From 3c48031ec33469594af77221cc79de2688d49792 Mon Sep 17 00:00:00 2001 From: Theodore Karatapanis Date: Tue, 6 May 2025 21:01:24 +0300 Subject: [PATCH] arch/arm64/imx9: Extend ELE API for container authentication This extends ELE API to: - Authenticate i.MX container header. - Verify container images. - Release resources of the authenticated containers. Signed-off-by: Theodore Karatapanis --- arch/arm64/src/imx9/hardware/imx9_ele.h | 23 ++++---- arch/arm64/src/imx9/imx9_ele.c | 74 ++++++++++++++++++++++++- arch/arm64/src/imx9/imx9_ele.h | 56 +++++++++++++++++++ 3 files changed, 141 insertions(+), 12 deletions(-) diff --git a/arch/arm64/src/imx9/hardware/imx9_ele.h b/arch/arm64/src/imx9/hardware/imx9_ele.h index dbb86e0415c..7a289aac74a 100644 --- a/arch/arm64/src/imx9/hardware/imx9_ele.h +++ b/arch/arm64/src/imx9/hardware/imx9_ele.h @@ -33,16 +33,19 @@ * Pre-processor Definitions ****************************************************************************/ -#define ELE_MAX_MSG 255U -#define AHAB_VERSION 0x6 -#define AHAB_CMD_TAG 0x17 -#define AHAB_RESP_TAG 0xe1 -#define ELE_RELEASE_RDC_REQ 0xc4 -#define ELE_READ_FUSE_REQ 0x97 -#define ELE_GET_EVENTS 0xa2 -#define ELE_DERIVE_KEY_REQ 0xa9 -#define ELE_FWD_LIFECYCLE_UP 0x95 -#define ELE_OK 0xd6 +#define ELE_MAX_MSG 255U +#define AHAB_VERSION 0x6 +#define AHAB_CMD_TAG 0x17 +#define AHAB_RESP_TAG 0xe1 +#define ELE_RELEASE_RDC_REQ 0xc4 +#define ELE_READ_FUSE_REQ 0x97 +#define ELE_GET_EVENTS_REQ 0xa2 +#define ELE_DERIVE_KEY_REQ 0xa9 +#define ELE_FWD_LIFECYCLE_UP_REQ 0x95 +#define ELE_OEM_CNTN_AUTH_REQ 0x87 +#define ELE_VERIFY_IMAGE_REQ 0x88 +#define ELE_RELEASE_CONTAINER_REQ 0x89 +#define ELE_OK 0xd6 #define ELE_MU_TCR (IMX9_S3MUA_BASE + 0x120) #define ELE_MU_TSR (IMX9_S3MUA_BASE + 0x124) diff --git a/arch/arm64/src/imx9/imx9_ele.c b/arch/arm64/src/imx9/imx9_ele.c index 8565df5028b..e53df86eb1c 100644 --- a/arch/arm64/src/imx9/imx9_ele.c +++ b/arch/arm64/src/imx9/imx9_ele.c @@ -267,7 +267,7 @@ int imx9_ele_get_events(uint32_t *buffer, size_t buffer_size) msg.header.version = AHAB_VERSION; msg.header.tag = AHAB_CMD_TAG; msg.header.size = 1; - msg.header.command = ELE_GET_EVENTS; + msg.header.command = ELE_GET_EVENTS_REQ; imx9_ele_sendmsg(&msg); imx9_ele_receivemsg(&msg); @@ -298,7 +298,7 @@ int imx9_ele_close_device(void) msg.header.version = AHAB_VERSION; msg.header.tag = AHAB_CMD_TAG; msg.header.size = 2; - msg.header.command = ELE_FWD_LIFECYCLE_UP; + msg.header.command = ELE_FWD_LIFECYCLE_UP_REQ; msg.data[0] = 0x08; imx9_ele_sendmsg(&msg); @@ -317,3 +317,73 @@ uint32_t imx9_ele_get_lifecycle(void) return (getreg32(FSB_LC_REG) & 0x3ff); } +int imx9_ele_auth_oem_ctnr(unsigned long ctnr_addr, uint32_t *response) +{ + msg.header.version = AHAB_VERSION; + msg.header.tag = AHAB_CMD_TAG; + msg.header.size = 3; + msg.header.command = ELE_OEM_CNTN_AUTH_REQ; + msg.data[0] = upper_32_bits(ctnr_addr); + msg.data[1] = lower_32_bits(ctnr_addr); + + imx9_ele_sendmsg(&msg); + imx9_ele_receivemsg(&msg); + if (response) + { + *response = msg.data[0]; + } + + if ((msg.data[0] & 0xff) == ELE_OK) + { + return 0; + } + + return -EIO; +} + +int imx9_ele_release_container(uint32_t *response) +{ + msg.header.version = AHAB_VERSION; + msg.header.tag = AHAB_CMD_TAG; + msg.header.size = 1; + msg.header.command = ELE_RELEASE_CONTAINER_REQ; + + imx9_ele_sendmsg(&msg); + imx9_ele_receivemsg(&msg); + + if (response) + { + *response = msg.data[0]; + } + + if ((msg.data[0] & 0xff) == ELE_OK) + { + return 0; + } + + return -EIO; +} + +int imx9_ele_verify_image(uint32_t img_id, uint32_t *response) +{ + msg.header.version = AHAB_VERSION; + msg.header.tag = AHAB_CMD_TAG; + msg.header.size = 2; + msg.header.command = ELE_VERIFY_IMAGE_REQ; + msg.data[0] = 1 << img_id; + + imx9_ele_sendmsg(&msg); + imx9_ele_receivemsg(&msg); + + if (response) + { + *response = msg.data[0]; + } + + if ((msg.data[0] & 0xff) == ELE_OK) + { + return 0; + } + + return -EIO; +} diff --git a/arch/arm64/src/imx9/imx9_ele.h b/arch/arm64/src/imx9/imx9_ele.h index 067df8c7e7a..8db3d707905 100644 --- a/arch/arm64/src/imx9/imx9_ele.h +++ b/arch/arm64/src/imx9/imx9_ele.h @@ -163,4 +163,60 @@ int imx9_ele_close_device(void); uint32_t imx9_ele_get_lifecycle(void); +/**************************************************************************** + * Name: imx9_ele_auth_oem_ctnr + * + * Description: + * Authenticate container header. + * + * Input Parameters: + * ctnr_addr - Address of the container header. + * + * Output Parameters: + * response - ELE response, can be used for debugging. + * + * Returned Value: + * Zero (OK) is returned for success. A negated errno value is returned on + * failure. + * + ****************************************************************************/ + +int imx9_ele_auth_oem_ctnr(unsigned long ctnr_addr, uint32_t *response); + +/**************************************************************************** + * Name: imx9_ele_release_container + * + * Description: + * Release the container from the ELE, used after imx9_ele_auth_oem_ctnr(). + * + * Output Parameters: + * response - ELE response, can be used for debugging. + * + * Returned Value: + * Zero (OK) is returned for success. A negated errno value is returned on + * failure. + * + ****************************************************************************/ + +int imx9_ele_release_container(uint32_t *response); + +/**************************************************************************** + * Name: imx9_ele_verify_image + * + * Description: + * Verify the specified image, for the current container. + * + * Input Parameters: + * img_id - The id of the image in the context of the current container. + * + * Output Parameters: + * response - ELE response, can be used for debugging. + * + * Returned Value: + * Zero (OK) is returned for success. A negated errno value is returned on + * failure. + * + ****************************************************************************/ + +int imx9_ele_verify_image(uint32_t img_id, uint32_t *response); #endif /* __ARCH_ARM64_SRC_IMX9_IMX9_ELE_H */