| 3fd340e5 | 04-Nov-2021 |
Etienne Carriere <etienne.carriere@linaro.org> |
core: dt_driver: factorize DT cells helper functions
Move/rename fdt_clock_cells() to fdt_get_dt_driver_cells().
and clk_dt_register_clk_provider() to dt_driver_register_provider().
Add helper func
core: dt_driver: factorize DT cells helper functions
Move/rename fdt_clock_cells() to fdt_get_dt_driver_cells().
and clk_dt_register_clk_provider() to dt_driver_register_provider().
Add helper function dt_driver_provider_cells() to get ::provider_cells
from a registered provider reference.
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Clément Léger <clement.leger@bootlin.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 1d23b02e | 08-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: drivers: generate HUK from PUF KEK
If authenticated boot was disabled we allow generating the HUK using
the SHA-256 of the DNA unique identifier.
If authenticated boot was enabled, use the
zynqmp: drivers: generate HUK from PUF KEK
If authenticated boot was disabled we allow generating the HUK using
the SHA-256 of the DNA unique identifier.
If authenticated boot was enabled, use the PUK KEK to generate the
HUK instead. The PUF KEK must be registered while securing the board
using the Xilinx tools. In this case, the HUK is generated by reading
the DNA eFuses. This 96 bits value is used to generate a 16 byte
digest which is then AES-GCM encrypted using the PUF KEK. The
resulting 16 byte value is the HUK. To prevent the HUK from being
leaked, the AES-GCM module must be reserved.
The HUK generation was validated on Zynqmp zu3cg using the Xilinx
Lightweight Provisioning Tool to enable authenticated boot and to
provision the PUF (burning a number of eFuses in the process).
Tested-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Tested-by: Ricardo Salveti <ricardo@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 9b61a2bc | 07-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: drivers: PM firmware
These routines call TF-A exported SiP services that implement IPI
protocol for communication with PMUFW (Platform Management Unit).
To access eFuses, PMUFW should be bu
zynqmp: drivers: PM firmware
These routines call TF-A exported SiP services that implement IPI
protocol for communication with PMUFW (Platform Management Unit).
To access eFuses, PMUFW should be built with -DENABLE_EFUSE_ACCESS=1.
Notice however that certain eFuses will not be available unless the
Xilskey library linked to the PMUFW is compiled removing some of those
security restrictions.
Signed-off-by: Igor Opaniuk <igor.opaniuk@foundries.io>
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| f072eea4 | 04-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: drivers: AES-GCM with PUF KEK
Provide a mechanism to encrypt a red key using the KEK; the KEK is
only available on secured boards after the RSA_EN and PPK eFUSES have
been burnt (the system
zynqmp: drivers: AES-GCM with PUF KEK
Provide a mechanism to encrypt a red key using the KEK; the KEK is
only available on secured boards after the RSA_EN and PPK eFUSES have
been burnt (the system will only boot ROM authenticated bootloaders
from here on).
The main use case for OP-TEE would be to encode the zynqmp per device
unique identifier (DNA0, DNA1, DNA2 eFUSEs - ie, a red key) using the
KEK. The encryption key generated this way is cryptographically strong
and will be used as the device HUK (ie, black key).
Test code:
csu_aes_encrypt_data(src, dst, BLOB_DATA_SIZE, tag, GCM_TAG_SIZE,
iv, GCM_IV_SIZE, CSU_AES_KEY_SRC_DEV);
csu_aes_decrypt_data(dst, src, BLOB_DATA_SIZE, tag, GCM_TAG_SIZE,
iv, GCM_IV_SIZE, CSU_AES_KEY_SRC_DEV);
if (memcmp(src, buffer, BLOB_DATA_SIZE)) {
EMSG(" - encrypt/decrypt test failed");
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| e4a0a852 | 04-Oct-2021 |
Jorge Ramirez-Ortiz <jorge@foundries.io> |
zynqmp: drivers: Physically Unclonable Function (PUF)
This block is used to generate black keys via the AES-GCM module.
The PUF KEK - feeding the AES-GCM block - is also unique for each
device.
The
zynqmp: drivers: Physically Unclonable Function (PUF)
This block is used to generate black keys via the AES-GCM module.
The PUF KEK - feeding the AES-GCM block - is also unique for each
device.
The KEK is only available once the board has been secured via
programmable eFUSES (RSA_EN authentication via the PPK fuses).
Registering the PUF should be done using the Xilinx tools so the
adequate eFUSES are written.
Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 6e4e7a23 | 27-Oct-2021 |
Etienne Carriere <etienne.carriere@linaro.org> |
drivers: clk: rename clk_dt_get_fn to clk_dt_get_func
Rename type clk_dt_get_fn to clk_dt_get_func for consistency in OP-TEE
OS implementation where all other function prototype type definitions
use
drivers: clk: rename clk_dt_get_fn to clk_dt_get_func
Rename type clk_dt_get_fn to clk_dt_get_func for consistency in OP-TEE
OS implementation where all other function prototype type definitions
use _func as suffix.
Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| 6c9ed842 | 19-Sep-2021 |
Etienne Carriere <etienne.carriere@linaro.org> |
drivers: clk: implement clk_is_enabled()
Add clock API function clk_is_enabled(). It is not very useful at
runtime since clock state can change at any time. The API function
is useful during specifi
drivers: clk: implement clk_is_enabled()
Add clock API function clk_is_enabled(). It is not very useful at
runtime since clock state can change at any time. The API function
is useful during specific system sequences where OP-TEE core knows
is executes atomically (primary core boot, low power sequences).
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
show more ...
|
| dbe94a85 | 25-Jun-2021 |
Clément Léger <clement.leger@bootlin.com> |
drivers: clk: add devicetree support
When using a devicetree, it is often useful to have clocks parsing.
This support adds clocks properties parsing and allow having clock
providers and users. Clock
drivers: clk: add devicetree support
When using a devicetree, it is often useful to have clocks parsing.
This support adds clocks properties parsing and allow having clock
providers and users. Clocks drivers can also be declared with
CLK_DT_DECLARE. They will be probed automatically by the clock core.
On the user side, function clk_dt_get_by_name and clk_dt_get_by_idx
allows to retrieve a clock from the device tree description and match
it with the provider clocks. The core ensure the clocks are probed
hierarchically.
This support is enabled using CFG_DRIVERS_CLK_DT.
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Clément Léger <clement.leger@bootlin.com>
show more ...
|