ti_secure_image_check_binary() skips the signing certificate prepended to an image when it is loaded on a GP device, so that the actual payload can be processed.
This functionality will also be used in resume_to_dm_f() to skip the certificate once it has been authenticated. So, factorize that in ti_secure_skip_cert(). No functional change intended. Signed-off-by: Richard Genoud (TI) <[email protected]> --- arch/arm/mach-k3/include/mach/security.h | 1 + arch/arm/mach-k3/security.c | 46 +++++++++++++----------- 2 files changed, 27 insertions(+), 20 deletions(-) diff --git a/arch/arm/mach-k3/include/mach/security.h b/arch/arm/mach-k3/include/mach/security.h index fa90fed7c427..3750265a845f 100644 --- a/arch/arm/mach-k3/include/mach/security.h +++ b/arch/arm/mach-k3/include/mach/security.h @@ -10,3 +10,4 @@ void ti_secure_image_post_process(void **p_image, size_t *p_size); void ti_secure_image_auth_apply_fwls(void **p_image, size_t image_size); +void ti_secure_skip_cert(void **p_image, size_t *p_size); diff --git a/arch/arm/mach-k3/security.c b/arch/arm/mach-k3/security.c index 2df922a2fa27..f87fe6ec44e2 100644 --- a/arch/arm/mach-k3/security.c +++ b/arch/arm/mach-k3/security.c @@ -37,10 +37,33 @@ static size_t ti_secure_cert_length(void *p_image) return seq_length + 4; } +void ti_secure_skip_cert(void **p_image, size_t *p_size) +{ + size_t cert_length; + u32 device_type = get_device_type(); + + if (ti_secure_cert_detected(*p_image)) { + if (device_type == K3_DEVICE_TYPE_GP) + debug("Warning: Detected image signing certificate on GP device. " + "Skipping certificate to prevent boot failure. " + "This will fail if the image was also encrypted\n"); + + cert_length = ti_secure_cert_length(*p_image); + if (cert_length > *p_size) { + printf("Invalid signing certificate size\n"); + return; + } + + if (device_type == K3_DEVICE_TYPE_GP) + printf("Skipping authentication on GP device\n"); + *p_image += cert_length; + *p_size -= cert_length; + } +} + void ti_secure_image_check_binary(void **p_image, size_t *p_size) { u32 image_size; - size_t cert_length; image_size = *p_size; if (!image_size) { @@ -48,25 +71,8 @@ void ti_secure_image_check_binary(void **p_image, size_t *p_size) return; } - if (get_device_type() == K3_DEVICE_TYPE_GP) { - if (ti_secure_cert_detected(*p_image)) { - debug("Warning: Detected image signing certificate on GP device. " - "Skipping certificate to prevent boot failure. " - "This will fail if the image was also encrypted\n"); - - cert_length = ti_secure_cert_length(*p_image); - if (cert_length > *p_size) { - printf("Invalid signing certificate size\n"); - return; - } - - printf("Skipping authentication on GP device\n"); - *p_image += cert_length; - *p_size -= cert_length; - } - - return; - } + if (get_device_type() == K3_DEVICE_TYPE_GP) + ti_secure_skip_cert(p_image, p_size); } void ti_secure_image_post_process(void **p_image, size_t *p_size) -- 2.55.0
