From 563016d45a91a9f1501aa43b22e7db9705605346 Mon Sep 17 00:00:00 2001 From: Jacky Bai Date: Tue, 14 Jan 2020 16:05:59 +0800 Subject: plat: imx8m: Add hab suport on imx8m SoC family Add the HAB secure boot support for the i.MX8M SoC family. Signed-off-by: Ye Li Signed-off-by: Jacky Bai --- plat/imx/common/imx_sip_svc.c | 6 ++ plat/imx/common/include/imx_sip_svc.h | 15 ++++ plat/imx/imx8m/hab.c | 123 +++++++++++++++++++++++++++ plat/imx/imx8m/imx8mm/imx8mm_bl31_setup.c | 4 + plat/imx/imx8m/imx8mm/include/platform_def.h | 11 ++- plat/imx/imx8m/imx8mm/platform.mk | 1 + plat/imx/imx8m/imx8mn/imx8mn_bl31_setup.c | 4 + plat/imx/imx8m/imx8mn/include/platform_def.h | 9 +- plat/imx/imx8m/imx8mn/platform.mk | 1 + plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c | 2 + plat/imx/imx8m/imx8mq/include/platform_def.h | 7 +- plat/imx/imx8m/imx8mq/platform.mk | 1 + 12 files changed, 179 insertions(+), 5 deletions(-) create mode 100644 plat/imx/imx8m/hab.c diff --git a/plat/imx/common/imx_sip_svc.c b/plat/imx/common/imx_sip_svc.c index cf4590ff..6a595571 100644 --- a/plat/imx/common/imx_sip_svc.c +++ b/plat/imx/common/imx_sip_svc.c @@ -35,6 +35,9 @@ static uintptr_t imx_sip_handler(unsigned int smc_fid, break; case IMX_SIP_DDR_DVFS: return dram_dvfs_handler(smc_fid, handle, x1, x2, x3); + case IMX_SIP_HAB: + SMC_RET1(handle, imx_hab_handler(smc_fid, x1, x2, x3, x4)); + break; #endif #if defined(PLAT_imx8mm) || defined(PLAT_imx8mn) case IMX_SIP_DDR_DVFS: @@ -42,6 +45,9 @@ static uintptr_t imx_sip_handler(unsigned int smc_fid, case IMX_SIP_GPC: SMC_RET1(handle, imx_gpc_handler(smc_fid, x1, x2, x3)); break; + case IMX_SIP_HAB: + SMC_RET1(handle, imx_hab_handler(smc_fid, x1, x2, x3, x4)); + break; #endif #if (defined(PLAT_imx8qm) || defined(PLAT_imx8qx)) case IMX_SIP_SRTC: diff --git a/plat/imx/common/include/imx_sip_svc.h b/plat/imx/common/include/imx_sip_svc.h index e6a4dd5a..0deb6ae8 100644 --- a/plat/imx/common/include/imx_sip_svc.h +++ b/plat/imx/common/include/imx_sip_svc.h @@ -28,6 +28,15 @@ #define IMX_SIP_GET_SOC_INFO 0xC2000006 +#define IMX_SIP_HAB 0xc2000007 +#define IMX_SIP_HAB_AUTHENTICATE 0x00 +#define IMX_SIP_HAB_ENTRY 0x01 +#define IMX_SIP_HAB_EXIT 0x02 +#define IMX_SIP_HAB_REPORT_EVENT 0x03 +#define IMX_SIP_HAB_REPORT_STATUS 0x04 +#define IMX_SIP_HAB_FAILSAFE 0x05 +#define IMX_SIP_HAB_CHECK_TARGET 0x06 + #define IMX_SIP_WAKEUP_SRC 0xC2000009 #define IMX_SIP_WAKEUP_SRC_SCU 0x1 #define IMX_SIP_WAKEUP_SRC_IRQSTEER 0x2 @@ -45,6 +54,9 @@ int imx_gpc_handler(uint32_t smc_fid, u_register_t x1, u_register_t x2, u_register_t x3); int dram_dvfs_handler(uint32_t smc_fid, void *handle, u_register_t x1, u_register_t x2, u_register_t x3); + +int imx_hab_handler(uint32_t smc_fid, u_register_t x1, + u_register_t x2, u_register_t x3, u_register_t x4); #endif #if defined(PLAT_imx8mm) || defined(PLAT_imx8mn) int dram_dvfs_handler(uint32_t smc_fid, void *handle, @@ -52,6 +64,9 @@ int dram_dvfs_handler(uint32_t smc_fid, void *handle, int imx_gpc_handler(uint32_t smc_fid, u_register_t x1, u_register_t x2, u_register_t x3); + +int imx_hab_handler(uint32_t smc_fid, u_register_t x1, + u_register_t x2, u_register_t x3, u_register_t x4); #endif #if (defined(PLAT_imx8qm) || defined(PLAT_imx8qx)) diff --git a/plat/imx/imx8m/hab.c b/plat/imx/imx8m/hab.c new file mode 100644 index 00000000..17ad4207 --- /dev/null +++ b/plat/imx/imx8m/hab.c @@ -0,0 +1,123 @@ +/* + * Copyright 2017-2020 NXP + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +#include + +#include +#include +#include + +#include +#include + +/* Status definitions */ +enum hab_status { + HAB_STS_ANY = 0x00, + HAB_FAILURE = 0x33, + HAB_WARNING = 0x69, + HAB_SUCCESS = 0xf0 +}; + +/* Security Configuration definitions */ +enum hab_config { + HAB_CFG_RETURN = 0x33, /* < Field Return IC */ + HAB_CFG_OPEN = 0xf0, /* < Non-secure IC */ + HAB_CFG_CLOSED = 0xcc /* < Secure IC */ +}; + +/* State definitions */ +enum hab_state { + HAB_STATE_INITIAL = 0x33, /* Initialising state (transitory) */ + HAB_STATE_CHECK = 0x55, /* Check state (non-secure) */ + HAB_STATE_NONSECURE = 0x66, /* Non-secure state */ + HAB_STATE_TRUSTED = 0x99, /* Trusted state */ + HAB_STATE_SECURE = 0xaa, /* Secure state */ + HAB_STATE_FAIL_SOFT = 0xcc, /* Soft fail state */ + HAB_STATE_FAIL_HARD = 0xff, /* Hard fail state (terminal) */ + HAB_STATE_NONE = 0xf0, /* No security state machine */ + HAB_STATE_MAX +}; + +enum hab_target { + HAB_TGT_MEMORY = 0x0f, + HAB_TGT_PERIPHERAL = 0xf0, + HAB_TGT_ANY = 0x55, +}; + +typedef enum hab_status hab_rvt_report_event_t(enum hab_status, uint32_t, + uint8_t* , size_t*); +typedef enum hab_status hab_rvt_report_status_t(enum hab_config *, + enum hab_state *); +typedef enum hab_status hab_loader_callback_f_t(void**, size_t*, const void*); +typedef enum hab_status hab_rvt_entry_t(void); +typedef enum hab_status hab_rvt_exit_t(void); +typedef void *hab_rvt_authenticate_image_t(uint8_t, long, + void **, size_t *, hab_loader_callback_f_t); +typedef enum hab_status hab_rvt_check_target_t(enum hab_target, const void *, + size_t); +typedef void hab_rvt_failsafe_t(void); + +#define HAB_RVT_ENTRY_ARM64 ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x08)) +#define HAB_RVT_EXIT_ARM64 ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x10)) +#define HAB_RVT_CHECK_TARGET_ARM64 ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x18)) +#define HAB_RVT_AUTHENTICATE_IMAGE_ARM64 ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x20)) +#define HAB_RVT_REPORT_EVENT_ARM64 ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x40)) +#define HAB_RVT_REPORT_STATUS_ARM64 ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x48)) +#define HAB_RVT_FAILSAFE_ARM64 ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x50)) + +#define hab_rvt_authenticate_image_p ((hab_rvt_authenticate_image_t *)HAB_RVT_AUTHENTICATE_IMAGE_ARM64) +#define hab_rvt_entry_p ((hab_rvt_entry_t *)HAB_RVT_ENTRY_ARM64) +#define hab_rvt_exit_p ((hab_rvt_exit_t *)HAB_RVT_EXIT_ARM64) +#define hab_rvt_report_event_p ((hab_rvt_report_event_t *)HAB_RVT_REPORT_EVENT_ARM64) +#define hab_rvt_report_status_p ((hab_rvt_report_status_t *)HAB_RVT_REPORT_STATUS_ARM64) +#define hab_rvt_check_target_p ((hab_rvt_check_target_t *)HAB_RVT_CHECK_TARGET_ARM64) +#define hab_rvt_failsafe_p ((hab_rvt_failsafe_t *)HAB_RVT_FAILSAFE_ARM64) + + +#define HAB_CID_ATF 2 /**< ATF Caller ID*/ + +int imx_hab_handler(uint32_t smc_fid, u_register_t x1, u_register_t x2, + u_register_t x3, u_register_t x4) +{ + hab_rvt_authenticate_image_t *hab_rvt_authenticate_image; + hab_rvt_entry_t *hab_rvt_entry; + hab_rvt_exit_t *hab_rvt_exit; + hab_rvt_report_event_t *hab_rvt_report_event; + hab_rvt_report_status_t *hab_rvt_report_status; + hab_rvt_failsafe_t *hab_rvt_failsafe; + hab_rvt_check_target_t *hab_rvt_check_target; + + switch(x1) { + case IMX_SIP_HAB_AUTHENTICATE: + hab_rvt_authenticate_image = hab_rvt_authenticate_image_p; + return (unsigned long)hab_rvt_authenticate_image(HAB_CID_ATF, x2, (void **)x3, (size_t *)x4, NULL); + case IMX_SIP_HAB_ENTRY: + hab_rvt_entry = hab_rvt_entry_p; + return hab_rvt_entry(); + case IMX_SIP_HAB_EXIT: + hab_rvt_exit = hab_rvt_exit_p; + return hab_rvt_exit(); + case IMX_SIP_HAB_REPORT_EVENT: + hab_rvt_report_event = hab_rvt_report_event_p; + return hab_rvt_report_event(HAB_FAILURE, (uint32_t)x2, (uint8_t *)x3, (size_t *)x4); + case IMX_SIP_HAB_REPORT_STATUS: + hab_rvt_report_status = hab_rvt_report_status_p; + return hab_rvt_report_status((enum hab_config *)x2, (enum hab_state *)x3); + case IMX_SIP_HAB_FAILSAFE: + hab_rvt_failsafe = hab_rvt_failsafe_p; + hab_rvt_failsafe(); + return SMC_OK; + case IMX_SIP_HAB_CHECK_TARGET: + hab_rvt_check_target = hab_rvt_check_target_p; + return hab_rvt_check_target((enum hab_target)x2, (const void *)x3, (size_t)x4); + default: + return SMC_UNK; + + }; + + return 0; +} + diff --git a/plat/imx/imx8m/imx8mm/imx8mm_bl31_setup.c b/plat/imx/imx8m/imx8mm/imx8mm_bl31_setup.c index 5ece151b..1e7b32fa 100644 --- a/plat/imx/imx8m/imx8mm/imx8mm_bl31_setup.c +++ b/plat/imx/imx8m/imx8mm/imx8mm_bl31_setup.c @@ -36,6 +36,10 @@ static const mmap_region_t imx_mmap[] = { MAP_REGION_FLAT(OCRAM_S_BASE, OCRAM_S_SIZE, MT_DEVICE | MT_RW), /* OCRAM_S */ MAP_REGION_FLAT(IMX_DDRPHY_BASE, IMX_DDR_IPS_SIZE, MT_DEVICE | MT_RW), /* DDRMIX */ MAP_REGION_FLAT(IMX_VPUMIX_BASE, IMX_VPUMIX_SIZE, MT_DEVICE | MT_RW), /* VPUMIX */ + MAP_REGION_FLAT(IMX_CAAM_RAM_BASE, IMX_CAAM_RAM_SIZE, MT_MEMORY | MT_RW), /* CAMM RAM */ + MAP_REGION_FLAT(IMX_NS_OCRAM_BASE, IMX_NS_OCRAM_SIZE, MT_MEMORY | MT_RW), /* NS OCRAM */ + MAP_REGION_FLAT(IMX_ROM_BASE, IMX_ROM_SIZE, MT_MEMORY | MT_RO), /* ROM code */ + MAP_REGION_FLAT(IMX_DRAM_BASE, IMX_DRAM_SIZE, MT_MEMORY | MT_RW), /* DRAM */ {0}, }; diff --git a/plat/imx/imx8m/imx8mm/include/platform_def.h b/plat/imx/imx8m/imx8mm/include/platform_def.h index cd184207..dbe579a7 100644 --- a/plat/imx/imx8m/imx8mm/include/platform_def.h +++ b/plat/imx/imx8m/imx8mm/include/platform_def.h @@ -84,8 +84,15 @@ #define IMX_DDR_IPS_BASE U(0x3d000000) #define IMX_DDR_IPS_SIZE U(0x1800000) #define IMX_ROM_BASE U(0x0) -#define IMX_VPUMIX_BASE U(0x38330000) -#define IMX_VPUMIX_SIZE U(0x100000) +#define IMX_ROM_SIZE U(0x40000) +#define IMX_VPUMIX_BASE U(0x38330000) +#define IMX_VPUMIX_SIZE U(0x100000) +#define IMX_NS_OCRAM_BASE U(0x900000) +#define IMX_NS_OCRAM_SIZE U(0x20000) +#define IMX_CAAM_RAM_BASE U(0x100000) +#define IMX_CAAM_RAM_SIZE U(0x10000) +#define IMX_DRAM_BASE U(0x40000000) +#define IMX_DRAM_SIZE U(0xc0000000) #define GPV_BASE U(0x32000000) #define GPV_SIZE U(0x800000) diff --git a/plat/imx/imx8m/imx8mm/platform.mk b/plat/imx/imx8m/imx8mm/platform.mk index 3aaac40a..968d3a5f 100644 --- a/plat/imx/imx8m/imx8mm/platform.mk +++ b/plat/imx/imx8m/imx8mm/platform.mk @@ -25,6 +25,7 @@ IMX_GIC_SOURCES := drivers/arm/gic/v3/gicv3_helpers.c \ BL31_SOURCES += plat/imx/common/imx8_helpers.S \ plat/imx/imx8m/gpc_common.c \ + plat/imx/imx8m/hab.c \ plat/imx/imx8m/imx_aipstz.c \ plat/imx/imx8m/imx_rdc.c \ plat/imx/imx8m/imx8m_csu.c \ diff --git a/plat/imx/imx8m/imx8mn/imx8mn_bl31_setup.c b/plat/imx/imx8m/imx8mn/imx8mn_bl31_setup.c index 5c5e40c5..8e7a8d6b 100644 --- a/plat/imx/imx8m/imx8mn/imx8mn_bl31_setup.c +++ b/plat/imx/imx8m/imx8mn/imx8mn_bl31_setup.c @@ -35,6 +35,10 @@ static const mmap_region_t imx_mmap[] = { MAP_REGION_FLAT(IMX_AIPS_BASE, IMX_AIPS_SIZE, MT_DEVICE | MT_RW), /* AIPS map */ MAP_REGION_FLAT(OCRAM_S_BASE, OCRAM_S_SIZE, MT_DEVICE | MT_RW), /* OCRAM_S */ MAP_REGION_FLAT(IMX_DDRPHY_BASE, IMX_DDR_IPS_SIZE, MT_DEVICE | MT_RW), /* DDRMIX */ + MAP_REGION_FLAT(IMX_CAAM_RAM_BASE, IMX_CAAM_RAM_SIZE, MT_MEMORY | MT_RW), /* CAMM RAM */ + MAP_REGION_FLAT(IMX_NS_OCRAM_BASE, IMX_NS_OCRAM_SIZE, MT_MEMORY | MT_RW), /* NS OCRAM */ + MAP_REGION_FLAT(IMX_ROM_BASE, IMX_ROM_SIZE, MT_MEMORY | MT_RO), /* ROM code */ + MAP_REGION_FLAT(IMX_DRAM_BASE, IMX_DRAM_SIZE, MT_MEMORY | MT_RW), /* DRAM */ {0}, }; diff --git a/plat/imx/imx8m/imx8mn/include/platform_def.h b/plat/imx/imx8m/imx8mn/include/platform_def.h index 6d49bf66..f059c10b 100644 --- a/plat/imx/imx8m/imx8mn/include/platform_def.h +++ b/plat/imx/imx8m/imx8mn/include/platform_def.h @@ -1,5 +1,5 @@ /* - * Copyright 2019 NXP + * Copyright 2019-2020 NXP * * SPDX-License-Identifier: BSD-3-Clause */ @@ -84,6 +84,13 @@ #define IMX_DDR_IPS_BASE U(0x3d000000) #define IMX_DDR_IPS_SIZE U(0x1800000) #define IMX_ROM_BASE U(0x0) +#define IMX_ROM_SIZE U(0x40000) +#define IMX_NS_OCRAM_BASE U(0x900000) +#define IMX_NS_OCRAM_SIZE U(0x60000) +#define IMX_CAAM_RAM_BASE U(0x100000) +#define IMX_CAAM_RAM_SIZE U(0x10000) +#define IMX_DRAM_BASE U(0x40000000) +#define IMX_DRAM_SIZE U(0xc0000000) #define IMX_GIC_BASE PLAT_GICD_BASE #define IMX_GIC_SIZE U(0x200000) diff --git a/plat/imx/imx8m/imx8mn/platform.mk b/plat/imx/imx8m/imx8mn/platform.mk index 38dad54f..f4d2c810 100644 --- a/plat/imx/imx8m/imx8mn/platform.mk +++ b/plat/imx/imx8m/imx8mn/platform.mk @@ -25,6 +25,7 @@ IMX_GIC_SOURCES := drivers/arm/gic/v3/gicv3_helpers.c \ BL31_SOURCES += plat/imx/common/imx8_helpers.S \ plat/imx/imx8m/gpc_common.c \ + plat/imx/imx8m/hab.c \ plat/imx/imx8m/imx_aipstz.c \ plat/imx/imx8m/imx_rdc.c \ plat/imx/imx8m/imx8m_caam.c \ diff --git a/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c b/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c index ec1a9cc0..1dc2c89f 100644 --- a/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c +++ b/plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c @@ -36,6 +36,8 @@ static const mmap_region_t imx_mmap[] = { MAP_REGION_FLAT(IMX_GIC_BASE, IMX_GIC_SIZE, MT_DEVICE | MT_RW), /* GIC map */ MAP_REGION_FLAT(IMX_DDRPHY_BASE, IMX_DDR_IPS_SIZE, MT_DEVICE | MT_RW), /* DDRMIX map */ MAP_REGION_FLAT(IMX_DRAM_BASE, IMX_DRAM_SIZE, MT_MEMORY | MT_RW | MT_NS), + MAP_REGION_FLAT(IMX_CAAM_RAM_BASE, IMX_CAAM_RAM_SIZE, MT_MEMORY | MT_RW), /* CAMM RAM */ + MAP_REGION_FLAT(IMX_NS_OCRAM_BASE, IMX_NS_OCRAM_SIZE, MT_MEMORY | MT_RW), /* NS OCRAM */ {0}, }; diff --git a/plat/imx/imx8m/imx8mq/include/platform_def.h b/plat/imx/imx8m/imx8mq/include/platform_def.h index c7d972ad..9241067f 100644 --- a/plat/imx/imx8m/imx8mq/include/platform_def.h +++ b/plat/imx/imx8m/imx8mq/include/platform_def.h @@ -9,7 +9,7 @@ #define PLATFORM_LINKER_FORMAT "elf64-littleaarch64" #define PLATFORM_LINKER_ARCH aarch64 -#define PLATFORM_STACK_SIZE 0x800 +#define PLATFORM_STACK_SIZE 0xb00 #define CACHE_WRITEBACK_GRANULE 64 #define PLAT_PRIMARY_CPU 0x0 @@ -79,7 +79,10 @@ #define IMX_DDR_IPS_SIZE U(0x1800000) #define IMX_DRAM_BASE U(0x40000000) #define IMX_DRAM_SIZE U(0xc0000000) - +#define IMX_NS_OCRAM_BASE U(0x900000) +#define IMX_NS_OCRAM_SIZE U(0x20000) +#define IMX_CAAM_RAM_BASE U(0x100000) +#define IMX_CAAM_RAM_SIZE U(0x10000) #define IMX_ROM_BASE U(0x00000000) #define IMX_ROM_SIZE U(0x20000) diff --git a/plat/imx/imx8m/imx8mq/platform.mk b/plat/imx/imx8m/imx8mq/platform.mk index fce4edc5..4efba258 100644 --- a/plat/imx/imx8m/imx8mq/platform.mk +++ b/plat/imx/imx8m/imx8mq/platform.mk @@ -27,6 +27,7 @@ BL31_SOURCES += plat/imx/common/imx8_helpers.S \ plat/imx/imx8m/imx8mq/imx8mq_bl31_setup.c \ plat/imx/imx8m/imx8mq/imx8mq_psci.c \ plat/imx/imx8m/gpc_common.c \ + plat/imx/imx8m/hab.c \ plat/imx/imx8m/imx_aipstz.c \ plat/imx/imx8m/imx8m_caam.c \ plat/imx/imx8m/imx8m_psci_common.c \ -- cgit v1.2.3