Commit graph

35 commits

Author SHA1 Message Date
York Sun
90b80386ff crypto: Move CONFIG_SYS_FSL_SEC_LE and _BE to Kconfig
Use Kconfig option to set little- or big-endian access to secure
boot and trust architecture.

Signed-off-by: York Sun <york.sun@nxp.com>
2017-01-04 19:40:19 -05:00
York Sun
2c2e2c9e14 crypto: Move SYS_FSL_SEC_COMPAT into driver Kconfig
Instead of define CONFIG_SYS_FSL_SEC_COMPAT in header files for PowerPC
and ARM SoCs, move it to Kconfig under the driver.

Signed-off-by: York Sun <york.sun@nxp.com>
2017-01-04 19:40:17 -05:00
York Sun
4fd64746b0 powerpc: C29X: Move CONFIG_PPC_C29X to Kconfig option
Replace CONFIG_PPC_C29X with ARCH_C29X in Kconfig and clean up existing
macros.

Signed-off-by: York Sun <york.sun@nxp.com>
2016-11-23 23:42:04 -08:00
Robert P. J. Day
fc0b5948e0 Various, accumulated typos collected from around the tree.
Fix various misspellings of:

 * deprecated
 * partition
 * preceding,preceded
 * preparation
 * its versus it's
 * export
 * existing
 * scenario
 * redundant
 * remaining
 * value
 * architecture

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Reviewed-by: Jagan Teki <jteki@openedev.com>
Reviewed-by: Stefan Roese <sr@denx.de>
2016-10-06 20:57:40 -04:00
Masahiro Yamada
5d97dff042 treewide: replace #include <asm-generic/errno.h> with <linux/errno.h>
Now, include/linux/errno.h is a wrapper of <asm-generic/errno.h>.
Replace all include directives for <asm-generic/errno.h> with
<linux/errno.h>.

<asm-generic/...> is supposed to be included from <asm/...> when
arch-headers fall back into generic implementation. Generally, they
should not be directly included from .c files.

Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
[trini: Add drivers/usb/host/xhci-rockchip.c]
Signed-off-by: Tom Rini <trini@konsulko.com>
2016-09-23 22:25:27 -04:00
Sumit Garg
7fe1d6a410 crypto/fsl: Update blob cmd to accept 64bit addresses
Update blob cmd to accept 64bit source, key modifier and destination
addresses. Also correct output result print format for fsl specific
implementation of blob cmd.

Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-08-02 09:45:39 -07:00
Sumit Garg
7f0a0e4c58 DM: crypto/fsl: Enable rsa DM driver usage before relocation
Enable rsa signature verification in SPL framework before relocation for
verification of main u-boot.

Reviewed-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-07-26 09:01:21 -07:00
Sumit Garg
8f01397ba7 powerpc/mpc85xx: SECURE BOOT- Enable chain of trust in SPL
As part of Chain of Trust for Secure boot, the SPL U-Boot will validate
the next level U-boot image. Add a new function spl_validate_uboot to
perform the validation.

Enable hardware crypto operations in SPL using SEC block.
In case of Secure Boot, PAMU is not bypassed. For allowing SEC block
access to CPC configured as SRAM, configure PAMU.

Reviewed-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Signed-off-by: Sumit Garg <sumit.garg@nxp.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-07-21 11:09:23 -07:00
Robert P. J. Day
62a3b7dd08 Various, unrelated tree-wide typo fixes.
Fix a number of typos, including:

     * "compatble" -> "compatible"
     * "eanbeld" -> "enabled"
     * "envrionment" -> "environment"
     * "FTD" -> "FDT" (for "flattened device tree")
     * "ommitted" -> "omitted"
     * "overriden" -> "overridden"
     * "partiton" -> "partition"
     * "propogate" -> "propagate"
     * "resourse" -> "resource"
     * "rest in piece" -> "rest in peace"
     * "suport" -> "support"
     * "varible" -> "variable"

Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
2016-07-16 09:43:12 -04:00
Alex Porosanu
76394c9c91 crypto/fsl: add support for multiple SEC engines initialization
For SoCs that contain multiple SEC engines, each of them needs
to be initialized (by means of initializing among others the
random number generator).

Signed-off-by: Alex Porosanu <alexandru.porosanu@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-05-18 08:51:46 -07:00
York Sun
3c1d218a1d armv8: LS2080A: Consolidate LS2080A and LS2085A
LS2080A is the primary SoC, and LS2085A is a personality with AIOP
and DPAA DDR. The RDB and QDS boards support both personality. By
detecting the SVR at runtime, a single image per board can support
both SoCs. It gives users flexibility to swtich SoC without the need
to reprogram the board.

Signed-off-by: York Sun <york.sun@nxp.com>
CC: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
Reviewed-by: Prabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
2016-04-06 10:26:46 -07:00
Saksham Jain
8a6f83dcb8 crypto/fsl: Make CAAM transactions cacheable
This commit solves CAAM coherency issue on ls2080. When caches are
enabled and CAAM's DMA's AXI transcations are not made cacheable,
Core reads/writes data from/to caches and CAAM does from main memory.
This forces data flushes to synchronize various data structures. But
even if any data in proximity of these structures is read by core,
these structures again are fetched in caches.

To avoid this problem, either all the data that CAAM accesses can be
made cache line aligned or CAAM transcations can be made cacheable.

So, this commit makes CAAM transcations as write back with write and
read allocate.

Signed-off-by: Saksham Jain <saksham.jain@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-03-29 08:46:22 -07:00
Saksham Jain
69b6a796f7 crypto/fsl: Correct 64-bit write when MMU disabled
When MMU is disabled, 64-bit write must be aligned at 64-bit
boundary. Becaue the memory location is not guaranteed to be 64-bit
aligned, the 64-bit write needs to be split into two 32-bit writes
to avoid the alignment exception.

Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Signed-off-by: Saksham Jain <saksham.jain@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-03-29 08:46:22 -07:00
Aneesh Bansal
c4cbd7137d drivers/crypto/fsl: define structures for PDB
Structures are defined for PDB (Protocol Data Blcks) for various
operations. These structure will be used to add PDB data while
creating the PDB descriptors.

Signed-off-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
CC: Ulises Cardenas <raul.casas@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-03-21 12:42:11 -07:00
Aneesh Bansal
2959037077 drivers/crypto/fsl: add constructs for protocol descriptors
Construct APIs are added to create Protocol Descriptors for
CAAM block.

Signed-off-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
CC: Ulises Cardenas <raul.casas@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-03-21 12:42:11 -07:00
Aneesh Bansal
6178e95978 drivers/crypto/fsl: correct error checking in run_descriptor
When CAAM runs a descriptor and an error occurs, a non-zero
value is set in Output Status Register. The if condition should
check the status for a non-zero value.

Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-03-21 12:42:11 -07:00
Aneesh Bansal
f698e9f39a powerpc/SECURE_BOOT: Add PAMU driver
PAMU driver basic support for usage in Secure Boot.
In secure boot PAMU is not in bypass mode. Hence to use
any peripheral (SEC Job ring in our case), PAMU has to be
configured.

The patch reverts commit 7cad2e38d6.

The Header file pamu.h and few functions in driver have been derived
from Freescale Libos.

Signed-off-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Signed-off-by: Aneesh Bansal <aneesh.bansal@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-02-24 08:40:55 -08:00
Ruchika Gupta
7f4736bd65 drivers/crypto/fsl : Allocate output ring with size aligned to CACHELNE SIZE
The output ring needs to be invalidated before enqueuing the job to SEC.
While allocation of space to output ring, it should be taken care that the
size is cacheline size aligned inorder to prevent invalidating valid data.

The patch also correct the method of aligning end of structs while flushing caches

    Since start = align(start_of_struct), it is incorrect to assign
    end = align(start + struct_size). It should instead be,
    end = align(start_of_struct + struct_size).

Signed-off-by: Saksham Jain <saksham@nxp.com>
Signed-off-by: Ruchika Gupta <ruchika.gupta@nxp.com>
Reviewed-by: York Sun <york.sun@nxp.com>
2016-02-24 08:40:55 -08:00
Ulises Cardenas
f91e65a74e imx: Refactoring CAAM Job Ring structure and Secure Memory for imx7
Refactored data structure for CAAM's job ring and Secure Memory
to support i.MX7.

The new memory map use macros to resolve SM's offset by version.
This will solve the versioning issue caused by the new version of
secure memory of i.MX7

Signed-off-by: Ulises Cardenas <raul.casas@nxp.com>
Reviewed-by: Stefano Babic <sbabic@denx.de>
2016-02-21 11:20:54 +01:00
Aneesh Bansal
3a4800a596 drivers/crypto/fsl: fix endianness issue in RNG
For Setting and clearing the bits in SEC Block registers
sec_clrbits32() and sec_setbits32() are used which work as
per endianness of CAAM block.
So these must be used with SEC register address as argument.
If the value is read in a local variable, then the functions
will not behave correctly where endianness of CAAM and core is
different.

Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
CC: Alex Porosanu <alexandru.porosanu@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-12-15 08:57:35 +08:00
Aneesh Bansal
f59e69cbd3 crypto/fsl: SEC driver cleanup for 64 bit and endianness
The SEC driver code has been cleaned up to work for 64 bit
physical addresses and systems where endianess of SEC block
is different from the Core.
Changes:
1. Descriptor created on Core is modified as per SEC block
   endianness before the job is submitted.
2. The read/write of physical addresses to Job Rings will
   be depend on endianness of SEC block as 32 bit low and
   high part of the 64 bit address will vary.
3. The 32 bit low and high part of the 64 bit address in
   descriptor will vary depending on endianness of SEC.

Signed-off-by: Aneesh Bansal <aneesh.bansal@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-10-29 10:33:57 -07:00
Ruchika Gupta
057c220055 Correct License and Copyright information on few files
gpio.h - Added missing copyright in few files.
rsa-mod-exp.h - Corrected copyright in the file.
fsl_sec.h - Added missing license in files
drivers/crypto/fsl/Makefile - Removed the incomplete GPLv2 license and replaced it with GPLv2+ license

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
2015-08-12 20:47:46 -04:00
horia.geanta@freescale.com
14d5547cf1 drivers/crypto/fsl: clean-up - use fdt_setprop_u32 helper
Signed-off-by: Horia Geantă <horia.geanta@freescale.com>
Acked-by: Ruchika Gupta<ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-08-03 12:06:38 -07:00
horia.geanta@freescale.com
3ef2412de6 drivers/crypto/fsl: fix snooping for write transactions
HW coherency won't work properly for CAAM write transactions
if AWCACHE is left to default (POR) value - 4'b0001.
It has to be programmed to 4'b0010.

For platforms that have HW coherency support:
-PPC-based: the update has no effect; CAAM coherency already works
due to the IOMMU (PAMU) driver setting the correct memory coherency
attributes
-ARM-based: the update fixes cache coherency issues,
since IOMMU (SMMU) driver is not programmed to behave similar to PAMU

Fixes: b9eebfade9 ("fsl_sec: Add hardware accelerated SHA256 and SHA1")
Signed-off-by: Horia Geantă <horia.geanta@freescale.com>
Reviewed-by: Aneesh Bansal <aneesh.bansal@freescale.com>
Reviewed-by: Mingkai Hu <Mingkai.Hu@freescale.com>
Acked-by: Ruchika Gupta<ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-08-03 12:06:38 -07:00
horia.geanta@freescale.com
e5d08b4d60 drivers/crypto/fsl: fix "era" property value on LE platforms
Use fdt_setprop_u32() instead of fdt_setprop().

Fixes: 0181937fa3 ("crypto/fsl: Add fixup for crypto node")
Signed-off-by: Horia Geantă <horia.geanta@freescale.com>
Reviewed-by: Mingkai Hu <Mingkai.Hu@freescale.com>
Acked-by: Ruchika Gupta<ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-08-03 12:06:38 -07:00
Alex Porosanu
c406551736 drivers/crypto/fsl: enable raw data instead of von Neumann data
The sampling of the oscillator can be done in multiple modes for
generating the entropy value. By default, this is set to von
Neumann. This patch changes the sampling to raw data, since it
has been discovered that the generated entropy has a better
'quality'.

Signed-off-by: Alex Porosanu <alexandru.porosanu@freescale.com>
Acked-by: Ruchika Gupta<ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-08-03 12:06:37 -07:00
Alex Porosanu
026a3f1b7c drivers/crypto/fsl: disable RNG oscillator maximum frequency check
The rtfrqmax & rtfrqmin set the bounds of the expected frequency of the
oscillator, when SEC runs at its maximum frequency. For certain platforms
(f.i. T2080), the oscillator is very fast and thus if the SEC runs at
a lower than normal frequency, the ring oscillator is incorrectly detected
as being out of bounds.

This patch effectively disables the maximum frequency check, by setting a
high enough maximum allowable frequency for the oscillator. The reasoning
behind this is that usually a broken oscillator will run too slow
(i.e. not run at all) rather than run too fast.

Signed-off-by: Alex Porosanu <alexandru.porosanu@freescale.com>
Acked-by: Ruchika Gupta<ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-08-03 12:06:37 -07:00
Raul Cardenas
0200020bc2 imx6: Added DEK blob generator command
Freescale's SEC block has built-in Data Encryption
Key(DEK) Blob Protocol which provides a method for
protecting a DEK for non-secure memory storage.
SEC block protects data in a data structure called
a Secret Key Blob, which provides both confidentiality
and integrity protection.
Every time the blob encapsulation is executed,
a AES-256 key is randomly generated to encrypt the DEK.
This key is encrypted with the OTP Secret key
from SoC. The resulting blob consists of the encrypted
AES-256 key, the encrypted DEK, and a 16-bit MAC.

During decapsulation, the reverse process is performed
to get back the original DEK. A caveat to the blob
decapsulation process,  is that the DEK is decrypted
in secure-memory and can only be read by FSL SEC HW.
The DEK is used to decrypt data during encrypted boot.

Commands added
--------------
  dek_blob - encapsulating DEK as a cryptgraphic blob

Commands Syntax
---------------
  dek_blob src dst len

    Encapsulate and create blob of a len-bits DEK at
    address src and store the result at address dst.

Signed-off-by: Raul Cardenas <Ulises.Cardenas@freescale.com>
Signed-off-by: Nitin Garg <nitin.garg@freescale.com>

Signed-off-by: Ulises Cardenas <ulises.cardenas@freescale.com>

Signed-off-by: Ulises Cardenas-B45798 <Ulises.Cardenas@freescale.com>
2015-03-02 09:57:06 +01:00
gaurav rana
94e3c8c4fd crypto/fsl - Add progressive hashing support using hardware acceleration.
Currently only normal hashing is supported using hardware acceleration.
Added support for progressive hashing using hardware.

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com>
CC: Simon Glass <sjg@chromium.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-02-25 13:20:02 -08:00
gaurav rana
7ee8c4795d crypto/fsl: Make function names consistent for blob encapsulation/decapsulation.
This patch does the following:

1. The function names for encapsulation and decapsulation
were inconsitent in freescale's implementation and cmd_blob file.
This patch corrects the issues.
2. The function protopye is also modified to change the length parameter
from u8 to u32 to allow encapsulation and decapsulation of larger images.
3. Modified the description of km paramter in the command usage for better
readability.

Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com>
Reviewed-by: Ruchika Gupta <ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2015-02-25 13:19:48 -08:00
Ruchika Gupta
34276478f7 DM: crypto/fsl - Add Freescale rsa DM driver
Driver added for RSA Modular Exponentiation using Freescale Hardware
Accelerator CAAM. The driver uses UCLASS_MOD_EXP

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
CC: Simon Glass <sjg@chromium.org>
Acked-by: Simon Glass <sjg@chromium.org>
2015-01-29 17:09:58 -07:00
Ruchika Gupta
0181937fa3 crypto/fsl: Add fixup for crypto node
Era property is added in the crypto node in device tree.
Move the code to do so from arch/powerpc/mpc8xxx/fdt.c to
drivers/sec/sec.c so that it can be used across arm and
powerpc platforms having crypto node.

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
[York Sun: Fix commit message indentation]
Reviewed-by: York Sun <yorksun@freescale.com>
2015-01-23 22:29:14 -06:00
gaurav rana
851c9dbad2 crypto/fsl: Fix RNG instantiation failure.
Corrected the order of arguments in memset in run_descriptor
function. Wrong order of argumnets led to improper initialization
of members of struct type result. This resulted in RNG instantiation
error.

Signed-off-by: Gaurav Rana <gaurav.rana@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2014-12-15 09:16:26 -08:00
Ruchika Gupta
c5de15cbc8 crypto/fsl: Add command for encapsulating/decapsulating blobs
Freescale's SEC block has built-in Blob Protocol which provides
a method for protecting user-defined data across system power
cycles. SEC block protects data in a data structure called a Blob,
which provides both confidentiality and integrity protection.

Encapsulating data as a blob
Each time that the Blob Protocol is used to protect data, a
different randomly generated key is used to encrypt the data.
This random key is itself encrypted using a key which is derived
from SoC's non volatile secret key and a 16 bit Key identifier.
The resulting encrypted key along with encrypted data is called a blob.
The non volatile secure key is available for use only during secure boot.

During decapsulation, the reverse process is performed to get back
the original data.

Commands added
--------------
    blob enc - encapsulating data as a cryptgraphic blob
    blob dec - decapsulating cryptgraphic blob to get the data

Commands Syntax
---------------
	blob enc src dst len km

	Encapsulate and create blob of data $len bytes long
	at address $src and store the result at address $dst.
	$km is the 16 byte key modifier is also required for
	generation/use as key for cryptographic operation. Key
	modifier should be 16 byte long.

	blob dec src dst len km

	Decapsulate the  blob of data at address $src and
	store result of $len byte at addr $dst.
	$km is the 16 byte key modifier is also required for
	generation/use as key for cryptographic operation. Key
	modifier should be 16 byte long.

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2014-10-16 14:20:40 -07:00
Ruchika Gupta
b9eebfade9 fsl_sec: Add hardware accelerated SHA256 and SHA1
SHA-256 and SHA-1 accelerated using SEC hardware in Freescale SoC's
The driver for SEC (CAAM) IP is based on linux drivers/crypto/caam.
The platforms needto add the MACRO CONFIG_FSL_CAAM inorder to
enable initialization of this hardware IP.

Signed-off-by: Ruchika Gupta <ruchika.gupta@freescale.com>
Reviewed-by: York Sun <yorksun@freescale.com>
2014-10-16 14:17:07 -07:00