1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * K3: Security functions
4 *
5 * Copyright (C) 2018-2022 Texas Instruments Incorporated - http://www.ti.com/
6 * Andrew F. Davis <afd@ti.com>
7 */
8
9 #include <asm/io.h>
10 #include <common.h>
11 #include <cpu_func.h>
12 #include <dm.h>
13 #include <hang.h>
14 #include <image.h>
15 #include <log.h>
16 #include <asm/cache.h>
17 #include <linux/soc/ti/ti_sci_protocol.h>
18 #include <mach/spl.h>
19 #include <spl.h>
20 #include <linux/dma-mapping.h>
21
22 #include "common.h"
23
ti_secure_cert_detected(void * p_image)24 static bool ti_secure_cert_detected(void *p_image)
25 {
26 /* Primitive certificate detection, check for DER starting with
27 * two 4-Octet SEQUENCE tags
28 */
29 return (((u8 *)p_image)[0] == 0x30 && ((u8 *)p_image)[1] == 0x82 &&
30 ((u8 *)p_image)[4] == 0x30 && ((u8 *)p_image)[5] == 0x82);
31 }
32
33 /* Primitive certificate length, assumes one 2-Octet sized SEQUENCE */
ti_secure_cert_length(void * p_image)34 static size_t ti_secure_cert_length(void *p_image)
35 {
36 size_t seq_length = be16_to_cpu(readw_relaxed(p_image + 2));
37 /* Add 4 for the SEQUENCE tag length */
38 return seq_length + 4;
39 }
40
ti_secure_image_check_binary(void ** p_image,size_t * p_size)41 void ti_secure_image_check_binary(void **p_image, size_t *p_size)
42 {
43 u32 image_size;
44 size_t cert_length;
45 image_size = *p_size;
46
47 if (!image_size) {
48 debug("%s: Image size is %d\n", __func__, image_size);
49 return;
50 }
51
52 if (get_device_type() == K3_DEVICE_TYPE_GP) {
53 if (ti_secure_cert_detected(*p_image)) {
54 printf("Warning: Detected image signing certificate on GP device. "
55 "Skipping certificate to prevent boot failure. "
56 "This will fail if the image was also encrypted\n");
57
58 cert_length = ti_secure_cert_length(*p_image);
59 if (cert_length > *p_size) {
60 printf("Invalid signing certificate size\n");
61 return;
62 }
63
64 *p_image += cert_length;
65 *p_size -= cert_length;
66 }
67
68 return;
69 }
70
71 if (get_device_type() != K3_DEVICE_TYPE_HS_SE &&
72 !ti_secure_cert_detected(*p_image)) {
73 printf("Warning: Did not detect image signing certificate. "
74 "Skipping authentication to prevent boot failure. "
75 "This will fail on Security Enforcing(HS-SE) devices\n");
76 return;
77 }
78 }
79
ti_secure_image_post_process(void ** p_image,size_t * p_size)80 void ti_secure_image_post_process(void **p_image, size_t *p_size)
81 {
82 struct ti_sci_handle *ti_sci = get_ti_sci_handle();
83 struct ti_sci_proc_ops *proc_ops = &ti_sci->ops.proc_ops;
84 u64 image_addr;
85 u32 image_size;
86 int ret;
87
88 image_size = *p_size;
89 if (!image_size) {
90 debug("%s: Image size is %d\n", __func__, image_size);
91 return;
92 }
93
94 if (get_device_type() != K3_DEVICE_TYPE_HS_SE &&
95 get_device_type() != K3_DEVICE_TYPE_HS_FS)
96 return;
97
98 /* Clean out image so it can be seen by system firmware */
99 image_addr = dma_map_single(*p_image, *p_size, DMA_BIDIRECTIONAL);
100
101 debug("Authenticating image at address 0x%016llx\n", image_addr);
102 debug("Authenticating image of size %d bytes\n", image_size);
103
104 /* Authenticate image */
105 ret = proc_ops->proc_auth_boot_image(ti_sci, &image_addr, &image_size);
106 if (ret) {
107 printf("Authentication failed!\n");
108 hang();
109 }
110
111 /* Invalidate any stale lines over data written by system firmware */
112 if (image_size)
113 dma_unmap_single(image_addr, image_size, DMA_BIDIRECTIONAL);
114
115 /*
116 * The image_size returned may be 0 when the authentication process has
117 * moved the image. When this happens no further processing on the
118 * image is needed or often even possible as it may have also been
119 * placed behind a firewall when moved.
120 */
121 *p_size = image_size;
122
123 /*
124 * Output notification of successful authentication to re-assure the
125 * user that the secure code is being processed as expected. However
126 * suppress any such log output in case of building for SPL and booting
127 * via YMODEM. This is done to avoid disturbing the YMODEM serial
128 * protocol transactions.
129 */
130 if (!(IS_ENABLED(CONFIG_SPL_BUILD) &&
131 IS_ENABLED(CONFIG_SPL_YMODEM_SUPPORT) &&
132 spl_boot_device() == BOOT_DEVICE_UART))
133 printf("Authentication passed\n");
134 }
135