1// SPDX-License-Identifier: GPL-2.0+ 2/* 3 * STM32MP ECDSA verification via the ROM API 4 * 5 * Implements ECDSA signature verification via the STM32MP ROM. 6 */ 7#include <asm/system.h> 8#include <asm/arch/sys_proto.h> 9#include <dm/device.h> 10#include <linux/types.h> 11#include <u-boot/ecdsa.h> 12#include <crypto/ecdsa-uclass.h> 13#include <linux/libfdt.h> 14#include <dm/platdata.h> 15 16#define ROM_API_SUCCESS 0x77 17#define ROM_API_ECDSA_ALGO_PRIME_256V1 1 18#define ROM_API_ECDSA_ALGO_BRAINPOOL_256 2 19 20#define ROM_API_OFFSET_ECDSA_VERIFY 0x60 21 22struct ecdsa_rom_api { 23 uint32_t (*ecdsa_verify_signature)(const void *hash, const void *pubkey, 24 const void *signature, 25 uint32_t ecc_algo); 26}; 27 28static void stm32mp_rom_get_ecdsa_functions(struct ecdsa_rom_api *rom) 29{ 30 uintptr_t verify_ptr = get_stm32mp_rom_api_table() + 31 ROM_API_OFFSET_ECDSA_VERIFY; 32 33 rom->ecdsa_verify_signature = *(void **)verify_ptr; 34} 35 36static int ecdsa_key_algo(const char *curve_name) 37{ 38 if (!strcmp(curve_name, "prime256v1")) 39 return ROM_API_ECDSA_ALGO_PRIME_256V1; 40 else if (!strcmp(curve_name, "brainpool256")) 41 return ROM_API_ECDSA_ALGO_BRAINPOOL_256; 42 else 43 return -ENOPROTOOPT; 44} 45 46static int romapi_ecdsa_verify(struct udevice *dev, 47 const struct ecdsa_public_key *pubkey, 48 const void *hash, size_t hash_len, 49 const void *signature, size_t sig_len) 50{ 51 struct ecdsa_rom_api rom; 52 uint8_t raw_key[64]; 53 uint32_t rom_ret; 54 int algo; 55 56 /* The ROM API can only handle 256-bit ECDSA keys. */ 57 if (sig_len != 64 || hash_len != 32 || pubkey->size_bits != 256) 58 return -EINVAL; 59 60 algo = ecdsa_key_algo(pubkey->curve_name); 61 if (algo < 0) 62 return algo; 63 64 /* The ROM API wants the (X, Y) coordinates concatenated. */ 65 memcpy(raw_key, pubkey->x, 32); 66 memcpy(raw_key + 32, pubkey->y, 32); 67 68 stm32mp_rom_get_ecdsa_functions(&rom); 69 70 /* Mark BootROM region as executable. */ 71 mmu_set_region_dcache_behaviour(0, SZ_2M, DCACHE_DEFAULT_OPTION); 72 73 rom_ret = rom.ecdsa_verify_signature(hash, raw_key, signature, algo); 74 75 return rom_ret == ROM_API_SUCCESS ? 0 : -EPERM; 76} 77 78static const struct ecdsa_ops rom_api_ops = { 79 .verify = romapi_ecdsa_verify, 80}; 81 82U_BOOT_DRIVER(stm32mp_rom_api_ecdsa) = { 83 .name = "stm32mp_rom_api_ecdsa", 84 .id = UCLASS_ECDSA, 85 .ops = &rom_api_ops, 86 .flags = DM_FLAG_PRE_RELOC, 87}; 88 89U_BOOT_DRVINFO(stm32mp_rom_api_ecdsa) = { 90 .name = "stm32mp_rom_api_ecdsa", 91}; 92