[U-Boot] [PATCH] arm: am33xx: security: adds auth support for encrypted images

[U-Boot] [PATCH] arm: am33xx: security: adds auth support for encrypted images

[Andrew F. Davis]

From: Madan Srinivas <madans@ti.com>

This patch adds support for authentication of both plain
text and encrypted binaries. A new SECDEV package is needed
to enable encryption of binaries by default for AM3x.

The ROM authentication API detects encrypted images at
runtime and automatically decrypts the image if the
signature verification passes.

Addition of encryption on AM3x results in a change in the
image format. On AM4x, AM5x and, on AM3x devices signing
clear test images, the signature is appended to the end of the
binary.

On AM3x, when the SECDEV package is used to create signed
and encrypted images, the signature is added as a header
to the start of the binary. So the binary size calculation
has been updated to reflect this change.

The signing tools and encrypted image format for AM3x
cannot be changed to behave like AM4x and AM5x to
maintain backward compatibility with older Sitara
M-Shield releases.

Signed-off-by: Madan Srinivas <madans@ti.com>
Signed-off-by: Andrew F. Davis <afd@ti.com>
---
 arch/arm/mach-omap2/sec-common.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/arm/mach-omap2/sec-common.c b/arch/arm/mach-omap2/sec-common.c
index 52e1785b4a..2630e7d316 100644
--- a/arch/arm/mach-omap2/sec-common.c
+++ b/arch/arm/mach-omap2/sec-common.c
@@ -41,6 +41,9 @@
 #define PPA_SERV_HAL_SETUP_EMIF_FW_REGION   (PPA_HAL_SERVICES_START_INDEX + 26)
 #define PPA_SERV_HAL_LOCK_EMIF_FW           (PPA_HAL_SERVICES_START_INDEX + 27)
 
+/* Offset of header size if image is signed as ISW */
+#define HEADER_SIZE_OFFSET	(0x6D)
+
 int tee_loaded = 0;
 
 /* Argument for PPA_SERV_HAL_TEE_LOAD_MASTER */
@@ -125,6 +128,9 @@ int secure_boot_verify_image(void **image, size_t *size)
 	}
 
 	*size = sig_addr - cert_addr;	/* Subtract out the signature size */
+	/* Subtract header if present */
+	if (strncmp((char *)sig_addr, "CERT_ISW_", 9) == 0)
+		*size = ((u32 *)*image)[HEADER_SIZE_OFFSET];
 	cert_size = *size;
 
 	/* Check if image load address is 32-bit aligned */
-- 
2.14.1

[U-Boot] arm: am33xx: security: adds auth support for encrypted images

[Tom Rini]

On Wed, Sep 20, 2017 at 02:37:36PM -0500, Andrew F. Davis wrote:

> From: Madan Srinivas <madans@ti.com>
> 
> This patch adds support for authentication of both plain
> text and encrypted binaries. A new SECDEV package is needed
> to enable encryption of binaries by default for AM3x.
> 
> The ROM authentication API detects encrypted images at
> runtime and automatically decrypts the image if the
> signature verification passes.
> 
> Addition of encryption on AM3x results in a change in the
> image format. On AM4x, AM5x and, on AM3x devices signing
> clear test images, the signature is appended to the end of the
> binary.
> 
> On AM3x, when the SECDEV package is used to create signed
> and encrypted images, the signature is added as a header
> to the start of the binary. So the binary size calculation
> has been updated to reflect this change.
> 
> The signing tools and encrypted image format for AM3x
> cannot be changed to behave like AM4x and AM5x to
> maintain backward compatibility with older Sitara
> M-Shield releases.
> 
> Signed-off-by: Madan Srinivas <madans@ti.com>
> Signed-off-by: Andrew F. Davis <afd@ti.com>

Applied to u-boot/master, thanks!

-- 
Tom
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: Digital signature
URL: <http://lists.denx.de/pipermail/u-boot/attachments/20170929/9739878f/attachment.sig>