arm: imx: add HAB authentication of image to SPL boot
When using HAB as secure boot mechanism on Wandboard, the chain of
trust breaks immediately after the SPL. As this is not checking
the authenticity of the loaded image before jumping to it.
The HAB status output will not be implemented in SPL as it adds
a lot of strings that are only required in debug cases. With those
it exceeds the maximum size of the available OCRAM (69 KiB).
The SPL MISC driver support must be enabled, so that the driver can use OTP fuse
to check if HAB is enabled.
Cc: sbabic@denx.de
v2-Changes: None
Signed-off-by: Sven Ebenfeld <sven.ebenfeld@gmail.com>
Reviewed-by: George McCollister <george.mccollister@gmail.com>
Tested-by: George McCollister <george.mccollister@gmail.com>
diff --git a/arch/arm/imx-common/hab.c b/arch/arm/imx-common/hab.c
index 6731825..7449487 100644
--- a/arch/arm/imx-common/hab.c
+++ b/arch/arm/imx-common/hab.c
@@ -110,6 +110,10 @@
* +------------+ + CSF_PAD_SIZE
*/
+static bool is_hab_enabled(void);
+
+#if !defined(CONFIG_SPL_BUILD)
+
#define MAX_RECORD_BYTES (8*1024) /* 4 kbytes */
struct record {
@@ -257,22 +261,6 @@
-1
};
-bool is_hab_enabled(void)
-{
- struct imx_sec_config_fuse_t *fuse =
- (struct imx_sec_config_fuse_t *)&imx_sec_config_fuse;
- uint32_t reg;
- int ret;
-
- ret = fuse_read(fuse->bank, fuse->word, ®);
- if (ret) {
- puts("\nSecure boot fuse read error\n");
- return ret;
- }
-
- return (reg & IS_HAB_ENABLED_BIT) == IS_HAB_ENABLED_BIT;
-}
-
static inline uint8_t get_idx(uint8_t *list, uint8_t tgt)
{
uint8_t idx = 0;
@@ -359,6 +347,68 @@
return 0;
}
+int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
+{
+ if ((argc != 1)) {
+ cmd_usage(cmdtp);
+ return 1;
+ }
+
+ get_hab_status();
+
+ return 0;
+}
+
+static int do_authenticate_image(cmd_tbl_t *cmdtp, int flag, int argc,
+ char * const argv[])
+{
+ ulong addr, ivt_offset;
+ int rcode = 0;
+
+ if (argc < 3)
+ return CMD_RET_USAGE;
+
+ addr = simple_strtoul(argv[1], NULL, 16);
+ ivt_offset = simple_strtoul(argv[2], NULL, 16);
+
+ rcode = authenticate_image(addr, ivt_offset);
+
+ return rcode;
+}
+
+U_BOOT_CMD(
+ hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status,
+ "display HAB status",
+ ""
+ );
+
+U_BOOT_CMD(
+ hab_auth_img, 3, 0, do_authenticate_image,
+ "authenticate image via HAB",
+ "addr ivt_offset\n"
+ "addr - image hex address\n"
+ "ivt_offset - hex offset of IVT in the image"
+ );
+
+
+#endif /* !defined(CONFIG_SPL_BUILD) */
+
+static bool is_hab_enabled(void)
+{
+ struct imx_sec_config_fuse_t *fuse =
+ (struct imx_sec_config_fuse_t *)&imx_sec_config_fuse;
+ uint32_t reg;
+ int ret;
+
+ ret = fuse_read(fuse->bank, fuse->word, ®);
+ if (ret) {
+ puts("\nSecure boot fuse read error\n");
+ return ret;
+ }
+
+ return (reg & IS_HAB_ENABLED_BIT) == IS_HAB_ENABLED_BIT;
+}
+
uint32_t authenticate_image(uint32_t ddr_start, uint32_t image_size)
{
uint32_t load_addr = 0;
@@ -400,7 +450,9 @@
(void *)(ddr_start + ivt_offset+IVT_SIZE),
4, 0x10, 0);
+#if !defined(CONFIG_SPL_BUILD)
get_hab_status();
+#endif
puts("\nCalling authenticate_image in ROM\n");
printf("\tivt_offset = 0x%x\n", ivt_offset);
@@ -449,7 +501,9 @@
hab_caam_clock_enable(0);
+#if !defined(CONFIG_SPL_BUILD)
get_hab_status();
+#endif
} else {
puts("hab fuse not enabled\n");
}
@@ -459,46 +513,3 @@
return result;
}
-
-int do_hab_status(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
-{
- if ((argc != 1)) {
- cmd_usage(cmdtp);
- return 1;
- }
-
- get_hab_status();
-
- return 0;
-}
-
-static int do_authenticate_image(cmd_tbl_t *cmdtp, int flag, int argc,
- char * const argv[])
-{
- ulong addr, ivt_offset;
- int rcode = 0;
-
- if (argc < 3)
- return CMD_RET_USAGE;
-
- addr = simple_strtoul(argv[1], NULL, 16);
- ivt_offset = simple_strtoul(argv[2], NULL, 16);
-
- rcode = authenticate_image(addr, ivt_offset);
-
- return rcode;
-}
-
-U_BOOT_CMD(
- hab_status, CONFIG_SYS_MAXARGS, 1, do_hab_status,
- "display HAB status",
- ""
- );
-
-U_BOOT_CMD(
- hab_auth_img, 3, 0, do_authenticate_image,
- "authenticate image via HAB",
- "addr ivt_offset\n"
- "addr - image hex address\n"
- "ivt_offset - hex offset of IVT in the image"
- );