cmd_dek.c 8.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * Copyright 2008-2015 Freescale Semiconductor, Inc.
  4. *
  5. * Command for encapsulating DEK blob
  6. */
  7. #include <common.h>
  8. #include <command.h>
  9. #include <log.h>
  10. #include <malloc.h>
  11. #include <asm/byteorder.h>
  12. #include <linux/compiler.h>
  13. #include <fsl_sec.h>
  14. #include <asm/arch/clock.h>
  15. #include <mapmem.h>
  16. #include <tee.h>
  17. #ifdef CONFIG_IMX_SECO_DEK_ENCAP
  18. #include <asm/arch/sci/sci.h>
  19. #include <asm/arch/image.h>
  20. #endif
  21. #include <cpu_func.h>
  22. /**
  23. * blob_dek() - Encapsulate the DEK as a blob using CAM's Key
  24. * @src: - Address of data to be encapsulated
  25. * @dst: - Desination address of encapsulated data
  26. * @len: - Size of data to be encapsulated
  27. *
  28. * Returns zero on success,and negative on error.
  29. */
  30. #ifdef CONFIG_IMX_CAAM_DEK_ENCAP
  31. static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
  32. {
  33. u8 *src_ptr, *dst_ptr;
  34. src_ptr = map_sysmem(src_addr, len / 8);
  35. dst_ptr = map_sysmem(dst_addr, BLOB_SIZE(len / 8));
  36. hab_caam_clock_enable(1);
  37. u32 out_jr_size = sec_in32(CONFIG_SYS_FSL_JR0_ADDR +
  38. FSL_CAAM_ORSR_JRa_OFFSET);
  39. if (out_jr_size != FSL_CAAM_MAX_JR_SIZE)
  40. sec_init();
  41. if (!((len == 128) | (len == 192) | (len == 256))) {
  42. debug("Invalid DEK size. Valid sizes are 128, 192 and 256b\n");
  43. return -1;
  44. }
  45. len /= 8;
  46. return blob_dek(src_ptr, dst_ptr, len);
  47. }
  48. #endif /* CONFIG_IMX_CAAM_DEK_ENCAP */
  49. #ifdef CONFIG_IMX_OPTEE_DEK_ENCAP
  50. #define PTA_DEK_BLOB_PTA_UUID {0xef477737, 0x0db1, 0x4a9d, \
  51. {0x84, 0x37, 0xf2, 0xf5, 0x35, 0xc0, 0xbd, 0x92} }
  52. #define OPTEE_BLOB_HDR_SIZE 8
  53. static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
  54. {
  55. struct udevice *dev = NULL;
  56. struct tee_shm *shm_input, *shm_output;
  57. struct tee_open_session_arg arg = {0};
  58. struct tee_invoke_arg arg_func = {0};
  59. const struct tee_optee_ta_uuid uuid = PTA_DEK_BLOB_PTA_UUID;
  60. struct tee_param param[4] = {0};
  61. int ret;
  62. /* Get tee device */
  63. dev = tee_find_device(NULL, NULL, NULL, NULL);
  64. if (!dev) {
  65. printf("Cannot get OP-TEE device\n");
  66. return -1;
  67. }
  68. /* Set TA UUID */
  69. tee_optee_ta_uuid_to_octets(arg.uuid, &uuid);
  70. /* Open TA session */
  71. ret = tee_open_session(dev, &arg, 0, NULL);
  72. if (ret < 0) {
  73. printf("Cannot open session with PTA Blob 0x%X\n", ret);
  74. return -1;
  75. }
  76. /* Allocate shared input and output buffers for TA */
  77. ret = tee_shm_register(dev, (void *)(ulong)src_addr, len / 8, 0x0, &shm_input);
  78. if (ret < 0) {
  79. printf("Cannot register input shared memory 0x%X\n", ret);
  80. goto error;
  81. }
  82. ret = tee_shm_register(dev, (void *)(ulong)dst_addr,
  83. BLOB_SIZE(len / 8) + OPTEE_BLOB_HDR_SIZE,
  84. 0x0, &shm_output);
  85. if (ret < 0) {
  86. printf("Cannot register output shared memory 0x%X\n", ret);
  87. goto error;
  88. }
  89. param[0].u.memref.shm = shm_input;
  90. param[0].u.memref.size = shm_input->size;
  91. param[0].attr = TEE_PARAM_ATTR_TYPE_MEMREF_INPUT;
  92. param[1].u.memref.shm = shm_output;
  93. param[1].u.memref.size = shm_output->size;
  94. param[1].attr = TEE_PARAM_ATTR_TYPE_MEMREF_OUTPUT;
  95. param[2].attr = TEE_PARAM_ATTR_TYPE_NONE;
  96. param[3].attr = TEE_PARAM_ATTR_TYPE_NONE;
  97. arg_func.func = 0;
  98. arg_func.session = arg.session;
  99. /* Generate DEK blob */
  100. arg_func.session = arg.session;
  101. ret = tee_invoke_func(dev, &arg_func, 4, param);
  102. if (ret < 0)
  103. printf("Cannot generate Blob with PTA DEK Blob 0x%X\n", ret);
  104. error:
  105. /* Free shared memory */
  106. tee_shm_free(shm_input);
  107. tee_shm_free(shm_output);
  108. /* Close session */
  109. ret = tee_close_session(dev, arg.session);
  110. if (ret < 0)
  111. printf("Cannot close session with PTA DEK Blob 0x%X\n", ret);
  112. return ret;
  113. }
  114. #endif /* CONFIG_IMX_OPTEE_DEK_ENCAP */
  115. #ifdef CONFIG_IMX_SECO_DEK_ENCAP
  116. #define DEK_BLOB_KEY_ID 0x0
  117. #define AHAB_PRIVATE_KEY 0x81
  118. #define AHAB_VERSION 0x00
  119. #define AHAB_MODE_CBC 0x67
  120. #define AHAB_ALG_AES 0x55
  121. #define AHAB_128_AES_KEY 0x10
  122. #define AHAB_192_AES_KEY 0x18
  123. #define AHAB_256_AES_KEY 0x20
  124. #define AHAB_FLAG_KEK 0x80
  125. #define AHAB_DEK_BLOB 0x01
  126. #define DEK_BLOB_HDR_SIZE 8
  127. #define SECO_PT 2U
  128. static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
  129. {
  130. sc_err_t err;
  131. sc_rm_mr_t mr_input, mr_output;
  132. struct generate_key_blob_hdr hdr;
  133. u8 in_size, out_size;
  134. u8 *src_ptr, *dst_ptr;
  135. int ret = 0;
  136. int i;
  137. /* Set sizes */
  138. in_size = sizeof(struct generate_key_blob_hdr) + len / 8;
  139. out_size = BLOB_SIZE(len / 8) + DEK_BLOB_HDR_SIZE;
  140. /* Get src and dst virtual addresses */
  141. src_ptr = map_sysmem(src_addr, in_size);
  142. dst_ptr = map_sysmem(dst_addr, out_size);
  143. /* Check addr input */
  144. if (!(src_ptr && dst_ptr)) {
  145. debug("src_addr or dst_addr invalid\n");
  146. return -1;
  147. }
  148. /* Build key header */
  149. hdr.version = AHAB_VERSION;
  150. hdr.length_lsb = sizeof(struct generate_key_blob_hdr) + len / 8;
  151. hdr.length_msb = 0x00;
  152. hdr.tag = AHAB_PRIVATE_KEY;
  153. hdr.flags = AHAB_DEK_BLOB;
  154. hdr.algorithm = AHAB_ALG_AES;
  155. hdr.mode = AHAB_MODE_CBC;
  156. switch (len) {
  157. case 128:
  158. hdr.size = AHAB_128_AES_KEY;
  159. break;
  160. case 192:
  161. hdr.size = AHAB_192_AES_KEY;
  162. break;
  163. case 256:
  164. hdr.size = AHAB_256_AES_KEY;
  165. break;
  166. default:
  167. /* Not supported */
  168. debug("Invalid DEK size. Valid sizes are 128, 192 and 256b\n");
  169. return -1;
  170. }
  171. /* Build input message */
  172. memmove((void *)(src_ptr + sizeof(struct generate_key_blob_hdr)),
  173. (void *)src_ptr, len / 8);
  174. memcpy((void *)src_ptr, (void *)&hdr,
  175. sizeof(struct generate_key_blob_hdr));
  176. /* Flush the cache before triggering the CAAM DMA */
  177. flush_dcache_range(src_addr, src_addr + in_size);
  178. /* Find input memory region */
  179. err = sc_rm_find_memreg((-1), &mr_input, src_addr & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
  180. ALIGN(src_addr + in_size, CONFIG_SYS_CACHELINE_SIZE));
  181. if (err) {
  182. printf("Error: find memory region 0x%X\n", src_addr);
  183. return -ENOMEM;
  184. }
  185. /* Find output memory region */
  186. err = sc_rm_find_memreg((-1), &mr_output, dst_addr & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
  187. ALIGN(dst_addr + out_size, CONFIG_SYS_CACHELINE_SIZE));
  188. if (err) {
  189. printf("Error: find memory region 0x%X\n", dst_addr);
  190. return -ENOMEM;
  191. }
  192. /* Set memory region permissions for SECO */
  193. err = sc_rm_set_memreg_permissions(-1, mr_input, SECO_PT,
  194. SC_RM_PERM_FULL);
  195. if (err) {
  196. printf("Set permission failed for input memory region\n");
  197. ret = -EPERM;
  198. goto error;
  199. }
  200. err = sc_rm_set_memreg_permissions(-1, mr_output, SECO_PT,
  201. SC_RM_PERM_FULL);
  202. if (err) {
  203. printf("Set permission failed for output memory region\n");
  204. ret = -EPERM;
  205. goto error;
  206. }
  207. /* Flush output data before SECO operation */
  208. flush_dcache_range((ulong)dst_ptr, (ulong)(dst_ptr +
  209. roundup(out_size, ARCH_DMA_MINALIGN)));
  210. /* Generate DEK blob */
  211. err = sc_seco_gen_key_blob((-1), 0x0, src_addr, dst_addr, out_size);
  212. if (err) {
  213. ret = -EPERM;
  214. goto error;
  215. }
  216. /* Invalidate output buffer */
  217. invalidate_dcache_range((ulong)dst_ptr, (ulong)(dst_ptr +
  218. roundup(out_size, ARCH_DMA_MINALIGN)));
  219. printf("DEK Blob\n");
  220. for (i = 0; i < DEK_BLOB_HDR_SIZE + BLOB_SIZE(len / 8); i++)
  221. printf("%02X", dst_ptr[i]);
  222. printf("\n");
  223. error:
  224. /* Remove memory region permission to SECO */
  225. err = sc_rm_set_memreg_permissions(-1, mr_input, SECO_PT,
  226. SC_RM_PERM_NONE);
  227. if (err) {
  228. printf("Error: remove permission failed for input\n");
  229. ret = -EPERM;
  230. }
  231. err = sc_rm_set_memreg_permissions(-1, mr_output, SECO_PT,
  232. SC_RM_PERM_NONE);
  233. if (err) {
  234. printf("Error: remove permission failed for output\n");
  235. ret = -EPERM;
  236. }
  237. return ret;
  238. }
  239. #endif /* CONFIG_IMX_SECO_DEK_ENCAP */
  240. /**
  241. * do_dek_blob() - Handle the "dek_blob" command-line command
  242. * @cmdtp: Command data struct pointer
  243. * @flag: Command flag
  244. * @argc: Command-line argument count
  245. * @argv: Array of command-line arguments
  246. *
  247. * Returns zero on success, CMD_RET_USAGE in case of misuse and negative
  248. * on error.
  249. */
  250. static int do_dek_blob(struct cmd_tbl *cmdtp, int flag, int argc,
  251. char *const argv[])
  252. {
  253. uint32_t src_addr, dst_addr, len;
  254. if (argc != 4)
  255. return CMD_RET_USAGE;
  256. src_addr = hextoul(argv[1], NULL);
  257. dst_addr = hextoul(argv[2], NULL);
  258. len = dectoul(argv[3], NULL);
  259. return blob_encap_dek(src_addr, dst_addr, len);
  260. }
  261. /***************************************************/
  262. static char dek_blob_help_text[] =
  263. "src dst len - Encapsulate and create blob of data\n"
  264. " $len bits long at address $src and\n"
  265. " store the result at address $dst.\n";
  266. U_BOOT_CMD(
  267. dek_blob, 4, 1, do_dek_blob,
  268. "Data Encryption Key blob encapsulation",
  269. dek_blob_help_text
  270. );