jobdesc.c 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * SEC Descriptor Construction Library
  4. * Basic job descriptor construction
  5. *
  6. * Copyright 2014 Freescale Semiconductor, Inc.
  7. * Copyright 2018 NXP
  8. *
  9. */
  10. #include <common.h>
  11. #include <cpu_func.h>
  12. #include <fsl_sec.h>
  13. #include "desc_constr.h"
  14. #include "jobdesc.h"
  15. #include "rsa_caam.h"
  16. #include <asm/cache.h>
  17. #if defined(CONFIG_MX6) || defined(CONFIG_MX7) || defined(CONFIG_MX7ULP) || \
  18. defined(CONFIG_IMX8M)
  19. /*!
  20. * Secure memory run command
  21. *
  22. * @param sec_mem_cmd Secure memory command register
  23. * @return cmd_status Secure memory command status register
  24. */
  25. uint32_t secmem_set_cmd(uint32_t sec_mem_cmd)
  26. {
  27. uint32_t temp_reg;
  28. ccsr_sec_t *sec = (void *)CONFIG_SYS_FSL_SEC_ADDR;
  29. uint32_t sm_vid = SM_VERSION(sec_in32(&sec->smvid));
  30. uint32_t jr_id = 0;
  31. sec_out32(CAAM_SMCJR(sm_vid, jr_id), sec_mem_cmd);
  32. do {
  33. temp_reg = sec_in32(CAAM_SMCSJR(sm_vid, jr_id));
  34. } while (temp_reg & CMD_COMPLETE);
  35. return temp_reg;
  36. }
  37. /*!
  38. * CAAM page allocation:
  39. * Allocates a partition from secure memory, with the id
  40. * equal to partition_num. This will de-allocate the page
  41. * if it is already allocated. The partition will have
  42. * full access permissions. The permissions are set before,
  43. * running a job descriptor. A memory page of secure RAM
  44. * is allocated for the partition.
  45. *
  46. * @param page Number of the page to allocate.
  47. * @param partition Number of the partition to allocate.
  48. * @return 0 on success, ERROR_IN_PAGE_ALLOC otherwise
  49. */
  50. int caam_page_alloc(uint8_t page_num, uint8_t partition_num)
  51. {
  52. uint32_t temp_reg;
  53. ccsr_sec_t *sec = (void *)CONFIG_SYS_FSL_SEC_ADDR;
  54. uint32_t sm_vid = SM_VERSION(sec_in32(&sec->smvid));
  55. uint32_t jr_id = 0;
  56. /*
  57. * De-Allocate partition_num if already allocated to ARM core
  58. */
  59. if (sec_in32(CAAM_SMPO_0) & PARTITION_OWNER(partition_num)) {
  60. temp_reg = secmem_set_cmd(PARTITION(partition_num) |
  61. CMD_PART_DEALLOC);
  62. if (temp_reg & SMCSJR_AERR) {
  63. printf("Error: De-allocation status 0x%X\n", temp_reg);
  64. return ERROR_IN_PAGE_ALLOC;
  65. }
  66. }
  67. /* set the access rights to allow full access */
  68. sec_out32(CAAM_SMAG1JR(sm_vid, jr_id, partition_num), 0xF);
  69. sec_out32(CAAM_SMAG2JR(sm_vid, jr_id, partition_num), 0xF);
  70. sec_out32(CAAM_SMAPJR(sm_vid, jr_id, partition_num), 0xFF);
  71. /* Now need to allocate partition_num of secure RAM. */
  72. /* De-Allocate page_num by starting with a page inquiry command */
  73. temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_INQUIRY);
  74. /* if the page is owned, de-allocate it */
  75. if ((temp_reg & SMCSJR_PO) == PAGE_OWNED) {
  76. temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_PAGE_DEALLOC);
  77. if (temp_reg & SMCSJR_AERR) {
  78. printf("Error: Allocation status 0x%X\n", temp_reg);
  79. return ERROR_IN_PAGE_ALLOC;
  80. }
  81. }
  82. /* Allocate page_num to partition_num */
  83. temp_reg = secmem_set_cmd(PAGE(page_num) | PARTITION(partition_num)
  84. | CMD_PAGE_ALLOC);
  85. if (temp_reg & SMCSJR_AERR) {
  86. printf("Error: Allocation status 0x%X\n", temp_reg);
  87. return ERROR_IN_PAGE_ALLOC;
  88. }
  89. /* page inquiry command to ensure that the page was allocated */
  90. temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_INQUIRY);
  91. /* if the page is not owned => problem */
  92. if ((temp_reg & SMCSJR_PO) != PAGE_OWNED) {
  93. printf("Allocation of page %u in partition %u failed 0x%X\n",
  94. page_num, partition_num, temp_reg);
  95. return ERROR_IN_PAGE_ALLOC;
  96. }
  97. return 0;
  98. }
  99. int inline_cnstr_jobdesc_blob_dek(uint32_t *desc, const uint8_t *plain_txt,
  100. uint8_t *dek_blob, uint32_t in_sz)
  101. {
  102. ccsr_sec_t *sec = (void *)CONFIG_SYS_FSL_SEC_ADDR;
  103. uint32_t sm_vid = SM_VERSION(sec_in32(&sec->smvid));
  104. uint32_t jr_id = 0;
  105. uint32_t ret = 0;
  106. u32 aad_w1, aad_w2;
  107. /* output blob will have 32 bytes key blob in beginning and
  108. * 16 byte HMAC identifier at end of data blob */
  109. uint32_t out_sz = in_sz + KEY_BLOB_SIZE + MAC_SIZE;
  110. /* Setting HDR for blob */
  111. uint8_t wrapped_key_hdr[8] = {HDR_TAG, 0x00, WRP_HDR_SIZE + out_sz,
  112. HDR_PAR, HAB_MOD, HAB_ALG, in_sz, HAB_FLG};
  113. /* initialize the blob array */
  114. memset(dek_blob, 0, out_sz + 8);
  115. /* Copy the header into the DEK blob buffer */
  116. memcpy(dek_blob, wrapped_key_hdr, sizeof(wrapped_key_hdr));
  117. /* allocating secure memory */
  118. ret = caam_page_alloc(PAGE_1, PARTITION_1);
  119. if (ret)
  120. return ret;
  121. /* Write DEK to secure memory */
  122. memcpy((uint32_t *)SEC_MEM_PAGE1, (uint32_t *)plain_txt, in_sz);
  123. unsigned long start = (unsigned long)SEC_MEM_PAGE1 &
  124. ~(ARCH_DMA_MINALIGN - 1);
  125. unsigned long end = ALIGN(start + 0x1000, ARCH_DMA_MINALIGN);
  126. flush_dcache_range(start, end);
  127. /* Now configure the access rights of the partition */
  128. sec_out32(CAAM_SMAG1JR(sm_vid, jr_id, PARTITION_1), KS_G1);
  129. sec_out32(CAAM_SMAG2JR(sm_vid, jr_id, PARTITION_1), 0);
  130. sec_out32(CAAM_SMAPJR(sm_vid, jr_id, PARTITION_1), PERM);
  131. /* construct aad for AES */
  132. aad_w1 = (in_sz << OP_ALG_ALGSEL_SHIFT) | KEY_AES_SRC | LD_CCM_MODE;
  133. aad_w2 = 0x0;
  134. init_job_desc(desc, 0);
  135. append_cmd(desc, CMD_LOAD | CLASS_2 | KEY_IMM | KEY_ENC |
  136. (0x0c << LDST_OFFSET_SHIFT) | 0x08);
  137. append_u32(desc, aad_w1);
  138. append_u32(desc, aad_w2);
  139. append_cmd_ptr(desc, (caam_dma_addr_t)SEC_MEM_PAGE1, in_sz, CMD_SEQ_IN_PTR);
  140. append_cmd_ptr(desc, (caam_dma_addr_t)(ulong)(dek_blob + 8), out_sz, CMD_SEQ_OUT_PTR);
  141. append_operation(desc, OP_TYPE_ENCAP_PROTOCOL | OP_PCLID_BLOB |
  142. OP_PCLID_SECMEM);
  143. return ret;
  144. }
  145. #endif
  146. void inline_cnstr_jobdesc_hash(uint32_t *desc,
  147. const uint8_t *msg, uint32_t msgsz, uint8_t *digest,
  148. u32 alg_type, uint32_t alg_size, int sg_tbl)
  149. {
  150. /* SHA 256 , output is of length 32 words */
  151. uint32_t storelen = alg_size;
  152. u32 options;
  153. caam_dma_addr_t dma_addr_in, dma_addr_out;
  154. dma_addr_in = virt_to_phys((void *)msg);
  155. dma_addr_out = virt_to_phys((void *)digest);
  156. init_job_desc(desc, 0);
  157. append_operation(desc, OP_TYPE_CLASS2_ALG |
  158. OP_ALG_AAI_HASH | OP_ALG_AS_INITFINAL |
  159. OP_ALG_ENCRYPT | OP_ALG_ICV_OFF | alg_type);
  160. options = LDST_CLASS_2_CCB | FIFOLD_TYPE_MSG | FIFOLD_TYPE_LAST2;
  161. if (sg_tbl)
  162. options |= FIFOLDST_SGF;
  163. if (msgsz > 0xffff) {
  164. options |= FIFOLDST_EXT;
  165. append_fifo_load(desc, dma_addr_in, 0, options);
  166. append_cmd(desc, msgsz);
  167. } else {
  168. append_fifo_load(desc, dma_addr_in, msgsz, options);
  169. }
  170. append_store(desc, dma_addr_out, storelen,
  171. LDST_CLASS_2_CCB | LDST_SRCDST_BYTE_CONTEXT);
  172. }
  173. #ifndef CONFIG_SPL_BUILD
  174. void inline_cnstr_jobdesc_blob_encap(uint32_t *desc, uint8_t *key_idnfr,
  175. uint8_t *plain_txt, uint8_t *enc_blob,
  176. uint32_t in_sz)
  177. {
  178. caam_dma_addr_t dma_addr_key_idnfr, dma_addr_in, dma_addr_out;
  179. uint32_t key_sz = KEY_IDNFR_SZ_BYTES;
  180. /* output blob will have 32 bytes key blob in beginning and
  181. * 16 byte HMAC identifier at end of data blob */
  182. uint32_t out_sz = in_sz + KEY_BLOB_SIZE + MAC_SIZE;
  183. dma_addr_key_idnfr = virt_to_phys((void *)key_idnfr);
  184. dma_addr_in = virt_to_phys((void *)plain_txt);
  185. dma_addr_out = virt_to_phys((void *)enc_blob);
  186. init_job_desc(desc, 0);
  187. append_key(desc, dma_addr_key_idnfr, key_sz, CLASS_2);
  188. append_seq_in_ptr(desc, dma_addr_in, in_sz, 0);
  189. append_seq_out_ptr(desc, dma_addr_out, out_sz, 0);
  190. append_operation(desc, OP_TYPE_ENCAP_PROTOCOL | OP_PCLID_BLOB);
  191. }
  192. void inline_cnstr_jobdesc_blob_decap(uint32_t *desc, uint8_t *key_idnfr,
  193. uint8_t *enc_blob, uint8_t *plain_txt,
  194. uint32_t out_sz)
  195. {
  196. caam_dma_addr_t dma_addr_key_idnfr, dma_addr_in, dma_addr_out;
  197. uint32_t key_sz = KEY_IDNFR_SZ_BYTES;
  198. uint32_t in_sz = out_sz + KEY_BLOB_SIZE + MAC_SIZE;
  199. dma_addr_key_idnfr = virt_to_phys((void *)key_idnfr);
  200. dma_addr_in = virt_to_phys((void *)enc_blob);
  201. dma_addr_out = virt_to_phys((void *)plain_txt);
  202. init_job_desc(desc, 0);
  203. append_key(desc, dma_addr_key_idnfr, key_sz, CLASS_2);
  204. append_seq_in_ptr(desc, dma_addr_in, in_sz, 0);
  205. append_seq_out_ptr(desc, dma_addr_out, out_sz, 0);
  206. append_operation(desc, OP_TYPE_DECAP_PROTOCOL | OP_PCLID_BLOB);
  207. }
  208. #endif
  209. /*
  210. * Descriptor to instantiate RNG State Handle 0 in normal mode and
  211. * load the JDKEK, TDKEK and TDSK registers
  212. */
  213. void inline_cnstr_jobdesc_rng_instantiation(u32 *desc, int handle, int do_sk)
  214. {
  215. u32 *jump_cmd;
  216. init_job_desc(desc, 0);
  217. /* INIT RNG in non-test mode */
  218. append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
  219. (handle << OP_ALG_AAI_SHIFT) | OP_ALG_AS_INIT |
  220. OP_ALG_PR_ON);
  221. /* For SH0, Secure Keys must be generated as well */
  222. if (!handle && do_sk) {
  223. /* wait for done */
  224. jump_cmd = append_jump(desc, JUMP_CLASS_CLASS1);
  225. set_jump_tgt_here(desc, jump_cmd);
  226. /*
  227. * load 1 to clear written reg:
  228. * resets the done interrupt and returns the RNG to idle.
  229. */
  230. append_load_imm_u32(desc, 1, LDST_SRCDST_WORD_CLRW);
  231. /* generate secure keys (non-test) */
  232. append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
  233. OP_ALG_RNG4_SK);
  234. }
  235. }
  236. /* Descriptor for deinstantiation of the RNG block. */
  237. void inline_cnstr_jobdesc_rng_deinstantiation(u32 *desc, int handle)
  238. {
  239. init_job_desc(desc, 0);
  240. append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG |
  241. (handle << OP_ALG_AAI_SHIFT) | OP_ALG_AS_INITFINAL);
  242. }
  243. void inline_cnstr_jobdesc_rng(u32 *desc, void *data_out, u32 size)
  244. {
  245. caam_dma_addr_t dma_data_out = virt_to_phys(data_out);
  246. init_job_desc(desc, 0);
  247. append_operation(desc, OP_ALG_ALGSEL_RNG | OP_TYPE_CLASS1_ALG |
  248. OP_ALG_PR_ON);
  249. append_fifo_store(desc, dma_data_out, size, FIFOST_TYPE_RNGSTORE);
  250. }
  251. /* Change key size to bytes form bits in calling function*/
  252. void inline_cnstr_jobdesc_pkha_rsaexp(uint32_t *desc,
  253. struct pk_in_params *pkin, uint8_t *out,
  254. uint32_t out_siz)
  255. {
  256. caam_dma_addr_t dma_addr_e, dma_addr_a, dma_addr_n, dma_addr_out;
  257. dma_addr_e = virt_to_phys((void *)pkin->e);
  258. dma_addr_a = virt_to_phys((void *)pkin->a);
  259. dma_addr_n = virt_to_phys((void *)pkin->n);
  260. dma_addr_out = virt_to_phys((void *)out);
  261. init_job_desc(desc, 0);
  262. append_key(desc, dma_addr_e, pkin->e_siz, KEY_DEST_PKHA_E | CLASS_1);
  263. append_fifo_load(desc, dma_addr_a,
  264. pkin->a_siz, LDST_CLASS_1_CCB | FIFOLD_TYPE_PK_A);
  265. append_fifo_load(desc, dma_addr_n,
  266. pkin->n_siz, LDST_CLASS_1_CCB | FIFOLD_TYPE_PK_N);
  267. append_operation(desc, OP_TYPE_PK | OP_ALG_PK | OP_ALG_PKMODE_MOD_EXPO);
  268. append_fifo_store(desc, dma_addr_out, out_siz,
  269. LDST_CLASS_1_CCB | FIFOST_TYPE_PKHA_B);
  270. }