1 // SPDX-License-Identifier: GPL-2.0+
3 * Copyright (C) 2021 Philippe Reynes <philippe.reynes@softathome.com>
7 #include <asm/global_data.h>
8 DECLARE_GLOBAL_DATA_PTR;
12 #include <u-boot/sha256.h>
17 * This value is used to skip the header before really launching the image
19 ulong image_load_offset;
22 * This function gathers information about the signature check
23 * that could be done before launching the image.
26 * < 0 => an error has occurred
30 static int image_pre_load_sig_setup(struct image_sig_info *info)
32 const void *algo_name, *padding_name, *key, *mandatory;
38 log_err("ERROR: info is NULL for image pre-load sig check\n");
43 memset(info, 0, sizeof(*info));
45 node = fdt_path_offset(gd_fdt_blob(), IMAGE_PRE_LOAD_PATH);
47 log_info("INFO: no info for image pre-load sig check\n");
52 algo_name = fdt_getprop(gd_fdt_blob(), node,
53 IMAGE_PRE_LOAD_PROP_ALGO_NAME, NULL);
55 printf("ERROR: no algo_name for image pre-load sig check\n");
60 padding_name = fdt_getprop(gd_fdt_blob(), node,
61 IMAGE_PRE_LOAD_PROP_PADDING_NAME, NULL);
63 log_info("INFO: no padding_name provided, so using pkcs-1.5\n");
64 padding_name = "pkcs-1.5";
67 sig_size = fdt_getprop(gd_fdt_blob(), node,
68 IMAGE_PRE_LOAD_PROP_SIG_SIZE, NULL);
70 log_err("ERROR: no signature-size for image pre-load sig check\n");
75 key = fdt_getprop(gd_fdt_blob(), node,
76 IMAGE_PRE_LOAD_PROP_PUBLIC_KEY, &key_len);
78 log_err("ERROR: no key for image pre-load sig check\n");
83 info->algo_name = (char *)algo_name;
84 info->padding_name = (char *)padding_name;
85 info->key = (uint8_t *)key;
86 info->key_len = key_len;
87 info->sig_size = fdt32_to_cpu(*sig_size);
89 mandatory = fdt_getprop(gd_fdt_blob(), node,
90 IMAGE_PRE_LOAD_PROP_MANDATORY, NULL);
91 if (mandatory && !strcmp((char *)mandatory, "yes"))
94 /* Compute signature information */
95 info->sig_info.name = info->algo_name;
96 info->sig_info.padding = image_get_padding_algo(info->padding_name);
97 info->sig_info.checksum = image_get_checksum_algo(info->sig_info.name);
98 info->sig_info.crypto = image_get_crypto_algo(info->sig_info.name);
99 info->sig_info.key = info->key;
100 info->sig_info.keylen = info->key_len;
106 static int image_pre_load_sig_get_magic(ulong addr, u32 *magic)
108 struct sig_header_s *sig_header;
111 sig_header = (struct sig_header_s *)map_sysmem(addr, SIG_HEADER_LEN);
113 log_err("ERROR: can't map first header\n");
118 *magic = fdt32_to_cpu(sig_header->magic);
120 unmap_sysmem(sig_header);
126 static int image_pre_load_sig_get_header_size(ulong addr, u32 *header_size)
128 struct sig_header_s *sig_header;
131 sig_header = (struct sig_header_s *)map_sysmem(addr, SIG_HEADER_LEN);
133 log_err("ERROR: can't map first header\n");
138 *header_size = fdt32_to_cpu(sig_header->header_size);
140 unmap_sysmem(sig_header);
148 * < 0 => no magic and magic mandatory (or error when reading magic)
150 * 1 => magic NOT found
152 static int image_pre_load_sig_check_magic(struct image_sig_info *info, ulong addr)
157 ret = image_pre_load_sig_get_magic(addr, &magic);
161 if (magic != IMAGE_PRE_LOAD_SIG_MAGIC) {
162 if (info->mandatory) {
163 log_err("ERROR: signature is mandatory\n");
171 ret = 0; /* magic found */
177 static int image_pre_load_sig_check_header_sig(struct image_sig_info *info, ulong addr)
180 struct image_region reg;
185 /* Only map header of the header and its signature */
186 header = (void *)map_sysmem(addr, SIG_HEADER_LEN + info->sig_size);
188 log_err("ERROR: can't map header\n");
194 reg.size = SIG_HEADER_LEN;
196 sig = (uint8_t *)header + SIG_HEADER_LEN;
197 sig_len = info->sig_size;
199 ret = info->sig_info.crypto->verify(&info->sig_info, ®, 1, sig, sig_len);
201 log_err("ERROR: header signature check has failed (err=%d)\n", ret);
207 unmap_sysmem(header);
213 static int image_pre_load_sig_check_img_sig_sha256(struct image_sig_info *info, ulong addr)
215 struct sig_header_s *sig_header;
216 u32 header_size, offset_img_sig;
218 u8 sha256_img_sig[SHA256_SUM_LEN];
221 sig_header = (struct sig_header_s *)map_sysmem(addr, SIG_HEADER_LEN);
223 log_err("ERROR: can't map first header\n");
228 header_size = fdt32_to_cpu(sig_header->header_size);
229 offset_img_sig = fdt32_to_cpu(sig_header->offset_img_sig);
231 header = (void *)map_sysmem(addr, header_size);
233 log_err("ERROR: can't map header\n");
238 sha256_csum_wd(header + offset_img_sig, info->sig_size,
239 sha256_img_sig, CHUNKSZ_SHA256);
241 ret = memcmp(sig_header->sha256_img_sig, sha256_img_sig, SHA256_SUM_LEN);
243 log_err("ERROR: sha256 of image signature is invalid\n");
249 unmap_sysmem(header);
251 unmap_sysmem(sig_header);
256 static int image_pre_load_sig_check_img_sig(struct image_sig_info *info, ulong addr)
258 struct sig_header_s *sig_header;
259 u32 header_size, image_size, offset_img_sig;
261 struct image_region reg;
266 sig_header = (struct sig_header_s *)map_sysmem(addr, SIG_HEADER_LEN);
268 log_err("ERROR: can't map first header\n");
273 header_size = fdt32_to_cpu(sig_header->header_size);
274 image_size = fdt32_to_cpu(sig_header->image_size);
275 offset_img_sig = fdt32_to_cpu(sig_header->offset_img_sig);
277 unmap_sysmem(sig_header);
279 image = (void *)map_sysmem(addr, header_size + image_size);
281 log_err("ERROR: can't map full image\n");
286 reg.data = image + header_size;
287 reg.size = image_size;
289 sig = (uint8_t *)image + offset_img_sig;
290 sig_len = info->sig_size;
292 ret = info->sig_info.crypto->verify(&info->sig_info, ®, 1, sig, sig_len);
294 log_err("ERROR: signature check has failed (err=%d)\n", ret);
296 goto out_unmap_image;
299 log_info("INFO: signature check has succeed\n");
308 int image_pre_load_sig(ulong addr)
310 struct image_sig_info info;
313 ret = image_pre_load_sig_setup(&info);
321 ret = image_pre_load_sig_check_magic(&info, addr);
329 /* Check the signature of the signature header */
330 ret = image_pre_load_sig_check_header_sig(&info, addr);
334 /* Check sha256 of the image signature */
335 ret = image_pre_load_sig_check_img_sig_sha256(&info, addr);
339 /* Check the image signature */
340 ret = image_pre_load_sig_check_img_sig(&info, addr);
344 ret = image_pre_load_sig_get_header_size(addr, &header_size);
346 log_err("%s: can't get header size\n", __func__);
351 image_load_offset += header_size;
358 int image_pre_load(ulong addr)
362 image_load_offset = 0;
364 if (CONFIG_IS_ENABLED(IMAGE_PRE_LOAD_SIG))
365 ret = image_pre_load_sig(addr);