random-mirrors/smaeul-u-boot
1
0
Fork 0
mirror of https://github.com/smaeul/u-boot.git synced 2025-10-14 04:46:01 +01:00
Code Issues Packages Projects Releases Wiki Activity

arm: mach-k3: security: Allow signing bypass if type is HS-FS

Browse Source 
On HS-FS devices signing boot images is optional. To ease use
we check if we are HS-FS and if no certificate is attached
to the image we skip the authentication step with a warning
that this will fail when the device is set to security enforcing.

Signed-off-by: Andrew Davis <afd@ti.com>
This commit is contained in:
Andrew Davis 2022-07-15 11:34:33 -05:00 committed by Tom Rini
parent d1c079557f
commit e1ef04fb3e
1 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
arch/arm/mach-k3/security.c
View File

@ -2,10 +2,11 @@
/* /*
* K3: Security functions * K3: Security functions
* *
* Copyright (C) 2018 Texas Instruments Incorporated - http://www.ti.com/ * Copyright (C) 2018-2022 Texas Instruments Incorporated - http://www.ti.com/
* Andrew F. Davis <afd@ti.com> * Andrew F. Davis <afd@ti.com>
*/ */
#include <asm/io.h>
#include <common.h> #include <common.h>
#include <cpu_func.h> #include <cpu_func.h>
#include <dm.h> #include <dm.h>
@ -18,6 +19,17 @@
#include <spl.h> #include <spl.h>
#include <asm/arch/sys_proto.h> #include <asm/arch/sys_proto.h>
#include "common.h"
static bool ti_secure_cert_detected(void *p_image)
{
/* Primitive certificate detection, check for DER starting with
* two 4-Octet SEQUENCE tags
*/
return (((u8 *)p_image)[0] == 0x30 && ((u8 *)p_image)[1] == 0x82 &&
((u8 *)p_image)[4] == 0x30 && ((u8 *)p_image)[5] == 0x82);
}
void ti_secure_image_post_process(void **p_image, size_t *p_size) void ti_secure_image_post_process(void **p_image, size_t *p_size)
{ {
struct ti_sci_handle *ti_sci = get_ti_sci_handle(); struct ti_sci_handle *ti_sci = get_ti_sci_handle();
@ -29,6 +41,14 @@ void ti_secure_image_post_process(void **p_image, size_t *p_size)
image_addr = (uintptr_t)*p_image; image_addr = (uintptr_t)*p_image;
image_size = *p_size; image_size = *p_size;
if (get_device_type() != K3_DEVICE_TYPE_HS_SE &&
!ti_secure_cert_detected(*p_image)) {
printf("Warning: Did not detect image signing certificate. "
"Skipping authentication to prevent boot failure. "
"This will fail on Security Enforcing(HS-SE) devices\n");
return;
}
debug("Authenticating image at address 0x%016llx\n", image_addr); debug("Authenticating image at address 0x%016llx\n", image_addr);
debug("Authenticating image of size %d bytes\n", image_size); debug("Authenticating image of size %d bytes\n", image_size);