Skip to content

Update BL1 key hash feature #384

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BenReed161 merged 1 commit into from
May 28, 2026
+201 −4
Merged

Update BL1 key hash feature #384

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
112 changes: 108 additions & 4 deletions inc/switchtec/mfg.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,18 +52,27 @@
#define SWITCHTEC_PSID_DWORD_S 4

#define OTP_MULTI_DWORD_IMAGE_BIAK0 656
#define OTP_DWORD_0 0
#define OTP_DWORD_10 10
#define OTP_DWORD_0 0
#define OTP_DWORD_10 10
#define OTP_DWORD_11 11
#define OTP_DWORD_12 12
#define OTP_DWORD_13 13
#define OTP_DWORD_19 19
#define OTP_DWORD_20 20
#define OTP_DWORD_21 21
#define OTP_DWORD_22 22
#define OTP_DWORD_23 23
#define OTP_DWORD_25 25
#define OTP_DWORD_61 61

/* DWORD 0 — PRODUCT FLAGS */
#define OTP_DWORD_0_PRODUCT_DEVSEL_LSB 0
#define OTP_DWORD_0_PRODUCT_DEVSEL_MSK 0x0000003F
#define OTP_DWORD_0_PRODUCT_DEVSEL_FAMILY_BIT (1U << 5)
#define OTP_DWORD_0_PRODUCT_SECSC_LSB 22
#define OTP_DWORD_0_PRODUCT_SECSC_MSK 0x00400000

/* DWORD 10 — TWI RECOVERY */
#define OTP_DWORD_10_SMBUS_SMBRMRPCADDR_LSB 5
#define OTP_DWORD_10_SMBUS_SMBRMRPCADDR_MSK 0x00007FE0
#define OTP_DWORD_10_SMBUS_SMBRIF_LSB 1
Expand All @@ -72,12 +81,107 @@
#define OTP_DWORD_10_SMBUS_SMBRATYPE_MSK 0x00000018
#define OTP_DWORD_10_SMBUS_SMBROCPADDR_LSB 18
#define OTP_DWORD_10_SMBUS_SMBROCPADDR_MSK 0x0FFC0000
/* DWORD 19 — Boot Image Integrity Check Format */

/* DWORD 11 — I3C PID HIGH */
#define OTP_DWORD_11_I3C_I3CPID_LSB 0
#define OTP_DWORD_11_I3C_I3CPID_MSK 0xFFFFFFFF
/* DWORD 12 — I3C PID LOW */
#define OTP_DWORD_12_I3C_I3CPID2_LSB 0
#define OTP_DWORD_12_I3C_I3CPID2_MSK 0x0000FFFF
/* DWORD 13 — I3C RECOVERY FIELDS */
#define OTP_DWORD_13_I3C_I3CADDR_LSB 0
#define OTP_DWORD_13_I3C_I3CADDR_MSK 0x0000007F
#define OTP_DWORD_13_I3C_I3CINST_LSB 7
#define OTP_DWORD_13_I3C_I3CINST_MSK 0x00000180

/* DWORD 19 — ALGO DISABLE, ROM KEY DISABLE, FAILOVER, TOKEN DISABLE */
#define OTP_DWORD_19_CONTROL_CRC32D_LSB 0
#define OTP_DWORD_19_CONTROL_CRC32D_MSK 0x00000001
#define OTP_DWORD_19_CONTROL_ECDSAP384D_LSB 1
#define OTP_DWORD_19_CONTROL_ECDSAP384D_MSK 0x00000002
#define OTP_DWORD_19_CONTROL_ECDSAP521D_LSB 2
#define OTP_DWORD_19_CONTROL_ECDSAP521D_MSK 0x00000004
#define OTP_DWORD_19_CONTROL_RSA3KSHA2D_LSB 3
#define OTP_DWORD_19_CONTROL_RSA3KSHA2D_MSK 0x00000008
#define OTP_DWORD_19_CONTROL_RSA4KSHA2D_LSB 4
#define OTP_DWORD_19_CONTROL_RSA4KSHA2D_MSK 0x00000010
#define OTP_DWORD_19_CONTROL_DILITHIUM5D_LSB 5
#define OTP_DWORD_19_CONTROL_DILITHIUM5D_MSK 0x00000020
#define OTP_DWORD_19_CONTROL_IRK1R_LSB 6
#define OTP_DWORD_19_CONTROL_IRK1R_MSK 0x00000040
#define OTP_DWORD_19_CONTROL_IRK2R_LSB 7
#define OTP_DWORD_19_CONTROL_IRK2R_MSK 0x00000080
#define OTP_DWORD_19_CONTROL_IRK3R_LSB 8
#define OTP_DWORD_19_CONTROL_IRK3R_MSK 0x00000100
#define OTP_DWORD_19_CONTROL_IRK4R_LSB 9
#define OTP_DWORD_19_CONTROL_IRK4R_MSK 0x00000200
#define OTP_DWORD_19_CONTROL_BFUD_LSB 20
#define OTP_DWORD_19_CONTROL_BFUD_MSK 0x00100000
#define OTP_DWORD_19_CONTROL_BFSMBUSD_LSB 21
#define OTP_DWORD_19_CONTROL_BFSMBUSD_MSK 0x00200000
#define OTP_DWORD_19_CONTROL_BFI3CD_LSB 22
#define OTP_DWORD_19_CONTROL_BFI3CD_MSK 0x00400000
#define OTP_DWORD_19_CONTROL_BF2UD_LSB 23
#define OTP_DWORD_19_CONTROL_BF2UD_MSK 0x00800000
#define OTP_DWORD_19_CONTROL_BF2SMBUSD_LSB 24
#define OTP_DWORD_19_CONTROL_BF2SMBUSD_MSK 0x01000000
#define OTP_DWORD_19_CONTROL_BF2I3CD_LSB 25
#define OTP_DWORD_19_CONTROL_BF2I3CD_MSK 0x02000000
#define OTP_DWORD_19_CONTROL_BIICFCRCD_LSB 29
#define OTP_DWORD_19_CONTROL_BIICFCRCD_MSK 0x20000000
/* DWORD 20 — Boot Image Integrity Check Format (continued) */
#define OTP_DWORD_19_CONTROL_BIICFEC384D_LSB 30
#define OTP_DWORD_19_CONTROL_BIICFEC384D_MSK 0x40000000
#define OTP_DWORD_19_CONTROL_BIICFEC521D_LSB 31
#define OTP_DWORD_19_CONTROL_BIICFEC521D_MSK 0x80000000

/* DWORD 20 — HASH FORMAT DISABLE */
#define OTP_DWORD_20_CONTROL_BIICFR3SD_LSB 0
#define OTP_DWORD_20_CONTROL_BIICFR3SD_MSK 0x00000001
#define OTP_DWORD_20_CONTROL_BIICFRS2D_LSB 1
#define OTP_DWORD_20_CONTROL_BIICFRS2D_MSK 0x00000002
#define OTP_DWORD_20_CONTROL_BIIDILITHIUM5D_LSB 2
#define OTP_DWORD_20_CONTROL_BIIDILITHIUM5D_MSK 0x00000004

/* DWORD 21 — KEY READ MASK VECTOR */
#define OTP_DWORD_21_CONTROL_BIAKRMV_LSB 0
#define OTP_DWORD_21_CONTROL_BIAKRMV_MSK 0x00000FFF
/* DWORD 22 — KEY READ MASK REQUEST VECTOR */
#define OTP_DWORD_22_CONTROL_BIAKRMRV_LSB 0
#define OTP_DWORD_22_CONTROL_BIAKRMRV_MSK 0x00000FFF

/* DWORD 23 — KEY STATUS (BIAKxS) */
#define OTP_DWORD_23_CONTROL_BIAK0S_LSB 0
#define OTP_DWORD_23_CONTROL_BIAK0S_MSK 0x00000003
#define OTP_DWORD_23_CONTROL_BIAK1S_LSB 2
#define OTP_DWORD_23_CONTROL_BIAK1S_MSK 0x0000000C
#define OTP_DWORD_23_CONTROL_BIAK2S_LSB 4
#define OTP_DWORD_23_CONTROL_BIAK2S_MSK 0x00000030
#define OTP_DWORD_23_CONTROL_BIAK3S_LSB 6
#define OTP_DWORD_23_CONTROL_BIAK3S_MSK 0x000000C0
#define OTP_DWORD_23_CONTROL_BIAK4S_LSB 8
#define OTP_DWORD_23_CONTROL_BIAK4S_MSK 0x00000300
#define OTP_DWORD_23_CONTROL_BIAK5S_LSB 10
#define OTP_DWORD_23_CONTROL_BIAK5S_MSK 0x00000C00
#define OTP_DWORD_23_CONTROL_BIAK6S_LSB 12
#define OTP_DWORD_23_CONTROL_BIAK6S_MSK 0x00003000
#define OTP_DWORD_23_CONTROL_BIAK7S_LSB 14
#define OTP_DWORD_23_CONTROL_BIAK7S_MSK 0x0000C000
#define OTP_DWORD_23_CONTROL_BIAK8S_LSB 16
#define OTP_DWORD_23_CONTROL_BIAK8S_MSK 0x00030000
#define OTP_DWORD_23_CONTROL_BIAK9S_LSB 18
#define OTP_DWORD_23_CONTROL_BIAK9S_MSK 0x000C0000
#define OTP_DWORD_23_CONTROL_BIAK10S_LSB 20
#define OTP_DWORD_23_CONTROL_BIAK10S_MSK 0x00300000
#define OTP_DWORD_23_CONTROL_BIAK11S_LSB 22
#define OTP_DWORD_23_CONTROL_BIAK11S_MSK 0x00C00000

/* DWORD 25 — PUFAC FIELDS */
#define OTP_DWORD_25_CONTROL_PUFACS_LSB 0
#define OTP_DWORD_25_CONTROL_PUFACS_MSK 0x00000003
#define OTP_DWORD_25_CONTROL_PUFACRM_LSB 4
#define OTP_DWORD_25_CONTROL_PUFACRM_MSK 0x00000010
#define OTP_DWORD_25_CONTROL_PUFACRMR_LSB 5
#define OTP_DWORD_25_CONTROL_PUFACRMR_MSK 0x00000020

#define OTP_DWORD_61_MFGMSTT_SECSTATESET_LSB 4
#define OTP_DWORD_61_MFGMSTT_SECSTATESET_MSK 0x00000010
Expand Down
93 changes: 93 additions & 0 deletions lib/mfg.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -727,6 +727,7 @@ int security_settings_get_gen6(struct switchtec_dev *dev,
if (ret)
return ret;

/* DWORD 10 — TWI RECOVERY */
state->twi_rcvry_address_mrpc = (reply_otp[OTP_DWORD_10] & OTP_DWORD_10_SMBUS_SMBRMRPCADDR_MSK)
>> OTP_DWORD_10_SMBUS_SMBRMRPCADDR_LSB;
state->twi_rcvry_bus = (reply_otp[OTP_DWORD_10] & OTP_DWORD_10_SMBUS_SMBRIF_MSK)
Expand All @@ -735,9 +736,101 @@ int security_settings_get_gen6(struct switchtec_dev *dev,
>> OTP_DWORD_10_SMBUS_SMBRATYPE_LSB;
state->twi_rcvry_address_ocp = (reply_otp[OTP_DWORD_10] & OTP_DWORD_10_SMBUS_SMBROCPADDR_MSK)
>> OTP_DWORD_10_SMBUS_SMBROCPADDR_LSB;

/* DWORD 0 — PRODUCT FLAGS */
state->secsc = (reply_otp[OTP_DWORD_0] & OTP_DWORD_0_PRODUCT_SECSC_MSK)
>> OTP_DWORD_0_PRODUCT_SECSC_LSB;

/* DWORD 25 — PUFAC */
state->puf_ac_status = (reply_otp[OTP_DWORD_25] & OTP_DWORD_25_CONTROL_PUFACS_MSK)
>> OTP_DWORD_25_CONTROL_PUFACS_LSB;

/* DWORD 23 — KEY HASH STATUS */
state->otp_key0_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK0S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK0S_LSB;
state->otp_key1_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK1S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK1S_LSB;
state->otp_key2_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK2S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK2S_LSB;
state->otp_key3_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK3S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK3S_LSB;
state->otp_key4_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK4S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK4S_LSB;
state->otp_key5_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK5S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK5S_LSB;
state->otp_key6_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK6S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK6S_LSB;
state->otp_key7_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK7S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK7S_LSB;
state->otp_key8_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK8S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK8S_LSB;
state->otp_key9_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK9S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK9S_LSB;
state->otp_key10_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK10S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK10S_LSB;
state->otp_key11_hash_status = (reply_otp[OTP_DWORD_23] & OTP_DWORD_23_CONTROL_BIAK11S_MSK)
>> OTP_DWORD_23_CONTROL_BIAK11S_LSB;

/* DWORD 20 — HASH TABLE DISABLE */
state->has_table_sha2_384_disable = (reply_otp[OTP_DWORD_20] & OTP_DWORD_20_CONTROL_BIICFR3SD_MSK)
>> OTP_DWORD_20_CONTROL_BIICFR3SD_LSB;
state->has_table_sha2_512_disable = (reply_otp[OTP_DWORD_20] & OTP_DWORD_20_CONTROL_BIICFRS2D_MSK)
>> OTP_DWORD_20_CONTROL_BIICFRS2D_LSB;
state->has_table_sha3_512_disable = (reply_otp[OTP_DWORD_20] & OTP_DWORD_20_CONTROL_BIIDILITHIUM5D_MSK)
>> OTP_DWORD_20_CONTROL_BIIDILITHIUM5D_LSB;
state->has_table_crc32_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_CRC32D_MSK)
>> OTP_DWORD_19_CONTROL_CRC32D_LSB;

/* DWORD 11-13 — I3C IDENTIFIERS */
state->i3c_pid_high = (reply_otp[OTP_DWORD_11] & OTP_DWORD_11_I3C_I3CPID_MSK)
>> OTP_DWORD_11_I3C_I3CPID_LSB;
state->i3c_pid_low = (reply_otp[OTP_DWORD_12] & OTP_DWORD_12_I3C_I3CPID2_MSK)
>> OTP_DWORD_12_I3C_I3CPID2_LSB;
state->i3c_rcvry_address = (reply_otp[OTP_DWORD_13] & OTP_DWORD_13_I3C_I3CADDR_MSK)
>> OTP_DWORD_13_I3C_I3CADDR_LSB;
state->i3c_rcvry_bus = (reply_otp[OTP_DWORD_13] & OTP_DWORD_13_I3C_I3CINST_MSK)
>> OTP_DWORD_13_I3C_I3CINST_LSB;

/* DWORD 19 — ALGO/BOOT/FAILOVER/TOKEN DISABLE FLAGS */
state->algo_crc_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_CRC32D_MSK)
>> OTP_DWORD_19_CONTROL_CRC32D_LSB;
state->algo_ecdsa_p384_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_ECDSAP384D_MSK)
>> OTP_DWORD_19_CONTROL_ECDSAP384D_LSB;
state->algo_ecdsa_p521_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_ECDSAP521D_MSK)
>> OTP_DWORD_19_CONTROL_ECDSAP521D_LSB;
state->algo_rsa3ksha2_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_RSA3KSHA2D_MSK)
>> OTP_DWORD_19_CONTROL_RSA3KSHA2D_LSB;
state->algo_rsa4ksha2_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_RSA4KSHA2D_MSK)
>> OTP_DWORD_19_CONTROL_RSA4KSHA2D_LSB;
state->algo_dilithium5_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_DILITHIUM5D_MSK)
>> OTP_DWORD_19_CONTROL_DILITHIUM5D_LSB;
state->rom_key_1_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_IRK1R_MSK)
>> OTP_DWORD_19_CONTROL_IRK1R_LSB;
state->rom_key_2_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_IRK2R_MSK)
>> OTP_DWORD_19_CONTROL_IRK2R_LSB;
state->rom_key_3_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_IRK3R_MSK)
>> OTP_DWORD_19_CONTROL_IRK3R_LSB;
state->rom_key_4_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_IRK4R_MSK)
>> OTP_DWORD_19_CONTROL_IRK4R_LSB;
state->boot_from_uart_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BFUD_MSK)
>> OTP_DWORD_19_CONTROL_BFUD_LSB;
state->boot_from_smbus_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BFSMBUSD_MSK)
>> OTP_DWORD_19_CONTROL_BFSMBUSD_LSB;
state->boot_from_i3c_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BFI3CD_MSK)
>> OTP_DWORD_19_CONTROL_BFI3CD_LSB;
state->failover_to_uart_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BF2UD_MSK)
>> OTP_DWORD_19_CONTROL_BF2UD_LSB;
state->failover_to_smbus_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BF2SMBUSD_MSK)
>> OTP_DWORD_19_CONTROL_BF2SMBUSD_LSB;
state->failover_to_i3c_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BF2I3CD_MSK)
>> OTP_DWORD_19_CONTROL_BF2I3CD_LSB;
state->static_token_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BIICFCRCD_MSK)
>> OTP_DWORD_19_CONTROL_BIICFCRCD_LSB;
state->psid_only_token_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BIICFEC384D_MSK)
>> OTP_DWORD_19_CONTROL_BIICFEC384D_LSB;
state->uid_only_token_disable = (reply_otp[OTP_DWORD_19] & OTP_DWORD_19_CONTROL_BIICFEC521D_MSK)
>> OTP_DWORD_19_CONTROL_BIICFEC521D_LSB;

/* get 192 dwords of OTP content from offset 656 for keys*/
cmd.subcmd = MRPC_GET_SECURE_OTP;
cmd.OTP_dword_offset = OTP_MULTI_DWORD_IMAGE_BIAK0;
Expand Down