.c) > OBJS := $(addprefix $(obj),$(SOBJS) $(COBJS)) > diff --git a/arch/arm/cpu/armv7/mx6/hab.c b/arch/arm/cpu/armv7/mx6/hab.c > new file mode 100644 > index 0000000..c3c273f > --- /dev/null > +++ b/arch/arm/cpu/armv7/mx6/hab.c > @@ -0,0 +1,127 @@ > +/* > + * Copyright (C) 2010-2013 Freescale Semiconductor, Inc. > + * > + * See file CREDITS for list of people who contributed to this > + * project. > + * > + * This program is free software; you can redistribute it and/or > + * modify it under the terms of the GNU General Public License as > + * published by the Free Software Foundation; either version 2 of > + * the License, or (at your option) any later version. > + * > + * This program is distributed in the hope that it will be useful, > + * but WITHOUT ANY WARRANTY; without even the implied warranty of > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > + * GNU General Public License for more details. > + * > + * You should have received a copy of the GNU General Public License > + * along with this program; if not, write to the Free Software > + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, > + * MA 02111-1307 USA > + */ > + > +#include <common.h> > +#include <asm/io.h> > +#if defined(CONFIG_SECURE_BOOT) ,and then you remove this 'if defined' ?
Dear Stefano Babic, > Add functions to report the HAB (High Assurance Boot) status > of e.g. i.MX6 CPUs. > > This is taken from > > git://git.freescale.com/imx/uboot-imx.git branch imx_v2009.08_3.0.35_4.0.0 > cpu/arm_cortexa8/mx6/generic.c > include/asm-arm/arch-mx6/mx6_secure.h > > Signed-off-by: Stefano Babic <sbabic@denx.de> > --- > arch/arm/cpu/armv7/mx6/Makefile | 2 +- > arch/arm/cpu/armv7/mx6/hab.c | 127 > ++++++++++++++++++++++++++++++ arch/arm/include/asm/arch-mx6/hab.h | > 80 +++++++++++++++++++ arch/arm/include/asm/arch-mx6/imx-regs.h | 8 +- > 4 files changed, 215 insertions(+), 2 deletions(-) > create mode 100644 arch/arm/cpu/armv7/mx6/hab.c > create mode 100644 arch/arm/include/asm/arch-mx6/hab.h > > diff --git a/arch/arm/cpu/armv7/mx6/Makefile > b/arch/arm/cpu/armv7/mx6/Makefile index 4f9ca68..7c18f43 100644 > --- a/arch/arm/cpu/armv7/mx6/Makefile > +++ b/arch/arm/cpu/armv7/mx6/Makefile > @@ -27,7 +27,7 @@ include $(TOPDIR)/config.mk > > LIB = $(obj)lib$(SOC).o > > -COBJS = soc.o clock.o > +COBJS = soc.o clock.o hab.o > > SRCS := $(SOBJS:.o=.S) $(COBJS:.o=.c) > OBJS := $(addprefix $(obj),$(SOBJS) $(COBJS)) > diff --git a/arch/arm/cpu/armv7/mx6/hab.c b/arch/arm/cpu/armv7/mx6/hab.c > new file mode 100644 > index 0000000..c3c273f > --- /dev/null > +++ b/arch/arm/cpu/armv7/mx6/hab.c > @@ -0,0 +1,127 @@ > +/* > + * Copyright (C) 2010-2013 Freescale Semiconductor, Inc. > + * > + * See file CREDITS for list of people who contributed to this > + * project. > + * > + * This program is free software; you can redistribute it and/or > + * modify it under the terms of the GNU General Public License as > + * published by the Free Software Foundation; either version 2 of > + * the License, or (at your option) any later version. > + * > + * This program is distributed in the hope that it will be useful, > + * but WITHOUT ANY WARRANTY; without even the implied warranty of > + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the > + * GNU General Public License for more details. > + * > + * You should have received a copy of the GNU General Public License > + * along with this program; if not, write to the Free Software > + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, > + * MA 02111-1307 USA > + */ > + > +#include <common.h> > +#include <asm/io.h> > +#if defined(CONFIG_SECURE_BOOT) > +#include <asm/arch/hab.h> > + > +#ifdef CONFIG_SECURE_BOOT > +/* -------- start of HAB API updates ------------*/ > +#define hab_rvt_report_event ((hab_rvt_report_event_t > *)HAB_RVT_REPORT_EVENT) +#define hab_rvt_report_status > ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) +#define > hab_rvt_authenticate_image \ > + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) > +#define hab_rvt_entry ((hab_rvt_entry_t *)HAB_RVT_ENTRY) > +#define hab_rvt_exit ((hab_rvt_exit_t *)HAB_RVT_EXIT) > +#define hab_rvt_clock_init HAB_RVT_CLOCK_INIT > + > + > +bool is_hab_enabled(void) > +{ > + struct ocotp_regs *ocotp = (struct ocotp_regs *)OCOTP_BASE_ADDR; > + struct fuse_bank *bank = &ocotp->bank[0]; > + struct fuse_bank0_regs *fuse = > + (struct fuse_bank0_regs *)bank->fuse_regs; > + uint32_t reg = readl(&fuse->cfg5); > + > + return (reg & 0x2) == 0x2; > +} > + > + > +void display_event(uint8_t *event_data, size_t bytes) > +{ > + uint32_t i; > + > + if ((event_data) && (bytes > 0)) { if (!<cond>) return; <The loop goes here> > + for (i = 0; i < bytes; i++) { > + if (i == 0) > + printf("\t0x%02x", event_data[i]); > + else if ((i % 8) == 0) > + printf("\n\t0x%02x", event_data[i]); > + else > + printf(" 0x%02x", event_data[i]); > + } > + } > +} > + > +int get_hab_status(void) > +{ > + uint32_t index = 0; /* Loop index */ > + uint8_t event_data[128]; /* Event data buffer */ > + size_t bytes = sizeof(event_data); /* Event size in bytes */ > + hab_config_t config = 0; > + hab_state_t state = 0; > + > + if (is_hab_enabled()) > + printf("\nSecure boot enabled\n"); > + else > + printf("\nSecure boot disabled\n"); Use puts() instead of printf() with no args. Otherwise very nice ;-) Best regards, Marek Vasut
Hi Fabio, On 11/07/2013 19:17, Fabio Estevam wrote: > Hi Stefano, > > On Thu, Jul 11, 2013 at 10:06 AM, Stefano Babic <sbabic@denx.de> wrote: > >> --- a/arch/arm/cpu/armv7/mx6/Makefile >> +++ b/arch/arm/cpu/armv7/mx6/Makefile >> @@ -27,7 +27,7 @@ include $(TOPDIR)/config.mk >> >> LIB = $(obj)lib$(SOC).o > > Whole series looks good. > > Only a minor comment: > >> -COBJS = soc.o clock.o >> +COBJS = soc.o clock.o hab.o > > What about: > > COBJS-y += soc.o clock.o > COBJS-$(CONFIG_SECURE_BOOT) += hab.o Correct, fix in V2. > > ,and then you remove this 'if defined' ? > Agree. Best regards, Stefano
Hi Marek, On 11/07/2013 20:31, Marek Vasut wrote: >> +void display_event(uint8_t *event_data, size_t bytes) >> +{ >> + uint32_t i; >> + >> + if ((event_data) && (bytes > 0)) { > > if (!<cond>) > return; > > <The loop goes here> Fix in V2, thanks. >> + if (is_hab_enabled()) >> + printf("\nSecure boot enabled\n"); >> + else >> + printf("\nSecure boot disabled\n"); > > Use puts() instead of printf() with no args. > Right, and I will fix also other similar cases in this file. Regards, Stefano
diff --git a/arch/arm/cpu/armv7/mx6/Makefile b/arch/arm/cpu/armv7/mx6/Makefile index 4f9ca68..7c18f43 100644 --- a/arch/arm/cpu/armv7/mx6/Makefile +++ b/arch/arm/cpu/armv7/mx6/Makefile @@ -27,7 +27,7 @@ include $(TOPDIR)/config.mk LIB = $(obj)lib$(SOC).o -COBJS = soc.o clock.o +COBJS = soc.o clock.o hab.o SRCS := $(SOBJS:.o=.S) $(COBJS:.o=.c) OBJS := $(addprefix $(obj),$(SOBJS) $(COBJS)) diff --git a/arch/arm/cpu/armv7/mx6/hab.c b/arch/arm/cpu/armv7/mx6/hab.c new file mode 100644 index 0000000..c3c273f --- /dev/null +++ b/arch/arm/cpu/armv7/mx6/hab.c @@ -0,0 +1,127 @@ +/* + * Copyright (C) 2010-2013 Freescale Semiconductor, Inc. + * + * See file CREDITS for list of people who contributed to this + * project. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of + * the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 59 Temple Place, Suite 330, Boston, + * MA 02111-1307 USA + */ + +#include <common.h> +#include <asm/io.h> +#if defined(CONFIG_SECURE_BOOT) +#include <asm/arch/hab.h> + +#ifdef CONFIG_SECURE_BOOT +/* -------- start of HAB API updates ------------*/ +#define hab_rvt_report_event ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT) +#define hab_rvt_report_status ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS) +#define hab_rvt_authenticate_image \ + ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE) +#define hab_rvt_entry ((hab_rvt_entry_t *)HAB_RVT_ENTRY) +#define hab_rvt_exit ((hab_rvt_exit_t *)HAB_RVT_EXIT) +#define hab_rvt_clock_init HAB_RVT_CLOCK_INIT + + +bool is_hab_enabled(void) +{ + struct ocotp_regs *ocotp = (struct ocotp_regs *)OCOTP_BASE_ADDR; + struct fuse_bank *bank = &ocotp->bank[0]; + struct fuse_bank0_regs *fuse = + (struct fuse_bank0_regs *)bank->fuse_regs; + uint32_t reg = readl(&fuse->cfg5); + + return (reg & 0x2) == 0x2; +} + + +void display_event(uint8_t *event_data, size_t bytes) +{ + uint32_t i; + + if ((event_data) && (bytes > 0)) { + for (i = 0; i < bytes; i++) { + if (i == 0) + printf("\t0x%02x", event_data[i]); + else if ((i % 8) == 0) + printf("\n\t0x%02x", event_data[i]); + else + printf(" 0x%02x", event_data[i]); + } + } +} + +int get_hab_status(void) +{ + uint32_t index = 0; /* Loop index */ + uint8_t event_data[128]; /* Event data buffer */ + size_t bytes = sizeof(event_data); /* Event size in bytes */ + hab_config_t config = 0; + hab_state_t state = 0; + + if (is_hab_enabled()) + printf("\nSecure boot enabled\n"); + else + printf("\nSecure boot disabled\n"); + + /* Check HAB status */ + if (hab_rvt_report_status(&config, &state) != HAB_SUCCESS) { + printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", + config, state); + + /* Display HAB Error events */ + while (hab_rvt_report_event(HAB_FAILURE, index, event_data, + &bytes) == HAB_SUCCESS) { + printf("\n"); + printf("--------- HAB Event %d -----------------\n", + index + 1); + printf("event data:\n"); + display_event(event_data, bytes); + printf("\n"); + bytes = sizeof(event_data); + index++; + } + } + /* Display message if no HAB events are found */ + else { + printf("\nHAB Configuration: 0x%02x, HAB State: 0x%02x\n", + config, state); + printf("No HAB Events Found!\n\n"); + } + return 0; +} + +int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) +{ + if ((argc != 1)) { + cmd_usage(cmdtp); + return 1; + } + + get_hab_status(); + + return 0; +} + +U_BOOT_CMD( + hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status, + "display HAB status", + "" +); + +#endif + +#endif diff --git a/arch/arm/include/asm/arch-mx6/hab.h b/arch/arm/include/asm/arch-mx6/hab.h new file mode 100644 index 0000000..927c280 --- /dev/null +++ b/arch/arm/include/asm/arch-mx6/hab.h @@ -0,0 +1,80 @@ +/* + * Copyright (C) 2012 Freescale Semiconductor, Inc. All Rights Reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + + * You should have received a copy of the GNU General Public License along + * with this program; if not, write to the Free Software Foundation, Inc., + * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. + * + * Auto Generate file, please don't edit it + * + */ + +#ifndef __SECURE_MX6Q_H__ +#define __SECURE_MX6Q_H__ + +#include <linux/types.h> + +/* -------- start of HAB API updates ------------*/ +/* The following are taken from HAB4 SIS */ + +/* Status definitions */ +enum hab_status { + HAB_STS_ANY = 0x00, + HAB_FAILURE = 0x33, + HAB_WARNING = 0x69, + HAB_SUCCESS = 0xf0 +} hab_status_t; + +/* Security Configuration definitions */ +enum hab_config { + HAB_CFG_RETURN = 0x33, /**< Field Return IC */ + HAB_CFG_OPEN = 0xf0, /**< Non-secure IC */ + HAB_CFG_CLOSED = 0xcc /**< Secure IC */ +} hab_config_t; + +/* State definitions */ +enum hab_state { + HAB_STATE_INITIAL = 0x33, /**< Initialising state (transitory) */ + HAB_STATE_CHECK = 0x55, /**< Check state (non-secure) */ + HAB_STATE_NONSECURE = 0x66, /**< Non-secure state */ + HAB_STATE_TRUSTED = 0x99, /**< Trusted state */ + HAB_STATE_SECURE = 0xaa, /**< Secure state */ + HAB_STATE_FAIL_SOFT = 0xcc, /**< Soft fail state */ + HAB_STATE_FAIL_HARD = 0xff, /**< Hard fail state (terminal) */ + HAB_STATE_NONE = 0xf0, /**< No security state machine */ + HAB_STATE_MAX +} hab_state_t; + +/*Function prototype description*/ +typedef hab_status_t hab_rvt_report_event_t(hab_status_t, uint32_t, + uint8_t* , size_t*); +typedef hab_status_t hab_rvt_report_status_t(hab_config_t *, hab_state_t *); +typedef hab_status_t hab_loader_callback_f_t(void**, size_t*, const void*); +typedef hab_status_t hab_rvt_entry_t(void); +typedef hab_status_t hab_rvt_exit_t(void); +typedef void *hab_rvt_authenticate_image_t(uint8_t, ptrdiff_t, + void **, size_t *, hab_loader_callback_f_t); +typedef void hapi_clock_init_t(void); + +#define HAB_RVT_REPORT_EVENT (*(uint32_t *)0x000000B4) +#define HAB_RVT_REPORT_STATUS (*(uint32_t *)0x000000B8) +#define HAB_RVT_AUTHENTICATE_IMAGE (*(uint32_t *)0x000000A4) +#define HAB_RVT_ENTRY (*(uint32_t *)0x00000098) +#define HAB_RVT_EXIT (*(uint32_t *)0x0000009C) +#define HAB_RVT_CLOCK_INIT ((hapi_clock_init_t *)0x0000024D) + +#define HAB_CID_ROM 0 /**< ROM Caller ID */ +#define HAB_CID_UBOOT 1 /**< UBOOT Caller ID*/ +/* ----------- end of HAB API updates ------------*/ + +#endif diff --git a/arch/arm/include/asm/arch-mx6/imx-regs.h b/arch/arm/include/asm/arch-mx6/imx-regs.h index 03abb2a..4a2bba9 100644 --- a/arch/arm/include/asm/arch-mx6/imx-regs.h +++ b/arch/arm/include/asm/arch-mx6/imx-regs.h @@ -468,7 +468,13 @@ struct fuse_bank0_regs { u32 uid_low; u32 rsvd1[3]; u32 uid_high; - u32 rsvd2[0x17]; + u32 rsvd2[3]; + u32 rsvd3[4]; + u32 rsvd4[4]; + u32 rsvd5[4]; + u32 cfg5; + u32 rsvd6[3]; + u32 rsvd7[4]; }; struct fuse_bank4_regs {
Add functions to report the HAB (High Assurance Boot) status of e.g. i.MX6 CPUs. This is taken from git://git.freescale.com/imx/uboot-imx.git branch imx_v2009.08_3.0.35_4.0.0 cpu/arm_cortexa8/mx6/generic.c include/asm-arm/arch-mx6/mx6_secure.h Signed-off-by: Stefano Babic <sbabic@denx.de> --- arch/arm/cpu/armv7/mx6/Makefile | 2 +- arch/arm/cpu/armv7/mx6/hab.c | 127 ++++++++++++++++++++++++++++++ arch/arm/include/asm/arch-mx6/hab.h | 80 +++++++++++++++++++ arch/arm/include/asm/arch-mx6/imx-regs.h | 8 +- 4 files changed, 215 insertions(+), 2 deletions(-) create mode 100644 arch/arm/cpu/armv7/mx6/hab.c create mode 100644 arch/arm/include/asm/arch-mx6/hab.h