secure_vab.c 5.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * Copyright (C) 2020 Intel Corporation <www.intel.com>
  4. *
  5. */
  6. #include <asm/arch/mailbox_s10.h>
  7. #include <asm/arch/secure_vab.h>
  8. #include <asm/arch/smc_api.h>
  9. #include <asm/unaligned.h>
  10. #include <common.h>
  11. #include <exports.h>
  12. #include <linux/errno.h>
  13. #include <linux/intel-smc.h>
  14. #include <log.h>
  15. #define CHUNKSZ_PER_WD_RESET (256 * SZ_1K)
  16. /*
  17. * Read the length of the VAB certificate from the end of image
  18. * and calculate the actual image size (excluding the VAB certificate).
  19. */
  20. static size_t get_img_size(u8 *img_buf, size_t img_buf_sz)
  21. {
  22. u8 *img_buf_end = img_buf + img_buf_sz;
  23. u32 cert_sz = get_unaligned_le32(img_buf_end - sizeof(u32));
  24. u8 *p = img_buf_end - cert_sz - sizeof(u32);
  25. /* Ensure p is pointing within the img_buf */
  26. if (p < img_buf || p > (img_buf_end - VAB_CERT_HEADER_SIZE))
  27. return 0;
  28. if (get_unaligned_le32(p) == SDM_CERT_MAGIC_NUM)
  29. return (size_t)(p - img_buf);
  30. return 0;
  31. }
  32. /*
  33. * Vendor Authorized Boot (VAB) is a security feature for authenticating
  34. * the images such as U-Boot, ARM trusted Firmware, Linux kernel,
  35. * device tree blob and etc loaded from FIT. User can also trigger
  36. * the VAB authentication from U-Boot command.
  37. *
  38. * This function extracts the VAB certificate and signature block
  39. * appended at the end of the image, then send to Secure Device Manager
  40. * (SDM) for authentication. This function will validate the SHA384
  41. * of the image against the SHA384 hash stored in the VAB certificate
  42. * before sending the VAB certificate to SDM for authentication.
  43. *
  44. * RETURN
  45. * 0 if authentication success or
  46. * if authentication is not required and bypassed on a non-secure device
  47. * negative error code if authentication fail
  48. */
  49. int socfpga_vendor_authentication(void **p_image, size_t *p_size)
  50. {
  51. int retry_count = 20;
  52. u8 hash384[SHA384_SUM_LEN];
  53. u64 img_addr, mbox_data_addr;
  54. size_t img_sz, mbox_data_sz;
  55. u8 *cert_hash_ptr, *mbox_relocate_data_addr;
  56. u32 resp = 0, resp_len = 1;
  57. int ret;
  58. img_addr = (uintptr_t)*p_image;
  59. debug("Authenticating image at address 0x%016llx (%ld bytes)\n",
  60. img_addr, *p_size);
  61. img_sz = get_img_size((u8 *)img_addr, *p_size);
  62. debug("img_sz = %ld\n", img_sz);
  63. if (!img_sz) {
  64. puts("VAB certificate not found in image!\n");
  65. return -ENOKEY;
  66. }
  67. if (!IS_ALIGNED(img_sz, sizeof(u32))) {
  68. printf("Image size (%ld bytes) not aliged to 4 bytes!\n",
  69. img_sz);
  70. return -EBFONT;
  71. }
  72. /* Generate HASH384 from the image */
  73. sha384_csum_wd((u8 *)img_addr, img_sz, hash384, CHUNKSZ_PER_WD_RESET);
  74. cert_hash_ptr = (u8 *)(img_addr + img_sz + VAB_CERT_MAGIC_OFFSET +
  75. VAB_CERT_FIT_SHA384_OFFSET);
  76. /*
  77. * Compare the SHA384 found in certificate against the SHA384
  78. * calculated from image
  79. */
  80. if (memcmp(hash384, cert_hash_ptr, SHA384_SUM_LEN)) {
  81. puts("SHA384 not match!\n");
  82. return -EKEYREJECTED;
  83. }
  84. mbox_data_addr = img_addr + img_sz - sizeof(u32);
  85. /* Size in word (32bits) */
  86. mbox_data_sz = (ALIGN(*p_size - img_sz, sizeof(u32))) >> 2;
  87. debug("mbox_data_addr = 0x%016llx\n", mbox_data_addr);
  88. debug("mbox_data_sz = %ld words\n", mbox_data_sz);
  89. /*
  90. * Relocate certificate to first memory block before trigger SMC call
  91. * to send mailbox command because ATF only able to access first
  92. * memory block.
  93. */
  94. mbox_relocate_data_addr = (u8 *)malloc(mbox_data_sz * sizeof(u32));
  95. if (!mbox_relocate_data_addr) {
  96. puts("Out of memory for VAB certificate relocation!\n");
  97. return -ENOMEM;
  98. }
  99. memcpy(mbox_relocate_data_addr, (u8 *)mbox_data_addr, mbox_data_sz * sizeof(u32));
  100. *(u32 *)mbox_relocate_data_addr = 0;
  101. debug("mbox_relocate_data_addr = 0x%p\n", mbox_relocate_data_addr);
  102. do {
  103. if (!IS_ENABLED(CONFIG_SPL_BUILD) && IS_ENABLED(CONFIG_SPL_ATF)) {
  104. /* Invoke SMC call to ATF to send the VAB certificate to SDM */
  105. ret = smc_send_mailbox(MBOX_VAB_SRC_CERT, mbox_data_sz,
  106. (u32 *)mbox_relocate_data_addr, 0, &resp_len,
  107. &resp);
  108. } else {
  109. /* Send the VAB certficate to SDM for authentication */
  110. ret = mbox_send_cmd(MBOX_ID_UBOOT, MBOX_VAB_SRC_CERT,
  111. MBOX_CMD_DIRECT, mbox_data_sz,
  112. (u32 *)mbox_relocate_data_addr, 0, &resp_len,
  113. &resp);
  114. }
  115. /* If SDM is not available, just delay 50ms and retry again */
  116. if (ret == MBOX_RESP_DEVICE_BUSY)
  117. mdelay(50);
  118. else
  119. break;
  120. } while (--retry_count);
  121. /* Free the relocate certificate memory space */
  122. free(mbox_relocate_data_addr);
  123. /* Exclude the size of the VAB certificate from image size */
  124. *p_size = img_sz;
  125. debug("ret = 0x%08x, resp = 0x%08x, resp_len = %d\n", ret, resp,
  126. resp_len);
  127. if (ret) {
  128. /*
  129. * Unsupported mailbox command or device not in the
  130. * owned/secure state
  131. */
  132. if (ret == MBOX_RESP_NOT_ALLOWED_UNDER_SECURITY_SETTINGS) {
  133. /* SDM bypass authentication */
  134. printf("%s 0x%016llx (%ld bytes)\n",
  135. "Image Authentication bypassed at address",
  136. img_addr, img_sz);
  137. return 0;
  138. }
  139. puts("VAB certificate authentication failed in SDM");
  140. if (ret == MBOX_RESP_DEVICE_BUSY) {
  141. puts(" (SDM busy timeout)\n");
  142. return -ETIMEDOUT;
  143. } else if (ret == MBOX_RESP_UNKNOWN) {
  144. puts(" (Not supported)\n");
  145. return -ESRCH;
  146. }
  147. puts("\n");
  148. return -EKEYREJECTED;
  149. } else {
  150. /* If Certificate Process Status has error */
  151. if (resp) {
  152. puts("VAB certificate process failed\n");
  153. return -ENOEXEC;
  154. }
  155. }
  156. printf("%s 0x%016llx (%ld bytes)\n",
  157. "Image Authentication passed at address", img_addr, img_sz);
  158. return 0;
  159. }