1 /*
2 * Copyright 2017-2020 NXP
3 * Copyright 2022 Leica Geosystems AG
4 *
5 * SPDX-License-Identifier: BSD-3-Clause
6 */
7
8 #include <common/runtime_svc.h>
9 #include <imx_sip_svc.h>
10
11 #define HAB_CID_ATF U(2) /* TF-A Caller ID */
12
13 /* HAB Status definitions */
14 enum hab_status {
15 HAB_STS_ANY = 0x00, /* Match any status in report_event() */
16 HAB_FAILURE = 0x33, /* Operation failed */
17 HAB_WARNING = 0x69, /* Operation completed with warning */
18 HAB_SUCCESS = 0xf0 /* Operation completed successfully */
19 };
20
21 /* HAB Configuration definitions */
22 enum hab_config {
23 HAB_CFG_RETURN = 0x33, /* Field Return IC */
24 HAB_CFG_OPEN = 0xf0, /* Non-secure IC */
25 HAB_CFG_CLOSED = 0xcc /* Secure IC */
26 };
27
28 /* HAB State definitions */
29 enum hab_state {
30 HAB_STATE_INITIAL = 0x33, /* Initializing state (transitory) */
31 HAB_STATE_CHECK = 0x55, /* Check state (non-secure) */
32 HAB_STATE_NONSECURE = 0x66, /* Non-secure state */
33 HAB_STATE_TRUSTED = 0x99, /* Trusted state */
34 HAB_STATE_SECURE = 0xaa, /* Secure state */
35 HAB_STATE_FAIL_SOFT = 0xcc, /* Soft fail state */
36 HAB_STATE_FAIL_HARD = 0xff, /* Hard fail state (terminal) */
37 HAB_STATE_NONE = 0xf0 /* No security state machine */
38 };
39
40 /* HAB Verification Target definitions */
41 enum hab_target {
42 HAB_TGT_MEMORY = 0x0f, /* Check memory allowed list */
43 HAB_TGT_PERIPHERAL = 0xf0, /* Check peripheral allowed list */
44 HAB_TGT_ANY = 0x55 /* Check memory & peripheral allowed list */
45 };
46
47 /* Authenticate Image Loader Callback prototype */
48 typedef enum hab_status hab_loader_callback_f_t(void **, size_t *, const void *);
49
50 /*
51 * HAB Rom VectorTable (RVT) structure.
52 * This table provides function pointers into the HAB library in ROM for
53 * use by post-ROM boot sequence components.
54 * Functions are ordered in the structure below based on the offsets in ROM
55 * image, and shall not be changed!
56 * Details on API allocation offsets and function description could be
57 * found in following documents from NXP:
58 * - High Assurance Boot Version 4 Application Programming Interface
59 * Reference Manual (available in CST package)
60 * - HABv4 RVT Guidelines and Recommendations (AN12263)
61 */
62 struct hab_rvt_api {
63 uint64_t hdr;
64 enum hab_status (*entry)(void);
65 enum hab_status (*exit)(void);
66 enum hab_status (*check_target)(enum hab_target type, const void *start, size_t bytes);
67 void* (*authenticate_image)(uint8_t cid, long ivt_offset, void **start,
68 size_t *bytes, hab_loader_callback_f_t loader);
69 enum hab_status (*run_dcd)(const uint8_t *dcd);
70 enum hab_status (*run_csf)(const uint8_t *csf, uint8_t cid, uint32_t srkmask);
71 enum hab_status (*assert)(long type, const void *data, uint32_t count);
72 enum hab_status (*report_event)(enum hab_status status, uint32_t index,
73 uint8_t *event, size_t *bytes);
74 enum hab_status (*report_status)(enum hab_config *config, enum hab_state *state);
75 void (*failsafe)(void);
76 void* (*authenticate_image_no_dcd)(uint8_t cid, long ivt_offset, void **start,
77 size_t *bytes, hab_loader_callback_f_t loader);
78 uint32_t (*get_version)(void);
79 enum hab_status (*authenticate_container)(uint8_t cid, long ivt_offset, void **start,
80 size_t *bytes, hab_loader_callback_f_t loader, uint32_t srkmask, int skip_dcd);
81 };
82
83 struct hab_rvt_api *g_hab_rvt_api = (struct hab_rvt_api *)HAB_RVT_BASE;
84
85 /*******************************************************************************
86 * Handler for servicing HAB SMC calls
87 ******************************************************************************/
imx_hab_handler(uint32_t smc_fid,u_register_t x1,u_register_t x2,u_register_t x3,u_register_t x4)88 int imx_hab_handler(uint32_t smc_fid,
89 u_register_t x1,
90 u_register_t x2,
91 u_register_t x3,
92 u_register_t x4)
93 {
94 switch (x1) {
95 case IMX_SIP_HAB_ENTRY:
96 return g_hab_rvt_api->entry();
97 case IMX_SIP_HAB_EXIT:
98 return g_hab_rvt_api->exit();
99 case IMX_SIP_HAB_CHECK_TARGET:
100 return g_hab_rvt_api->check_target((enum hab_target)x2,
101 (const void *)x3, (size_t)x4);
102 case IMX_SIP_HAB_AUTH_IMG:
103 return (unsigned long)g_hab_rvt_api->authenticate_image(HAB_CID_ATF,
104 x2, (void **)x3, (size_t *)x4, NULL);
105 case IMX_SIP_HAB_REPORT_EVENT:
106 return g_hab_rvt_api->report_event(HAB_FAILURE,
107 (uint32_t)x2, (uint8_t *)x3, (size_t *)x4);
108 case IMX_SIP_HAB_REPORT_STATUS:
109 return g_hab_rvt_api->report_status((enum hab_config *)x2,
110 (enum hab_state *)x3);
111 case IMX_SIP_HAB_FAILSAFE:
112 g_hab_rvt_api->failsafe();
113 break;
114 case IMX_SIP_HAB_AUTH_IMG_NO_DCD:
115 return (unsigned long)g_hab_rvt_api->authenticate_image_no_dcd(
116 HAB_CID_ATF, x2, (void **)x3, (size_t *)x4, NULL);
117 case IMX_SIP_HAB_GET_VERSION:
118 return g_hab_rvt_api->get_version();
119 default:
120 return SMC_UNK;
121 };
122
123 return SMC_OK;
124 }
125
