fsl_validate.h 6.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283
  1. /* SPDX-License-Identifier: GPL-2.0+ */
  2. /*
  3. * Copyright 2015 Freescale Semiconductor, Inc.
  4. */
  5. #ifndef _FSL_VALIDATE_H_
  6. #define _FSL_VALIDATE_H_
  7. #include <fsl_sec.h>
  8. #include <fsl_sec_mon.h>
  9. #include <linux/types.h>
  10. struct cmd_tbl;
  11. #define WORD_SIZE 4
  12. /* Minimum and maximum size of RSA signature length in bits */
  13. #define KEY_SIZE 4096
  14. #define KEY_SIZE_BYTES (KEY_SIZE/8)
  15. #define KEY_SIZE_WORDS (KEY_SIZE_BYTES/(WORD_SIZE))
  16. extern struct jobring jr;
  17. /* Barker code size in bytes */
  18. #define ESBC_BARKER_LEN 4 /* barker code length in ESBC uboot client */
  19. /* header */
  20. /* No-error return values */
  21. #define ESBC_VALID_HDR 0 /* header is valid */
  22. /* Maximum number of SG entries allowed */
  23. #define MAX_SG_ENTRIES 8
  24. /* Different Header Struct for LS-CH3 */
  25. #ifdef CONFIG_ESBC_HDR_LS
  26. struct fsl_secboot_img_hdr {
  27. u8 barker[ESBC_BARKER_LEN]; /* barker code */
  28. u32 srk_tbl_off;
  29. struct {
  30. u8 num_srk;
  31. u8 srk_sel;
  32. u8 reserve;
  33. } len_kr;
  34. u8 ie_flag;
  35. u32 uid_flag;
  36. u32 psign; /* signature offset */
  37. u32 sign_len; /* length of the signature in bytes */
  38. u64 pimg64; /* 64 bit pointer to ESBC Image */
  39. u32 img_size; /* ESBC client image size in bytes */
  40. u32 ie_key_sel;
  41. u32 fsl_uid_0;
  42. u32 fsl_uid_1;
  43. u32 oem_uid_0;
  44. u32 oem_uid_1;
  45. u32 oem_uid_2;
  46. u32 oem_uid_3;
  47. u32 oem_uid_4;
  48. u32 reserved1[3];
  49. };
  50. #ifdef CONFIG_KEY_REVOCATION
  51. /* Srk table and key revocation check */
  52. #define UNREVOCABLE_KEY 8
  53. #define ALIGN_REVOC_KEY 7
  54. #define MAX_KEY_ENTRIES 8
  55. #endif
  56. #if defined(CONFIG_FSL_ISBC_KEY_EXT)
  57. #define IE_FLAG_MASK 0x1
  58. #define SCRATCH_IE_LOW_ADR 13
  59. #define SCRATCH_IE_HIGH_ADR 14
  60. #endif
  61. #else /* CONFIG_ESBC_HDR_LS */
  62. /*
  63. * ESBC uboot client header structure.
  64. * The struct contain the following fields
  65. * barker code
  66. * public key offset
  67. * pub key length
  68. * signature offset
  69. * length of the signature
  70. * ptr to SG table
  71. * no of entries in SG table
  72. * esbc ptr
  73. * size of esbc
  74. * esbc entry point
  75. * Scatter gather flag
  76. * UID flag
  77. * FSL UID
  78. * OEM UID
  79. * Here, pub key is modulus concatenated with exponent
  80. * of equal length
  81. */
  82. struct fsl_secboot_img_hdr {
  83. u8 barker[ESBC_BARKER_LEN]; /* barker code */
  84. union {
  85. u32 pkey; /* public key offset */
  86. #ifdef CONFIG_KEY_REVOCATION
  87. u32 srk_tbl_off;
  88. #endif
  89. };
  90. union {
  91. u32 key_len; /* pub key length in bytes */
  92. #ifdef CONFIG_KEY_REVOCATION
  93. struct {
  94. u32 srk_table_flag:8;
  95. u32 srk_sel:8;
  96. u32 num_srk:16;
  97. } len_kr;
  98. #endif
  99. };
  100. u32 psign; /* signature offset */
  101. u32 sign_len; /* length of the signature in bytes */
  102. union {
  103. u32 psgtable; /* ptr to SG table */
  104. #ifndef CONFIG_ESBC_ADDR_64BIT
  105. u32 pimg; /* ptr to ESBC client image */
  106. #endif
  107. };
  108. union {
  109. u32 sg_entries; /* no of entries in SG table */
  110. u32 img_size; /* ESBC client image size in bytes */
  111. };
  112. u32 img_start; /* ESBC client entry point */
  113. u32 sg_flag; /* Scatter gather flag */
  114. u32 uid_flag;
  115. u32 fsl_uid_0;
  116. u32 oem_uid_0;
  117. u32 reserved1[2];
  118. u32 fsl_uid_1;
  119. u32 oem_uid_1;
  120. union {
  121. u32 reserved2[2];
  122. #ifdef CONFIG_ESBC_ADDR_64BIT
  123. u64 pimg64; /* 64 bit pointer to ESBC Image */
  124. #endif
  125. };
  126. u32 ie_flag;
  127. u32 ie_key_sel;
  128. };
  129. #ifdef CONFIG_KEY_REVOCATION
  130. /* Srk table and key revocation check */
  131. #define SRK_FLAG 0x01
  132. #define UNREVOCABLE_KEY 4
  133. #define ALIGN_REVOC_KEY 3
  134. #define MAX_KEY_ENTRIES 4
  135. #endif
  136. #if defined(CONFIG_FSL_ISBC_KEY_EXT)
  137. #define IE_FLAG_MASK 0xFFFFFFFF
  138. #endif
  139. #endif /* CONFIG_ESBC_HDR_LS */
  140. #if defined(CONFIG_FSL_ISBC_KEY_EXT)
  141. struct ie_key_table {
  142. u32 key_len;
  143. u8 pkey[2 * KEY_SIZE_BYTES];
  144. };
  145. struct ie_key_info {
  146. uint32_t key_revok;
  147. uint32_t num_keys;
  148. struct ie_key_table ie_key_tbl[32];
  149. };
  150. #endif
  151. #ifdef CONFIG_KEY_REVOCATION
  152. struct srk_table {
  153. u32 key_len;
  154. u8 pkey[2 * KEY_SIZE_BYTES];
  155. };
  156. #endif
  157. /*
  158. * SG table.
  159. */
  160. #if defined(CONFIG_FSL_TRUST_ARCH_v1) && defined(CONFIG_FSL_CORENET)
  161. /*
  162. * This struct contains the following fields
  163. * length of the segment
  164. * source address
  165. */
  166. struct fsl_secboot_sg_table {
  167. u32 len; /* length of the segment in bytes */
  168. u32 src_addr; /* ptr to the data segment */
  169. };
  170. #else
  171. /*
  172. * This struct contains the following fields
  173. * length of the segment
  174. * Destination Target ID
  175. * source address
  176. * destination address
  177. */
  178. struct fsl_secboot_sg_table {
  179. u32 len;
  180. u32 trgt_id;
  181. u32 src_addr;
  182. u32 dst_addr;
  183. };
  184. #endif
  185. /* ESBC global structure.
  186. * Data to be used across verification of different images.
  187. * Stores following Data:
  188. * IE Table
  189. */
  190. struct fsl_secboot_glb {
  191. #if defined(CONFIG_FSL_ISBC_KEY_EXT)
  192. uintptr_t ie_addr;
  193. struct ie_key_info ie_tbl;
  194. #endif
  195. };
  196. /*
  197. * ESBC private structure.
  198. * Private structure used by ESBC to store following fields
  199. * ESBC client key
  200. * ESBC client key hash
  201. * ESBC client Signature
  202. * Encoded hash recovered from signature
  203. * Encoded hash of ESBC client header plus ESBC client image
  204. */
  205. struct fsl_secboot_img_priv {
  206. uint32_t hdr_location;
  207. uintptr_t ie_addr;
  208. u32 key_len;
  209. struct fsl_secboot_img_hdr hdr;
  210. u8 img_key[2 * KEY_SIZE_BYTES]; /* ESBC client key */
  211. u8 img_key_hash[32]; /* ESBC client key hash */
  212. #ifdef CONFIG_KEY_REVOCATION
  213. struct srk_table srk_tbl[MAX_KEY_ENTRIES];
  214. #endif
  215. u8 img_sign[KEY_SIZE_BYTES]; /* ESBC client signature */
  216. u8 img_encoded_hash[KEY_SIZE_BYTES]; /* EM wrt RSA PKCSv1.5 */
  217. /* Includes hash recovered after
  218. * signature verification
  219. */
  220. u8 img_encoded_hash_second[KEY_SIZE_BYTES];/* EM' wrt RSA PKCSv1.5 */
  221. /* Includes hash of
  222. * ESBC client header plus
  223. * ESBC client image
  224. */
  225. struct fsl_secboot_sg_table sgtbl[MAX_SG_ENTRIES]; /* SG table */
  226. uintptr_t ehdrloc; /* ESBC Header location */
  227. uintptr_t *img_addr_ptr; /* ESBC Image Location */
  228. uint32_t img_size; /* ESBC Image Size */
  229. };
  230. int do_esbc_halt(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]);
  231. int fsl_secboot_validate(uintptr_t haddr, char *arg_hash_str,
  232. uintptr_t *img_addr_ptr);
  233. int fsl_secboot_blob_encap(struct cmd_tbl *cmdtp, int flag, int argc,
  234. char *const argv[]);
  235. int fsl_secboot_blob_decap(struct cmd_tbl *cmdtp, int flag, int argc,
  236. char *const argv[]);
  237. int fsl_check_boot_mode_secure(void);
  238. int fsl_setenv_chain_of_trust(void);
  239. /*
  240. * This function is used to validate the main U-boot binary from
  241. * SPL just before passing control to it using QorIQ Trust
  242. * Architecture header (appended to U-boot image).
  243. */
  244. void spl_validate_uboot(uint32_t hdr_addr, uintptr_t img_addr);
  245. #endif