1// SPDX-License-Identifier: GPL-2.0+
2/*
3 * STM32MP ECDSA verification via the ROM API
4 *
5 * Implements ECDSA signature verification via the STM32MP ROM.
6 */
7#include <asm/system.h>
8#include <asm/arch/sys_proto.h>
9#include <dm/device.h>
10#include <linux/types.h>
11#include <u-boot/ecdsa.h>
12#include <crypto/ecdsa-uclass.h>
13#include <linux/libfdt.h>
14#include <dm/platdata.h>
15
16#define ROM_API_SUCCESS				0x77
17#define ROM_API_ECDSA_ALGO_PRIME_256V1		1
18#define ROM_API_ECDSA_ALGO_BRAINPOOL_256	2
19
20#define ROM_API_OFFSET_ECDSA_VERIFY		0x60
21
22struct ecdsa_rom_api {
23	uint32_t (*ecdsa_verify_signature)(const void *hash, const void *pubkey,
24					   const void *signature,
25					   uint32_t ecc_algo);
26};
27
28static void stm32mp_rom_get_ecdsa_functions(struct ecdsa_rom_api *rom)
29{
30	uintptr_t verify_ptr = get_stm32mp_rom_api_table() +
31			       ROM_API_OFFSET_ECDSA_VERIFY;
32
33	rom->ecdsa_verify_signature = *(void **)verify_ptr;
34}
35
36static int ecdsa_key_algo(const char *curve_name)
37{
38	if (!strcmp(curve_name, "prime256v1"))
39		return ROM_API_ECDSA_ALGO_PRIME_256V1;
40	else if (!strcmp(curve_name, "brainpool256"))
41		return ROM_API_ECDSA_ALGO_BRAINPOOL_256;
42	else
43		return -ENOPROTOOPT;
44}
45
46static int romapi_ecdsa_verify(struct udevice *dev,
47			       const struct ecdsa_public_key *pubkey,
48			       const void *hash, size_t hash_len,
49			       const void *signature, size_t sig_len)
50{
51	struct ecdsa_rom_api rom;
52	uint8_t raw_key[64];
53	uint32_t rom_ret;
54	int algo;
55
56	/* The ROM API can only handle 256-bit ECDSA keys. */
57	if (sig_len != 64 || hash_len != 32 || pubkey->size_bits != 256)
58		return -EINVAL;
59
60	algo = ecdsa_key_algo(pubkey->curve_name);
61	if (algo < 0)
62		return algo;
63
64	/* The ROM API wants the (X, Y) coordinates concatenated. */
65	memcpy(raw_key, pubkey->x, 32);
66	memcpy(raw_key + 32, pubkey->y, 32);
67
68	stm32mp_rom_get_ecdsa_functions(&rom);
69
70	/* Mark BootROM region as executable. */
71	mmu_set_region_dcache_behaviour(0, SZ_2M, DCACHE_DEFAULT_OPTION);
72
73	rom_ret = rom.ecdsa_verify_signature(hash, raw_key, signature, algo);
74
75	return rom_ret == ROM_API_SUCCESS ? 0 : -EPERM;
76}
77
78static const struct ecdsa_ops rom_api_ops = {
79	.verify = romapi_ecdsa_verify,
80};
81
82U_BOOT_DRIVER(stm32mp_rom_api_ecdsa) = {
83	.name	= "stm32mp_rom_api_ecdsa",
84	.id	= UCLASS_ECDSA,
85	.ops	= &rom_api_ops,
86	.flags	= DM_FLAG_PRE_RELOC,
87};
88
89U_BOOT_DRVINFO(stm32mp_rom_api_ecdsa) = {
90	.name = "stm32mp_rom_api_ecdsa",
91};
92