1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright 2008-2015 Freescale Semiconductor, Inc.
4 *
5 * Command for encapsulating DEK blob
6 */
7
8 #include <common.h>
9 #include <command.h>
10 #include <log.h>
11 #include <malloc.h>
12 #include <memalign.h>
13 #include <asm/byteorder.h>
14 #include <linux/compiler.h>
15 #include <fsl_sec.h>
16 #include <asm/arch/clock.h>
17 #include <mapmem.h>
18 #include <tee.h>
19 #ifdef CONFIG_IMX_SECO_DEK_ENCAP
20 #include <firmware/imx/sci/sci.h>
21 #include <asm/mach-imx/image.h>
22 #endif
23 #include <cpu_func.h>
24
25 /**
26 * blob_dek() - Encapsulate the DEK as a blob using CAM's Key
27 * @src: - Address of data to be encapsulated
28 * @dst: - Desination address of encapsulated data
29 * @len: - Size of data to be encapsulated
30 *
31 * Returns zero on success,and negative on error.
32 */
33 #ifdef CONFIG_IMX_CAAM_DEK_ENCAP
blob_encap_dek(u32 src_addr,u32 dst_addr,u32 len)34 static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
35 {
36 u8 *src_ptr, *dst_ptr;
37
38 src_ptr = map_sysmem(src_addr, len / 8);
39 dst_ptr = map_sysmem(dst_addr, BLOB_SIZE(len / 8));
40
41 hab_caam_clock_enable(1);
42
43 u32 out_jr_size = sec_in32(CFG_SYS_FSL_JR0_ADDR +
44 FSL_CAAM_ORSR_JRa_OFFSET);
45 if (out_jr_size != FSL_CAAM_MAX_JR_SIZE)
46 sec_init();
47
48 if (!((len == 128) | (len == 192) | (len == 256))) {
49 debug("Invalid DEK size. Valid sizes are 128, 192 and 256b\n");
50 return -1;
51 }
52
53 len /= 8;
54 return blob_dek(src_ptr, dst_ptr, len);
55 }
56 #endif /* CONFIG_IMX_CAAM_DEK_ENCAP */
57
58 #ifdef CONFIG_IMX_OPTEE_DEK_ENCAP
59
60 #define PTA_DEK_BLOB_PTA_UUID {0xef477737, 0x0db1, 0x4a9d, \
61 {0x84, 0x37, 0xf2, 0xf5, 0x35, 0xc0, 0xbd, 0x92} }
62
63 #define OPTEE_BLOB_HDR_SIZE 8
64
blob_encap_dek(u32 src_addr,u32 dst_addr,u32 len)65 static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
66 {
67 struct udevice *dev = NULL;
68 struct tee_shm *shm_input, *shm_output;
69 struct tee_open_session_arg arg = {0};
70 struct tee_invoke_arg arg_func = {0};
71 const struct tee_optee_ta_uuid uuid = PTA_DEK_BLOB_PTA_UUID;
72 struct tee_param param[4] = {0};
73 int ret;
74
75 /* Get tee device */
76 dev = tee_find_device(NULL, NULL, NULL, NULL);
77 if (!dev) {
78 printf("Cannot get OP-TEE device\n");
79 return -1;
80 }
81
82 /* Set TA UUID */
83 tee_optee_ta_uuid_to_octets(arg.uuid, &uuid);
84
85 /* Open TA session */
86 ret = tee_open_session(dev, &arg, 0, NULL);
87 if (ret < 0) {
88 printf("Cannot open session with PTA Blob 0x%X\n", ret);
89 return -1;
90 }
91
92 /* Allocate shared input and output buffers for TA */
93 ret = tee_shm_register(dev, (void *)(ulong)src_addr, len / 8, 0x0, &shm_input);
94 if (ret < 0) {
95 printf("Cannot register input shared memory 0x%X\n", ret);
96 goto error;
97 }
98
99 ret = tee_shm_register(dev, (void *)(ulong)dst_addr,
100 BLOB_SIZE(len / 8) + OPTEE_BLOB_HDR_SIZE,
101 0x0, &shm_output);
102 if (ret < 0) {
103 printf("Cannot register output shared memory 0x%X\n", ret);
104 goto error;
105 }
106
107 param[0].u.memref.shm = shm_input;
108 param[0].u.memref.size = shm_input->size;
109 param[0].attr = TEE_PARAM_ATTR_TYPE_MEMREF_INPUT;
110 param[1].u.memref.shm = shm_output;
111 param[1].u.memref.size = shm_output->size;
112 param[1].attr = TEE_PARAM_ATTR_TYPE_MEMREF_OUTPUT;
113 param[2].attr = TEE_PARAM_ATTR_TYPE_NONE;
114 param[3].attr = TEE_PARAM_ATTR_TYPE_NONE;
115
116 arg_func.func = 0;
117 arg_func.session = arg.session;
118
119 /* Generate DEK blob */
120 arg_func.session = arg.session;
121 ret = tee_invoke_func(dev, &arg_func, 4, param);
122 if (ret < 0)
123 printf("Cannot generate Blob with PTA DEK Blob 0x%X\n", ret);
124
125 error:
126 /* Free shared memory */
127 tee_shm_free(shm_input);
128 tee_shm_free(shm_output);
129
130 /* Close session */
131 ret = tee_close_session(dev, arg.session);
132 if (ret < 0)
133 printf("Cannot close session with PTA DEK Blob 0x%X\n", ret);
134
135 return ret;
136 }
137 #endif /* CONFIG_IMX_OPTEE_DEK_ENCAP */
138 #ifdef CONFIG_IMX_SECO_DEK_ENCAP
139
140 #define DEK_BLOB_KEY_ID 0x0
141
142 #define AHAB_PRIVATE_KEY 0x81
143 #define AHAB_VERSION 0x00
144 #define AHAB_MODE_CBC 0x67
145 #define AHAB_ALG_AES 0x55
146 #define AHAB_128_AES_KEY 0x10
147 #define AHAB_192_AES_KEY 0x18
148 #define AHAB_256_AES_KEY 0x20
149 #define AHAB_FLAG_KEK 0x80
150 #define AHAB_DEK_BLOB 0x01
151
152 #define DEK_BLOB_HDR_SIZE 8
153 #define SECO_PT 2U
154
blob_encap_dek(u32 src_addr,u32 dst_addr,u32 len)155 static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
156 {
157 sc_err_t err;
158 sc_rm_mr_t mr_input, mr_output;
159 struct generate_key_blob_hdr hdr;
160 u8 in_size, out_size;
161 u8 *src_ptr, *dst_ptr;
162 int ret = 0;
163 int i;
164
165 /* Set sizes */
166 in_size = sizeof(struct generate_key_blob_hdr) + len / 8;
167 out_size = BLOB_SIZE(len / 8) + DEK_BLOB_HDR_SIZE;
168
169 /* Get src and dst virtual addresses */
170 src_ptr = map_sysmem(src_addr, in_size);
171 dst_ptr = map_sysmem(dst_addr, out_size);
172
173 /* Check addr input */
174 if (!(src_ptr && dst_ptr)) {
175 debug("src_addr or dst_addr invalid\n");
176 return -1;
177 }
178
179 /* Build key header */
180 hdr.version = AHAB_VERSION;
181 hdr.length_lsb = sizeof(struct generate_key_blob_hdr) + len / 8;
182 hdr.length_msb = 0x00;
183 hdr.tag = AHAB_PRIVATE_KEY;
184 hdr.flags = AHAB_DEK_BLOB;
185 hdr.algorithm = AHAB_ALG_AES;
186 hdr.mode = AHAB_MODE_CBC;
187
188 switch (len) {
189 case 128:
190 hdr.size = AHAB_128_AES_KEY;
191 break;
192 case 192:
193 hdr.size = AHAB_192_AES_KEY;
194 break;
195 case 256:
196 hdr.size = AHAB_256_AES_KEY;
197 break;
198 default:
199 /* Not supported */
200 debug("Invalid DEK size. Valid sizes are 128, 192 and 256b\n");
201 return -1;
202 }
203
204 /* Build input message */
205 memmove((void *)(src_ptr + sizeof(struct generate_key_blob_hdr)),
206 (void *)src_ptr, len / 8);
207 memcpy((void *)src_ptr, (void *)&hdr,
208 sizeof(struct generate_key_blob_hdr));
209
210 /* Flush the cache before triggering the CAAM DMA */
211 flush_dcache_range(src_addr, src_addr + in_size);
212
213 /* Find input memory region */
214 err = sc_rm_find_memreg((-1), &mr_input, src_addr & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
215 ALIGN(src_addr + in_size, CONFIG_SYS_CACHELINE_SIZE));
216 if (err) {
217 printf("Error: find memory region 0x%X\n", src_addr);
218 return -ENOMEM;
219 }
220
221 /* Find output memory region */
222 err = sc_rm_find_memreg((-1), &mr_output, dst_addr & ~(CONFIG_SYS_CACHELINE_SIZE - 1),
223 ALIGN(dst_addr + out_size, CONFIG_SYS_CACHELINE_SIZE));
224 if (err) {
225 printf("Error: find memory region 0x%X\n", dst_addr);
226 return -ENOMEM;
227 }
228
229 /* Set memory region permissions for SECO */
230 err = sc_rm_set_memreg_permissions(-1, mr_input, SECO_PT,
231 SC_RM_PERM_FULL);
232 if (err) {
233 printf("Set permission failed for input memory region\n");
234 ret = -EPERM;
235 goto error;
236 }
237
238 err = sc_rm_set_memreg_permissions(-1, mr_output, SECO_PT,
239 SC_RM_PERM_FULL);
240 if (err) {
241 printf("Set permission failed for output memory region\n");
242 ret = -EPERM;
243 goto error;
244 }
245
246 /* Flush output data before SECO operation */
247 flush_dcache_range((ulong)dst_ptr, (ulong)(dst_ptr +
248 roundup(out_size, ARCH_DMA_MINALIGN)));
249
250 /* Generate DEK blob */
251 err = sc_seco_gen_key_blob((-1), 0x0, src_addr, dst_addr, out_size);
252 if (err) {
253 ret = -EPERM;
254 goto error;
255 }
256
257 /* Invalidate output buffer */
258 invalidate_dcache_range((ulong)dst_ptr, (ulong)(dst_ptr +
259 roundup(out_size, ARCH_DMA_MINALIGN)));
260
261 printf("DEK Blob\n");
262 for (i = 0; i < DEK_BLOB_HDR_SIZE + BLOB_SIZE(len / 8); i++)
263 printf("%02X", dst_ptr[i]);
264 printf("\n");
265
266 error:
267 /* Remove memory region permission to SECO */
268 err = sc_rm_set_memreg_permissions(-1, mr_input, SECO_PT,
269 SC_RM_PERM_NONE);
270 if (err) {
271 printf("Error: remove permission failed for input\n");
272 ret = -EPERM;
273 }
274
275 err = sc_rm_set_memreg_permissions(-1, mr_output, SECO_PT,
276 SC_RM_PERM_NONE);
277 if (err) {
278 printf("Error: remove permission failed for output\n");
279 ret = -EPERM;
280 }
281
282 return ret;
283 }
284 #endif /* CONFIG_IMX_SECO_DEK_ENCAP */
285
286 /**
287 * do_dek_blob() - Handle the "dek_blob" command-line command
288 * @cmdtp: Command data struct pointer
289 * @flag: Command flag
290 * @argc: Command-line argument count
291 * @argv: Array of command-line arguments
292 *
293 * Returns zero on success, CMD_RET_USAGE in case of misuse and negative
294 * on error.
295 */
do_dek_blob(struct cmd_tbl * cmdtp,int flag,int argc,char * const argv[])296 static int do_dek_blob(struct cmd_tbl *cmdtp, int flag, int argc,
297 char *const argv[])
298 {
299 uint32_t src_addr, dst_addr, len;
300
301 if (argc != 4)
302 return CMD_RET_USAGE;
303
304 src_addr = hextoul(argv[1], NULL);
305 dst_addr = hextoul(argv[2], NULL);
306 len = dectoul(argv[3], NULL);
307
308 return blob_encap_dek(src_addr, dst_addr, len);
309 }
310
311 /***************************************************/
312 static char dek_blob_help_text[] =
313 "src dst len - Encapsulate and create blob of data\n"
314 " $len bits long at address $src and\n"
315 " store the result at address $dst.\n";
316
317 U_BOOT_CMD(
318 dek_blob, 4, 1, do_dek_blob,
319 "Data Encryption Key blob encapsulation",
320 dek_blob_help_text
321 );
322