This implements the necessary SoC code to check the full barebox against
a sha256 compiled into the first stage barebox.
Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx>
---
arch/arm/mach-k3/Kconfig | 1 +
arch/arm/mach-k3/r5.c | 14 ++++++++++++++
2 files changed, 15 insertions(+)
diff --git a/arch/arm/mach-k3/Kconfig b/arch/arm/mach-k3/Kconfig
index 50919dc7e3..561ad1dac4 100644
--- a/arch/arm/mach-k3/Kconfig
+++ b/arch/arm/mach-k3/Kconfig
@@ -16,6 +16,7 @@ config MACH_K3_CORTEX_R5
select ELF
select K3_DDRSS
select FIP
+ select HAVE_FIRMWARE_VERIFY_NEXT_IMAGE
depends on 32BIT
select ARM_USE_COMPRESSED_DTB
default y
diff --git a/arch/arm/mach-k3/r5.c b/arch/arm/mach-k3/r5.c
index e12c888afa..cb52ff364d 100644
--- a/arch/arm/mach-k3/r5.c
+++ b/arch/arm/mach-k3/r5.c
@@ -248,6 +248,8 @@ static int load_fip(const char *filename, off_t offset)
{
struct fip_state *fip;
struct fip_image_desc *desc;
+ unsigned char shasum[SHA256_DIGEST_SIZE];
+ int ret;
fip = fip_image_open(filename, offset);
if (IS_ERR(fip)) {
@@ -255,6 +257,18 @@ static int load_fip(const char *filename, off_t offset)
return PTR_ERR(fip);
}
+ if (IS_ENABLED(CONFIG_FIRMWARE_VERIFY_NEXT_IMAGE)) {
+ ret = fip_sha256(fip, shasum);
+ if (ret) {
+ pr_err("Cannot calc fip sha256: %pe\n", ERR_PTR(ret));
+ return ret;
+ }
+
+ ret = firmware_next_image_verify(shasum, SHA256_DIGEST_SIZE, true);
+ if (ret)
+ return ret;
+ }
+
fip_for_each_desc(fip, desc) {
struct fip_toc_entry *toc_entry = &desc->image->toc_e;
--
2.39.5
