1 /* 2 * Copyright (c) 2013, Google Inc. 3 * 4 * SPDX-License-Identifier: GPL-2.0+ 5 */ 6 7 #ifndef USE_HOSTCC 8 #include <common.h> 9 #include <crypto.h> 10 #include <fdtdec.h> 11 #include <misc.h> 12 #include <asm/types.h> 13 #include <asm/byteorder.h> 14 #include <linux/errno.h> 15 #include <asm/types.h> 16 #include <asm/unaligned.h> 17 #include <dm.h> 18 #else 19 #include "fdt_host.h" 20 #include "mkimage.h" 21 #include <fdt_support.h> 22 #endif 23 #include <u-boot/rsa-mod-exp.h> 24 #include <u-boot/rsa.h> 25 26 /* Default public exponent for backward compatibility */ 27 #define RSA_DEFAULT_PUBEXP 65537 28 29 /** 30 * rsa_verify_padding() - Verify RSA message padding is valid 31 * 32 * Verify a RSA message's padding is consistent with PKCS1.5 33 * padding as described in the RSA PKCS#1 v2.1 standard. 34 * 35 * @msg: Padded message 36 * @pad_len: Number of expected padding bytes 37 * @algo: Checksum algo structure having information on DER encoding etc. 38 * @return 0 on success, != 0 on failure 39 */ 40 static int rsa_verify_padding(const uint8_t *msg, const int pad_len, 41 struct checksum_algo *algo) 42 { 43 int ff_len; 44 int ret; 45 46 /* first byte must be 0x00 */ 47 ret = *msg++; 48 /* second byte must be 0x01 */ 49 ret |= *msg++ ^ 0x01; 50 /* next ff_len bytes must be 0xff */ 51 ff_len = pad_len - algo->der_len - 3; 52 ret |= *msg ^ 0xff; 53 ret |= memcmp(msg, msg+1, ff_len-1); 54 msg += ff_len; 55 /* next byte must be 0x00 */ 56 ret |= *msg++; 57 /* next der_len bytes must match der_prefix */ 58 ret |= memcmp(msg, algo->der_prefix, algo->der_len); 59 60 return ret; 61 } 62 63 #if !defined(USE_HOSTCC) 64 #if CONFIG_IS_ENABLED(FIT_HW_CRYPTO) 65 static void rsa_convert_big_endian(uint32_t *dst, const uint32_t *src, int len) 66 { 67 int i; 68 69 for (i = 0; i < len; i++) 70 dst[i] = fdt32_to_cpu(src[len - 1 - i]); 71 } 72 73 static int rsa_mod_exp_hw(struct key_prop *prop, const uint8_t *sig, 74 const uint32_t sig_len, const uint32_t key_len, 75 uint8_t *output) 76 { 77 struct udevice *dev; 78 uint8_t sig_reverse[sig_len]; 79 uint8_t buf[sig_len]; 80 rsa_key rsa_key; 81 int i, ret; 82 83 if (key_len != RSA2048_BYTES) 84 return -EINVAL; 85 86 rsa_key.algo = CRYPTO_RSA2048; 87 rsa_key.n = malloc(key_len); 88 rsa_key.e = malloc(key_len); 89 rsa_key.c = malloc(key_len); 90 if (!rsa_key.n || !rsa_key.e || !rsa_key.c) 91 return -ENOMEM; 92 93 rsa_convert_big_endian(rsa_key.n, (uint32_t *)prop->modulus, 94 key_len / sizeof(uint32_t)); 95 rsa_convert_big_endian(rsa_key.e, (uint32_t *)prop->public_exponent_BN, 96 key_len / sizeof(uint32_t)); 97 #ifdef CONFIG_ROCKCHIP_CRYPTO_V1 98 rsa_convert_big_endian(rsa_key.c, (uint32_t *)prop->factor_c, 99 key_len / sizeof(uint32_t)); 100 #else 101 rsa_convert_big_endian(rsa_key.c, (uint32_t *)prop->factor_np, 102 key_len / sizeof(uint32_t)); 103 #endif 104 for (i = 0; i < sig_len; i++) 105 sig_reverse[sig_len-1-i] = sig[i]; 106 107 dev = crypto_get_device(rsa_key.algo); 108 if (!dev) { 109 printf("No crypto device for expected RSA\n"); 110 return -ENODEV; 111 } 112 113 ret = crypto_rsa_verify(dev, &rsa_key, (u8 *)sig_reverse, buf); 114 if (ret) 115 goto out; 116 117 for (i = 0; i < sig_len; i++) 118 sig_reverse[sig_len-1-i] = buf[i]; 119 120 memcpy(output, sig_reverse, sig_len); 121 out: 122 free(rsa_key.n); 123 free(rsa_key.e); 124 free(rsa_key.c); 125 126 return ret; 127 } 128 #endif 129 #endif 130 131 int padding_pkcs_15_verify(struct image_sign_info *info, 132 uint8_t *msg, int msg_len, 133 const uint8_t *hash, int hash_len) 134 { 135 struct checksum_algo *checksum = info->checksum; 136 int ret, pad_len = msg_len - checksum->checksum_len; 137 138 /* Check pkcs1.5 padding bytes. */ 139 ret = rsa_verify_padding(msg, pad_len, checksum); 140 if (ret) { 141 debug("In RSAVerify(): Padding check failed!\n"); 142 return -EINVAL; 143 } 144 145 /* Check hash. */ 146 if (memcmp((uint8_t *)msg + pad_len, hash, msg_len - pad_len)) { 147 debug("In RSAVerify(): Hash check failed!\n"); 148 return -EACCES; 149 } 150 151 return 0; 152 } 153 154 #ifdef CONFIG_FIT_ENABLE_RSASSA_PSS_SUPPORT 155 static void u32_i2osp(uint32_t val, uint8_t *buf) 156 { 157 buf[0] = (uint8_t)((val >> 24) & 0xff); 158 buf[1] = (uint8_t)((val >> 16) & 0xff); 159 buf[2] = (uint8_t)((val >> 8) & 0xff); 160 buf[3] = (uint8_t)((val >> 0) & 0xff); 161 } 162 163 /** 164 * mask_generation_function1() - generate an octet string 165 * 166 * Generate an octet string used to check rsa signature. 167 * It use an input octet string and a hash function. 168 * 169 * @checksum: A Hash function 170 * @seed: Specifies an input variable octet string 171 * @seed_len: Size of the input octet string 172 * @output: Specifies the output octet string 173 * @output_len: Size of the output octet string 174 * @return 0 if the octet string was correctly generated, others on error 175 */ 176 static int mask_generation_function1(struct checksum_algo *checksum, 177 uint8_t *seed, int seed_len, 178 uint8_t *output, int output_len) 179 { 180 struct image_region region[2]; 181 int ret = 0, i, i_output = 0, region_count = 2; 182 uint32_t counter = 0; 183 uint8_t buf_counter[4], *tmp; 184 int hash_len = checksum->checksum_len; 185 186 memset(output, 0, output_len); 187 188 region[0].data = seed; 189 region[0].size = seed_len; 190 region[1].data = &buf_counter[0]; 191 region[1].size = 4; 192 193 tmp = malloc(hash_len); 194 if (!tmp) { 195 debug("%s: can't allocate array tmp\n", __func__); 196 ret = -ENOMEM; 197 goto out; 198 } 199 200 while (i_output < output_len) { 201 u32_i2osp(counter, &buf_counter[0]); 202 203 ret = checksum->calculate(checksum->name, 204 region, region_count, 205 tmp); 206 if (ret < 0) { 207 debug("%s: Error in checksum calculation\n", __func__); 208 goto out; 209 } 210 211 i = 0; 212 while ((i_output < output_len) && (i < hash_len)) { 213 output[i_output] = tmp[i]; 214 i_output++; 215 i++; 216 } 217 218 counter++; 219 } 220 221 out: 222 free(tmp); 223 224 return ret; 225 } 226 227 static int compute_hash_prime(struct checksum_algo *checksum, 228 uint8_t *pad, int pad_len, 229 uint8_t *hash, int hash_len, 230 uint8_t *salt, int salt_len, 231 uint8_t *hprime) 232 { 233 struct image_region region[3]; 234 int ret, region_count = 3; 235 236 region[0].data = pad; 237 region[0].size = pad_len; 238 region[1].data = hash; 239 region[1].size = hash_len; 240 region[2].data = salt; 241 region[2].size = salt_len; 242 243 ret = checksum->calculate(checksum->name, region, region_count, hprime); 244 if (ret < 0) { 245 debug("%s: Error in checksum calculation\n", __func__); 246 goto out; 247 } 248 249 out: 250 return ret; 251 } 252 253 int padding_pss_verify(struct image_sign_info *info, 254 uint8_t *msg, int msg_len, 255 const uint8_t *hash, int hash_len) 256 { 257 uint8_t *masked_db = NULL; 258 int masked_db_len = msg_len - hash_len - 1; 259 uint8_t *h = NULL, *hprime = NULL; 260 int h_len = hash_len; 261 uint8_t *db_mask = NULL; 262 int db_mask_len = masked_db_len; 263 uint8_t *db = NULL, *salt = NULL; 264 int db_len = masked_db_len, salt_len = msg_len - hash_len - 2; 265 uint8_t pad_zero[8] = { 0 }; 266 int ret, i, leftmost_bits = 1; 267 uint8_t leftmost_mask; 268 struct checksum_algo *checksum = info->checksum; 269 270 /* first, allocate everything */ 271 masked_db = malloc(masked_db_len); 272 h = malloc(h_len); 273 db_mask = malloc(db_mask_len); 274 db = malloc(db_len); 275 salt = malloc(salt_len); 276 hprime = malloc(hash_len); 277 if (!masked_db || !h || !db_mask || !db || !salt || !hprime) { 278 printf("%s: can't allocate some buffer\n", __func__); 279 ret = -ENOMEM; 280 goto out; 281 } 282 283 /* step 4: check if the last byte is 0xbc */ 284 if (msg[msg_len - 1] != 0xbc) { 285 printf("%s: invalid pss padding (0xbc is missing)\n", __func__); 286 ret = -EINVAL; 287 goto out; 288 } 289 290 /* step 5 */ 291 memcpy(masked_db, msg, masked_db_len); 292 memcpy(h, msg + masked_db_len, h_len); 293 294 /* step 6 */ 295 leftmost_mask = (0xff >> (8 - leftmost_bits)) << (8 - leftmost_bits); 296 if (masked_db[0] & leftmost_mask) { 297 printf("%s: invalid pss padding ", __func__); 298 printf("(leftmost bit of maskedDB not zero)\n"); 299 ret = -EINVAL; 300 goto out; 301 } 302 303 /* step 7 */ 304 mask_generation_function1(checksum, h, h_len, db_mask, db_mask_len); 305 306 /* step 8 */ 307 for (i = 0; i < db_len; i++) 308 db[i] = masked_db[i] ^ db_mask[i]; 309 310 /* step 9 */ 311 db[0] &= 0xff >> leftmost_bits; 312 313 /* step 10 */ 314 if (db[0] != 0x01) { 315 printf("%s: invalid pss padding ", __func__); 316 printf("(leftmost byte of db isn't 0x01)\n"); 317 ret = EINVAL; 318 goto out; 319 } 320 321 /* step 11 */ 322 memcpy(salt, &db[1], salt_len); 323 324 /* step 12 & 13 */ 325 compute_hash_prime(checksum, pad_zero, 8, 326 (uint8_t *)hash, hash_len, 327 salt, salt_len, hprime); 328 329 /* step 14 */ 330 ret = memcmp(h, hprime, hash_len); 331 332 out: 333 free(hprime); 334 free(salt); 335 free(db); 336 free(db_mask); 337 free(h); 338 free(masked_db); 339 340 return ret; 341 } 342 #endif 343 344 /** 345 * rsa_verify_key() - Verify a signature against some data using RSA Key 346 * 347 * Verify a RSA PKCS1.5 signature against an expected hash using 348 * the RSA Key properties in prop structure. 349 * 350 * @info: Specifies key and FIT information 351 * @prop: Specifies key 352 * @sig: Signature 353 * @sig_len: Number of bytes in signature 354 * @hash: Pointer to the expected hash 355 * @key_len: Number of bytes in rsa key 356 * @return 0 if verified, -ve on error 357 */ 358 static int rsa_verify_key(struct image_sign_info *info, 359 struct key_prop *prop, const uint8_t *sig, 360 const uint32_t sig_len, const uint8_t *hash, 361 const uint32_t key_len) 362 { 363 int ret; 364 struct checksum_algo *checksum = info->checksum; 365 struct padding_algo *padding = info->padding; 366 int hash_len = checksum->checksum_len; 367 368 if (!prop || !sig || !hash || !checksum) 369 return -EIO; 370 371 if (sig_len != (prop->num_bits / 8)) { 372 debug("Signature is of incorrect length %d\n", sig_len); 373 return -EINVAL; 374 } 375 376 debug("Checksum algorithm: %s", checksum->name); 377 378 /* Sanity check for stack size */ 379 if (sig_len > RSA_MAX_SIG_BITS / 8) { 380 debug("Signature length %u exceeds maximum %d\n", sig_len, 381 RSA_MAX_SIG_BITS / 8); 382 return -EINVAL; 383 } 384 385 uint8_t buf[sig_len]; 386 387 #if !defined(USE_HOSTCC) 388 #if CONFIG_IS_ENABLED(FIT_HW_CRYPTO) 389 ret = rsa_mod_exp_hw(prop, sig, sig_len, key_len, buf); 390 #else 391 struct udevice *mod_exp_dev; 392 393 ret = uclass_get_device(UCLASS_MOD_EXP, 0, &mod_exp_dev); 394 if (ret) { 395 printf("RSA: Can't find Modular Exp implementation\n"); 396 return -EINVAL; 397 } 398 399 ret = rsa_mod_exp(mod_exp_dev, sig, sig_len, prop, buf); 400 #endif 401 #else 402 ret = rsa_mod_exp_sw(sig, sig_len, prop, buf); 403 #endif 404 if (ret) { 405 debug("Error in Modular exponentation\n"); 406 return ret; 407 } 408 409 ret = padding->verify(info, buf, key_len, hash, hash_len); 410 if (ret) { 411 debug("In RSAVerify(): padding check failed!\n"); 412 return ret; 413 } 414 415 return 0; 416 } 417 418 static int rsa_get_key_prop(struct key_prop *prop, struct image_sign_info *info, int node) 419 { 420 const void *blob = info->fdt_blob; 421 int length; 422 int hash_node; 423 424 if (node < 0) { 425 debug("%s: Skipping invalid node", __func__); 426 return -EBADF; 427 } 428 429 if (!prop) { 430 debug("%s: The prop is NULL", __func__); 431 return -EBADF; 432 } 433 434 prop->burn_key = fdtdec_get_int(blob, node, "burn-key-hash", 0); 435 436 prop->num_bits = fdtdec_get_int(blob, node, "rsa,num-bits", 0); 437 438 prop->n0inv = fdtdec_get_int(blob, node, "rsa,n0-inverse", 0); 439 440 prop->public_exponent = fdt_getprop(blob, node, "rsa,exponent", &length); 441 if (!prop->public_exponent || length < sizeof(uint64_t)) 442 prop->public_exponent = NULL; 443 444 prop->exp_len = sizeof(uint64_t); 445 prop->modulus = fdt_getprop(blob, node, "rsa,modulus", NULL); 446 prop->public_exponent_BN = fdt_getprop(blob, node, "rsa,exponent-BN", NULL); 447 prop->rr = fdt_getprop(blob, node, "rsa,r-squared", NULL); 448 #ifdef CONFIG_ROCKCHIP_CRYPTO_V1 449 hash_node = fdt_subnode_offset(blob, node, "hash@c"); 450 #else 451 hash_node = fdt_subnode_offset(blob, node, "hash@np"); 452 #endif 453 if (hash_node >= 0) 454 prop->hash = fdt_getprop(blob, hash_node, "value", NULL); 455 456 if (!prop->num_bits || !prop->modulus) { 457 debug("%s: Missing RSA key info", __func__); 458 return -EFAULT; 459 } 460 461 #ifdef CONFIG_ROCKCHIP_CRYPTO_V1 462 prop->factor_c = fdt_getprop(blob, node, "rsa,c", NULL); 463 if (!prop.factor_c) 464 return -EFAULT; 465 #else 466 prop->factor_np = fdt_getprop(blob, node, "rsa,np", NULL); 467 if (!prop->factor_np) 468 return -EFAULT; 469 #endif 470 471 return 0; 472 } 473 474 /** 475 * rsa_verify_with_keynode() - Verify a signature against some data using 476 * information in node with prperties of RSA Key like modulus, exponent etc. 477 * 478 * Parse sign-node and fill a key_prop structure with properties of the 479 * key. Verify a RSA PKCS1.5 signature against an expected hash using 480 * the properties parsed 481 * 482 * @info: Specifies key and FIT information 483 * @hash: Pointer to the expected hash 484 * @sig: Signature 485 * @sig_len: Number of bytes in signature 486 * @node: Node having the RSA Key properties 487 * @return 0 if verified, -ve on error 488 */ 489 static int rsa_verify_with_keynode(struct image_sign_info *info, 490 const void *hash, uint8_t *sig, 491 uint sig_len, int node) 492 { 493 struct key_prop prop; 494 495 if (rsa_get_key_prop(&prop, info, node)) 496 return -EFAULT; 497 498 return rsa_verify_key(info, &prop, sig, sig_len, hash, 499 info->crypto->key_len); 500 } 501 502 int rsa_verify(struct image_sign_info *info, 503 const struct image_region region[], int region_count, 504 uint8_t *sig, uint sig_len) 505 { 506 const void *blob = info->fdt_blob; 507 /* Reserve memory for maximum checksum-length */ 508 uint8_t hash[info->crypto->key_len]; 509 int ndepth, noffset; 510 int sig_node, node; 511 char name[100]; 512 int ret; 513 514 /* 515 * Verify that the checksum-length does not exceed the 516 * rsa-signature-length 517 */ 518 if (info->checksum->checksum_len > 519 info->crypto->key_len) { 520 debug("%s: invlaid checksum-algorithm %s for %s\n", 521 __func__, info->checksum->name, info->crypto->name); 522 return -EINVAL; 523 } 524 525 sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME); 526 if (sig_node < 0) { 527 debug("%s: No signature node found\n", __func__); 528 return -ENOENT; 529 } 530 531 /* Calculate checksum with checksum-algorithm */ 532 ret = info->checksum->calculate(info->checksum->name, 533 region, region_count, hash); 534 if (ret < 0) { 535 debug("%s: Error in checksum calculation\n", __func__); 536 return -EINVAL; 537 } 538 539 /* See if we must use a particular key */ 540 if (info->required_keynode != -1) { 541 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, 542 info->required_keynode); 543 if (!ret) 544 return ret; 545 } 546 547 /* Look for a key that matches our hint */ 548 snprintf(name, sizeof(name), "key-%s", info->keyname); 549 node = fdt_subnode_offset(blob, sig_node, name); 550 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, node); 551 if (!ret) 552 return ret; 553 554 /* No luck, so try each of the keys in turn */ 555 for (ndepth = 0, noffset = fdt_next_node(info->fit, sig_node, &ndepth); 556 (noffset >= 0) && (ndepth > 0); 557 noffset = fdt_next_node(info->fit, noffset, &ndepth)) { 558 if (ndepth == 1 && noffset != node) { 559 ret = rsa_verify_with_keynode(info, hash, sig, sig_len, 560 noffset); 561 if (!ret) 562 break; 563 } 564 } 565 566 return ret; 567 } 568 569 #if !defined(USE_HOSTCC) 570 #ifdef CONFIG_SPL_FIT_HW_CRYPTO 571 int rsa_burn_key_hash(struct image_sign_info *info) 572 { 573 char *rsa_key; 574 void *n, *e, *c; 575 uint32_t key_len; 576 struct udevice *dev; 577 struct key_prop prop; 578 char name[100] = {0}; 579 char secure_boot_enable = 0; 580 const void *blob = info->fdt_blob; 581 uint8_t digest[FIT_MAX_HASH_LEN]; 582 uint8_t digest_read[FIT_MAX_HASH_LEN]; 583 int sig_node, node, digest_len, i, ret = 0; 584 585 dev = misc_otp_get_device(OTP_S); 586 if (!dev) 587 return -ENODEV; 588 589 ret = misc_otp_read(dev, OTP_SECURE_BOOT_ENABLE_ADDR, 590 &secure_boot_enable, OTP_SECURE_BOOT_ENABLE_SIZE); 591 if (ret) 592 return ret; 593 594 if (secure_boot_enable) 595 return 0; 596 597 sig_node = fdt_subnode_offset(blob, 0, FIT_SIG_NODENAME); 598 if (sig_node < 0) { 599 debug("%s: No signature node found\n", __func__); 600 return -ENOENT; 601 } 602 603 snprintf(name, sizeof(name), "key-%s", info->keyname); 604 node = fdt_subnode_offset(blob, sig_node, name); 605 606 if (rsa_get_key_prop(&prop, info, node)) 607 return -1; 608 609 if (!(prop.burn_key)) 610 return -EPERM; 611 612 if (!prop.hash || !prop.modulus || !prop.public_exponent_BN) 613 return -ENOENT; 614 #ifdef CONFIG_ROCKCHIP_CRYPTO_V1 615 if (!prop.factor_c) 616 return -ENOENT; 617 #else 618 if (!prop.factor_np) 619 return -ENOENT; 620 #endif 621 key_len = info->crypto->key_len; 622 if (info->crypto->key_len != RSA2048_BYTES) 623 return -EINVAL; 624 625 rsa_key = malloc(key_len * 3); 626 if (!rsa_key) 627 return -ENOMEM; 628 629 n = rsa_key; 630 e = rsa_key + key_len; 631 c = rsa_key + key_len * 2; 632 rsa_convert_big_endian(n, (uint32_t *)prop.modulus, 633 key_len / sizeof(uint32_t)); 634 rsa_convert_big_endian(e, (uint32_t *)prop.public_exponent_BN, 635 key_len / sizeof(uint32_t)); 636 #ifdef CONFIG_ROCKCHIP_CRYPTO_V1 637 rsa_convert_big_endian(c, (uint32_t *)prop.factor_c, 638 key_len / sizeof(uint32_t)); 639 #else 640 rsa_convert_big_endian(c, (uint32_t *)prop.factor_np, 641 key_len / sizeof(uint32_t)); 642 #endif 643 644 ret = calculate_hash(rsa_key, key_len * 2 + OTP_RSA2048_C_SIZE, 645 info->checksum->name, digest, &digest_len); 646 if (ret) 647 goto error; 648 649 if (memcmp(digest, prop.hash, digest_len) != 0) { 650 printf("RSA: Compare public key hash fail.\n"); 651 goto error; 652 } 653 654 /* burn key hash here */ 655 ret = misc_otp_read(dev, OTP_RSA_HASH_ADDR, digest_read, OTP_RSA_HASH_SIZE); 656 if (ret) 657 goto error; 658 659 for (i = 0; i < OTP_RSA_HASH_SIZE; i++) { 660 if (digest_read[i]) { 661 printf("RSA: The secure region has been written.\n"); 662 ret = -EIO; 663 goto error; 664 } 665 } 666 667 ret = misc_otp_write(dev, OTP_RSA_HASH_ADDR, digest, OTP_RSA_HASH_SIZE); 668 if (ret) 669 goto error; 670 671 memset(digest_read, 0, FIT_MAX_HASH_LEN); 672 ret = misc_otp_read(dev, OTP_RSA_HASH_ADDR, digest_read, OTP_RSA_HASH_SIZE); 673 if (ret) 674 goto error; 675 676 if (memcmp(digest, digest_read, digest_len) != 0) { 677 printf("RSA: Write public key hash fail.\n"); 678 goto error; 679 } 680 681 secure_boot_enable = 0xff; 682 ret = misc_otp_write(dev, OTP_SECURE_BOOT_ENABLE_ADDR, 683 &secure_boot_enable, OTP_SECURE_BOOT_ENABLE_SIZE); 684 if (ret) 685 goto error; 686 687 printf("RSA：Write key hash successfully\n"); 688 689 error: 690 free(rsa_key); 691 692 return ret; 693 } 694 #endif 695 #endif 696