sec_check.c 6.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273
  1. /*
  2. * Copyright (C) 2017-2021 Alibaba Group Holding Limited
  3. *
  4. * SPDX-License-Identifier: GPL-2.0+
  5. */
  6. #include <common.h>
  7. #include <command.h>
  8. #include <console.h>
  9. #include <malloc.h>
  10. #include <linux/errno.h>
  11. #include <asm/arch-thead/boot_mode.h>
  12. #include "../../../lib/sec_library/include/csi_sec_img_verify.h"
  13. extern int csi_efuse_api_int(void);
  14. extern int csi_efuse_api_unint(void);
  15. extern int csi_efuse_read_raw(uint32_t addr, void *data, uint32_t cnt);
  16. extern int csi_efuse_write_raw(uint32_t addr, const void *data, uint32_t cnt);
  17. extern uint32_t rambus_crypto_init(void);
  18. int image_have_head(unsigned long img_src_addr)
  19. {
  20. uint8_t *buffer = (uint8_t *)img_src_addr;
  21. if (memcmp(header_magic, &buffer[4], 4) == 0) {
  22. return 1;
  23. }
  24. return 0;
  25. }
  26. int csi_sec_init(void)
  27. {
  28. int ret;
  29. char *version;
  30. /* Initialize eFuse module */
  31. ret = csi_efuse_api_int();
  32. if (ret) {
  33. printf("efuse init faild[%d]\n", ret);
  34. goto exit;
  35. }
  36. ret = rambus_crypto_init();
  37. if (ret) {
  38. printf("rambus_crypto_init faild[%d]\n", ret);
  39. goto exit;
  40. }
  41. csi_sec_get_lib_version(&version);
  42. csi_sec_set_boot_stage(0);
  43. printf("sec version: %s \n", version);
  44. exit:
  45. return ret;
  46. }
  47. #define LIGHT_MAC1ADDR_OFF 176
  48. void designware_get_mac_from_fuse(unsigned char *mac)
  49. {
  50. int ret;
  51. /* Initialize eFuse module */
  52. ret = csi_efuse_api_int();
  53. if (ret) {
  54. printf("efuse init faild[%d]\n", ret);
  55. return;
  56. }
  57. ret = csi_efuse_read_raw(LIGHT_MAC1ADDR_OFF, mac, 6);
  58. if (ret) {
  59. printf("efuse macaddr read faild[%d]\n", ret);
  60. return;
  61. }
  62. }
  63. static int strtou32(const char *str, unsigned int base, u32 *result)
  64. {
  65. char *ep;
  66. *result = simple_strtoul(str, &ep, base);
  67. if (ep == str || *ep != '\0')
  68. return -EINVAL;
  69. return 0;
  70. }
  71. static int confirm_prog(void)
  72. {
  73. puts("Warning: Programming fuses is an irreversible operation!\n"
  74. " This may brick your system.\n"
  75. " Use this command only if you are sure of "
  76. "what you are doing!\n"
  77. "\nReally perform this fuse programming? <y/N>\n");
  78. if (confirm_yesno())
  79. return 1;
  80. puts("Fuse programming aborted\n");
  81. return 0;
  82. }
  83. static int do_fuse(cmd_tbl_t *cmdtp, int flag, int argc, char *const argv[])
  84. {
  85. const char *op = argc >= 2 ? argv[1] : NULL;
  86. int confirmed = argc >= 3 && !strcmp(argv[2], "-y");
  87. u32 addr, cnt, val;
  88. u8 *data;
  89. int ret, i;
  90. /* Initialize eFuse module */
  91. ret = csi_efuse_api_int();
  92. if (ret) {
  93. printf("efuse init faild[%d]\n", ret);
  94. goto err;
  95. }
  96. argc -= 2 + confirmed;
  97. argv += 2 + confirmed;
  98. if (argc < 1 || strtou32(argv[0], 0, &addr))
  99. return CMD_RET_USAGE;
  100. if (!strcmp(op, "read")) {
  101. if (argc == 1)
  102. cnt = 1;
  103. else if (argc != 2 || strtou32(argv[1], 0, &cnt))
  104. return CMD_RET_USAGE;
  105. printf("Reading addr %u:\n", addr);
  106. {
  107. data = malloc(cnt);
  108. ret = csi_efuse_read_raw(addr, data, cnt);
  109. if (ret) {
  110. free(data);
  111. goto err;
  112. }
  113. for (i = 0; i < cnt; i++)
  114. printf(" 0x%.2x", data[i]);
  115. free(data);
  116. }
  117. putc('\n');
  118. } else if (!strcmp(op, "write")) {
  119. if (argc < 2)
  120. return CMD_RET_USAGE;
  121. data = malloc(argc - 1);
  122. printf("Programming addr %u to\n", addr);
  123. for (i = 1; i < argc; i++) {
  124. if (strtou32(argv[i], 16, &val))
  125. return CMD_RET_USAGE;
  126. data[i-1] = val;
  127. printf(" 0x%.2x\n", val);
  128. }
  129. cnt = argc - 1;
  130. if (!confirmed && !confirm_prog()) {
  131. free(data);
  132. return CMD_RET_FAILURE;
  133. }
  134. ret = csi_efuse_write_raw(addr, data, cnt);
  135. if (ret) {
  136. free(data);
  137. goto err;
  138. }
  139. free(data);
  140. } else {
  141. return CMD_RET_USAGE;
  142. }
  143. return 0;
  144. err:
  145. puts("ERROR\n");
  146. return CMD_RET_FAILURE;
  147. }
  148. #if CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_A) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_VAL_B) || CONFIG_IS_ENABLED(LIGHT_SEC_BOOT_WITH_VERIFY_ANT_REF)
  149. /* Secure function for image verificaiton here */
  150. int get_image_version(unsigned long img_src_addr)
  151. {
  152. img_header_t *img = (img_header_t *)img_src_addr;
  153. uint8_t magiccode[4] = {0};
  154. magiccode[3] = img->magic_num & 0xff;
  155. magiccode[2] = (img->magic_num & 0xff00) >> 8;
  156. magiccode[1] = (img->magic_num & 0xff0000) >> 16;
  157. magiccode[0] = (img->magic_num & 0xff000000) >> 24;
  158. if (memcmp(header_magic, magiccode, 4) == 0) {
  159. return -1;
  160. }
  161. return img->image_version;
  162. }
  163. int get_image_size(unsigned long img_src_addr)
  164. {
  165. img_header_t *img = (img_header_t *)img_src_addr;
  166. uint8_t magiccode[4] = {0};
  167. magiccode[3] = img->magic_num & 0xff;
  168. magiccode[2] = (img->magic_num & 0xff00) >> 8;
  169. magiccode[1] = (img->magic_num & 0xff0000) >> 16;
  170. magiccode[0] = (img->magic_num & 0xff000000) >> 24;
  171. if (memcmp(header_magic, magiccode, 4) == 0) {
  172. return -1;
  173. }
  174. return img->image_size;
  175. }
  176. void dump_image_header_info(long addr)
  177. {
  178. img_header_t *phead = (img_header_t *)addr;
  179. printf("\n---------------------------------------------\n");
  180. printf("entry point: 0x%x\n", phead->entry_point);
  181. printf("image size: %d Bytes\n", phead->image_size);
  182. printf("head version: 0x%x\n", phead->head_version);
  183. printf("image version: 0x%x\n", phead->image_version);
  184. printf("image checksum: 0x%x\n", phead->image_checksum);
  185. printf("image run addr: 0x%llx\n", phead->image_run_addr);
  186. printf("image offset: 0x%x\n", phead->image_offset);
  187. printf("image digest scheme: %d\n", phead->digest_scheme);
  188. printf("image sign scheme: %d\n", phead->signature_scheme);
  189. printf("image encrypt type: %d\n", phead->encrypt_type);
  190. printf("\n---------------------------------------------\n");
  191. }
  192. int verify_customer_image(img_type_t type, long addr)
  193. {
  194. int ret;
  195. const char *image_name = "";
  196. /* Double check image number */
  197. if (image_have_head(addr) == 0)
  198. return -1;
  199. /* Dump image header information here */
  200. dump_image_header_info(addr);
  201. /* Call customer image verification function */
  202. if ((type == T_TF) || (type == T_TEE) || (type == T_KRLIMG)) {
  203. ret = csi_sec_custom_image_verify(addr, UBOOT_STAGE_ADDR);
  204. if (ret) {
  205. printf("Image(%d) is verified fail, Please go to check!\n\n", type);
  206. return ret;
  207. }
  208. } else if (type == T_UBOOT) {
  209. ret = csi_sec_uboot_image_verify(addr, addr - PUBKEY_HEADER_SIZE);
  210. if (ret) {
  211. printf("Image(%s) is verified fail, Please go to check!\n\n", "uboot");
  212. return ret;
  213. }
  214. }
  215. return 0;
  216. }
  217. #else
  218. U_BOOT_CMD(
  219. efuse, CONFIG_SYS_MAXARGS, 0, do_fuse,
  220. "eFuse sub-system",
  221. "read <addr> [<cnt>] - read 1 or 'cnt' fuse bytes,\n"
  222. " starting at 'addr'\n"
  223. "efuse write [-y] <addr> <hexval> [<hexval>...] - program 1 or\n"
  224. " several fuse bytes, starting at 'addr'\n"
  225. );
  226. #endif