drivers: caam: fix cache invalidation of RSA buffer

When using CAAM to generate an RSA key the CPU caching of the DMA
buffers need to be controlled to ensure the correct visibility for both
devices.

drivers: caam: fix cache invalidation of RSA buffer

When using CAAM to generate an RSA key the CPU caching of the DMA
buffers need to be controlled to ensure the correct visibility for both
devices. For the n parameter the wrong address was used when
invalidating the CPU cache after the DMA operation, resulting in <key
length> bytes of the stack being invalidated (without flushing to
memory) instead of the buffer.

The first potential consequence of this is that any parts of the n
buffer that were cached during the key generation won't get read from
RAM, resulting in a corrupt key. This is unlikely since the n buffer
was correctly flushed immediately before starting the CAAM operation.
To reliably reproduce this, a read that should normally be harmless can
be inserted immediately before caam_jr_enqueue:
((volatile uint8_t *)genkey.n.data)[0];

The second effect of this bug is that parts of the do_gen_keypair stack
frame will have its cache lines invalidated (again without write back to
memory). With 4096 bit keys and a compiler that produces the right stack
layout this affects callee saved registers, the return pointer and
potentially a stack canary. I have not been able to see the effects of
this on my iMX8MQ test device.

Fixes: ccbcceeb73c1 ("drivers: caam: add CAAM key support for RSA")
Signed-off-by: Martin Nyhus <martin@nyhus.dev>
Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>

show more ...

drivers: caam: handle serialization of short params

Adjusts the caam key serialization code to account for keys where
sec_size < buf.length. When that is the case the serialization can only
touch th

drivers: caam: handle serialization of short params

Adjusts the caam key serialization code to account for keys where
sec_size < buf.length. When that is the case the serialization can only
touch the first sec_size bytes since the rest are invalid, and the
serialized length is thus sec_size.

If the default key type has been changed to plain this can happen during
RSA keygen if the d parameter ends up shorter than the key size in
bytes. In that case the valid bytes are at the front of the buffer and
do_gen_keypair accounts for this by setting sec_size correctly, and
caam_key_serialize_to_bn is called with an inkey in the sec_size <
buf.length state. This ended up creating corrupt keys for roughly 1% of
keygens, and was caught by various RSA tests in optee_test.

Fixes: 1495f6c4a82a ("drivers: caam: add CAAM key driver")
Signed-off-by: Martin Nyhus <martin@nyhus.dev>
Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>

show more ...

drivers: caam: fix bits/bytes confusion

Fixes two mixups of bits and bytes in caam_key_init that roughly cancel
each other out. Both sec_size and the result from
caam_key_serialized_size are values

drivers: caam: fix bits/bytes confusion

Fixes two mixups of bits and bytes in caam_key_init that roughly cancel
each other out. Both sec_size and the result from
caam_key_serialized_size are values in bytes, so the key sizes in bits
need to be converted. For plain text keys this makes no difference to
the result since they cancel each other out exactly.

For the default key type of BLACK_CCM the blob overhead is now correctly
counted as bytes instead of bits which decreases the headroom, but since
the default config of 4576 was calculated correctly, the assert still
shouldn't fail.

Fixes: 1495f6c4a82a ("drivers: caam: add CAAM key driver")
Signed-off-by: Martin Nyhus <martin@nyhus.dev>
Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>

show more ...

drivers: caam: improve empty aad updates

In caam_ae_update_aad an update without data was already handled as long
as the data pointer was NULL. This change updates the logic to also
account for the

drivers: caam: improve empty aad updates

In caam_ae_update_aad an update without data was already handled as long
as the data pointer was NULL. This change updates the logic to also
account for the case where the pointer is non-null but the length is
zero. When that was the case caam_cpy_buf would exit early without
allocating, leaving aad->data as NULL, making caam_cpy_block_src fail.

This was found through the Android Keymint tests because Rust represents
empty buffers (Rust slices) with a non-null pointer and length 0.

Fixes: faaf0c5975d2 ("drivers: caam: Add AES GCM")
Signed-off-by: Martin Nyhus <martin@nyhus.dev>
Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>

show more ...

caam: fix compilation when CFG_NXP_CAAM_AE_* are disabled

Similarly to other CAAM modules, define empty function if CAAM AE is
not used, to avoid undefined reference to caam_ae_init().

Signed-off-b

caam: fix compilation when CFG_NXP_CAAM_AE_* are disabled

Similarly to other CAAM modules, define empty function if CAAM AE is
not used, to avoid undefined reference to caam_ae_init().

Signed-off-by: Pavel Löbl <pavel@loebl.cz>
Acked-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

drivers: caam: introduce AE_CCM and AE_GCM compilation flags

imx6dl-sabresd, imx6q-sabresd, imx6sx-sdb does not support AES GCM

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: S

drivers: caam: introduce AE_CCM and AE_GCM compilation flags

imx6dl-sabresd, imx6q-sabresd, imx6sx-sdb does not support AES GCM

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: Add AES CCM

Implement CAAM AES CCM

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklande

drivers: caam: Add AES CCM

Implement CAAM AES CCM

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: Add AES GCM

Implement CAAM AES GCM

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklande

drivers: caam: Add AES GCM

Implement CAAM AES GCM

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: Add caam_cpy_buf_src()

Add caam_cpy_buf_src() function that copy a data buffer into a caam buffer.

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra

drivers: caam: Add caam_cpy_buf_src()

Add caam_cpy_buf_src() function that copy a data buffer into a caam buffer.

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: Update CCB Clear Written Register

Introduce more CCB CLR WR register

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked

drivers: caam: Update CCB Clear Written Register

Introduce more CCB CLR WR register

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: Add SEQ FIFO Load

Introduce Sequence Fifo load command

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wikl

drivers: caam: Add SEQ FIFO Load

Introduce Sequence Fifo load command

Signed-off-by: Olivier Masse <olivier.masse@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tree-wide: use power-of-2 rounding macros where applicable

Use ROUNDUP2(), ROUNDUP2_OVERFLOW(), ROUNDUP2_DIV() and ROUNDDOWN2() at
places where the rounding argument is a variable value and we want

tree-wide: use power-of-2 rounding macros where applicable

Use ROUNDUP2(), ROUNDUP2_OVERFLOW(), ROUNDUP2_DIV() and ROUNDDOWN2() at
places where the rounding argument is a variable value and we want to
leverage the implementation of these routines optimized for a
power-of-2 rounding argument.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: sm: fix SM partition permission in SMAG registers

SM partition SMAG1 permissions were wrongly set for generating DEK blob
which results in error while decapsulating DEK blob during HA

drivers: caam: sm: fix SM partition permission in SMAG registers

SM partition SMAG1 permissions were wrongly set for generating DEK blob
which results in error while decapsulating DEK blob during HAB
encrypted boot.
Setting the permissions correctly fix this issue.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Fixes: 2a12ae237796 ("drivers: caam: add CAAM secure memory driver")

show more ...

drivers: caam: enable/disable prediction resistance based on CONFIG flag

With prediction resistance enabled, on every random number request
CAAM is forced to do reseeding of DRBG, which is time taki

drivers: caam: enable/disable prediction resistance based on CONFIG flag

With prediction resistance enabled, on every random number request
CAAM is forced to do reseeding of DRBG, which is time taking process
which leads to lower Random number generation performance.
So to give user the flexibility to enable/disable this feature a flag
CFG_CAAM_RNG_RUNTIME_PR is introduced.
By default it will be disabled and user can enable it as per its
requirement.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

driver: caam: disable RNG buffering

Previous design of keeping RNG data in a buffer and giving random number
to user from that buffer is vulnerable to attacks and also not NIST/FIPS
compliant.
So to

driver: caam: disable RNG buffering

Previous design of keeping RNG data in a buffer and giving random number
to user from that buffer is vulnerable to attacks and also not NIST/FIPS
compliant.
So to make it more secure and NIST/FIPS compliant, will get random
number from CAAM on each user request.

Reference: Section 2.7 of NIST SP 800-90C

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: cache align Key blob modifier

An array was used as Key blob modifier, changed it cache aligned
dynamic memory.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens W

drivers: caam: cache align Key blob modifier

An array was used as Key blob modifier, changed it cache aligned
dynamic memory.

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: check only format bit in operation

operation variable has been updated after entering the function
so we cannot check against full RSA operations.
Updated to check only format bit in

drivers: caam: check only format bit in operation

operation variable has been updated after entering the function
so we cannot check against full RSA operations.
Updated to check only format bit in operation

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: fix CFG_CORE_BIGNUM_MAX_BITS

CFG_CORE_BIGNUM_MAX_BITS should be 4576
4096 (RSA Max key size) +
8 * 60 (Header serialization and Black blob overhead in bytes)

Signed-off-by: Sahil Mal

drivers: caam: fix CFG_CORE_BIGNUM_MAX_BITS

CFG_CORE_BIGNUM_MAX_BITS should be 4576
4096 (RSA Max key size) +
8 * 60 (Header serialization and Black blob overhead in bytes)

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: use fdt_reg_info()

Use fdt_reg_info() instead of fdt_reg_base_address() and fdt_reg_size()
to optimize look up in the DT due to finding parent node.

Signed-off-by: Etienne Carriere <etienn

drivers: use fdt_reg_info()

Use fdt_reg_info() instead of fdt_reg_base_address() and fdt_reg_size()
to optimize look up in the DT due to finding parent node.

Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: Update comments in ECC driver

There were some typos in comments in the code, updated them

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>

drivers: caam: Update comments in RSA driver

There were some typos in comments in the code, updated them

Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>

drivers: caam: hal: add caam_hal_sm_get_base_dt() implementation

Implement caam_hal_sm_get_base_dt() function when CFG_DT=y

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Signed-off-by: Sahil

drivers: caam: hal: add caam_hal_sm_get_base_dt() implementation

Implement caam_hal_sm_get_base_dt() function when CFG_DT=y

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: skip JR init of CFG_JR_HAB_INDEX

On iMX8M SoC, the HAB requires the JR0 to be set to secure world to
decrypt the kernel image when loading the image in U-Boot.

Before reaching u-boot

drivers: caam: skip JR init of CFG_JR_HAB_INDEX

On iMX8M SoC, the HAB requires the JR0 to be set to secure world to
decrypt the kernel image when loading the image in U-Boot.

Before reaching u-boot, OP-TEE and TF-A set the JR0 to the non-secure
domain that leads to a HAB failure when trying to decrypt the kernel.

To fix the issue, this commit introduces CFG_JR_HAB_INDEX that specifies
which JR the HAB uses. OPTEE will skip the initialization of
CFG_JR_HAB_INDEX and leave it as secure.

It will also disable its usage in the device tree to inform the kernel.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: pass TEE_ATTR_RSA_OAEP_MGF_HASH to RSA-OAEP implementations

OP-TEE currently doesn't support using a different hash for MGF1
with RSA-OAEP. However, this is required for AOSP compatibility
(e.

core: pass TEE_ATTR_RSA_OAEP_MGF_HASH to RSA-OAEP implementations

OP-TEE currently doesn't support using a different hash for MGF1
with RSA-OAEP. However, this is required for AOSP compatibility
(e.g. in EncryptionOperationsTest.RsaOaepWithMGFDigestSuccess [1]).

Pass the MGF1 attribute to crypto implementations. Note that
only libtomcrypt supports this feature at the moment, so other
implementations will either fail or fall back to libtomcrypt when
passed a different MGF1 hash.

Link: https://android.googlesource.com/platform/hardware/interfaces/+/refs/heads/main/security/keymint/aidl/vts/functional/KeyMintTest.cpp#5552 [1]
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

drivers: caam: add CAAM key support for DH

Add CAAM key support for DH.
Add DH black key support for shared secret generation.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Signed-off-by: Sa

drivers: caam: add CAAM key support for DH

Add CAAM key support for DH.
Add DH black key support for shared secret generation.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...