Eric Lee / smarc-uboot

23 May, 2018

4 commits

27 Apr, 2018

2 commits

  • fe33f7296   MLK-17915: cmd: blob: Instantiate RNG before running CMD_BLOB ... Browse Code »
    13

    U-Boot can instantiate CAAM RNG if needed by crypto operations.
    Call sec_init() prior running a blob operation to ensure
    RNG is correctly instantiated.

    Make sure CAAM clock is enabled and check if a job ring is
    available for that operation.

    Signed-off-by: Breno Lima
    Reviewed-by: Ye Li
    (cherry picked from commit b2b745515d06f05ea288524e26cf2389d6924ff2)

    Breno Lima
     
  • d7b900dfa   MLK-18169 imx: imx7 Support for Manufacturing Protection ... Browse Code »

    This code was originally developed by Raul Cardenas
    and modified to be applied in U-Boot imx_v2017.03.

    More information about the initial submission can be seen
    in the link below:
    https://lists.denx.de/pipermail/u-boot/2016-February/245273.html

    i.MX7D has an a protection feature for Manufacturing process.
    This feature uses asymmetric encryption to sign and verify
    authenticated software handled between parties. This command
    enables the use of such feature.

    The private key is unique and generated once per device.
    And it is stored in secure memory and only accessible by CAAM.
    Therefore, the public key generation and signature functions
    are the only functions available for the user.

    The manufacturing-protection authentication process can be used to
    authenticate the chip to the OEM's server.

    Command usage:

    Print the public key for the device.
    - mfgprot pubk

    Generates Signature over given data.
    - mfgprot sign

    Signed-off-by: Raul Ulises Cardenas
    Signed-off-by: Breno Lima
    Reviewed-by: Fabio Estevam
    Reviewed-by: Ye Li
    (cherry picked from commit db2dbf622d3c711b2fbd85e6814992e023479dad)

    Breno Lima
     

10 Feb, 2018

1 commit

  • dfaec7602   crypto/fsl: instantiate all rng state handles ... Browse Code »

    Extend the instantiate_rng() function and the corresponding CAAM job
    descriptor to instantiate all RNG state handles. This moves the RNG
    instantiation code in line with the CAAM kernel driver.

    Previously, only the first state handle was instantiated. The second
    one was instantiated by the CAAM kernel driver. This works if the
    kernel runs in secure mode, but fails in non-secure mode since the
    kernel driver uses DEC0 directly instead of over the job ring
    interface. Instantiating all RNG state handles in u-boot removes the
    need for using DEC0 in the kernel driver, making it possible to use
    the CAAM in non-secure mode.

    Signed-off-by: Lukas Auer
    Tested-by: Bryan O'Donoghue
    Reviewed-by: York Sun

    Lukas Auer
     

08 Jan, 2018

1 commit

  • 598e9dccc   crypto/fsl: fix BLOB encapsulation and decapsulation ... Browse Code »
    20

    The blob_encap and blob_decap functions were not flushing the dcache
    before passing data to CAAM/DMA and not invalidating the dcache when
    getting data back.
    Therefore, blob encapsulation and decapsulation failed with errors like
    the following due to data cache incoherency:
    "40000006: DECO: desc idx 0: Invalid KEY command"

    To ensure coherency, we require the key_mod, src and dst buffers to be
    aligned to the cache line size and flush/invalidate the memory regions.
    The same requirements apply to the job descriptor.

    Tested on an i.MX6Q board.

    Reviewed-by: Sumit Garg
    Signed-off-by: Clemens Gruber

    Clemens Gruber
     

05 Jan, 2017

1 commit

24 Nov, 2016

1 commit

18 May, 2016

1 commit

21 Feb, 2016

1 commit

30 Oct, 2015

1 commit

  • f59e69cbd   crypto/fsl: SEC driver cleanup for 64 bit and endianness ... Browse Code »

    The SEC driver code has been cleaned up to work for 64 bit
    physical addresses and systems where endianess of SEC block
    is different from the Core.
    Changes:
    1. Descriptor created on Core is modified as per SEC block
    endianness before the job is submitted.
    2. The read/write of physical addresses to Job Rings will
    be depend on endianness of SEC block as 32 bit low and
    high part of the 64 bit address will vary.
    3. The 32 bit low and high part of the 64 bit address in
    descriptor will vary depending on endianness of SEC.

    Signed-off-by: Aneesh Bansal
    Reviewed-by: York Sun

    Aneesh Bansal
     

13 Aug, 2015

1 commit

04 Aug, 2015

3 commits

  • c40655173   drivers/crypto/fsl: enable raw data instead of von Neumann data ... Browse Code »

    The sampling of the oscillator can be done in multiple modes for
    generating the entropy value. By default, this is set to von
    Neumann. This patch changes the sampling to raw data, since it
    has been discovered that the generated entropy has a better
    'quality'.

    Signed-off-by: Alex Porosanu
    Acked-by: Ruchika Gupta
    Reviewed-by: York Sun

    Alex Porosanu
     
  • 17649e1b9   drivers/crypto/fsl: change starting entropy delay value ... Browse Code »

    The entropy delay (the length in system clocks of each
    entropy sample) for the RNG4 block of CAAM is dependent
    on the frequency of the SoC. By elaborate methods, it
    has been determined that a good starting value for all
    platforms integrating the CAAM IP is 3200. Using a
    higher value has additional benefit of speeding up
    the process of instantiating the RNG, since the entropy
    delay will be increased and instantiation of the RNG
    state handles will be reattempted by the driver. If the
    starting value is low, for certain platforms, this can
    lead to a quite lengthy process.
    This patch changes the starting value of the length of
    the entropy sample to 3200 system clocks.
    In addition to this change, the attempted entropy delay
    values are now printed on the console upon initialization
    of the RNG block.

    Signed-off-by: Alex Porosanu
    Acked-by: Ruchika Gupta
    Reviewed-by: York Sun

    Alex Porosanu
     
  • 026a3f1b7   drivers/crypto/fsl: disable RNG oscillator maximum frequency check ... Browse Code »

    The rtfrqmax & rtfrqmin set the bounds of the expected frequency of the
    oscillator, when SEC runs at its maximum frequency. For certain platforms
    (f.i. T2080), the oscillator is very fast and thus if the SEC runs at
    a lower than normal frequency, the ring oscillator is incorrectly detected
    as being out of bounds.

    This patch effectively disables the maximum frequency check, by setting a
    high enough maximum allowable frequency for the oscillator. The reasoning
    behind this is that usually a broken oscillator will run too slow
    (i.e. not run at all) rather than run too fast.

    Signed-off-by: Alex Porosanu
    Acked-by: Ruchika Gupta
    Reviewed-by: York Sun

    Alex Porosanu
     

05 Mar, 2015

1 commit

  • 33d5156f7   fsl_sec.h: Fix thinko ... Browse Code »

    In 0200020 we added a number of tests for 'if
    defined(CONFIG_SYS_FSL_SEC_LE) && !defined(CONFIG_MX6)' and
    accidentally did one as 'ifdef defined...'

    Signed-off-by: Tom Rini

    Tom Rini
     

02 Mar, 2015

1 commit

  • 0200020bc   imx6: Added DEK blob generator command ... Browse Code »
    43

    Freescale's SEC block has built-in Data Encryption
    Key(DEK) Blob Protocol which provides a method for
    protecting a DEK for non-secure memory storage.
    SEC block protects data in a data structure called
    a Secret Key Blob, which provides both confidentiality
    and integrity protection.
    Every time the blob encapsulation is executed,
    a AES-256 key is randomly generated to encrypt the DEK.
    This key is encrypted with the OTP Secret key
    from SoC. The resulting blob consists of the encrypted
    AES-256 key, the encrypted DEK, and a 16-bit MAC.

    During decapsulation, the reverse process is performed
    to get back the original DEK. A caveat to the blob
    decapsulation process, is that the DEK is decrypted
    in secure-memory and can only be read by FSL SEC HW.
    The DEK is used to decrypt data during encrypted boot.

    Commands added
    --------------
    dek_blob - encapsulating DEK as a cryptgraphic blob

    Commands Syntax
    ---------------
    dek_blob src dst len

    Encapsulate and create blob of a len-bits DEK at
    address src and store the result at address dst.

    Signed-off-by: Raul Cardenas
    Signed-off-by: Nitin Garg

    Signed-off-by: Ulises Cardenas

    Signed-off-by: Ulises Cardenas-B45798

    Raul Cardenas
     

26 Feb, 2015

1 commit

17 Oct, 2014

4 commits

  • c5de15cbc   crypto/fsl: Add command for encapsulating/decapsulating blobs ... Browse Code »
    1

    Freescale's SEC block has built-in Blob Protocol which provides
    a method for protecting user-defined data across system power
    cycles. SEC block protects data in a data structure called a Blob,
    which provides both confidentiality and integrity protection.

    Encapsulating data as a blob
    Each time that the Blob Protocol is used to protect data, a
    different randomly generated key is used to encrypt the data.
    This random key is itself encrypted using a key which is derived
    from SoC's non volatile secret key and a 16 bit Key identifier.
    The resulting encrypted key along with encrypted data is called a blob.
    The non volatile secure key is available for use only during secure boot.

    During decapsulation, the reverse process is performed to get back
    the original data.

    Commands added
    --------------
    blob enc - encapsulating data as a cryptgraphic blob
    blob dec - decapsulating cryptgraphic blob to get the data

    Commands Syntax
    ---------------
    blob enc src dst len km

    Encapsulate and create blob of data $len bytes long
    at address $src and store the result at address $dst.
    $km is the 16 byte key modifier is also required for
    generation/use as key for cryptographic operation. Key
    modifier should be 16 byte long.

    blob dec src dst len km

    Decapsulate the blob of data at address $src and
    store result of $len byte at addr $dst.
    $km is the 16 byte key modifier is also required for
    generation/use as key for cryptographic operation. Key
    modifier should be 16 byte long.

    Signed-off-by: Ruchika Gupta
    Reviewed-by: York Sun

    Ruchika Gupta
     
  • b9eebfade   fsl_sec: Add hardware accelerated SHA256 and SHA1 ... Browse Code »
    34

    SHA-256 and SHA-1 accelerated using SEC hardware in Freescale SoC's
    The driver for SEC (CAAM) IP is based on linux drivers/crypto/caam.
    The platforms needto add the MACRO CONFIG_FSL_CAAM inorder to
    enable initialization of this hardware IP.

    Signed-off-by: Ruchika Gupta
    Reviewed-by: York Sun

    Ruchika Gupta
     
  • 028dbb8db   fsl_sec : Change accessor function to take care of endianness ... Browse Code »

    SEC registers can be of type Little Endian or big Endian depending upon
    Freescale SoC. Here SoC defines the register type of SEC IP.

    So update acessor functions with common SEC acessor functions to take care
    both type of endianness.

    Signed-off-by: Ruchika Gupta
    Reviewed-by: York Sun

    Ruchika Gupta
     
  • 48ef0d2a1   fsl_sec : Move SEC CCSR definition to common include ... Browse Code »

    Freescale SEC controller has been used for mpc8xxx. It will be used
    for ARM-based SoC as well. This patch moves the CCSR defintion of
    SEC to common include

    Signed-off-by: Ruchika Gupta
    Reviewed-by: York Sun

    Ruchika Gupta