diff options
| -rw-r--r-- | common/Makefile | 1 | ||||
| -rw-r--r-- | common/cmd_fsl_caam.c | 108 | ||||
| -rw-r--r-- | drivers/crypto/Makefile | 1 | ||||
| -rwxr-xr-x | drivers/crypto/fsl_caam.c | 459 | ||||
| -rw-r--r-- | drivers/crypto/fsl_caam_internal.h | 401 | ||||
| -rw-r--r-- | include/fsl_caam.h | 74 |
6 files changed, 1044 insertions, 0 deletions
diff --git a/common/Makefile b/common/Makefile index f97a385..f06e3a2 100644 --- a/common/Makefile +++ b/common/Makefile @@ -59,6 +59,7 @@ obj-$(CONFIG_ENV_IS_IN_UBI) += env_ubi.o obj-$(CONFIG_ENV_IS_NOWHERE) += env_nowhere.o # command +obj-$(CONFIG_CMD_FSL_CAAM_KB) += cmd_fsl_caam.o obj-$(CONFIG_CMD_AES) += cmd_aes.o obj-$(CONFIG_CMD_AMBAPP) += cmd_ambapp.o obj-$(CONFIG_CMD_ARMFLASH) += cmd_armflash.o diff --git a/common/cmd_fsl_caam.c b/common/cmd_fsl_caam.c new file mode 100644 index 0000000..1cd7af7 --- /dev/null +++ b/common/cmd_fsl_caam.c @@ -0,0 +1,108 @@ +/* + * Copyright (C) 2012-2016 Freescale Semiconductor, Inc. + * + * + * See file CREDITS for list of people who contributed to this + * project. + * + * This program is free software; you can redistribute it and/or + * modify it under the terms of the GNU General Public License as + * published by the Free Software Foundation; either version 2 of + * the License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + */ + + +#include <common.h> +#include <command.h> +#include <fsl_caam.h> + +static int do_caam(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) +{ + + int ret, i; + + if (argc < 2) + return CMD_RET_USAGE; + + if (strcmp(argv[1], "genblob") == 0) { + + if (argc != 5) + return CMD_RET_USAGE; + + void *data_addr; + void *blob_addr; + int size; + + data_addr = (void *)simple_strtoul(argv[2], NULL, 16); + blob_addr = (void *)simple_strtoul(argv[3], NULL, 16); + size = (void *)simple_strtoul(argv[4], NULL, 10); + if (size <= 48) + return CMD_RET_USAGE; + + caam_open(); + ret = caam_gen_blob((uint32_t)data_addr, (uint32_t)blob_addr, (uint32_t)size); + + if(ret != SUCCESS){ + printf("Error during blob decap operation: 0x%d\n",ret); + return 0; + } + + /* Print the generated DEK blob */ + printf("DEK blob is available at 0x%08X and equals:\n",(unsigned int)blob_addr); + for(i=0;i<size;i++) + printf("%02X ",((uint8_t *)blob_addr)[i]); + printf("\n\n"); + + + return 1; + + } + + else if (strcmp(argv[1], "decap") == 0){ + + if (argc != 5) + return CMD_RET_USAGE; + + void *blob_addr; + void *data_addr; + int size; + + blob_addr = (void *)simple_strtoul(argv[2], NULL, 16); + data_addr = (void *)simple_strtoul(argv[3], NULL, 16); + size = (void *)simple_strtoul(argv[4], NULL, 10); + if (size <= 48) + return CMD_RET_USAGE; + + caam_open(); + ret = caam_decap_blob((uint32_t)(data_addr), (uint32_t)(blob_addr), (uint32_t)size); + if(ret != SUCCESS) + printf("Error during blob decap operation: 0x%d\n",ret); + else { + printf("Success, blob decap at SM PAGE1 original data is:\n"); + int i = 0; + for (i = 0; i < size; i++) { + printf("0x%x ",*(unsigned char*)(data_addr+i)); + if (i % 16 == 0) + printf("\n"); + } + printf("\n"); + } + + return 1; + } + + return CMD_RET_USAGE; +} + +U_BOOT_CMD( + caam, 5, 1, do_caam, + "Freescale i.MX CAAM command", + "caam genblob data_addr blob_addr data_size\n \ + caam decap blobaddr data_addr data_size\n \ + \n " + ); diff --git a/drivers/crypto/Makefile b/drivers/crypto/Makefile index fb8c10b..062efdc 100644 --- a/drivers/crypto/Makefile +++ b/drivers/crypto/Makefile @@ -6,5 +6,6 @@ # obj-$(CONFIG_EXYNOS_ACE_SHA) += ace_sha.o +obj-$(CONFIG_FSL_CAAM_KB) += fsl_caam.o obj-y += rsa_mod_exp/ obj-y += fsl/ diff --git a/drivers/crypto/fsl_caam.c b/drivers/crypto/fsl_caam.c new file mode 100755 index 0000000..fa041cf --- /dev/null +++ b/drivers/crypto/fsl_caam.c @@ -0,0 +1,459 @@ +/* + * Copyright (c) 2012-2016, Freescale Semiconductor, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without modification, + * are permitted provided that the following conditions are met: + * + * o Redistributions of source code must retain the above copyright notice, this list + * of conditions and the following disclaimer. + * + * o Redistributions in binary form must reproduce the above copyright notice, this + * list of conditions and the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * + * o Neither the name of Freescale Semiconductor, Inc. nor the names of its + * contributors may be used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include <common.h> +#include <asm/io.h> +#include <asm/arch/crm_regs.h> +#include "fsl_caam_internal.h" +#include <fsl_caam.h> + +/*---------- Global variables ----------*/ +/* Input job ring - single entry input ring */ +uint32_t g_input_ring[JOB_RING_ENTRIES] = {0}; + +/* Output job ring - single entry output ring (consists of two words) */ +uint32_t g_output_ring[2*JOB_RING_ENTRIES] = {0, 0}; + +uint32_t decap_dsc[] = +{ + DECAP_BLOB_DESC1, + DECAP_BLOB_DESC2, + DECAP_BLOB_DESC3, + DECAP_BLOB_DESC4, + DECAP_BLOB_DESC5, + DECAP_BLOB_DESC6, + DECAP_BLOB_DESC7, + DECAP_BLOB_DESC8, + DECAP_BLOB_DESC9 +}; + +uint32_t encap_dsc[] = +{ + ENCAP_BLOB_DESC1, + ENCAP_BLOB_DESC2, + ENCAP_BLOB_DESC3, + ENCAP_BLOB_DESC4, + ENCAP_BLOB_DESC5, + ENCAP_BLOB_DESC6, + ENCAP_BLOB_DESC7, + ENCAP_BLOB_DESC8, + ENCAP_BLOB_DESC9 +}; + +uint32_t rng_inst_dsc[] = +{ + RNG_INST_DESC1, + RNG_INST_DESC2, + RNG_INST_DESC3, + RNG_INST_DESC4, + RNG_INST_DESC5, + RNG_INST_DESC6, + RNG_INST_DESC7, + RNG_INST_DESC8, + RNG_INST_DESC9 +}; + +static uint8_t skeymod[] = { + 0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, + 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00 +}; + +/*! + * Secure memory run command. + * + * @param sec_mem_cmd Secure memory command register + * @return cmd_status Secure memory command status register + */ +uint32_t secmem_set_cmd_1(uint32_t sec_mem_cmd) +{ + uint32_t temp_reg; + __raw_writel(sec_mem_cmd, CAAM_SMCJR0); + do { + temp_reg = __raw_readl(CAAM_SMCSJR0); + } while(temp_reg & CMD_COMPLETE); + + return temp_reg; +} + +/*! + * CAAM page allocation. + * + * @param page Number of the page to allocate. + * @param partition Number of the partition to allocate. + */ +static uint32_t caam_page_alloc(uint8_t page_num, uint8_t partition_num) +{ + uint32_t temp_reg; + + /* + * De-Allocate partition_num if already allocated to ARM core + */ + if(__raw_readl(CAAM_SMPO_0) & PARTITION_OWNER(partition_num)) + { + temp_reg = secmem_set_cmd_1(PARTITION(partition_num) | CMD_PART_DEALLOC); + if(temp_reg & SMCSJR_AERR) + { + printf("Error: De-allocation status 0x%X\n",temp_reg); + return ERROR_IN_PAGE_ALLOC; + } + } + + /* set the access rights to allow full access */ + __raw_writel(0xF, CAAM_SMAG1JR0(partition_num)); + __raw_writel(0xF, CAAM_SMAG2JR0(partition_num)); + __raw_writel(0xFF, CAAM_SMAPJR0(partition_num)); + + /* Now need to allocate partition_num of secure RAM. */ + /* De-Allocate page_num by starting with a page inquiry command */ + temp_reg = secmem_set_cmd_1(PAGE(page_num) | CMD_INQUIRY); + /* if the page is owned, de-allocate it */ + if((temp_reg & SMCSJR_PO) == PAGE_OWNED) + { + temp_reg = secmem_set_cmd_1(PAGE(page_num) | CMD_PAGE_DEALLOC); + if(temp_reg & SMCSJR_AERR) + { + printf("Error: Allocation status 0x%X\n",temp_reg); + return ERROR_IN_PAGE_ALLOC; + } + } + + /* Allocate page_num to partition_num */ + temp_reg = secmem_set_cmd_1(PAGE(page_num) | PARTITION(partition_num) + | CMD_PAGE_ALLOC); + if(temp_reg & SMCSJR_AERR) + { + printf("Error: Allocation status 0x%X\n",temp_reg); + return ERROR_IN_PAGE_ALLOC; + } + /* page inquiry command to ensure that the page was allocated */ + temp_reg = secmem_set_cmd_1(PAGE(page_num) | CMD_INQUIRY); + /* if the page is not owned => problem */ + if((temp_reg & SMCSJR_PO) != PAGE_OWNED) + { + printf("Error: Allocation of page %d in partition %d failed 0x%X\n" + ,temp_reg, page_num, partition_num); + + return ERROR_IN_PAGE_ALLOC; + } + + return SUCCESS; +} + +/*! + * Use CAAM to decapsulate a blob to secure memory. + * Such blob of secret key cannot be read once decrypted, + * but can still be used for enc/dec operation of user's data. + * + * @param blob_addr Location address of the blob. + * + * @return SUCCESS or ERROR_XXX + */ +uint32_t caam_decap_blob(uint32_t plain_text, uint32_t blob_addr, uint32_t size) +{ + uint32_t ret = SUCCESS; + + /* Buffer that holds blob */ + uint8_t *blob = (uint8_t *)blob_addr; + + /**** Prepare partition and page, and start the job to create the blob ***/ +#if 0 + ret = caam_page_alloc(PAGE_1, PARTITION_1); + if(ret != SUCCESS) + return ret; + + /* Now configure the access rights of the partition */ + __raw_writel(KS_G1, CAAM_SMAG1JR0(PARTITION_1)); // set group 1 + __raw_writel(0, CAAM_SMAG2JR0(PARTITION_1)); // clear group 2 + __raw_writel(PERM, CAAM_SMAPJR0(PARTITION_1)); // set permissions & locks +#endif + + /* TODO: Fix Hardcoded Descriptor */ + decap_dsc[0] = (uint32_t)0xB0800008; + decap_dsc[1] = (uint32_t)0x14400010; + decap_dsc[2] = (uint32_t)skeymod; + decap_dsc[3] = (uint32_t)0xF0000000 | (0x0000ffff & (size+48) ); + decap_dsc[4] = blob_addr; + decap_dsc[5] = (uint32_t)0xF8000000 | (0x0000ffff & (size)); + decap_dsc[6] = (uint32_t)(uint8_t*)plain_text; + decap_dsc[7] = (uint32_t)0x860D0000; + +// uncomment when using descriptor from "fsl_caam_internal.h" +// does not use key modifier. +#if 0 + /* Fill in input blob addr in decap_dsc */ + decap_dsc[5] = (uint32_t)blob; + /* Fill in the address where to decrypt the blob */ + decap_dsc[7] = (uint32_t)SEC_MEM_PAGE1; +#endif + + /* Run descriptor with result written to blob buffer */ + /* Add job to input ring */ + g_input_ring[0] = (uint32_t)decap_dsc; + + flush_dcache_range((uint32_t)blob_addr & 0xffffffe0, ((uint32_t)blob_addr & 0xffffffe0) + 2*size); + flush_dcache_range((uint32_t)plain_text& 0xffffffe0, ((uint32_t)plain_text& 0xffffffe0) + 2*size); + flush_dcache_range((uint32_t)decap_dsc & 0xffffffe0, ((uint32_t)decap_dsc & 0xffffffe0) + 128); + flush_dcache_range((uint32_t)g_input_ring & 0xffffffe0, ((uint32_t)g_input_ring & 0xffffffe0) + 128); + /* Increment jobs added */ + __raw_writel(1, CAAM_IRJAR0); + + /* Wait for job ring to complete the job: 1 completed job expected */ + while(__raw_readl(CAAM_ORSFR0) != 1); + + // TODO: check if Secure memory is cacheable. + invalidate_dcache_range((uint32_t)g_output_ring & 0xffffffe0, ((uint32_t)g_output_ring & 0xffffffe0) + 128); + /* check that descriptor address is the one expected in the output ring */ + if(g_output_ring[0] == (uint32_t)decap_dsc) + { + /* check if any error is reported in the output ring */ + if ((g_output_ring[1] & JOB_RING_STS) != 0) + { + printf("Error: blob decap job completed with errors 0x%X\n", + g_output_ring[1]); + } + } + else + { + printf("Error: blob decap job output ring descriptor address does" \ + " not match\n"); + } + flush_dcache_range((uint32_t)plain_text& 0xffffffe0, ((uint32_t)plain_text& 0xffffffe0) + 2*size); + + + /* Remove job from Job Ring Output Queue */ + __raw_writel(1, CAAM_ORJRR0); + + return ret; +} + +/*! + * Use CAAM to generate a blob. + * + * @param plain_data_addr Location address of the plain data. + * @param blob_addr Location address of the blob. + * + * @return SUCCESS or ERROR_XXX + */ +uint32_t caam_gen_blob(uint32_t plain_data_addr, uint32_t blob_addr, uint32_t size) +{ + uint32_t ret = SUCCESS; + uint32_t addr; + + /* Buffer to hold the resulting blob */ + uint8_t *blob = (uint8_t *)blob_addr; + + /* initialize the blob array */ + memset(blob,0,size); + + /**** Prepare partition and page, and start the job to create the blob ***/ +#if 0 + ret = caam_page_alloc(PAGE_1, PARTITION_1); + if(ret != SUCCESS) + return ret; + + /* Write the DEK to the partition. */ + memcpy((uint32_t*)SEC_MEM_PAGE1, (uint32_t*)plain_data_addr, size); + + /* Now configure the access rights of the partition */ + // __raw_writel(KS_G1, CAAM_SMAG1JR0(PARTITION_1)); // set group 1 + // __raw_writel(0, CAAM_SMAG2JR0(PARTITION_1)); // clear group 2 + // __raw_writel(PERM, CAAM_SMAPJR0(PARTITION_1)); // set permissions & locks +#endif + + /* TODO: Fix Hardcoded Descriptor */ + encap_dsc[0] = (uint32_t)0xB0800008; + encap_dsc[1] = (uint32_t)0x14400010; + encap_dsc[2] = (uint32_t)skeymod; + encap_dsc[3] = (uint32_t)0xF0000000 | (0x0000ffff & (size)); + encap_dsc[4] = (uint32_t)plain_data_addr; + encap_dsc[5] = (uint32_t)0xF8000000 | (0x0000ffff & (size+48)); + encap_dsc[6] = (uint32_t)blob; + encap_dsc[7] = (uint32_t)0x870D0000; + + // uncomment when using descriptor from "fsl_caam_internal.h" + // does not use key modifier. +#if 0 + // + /* Fill in the address where the DEK resides */ + encap_dsc[5] = (uint32_t)SEC_MEM_PAGE1; + /* Fill in output blob addr in encap_dsc */ + encap_dsc[7] = (uint32_t)blob; +#endif + + /* Run descriptor with result written to blob buffer */ + /* Add job to input ring */ + g_input_ring[0] = (uint32_t)encap_dsc; + + flush_dcache_range((uint32_t)plain_data_addr& 0xffffffe0, ((uint32_t)plain_data_addr& 0xffffffe0) + size); + flush_dcache_range((uint32_t)encap_dsc & 0xffffffe0, ((uint32_t)encap_dsc & 0xffffffe0) + 128); + flush_dcache_range((uint32_t)blob & 0xffffffe0, ((uint32_t)g_input_ring & 0xffffffe0) + 2 * size); + /* Increment jobs added */ + __raw_writel(1, CAAM_IRJAR0); + + /* Wait for job ring to complete the job: 1 completed job expected */ + while(__raw_readl(CAAM_ORSFR0) != 1); + + // flush cache + invalidate_dcache_range((uint32_t)g_output_ring & 0xffffffe0, ((uint32_t)g_output_ring & 0xffffffe0) + 128); + invalidate_dcache_range((uint32_t)g_output_ring & 0xffffffe0, ((uint32_t)g_output_ring & 0xffffffe0) + 128); + /* check that descriptor address is the one expected in the output ring */ + if(g_output_ring[0] == (uint32_t)encap_dsc) + { + /* check if any error is reported in the output ring */ + if ((g_output_ring[1] & JOB_RING_STS) != 0) + { + printf("Error: blob encap job completed with errors 0x%X\n", + g_output_ring[1]); + } + } + else + { + printf("Error: blob encap job output ring descriptor address does" \ + " not match\n"); + } + + /* Remove job from Job Ring Output Queue */ + __raw_writel(1, CAAM_ORJRR0); + + return ret; +} + +/*! + * Initialize the CAAM. + * + */ +void caam_open(void) +{ + struct mxc_ccm_reg *mxc_ccm = (struct mxc_ccm_reg *)CCM_BASE_ADDR; + uint32_t temp_reg; + //uint32_t addr; + + /* switch on the clock */ + temp_reg = __raw_readl(&mxc_ccm->CCGR0); + temp_reg |= MXC_CCM_CCGR0_CAAM_SECURE_MEM_MASK | + MXC_CCM_CCGR0_CAAM_WRAPPER_ACLK_MASK | + MXC_CCM_CCGR0_CAAM_WRAPPER_IPG_MASK; + __raw_writel(temp_reg, &mxc_ccm->CCGR0); + + /* MID for CAAM - already done by HAB in ROM during preconfigure, + * That is JROWN for JR0/1 = 1 (TZ, Secure World, ARM) + * JRNSMID and JRSMID for JR0/1 = 2 (TZ, Secure World, CAAM) + * + * However, still need to initialize Job Rings as these are torn + * down by HAB for each command + */ + + /* Initialize job ring addresses */ + __raw_writel((uint32_t)g_input_ring, CAAM_IRBAR0); // input ring address + __raw_writel((uint32_t)g_output_ring, CAAM_ORBAR0); // output ring address + + /* Initialize job ring sizes to 1 */ + __raw_writel(JOB_RING_ENTRIES, CAAM_IRSR0); + __raw_writel(JOB_RING_ENTRIES, CAAM_ORSR0); + + /* HAB disables interrupts for JR0 so do the same here */ + temp_reg = __raw_readl(CAAM_JRCFGR0_LS) | JRCFG_LS_IMSK; + __raw_writel(temp_reg, CAAM_JRCFGR0_LS); + + /********* Initialize and instantiate the RNG *******************/ + /* if RNG already instantiated then skip it */ + if ((__raw_readl(CAAM_RDSTA) & RDSTA_IF0) != RDSTA_IF0) + { + /* Enter TRNG Program mode */ + __raw_writel(RTMCTL_PGM, CAAM_RTMCTL); + + /* Set OSC_DIV field to TRNG */ + temp_reg = __raw_readl(CAAM_RTMCTL) | (RNG_TRIM_OSC_DIV << 2); + __raw_writel(temp_reg, CAAM_RTMCTL); + + /* Set delay */ + __raw_writel(((RNG_TRIM_ENT_DLY << 16) | 0x09C4), CAAM_RTSDCTL); + __raw_writel((RNG_TRIM_ENT_DLY >> 1), CAAM_RTFRQMIN); + __raw_writel((RNG_TRIM_ENT_DLY << 4), CAAM_RTFRQMAX); + + /* Resume TRNG Run mode */ + temp_reg = __raw_readl(CAAM_RTMCTL) ^ RTMCTL_PGM; + __raw_writel(temp_reg, CAAM_RTMCTL); + + /* Clear the ERR bit in RTMCTL if set. The TRNG error can occur when the + * RNG clock is not within 1/2x to 8x the system clock. + * This error is possible if ROM code does not initialize the system PLLs + * immediately after PoR. + */ + temp_reg = __raw_readl(CAAM_RTMCTL) | RTMCTL_ERR; + __raw_writel(temp_reg, CAAM_RTMCTL); + + /* Run descriptor to instantiate the RNG */ + /* Add job to input ring */ + g_input_ring[0] = (uint32_t)rng_inst_dsc; + + flush_dcache_range((uint32_t)g_input_ring & 0xffffffe0, ((uint32_t)g_input_ring & 0xffffffe0) + 128); + /* Increment jobs added */ + __raw_writel(1, CAAM_IRJAR0); + + /* Wait for job ring to complete the job: 1 completed job expected */ + while(__raw_readl(CAAM_ORSFR0) != 1); + + + invalidate_dcache_range((uint32_t)g_output_ring & 0xffffffe0, ((uint32_t)g_output_ring & 0xffffffe0) + 128); + + /* check that descriptor address is the one expected in the out ring */ + if(g_output_ring[0] == (uint32_t)rng_inst_dsc) + { + /* check if any error is reported in the output ring */ + if ((g_output_ring[1] & JOB_RING_STS) != 0) + { + printf("Error: RNG instantiation errors g_output_ring[1]: 0x%X\n" + , g_output_ring[1]); + printf("RTMCTL 0x%X\n", __raw_readl(CAAM_RTMCTL)); + printf("RTSTATUS 0x%X\n", __raw_readl(CAAM_RTSTATUS)); + printf("RTSTA 0x%X\n", __raw_readl(CAAM_RDSTA)); + } + } + else + { + printf("Error: RNG job output ring descriptor address does " \ + "not match: 0x%X != 0x%X \n", g_output_ring[0], rng_inst_dsc[0]); + } + + /* ensure that the RNG was correctly instantiated */ + temp_reg = __raw_readl(CAAM_RDSTA); + if (temp_reg != (RDSTA_IF0 | RDSTA_SKVN)) + { + + printf("Error: RNG instantiation failed 0x%X\n", temp_reg); + } + + /* Remove job from Job Ring Output Queue */ + __raw_writel(1, CAAM_ORJRR0); + } + + return; +} diff --git a/drivers/crypto/fsl_caam_internal.h b/drivers/crypto/fsl_caam_internal.h new file mode 100644 index 0000000..755cad8 --- /dev/null +++ b/drivers/crypto/fsl_caam_internal.h @@ -0,0 +1,401 @@ +/* + * Copyright (c) 2012-2016, Freescale Semiconductor, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without modification, + * are permitted provided that the following conditions are met: + * + * o Redistributions of source code must retain the above copyright notice, this list + * of conditions and the following disclaimer. + * + * o Redistributions in binary form must reproduce the above copyright notice, this + * list of conditions and the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * + * o Neither the name of Freescale Semiconductor, Inc. nor the names of its + * contributors may be used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef __CAAM_INTERNAL_H__ +#define __CAAM_INTERNAL_H__ + +/* 4kbyte pages */ +#define CAAM_SEC_RAM_START_ADDR CAAM_ARB_BASE_ADDR + +#define SEC_MEM_PAGE0 CAAM_SEC_RAM_START_ADDR +#define SEC_MEM_PAGE1 (CAAM_SEC_RAM_START_ADDR + 0x1000) +#define SEC_MEM_PAGE2 (CAAM_SEC_RAM_START_ADDR + 0x2000) +#define SEC_MEM_PAGE3 (CAAM_SEC_RAM_START_ADDR + 0x3000) + +/* Configuration and special key registers */ +#define CAAM_MCFGR CAAM_BASE_ADDR + 0x0004 +#define CAAM_SCFGR CAAM_BASE_ADDR + 0x000c +#define CAAM_JR0MIDR CAAM_BASE_ADDR + 0x0010 +#define CAAM_JR1MIDR CAAM_BASE_ADDR + 0x0018 +#define CAAM_DECORR CAAM_BASE_ADDR + 0x009c +#define CAAM_DECO0MID CAAM_BASE_ADDR + 0x00a0 +#define CAAM_DAR CAAM_BASE_ADDR + 0x0120 +#define CAAM_DRR CAAM_BASE_ADDR + 0x0124 +#define CAAM_JDKEKR CAAM_BASE_ADDR + 0x0400 +#define CAAM_TDKEKR CAAM_BASE_ADDR + 0x0420 +#define CAAM_TDSKR CAAM_BASE_ADDR + 0x0440 +#define CAAM_SKNR CAAM_BASE_ADDR + 0x04e0 +#define CAAM_SMSTA CAAM_BASE_ADDR + 0x0FB4 +#define CAAM_STA CAAM_BASE_ADDR + 0x0FD4 +#define CAAM_SMPO_0 CAAM_BASE_ADDR + 0x1FBC + +/* RNG registers */ +#define CAAM_RTMCTL CAAM_BASE_ADDR + 0x0600 +#define CAAM_RTSDCTL CAAM_BASE_ADDR + 0x0610 +#define CAAM_RTFRQMIN CAAM_BASE_ADDR + 0x0618 +#define CAAM_RTFRQMAX CAAM_BASE_ADDR + 0x061C +#define CAAM_RTSTATUS CAAM_BASE_ADDR + 0x063C +#define CAAM_RDSTA CAAM_BASE_ADDR + 0x06C0 + +/* Job Ring 0 registers */ +#define CAAM_IRBAR0 CAAM_BASE_ADDR + 0x1004 +#define CAAM_IRSR0 CAAM_BASE_ADDR + 0x100c +#define CAAM_IRSAR0 CAAM_BASE_ADDR + 0x1014 +#define CAAM_IRJAR0 CAAM_BASE_ADDR + 0x101c +#define CAAM_ORBAR0 CAAM_BASE_ADDR + 0x1024 +#define CAAM_ORSR0 CAAM_BASE_ADDR + 0x102c +#define CAAM_ORJRR0 CAAM_BASE_ADDR + 0x1034 +#define CAAM_ORSFR0 CAAM_BASE_ADDR + 0x103c +#define CAAM_JRSTAR0 CAAM_BASE_ADDR + 0x1044 +#define CAAM_JRINTR0 CAAM_BASE_ADDR + 0x104c +#define CAAM_JRCFGR0_MS CAAM_BASE_ADDR + 0x1050 +#define CAAM_JRCFGR0_LS CAAM_BASE_ADDR + 0x1054 +#define CAAM_IRRIR0 CAAM_BASE_ADDR + 0x105c +#define CAAM_ORWIR0 CAAM_BASE_ADDR + 0x1064 +#define CAAM_JRCR0 CAAM_BASE_ADDR + 0x106c +#define CAAM_SMCJR0 CAAM_BASE_ADDR + 0x10f4 +#define CAAM_SMCSJR0 CAAM_BASE_ADDR + 0x10fc +#define CAAM_SMAPJR0(y) (CAAM_BASE_ADDR + 0x1104 + y*16) +#define CAAM_SMAG2JR0(y) (CAAM_BASE_ADDR + 0x1108 + y*16) +#define CAAM_SMAG1JR0(y) (CAAM_BASE_ADDR + 0x110C + y*16) +#define CAAM_SMAPJR0_PRTN1 CAAM_BASE_ADDR + 0x1114 +#define CAAM_SMAG2JR0_PRTN1 CAAM_BASE_ADDR + 0x1118 +#define CAAM_SMAG1JR0_PRTN1 CAAM_BASE_ADDR + 0x111c +#define CAAM_SMPO CAAM_BASE_ADDR + 0x1fbc + +#define JRCFG_LS_IMSK 0x00000001 /* Interrupt Mask */ +#define JR_MID 2 /* Matches ROM configuration */ +#define KS_G1 (1 << JR_MID) /* CAAM only */ +#define PERM 0x0000B008 /* Clear on release, + * lock SMAP + * lock SMAG + * group 1 Blob + */ + +#define CMD_PAGE_ALLOC 0x1 +#define CMD_PAGE_DEALLOC 0x2 +#define CMD_PART_DEALLOC 0x3 +#define CMD_INQUIRY 0x5 +#define PAGE(x) (x << 16) +#define PARTITION(x) (x << 8) + +#define SMCSJR_AERR (3 << 12) +#define SMCSJR_CERR (3 << 14) +#define CMD_COMPLETE (3 << 14) + +#define SMCSJR_PO (3 << 6) +#define PAGE_AVAILABLE 0 +#define PAGE_OWNED (3 << 6) + +#define PARTITION_OWNER(x) (0x3 << (x*2)) + +#define CAAM_BUSY_MASK 0x00000001 /* BUSY from status reg */ +#define CAAM_IDLE_MASK 0x00000002 /* IDLE from status reg */ + +#define JOB_RING_ENTRIES 1 +#define JOB_RING_STS (0xF << 28) + +/** OSC_DIV in RNG trim fuses */ +#define RNG_TRIM_OSC_DIV 0 +/** ENT_DLY multiplier in RNG trim fuses */ +//#define RNG_TRIM_ENT_DLY 200*4 +#define RNG_TRIM_ENT_DLY 3200 + +#define RTMCTL_PGM (1 << 16) +#define RTMCTL_ERR (1 << 12) +#define RDSTA_IF0 1 +#define RDSTA_SKVN (1 << 30) + +typedef enum { + PAGE_0, + PAGE_1, + PAGE_2, + PAGE_3, +} page_num_e; + +typedef enum { + PARTITION_0, + PARTITION_1, + PARTITION_2, + PARTITION_3, + PARTITION_4, + PARTITION_5, + PARTITION_6, + PARTITION_7, +} partition_num_e; + +/***************************************** + *----- Blob decapsulate descriptor -----* + *****************************************/ +/* 1. Header + * + * 1011 0000 1000 0000 0000 0000 0000 1001 + * |||| | |||| + * ++++-+-- Header ++++-- 9 words in descriptor + */ +#define DECAP_BLOB_DESC1 0xB0800009 + +/* 2. Load command KEY 2 immediate + * + * 0001 0100 1100 0000 0000 1100 0000 1000 + * |||| ||| |||| |||| |||| |||| |||| |||| + * |||| ||| |||| |||| |||| |||| ++++-++++-- Length + * |||| ||| |||| |||| ++++-++++-- Offset + * |||| ||| |+++-++++-- DST (Destination Register) Key2 + * |||| ||| +-- IMM (Immediate flag) + * |||| |++-- class 2 + * ++++-+-- Load command + */ +#define DECAP_BLOB_DESC2 0x14C00C08 + +/* 3. 8 bytes for load command above - aad data + * + * 0000 0000 0001 0000 0101 0101 0110 0110 + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| |||| |||| ++++-++++-- CCM Mode + * |||| |||| |||| |||| ++++-++++-- AES + * |||| |||| ++++-++++-- Length + * ++++-++++-- Flag + */ +#define DECAP_BLOB_DESC3 0x00105566 +#define DECAP_BLOB_DESC4 0x00000000 + +/* 5. SEQ In Ptr + * + * 1111 0000 0000 0000 0000 0000 0100 0000 + * |||| | |||| |||| |||| |||| + * |||| | ++++-++++-++++-++++-- Length in bytes (64) + * ++++-+-- Seq In Ptr + */ +#define DECAP_BLOB_DESC5 0xF0000400 +//#define DECAP_BLOB_DESC5 0xF0000040 + +/* 6. Pointer for above SEQ In ptr command */ +/* Address is provided during run time */ +#define DECAP_BLOB_DESC6 0x00000000 + +/* 7. SEQ Out Ptr + * + * 1111 1000 0000 0000 0000 0000 0001 0000 + * |||| | |||| |||| |||| |||| + * |||| | ++++-++++-++++-++++-- Length in bytes (16) + * ++++-+-- Seq In Ptr + */ +#define DECAP_BLOB_DESC7 0xF80003d0 +//#define DECAP_BLOB_DESC7 0xF8000010 + +/* 8. Pointer for above SEQ Out ptr command */ +/* Address could be changed during run time */ +#define DECAP_BLOB_DESC8 SEC_MEM_PAGE1 + +/* 9. Protocol + * + * 1000 0110 0000 1101 0000 0000 0000 1000 + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| ++++-++++-++++-++++-- Proto Info = sec mem blob + * |||| |||| ++++-++++-- Protocol ID = Blob + * |||| |+++-- Optype - decapsulation protocol + * ++++-+-- Seq In Ptr + */ +#define DECAP_BLOB_DESC9 0x860D0008 + +/***************************************** + *----- Blob encapsulate descriptor -----* + *****************************************/ +/* Blob Header + * + * 1011 0000 1000 0000 0000 0000 0000 1001 + * |||| | | + * ++++-+-- Header +-- 9 words in descriptor + */ +#define ENCAP_BLOB_DESC1 0xB0800009 + +/* 2. Load command KEY 2 immediate + * + * 0001 0100 1100 0000 0000 1100 0000 1000 + * |||| ||| |||| |||| |||| |||| |||| |||| + * |||| ||| |||| |||| |||| |||| ++++-++++-- Length + * |||| ||| |||| |||| ++++-++++-- Offset + * |||| ||| |+++-++++-- DST (Destination Register) Key2 + * |||| ||| +-- IMM (Immediate flag) + * |||| |++-- class 2 + * ++++-+-- Load command + */ +#define ENCAP_BLOB_DESC2 0x14C00C08 + +/* 3. 8 bytes for load command above - aad data + * + * 0000 0000 0001 0000 0101 0101 0110 0110 + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| |||| |||| ++++-++++-- CCM Mode + * |||| |||| |||| |||| ++++-++++-- AES + * |||| |||| ++++-++++-- Length + * ++++-++++-- Flag + */ +#define ENCAP_BLOB_DESC3 0x00105566 +#define ENCAP_BLOB_DESC4 0x00000000 + +/* 5. SEQ In Ptr + * + * 1111 0000 0000 0000 0000 0000 0001 0000 + * |||| | |||| |||| |||| |||| + * |||| | ++++-++++-++++-++++-- Length in bytes (16) + * ++++-+-- Seq In Ptr + */ +#define ENCAP_BLOB_DESC5 0xF00003d0 +//#define ENCAP_BLOB_DESC5 0xF0000010 + +/* 6. Pointer for above SEQ In ptr command */ +/* Address could be changed during run time */ +#define ENCAP_BLOB_DESC6 SEC_MEM_PAGE1 + +/* 7. SEQ Out Ptr + * + * 1111 1000 0000 0000 0000 0000 0100 0000 + * |||| | |||| |||| |||| |||| + * |||| | ++++-++++-++++-++++-- Length in bytes (64) + * ++++-+-- Seq Out Ptr + */ +#define ENCAP_BLOB_DESC7 0xF8000400 +//#define ENCAP_BLOB_DESC7 0xF8000040 + +/* 8. Pointer for above SEQ Out ptr command */ +/* Address is provided during run time */ +#define ENCAP_BLOB_DESC8 0x00000000 + +/* 9. Protocol + * + * 1000 0111 0000 1101 0000 0000 0000 1000 + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| ++++-++++-++++-++++-- Proto Info = sec mem blob + * |||| |||| ++++-++++-- Protocol ID = Blob + * |||| |+++-- Optype - encapsulation protocol + * ++++-+-- Seq In Ptr + */ +#define ENCAP_BLOB_DESC9 0x870D0008 + +/**************************************** + *----- Data encryption descriptor -----* + ****************************************/ +/* 1. Header + * + * 1011 0000 1000 0000 0000 0000 0000 1000 + * |||| | | |||| + * ++++-+-- Header +-++++-- 8 words in descriptor + */ +#define ENCRYPT_DESC1 0xB0800008 + +/* 2. Load AES-128 key from secure memory + * + * 0010 0010 0000 0000 0000 0000 0001 0000 + * |||| | | |||| |||| |||| |||| + * |||| | | ++++-++++-++++-++++-- 16 bytes + * |||| | +-- Load FIFO with data for Class 1 CHA + * ++++-+-- FIFO Load + */ +#define ENCRYPT_DESC2 0x02200010 + +/* 3. Pointer to key data in secure memory */ +/* Address is provided during run time */ +#define ENCRYPT_DESC3 0x00000000 + +/* 4. Algorith Operation - Decrypt with ECB mode + * + * 1000 0010 0001 0000 0000 0010 0000 1101 + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| |||| |||| |||| |||+-- Encrypt + * |||| |||| |||| |||| |||| |||| |||| ++-- Initialize/Finalize + * |||| |||| |||| |||| ---+-++++-++++-- ECB mode + * |||| |||| ++++-++++-- AES + * |||| |+++-- Optype: Class 1 algorithm + * ++++-+-- ALGORITHM OP. + */ +#define ENCRYPT_DESC4 0x8210020D + +/* 5. Load 16 bytes of message data + * + * 0010 0010 0001 0010 0000 0000 0001 0000 + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| ++++-++++-++++-++++-- Msg Length = 16Bytes + * |||| |||| ||++-++++-- Input data type: Msg data LC1=1 + * |||| |||| |+-- EXT: No extended length + * |||| |||| +-- IMM: data begins at the location pointed to by the next word + * |||| |||++-SGT/VLF: FIFO Load-Pointer points to actual data + * |||| |++-- Load FIFO with data for Class 1 CHA + * ++++-+-- FIFO Load + */ +#define ENCRYPT_DESC5 0x22120010 + +/* 6. Pointer to plain text test vector message */ +/* Address is provided during run time */ +#define ENCRYPT_DESC6 0x00000000 + +/* 7. FIFO STORE - encrypted result. + * 0110 0000 0011 0000 0000 0000 0001 0000 + * |||| |||| |||| |||| |||| |||| |||| |||| + * |||| |||| |||| |||| ++++-++++-++++-++++-- Length = 16Bytes + * |||| |||| ||++-++++-- Output data type: Msg Data + * |||| |||| |+-- EXT: No extended length + * |||| |||| +-- CONT: No continue + * |||| |||+-- SGT/VLF: Pointer points to actual data + * |||| |++-- AUX: None + * ++++-+-- FIFO Store + */ +#define ENCRYPT_DESC7 0x60300010 + +/* 8. Pointer to ciphered text buffer */ +/* Address is provided during run time */ +#define ENCRYPT_DESC8 0x00000000 + +/********************************************************************* + *----- Descriptor to instantiate RNG in non-deterministic mode -----* + *********************************************************************/ +// Header +#define RNG_INST_DESC1 0xB0800009 +// Class 1 context load for personalization string, 8bytes +#define RNG_INST_DESC2 0x12A00008 +// 8 bytes of personalization string (8-byte UID + zeros) +#define RNG_INST_DESC3 0x01020304 +#define RNG_INST_DESC4 0x05060708 +// Instantiate State Handle 0 using entropy from TRNG +// without prediction resistance +#define RNG_INST_DESC5 0x82500404 +// Wait for Class 1 done +#define RNG_INST_DESC6 0xA2000001 +// Immediate 4 byte load to clear written register +#define RNG_INST_DESC7 0x10880004 +// Clear primary mode bit +#define RNG_INST_DESC8 0x00000001 +// Generate secure keys without prediction resistance +#define RNG_INST_DESC9 0x82501000 + +#endif /* __CAAM_INTERNAL_H__ */ diff --git a/include/fsl_caam.h b/include/fsl_caam.h new file mode 100644 index 0000000..d282a33 --- /dev/null +++ b/include/fsl_caam.h @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2012-2016, Freescale Semiconductor, Inc. + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without modification, + * are permitted provided that the following conditions are met: + * + * o Redistributions of source code must retain the above copyright notice, this list + * of conditions and the following disclaimer. + * + * o Redistributions in binary form must reproduce the above copyright notice, this + * list of conditions and the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * + * o Neither the name of Freescale Semiconductor, Inc. nor the names of its + * contributors may be used to endorse or promote products derived from this + * software without specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND + * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#ifndef __CAAM_H__ +#define __CAAM_H__ + +//! @name Error codes +//@{ +#if !defined(SUCCESS) +#define SUCCESS (0) +#endif + +#define ERROR_IN_PAGE_ALLOC (1) + + +//////////////////////////////////////////////////////////////////////////////// +//! @brief Enable and initialize the CAAM driver. +//! +//! This function enables the clock to the CAAM. It initializes the RNG, and +//! instantiate it to allow generation of key for blob. +//! +//////////////////////////////////////////////////////////////////////////////// +void caam_open(void); + +//////////////////////////////////////////////////////////////////////////////// +//! @brief Generate a blob of a secure key. +//! +//! @param[in] plain_data_addr Location address of the plain text data. +//! @param[in] blob_addr Location address of the blob. +//! @param[in] size Size in bytes of the data to encrypt. +//! +//! @return SUCCESS +//! @return ERROR_XXX +//////////////////////////////////////////////////////////////////////////////// +uint32_t caam_gen_blob(uint32_t plain_data_addr, uint32_t blob_addr, uint32_t size); + +//////////////////////////////////////////////////////////////////////////////// +//! @brief Decapsulate a blob of a secure key. +//! +//! @param[in] blob_addr Location address of the blob. +//! +//! @return SUCCESS +//! @return ERROR_XXX +//////////////////////////////////////////////////////////////////////////////// +uint32_t caam_decap_blob(uint32_t plain_text, uint32_t blob_addr, uint32_t size); + +#endif /* __CAAM_H__ */ |