1b9eebfadSRuchika Gupta /* 2b9eebfadSRuchika Gupta * SEC Descriptor Construction Library 3b9eebfadSRuchika Gupta * Basic job descriptor construction 4b9eebfadSRuchika Gupta * 5b9eebfadSRuchika Gupta * Copyright 2014 Freescale Semiconductor, Inc. 6b9eebfadSRuchika Gupta * 7b9eebfadSRuchika Gupta * SPDX-License-Identifier: GPL-2.0+ 8b9eebfadSRuchika Gupta * 9b9eebfadSRuchika Gupta */ 10b9eebfadSRuchika Gupta 11b9eebfadSRuchika Gupta #include <common.h> 12*0200020bSRaul Cardenas #include <fsl_sec.h> 13b9eebfadSRuchika Gupta #include "desc_constr.h" 14b9eebfadSRuchika Gupta #include "jobdesc.h" 1534276478SRuchika Gupta #include "rsa_caam.h" 16b9eebfadSRuchika Gupta 17*0200020bSRaul Cardenas #ifdef CONFIG_MX6 18*0200020bSRaul Cardenas /*! 19*0200020bSRaul Cardenas * Secure memory run command 20*0200020bSRaul Cardenas * 21*0200020bSRaul Cardenas * @param sec_mem_cmd Secure memory command register 22*0200020bSRaul Cardenas * @return cmd_status Secure memory command status register 23*0200020bSRaul Cardenas */ 24*0200020bSRaul Cardenas uint32_t secmem_set_cmd(uint32_t sec_mem_cmd) 25*0200020bSRaul Cardenas { 26*0200020bSRaul Cardenas uint32_t temp_reg; 27*0200020bSRaul Cardenas 28*0200020bSRaul Cardenas sec_out32(CAAM_SMCJR0, sec_mem_cmd); 29*0200020bSRaul Cardenas 30*0200020bSRaul Cardenas do { 31*0200020bSRaul Cardenas temp_reg = sec_in32(CAAM_SMCSJR0); 32*0200020bSRaul Cardenas } while (temp_reg & CMD_COMPLETE); 33*0200020bSRaul Cardenas 34*0200020bSRaul Cardenas return temp_reg; 35*0200020bSRaul Cardenas } 36*0200020bSRaul Cardenas 37*0200020bSRaul Cardenas /*! 38*0200020bSRaul Cardenas * CAAM page allocation: 39*0200020bSRaul Cardenas * Allocates a partition from secure memory, with the id 40*0200020bSRaul Cardenas * equal to partion_num. This will de-allocate the page 41*0200020bSRaul Cardenas * if it is already allocated. The partition will have 42*0200020bSRaul Cardenas * full access permissions. The permissions are set before, 43*0200020bSRaul Cardenas * running a job descriptor. A memory page of secure RAM 44*0200020bSRaul Cardenas * is allocated for the partition. 45*0200020bSRaul Cardenas * 46*0200020bSRaul Cardenas * @param page Number of the page to allocate. 47*0200020bSRaul Cardenas * @param partition Number of the partition to allocate. 48*0200020bSRaul Cardenas * @return 0 on success, ERROR_IN_PAGE_ALLOC otherwise 49*0200020bSRaul Cardenas */ 50*0200020bSRaul Cardenas int caam_page_alloc(uint8_t page_num, uint8_t partition_num) 51*0200020bSRaul Cardenas { 52*0200020bSRaul Cardenas uint32_t temp_reg; 53*0200020bSRaul Cardenas 54*0200020bSRaul Cardenas /* 55*0200020bSRaul Cardenas * De-Allocate partition_num if already allocated to ARM core 56*0200020bSRaul Cardenas */ 57*0200020bSRaul Cardenas if (sec_in32(CAAM_SMPO_0) & PARTITION_OWNER(partition_num)) { 58*0200020bSRaul Cardenas temp_reg = secmem_set_cmd(PARTITION(partition_num) | 59*0200020bSRaul Cardenas CMD_PART_DEALLOC); 60*0200020bSRaul Cardenas if (temp_reg & SMCSJR_AERR) { 61*0200020bSRaul Cardenas printf("Error: De-allocation status 0x%X\n", temp_reg); 62*0200020bSRaul Cardenas return ERROR_IN_PAGE_ALLOC; 63*0200020bSRaul Cardenas } 64*0200020bSRaul Cardenas } 65*0200020bSRaul Cardenas 66*0200020bSRaul Cardenas /* set the access rights to allow full access */ 67*0200020bSRaul Cardenas sec_out32(CAAM_SMAG1JR0(partition_num), 0xF); 68*0200020bSRaul Cardenas sec_out32(CAAM_SMAG2JR0(partition_num), 0xF); 69*0200020bSRaul Cardenas sec_out32(CAAM_SMAPJR0(partition_num), 0xFF); 70*0200020bSRaul Cardenas 71*0200020bSRaul Cardenas /* Now need to allocate partition_num of secure RAM. */ 72*0200020bSRaul Cardenas /* De-Allocate page_num by starting with a page inquiry command */ 73*0200020bSRaul Cardenas temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_INQUIRY); 74*0200020bSRaul Cardenas 75*0200020bSRaul Cardenas /* if the page is owned, de-allocate it */ 76*0200020bSRaul Cardenas if ((temp_reg & SMCSJR_PO) == PAGE_OWNED) { 77*0200020bSRaul Cardenas temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_PAGE_DEALLOC); 78*0200020bSRaul Cardenas if (temp_reg & SMCSJR_AERR) { 79*0200020bSRaul Cardenas printf("Error: Allocation status 0x%X\n", temp_reg); 80*0200020bSRaul Cardenas return ERROR_IN_PAGE_ALLOC; 81*0200020bSRaul Cardenas } 82*0200020bSRaul Cardenas } 83*0200020bSRaul Cardenas 84*0200020bSRaul Cardenas /* Allocate page_num to partition_num */ 85*0200020bSRaul Cardenas temp_reg = secmem_set_cmd(PAGE(page_num) | PARTITION(partition_num) 86*0200020bSRaul Cardenas | CMD_PAGE_ALLOC); 87*0200020bSRaul Cardenas if (temp_reg & SMCSJR_AERR) { 88*0200020bSRaul Cardenas printf("Error: Allocation status 0x%X\n", temp_reg); 89*0200020bSRaul Cardenas return ERROR_IN_PAGE_ALLOC; 90*0200020bSRaul Cardenas } 91*0200020bSRaul Cardenas /* page inquiry command to ensure that the page was allocated */ 92*0200020bSRaul Cardenas temp_reg = secmem_set_cmd(PAGE(page_num) | CMD_INQUIRY); 93*0200020bSRaul Cardenas 94*0200020bSRaul Cardenas /* if the page is not owned => problem */ 95*0200020bSRaul Cardenas if ((temp_reg & SMCSJR_PO) != PAGE_OWNED) { 96*0200020bSRaul Cardenas printf("Allocation of page %d in partition %d failed 0x%X\n", 97*0200020bSRaul Cardenas temp_reg, page_num, partition_num); 98*0200020bSRaul Cardenas 99*0200020bSRaul Cardenas return ERROR_IN_PAGE_ALLOC; 100*0200020bSRaul Cardenas } 101*0200020bSRaul Cardenas 102*0200020bSRaul Cardenas return 0; 103*0200020bSRaul Cardenas } 104*0200020bSRaul Cardenas 105*0200020bSRaul Cardenas int inline_cnstr_jobdesc_blob_dek(uint32_t *desc, const uint8_t *plain_txt, 106*0200020bSRaul Cardenas uint8_t *dek_blob, uint32_t in_sz) 107*0200020bSRaul Cardenas { 108*0200020bSRaul Cardenas uint32_t ret = 0; 109*0200020bSRaul Cardenas u32 aad_w1, aad_w2; 110*0200020bSRaul Cardenas /* output blob will have 32 bytes key blob in beginning and 111*0200020bSRaul Cardenas * 16 byte HMAC identifier at end of data blob */ 112*0200020bSRaul Cardenas uint32_t out_sz = in_sz + KEY_BLOB_SIZE + MAC_SIZE; 113*0200020bSRaul Cardenas /* Setting HDR for blob */ 114*0200020bSRaul Cardenas uint8_t wrapped_key_hdr[8] = {HDR_TAG, 0x00, WRP_HDR_SIZE + out_sz, 115*0200020bSRaul Cardenas HDR_PAR, HAB_MOD, HAB_ALG, in_sz, HAB_FLG}; 116*0200020bSRaul Cardenas 117*0200020bSRaul Cardenas /* initialize the blob array */ 118*0200020bSRaul Cardenas memset(dek_blob, 0, out_sz + 8); 119*0200020bSRaul Cardenas /* Copy the header into the DEK blob buffer */ 120*0200020bSRaul Cardenas memcpy(dek_blob, wrapped_key_hdr, sizeof(wrapped_key_hdr)); 121*0200020bSRaul Cardenas 122*0200020bSRaul Cardenas /* allocating secure memory */ 123*0200020bSRaul Cardenas ret = caam_page_alloc(PAGE_1, PARTITION_1); 124*0200020bSRaul Cardenas if (ret) 125*0200020bSRaul Cardenas return ret; 126*0200020bSRaul Cardenas 127*0200020bSRaul Cardenas /* Write DEK to secure memory */ 128*0200020bSRaul Cardenas memcpy((uint32_t *)SEC_MEM_PAGE1, (uint32_t *)plain_txt, in_sz); 129*0200020bSRaul Cardenas 130*0200020bSRaul Cardenas unsigned long start = (unsigned long)SEC_MEM_PAGE1 & 131*0200020bSRaul Cardenas ~(ARCH_DMA_MINALIGN - 1); 132*0200020bSRaul Cardenas unsigned long end = ALIGN(start + 0x1000, ARCH_DMA_MINALIGN); 133*0200020bSRaul Cardenas flush_dcache_range(start, end); 134*0200020bSRaul Cardenas 135*0200020bSRaul Cardenas /* Now configure the access rights of the partition */ 136*0200020bSRaul Cardenas sec_out32(CAAM_SMAG1JR0(PARTITION_1), KS_G1); /* set group 1 */ 137*0200020bSRaul Cardenas sec_out32(CAAM_SMAG2JR0(PARTITION_1), 0); /* clear group 2 */ 138*0200020bSRaul Cardenas sec_out32(CAAM_SMAPJR0(PARTITION_1), PERM); /* set perm & locks */ 139*0200020bSRaul Cardenas 140*0200020bSRaul Cardenas /* construct aad for AES */ 141*0200020bSRaul Cardenas aad_w1 = (in_sz << OP_ALG_ALGSEL_SHIFT) | KEY_AES_SRC | LD_CCM_MODE; 142*0200020bSRaul Cardenas aad_w2 = 0x0; 143*0200020bSRaul Cardenas 144*0200020bSRaul Cardenas init_job_desc(desc, 0); 145*0200020bSRaul Cardenas 146*0200020bSRaul Cardenas append_cmd(desc, CMD_LOAD | CLASS_2 | KEY_IMM | KEY_ENC | 147*0200020bSRaul Cardenas (0x0c << LDST_OFFSET_SHIFT) | 0x08); 148*0200020bSRaul Cardenas 149*0200020bSRaul Cardenas append_u32(desc, aad_w1); 150*0200020bSRaul Cardenas 151*0200020bSRaul Cardenas append_u32(desc, aad_w2); 152*0200020bSRaul Cardenas 153*0200020bSRaul Cardenas append_cmd_ptr(desc, (dma_addr_t)SEC_MEM_PAGE1, in_sz, CMD_SEQ_IN_PTR); 154*0200020bSRaul Cardenas 155*0200020bSRaul Cardenas append_cmd_ptr(desc, (dma_addr_t)dek_blob + 8, out_sz, CMD_SEQ_OUT_PTR); 156*0200020bSRaul Cardenas 157*0200020bSRaul Cardenas append_operation(desc, OP_TYPE_ENCAP_PROTOCOL | OP_PCLID_BLOB | 158*0200020bSRaul Cardenas OP_PCLID_SECMEM); 159*0200020bSRaul Cardenas 160*0200020bSRaul Cardenas return ret; 161*0200020bSRaul Cardenas } 162*0200020bSRaul Cardenas #endif 163c5de15cbSRuchika Gupta 164b9eebfadSRuchika Gupta void inline_cnstr_jobdesc_hash(uint32_t *desc, 165b9eebfadSRuchika Gupta const uint8_t *msg, uint32_t msgsz, uint8_t *digest, 166b9eebfadSRuchika Gupta u32 alg_type, uint32_t alg_size, int sg_tbl) 167b9eebfadSRuchika Gupta { 168b9eebfadSRuchika Gupta /* SHA 256 , output is of length 32 words */ 169b9eebfadSRuchika Gupta uint32_t storelen = alg_size; 170b9eebfadSRuchika Gupta u32 options; 171b9eebfadSRuchika Gupta dma_addr_t dma_addr_in, dma_addr_out; 172b9eebfadSRuchika Gupta 173b9eebfadSRuchika Gupta dma_addr_in = virt_to_phys((void *)msg); 174b9eebfadSRuchika Gupta dma_addr_out = virt_to_phys((void *)digest); 175b9eebfadSRuchika Gupta 176b9eebfadSRuchika Gupta init_job_desc(desc, 0); 177b9eebfadSRuchika Gupta append_operation(desc, OP_TYPE_CLASS2_ALG | 178b9eebfadSRuchika Gupta OP_ALG_AAI_HASH | OP_ALG_AS_INITFINAL | 179b9eebfadSRuchika Gupta OP_ALG_ENCRYPT | OP_ALG_ICV_OFF | alg_type); 180b9eebfadSRuchika Gupta 181b9eebfadSRuchika Gupta options = LDST_CLASS_2_CCB | FIFOLD_TYPE_MSG | FIFOLD_TYPE_LAST2; 182b9eebfadSRuchika Gupta if (sg_tbl) 183b9eebfadSRuchika Gupta options |= FIFOLDST_SGF; 184b9eebfadSRuchika Gupta if (msgsz > 0xffff) { 185b9eebfadSRuchika Gupta options |= FIFOLDST_EXT; 186b9eebfadSRuchika Gupta append_fifo_load(desc, dma_addr_in, 0, options); 187b9eebfadSRuchika Gupta append_cmd(desc, msgsz); 188b9eebfadSRuchika Gupta } else { 189b9eebfadSRuchika Gupta append_fifo_load(desc, dma_addr_in, msgsz, options); 190b9eebfadSRuchika Gupta } 191b9eebfadSRuchika Gupta 192b9eebfadSRuchika Gupta append_store(desc, dma_addr_out, storelen, 193b9eebfadSRuchika Gupta LDST_CLASS_2_CCB | LDST_SRCDST_BYTE_CONTEXT); 194b9eebfadSRuchika Gupta } 195c5de15cbSRuchika Gupta 196c5de15cbSRuchika Gupta void inline_cnstr_jobdesc_blob_encap(uint32_t *desc, uint8_t *key_idnfr, 197c5de15cbSRuchika Gupta uint8_t *plain_txt, uint8_t *enc_blob, 198c5de15cbSRuchika Gupta uint32_t in_sz) 199c5de15cbSRuchika Gupta { 200c5de15cbSRuchika Gupta dma_addr_t dma_addr_key_idnfr, dma_addr_in, dma_addr_out; 201c5de15cbSRuchika Gupta uint32_t key_sz = KEY_IDNFR_SZ_BYTES; 202c5de15cbSRuchika Gupta /* output blob will have 32 bytes key blob in beginning and 203c5de15cbSRuchika Gupta * 16 byte HMAC identifier at end of data blob */ 204c5de15cbSRuchika Gupta uint32_t out_sz = in_sz + KEY_BLOB_SIZE + MAC_SIZE; 205c5de15cbSRuchika Gupta 206c5de15cbSRuchika Gupta dma_addr_key_idnfr = virt_to_phys((void *)key_idnfr); 207c5de15cbSRuchika Gupta dma_addr_in = virt_to_phys((void *)plain_txt); 208c5de15cbSRuchika Gupta dma_addr_out = virt_to_phys((void *)enc_blob); 209c5de15cbSRuchika Gupta 210c5de15cbSRuchika Gupta init_job_desc(desc, 0); 211c5de15cbSRuchika Gupta 212c5de15cbSRuchika Gupta append_key(desc, dma_addr_key_idnfr, key_sz, CLASS_2); 213c5de15cbSRuchika Gupta 214c5de15cbSRuchika Gupta append_seq_in_ptr(desc, dma_addr_in, in_sz, 0); 215c5de15cbSRuchika Gupta 216c5de15cbSRuchika Gupta append_seq_out_ptr(desc, dma_addr_out, out_sz, 0); 217c5de15cbSRuchika Gupta 218c5de15cbSRuchika Gupta append_operation(desc, OP_TYPE_ENCAP_PROTOCOL | OP_PCLID_BLOB); 219c5de15cbSRuchika Gupta } 220c5de15cbSRuchika Gupta 221c5de15cbSRuchika Gupta void inline_cnstr_jobdesc_blob_decap(uint32_t *desc, uint8_t *key_idnfr, 222c5de15cbSRuchika Gupta uint8_t *enc_blob, uint8_t *plain_txt, 223c5de15cbSRuchika Gupta uint32_t out_sz) 224c5de15cbSRuchika Gupta { 225c5de15cbSRuchika Gupta dma_addr_t dma_addr_key_idnfr, dma_addr_in, dma_addr_out; 226c5de15cbSRuchika Gupta uint32_t key_sz = KEY_IDNFR_SZ_BYTES; 227c5de15cbSRuchika Gupta uint32_t in_sz = out_sz + KEY_BLOB_SIZE + MAC_SIZE; 228c5de15cbSRuchika Gupta 229c5de15cbSRuchika Gupta dma_addr_key_idnfr = virt_to_phys((void *)key_idnfr); 230c5de15cbSRuchika Gupta dma_addr_in = virt_to_phys((void *)enc_blob); 231c5de15cbSRuchika Gupta dma_addr_out = virt_to_phys((void *)plain_txt); 232c5de15cbSRuchika Gupta 233c5de15cbSRuchika Gupta init_job_desc(desc, 0); 234c5de15cbSRuchika Gupta 235c5de15cbSRuchika Gupta append_key(desc, dma_addr_key_idnfr, key_sz, CLASS_2); 236c5de15cbSRuchika Gupta 237c5de15cbSRuchika Gupta append_seq_in_ptr(desc, dma_addr_in, in_sz, 0); 238c5de15cbSRuchika Gupta 239c5de15cbSRuchika Gupta append_seq_out_ptr(desc, dma_addr_out, out_sz, 0); 240c5de15cbSRuchika Gupta 241c5de15cbSRuchika Gupta append_operation(desc, OP_TYPE_DECAP_PROTOCOL | OP_PCLID_BLOB); 242c5de15cbSRuchika Gupta } 243c5de15cbSRuchika Gupta 244c5de15cbSRuchika Gupta /* 245c5de15cbSRuchika Gupta * Descriptor to instantiate RNG State Handle 0 in normal mode and 246c5de15cbSRuchika Gupta * load the JDKEK, TDKEK and TDSK registers 247c5de15cbSRuchika Gupta */ 248c5de15cbSRuchika Gupta void inline_cnstr_jobdesc_rng_instantiation(uint32_t *desc) 249c5de15cbSRuchika Gupta { 250c5de15cbSRuchika Gupta u32 *jump_cmd; 251c5de15cbSRuchika Gupta 252c5de15cbSRuchika Gupta init_job_desc(desc, 0); 253c5de15cbSRuchika Gupta 254c5de15cbSRuchika Gupta /* INIT RNG in non-test mode */ 255c5de15cbSRuchika Gupta append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG | 256c5de15cbSRuchika Gupta OP_ALG_AS_INIT); 257c5de15cbSRuchika Gupta 258c5de15cbSRuchika Gupta /* wait for done */ 259c5de15cbSRuchika Gupta jump_cmd = append_jump(desc, JUMP_CLASS_CLASS1); 260c5de15cbSRuchika Gupta set_jump_tgt_here(desc, jump_cmd); 261c5de15cbSRuchika Gupta 262c5de15cbSRuchika Gupta /* 263c5de15cbSRuchika Gupta * load 1 to clear written reg: 264c5de15cbSRuchika Gupta * resets the done interrrupt and returns the RNG to idle. 265c5de15cbSRuchika Gupta */ 266c5de15cbSRuchika Gupta append_load_imm_u32(desc, 1, LDST_SRCDST_WORD_CLRW); 267c5de15cbSRuchika Gupta 268c5de15cbSRuchika Gupta /* generate secure keys (non-test) */ 269c5de15cbSRuchika Gupta append_operation(desc, OP_TYPE_CLASS1_ALG | OP_ALG_ALGSEL_RNG | 270c5de15cbSRuchika Gupta OP_ALG_RNG4_SK); 271c5de15cbSRuchika Gupta } 27234276478SRuchika Gupta 27334276478SRuchika Gupta /* Change key size to bytes form bits in calling function*/ 27434276478SRuchika Gupta void inline_cnstr_jobdesc_pkha_rsaexp(uint32_t *desc, 27534276478SRuchika Gupta struct pk_in_params *pkin, uint8_t *out, 27634276478SRuchika Gupta uint32_t out_siz) 27734276478SRuchika Gupta { 27834276478SRuchika Gupta dma_addr_t dma_addr_e, dma_addr_a, dma_addr_n, dma_addr_out; 27934276478SRuchika Gupta 28034276478SRuchika Gupta dma_addr_e = virt_to_phys((void *)pkin->e); 28134276478SRuchika Gupta dma_addr_a = virt_to_phys((void *)pkin->a); 28234276478SRuchika Gupta dma_addr_n = virt_to_phys((void *)pkin->n); 28334276478SRuchika Gupta dma_addr_out = virt_to_phys((void *)out); 28434276478SRuchika Gupta 28534276478SRuchika Gupta init_job_desc(desc, 0); 28634276478SRuchika Gupta append_key(desc, dma_addr_e, pkin->e_siz, KEY_DEST_PKHA_E | CLASS_1); 28734276478SRuchika Gupta 28834276478SRuchika Gupta append_fifo_load(desc, dma_addr_a, 28934276478SRuchika Gupta pkin->a_siz, LDST_CLASS_1_CCB | FIFOLD_TYPE_PK_A); 29034276478SRuchika Gupta 29134276478SRuchika Gupta append_fifo_load(desc, dma_addr_n, 29234276478SRuchika Gupta pkin->n_siz, LDST_CLASS_1_CCB | FIFOLD_TYPE_PK_N); 29334276478SRuchika Gupta 29434276478SRuchika Gupta append_operation(desc, OP_TYPE_PK | OP_ALG_PK | OP_ALG_PKMODE_MOD_EXPO); 29534276478SRuchika Gupta 29634276478SRuchika Gupta append_fifo_store(desc, dma_addr_out, out_siz, 29734276478SRuchika Gupta LDST_CLASS_1_CCB | FIFOST_TYPE_PKHA_B); 29834276478SRuchika Gupta } 299