mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Marco Felsch <m.felsch@pengutronix.de>
To: Sascha Hauer <s.hauer@pengutronix.de>
Cc: "open list:BAREBOX" <barebox@lists.infradead.org>
Subject: Re: [PATCH 11/13] ARM: k3: r5: Allow to authenticate next image by ROM API
Date: Mon, 10 Mar 2025 20:26:01 +0100	[thread overview]
Message-ID: <20250310192601.7nzsencbk3borvqm@pengutronix.de> (raw)
In-Reply-To: <20250228-am625-secure-v1-11-4002488ff5ed@pengutronix.de>

On 25-02-28, Sascha Hauer wrote:
> This adds the Kconfig option CONFIG_ARCH_K3_AUTHENTICATE_IMAGE. When
> enabled, the full barebox image will only be started when it can be
> authenticated using the ROM API.
> 
> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
> ---
>  arch/arm/mach-k3/Kconfig |  7 ++++++
>  arch/arm/mach-k3/r5.c    | 64 +++++++++++++++++++++++++++++++++++++++++++++++-
>  2 files changed, 70 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/arm/mach-k3/Kconfig b/arch/arm/mach-k3/Kconfig
> index 37d5155577..e93e3154c8 100644
> --- a/arch/arm/mach-k3/Kconfig
> +++ b/arch/arm/mach-k3/Kconfig
> @@ -37,6 +37,13 @@ config MACH_BEAGLEPLAY
>  	help
>  	  Say Y here if you are using a TI AM62x based BeaglePlay board
>  
> +config ARCH_K3_AUTHENTICATE_IMAGE
> +	bool "Force authentication of FIP image against ROM API"
> +	help
> +	  By enabling this option the FIP image loaded by the first stage
> +	  will be authenticated against the K3 ROM API. Images which fail
> +	  to authenticate will not be started.

The ROM is checking only the sha sum or does the ROM also have some kind
of signature-checking (pub/priv keys requried)?

Regards,
  Marco


> +
>  config ARCH_K3_COMMAND_AUTHENTICATE
>  	bool "k3_authenticate_image command"
>  	depends on COMMAND_SUPPORT
> diff --git a/arch/arm/mach-k3/r5.c b/arch/arm/mach-k3/r5.c
> index c8a91e2597..d0093a3be7 100644
> --- a/arch/arm/mach-k3/r5.c
> +++ b/arch/arm/mach-k3/r5.c
> @@ -244,6 +244,64 @@ static uuid_t uuid_ti_dm_fw = UUID_TI_DM_FW;
>  static uuid_t uuid_bl33 = UUID_NON_TRUSTED_FIRMWARE_BL33;
>  static uuid_t uuid_bl32 = UUID_SECURE_PAYLOAD_BL32;
>  
> +static struct fip_state *fip_image_load_auth(const char *filename, size_t offset)
> +{
> +	struct fip_state *fip = NULL;
> +	int fd;
> +	unsigned int maxsize = SZ_4M;
> +	size_t size;
> +	void *buf = NULL;
> +	int ret;
> +
> +	fd = open(filename, O_RDONLY);
> +	if (fd < 0)
> +		return ERR_PTR(-errno);
> +
> +	if (offset) {
> +		loff_t pos;
> +		pos = lseek(fd, offset, SEEK_SET);
> +		if (pos < 0) {
> +			ret = -errno;
> +			goto err;
> +		}
> +	}
> +
> +	buf = xzalloc(maxsize);
> +
> +	/*
> +	 * There is no easy way to determine the size of the certificates the ROM
> +	 * takes as images, so the best we can do here is to assume a maximum size
> +	 * and load this.
> +	 */
> +	ret = read_full(fd, buf, maxsize);
> +	if (ret < 0)
> +		goto err;
> +
> +	size = maxsize;
> +
> +	ret = k3_authenticate_image(&buf, &size);
> +	if (ret) {
> +		pr_err("Failed to authenticate %s\n", filename);
> +		goto err;
> +	}
> +
> +	fip = fip_new();
> +	ret = fip_parse_buf(fip, buf, size, NULL);
> +	if (ret)
> +		goto err;
> +
> +	close(fd);
> +
> +	return fip;
> +err:
> +	if (fip)
> +		fip_free(fip);
> +	close(fd);
> +	free(buf);
> +
> +	return ERR_PTR(ret);
> +}
> +
>  static int load_fip(const char *filename, off_t offset)
>  {
>  	struct fip_state *fip;
> @@ -251,7 +309,11 @@ static int load_fip(const char *filename, off_t offset)
>  	unsigned char shasum[SHA256_DIGEST_SIZE];
>  	int ret;
>  
> -	fip = fip_image_open(filename, offset);
> +	if (IS_ENABLED(CONFIG_ARCH_K3_AUTHENTICATE_IMAGE))
> +		fip = fip_image_load_auth(filename, offset);
> +	else
> +		fip = fip_image_open(filename, offset);
> +
>  	if (IS_ERR(fip)) {
>  		pr_err("Cannot open FIP image: %pe\n", fip);
>  		return PTR_ERR(fip);
> 
> -- 
> 2.39.5
> 
> 
> 



  reply	other threads:[~2025-03-10 19:27 UTC|newest]

Thread overview: 28+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-02-28  7:16 [PATCH 00/13] am625: support secure loading of full barebox Sascha Hauer
2025-02-28  7:16 ` [PATCH 01/13] firmware: always generate sha256sum Sascha Hauer
2025-02-28  7:16 ` [PATCH 02/13] firmware: add function to verify next image Sascha Hauer
2025-03-10 18:37   ` Marco Felsch
2025-03-11  7:35     ` Sascha Hauer
2025-02-28  7:16 ` [PATCH 03/13] ARM: k3: r5: drop loading of separate binaries Sascha Hauer
2025-03-10 18:44   ` Marco Felsch
2025-02-28  7:16 ` [PATCH 04/13] ARM: k3: r5: add proper error handling Sascha Hauer
2025-03-10 18:52   ` Marco Felsch
2025-03-11  8:24     ` Sascha Hauer
2025-03-11  8:50       ` Marco Felsch
2025-02-28  7:16 ` [PATCH 05/13] fip: rework fip_image_open() Sascha Hauer
2025-02-28  7:16 ` [PATCH 06/13] fip: fix wrong function call Sascha Hauer
2025-02-28  7:16 ` [PATCH 07/13] fip: add function to calculate a sha256 over FIP image Sascha Hauer
2025-02-28  7:16 ` [PATCH 08/13] ARM: am625: support hash verification of full barebox Sascha Hauer
2025-03-10 19:22   ` Marco Felsch
2025-03-11  7:53     ` Sascha Hauer
2025-02-28  7:16 ` [PATCH 09/13] ARM: k3: add support for authenticating images against the ROM API Sascha Hauer
2025-02-28  7:16 ` [PATCH 10/13] ARM: k3: r5: delete fip image when it can't be opened Sascha Hauer
2025-02-28  7:16 ` [PATCH 11/13] ARM: k3: r5: Allow to authenticate next image by ROM API Sascha Hauer
2025-03-10 19:26   ` Marco Felsch [this message]
2025-03-11  7:54     ` Sascha Hauer
2025-02-28  7:17 ` [PATCH 12/13] scripts/k3img: remove temporary files Sascha Hauer
2025-02-28  7:17 ` [PATCH 13/13] scripts: add k3sign Sascha Hauer
2025-03-10 17:40 ` [PATCH 00/13] am625: support secure loading of full barebox Marco Felsch
2025-03-11  8:12   ` Sascha Hauer
2025-03-11  8:48     ` Marco Felsch
2025-03-11  9:13       ` Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250310192601.7nzsencbk3borvqm@pengutronix.de \
    --to=m.felsch@pengutronix.de \
    --cc=barebox@lists.infradead.org \
    --cc=s.hauer@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox