Eric Lee / smarc-uboot

1
Download as
Browse Code »

Commit 6c8ed4a65e73747f38d2e16e8a2b8cb0c7cce4af

Authored by Ye Li
1 parent 4160d73628
Exists in smarc_8mq_lf_v2020.04 and in 4 other branches pitx_8mp_lf_v2020.04, smarc-8m-android-11.0.0_2.0.0, smarc-8mp-android-11.0.0_2.0.0, smarc_8mp_lf_v2020.04

MLK-10958 imx: mx6ul support Bus Encryption Engine 

This patch is to support Bus Encryption Engine(BEE) for i.MX 6UL.
Supported feature:
1. SNVS key and soft key
2. CTR and ECB mode
3. Specify address region to bee.

Two commands are included:
bee init [key] [mode] [start] [end] - BEE block initial
    "Example: bee init 1 1 0x80000000 0x80010000\n"
bee test [region]
    "Example: bee test 1\n"

Mapping:
[0x10000000 - (0x10000000 + size - 1)] : [start - (start + size - 1)]
[0x30000000 - (0x30000000 + IRAM_SIZE - 1)] : [IRAM_BASE_ADDR -
(IRAM_BASE_ADDR + IRAM_SIZE - 1)]

Whatever start is, start - (start + size -1) will be fixed mapping to
0x10000000 - (0x10000000 + size - 1)

Since default AES region's protected size is SZ_512M, so
on mx6ul evk board, you can not simply run 'bee init', it will
overlap with uboot execution environment, you can use
'bee init 0 0 0x80000000 0x81000000'.

If want to use bee, Need to define CONFIG_CMD_BEE in board configuration
header file, since CONFIG_CMD_BEE default is not enabled.

This patch also checks fuse bit 25 of bank 0 word 4 before initialize bee.
The bit: 0 means bee enabled, 1 means bee disabled.

Signed-off-by: Peng Fan <Peng.Fan@freescale.com>
Signed-off-by: Ye Li <ye.li@nxp.com>
(cherry picked from commit 9d592121bebbdb9ded0009a2703c7cab01edfa70)
(cherry picked from commit cd03ba8327d46178900a63310d5ef3edd8034350)

Showing 4 changed files with 527 additions and 0 deletions Side-by-side Diff

arch/arm/include/asm/arch-mx6/mx6_bee.h
Diff comments   View file @ 6c8ed4a
  1 +/*
  2 + * Copyright (C) 2015 Freescale Semiconductor, Inc.
  3 + *
  4 + * SPDX-License-Identifier: GPL-2.0+
  5 + */
  6 +
  7 +#include <common.h>
  8 +
  9 +#define GPR0 0x0
  10 +#define GPR1 0x4
  11 +#define GPR2 0x8
  12 +#define GPR3 0xC
  13 +#define GPR4 0x10
  14 +#define GPR5 0x14
  15 +#define GPR6 0x18
  16 +#define GPR7 0x1C
  17 +#define GPR8 0x20
  18 +#define GPR9 0x24
  19 +#define GPR10 0x28
  20 +#define GPR11 0x2C
  21 +
  22 +#define GPR0_CTRL_CLK_EN_LOCK (1 << 31)
  23 +#define GPR0_CTRL_CLK_EN (1 << 15)
  24 +#define GPR0_CTRL_SFTRST_N_LOCK (1 << 30)
  25 +#define GPR0_CTRL_SFTRST (0 << 14)
  26 +#define GPR0_CTRL_SFTRST_N (1 << 14)
  27 +#define GPR0_CTRL_AES_MODE_LOCK (1 << 29)
  28 +#define GPR0_CTRL_AES_MODE_ECB (0 << 13)
  29 +#define GPR0_CTRL_AES_MODE_CTR (1 << 13)
  30 +#define GPR0_SEC_LEVEL_LOCK (3 << 24)
  31 +#define GPR0_SEC_LEVEL (3 << 8)
  32 +#define GPR0_AES_KEY_SEL_LOCK (1 << 20)
  33 +#define GPR0_AES_KEY_SEL_SNVS (0 << 4)
  34 +#define GPR0_AES_KEY_SEL_SOFT (1 << 4)
  35 +#define GPR0_BEE_ENABLE_LOCK (1 << 16)
  36 +#define GPR0_BEE_ENABLE (1 << 0)
  37 +
  38 +/*
  39 + * SECURITY LEVEL
  40 + * Non-Secure User | Non-Secure Spvr | Secure User | Secure Spvr
  41 + * Level
  42 + * (0)00 RD + WR RD + WR RD + WR RD + WR
  43 + * (1)01 None RD + WR RD + WR RD + WR
  44 + * (2)10 None None RD + WR RD + WR
  45 + * (3)11 None None None RD + WR
  46 + */
  47 +#define GPR0_SEC_LEVEL_0 (0 << 8)
  48 +#define GPR0_SEC_LEVEL_1 (1 << 8)
  49 +#define GPR0_SEC_LEVEL_2 (2 << 8)
  50 +#define GPR0_SEC_LEVEL_3 (3 << 8)
arch/arm/mach-imx/mx6/Kconfig
Diff comments   View file @ 6c8ed4a
... ... @@ -112,6 +112,12 @@
112 112 "fsl,ldo-bypass" property. When the property is set, board relevant
113 113 PMIC settings are called to adjust for LDO bypass.
114 114  
  115 +config CMD_BEE
  116 + bool "Enable commands for Bus Encryption Engine(BEE)"
  117 + depends on MX6UL
  118 + help
  119 + Set "Y" to enable the bee commands
  120 +
115 121 choice
116 122 prompt "MX6 board select"
117 123 optional
arch/arm/mach-imx/mx6/Makefile
Diff comments   View file @ 6c8ed4a
... ... @@ -4,10 +4,15 @@
4 4 # Wolfgang Denk, DENX Software Engineering, wd@denx.de.
5 5 #
6 6 # (C) Copyright 2011 Freescale Semiconductor, Inc.
  7 +# Copyright 2018 NXP
  8 +#
7 9  
8 10 obj-y := soc.o clock.o
9 11 obj-$(CONFIG_SPL_BUILD) += ddr.o
10 12 obj-$(CONFIG_MP) += mp.o
11 13 obj-$(CONFIG_MX6UL_LITESOM) += litesom.o
12 14 obj-$(CONFIG_MX6UL_OPOS6UL) += opos6ul.o
  15 +ifdef CONFIG_MX6UL
  16 +obj-$(CONFIG_CMD_BEE) += bee.o
  17 +endif
arch/arm/mach-imx/mx6/bee.c
Diff comments   View file @ 6c8ed4a
  1 +/*
  2 + * Copyright (C) 2015-2016 Freescale Semiconductor, Inc.
  3 + * Copyright 2018 NXP
  4 + *
  5 + * SPDX-License-Identifier: GPL-2.0+
  6 + */
  7 +
  8 +#include <asm/io.h>
  9 +#include <asm/arch/mx6_bee.h>
  10 +#include <linux/errno.h>
  11 +#include <asm/system.h>
  12 +#include <common.h>
  13 +#include <command.h>
  14 +#include <fuse.h>
  15 +#include <asm/arch/sys_proto.h>
  16 +
  17 +DECLARE_GLOBAL_DATA_PTR;
  18 +
  19 +#if (defined(CONFIG_SYS_DCACHE_OFF) || defined(CONFIG_SYS_ICACHE_OFF))
  20 +#error "Bee needs Cache Open"
  21 +#endif
  22 +
  23 +struct bee_parameters {
  24 + int key_method;
  25 + int mode;
  26 + u32 start1;
  27 + u32 size1;
  28 + u32 start2;
  29 + u32 size2;
  30 +};
  31 +
  32 +#define SOFT_KEY 0
  33 +#define SNVS_KEY 1
  34 +
  35 +#define ECB_MODE 0
  36 +#define CTR_MODE 1
  37 +
  38 +#define AES_REGION0_ADDR 0x10000000
  39 +#define AES_REGION1_ADDR 0x30000000
  40 +
  41 +static struct bee_parameters para;
  42 +static int bee_inited;
  43 +
  44 +union key_soft {
  45 + u8 s_key[16];
  46 + u32 b_key[4];
  47 +};
  48 +
  49 +union key_soft key_bad;
  50 +
  51 +/* software version */
  52 +u8 hw_get_random_byte(void)
  53 +{
  54 + static u32 lcg_state;
  55 + static u32 nb_soft = 9876543;
  56 +#define MAX_SOFT_RNG 1024
  57 + static const u32 a = 1664525;
  58 + static const u32 c = 1013904223;
  59 + nb_soft = (nb_soft + 1) % MAX_SOFT_RNG;
  60 + lcg_state = (a * lcg_state + c);
  61 + return (u8) (lcg_state >> 24);
  62 +}
  63 +
  64 +/*
  65 + * Lock bee GPR0 bits
  66 + * Only reset can release these bits.
  67 + */
  68 +static int bee_lock(void)
  69 +{
  70 + int val;
  71 +
  72 + val = readl(BEE_BASE_ADDR + GPR0);
  73 + val |= (GPR0_CTRL_CLK_EN_LOCK | GPR0_CTRL_SFTRST_N_LOCK |
  74 + GPR0_CTRL_AES_MODE_LOCK | GPR0_SEC_LEVEL_LOCK |
  75 + GPR0_AES_KEY_SEL_LOCK | GPR0_BEE_ENABLE_LOCK);
  76 + writel(val, BEE_BASE_ADDR + GPR0);
  77 +
  78 + return 0;
  79 +}
  80 +
  81 +/* Only check bee enable lock is enough */
  82 +static int bee_locked(void)
  83 +{
  84 + int val;
  85 +
  86 + val = readl(BEE_BASE_ADDR + GPR0);
  87 +
  88 + return val & GPR0_BEE_ENABLE_LOCK ? 1 : 0;
  89 +}
  90 +
  91 +int bee_init(struct bee_parameters *p)
  92 +{
  93 + int i;
  94 + union key_soft *key = &key_bad;
  95 + u32 value;
  96 +
  97 + if (bee_locked()) {
  98 + printf("BEE already enabled and locked.\n");
  99 + return CMD_RET_FAILURE;
  100 + }
  101 +
  102 + /* CLKGATE, SFTRST */
  103 + writel(GPR0_CTRL_CLK_EN | GPR0_CTRL_SFTRST_N, BEE_BASE_ADDR + GPR0);
  104 + /* OFFSET_ADDR0 */
  105 + writel(p->start1 >> 16, BEE_BASE_ADDR + GPR1);
  106 + /*
  107 + * OFFSET_ADDR1
  108 + * Default protect IRAM region, if what you want to protect
  109 + * bigger that 512M which is the max size that one AES region
  110 + * can protect, we need AES region 1 to cover.
  111 + */
  112 + writel(p->start2 >> 16, BEE_BASE_ADDR + GPR2);
  113 +
  114 + if (p->key_method == SOFT_KEY) {
  115 + for (i = 0; i < 16; i++)
  116 + key->s_key[i] = hw_get_random_byte();
  117 + /* AES 128 key from software */
  118 + /* aes0_key0_w0 */
  119 + writel(key->b_key[0], BEE_BASE_ADDR + GPR3);
  120 + /* aes0_key0_w1 */
  121 + writel(key->b_key[1], BEE_BASE_ADDR + GPR4);
  122 + /* aes0_key0_w2 */
  123 + writel(key->b_key[2], BEE_BASE_ADDR + GPR5);
  124 + /* aes0_key0_w3 */
  125 + writel(key->b_key[3], BEE_BASE_ADDR + GPR6);
  126 + }
  127 +
  128 + if (p->mode == ECB_MODE) {
  129 + value = GPR0_CTRL_CLK_EN | GPR0_CTRL_SFTRST_N |
  130 + GPR0_SEC_LEVEL_3 | GPR0_AES_KEY_SEL_SNVS |
  131 + GPR0_BEE_ENABLE | GPR0_CTRL_AES_MODE_ECB;
  132 + if (p->key_method == SOFT_KEY)
  133 + value = GPR0_CTRL_CLK_EN | GPR0_CTRL_SFTRST_N |
  134 + GPR0_SEC_LEVEL_3 | GPR0_AES_KEY_SEL_SOFT |
  135 + GPR0_BEE_ENABLE | GPR0_CTRL_AES_MODE_ECB;
  136 + writel(value, BEE_BASE_ADDR + GPR0);
  137 + } else {
  138 + for (i = 0; i < 16; i++)
  139 + key->s_key[i] = hw_get_random_byte();
  140 + /* aes_key1_w0 */
  141 + writel(key->b_key[0], BEE_BASE_ADDR + GPR8);
  142 + /* aes_key1_w1 */
  143 + writel(key->b_key[1], BEE_BASE_ADDR + GPR9);
  144 + /* aes_key1_w2 */
  145 + writel(key->b_key[2], BEE_BASE_ADDR + GPR10);
  146 + /* aes_key1_w3 */
  147 + writel(key->b_key[3], BEE_BASE_ADDR + GPR11);
  148 +
  149 + value = GPR0_CTRL_CLK_EN | GPR0_CTRL_SFTRST_N |
  150 + GPR0_SEC_LEVEL_3 | GPR0_AES_KEY_SEL_SNVS |
  151 + GPR0_BEE_ENABLE | GPR0_CTRL_AES_MODE_CTR;
  152 + if (p->key_method == SOFT_KEY)
  153 + value = GPR0_CTRL_CLK_EN | GPR0_CTRL_SFTRST_N |
  154 + GPR0_SEC_LEVEL_3 | GPR0_AES_KEY_SEL_SOFT |
  155 + GPR0_BEE_ENABLE | GPR0_CTRL_AES_MODE_CTR;
  156 + writel(value, BEE_BASE_ADDR + GPR0);
  157 + }
  158 +
  159 + bee_lock();
  160 +
  161 + printf("BEE is settings as: %s mode, %s %d key\n",
  162 + (p->mode == ECB_MODE) ? "ECB" : "CTR",
  163 + (p->key_method == SOFT_KEY) ? "SOFT" : "SNVS HW",
  164 + (p->mode == ECB_MODE) ? 128 : 256);
  165 +
  166 + return CMD_RET_SUCCESS;
  167 +}
  168 +
  169 +int bee_test(struct bee_parameters *p, int region)
  170 +{
  171 + u32 result = 0, range, address;
  172 + int i, val;
  173 + /*
  174 + * Test instruction running in AES Region:
  175 + * int test(void)
  176 + * {
  177 + * return 0x55aa55aa;
  178 + * }
  179 + * Assemble:
  180 + * 0xe59f0000: ldr r0, [pc]
  181 + * 0xe12fff1e: bx lr
  182 + * 0x55aa55aa: 0x55aa55aa
  183 + */
  184 + u32 inst[3] = {0xe59f0000, 0xe12fff1e, 0x55aa55aa};
  185 +
  186 + /* Cache enabled? */
  187 + if ((get_cr() & (CR_I | CR_C)) != (CR_I | CR_C)) {
  188 + printf("Enable dcache and icache first!\n");
  189 + return CMD_RET_FAILURE;
  190 + }
  191 +
  192 + printf("Test Region %d\nBegin Data test: Writing... ", region);
  193 +
  194 + range = (region == 0) ? p->size1 : p->size2;
  195 + address = (region == 0) ? AES_REGION0_ADDR : AES_REGION1_ADDR;
  196 + for (i = 0; i < range; i = i + 4)
  197 + writel(i, address + i);
  198 +
  199 + printf("Finshed Write!\n");
  200 +
  201 + flush_dcache_range(address, address + range);
  202 +
  203 + printf("Reading... ");
  204 + for (i = 0; i < range; i = i + 4) {
  205 + val = readl(address + i);
  206 + if (val != i)
  207 + result++;
  208 + }
  209 + printf("Finshed Read!\n");
  210 +
  211 + if (result > 0)
  212 + printf("BEE Data Test check Failed!\n");
  213 + else
  214 + printf("BEE Data Test Check Passed!\n");
  215 +
  216 + for (i = 0; i < ARRAY_SIZE(inst); i++)
  217 + writel(inst[i], address + (i * 4));
  218 +
  219 + flush_dcache_range(address, address + sizeof(inst));
  220 +
  221 + val = ((int (*)(void))address)();
  222 +
  223 + printf("\nBee Instruction test, Program:\n"
  224 + "int test(void)\n"
  225 + "{\n"
  226 + " return 0x55aa55aa;\n"
  227 + "}\n"
  228 + "Assemble:\n"
  229 + "0xe59f0000: ldr r0, [pc]\n"
  230 + "0xe12fff1e: bx lr\n"
  231 + "0x55aa55aa: 0x55aa55aa\n"
  232 + "Runnint at 0x%x\n", address);
  233 + if (val == 0x55aa55aa)
  234 + printf("Bee Instruction Test Passed!\n");
  235 + else
  236 + printf("Bee Instruction Test Failed!\n");
  237 +
  238 + return CMD_RET_SUCCESS;
  239 +}
  240 +
  241 +static int region_valid(u32 start, u32 size)
  242 +{
  243 + if ((start < PHYS_SDRAM) || (start >= (start + size - 1)) ||
  244 + (start >= (PHYS_SDRAM + PHYS_SDRAM_SIZE - 1))) {
  245 + printf("Invalid start 0x%x, size 0x%x\n", start, size);
  246 + return -EINVAL;
  247 + }
  248 +
  249 + if (size > SZ_512M) {
  250 + printf("The region size exceeds SZ_512M\n");
  251 + return -EINVAL;
  252 + }
  253 +
  254 + if ((start & 0xFFFF) && (size & 0xFFFF)) {
  255 + printf("start or size not 64KB aligned!\n");
  256 + return -EINVAL;
  257 + }
  258 +
  259 + /* 128K for U-Boot Stack */
  260 + if ((start + size - 1) >= (gd->start_addr_sp - SZ_128K)) {
  261 + printf("Overlap with uboot execution environment!\n"
  262 + "Decrease size or start\n");
  263 + return -EINVAL;
  264 + }
  265 +
  266 + return 0;
  267 +}
  268 +
  269 +static int do_bee_init(cmd_tbl_t *cmdtp, int flag, int argc,
  270 + char * const argv[])
  271 +{
  272 + u32 start, size, val;
  273 + int ret;
  274 + struct bee_parameters *p = &para;
  275 +
  276 +#if defined(CONFIG_SYS_ARM_CACHE_WRITETHROUGH)
  277 + enum dcache_option option = DCACHE_WRITETHROUGH;
  278 +#else
  279 + enum dcache_option option = DCACHE_WRITEBACK;
  280 +#endif
  281 +
  282 + if (argc > 5)
  283 + return CMD_RET_USAGE;
  284 +
  285 + if (fuse_read(0, 4, &val)) {
  286 + puts("Can not get fuse bank 0, word 4\n");
  287 + } else {
  288 + if (val & (1 << 25)) {
  289 + puts("BEE disabed in fuse!\n");
  290 + return CMD_RET_FAILURE;
  291 + }
  292 + }
  293 +
  294 + /* Cache enabled? */
  295 + if ((get_cr() & (CR_I | CR_C)) != (CR_I | CR_C)) {
  296 + /*
  297 + * Here we need icache and dcache both enabled, because
  298 + * we may take the protected region for instruction and
  299 + * data usage. And icache and dcache both enabled are
  300 + * better for performance.
  301 + */
  302 + printf("Please enable dcache and icache first!\n");
  303 + return CMD_RET_FAILURE;
  304 + }
  305 +
  306 + p->key_method = SOFT_KEY;
  307 + p->mode = ECB_MODE;
  308 + p->start1 = PHYS_SDRAM;
  309 + p->size1 = SZ_512M;
  310 + p->start2 = IRAM_BASE_ADDR;
  311 + p->size2 = IRAM_SIZE;
  312 +
  313 + if (argc == 2) {
  314 + p->key_method = (int)simple_strtoul(argv[1], NULL, 16);
  315 + p->mode = ECB_MODE;
  316 + p->start1 = PHYS_SDRAM;
  317 + p->size1 = SZ_512M;
  318 + } else if (argc == 3) {
  319 + p->key_method = (int)simple_strtoul(argv[1], NULL, 16);
  320 + p->mode = (int)simple_strtoul(argv[2], NULL, 10);
  321 + p->start1 = PHYS_SDRAM;
  322 + p->size1 = SZ_512M;
  323 + } else if ((argc == 4) || (argc == 5)) {
  324 + p->key_method = (int)simple_strtoul(argv[1], NULL, 16);
  325 + p->mode = (int)simple_strtoul(argv[2], NULL, 10);
  326 + start = (u32)simple_strtoul(argv[3], NULL, 16);
  327 + /* Default size that AES Region0 can protected */
  328 + size = SZ_512M;
  329 + if (argc == 5)
  330 + size = (u32)simple_strtoul(argv[4], NULL, 16);
  331 + p->start1 = start;
  332 + p->size1 = size;
  333 + }
  334 +
  335 + if ((p->key_method != SOFT_KEY) && (p->key_method != SNVS_KEY))
  336 + return CMD_RET_USAGE;
  337 +
  338 + if ((p->mode != ECB_MODE) && (p->mode != CTR_MODE))
  339 + return CMD_RET_USAGE;
  340 +
  341 + /*
  342 + * No need to check region valid for IRAM, since it is fixed.
  343 + * Only check DRAM region here.
  344 + */
  345 + if (region_valid(p->start1, p->size1))
  346 + return CMD_RET_FAILURE;
  347 +
  348 + ret = bee_init(p);
  349 + if (ret)
  350 + return CMD_RET_FAILURE;
  351 +
  352 + /*
  353 + * Set DCACHE OFF to AES REGION0 and AES REGION1 first
  354 + * to avoid possible unexcepted cache settings.
  355 + */
  356 + mmu_set_region_dcache_behaviour(AES_REGION0_ADDR, SZ_1G, DCACHE_OFF);
  357 +
  358 + mmu_set_region_dcache_behaviour(AES_REGION0_ADDR, p->size1, option);
  359 +
  360 + mmu_set_region_dcache_behaviour(AES_REGION1_ADDR, p->size2, option);
  361 +
  362 + printf("Access Region 0x%x - 0x%x to protect 0x%x - 0x%x\n"
  363 + "Do not directly access 0x%x - 0x%x\n"
  364 + "Access Region 0x%x - 0x%x to protect 0x%x - 0x%x\n"
  365 + "Do not directly access 0x%x - 0x%x\n",
  366 + AES_REGION0_ADDR, AES_REGION0_ADDR + p->size1 - 1,
  367 + p->start1, p->start1 + p->size1 - 1,
  368 + p->start1, p->start1 + p->size1 - 1,
  369 + AES_REGION1_ADDR, AES_REGION1_ADDR + p->size2 - 1,
  370 + p->start2, p->start2 + p->size2 - 1,
  371 + p->start2, p->start2 + p->size2 - 1);
  372 +
  373 + bee_inited = 1;
  374 +
  375 + return CMD_RET_SUCCESS;
  376 +}
  377 +
  378 +static int do_bee_test(cmd_tbl_t *cmdtp, int flag, int argc,
  379 + char * const argv[])
  380 +{
  381 + int ret;
  382 + int region;
  383 +
  384 + if (bee_inited == 0) {
  385 + printf("Bee not initialized, run bee init first!\n");
  386 + return CMD_RET_FAILURE;
  387 + }
  388 + if (argc > 2)
  389 + return CMD_RET_USAGE;
  390 +
  391 + region = 0;
  392 + if (argc == 2)
  393 + region = (int)simple_strtoul(argv[1], NULL, 16);
  394 + /* Only two regions are supported, 0 and 1 */
  395 + if (region >= 2)
  396 + return CMD_RET_USAGE;
  397 +
  398 + ret = bee_test(&para, region);
  399 + if (ret)
  400 + return CMD_RET_FAILURE;
  401 +
  402 + return CMD_RET_SUCCESS;
  403 +}
  404 +
  405 +static cmd_tbl_t cmd_bmp_sub[] = {
  406 + U_BOOT_CMD_MKENT(init, 5, 0, do_bee_init, "", ""),
  407 + U_BOOT_CMD_MKENT(test, 2, 0, do_bee_test, "", ""),
  408 +};
  409 +
  410 +static int do_bee_ops(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
  411 +{
  412 + cmd_tbl_t *c;
  413 +
  414 + c = find_cmd_tbl(argv[1], &cmd_bmp_sub[0], ARRAY_SIZE(cmd_bmp_sub));
  415 +
  416 + /* Drop off the 'bee' command argument */
  417 + argc--;
  418 + argv++;
  419 +
  420 + if (c)
  421 + return c->cmd(cmdtp, flag, argc, argv);
  422 + else
  423 + return CMD_RET_USAGE;
  424 +}
  425 +
  426 +U_BOOT_CMD(
  427 + bee, CONFIG_SYS_MAXARGS, 1, do_bee_ops,
  428 + "BEE function test",
  429 + "init [key] [mode] [start] [size] - BEE block initial\n"
  430 + " key: 0 | 1, 0 means software key, 1 means SNVS random key\n"
  431 + " mode: 0 | 1, 0 means ECB mode, 1 means CTR mode\n"
  432 + " start: start address that you want to protect\n"
  433 + " size: The size of the area that you want to protect\n"
  434 + " start and end(start + size) addr both should be 64KB aligned.\n"
  435 + "\n"
  436 + " After initialization, the mapping:\n"
  437 + " 1. [0x10000000 - (0x10000000 + size - 1)] <--->\n"
  438 + " [start - (start + size - 1)]\n"
  439 + " Here [start - (start + size -1)] is fixed mapping to\n"
  440 + " [0x10000000 - (0x10000000 + size - 1)], whatever start is.\n"
  441 + " 2. [0x30000000 - (0x30000000 + IRAM_SIZE - 1)] <--->\n"
  442 + " [IRAM_BASE_ADDR - (IRAM_BASE_ADDR + IRAM_SIZE - 1)]\n"
  443 + "\n"
  444 + " Note: Here we only use AES region 0 to protect the DRAM\n"
  445 + " area that you specified, max size SZ_512M.\n"
  446 + " AES region 1 is used to protect IRAM area.\n"
  447 + " Example:\n"
  448 + " 1. bee init 1 1 0xa0000000 0x10000\n"
  449 + " Access 0x10000000 - 0x10010000 to protect 0xa0000000 - 0xa0010000\n"
  450 + " 2. bee init 1 1 0x80000000 0x20000\n"
  451 + " Access 0x10000000 - 0x10020000 to protect 0x80000000 - 0x80020000\n"
  452 + "\n"
  453 + " Default configuration if only `bee init` without any args:\n"
  454 + " 1. software key\n"
  455 + " 2. ECB mode\n"
  456 + " 3. Address protected:\n"
  457 + " Remapped Region0: PHYS_SDRAM - PHYS_SDRAM + SZ_512M\n"
  458 + " Remapped Region1: IRAM_BASE_ADDR - IRAM_BASE_ADDR + IRAM_SIZE\n"
  459 + " 4. Default Mapping for 6UL:\n"
  460 + " [0x10000000 - 0x2FFFFFFF] <-> [0x80000000 - 0x9FFFFFFF]\n"
  461 + " [0x30000000 - 0x3001FFFF] <-> [0x00900000 - 0x0091FFFF]\n"
  462 + "\n"
  463 + "bee test [region] - BEE function test\n"
  464 + " region: 0 | 1, 0 means region0, 1 means regions1\n"
  465 +);