From patchwork Fri Jun 2 06:45:48 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Peng Fan (OSS)" X-Patchwork-Id: 1789471 X-Patchwork-Delegate: sbabic@denx.de Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de; envelope-from=u-boot-bounces@lists.denx.de; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.a=rsa-sha256 header.s=selector2-NXP1-onmicrosoft-com header.b=EKK4AUjg; dkim-atps=neutral Received: from phobos.denx.de (phobos.denx.de [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-384)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4QXXMB10gPz20Q4 for ; Fri, 2 Jun 2023 15:56:54 +1000 (AEST) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id C854B865C1; Fri, 2 Jun 2023 07:54:57 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=oss.nxp.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=NXP1.onmicrosoft.com header.i=@NXP1.onmicrosoft.com header.b="EKK4AUjg"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 27815865D3; Fri, 2 Jun 2023 07:54:50 +0200 (CEST) X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de X-Spam-Level: X-Spam-Status: No, score=-0.9 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,FORGED_SPF_HELO,SPF_HELO_PASS,T_SCC_BODY_TEXT_LINE, T_SPF_PERMERROR autolearn=no autolearn_force=no version=3.4.2 Received: from EUR01-HE1-obe.outbound.protection.outlook.com (mail-he1eur01on0622.outbound.protection.outlook.com [IPv6:2a01:111:f400:fe1e::622]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id 625C3865CC for ; Fri, 2 Jun 2023 07:54:47 +0200 (CEST) Authentication-Results: phobos.denx.de; dmarc=none (p=none dis=none) header.from=oss.nxp.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=peng.fan@oss.nxp.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=C9w1VwhXuL4r4NDP/V2CULRybFwH1J4jxV18xJfAOexGP84PhWx0sQcLcNnNeFvfNUAlT950O6lGp/3cfIqVkj7e41AUNuO1T5SKgyNIjBj0DyoeyOnAM5l5+WS1wpwU9Op0pgZvE1k5KIsIq4PhD1F72A9pYX77QF5UOhzk3iUO5Sc9QQW/K/civ8fnpNGDXv0utskD6lvwMLx5Id9DBtAASo04TSCd2Eob10YU3I2frksl11+WFZcgoyFbhtnM6UYX2oyowNloC4lmUtauePm5UmvpPU7JZrNVdUH0EAnuDGnJMO1UdJAzWIgJdTFtN5zM5HkqIbxWaXUMY4xVdg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=1Bh2LB56UMNfs4XBLVoj9BKN+gE/FyiAZVmyYCQ5mmI=; b=R9Q7eDmfyY+K54tkECvwgTkvzpJfHwRbuiRz9j74NCku/uCHz0DblpVe5TW7xwbSA4gC6em9yYU5rx52RfZVt3dfvjdYO2Zue2wJEfWowGtPfEp6uOsO0SpcemijW/38C/qSv93JGu1F5CBYsnwq8tvxT+J/rsmyP4wthQbD47W2XXMBPfRkHLHVLsi1tvfCpwg3xDpkI2ZPkw7hm53lUcKrrd7XuuuEm4S4BywD7iF8FY774esIUcb0zMOrzd0ImskPKjLxICUsHsJv1bW0UYcXNGxKzymlV9JOmrPt77hzwRykz+qDuGkK+AHTeopCmxTGi5M7H2Oq06zmqMwfKQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=oss.nxp.com; dmarc=pass action=none header.from=oss.nxp.com; dkim=pass header.d=oss.nxp.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=NXP1.onmicrosoft.com; s=selector2-NXP1-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=1Bh2LB56UMNfs4XBLVoj9BKN+gE/FyiAZVmyYCQ5mmI=; b=EKK4AUjgr/5zUPOXYI89vQH8oqOYk3tSX32D+8mJ1FhJmSHD7iJXfD3/qGNu25mP+8kBGwLQEsy0ySRfm+mNf+JOjhRyT+8jzq99hOj444bS6KudjiMkmTUugyHoqnKTmSZWqoPUlBm/QzIOQYcuTVcVTx7q5s6sZjZqeyuS7j0= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=oss.nxp.com; Received: from DU0PR04MB9417.eurprd04.prod.outlook.com (2603:10a6:10:358::11) by AM8PR04MB7362.eurprd04.prod.outlook.com (2603:10a6:20b:1c5::23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.6455.24; Fri, 2 Jun 2023 05:54:45 +0000 Received: from DU0PR04MB9417.eurprd04.prod.outlook.com ([fe80::7b3d:4c2a:1636:da28]) by DU0PR04MB9417.eurprd04.prod.outlook.com ([fe80::7b3d:4c2a:1636:da28%6]) with mapi id 15.20.6455.020; Fri, 2 Jun 2023 05:54:45 +0000 From: "Peng Fan (OSS)" To: sbabic@denx.de, festevam@gmail.com, "NXP i.MX U-Boot Team" Cc: u-boot@lists.denx.de, Peng Fan Subject: [PATCH 11/30] imx: ele_api: support program secure fuse and return lifecycle Date: Fri, 2 Jun 2023 14:45:48 +0800 Message-Id: <20230602064607.17222-12-peng.fan@oss.nxp.com> X-Mailer: git-send-email 2.40.0 In-Reply-To: <20230602064607.17222-1-peng.fan@oss.nxp.com> References: <20230602064607.17222-1-peng.fan@oss.nxp.com> X-ClientProxiedBy: SG2PR06CA0194.apcprd06.prod.outlook.com (2603:1096:4:1::26) To DU0PR04MB9417.eurprd04.prod.outlook.com (2603:10a6:10:358::11) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU0PR04MB9417:EE_|AM8PR04MB7362:EE_ X-MS-Office365-Filtering-Correlation-Id: ede0bd1f-0081-4250-d438-08db632dde1b X-MS-Exchange-SharedMailbox-RoutingAgent-Processed: True X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: ZeQjAIDeNzdveMvWVfJHzq3CV2aJM+9/dVlk0KFprN2WZgdClcFXr9DJm6KkQ1n6vqGJBB2nsXp8+prX2Wg0nmDZzjOg2uVOIw/YEu44i8CN3O8rvMD839MDZFiIoGU9p41B7tIQVLcyRphphnNfwTuw3mFwa9kn4KXBXyYh6zf5BTMv8Xwrijp6bvRh8Mn6g93m21W05kiMLFK98Gb2PRI/F8zyrlOh0G+nv5yCml9niAxk0fUUJOeDp90nqH/+kY6j4qma5Hk/TqaIcQlmZe1Ri8sPkJ2sFirbk7HSTcKWpRVHlPSSkmTIGpiTwmg1NHkEOdvFdOVIwUmVMR1E0/b+3rALK9LAlhkowwA9wGH25c2lspzZA5mm1qM2ifPolmPsAJIyR9azPX688OHP/vZP7FlXZBBcMfQ40voZwk4poKKn67VEBqFwkHzwyS6Bq6xIZcoNW4EGYL8TmHq2WhWsR9PTeQTjcJ43kbRl6FejGm9oMcGogEs/DGW41lPPKmCK8yRR7K4QaObhYr9iFUU/oaepu5Og5fH9CfItOh+ew8Nga2NP3bb/t4lSILLzfv2SWpHtio9w8twaHx/Qlyaq+uthPjC3VDX/KulVR+yOArGe/3LX/sA65SyTo/Og X-Forefront-Antispam-Report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DU0PR04MB9417.eurprd04.prod.outlook.com; PTR:; CAT:NONE; SFS:(13230028)(4636009)(346002)(376002)(366004)(39860400002)(396003)(136003)(451199021)(83380400001)(66556008)(66476007)(52116002)(6512007)(1076003)(26005)(6486002)(6506007)(478600001)(2616005)(186003)(86362001)(2906002)(5660300002)(6862004)(8936002)(8676002)(41300700001)(4326008)(66946007)(38350700002)(38100700002)(316002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: gfh5yvxpNbxvWHxexLbEaZLW8CARmpGnTWiQTCz/ED+ARl/rDociC8PCwzjb9gItUntCxwuuYHoOKZ4+CNnJTTX73BcTPqb7lDeTqVM+Q6iQLomxyvKDwuo7sWGPphS1RYpBfJvQ/JIMFnlXDPtWI2HhNIL9DBbnMNhQOTKvsj+I8I6ryoCJZuxN8M65bLae297PhZ+CfDQ3iOLobUiO8y+IiF1uOnbpq5Kad3GKMtog+SBCHXPxi7uZF3JtlHQgehnWqgdXtGqQl2FPNzQsdvR0Z34N0N9h591A0eJqijAuZPv9c3S/0Txj2gfsQDW2o61uBDw55/SS9+6XGPzk2dUFWIXMkMxm8fOJg+r2l1vtk6A39y3ieEo6/h1li7cQCZRdvwCryJGRPRRr0oMazsMonYmNcCNOz4u8K3PVF/TYjnFxlK5irSbaWzcJ/kgwVofyJKsFerHcYxd+v9e/NVTL664YTsPOxeK08Fxb5uO2bq4t6easRNNpgnhVDlQUXFbfdklf0zq7Gleot6qWV+jPrqEEg2tMS3TCa1ZGrM2D3YVQ1AI8plaMjNw0OrUiuoP1iKzu4J+ZoZJumb6f7nUMOxWSS3Juv4wI8UlX92Q05bG0266z2Q/Mzbq5MUeisl3JL5hed5ZaRXwwJwfcNgcSrSsS7tbDokSX8jyvzwcL29cjIE+SVuIf7T9gFaoLfwpgdP3JZMZ3Gh+f5y97V1r4MG/c42A8INR3YFSQ8R7QgXtWmAZV63Bmk6q6mmqKPOj4gi47fd6Ia8+C9bz9iQR9YMiwN9R7R7/bKffbzmGf1XBOE4HldSdF1S4cCmJzPb4cImI6FqBYSELDmmrMQbYLWZ8EJOMa4c5D82q2H83nWe+HxCxgcNDGGyefxDRDHcvC2nKock3tHUgLJehf9mRRoZxsSYQiaF6++ZYwloVWZSnys7GuUWHpQi+uFPW1+2qySd9TlN3I5hEI0Sy2r23RW/qFT+6SzmXclkt6VInvfpRdKMKF55+2kaTdl8c5xKnq9L5sTaS53R4TmNtDBpwOTyIb6bXJ61jZ+bAsy9WFoofoPtrUCOc/u+JhQ4n2fi0iENXdA57Qtcgo2IST0RMvLBdSiNJsU6eXRTkKlWm9kTeK98JMy+VN0b0emaZpL2NKoAPRpcMcQCh6G9VuUN/bKcb0JwBKMJet/Fa4EYmxf1q2XmaUuH1HHhenzaqq+Vlt0nXjgFY7RwIFHE1tE4WarTuXLo89ULSiKPFKkWScGof6YgMvJzP8fO1tYX+Dkd+ewa9692fXJE0Y3RF4NlxyZKP0mZoyfObcai6SlrH0nixVShOjzQ0oEHJoB2+XgroFBnUPxNTcnHnF9aMhoe8tpl2CXn3r06aQ14vAmjW5nLH/7aiZDNs5TiXKWBMQIAESNy9nts/5PHpEYX4xzTFK1/k5DAo6CIA7nc3xeT2YoF5PfnJ9GSvLFFJD2psfDo5hXW+zhyfqCeAlIqRkK4rHtfJiZAN5Fdlldfn51uOU9FuBBOMN6cUg/zT3Xffxt/sW6/k/luRWVR+jnmpPtKzs65QXv2uyC3mZuMnyLKlCJoIBobLcqkFOyGE0/LWu X-OriginatorOrg: oss.nxp.com X-MS-Exchange-CrossTenant-Network-Message-Id: ede0bd1f-0081-4250-d438-08db632dde1b X-MS-Exchange-CrossTenant-AuthSource: DU0PR04MB9417.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Jun 2023 05:54:45.6075 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 686ea1d3-bc2b-4c6f-a92c-d99c5c301635 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Rl6XiMG7ZhfD3tQXsT+vCjvNcTLtuXJ1viRjRt5QV7kaZOnWyvSCKysetTefpmd+KkmhpoyTGwRJr23jm3ZiBA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM8PR04MB7362 X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.8 at phobos.denx.de X-Virus-Status: Clean From: Peng Fan Add two ELE API: ele_return_lifecycle_update and ele_write_secure_fuse Add two cmd: ahab_return_lifecycle and ahab_sec_fuse_prog Signed-off-by: Peng Fan --- arch/arm/include/asm/mach-imx/ele_api.h | 2 + arch/arm/mach-imx/ele_ahab.c | 74 +++++++++++++++++++++++++ drivers/misc/imx_ele/ele_api.c | 64 ++++++++++++++++++++- 3 files changed, 139 insertions(+), 1 deletion(-) diff --git a/arch/arm/include/asm/mach-imx/ele_api.h b/arch/arm/include/asm/mach-imx/ele_api.h index 120da0854e4..477cfe73ab0 100644 --- a/arch/arm/include/asm/mach-imx/ele_api.h +++ b/arch/arm/include/asm/mach-imx/ele_api.h @@ -146,5 +146,7 @@ int ele_dump_buffer(u32 *buffer, u32 buffer_length); int ele_get_info(struct ele_get_info_data *info, u32 *response); int ele_get_fw_status(u32 *status, u32 *response); int ele_release_m33_trout(void); +int ele_write_secure_fuse(ulong signed_msg_blk, u32 *response); +int ele_return_lifecycle_update(ulong signed_msg_blk, u32 *response); #endif diff --git a/arch/arm/mach-imx/ele_ahab.c b/arch/arm/mach-imx/ele_ahab.c index 5f23486304c..785b0d6ec3c 100644 --- a/arch/arm/mach-imx/ele_ahab.c +++ b/arch/arm/mach-imx/ele_ahab.c @@ -563,6 +563,68 @@ static int do_ahab_status(struct cmd_tbl *cmdtp, int flag, int argc, char *const return 0; } +static int do_sec_fuse_prog(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) +{ + ulong addr; + u32 header, response; + + if (argc < 2) + return CMD_RET_USAGE; + + addr = hextoul(argv[1], NULL); + header = *(u32 *)addr; + + if ((header & 0xff0000ff) != 0x89000000) { + printf("Wrong Signed message block format, header 0x%x\n", header); + return CMD_RET_FAILURE; + } + + header = (header & 0xffff00) >> 8; + + printf("Signed Message block at 0x%lx, size 0x%x\n", addr, header); + flush_dcache_range(addr, addr + header - 1); + + if (ele_write_secure_fuse(addr, &response)) { + printf("Program secure fuse failed, response 0x%x\n", response); + return CMD_RET_FAILURE; + } + + printf("Program secure fuse completed, response 0x%x\n", response); + + return CMD_RET_SUCCESS; +} + +static int do_ahab_return_lifecycle(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) +{ + ulong addr; + u32 header, response; + + if (argc < 2) + return CMD_RET_USAGE; + + addr = hextoul(argv[1], NULL); + header = *(u32 *)addr; + + if ((header & 0xff0000ff) != 0x89000000) { + printf("Wrong Signed message block format, header 0x%x\n", header); + return CMD_RET_FAILURE; + } + + header = (header & 0xffff00) >> 8; + + printf("Signed Message block at 0x%lx, size 0x%x\n", addr, header); + flush_dcache_range(addr, addr + header - 1); + + if (ele_return_lifecycle_update(addr, &response)) { + printf("Return lifecycle failed, response 0x%x\n", response); + return CMD_RET_FAILURE; + } + + printf("Return lifecycle completed, response 0x%x\n", response); + + return CMD_RET_SUCCESS; +} + U_BOOT_CMD(auth_cntr, CONFIG_SYS_MAXARGS, 1, do_authenticate, "autenticate OS container via AHAB", "addr\n" @@ -583,3 +645,15 @@ U_BOOT_CMD(ahab_status, CONFIG_SYS_MAXARGS, 1, do_ahab_status, "display AHAB lifecycle only", "" ); + +U_BOOT_CMD(ahab_sec_fuse_prog, CONFIG_SYS_MAXARGS, 1, do_sec_fuse_prog, + "Program secure fuse via signed message block", + "addr\n" + "addr - Signed message block for secure fuse\n" +); + +U_BOOT_CMD(ahab_return_lifecycle, CONFIG_SYS_MAXARGS, 1, do_ahab_return_lifecycle, + "Return lifecycle to OEM field return via signed message block", + "addr\n" + "addr - Return lifecycle message block signed by OEM SRK\n" +); diff --git a/drivers/misc/imx_ele/ele_api.c b/drivers/misc/imx_ele/ele_api.c index 56605714f44..0ca0a94f08c 100644 --- a/drivers/misc/imx_ele/ele_api.c +++ b/drivers/misc/imx_ele/ele_api.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright 2020 NXP + * Copyright 2020, 2023 NXP * */ @@ -490,3 +490,65 @@ int ele_get_events(u32 *events, u32 *events_cnt, u32 *response) return ret; } + +int ele_write_secure_fuse(ulong signed_msg_blk, u32 *response) +{ + struct udevice *dev = gd->arch.ele_dev; + int size = sizeof(struct ele_msg); + struct ele_msg msg; + int ret; + + if (!dev) { + printf("ele dev is not initialized\n"); + return -ENODEV; + } + + msg.version = ELE_VERSION; + msg.tag = ELE_CMD_TAG; + msg.size = 3; + msg.command = ELE_WRITE_SECURE_FUSE_REQ; + + msg.data[0] = upper_32_bits(signed_msg_blk); + msg.data[1] = lower_32_bits(signed_msg_blk); + + ret = misc_call(dev, false, &msg, size, &msg, size); + if (ret) + printf("Error: %s: ret %d, response 0x%x, failed fuse row index %u\n", + __func__, ret, msg.data[0], msg.data[1]); + + if (response) + *response = msg.data[0]; + + return ret; +} + +int ele_return_lifecycle_update(ulong signed_msg_blk, u32 *response) +{ + struct udevice *dev = gd->arch.ele_dev; + int size = sizeof(struct ele_msg); + struct ele_msg msg; + int ret; + + if (!dev) { + printf("ele dev is not initialized\n"); + return -ENODEV; + } + + msg.version = ELE_VERSION; + msg.tag = ELE_CMD_TAG; + msg.size = 3; + msg.command = ELE_RET_LIFECYCLE_UP_REQ; + + msg.data[0] = upper_32_bits(signed_msg_blk); + msg.data[1] = lower_32_bits(signed_msg_blk); + + ret = misc_call(dev, false, &msg, size, &msg, size); + if (ret) + printf("Error: %s: ret %d, response 0x%x, failed fuse row index %u\n", + __func__, ret, msg.data[0], msg.data[1]); + + if (response) + *response = msg.data[0]; + + return ret; +}