From 5c2c24ba151121ebb627195322fab3498f834b14 Mon Sep 17 00:00:00 2001 From: Claudio Carvalho Date: Sat, 9 Dec 2017 02:52:21 -0200 Subject: libstb/cvc.c: import softrom behavior from drivers/sw_driver.c Softrom is used only for testing with mambo. By setting compatible="ibm,secureboot-v1-softrom" in the "ibm,secureboot" node, firmware images can be properly measured even if the Container-Verification-Code (CVC) is not available. In this case, the mbedtls_sha512() function is used to calculate the sha512 hash of the firmware images. This imports the softrom behavior from libstb/drivers/sw_driver.c code into cvc.c, but now softrom is implemented as a flag. When the flag is set, the wrappers for the CVC services work the same way as in sw_driver.c. Signed-off-by: Claudio Carvalho Signed-off-by: Stewart Smith --- libstb/cvc.c | 16 ++++++++++++++++ libstb/secureboot.c | 5 ++++- libstb/secureboot.h | 1 + 3 files changed, 21 insertions(+), 1 deletion(-) (limited to 'libstb') diff --git a/libstb/cvc.c b/libstb/cvc.c index b0f5cd3..fd1f607 100644 --- a/libstb/cvc.c +++ b/libstb/cvc.c @@ -26,6 +26,7 @@ #include #include "secureboot.h" #include "cvc.h" +#include "mbedtls/sha512.h" /* * Assembly interfaces to call into the Container Verification Code. @@ -43,6 +44,7 @@ struct container_verification_code { }; static struct container_verification_code *cvc = NULL; +static bool softrom = false; static void *secure_rom_mem = NULL; struct cvc_service { @@ -194,6 +196,8 @@ int cvc_init(void) if (version == IBM_SECUREBOOT_V1 && proc_gen == proc_gen_p8) { rc = cvc_secure_rom_init(); + } else if (version == IBM_SECUREBOOT_SOFTROM) { + softrom = true; } else { prlog(PR_ERR, "%s FAILED. /ibm,secureboot not supported\n", __func__); @@ -214,6 +218,15 @@ int call_cvc_sha512(const uint8_t *data, size_t data_len, uint8_t *digest, return OPAL_SUCCESS; memset(digest, 0, SHA512_DIGEST_LENGTH); + if (softrom) { + mbedtls_sha512_context ctx; + mbedtls_sha512_init(&ctx); + mbedtls_sha512_starts(&ctx, 0); // SHA512 = 0 + mbedtls_sha512_update(&ctx, data, data_len); + mbedtls_sha512_finish(&ctx, digest); + mbedtls_sha512_free(&ctx); + return OPAL_SUCCESS; + } service = cvc_find_service(CVC_SHA512_SERVICE); @@ -239,6 +252,9 @@ int call_cvc_verify(void *container, size_t len, const void *hw_key_hash, !hw_key_hash || hw_key_hash_size <= 0) return OPAL_PARAMETER; + if (softrom) + return OPAL_UNSUPPORTED; + service = cvc_find_service(CVC_VERIFY_SERVICE); if (!service) diff --git a/libstb/secureboot.c b/libstb/secureboot.c index 2787951..953b123 100644 --- a/libstb/secureboot.c +++ b/libstb/secureboot.c @@ -34,6 +34,7 @@ static struct { const char *compat; } secureboot_map[] = { { IBM_SECUREBOOT_V1, "ibm,secureboot-v1" }, + { IBM_SECUREBOOT_SOFTROM, "ibm,secureboot-v1-softrom" }, }; static void secureboot_enforce(void) @@ -112,7 +113,9 @@ void secureboot_init(void) if (!secure_mode) return; - if (version == IBM_SECUREBOOT_V1) { + if (version == IBM_SECUREBOOT_V1 || + version == IBM_SECUREBOOT_SOFTROM) { + hash_algo = dt_prop_get(node, "hash-algo"); if (strcmp(hash_algo, "sha512")) { /** diff --git a/libstb/secureboot.h b/libstb/secureboot.h index ea97ed7..8506ea0 100644 --- a/libstb/secureboot.h +++ b/libstb/secureboot.h @@ -24,6 +24,7 @@ enum secureboot_version { IBM_SECUREBOOT_V1, + IBM_SECUREBOOT_SOFTROM, }; bool secureboot_is_compatible(struct dt_node *node, int *version, const char **compat); -- cgit v1.1