1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * STM32MP ECDSA verification via the ROM API
4 *
5 * Implements ECDSA signature verification via the STM32MP ROM.
6 */
7 #include <asm/system.h>
8 #include <dm/device.h>
9 #include <linux/types.h>
10 #include <u-boot/ecdsa.h>
11 #include <crypto/ecdsa-uclass.h>
12 #include <linux/libfdt.h>
13 #include <dm/platdata.h>
14
15 #define ROM_API_SUCCESS 0x77
16 #define ROM_API_ECDSA_ALGO_PRIME_256V1 1
17 #define ROM_API_ECDSA_ALGO_BRAINPOOL_256 2
18
19 #define ROM_API_OFFSET_ECDSA_VERIFY 0x60
20
21 struct ecdsa_rom_api {
22 uint32_t (*ecdsa_verify_signature)(const void *hash, const void *pubkey,
23 const void *signature,
24 uint32_t ecc_algo);
25 };
26
27 /*
28 * Without forcing the ".data" section, this would get saved in ".bss". BSS
29 * will be cleared soon after, so it's not suitable.
30 */
31 static uintptr_t rom_api_loc __section(".data");
32
33 /*
34 * The ROM gives us the API location in r0 when starting. This is only available
35 * during SPL, as there isn't (yet) a mechanism to pass this on to u-boot.
36 */
save_boot_params(unsigned long r0,unsigned long r1,unsigned long r2,unsigned long r3)37 void save_boot_params(unsigned long r0, unsigned long r1, unsigned long r2,
38 unsigned long r3)
39 {
40 rom_api_loc = r0;
41 save_boot_params_ret();
42 }
43
stm32mp_rom_get_ecdsa_functions(struct ecdsa_rom_api * rom)44 static void stm32mp_rom_get_ecdsa_functions(struct ecdsa_rom_api *rom)
45 {
46 uintptr_t verify_ptr = rom_api_loc + ROM_API_OFFSET_ECDSA_VERIFY;
47
48 rom->ecdsa_verify_signature = *(void **)verify_ptr;
49 }
50
ecdsa_key_algo(const char * curve_name)51 static int ecdsa_key_algo(const char *curve_name)
52 {
53 if (!strcmp(curve_name, "prime256v1"))
54 return ROM_API_ECDSA_ALGO_PRIME_256V1;
55 else if (!strcmp(curve_name, "brainpool256"))
56 return ROM_API_ECDSA_ALGO_BRAINPOOL_256;
57 else
58 return -ENOPROTOOPT;
59 }
60
romapi_ecdsa_verify(struct udevice * dev,const struct ecdsa_public_key * pubkey,const void * hash,size_t hash_len,const void * signature,size_t sig_len)61 static int romapi_ecdsa_verify(struct udevice *dev,
62 const struct ecdsa_public_key *pubkey,
63 const void *hash, size_t hash_len,
64 const void *signature, size_t sig_len)
65 {
66 struct ecdsa_rom_api rom;
67 uint8_t raw_key[64];
68 uint32_t rom_ret;
69 int algo;
70
71 /* The ROM API can only handle 256-bit ECDSA keys. */
72 if (sig_len != 64 || hash_len != 32 || pubkey->size_bits != 256)
73 return -EINVAL;
74
75 algo = ecdsa_key_algo(pubkey->curve_name);
76 if (algo < 0)
77 return algo;
78
79 /* The ROM API wants the (X, Y) coordinates concatenated. */
80 memcpy(raw_key, pubkey->x, 32);
81 memcpy(raw_key + 32, pubkey->y, 32);
82
83 stm32mp_rom_get_ecdsa_functions(&rom);
84 rom_ret = rom.ecdsa_verify_signature(hash, raw_key, signature, algo);
85
86 return rom_ret == ROM_API_SUCCESS ? 0 : -EPERM;
87 }
88
89 static const struct ecdsa_ops rom_api_ops = {
90 .verify = romapi_ecdsa_verify,
91 };
92
93 U_BOOT_DRIVER(stm32mp_rom_api_ecdsa) = {
94 .name = "stm32mp_rom_api_ecdsa",
95 .id = UCLASS_ECDSA,
96 .ops = &rom_api_ops,
97 .flags = DM_FLAG_PRE_RELOC,
98 };
99
100 U_BOOT_DRVINFO(stm32mp_rom_api_ecdsa) = {
101 .name = "stm32mp_rom_api_ecdsa",
102 };
103