diff options
| author | Andrew Davis <afd@ti.com> | 2022-07-15 11:34:33 -0500 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2022-08-04 15:32:20 -0400 |
| commit | e1ef04fb3e3a1eb417700e34510714be0277bee9 (patch) | |
| tree | f9d6a38af4ed7c29afdf9cedffae294c9d0ece6f | |
| parent | d1c079557fe3098da02ba92bb4e4d382e6f9b12a (diff) | |
| download | u-boot-e1ef04fb3e3a1eb417700e34510714be0277bee9.zip u-boot-e1ef04fb3e3a1eb417700e34510714be0277bee9.tar.gz u-boot-e1ef04fb3e3a1eb417700e34510714be0277bee9.tar.bz2 | |
arm: mach-k3: security: Allow signing bypass if type is HS-FS
On HS-FS devices signing boot images is optional. To ease use
we check if we are HS-FS and if no certificate is attached
to the image we skip the authentication step with a warning
that this will fail when the device is set to security enforcing.
Signed-off-by: Andrew Davis <afd@ti.com>
| -rw-r--r-- | arch/arm/mach-k3/security.c | 22 |
1 files changed, 21 insertions, 1 deletions
diff --git a/arch/arm/mach-k3/security.c b/arch/arm/mach-k3/security.c index 8de9739..5bfcecd 100644 --- a/arch/arm/mach-k3/security.c +++ b/arch/arm/mach-k3/security.c @@ -2,10 +2,11 @@ /* * K3: Security functions * - * Copyright (C) 2018 Texas Instruments Incorporated - http://www.ti.com/ + * Copyright (C) 2018-2022 Texas Instruments Incorporated - http://www.ti.com/ * Andrew F. Davis <afd@ti.com> */ +#include <asm/io.h> #include <common.h> #include <cpu_func.h> #include <dm.h> @@ -18,6 +19,17 @@ #include <spl.h> #include <asm/arch/sys_proto.h> +#include "common.h" + +static bool ti_secure_cert_detected(void *p_image) +{ + /* Primitive certificate detection, check for DER starting with + * two 4-Octet SEQUENCE tags + */ + return (((u8 *)p_image)[0] == 0x30 && ((u8 *)p_image)[1] == 0x82 && + ((u8 *)p_image)[4] == 0x30 && ((u8 *)p_image)[5] == 0x82); +} + void ti_secure_image_post_process(void **p_image, size_t *p_size) { struct ti_sci_handle *ti_sci = get_ti_sci_handle(); @@ -29,6 +41,14 @@ void ti_secure_image_post_process(void **p_image, size_t *p_size) image_addr = (uintptr_t)*p_image; image_size = *p_size; + if (get_device_type() != K3_DEVICE_TYPE_HS_SE && + !ti_secure_cert_detected(*p_image)) { + printf("Warning: Did not detect image signing certificate. " + "Skipping authentication to prevent boot failure. " + "This will fail on Security Enforcing(HS-SE) devices\n"); + return; + } + debug("Authenticating image at address 0x%016llx\n", image_addr); debug("Authenticating image of size %d bytes\n", image_size); |