From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 498F5C43334 for ; Mon, 27 Jun 2022 02:46:30 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 2947C844E6; Mon, 27 Jun 2022 04:43:16 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=oss.nxp.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b="kxNv3hn7"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 8D8BD844ED; Mon, 27 Jun 2022 04:43:10 +0200 (CEST) Received: from EUR03-VE1-obe.outbound.protection.outlook.com (mail-eopbgr50064.outbound.protection.outlook.com [40.107.5.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id CE65C844BE for ; Mon, 27 Jun 2022 04:43:03 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=oss.nxp.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=peng.fan@oss.nxp.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ZiuoiYRyH0mpa/lCmMqvRA0AxR5jg+v6bj0TlylbQ3uy78s2yrmeRgan/CfOYHZc71HQ92N45rzTGhHvHS9KPV0Oj9DtWHuFUyWK/+St9zz7WeqXeRm9/fpF/tLeoqzMw/LlNA4eV0JthP8twC9ZOIC7/aWvKoyof4hOn6U013XtUgqQ7NhMakViAlkbCBTnv4iVL2njR7tQlZS8gN1D7yfGwJzV6U4PCu+mFrTXixtr8hwtieFpDGSkN+bTHPwADr3uSfNRElnDYTRKtUJ2BgzSfzHE2KURz6rHhIhDysaVGy6l+TI0dKSwQH5zzfZcaCmV9bqwE28/k0yw9zNXiQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5Yzsf6zcJR/kaNrHvL8GZBZHLzodqqUgkXiv7I2VMCM=; b=T/NxoX58IfDeIgr9wbjrESLcyqo6lcUcrPXUKAH9FNIOfOT/xAO1sZV+uw7SyKinm0UeMeGOwIAEMdyEQw/cZnww75VpGrjanBVjfg8x3r0HzgZSumYRzpF38J3pdLvjbptJd59d/4+TR2mTB5UKA+2V54RBxJsrTMl4kqbbHppgMS4Kxg/I74YL7KuUM1sTdvFaO9Xoa4vA/bQ+St5/3TXt87g8c5EC+ob1D47SUbJxKQQ5ZS3MguxglqMfVMLgqmHnVzC0LcrQvsTwFwGHEBoMTY6DT/dfcnbQoybv6k6XA41GYJEN6oanSLkVK2yk54jgEXuJsP4EcwI+WX9edA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oss.nxp.com; dmarc=pass action=none header.from=oss.nxp.com; dkim=pass header.d=oss.nxp.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NXP1.onmicrosoft.com; s=selector2-NXP1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5Yzsf6zcJR/kaNrHvL8GZBZHLzodqqUgkXiv7I2VMCM=; b=kxNv3hn7kvCt86wqgVHEoxMXioofpPpsAuFWh36wvzBD3AgxKdHD6a8FrWFQCUy4qj+M9qPeNBhP/ZnvmgT8EgHNzTAZju4/VykfEdT9jdw/g1NwoGEpObgodnqKiziFkmZRV/B4FoYxOPq+RlZizyx6xGCkXXshr/CObVCCU0E= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=oss.nxp.com; Received: from DU0PR04MB9417.eurprd04.prod.outlook.com (2603:10a6:10:358::11) by VI1PR04MB4109.eurprd04.prod.outlook.com (2603:10a6:803:46::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.5373.18; Mon, 27 Jun 2022 02:43:01 +0000 Received: from DU0PR04MB9417.eurprd04.prod.outlook.com ([fe80::fdd4:8557:334b:180d]) by DU0PR04MB9417.eurprd04.prod.outlook.com ([fe80::fdd4:8557:334b:180d%6]) with mapi id 15.20.5373.018; Mon, 27 Jun 2022 02:43:01 +0000 From: "Peng Fan (OSS)" To: sbabic@denx.de, festevam@gmail.com, "NXP i.MX U-Boot Team" Cc: u-boot@lists.denx.de, Ye Li Subject: [PATCH V2 25/49] imx: imx9: Add AHAB boot support Date: Mon, 27 Jun 2022 11:24:31 +0800 Message-Id: <20220627032455.28280-26-peng.fan@oss.nxp.com> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220627032455.28280-1-peng.fan@oss.nxp.com> References: <20220627032455.28280-1-peng.fan@oss.nxp.com> Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: SI2PR02CA0020.apcprd02.prod.outlook.com (2603:1096:4:195::7) To DU0PR04MB9417.eurprd04.prod.outlook.com (2603:10a6:10:358::11) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 331b41ad-2ab1-468d-0635-08da57e6c09d X-MS-TrafficTypeDiagnostic: VI1PR04MB4109:EE_ X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: AflwygsUyiusVShD6HlwRcIeZWUrFjYdcxhGRgW7w+RU0jq8RUC/YToc4V6rdn5RthKaUFZ6BXV4zRpLsLPd7FbAXXowPS/HaFiBXpvHUgNYRzC2tSGvynuPocP1Dqeb5hq4cEjmg3ea5EGZ1wKORQd7kJKfG64ZiWOssdubCGfKkueVjbgX7V9R/Pjsx6p+yhHM1PanN3ZLXthN/5XqnrdBdcikH2zaWbwl+iL2dBaN8Sj+6n3Ie/eec6iAZEPyuBKJAwk7VMXlA0nY87yQM1WNXZccRpCgWTi5Hzdfxe0YR7FBc5p8kGABvA4uhYF4zvtregQSamdZ5nY4cAgH2rH+8t2nHiL7ooVLTwCnWcywMt7JeXSXw6ZtfsEP3Lrgeo0sUMOG9KZHA8abDLuXbOvkCydLktrTsuy1NwR8cF8A6sI/fCw45a6dFl8R45QL+Bws1gJ6oZ93m28C2RbbtnjkDtQ8t99YyO40bwFY44pSkRZ9ODEFh8uZhd6Mxxa1p4Ca+Fx8EbBXRsfdd840kugHcWlTfCZOA4Ejeex8y5Scna4r/cf0Z9BWz4C30nL1zYulZOyDTuTaK0nmJyd8yBaMYjZX/g17JLx9liQvTI2/8QFUoW0temGn7a74UHR51e2qrojqrc6WM4irSbQRbeyp/S8/UIM19j2GztEw60tPSZLjf1/soHgm348aQlzsgHHNpnntR5sqKg4vEasMj/Rq/TCzFxBDxfd+f0Ktrw8yCnMebp3LW+adP9WVKFhengSPLohoPsKgP6U1gqLmeEHtXWPp9wy9Wlws17Xn5kA= X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DU0PR04MB9417.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230016)(4636009)(366004)(396003)(346002)(39860400002)(376002)(136003)(1076003)(41300700001)(8936002)(2616005)(52116002)(83380400001)(6862004)(5660300002)(38350700002)(38100700002)(2906002)(6486002)(186003)(478600001)(6666004)(86362001)(316002)(26005)(6512007)(66476007)(66946007)(4326008)(8676002)(66556008)(6506007); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?E+Lrz94exRfiC9l+Fj17MIv1dJp87RGHZKKqR2rzHtl1qkWZvSqHadCTtoO/?= =?us-ascii?Q?KUQH5rPiWmJurwZJHnE7yeIC/q4Rt2wwUHPigjIYN09eWZjR6QfAUz8U/FOi?= =?us-ascii?Q?TsDSrgvwypnQwcGI6dwwgxj7uwrWxOLSQc1WDnlmaMv7NlGycbmF22Wiq781?= =?us-ascii?Q?nh0xjIuxfQTjrr+n/rNQhlKgmWBvJAhhJScUU5M96bUBHyMhkbLTTVxuuEko?= =?us-ascii?Q?auCEU0tUyyKDxXlIvBx79aCxhn5U2A5iV4ltwo2pqZy5VgrYXwdqHrzlvWPr?= =?us-ascii?Q?MMFtNr3VK8VueeyDpNGvfFx+1jY8J+s1PZLYFXEV8NNHRMKTcBao3buDGit1?= =?us-ascii?Q?040GOstrgBvtq1dnYo57W3SmYtROYEzbSF2mMSVMIri3SVqN/zXDC2NMbfZw?= =?us-ascii?Q?WmL5Ue3R9MsQqzZsJ/clPw44PBtommoLk66untcCXtcMQNO3LlXwBsvFBwrK?= =?us-ascii?Q?56ic+z/UpgOCjgEwnMVLTpEw5cxqDdJaGZ86fUpbuhhhXTgB8Mz3tgr0rkWb?= =?us-ascii?Q?3tgwBk3gXYRkjZgHf2gxgQlpTIKvy2fqLQh7lX3oOrSA15nATHk05nesqE1D?= =?us-ascii?Q?EioV6LZfYOgcj4isDeI7g1agaw2cDWYypfvZa39OUI72hQBPLEHHDJbueXre?= =?us-ascii?Q?ZAlHhnvLSAdZtLI0vPeB5SKijX5sfcd08wKx61qw1XMbYY2o0TbpwHMay1zS?= =?us-ascii?Q?mNdhYC4Tp0sIYcH2sTAAFbeGwhb5XmZB2ZEDdh5Jubql3VAG/O/KFQ+mIfgx?= =?us-ascii?Q?gDCNazfOIqwQgfGpHo+s1d0YaRSrRfdBvKxlC3nQOTBvhP17EEluvDrOMt/y?= =?us-ascii?Q?Y2q5inusp8sRAu31u1qnfSWKRCrFcjuOsxCNJEOjVbftO8KRZjyWLVyxlsjY?= =?us-ascii?Q?8E/cxiQ7hs3c3/U93S6JsBylEkL1OtHPC+gJ1PmtF7tyFXNWB5+gmmxfHNmX?= =?us-ascii?Q?P/gtQVogMDTDHZfpFpWzy4DulkEBpgKI8w5gdZPqZZFqBP6yJDzj8zz1KWY0?= =?us-ascii?Q?noETj4Fy3SxWdCD+EEfvomalZ9HRlcLUCyK9CDxZxNrsIMRwyuoMnVKaKzhR?= =?us-ascii?Q?aSusKyL9PTe+/rJoCRFtummH3n7WBOn0XuoqZLWbRaQiG6m3DiEbg7aUZx6p?= =?us-ascii?Q?ZUZ7s9pxO5748Y0YI7weQ1rePWfEmPLY2xMB92SLs5MT0mGa74cShkXTMnRl?= =?us-ascii?Q?h6vP01hyFjQs+WA4CE8W3FKPupprIO5YXN/Xk2VXQ08VJYIHXxqkykIn6Lf7?= =?us-ascii?Q?ynNfOr7MX3QNg1EPoCKa4EO30INvW1qFC7CVJF+0TsnsxNvMYfMINwb+rxOr?= =?us-ascii?Q?zfDKPEKOhvFTFOtkc8rVu4jNxBxSbivfq41owfZyLkuHIN1urjj8T73mfoNt?= =?us-ascii?Q?sb9YIHivx4k8co6HaJpzuBnZe/VkpNbgFbmnh+GNkGQUzwfh+/p2tQ4En7AE?= =?us-ascii?Q?GlV88TOUNmWU/SROqsTqWM4vjKFfG2XQN3Jly274I3+fsxA+N+s0+0vOUtgd?= =?us-ascii?Q?ok4Mhwp1tmfOXthlESIfKsD+EqRZ+SX5nP8NAUzaCJfoF3XRZo8jDBsUut8Q?= =?us-ascii?Q?TN2l0J1g/7opeW7ui1ljOVtHekYexwCpRDR7iI1b?= X-OriginatorOrg: oss.nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: 331b41ad-2ab1-468d-0635-08da57e6c09d X-MS-Exchange-CrossTenant-AuthSource: DU0PR04MB9417.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 27 Jun 2022 02:43:01.5237 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: PJIMt0+8d/Ceoo/jCcyJdQh1Qtm3ctALRCbbLmCXFtNACagwiHZf9jys0oOm/xE9UIkV6So5rBjVRJalBHIlJA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR04MB4109 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean From: Ye Li Add AHAB driver for iMX9 to do authentication by calling sentinel API Signed-off-by: Ye Li Signed-off-by: Peng Fan --- arch/arm/mach-imx/imx9/Kconfig | 5 + arch/arm/mach-imx/imx9/Makefile | 1 + arch/arm/mach-imx/imx9/ahab.c | 346 ++++++++++++++++++++++++++++++++ 3 files changed, 352 insertions(+) create mode 100644 arch/arm/mach-imx/imx9/ahab.c diff --git a/arch/arm/mach-imx/imx9/Kconfig b/arch/arm/mach-imx/imx9/Kconfig index ce58e41428f..dae9f658e65 100644 --- a/arch/arm/mach-imx/imx9/Kconfig +++ b/arch/arm/mach-imx/imx9/Kconfig @@ -1,5 +1,10 @@ if ARCH_IMX9 +config AHAB_BOOT + bool "Support i.MX9 AHAB features" + help + This option enables the support for AHAB secure boot. + config IMX9 bool select HAS_CAAM diff --git a/arch/arm/mach-imx/imx9/Makefile b/arch/arm/mach-imx/imx9/Makefile index 0124212f266..41a22500c95 100644 --- a/arch/arm/mach-imx/imx9/Makefile +++ b/arch/arm/mach-imx/imx9/Makefile @@ -4,3 +4,4 @@ obj-y += lowlevel_init.o obj-y += soc.o clock.o clock_root.o trdc.o +obj-$(CONFIG_AHAB_BOOT) += ahab.o diff --git a/arch/arm/mach-imx/imx9/ahab.c b/arch/arm/mach-imx/imx9/ahab.c new file mode 100644 index 00000000000..6aa949619b5 --- /dev/null +++ b/arch/arm/mach-imx/imx9/ahab.c @@ -0,0 +1,346 @@ +// SPDX-License-Identifier: GPL-2.0+ +/* + * Copyright 2022 NXP + */ + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +DECLARE_GLOBAL_DATA_PTR; + +#define IMG_CONTAINER_BASE (0x80000000UL) +#define IMG_CONTAINER_END_BASE (IMG_CONTAINER_BASE + 0xFFFFUL) + +#define AHAB_NO_AUTHENTICATION_IND 0xee +#define AHAB_BAD_KEY_HASH_IND 0xfa +#define AHAB_INVALID_KEY_IND 0xf9 +#define AHAB_BAD_SIGNATURE_IND 0xf0 +#define AHAB_BAD_HASH_IND 0xf1 + +static void display_ahab_auth_ind(u32 event) +{ + u8 resp_ind = (event >> 8) & 0xff; + + switch (resp_ind) { + case AHAB_NO_AUTHENTICATION_IND: + printf("AHAB_NO_AUTHENTICATION_IND (0x%02X)\n\n", resp_ind); + break; + case AHAB_BAD_KEY_HASH_IND: + printf("AHAB_BAD_KEY_HASH_IND (0x%02X)\n\n", resp_ind); + break; + case AHAB_INVALID_KEY_IND: + printf("AHAB_INVALID_KEY_IND (0x%02X)\n\n", resp_ind); + break; + case AHAB_BAD_SIGNATURE_IND: + printf("AHAB_BAD_SIGNATURE_IND (0x%02X)\n\n", resp_ind); + break; + case AHAB_BAD_HASH_IND: + printf("AHAB_BAD_HASH_IND (0x%02X)\n\n", resp_ind); + break; + default: + printf("Unknown Indicator (0x%02X)\n\n", resp_ind); + break; + } +} + +int ahab_auth_cntr_hdr(struct container_hdr *container, u16 length) +{ + int err; + u32 resp; + + memcpy((void *)IMG_CONTAINER_BASE, (const void *)container, + ALIGN(length, CONFIG_SYS_CACHELINE_SIZE)); + + flush_dcache_range(IMG_CONTAINER_BASE, + IMG_CONTAINER_BASE + ALIGN(length, CONFIG_SYS_CACHELINE_SIZE) - 1); + + err = ahab_auth_oem_ctnr(IMG_CONTAINER_BASE, &resp); + if (err) { + printf("Authenticate container hdr failed, return %d, resp 0x%x\n", + err, resp); + display_ahab_auth_ind(resp); + } + + return err; +} + +int ahab_auth_release(void) +{ + int err; + u32 resp; + + err = ahab_release_container(&resp); + if (err) { + printf("Error: release container failed, resp 0x%x!\n", resp); + display_ahab_auth_ind(resp); + } + + return err; +} + +int ahab_verify_cntr_image(struct boot_img_t *img, int image_index) +{ + int err; + u32 resp; + + err = ahab_verify_image(image_index, &resp); + if (err) { + printf("Authenticate img %d failed, return %d, resp 0x%x\n", + image_index, err, resp); + display_ahab_auth_ind(resp); + + return -EIO; + } + + return 0; +} + +static inline bool check_in_dram(ulong addr) +{ + int i; + struct bd_info *bd = gd->bd; + + for (i = 0; i < CONFIG_NR_DRAM_BANKS; ++i) { + if (bd->bi_dram[i].size) { + if (addr >= bd->bi_dram[i].start && + addr < (bd->bi_dram[i].start + bd->bi_dram[i].size)) + return true; + } + } + + return false; +} + +int authenticate_os_container(ulong addr) +{ + struct container_hdr *phdr; + int i, ret = 0; + int err; + u16 length; + struct boot_img_t *img; + unsigned long s, e; + + if (addr % 4) { + puts("Error: Image's address is not 4 byte aligned\n"); + return -EINVAL; + } + + if (!check_in_dram(addr)) { + puts("Error: Image's address is invalid\n"); + return -EINVAL; + } + + phdr = (struct container_hdr *)addr; + if (phdr->tag != 0x87 || phdr->version != 0x0) { + printf("Error: Wrong container header\n"); + return -EFAULT; + } + + if (!phdr->num_images) { + printf("Error: Wrong container, no image found\n"); + return -EFAULT; + } + + length = phdr->length_lsb + (phdr->length_msb << 8); + + debug("container length %u\n", length); + + err = ahab_auth_cntr_hdr(phdr, length); + if (err) { + ret = -EIO; + goto exit; + } + + debug("Verify images\n"); + + /* Copy images to dest address */ + for (i = 0; i < phdr->num_images; i++) { + img = (struct boot_img_t *)(addr + + sizeof(struct container_hdr) + + i * sizeof(struct boot_img_t)); + + debug("img %d, dst 0x%x, src 0x%lx, size 0x%x\n", + i, (uint32_t)img->dst, img->offset + addr, img->size); + + memcpy((void *)img->dst, (const void *)(img->offset + addr), + img->size); + + s = img->dst & ~(CONFIG_SYS_CACHELINE_SIZE - 1); + e = ALIGN(img->dst + img->size, CONFIG_SYS_CACHELINE_SIZE) - 1; + + flush_dcache_range(s, e); + + ret = ahab_verify_cntr_image(img, i); + if (ret) + goto exit; + } + +exit: + debug("ahab_auth_release, 0x%x\n", ret); + ahab_auth_release(); + + return ret; +} + +static int do_authenticate(struct cmd_tbl *cmdtp, int flag, int argc, + char *const argv[]) +{ + ulong addr; + + if (argc < 2) + return CMD_RET_USAGE; + + addr = simple_strtoul(argv[1], NULL, 16); + + printf("Authenticate OS container at 0x%lx\n", addr); + + if (authenticate_os_container(addr)) + return CMD_RET_FAILURE; + + return CMD_RET_SUCCESS; +} + +static void display_life_cycle(u32 lc) +{ + printf("Lifecycle: 0x%08X, ", lc); + switch (lc) { + case 0x1: + printf("BLANK\n\n"); + break; + case 0x2: + printf("FAB\n\n"); + break; + case 0x4: + printf("NXP Provisioned\n\n"); + break; + case 0x8: + printf("OEM Open\n\n"); + break; + case 0x10: + printf("OEM Secure World Closed\n\n"); + break; + case 0x20: + printf("OEM closed\n\n"); + break; + case 0x40: + printf("Field Return OEM\n\n"); + break; + case 0x80: + printf("Field Return NXP\n\n"); + break; + case 0x100: + printf("OEM Locked\n\n"); + break; + case 0x200: + printf("BRICKED\n\n"); + break; + default: + printf("Unknown\n\n"); + break; + } +} + +static int confirm_close(void) +{ + puts("Warning: Please ensure your sample is in NXP closed state, " + "OEM SRK hash has been fused, \n" + " and you are able to boot a signed image successfully " + "without any SECO events reported.\n" + " If not, your sample will be unrecoverable.\n" + "\nReally perform this operation? \n"); + + if (confirm_yesno()) + return 1; + + puts("Ahab close aborted\n"); + return 0; +} + +static int do_ahab_close(struct cmd_tbl *cmdtp, int flag, int argc, + char *const argv[]) +{ + int err; + u32 resp; + + if (!confirm_close()) + return -EACCES; + + err = ahab_forward_lifecycle(8, &resp); + if (err != 0) { + printf("Error in forward lifecycle to OEM closed\n"); + return -EIO; + } + + printf("Change to OEM closed successfully\n"); + + return 0; +} + +int ahab_dump(void) +{ + u32 buffer[32]; + int ret, i = 0; + + do { + ret = ahab_dump_buffer(buffer, 32); + if (ret < 0) { + printf("Error in dump AHAB log\n"); + return -EIO; + } + + if (ret == 1) + break; + for (i = 0; i < ret; i++) + printf("0x%x\n", buffer[i]); + } while (ret >= 21); + + return 0; +} + +static int do_ahab_dump(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) +{ + return ahab_dump(); +} + +static int do_ahab_status(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) +{ + u32 lc; + + lc = readl(FSB_BASE_ADDR + 0x41c); + lc &= 0x3ff; + + display_life_cycle(lc); + return 0; +} + +U_BOOT_CMD(auth_cntr, CONFIG_SYS_MAXARGS, 1, do_authenticate, + "autenticate OS container via AHAB", + "addr\n" + "addr - OS container hex address\n" +); + +U_BOOT_CMD(ahab_close, CONFIG_SYS_MAXARGS, 1, do_ahab_close, + "Change AHAB lifecycle to OEM closed", + "" +); + +U_BOOT_CMD(ahab_dump, CONFIG_SYS_MAXARGS, 1, do_ahab_dump, + "Dump AHAB log for debug", + "" +); + +U_BOOT_CMD(ahab_status, CONFIG_SYS_MAXARGS, 1, do_ahab_status, + "display AHAB lifecycle only", + "" +); -- 2.36.0