1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3 * Copyright 2018-2021, 2023 NXP
4 *
5 * CAAM RSA manager.
6 * Implementation of RSA functions
7 */
8 #include <caam_acipher.h>
9 #include <caam_common.h>
10 #include <caam_desc_helper.h>
11 #include <caam_hal_ctrl.h>
12 #include <caam_io.h>
13 #include <caam_jr.h>
14 #include <caam_key.h>
15 #include <caam_status.h>
16 #include <caam_utils_mem.h>
17 #include <caam_utils_status.h>
18 #include <drvcrypt.h>
19 #include <drvcrypt_acipher.h>
20 #include <drvcrypt_math.h>
21 #include <mm/core_memprot.h>
22 #include <stdint.h>
23 #include <string.h>
24 #include <tee/cache.h>
25 #include <tee/tee_cryp_utl.h>
26 #include <tee_api_defines.h>
27 #include <tee_api_types.h>
28 #include <utee_types.h>
29
30 #include "local.h"
31
32 /*
33 * Definition of the maximum bits of Exponent e
34 * Refer to sp800-56b
35 */
36 #define MAX_BITS_EXP_E 256
37
38 /*
39 * Define the maximum number of entries in a descriptor
40 * function of the encrypt/decrypt and private key format
41 */
42 #ifdef CFG_CAAM_64BIT
43 #define MAX_DESC_ENC (8 + 4)
44 #define MAX_DESC_DEC_1 (7 + 2 + 4)
45 #define MAX_DESC_DEC_2 (11 + 2 + 7)
46 #define MAX_DESC_DEC_3 (13 + 2 + 10)
47 /* Define the maximum number of entries in the RSA Finish Key descriptor */
48 #define MAX_DESC_KEY_FINISH 24
49 #else
50 #define MAX_DESC_ENC 8
51 #define MAX_DESC_DEC_1 (7 + 2)
52 #define MAX_DESC_DEC_2 (11 + 2)
53 #define MAX_DESC_DEC_3 (13 + 2)
54 /* Define the maximum number of entries in the RSA Finish Key descriptor */
55 #define MAX_DESC_KEY_FINISH 15
56 #endif /* CFG_CAAM_64BIT */
57
58 static TEE_Result do_caam_encrypt(struct drvcrypt_rsa_ed *rsa_data,
59 uint32_t operation);
60 static TEE_Result do_caam_decrypt(struct drvcrypt_rsa_ed *rsa_data,
61 uint32_t operation);
62
63 /*
64 * Definition of the local RSA keypair
65 * Public Key Format: (n, e)
66 * Private Key Format #1: (n, d)
67 * Private Key Format #2: (p, q, d)
68 * Private Key Format #3: (p, q, dp, dq, qp)
69 */
70 struct caam_rsa_keypair {
71 uint8_t format; /* Define the Private Key Format (1, 2 or 3) */
72 struct caambuf n; /* Modulus [n = p * q] */
73 struct caambuf e; /* Public Exponent 65537 <= e < 2^256 */
74 struct caamkey d; /* Private Exponent [d = 1/e mod LCM(p-1, q-1)] */
75 struct caamkey p; /* Private Prime p */
76 struct caamkey q; /* Private Prime q */
77 struct caamkey dp; /* Private [dp = d mod (p-1)] */
78 struct caamkey dq; /* Private [dq = d mod (q-1)] */
79 struct caamkey qp; /* Private [qp = 1/q mod p] */
80 };
81
82 #define RSA_PRIVATE_KEY_FORMAT_1 1
83 #define RSA_PRIVATE_KEY_FORMAT_2 2
84 #define RSA_PRIVATE_KEY_FORMAT_3 3
85
86 /* CAAM Era version */
87 static uint8_t caam_era;
88
89 /*
90 * Free RSA keypair
91 *
92 * @key RSA keypair
93 */
do_free_keypair(struct rsa_keypair * key)94 static void do_free_keypair(struct rsa_keypair *key)
95 {
96 crypto_bignum_free(&key->e);
97 crypto_bignum_free(&key->d);
98 crypto_bignum_free(&key->n);
99 crypto_bignum_free(&key->p);
100 crypto_bignum_free(&key->q);
101 crypto_bignum_free(&key->qp);
102 crypto_bignum_free(&key->dp);
103 crypto_bignum_free(&key->dq);
104 }
105
106 /*
107 * Free local caam RSA keypair
108 *
109 * @key caam RSA keypair
110 */
do_keypair_free(struct caam_rsa_keypair * key)111 static void do_keypair_free(struct caam_rsa_keypair *key)
112 {
113 caam_free_buf(&key->e);
114 caam_free_buf(&key->n);
115
116 caam_key_free(&key->d);
117 caam_key_free(&key->p);
118 caam_key_free(&key->q);
119 caam_key_free(&key->dp);
120 caam_key_free(&key->dq);
121 caam_key_free(&key->qp);
122 }
123
124 /*
125 * Convert Crypto RSA Key to local RSA Public Key
126 * Ensure Key is push in physical memory
127 *
128 * @outkey [out] Output keypair in local format
129 * @inkey Input key in TEE Crypto format
130 */
do_keypub_conv(struct caam_rsa_keypair * outkey,const struct rsa_public_key * inkey)131 static enum caam_status do_keypub_conv(struct caam_rsa_keypair *outkey,
132 const struct rsa_public_key *inkey)
133 {
134 enum caam_status retstatus = CAAM_FAILURE;
135
136 RSA_TRACE("RSA Convert Public Key size N=%zu",
137 crypto_bignum_num_bytes(inkey->n));
138
139 retstatus = caam_calloc_align_buf(&outkey->e,
140 crypto_bignum_num_bytes(inkey->e));
141 if (retstatus != CAAM_NO_ERROR)
142 goto exit_conv;
143
144 crypto_bignum_bn2bin(inkey->e, outkey->e.data);
145 cache_operation(TEE_CACHECLEAN, outkey->e.data, outkey->e.length);
146
147 retstatus = caam_calloc_align_buf(&outkey->n,
148 crypto_bignum_num_bytes(inkey->n));
149 if (retstatus != CAAM_NO_ERROR)
150 goto exit_conv;
151
152 crypto_bignum_bn2bin(inkey->n, outkey->n.data);
153 cache_operation(TEE_CACHECLEAN, outkey->n.data, outkey->n.length);
154
155 return CAAM_NO_ERROR;
156
157 exit_conv:
158 do_keypair_free(outkey);
159
160 return CAAM_OUT_MEMORY;
161 }
162
163 /*
164 * Convert Crypto RSA Key additional fields of the key format #3
165 * Optional fields (dp, dq, qp)
166 *
167 * @outkey [out] Output keypair in local format
168 * @inkey Input key in TEE Crypto format
169 */
do_keypair_conv_f3(struct caam_rsa_keypair * outkey,const struct rsa_keypair * inkey)170 static enum caam_status do_keypair_conv_f3(struct caam_rsa_keypair *outkey,
171 const struct rsa_keypair *inkey)
172 {
173 enum caam_status retstatus = CAAM_FAILURE;
174 size_t size_p = 0;
175 size_t size_q = 0;
176 size_t size_dp = 0;
177 size_t size_dq = 0;
178 size_t size_qp = 0;
179
180 size_p = outkey->p.sec_size;
181 size_q = outkey->q.sec_size;
182 size_dp = crypto_bignum_num_bytes(inkey->dp);
183 size_dq = crypto_bignum_num_bytes(inkey->dq);
184 size_qp = crypto_bignum_num_bytes(inkey->qp);
185
186 /*
187 * If one of the parameters dp, dq or qp are not filled,
188 * returns immediately. This is not an error.
189 */
190 if (!size_dp || !size_dq || !size_qp)
191 return CAAM_NO_ERROR;
192
193 /*
194 * CAAM is assuming that:
195 * - dp and dq are same size as p
196 * - dq same size as q
197 *
198 * Because calculation of dp, dq and qp can be less
199 * than above assumption, force the dp, dq and qp
200 * buffer size.
201 */
202 retstatus = caam_key_deserialize_from_bn(inkey->dp,
203 &outkey->dp, size_p);
204 if (retstatus)
205 return retstatus;
206
207 /* Field dq */
208 retstatus = caam_key_deserialize_from_bn(inkey->dq,
209 &outkey->dq, size_p);
210 if (retstatus)
211 return retstatus;
212
213 /* Field qp */
214 retstatus = caam_key_deserialize_from_bn(inkey->qp,
215 &outkey->qp, size_q);
216 if (retstatus)
217 return retstatus;
218
219 /* Push fields value to the physical memory */
220 caam_key_cache_op(TEE_CACHECLEAN, &outkey->dp);
221 caam_key_cache_op(TEE_CACHECLEAN, &outkey->qp);
222 caam_key_cache_op(TEE_CACHECLEAN, &outkey->dq);
223
224 outkey->format = RSA_PRIVATE_KEY_FORMAT_3;
225
226 return CAAM_NO_ERROR;
227 }
228
229 /*
230 * Convert Crypto RSA Key additional fields of the key format #2
231 * Optional fields (p, q)
232 *
233 * @outkey [out] Output keypair in local format
234 * @inkey Input key in TEE Crypto format
235 */
do_keypair_conv_f2(struct caam_rsa_keypair * outkey,const struct rsa_keypair * inkey)236 static enum caam_status do_keypair_conv_f2(struct caam_rsa_keypair *outkey,
237 const struct rsa_keypair *inkey)
238 {
239 enum caam_status retstatus = CAAM_FAILURE;
240 size_t size_p = 0;
241 size_t size_q = 0;
242
243 size_p = crypto_bignum_num_bytes(inkey->p);
244 size_q = crypto_bignum_num_bytes(inkey->q);
245
246 /*
247 * If the Prime P or Prime Q are not filled, returns
248 * immediately. This is not an error.
249 */
250 if (size_p || !size_q)
251 return CAAM_NO_ERROR;
252
253 /* Field Prime p */
254 retstatus = caam_key_deserialize_from_bn(inkey->p, &outkey->p, 0);
255 if (retstatus)
256 return retstatus;
257
258 /* Field Prime q */
259 retstatus = caam_key_deserialize_from_bn(inkey->q, &outkey->q, 0);
260 if (retstatus)
261 return retstatus;
262
263 /* Push fields value to the physical memory */
264 caam_key_cache_op(TEE_CACHECLEAN, &outkey->p);
265 caam_key_cache_op(TEE_CACHECLEAN, &outkey->q);
266
267 outkey->format = RSA_PRIVATE_KEY_FORMAT_2;
268
269 if (CFG_NXP_CAAM_RSA_KEY_FORMAT > RSA_PRIVATE_KEY_FORMAT_2) {
270 retstatus = do_keypair_conv_f3(outkey, inkey);
271 RSA_TRACE("do_keypair_conv_f3 returned 0x%" PRIx32, retstatus);
272 }
273
274 return retstatus;
275 }
276
277 /*
278 * Convert Crypto RSA Key to local RSA Keypair Key
279 * Ensure Key is push in physical memory
280 * Don't convert the exponent e not used in decrytion
281 *
282 * @outkey [out] Output keypair in local format
283 * @inkey Input key in TEE Crypto format
284 */
do_keypair_conv(struct caam_rsa_keypair * outkey,const struct rsa_keypair * inkey)285 static enum caam_status do_keypair_conv(struct caam_rsa_keypair *outkey,
286 const struct rsa_keypair *inkey)
287 {
288 enum caam_status retstatus = CAAM_FAILURE;
289
290 RSA_TRACE("RSA Convert Keypair size N=%zu",
291 crypto_bignum_num_bytes(inkey->n));
292
293 /* Mandatory fields are n and d => Private Key Format #1 */
294 retstatus = caam_calloc_align_buf(&outkey->n,
295 crypto_bignum_num_bytes(inkey->n));
296 if (retstatus != CAAM_NO_ERROR)
297 return retstatus;
298
299 crypto_bignum_bn2bin(inkey->n, outkey->n.data);
300 cache_operation(TEE_CACHECLEAN, outkey->n.data, outkey->n.length);
301
302 retstatus = caam_key_deserialize_from_bn(inkey->d, &outkey->d, 0);
303 if (retstatus)
304 return retstatus;
305
306 caam_key_cache_op(TEE_CACHECLEAN, &outkey->d);
307
308 outkey->format = RSA_PRIVATE_KEY_FORMAT_1;
309
310 if (CFG_NXP_CAAM_RSA_KEY_FORMAT > RSA_PRIVATE_KEY_FORMAT_1) {
311 retstatus = do_keypair_conv_f2(outkey, inkey);
312 RSA_TRACE("do_keypair_conv_f2 returned 0x%" PRIx32, retstatus);
313 }
314
315 return retstatus;
316 }
317
318 /*
319 * Allocate a RSA keypair
320 *
321 * @key Keypair
322 * @size_bits Key size in bits
323 */
do_allocate_keypair(struct rsa_keypair * key,size_t size_bits)324 static TEE_Result do_allocate_keypair(struct rsa_keypair *key,
325 size_t size_bits)
326 {
327 RSA_TRACE("Allocate Keypair of %zu bits", size_bits);
328
329 /* Initialize all input key fields to 0 */
330 memset(key, 0, sizeof(*key));
331
332 /* Allocate the Public Exponent to maximum size */
333 key->e = crypto_bignum_allocate(MAX_BITS_EXP_E);
334 if (!key->e)
335 goto err_alloc_keypair;
336
337 /* Allocate the Private Exponent [d = 1/e mod LCM(p-1, q-1)] */
338 key->d = crypto_bignum_allocate(CFG_CORE_BIGNUM_MAX_BITS);
339 if (!key->d)
340 goto err_alloc_keypair;
341
342 /* Allocate the Modulus (size_bits) [n = p * q] */
343 key->n = crypto_bignum_allocate(size_bits);
344 if (!key->n)
345 goto err_alloc_keypair;
346
347 /* Allocate the prime number p */
348 key->p = crypto_bignum_allocate(CFG_CORE_BIGNUM_MAX_BITS);
349 if (!key->p)
350 goto err_alloc_keypair;
351
352 /* Allocate the prime number q */
353 key->q = crypto_bignum_allocate(CFG_CORE_BIGNUM_MAX_BITS);
354 if (!key->q)
355 goto err_alloc_keypair;
356
357 /* Allocate dp [d mod (p-1)] */
358 key->dp = crypto_bignum_allocate(CFG_CORE_BIGNUM_MAX_BITS);
359 if (!key->dp)
360 goto err_alloc_keypair;
361
362 /* Allocate dq [d mod (q-1)] */
363 key->dq = crypto_bignum_allocate(CFG_CORE_BIGNUM_MAX_BITS);
364 if (!key->dq)
365 goto err_alloc_keypair;
366
367 /* Allocate qp [1/q mod p] */
368 key->qp = crypto_bignum_allocate(CFG_CORE_BIGNUM_MAX_BITS);
369 if (!key->qp)
370 goto err_alloc_keypair;
371
372 return TEE_SUCCESS;
373
374 err_alloc_keypair:
375 RSA_TRACE("Allocation error");
376
377 do_free_keypair(key);
378
379 return TEE_ERROR_OUT_OF_MEMORY;
380 }
381
382 /*
383 * Allocate a RSA public key
384 *
385 * @key Public Key
386 * @size_bits Key size in bits
387 */
do_allocate_publickey(struct rsa_public_key * key,size_t size_bits)388 static TEE_Result do_allocate_publickey(struct rsa_public_key *key,
389 size_t size_bits)
390 {
391 RSA_TRACE("Allocate Public Key of %zu bits", size_bits);
392
393 /* Initialize all input key fields to 0 */
394 memset(key, 0, sizeof(*key));
395
396 /* Allocate the Public Exponent to maximum size */
397 key->e = crypto_bignum_allocate(MAX_BITS_EXP_E);
398 if (!key->e)
399 goto err_alloc_publickey;
400
401 /* Allocate the Modulus (size_bits) [n = p * q] */
402 key->n = crypto_bignum_allocate(size_bits);
403 if (!key->n)
404 goto err_alloc_publickey;
405
406 return TEE_SUCCESS;
407
408 err_alloc_publickey:
409 RSA_TRACE("Allocation error");
410
411 crypto_bignum_free(&key->e);
412 crypto_bignum_free(&key->n);
413
414 return TEE_ERROR_OUT_OF_MEMORY;
415 }
416
417 /*
418 * Free a RSA public key
419 *
420 * @key Public Key
421 */
do_free_publickey(struct rsa_public_key * key)422 static void do_free_publickey(struct rsa_public_key *key)
423 {
424 crypto_bignum_free(&key->e);
425 crypto_bignum_free(&key->n);
426 }
427
428 /*
429 * Output the RSA keypair format 3 additional fields in bignumber object
430 *
431 * @key [out] Keypair
432 * @genkey Key pair in local format
433 */
gen_keypair_get_f3(struct rsa_keypair * key,struct caam_rsa_keypair * genkey)434 static TEE_Result gen_keypair_get_f3(struct rsa_keypair *key,
435 struct caam_rsa_keypair *genkey)
436 {
437 enum caam_status status = CAAM_FAILURE;
438
439 caam_key_cache_op(TEE_CACHEINVALIDATE, &genkey->dp);
440 caam_key_cache_op(TEE_CACHEINVALIDATE, &genkey->dq);
441 caam_key_cache_op(TEE_CACHEINVALIDATE, &genkey->qp);
442
443 RSA_DUMPBUF("dp", genkey->dp.buf.data, genkey->dp.buf.length);
444 RSA_DUMPBUF("dq", genkey->dq.buf.data, genkey->dq.buf.length);
445 RSA_DUMPBUF("qp", genkey->qp.buf.data, genkey->qp.buf.length);
446
447 status = caam_key_serialize_to_bn(key->dp, &genkey->dp);
448 if (status)
449 return caam_status_to_tee_result(status);
450
451 status = caam_key_serialize_to_bn(key->dq, &genkey->dq);
452 if (status)
453 return caam_status_to_tee_result(status);
454
455 status = caam_key_serialize_to_bn(key->qp, &genkey->qp);
456 if (status)
457 return caam_status_to_tee_result(status);
458
459 return TEE_SUCCESS;
460 }
461
462 /*
463 * Output the RSA keypair format 2 additional fields in big number object
464 *
465 * @key [out] Keypair
466 * @genkey Key pair in local format
467 */
gen_keypair_get_f2(struct rsa_keypair * key,struct caam_rsa_keypair * genkey)468 static TEE_Result gen_keypair_get_f2(struct rsa_keypair *key,
469 struct caam_rsa_keypair *genkey)
470 {
471 enum caam_status status = CAAM_FAILURE;
472
473 caam_key_cache_op(TEE_CACHEINVALIDATE, &genkey->q);
474 caam_key_cache_op(TEE_CACHEINVALIDATE, &genkey->p);
475
476 RSA_DUMPBUF("p", genkey->p.buf.data, genkey->p.buf.length);
477 RSA_DUMPBUF("q", genkey->q.buf.data, genkey->q.buf.length);
478
479 status = caam_key_serialize_to_bn(key->p, &genkey->p);
480 if (status)
481 return caam_status_to_tee_result(status);
482
483 status = caam_key_serialize_to_bn(key->q, &genkey->q);
484 if (status)
485 return caam_status_to_tee_result(status);
486
487 if (genkey->format > RSA_PRIVATE_KEY_FORMAT_2)
488 return gen_keypair_get_f3(key, genkey);
489
490 return TEE_SUCCESS;
491 }
492
493 static TEE_Result
do_black_key_encapsulation(struct caam_rsa_keypair * rsa_keypair)494 do_black_key_encapsulation(struct caam_rsa_keypair *rsa_keypair)
495 {
496 TEE_Result ret = TEE_ERROR_GENERIC;
497 enum caam_key_type key_type = caam_key_default_key_gen_type();
498
499 ret = caam_key_black_encapsulation(&rsa_keypair->p, key_type);
500 if (ret) {
501 RSA_TRACE("RSA Key p component encapsulation failed");
502 return ret;
503 }
504
505 ret = caam_key_black_encapsulation(&rsa_keypair->q, key_type);
506 if (ret) {
507 RSA_TRACE("RSA Key q component encapsulation failed");
508 return ret;
509 }
510
511 RSA_TRACE("Black key encapsulation done");
512
513 return TEE_SUCCESS;
514 }
515
516 /*
517 * Generates a RSA keypair
518 *
519 * @key [out] Keypair
520 * @key_size Key size in bits
521 */
do_gen_keypair(struct rsa_keypair * key,size_t key_size)522 static TEE_Result do_gen_keypair(struct rsa_keypair *key, size_t key_size)
523 {
524 TEE_Result ret = TEE_ERROR_GENERIC;
525 enum caam_status retstatus = CAAM_FAILURE;
526 struct caam_rsa_keypair genkey = { };
527 size_t size_d_gen __maybe_unused = 0;
528 uint32_t *size_d_gen_val_ptr = NULL;
529 struct caam_jobctx jobctx = { };
530 uint32_t *desc = 0;
531 uint32_t desclen = 0;
532 struct prime_data_rsa prime = { };
533 enum caam_key_type key_type = caam_key_default_key_gen_type();
534 size_t key_size_bytes = key_size / 8;
535
536 RSA_TRACE("Generate Keypair of %zu bits", key_size);
537
538 genkey.format = CFG_NXP_CAAM_RSA_KEY_FORMAT;
539
540 /* Allocate the job used to prepare the operation */
541 desc = caam_calloc_desc(MAX_DESC_KEY_FINISH);
542 if (!desc) {
543 ret = TEE_ERROR_OUT_OF_MEMORY;
544 goto exit_gen_keypair;
545 }
546
547 size_d_gen_val_ptr = caam_calloc_align(sizeof(uint32_t));
548 if (!size_d_gen_val_ptr) {
549 ret = TEE_ERROR_OUT_OF_MEMORY;
550 goto exit_gen_keypair;
551 }
552
553 /* First allocate primes p and q */
554 genkey.p.key_type = CAAM_KEY_PLAIN_TEXT;
555 genkey.p.sec_size = key_size_bytes / 2;
556 genkey.p.is_blob = false;
557
558 retstatus = caam_key_alloc(&genkey.p);
559 if (retstatus != CAAM_NO_ERROR) {
560 ret = caam_status_to_tee_result(retstatus);
561 goto exit_gen_keypair;
562 }
563
564 genkey.q.key_type = CAAM_KEY_PLAIN_TEXT;
565 genkey.q.sec_size = key_size_bytes / 2;
566 genkey.q.is_blob = false;
567
568 retstatus = caam_key_alloc(&genkey.q);
569 if (retstatus != CAAM_NO_ERROR) {
570 ret = caam_status_to_tee_result(retstatus);
571 goto exit_gen_keypair;
572 }
573
574 /* Allocate Public exponent to a caam buffer */
575 retstatus = caam_calloc_buf(&genkey.e, crypto_bignum_num_bytes(key->e));
576 if (retstatus != CAAM_NO_ERROR) {
577 ret = caam_status_to_tee_result(retstatus);
578 goto exit_gen_keypair;
579 }
580
581 genkey.d.key_type = key_type;
582 genkey.d.sec_size = key_size_bytes;
583 genkey.d.is_blob = false;
584
585 retstatus = caam_key_alloc(&genkey.d);
586 if (retstatus != CAAM_NO_ERROR) {
587 ret = caam_status_to_tee_result(retstatus);
588 goto exit_gen_keypair;
589 }
590
591 retstatus = caam_calloc_align_buf(&genkey.n, key_size_bytes);
592 if (retstatus != CAAM_NO_ERROR) {
593 ret = caam_status_to_tee_result(retstatus);
594 goto exit_gen_keypair;
595 }
596
597 if (genkey.format > RSA_PRIVATE_KEY_FORMAT_2) {
598 genkey.dp.key_type = key_type;
599 genkey.dp.sec_size = key_size_bytes / 2;
600 genkey.dp.is_blob = false;
601
602 retstatus = caam_key_alloc(&genkey.dp);
603 if (retstatus != CAAM_NO_ERROR) {
604 ret = caam_status_to_tee_result(retstatus);
605 goto exit_gen_keypair;
606 }
607
608 genkey.dq.key_type = key_type;
609 genkey.dq.sec_size = key_size_bytes / 2;
610 genkey.dq.is_blob = false;
611
612 retstatus = caam_key_alloc(&genkey.dq);
613 if (retstatus != CAAM_NO_ERROR) {
614 ret = caam_status_to_tee_result(retstatus);
615 goto exit_gen_keypair;
616 }
617
618 genkey.qp.key_type = key_type;
619 genkey.qp.sec_size = key_size_bytes / 2;
620 genkey.qp.is_blob = false;
621
622 retstatus = caam_key_alloc(&genkey.qp);
623 if (retstatus != CAAM_NO_ERROR) {
624 ret = caam_status_to_tee_result(retstatus);
625 goto exit_gen_keypair;
626 }
627 }
628
629 crypto_bignum_bn2bin(key->e, genkey.e.data);
630
631 prime.era = caam_era;
632 prime.key_size = key_size;
633 prime.e = &genkey.e;
634 prime.p = &genkey.p.buf;
635 prime.q = &genkey.q.buf;
636
637 /* Generate prime p and q */
638 retstatus = caam_prime_rsa_gen(&prime);
639 RSA_TRACE("Generate Prime P and Q returned 0x%" PRIx32, retstatus);
640 if (retstatus != CAAM_NO_ERROR) {
641 ret = caam_status_to_tee_result(retstatus);
642 goto exit_gen_keypair;
643 }
644
645 caam_desc_init(desc);
646 caam_desc_add_word(desc, DESC_HEADER(0));
647
648 caam_desc_add_word(desc, 0);
649 caam_desc_add_word(desc, PDB_RSA_KEY_P_SIZE(genkey.p.sec_size));
650 caam_desc_add_word(desc, PDB_RSA_KEY_N_SIZE(genkey.n.length) |
651 PDB_RSA_KEY_E_SIZE(genkey.e.length));
652
653 caam_desc_add_ptr(desc, genkey.p.buf.paddr);
654 caam_desc_add_ptr(desc, genkey.q.buf.paddr);
655 caam_desc_add_ptr(desc, genkey.e.paddr);
656 caam_desc_add_ptr(desc, genkey.n.paddr);
657 caam_desc_add_ptr(desc, genkey.d.buf.paddr);
658 caam_desc_add_ptr(desc, virt_to_phys(size_d_gen_val_ptr));
659
660 if (genkey.format > RSA_PRIVATE_KEY_FORMAT_2) {
661 caam_desc_add_ptr(desc, genkey.dp.buf.paddr);
662 caam_desc_add_ptr(desc, genkey.dq.buf.paddr);
663 caam_desc_add_ptr(desc, genkey.qp.buf.paddr);
664
665 switch (key_type) {
666 case CAAM_KEY_PLAIN_TEXT:
667 caam_desc_add_word(desc, RSA_FINAL_KEY(ALL, NONE));
668 break;
669 case CAAM_KEY_BLACK_ECB:
670 caam_desc_add_word(desc, RSA_FINAL_KEY(ALL, ECB));
671 break;
672 case CAAM_KEY_BLACK_CCM:
673 caam_desc_add_word(desc, RSA_FINAL_KEY(ALL, CCM));
674 break;
675 default:
676 ret = TEE_ERROR_GENERIC;
677 goto exit_gen_keypair;
678 }
679
680 caam_key_cache_op(TEE_CACHEFLUSH, &genkey.dp);
681 caam_key_cache_op(TEE_CACHEFLUSH, &genkey.dq);
682 caam_key_cache_op(TEE_CACHEFLUSH, &genkey.qp);
683 } else {
684 switch (key_type) {
685 case CAAM_KEY_PLAIN_TEXT:
686 caam_desc_add_word(desc, RSA_FINAL_KEY(N_D, NONE));
687 break;
688 case CAAM_KEY_BLACK_ECB:
689 caam_desc_add_word(desc, RSA_FINAL_KEY(N_D, ECB));
690 break;
691 case CAAM_KEY_BLACK_CCM:
692 caam_desc_add_word(desc, RSA_FINAL_KEY(N_D, CCM));
693 break;
694 default:
695 ret = TEE_ERROR_GENERIC;
696 goto exit_gen_keypair;
697 }
698 }
699
700 desclen = caam_desc_get_len(desc);
701 caam_desc_update_hdr(desc, DESC_HEADER_IDX(desclen, desclen - 1));
702
703 jobctx.desc = desc;
704 RSA_DUMPDESC(desc);
705
706 cache_operation(TEE_CACHECLEAN, genkey.e.data, genkey.e.length);
707 caam_key_cache_op(TEE_CACHEFLUSH, &genkey.p);
708 caam_key_cache_op(TEE_CACHEFLUSH, &genkey.q);
709 caam_key_cache_op(TEE_CACHEFLUSH, &genkey.d);
710 cache_operation(TEE_CACHEFLUSH, genkey.n.data, genkey.n.length);
711 cache_operation(TEE_CACHEFLUSH, size_d_gen_val_ptr, sizeof(uint32_t));
712
713 retstatus = caam_jr_enqueue(&jobctx, NULL);
714
715 if (retstatus == CAAM_NO_ERROR) {
716 caam_key_cache_op(TEE_CACHEINVALIDATE, &genkey.d);
717 cache_operation(TEE_CACHEINVALIDATE, &genkey.n,
718 genkey.n.length);
719
720 cache_operation(TEE_CACHEINVALIDATE, size_d_gen_val_ptr,
721 sizeof(uint32_t));
722
723 size_d_gen = caam_read_val32(size_d_gen_val_ptr);
724
725 RSA_TRACE("D size %zu", size_d_gen);
726 RSA_DUMPBUF("D", genkey.d.buf.data, genkey.d.buf.length);
727 RSA_DUMPBUF("N", genkey.n.data, genkey.n.length);
728
729 genkey.d.sec_size = size_d_gen;
730
731 if (key_type != CAAM_KEY_PLAIN_TEXT) {
732 ret = do_black_key_encapsulation(&genkey);
733 if (ret != TEE_SUCCESS)
734 goto exit_gen_keypair;
735 }
736
737 ret = crypto_bignum_bin2bn(genkey.n.data, genkey.n.length,
738 key->n);
739 if (ret != TEE_SUCCESS)
740 goto exit_gen_keypair;
741
742 retstatus = caam_key_serialize_to_bn(key->d, &genkey.d);
743 if (retstatus) {
744 ret = caam_status_to_tee_result(retstatus);
745 goto exit_gen_keypair;
746 }
747
748 if (genkey.format > RSA_PRIVATE_KEY_FORMAT_1)
749 ret = gen_keypair_get_f2(key, &genkey);
750 } else {
751 RSA_TRACE("CAAM Status 0x%08" PRIx32, jobctx.status);
752 ret = job_status_to_tee_result(jobctx.status);
753 }
754
755 exit_gen_keypair:
756 do_keypair_free(&genkey);
757 caam_free(size_d_gen_val_ptr);
758 caam_free_desc(&desc);
759
760 return ret;
761 }
762
763 /*
764 * RSA EME-OAEP Decoding operation
765 * Refer the chapter 7.1.2 Decryption operation of pkcs-1v2-1 specification
766 *
767 * @rsa_data [in/out] RSA Data to encode
768 */
do_oaep_decoding(struct drvcrypt_rsa_ed * rsa_data)769 static TEE_Result do_oaep_decoding(struct drvcrypt_rsa_ed *rsa_data)
770 {
771 TEE_Result ret = TEE_ERROR_GENERIC;
772 enum caam_status retstatus = CAAM_FAILURE;
773 struct caambuf DB = { };
774 struct caambuf lHash = { };
775 struct caambuf seed = { };
776 struct caambuf dbMask = { };
777 struct caambuf maskedDB = { };
778 struct caambuf maskedSeed = { };
779 struct caambuf EM = { };
780 size_t db_size = 0;
781 size_t b01_idx = 0;
782 size_t db_len = 0;
783 struct drvcrypt_rsa_mgf mgf_data = { };
784 struct drvcrypt_rsa_ed dec_data = { };
785 struct drvcrypt_mod_op mod_op = { };
786
787 RSA_TRACE("RSA OAEP Decoding");
788
789 /*
790 * First Decryption of the Cipher to a EM of modulus size
791 */
792 retstatus = caam_calloc_align_buf(&EM, rsa_data->key.n_size);
793 if (retstatus != CAAM_NO_ERROR) {
794 ret = caam_status_to_tee_result(retstatus);
795 goto exit_oaep_decrypt;
796 }
797
798 memcpy(&dec_data, rsa_data, sizeof(dec_data));
799 dec_data.message.data = EM.data;
800 dec_data.message.length = EM.length;
801
802 ret = do_caam_decrypt(&dec_data, RSA_DECRYPT(NO));
803
804 RSA_DUMPBUF("EM", EM.data, EM.length);
805
806 /*
807 * DB = lHash' || PS || 0x01 || M
808 * DB length = k - hLen - 1
809 *
810 * PS is a 0's buffer of length h - mLen - 2hLen - 2
811 *
812 * k is the key modulus length
813 * hLen is the Hash digest length
814 * mLen is the input RSA message length
815 */
816 /* Calculate the DB size */
817 db_size = rsa_data->key.n_size - rsa_data->digest_size - 1;
818 RSA_TRACE("DB is %zu bytes", db_size);
819
820 /* Allocate the DB buffer */
821 retstatus = caam_calloc_align_buf(&DB, db_size);
822 if (retstatus != CAAM_NO_ERROR) {
823 ret = caam_status_to_tee_result(retstatus);
824 goto exit_oaep_decrypt;
825 }
826
827 /*
828 * Step a
829 * Generate the lHash
830 */
831 /* Allocate the lHash buffer */
832 retstatus = caam_calloc_align_buf(&lHash, rsa_data->digest_size);
833 if (retstatus != CAAM_NO_ERROR) {
834 ret = caam_status_to_tee_result(retstatus);
835 goto exit_oaep_decrypt;
836 }
837
838 RSA_TRACE("Hash the RSA Label of %zu bytes", rsa_data->label.length);
839 ret = tee_hash_createdigest(rsa_data->hash_algo, rsa_data->label.data,
840 rsa_data->label.length, lHash.data,
841 lHash.length);
842 RSA_TRACE("Hash the RSA Label returned 0x%08" PRIx32, ret);
843 if (ret != TEE_SUCCESS)
844 goto exit_oaep_decrypt;
845
846 RSA_DUMPBUF("lHash", lHash.data, lHash.length);
847
848 /* Allocate the seed buffer */
849 retstatus = caam_calloc_align_buf(&seed, rsa_data->digest_size);
850 if (retstatus != CAAM_NO_ERROR) {
851 ret = caam_status_to_tee_result(retstatus);
852 goto exit_oaep_decrypt;
853 }
854
855 /* Allocate the dbMask buffer */
856 retstatus = caam_calloc_align_buf(&dbMask, db_size);
857 if (retstatus != CAAM_NO_ERROR) {
858 ret = caam_status_to_tee_result(retstatus);
859 goto exit_oaep_decrypt;
860 }
861
862 /*
863 * Step b
864 * Split the EM string
865 * EM = Y || maskedSeed || maskedDB
866 *
867 * Where:
868 * Y size = 1 byte
869 * maskedSeed size = hLen
870 * maskedDB size = k - hLen - 1 bytes
871 *
872 * k is the key modulus length
873 * hLen is the Hash digest length
874 * mLen is the input RSA message length
875 *
876 * Note Y should have been remove during the
877 */
878 maskedSeed.data = &EM.data[1];
879 maskedSeed.length = rsa_data->digest_size;
880 maskedSeed.paddr = EM.paddr + sizeof(uint8_t);
881
882 maskedDB.data = &EM.data[1 + rsa_data->digest_size];
883 maskedDB.length = dbMask.length;
884 maskedDB.paddr = EM.paddr + sizeof(uint8_t) + rsa_data->digest_size;
885
886 /*
887 * Step c
888 * Generate a Mask of the maskedDB
889 * seedMask = MGF(maskedDB, k - hLen - 1)
890 *
891 * Note: Use same buffer for seed and seedMask
892 */
893 mgf_data.hash_algo = rsa_data->mgf_algo;
894 mgf_data.digest_size = rsa_data->mgf_size;
895 mgf_data.seed.data = maskedDB.data;
896 mgf_data.seed.length = maskedDB.length;
897 mgf_data.mask.data = seed.data;
898 mgf_data.mask.length = seed.length;
899
900 ret = rsa_data->mgf(&mgf_data);
901 if (ret != TEE_SUCCESS)
902 goto exit_oaep_decrypt;
903
904 /*
905 * Step d
906 * seed = maskedSeed xor seedMask
907 *
908 * Note: Use same buffer for seed and seedMask
909 */
910 mod_op.n.length = seed.length;
911 mod_op.a.data = maskedSeed.data;
912 mod_op.a.length = maskedSeed.length;
913 mod_op.b.data = seed.data;
914 mod_op.b.length = seed.length;
915 mod_op.result.data = seed.data;
916 mod_op.result.length = seed.length;
917
918 retstatus = drvcrypt_xor_mod_n(&mod_op);
919 if (retstatus != CAAM_NO_ERROR) {
920 ret = caam_status_to_tee_result(retstatus);
921 goto exit_oaep_decrypt;
922 }
923
924 RSA_DUMPBUF("Seed", seed.data, seed.length);
925
926 /*
927 * Step e
928 * Generate a Mask of the seed value
929 * dbMask = MGF(seed, k - hLen - 1)
930 */
931 mgf_data.seed.data = seed.data;
932 mgf_data.seed.length = seed.length;
933 mgf_data.mask.data = dbMask.data;
934 mgf_data.mask.length = dbMask.length;
935
936 ret = rsa_data->mgf(&mgf_data);
937 if (ret != TEE_SUCCESS)
938 goto exit_oaep_decrypt;
939
940 /*
941 * Step f
942 * DB = maskedDB xor dbMask
943 */
944 mod_op.n.length = DB.length;
945 mod_op.a.data = maskedDB.data;
946 mod_op.a.length = maskedDB.length;
947 mod_op.b.data = dbMask.data;
948 mod_op.b.length = dbMask.length;
949 mod_op.result.data = DB.data;
950 mod_op.result.length = DB.length;
951
952 retstatus = drvcrypt_xor_mod_n(&mod_op);
953 if (retstatus != CAAM_NO_ERROR) {
954 ret = caam_status_to_tee_result(retstatus);
955 goto exit_oaep_decrypt;
956 }
957
958 RSA_DUMPBUF("DB", DB.data, DB.length);
959
960 /*
961 * Step g
962 * Check the DB generated
963 * DB = lHash' || PS || 0x01 || M
964 *
965 * Error if:
966 * - lHash' != lHash (First step - Hash the Label)
967 * - byte 0x01 between PS and M is not present
968 */
969 /* Check Hash values */
970 if (memcmp(DB.data, lHash.data, lHash.length)) {
971 RSA_TRACE("Hash error");
972 ret = TEE_ERROR_BAD_PARAMETERS;
973 goto exit_oaep_decrypt;
974 }
975
976 /* Find the byte 0x01 separating PS and M */
977 for (b01_idx = rsa_data->digest_size;
978 b01_idx < db_size && !DB.data[b01_idx]; b01_idx++)
979 ;
980
981 if (b01_idx == db_size) {
982 RSA_TRACE("byte 0x01 not present");
983 ret = TEE_ERROR_BAD_PARAMETERS;
984 goto exit_oaep_decrypt;
985 }
986
987 db_len = DB.length - b01_idx - 1;
988
989 if (rsa_data->message.length < db_len) {
990 rsa_data->message.length = db_len;
991 ret = TEE_ERROR_SHORT_BUFFER;
992 goto exit_oaep_decrypt;
993 }
994
995 rsa_data->message.length = db_len;
996 memcpy(rsa_data->message.data, &DB.data[b01_idx + 1],
997 rsa_data->message.length);
998
999 RSA_DUMPBUF("Message decrypted", rsa_data->message.data,
1000 rsa_data->message.length);
1001 ret = TEE_SUCCESS;
1002
1003 exit_oaep_decrypt:
1004 caam_free_buf(&EM);
1005 caam_free_buf(&DB);
1006 caam_free_buf(&seed);
1007 caam_free_buf(&dbMask);
1008 caam_free_buf(&lHash);
1009
1010 return ret;
1011 }
1012
1013 /*
1014 * RSA EME-OAEP Encoding operation
1015 * Refer the chapter 7.1.1 Encryption operation of pkcs-1v2-1 specification
1016 *
1017 * @rsa_data [int/out] RSA Data to encode
1018 */
do_oaep_encoding(struct drvcrypt_rsa_ed * rsa_data)1019 static TEE_Result do_oaep_encoding(struct drvcrypt_rsa_ed *rsa_data)
1020 {
1021 TEE_Result ret = TEE_ERROR_GENERIC;
1022 enum caam_status retstatus;
1023 struct caambuf DB = { };
1024 struct caambuf lHash = { };
1025 struct caambuf seed = { };
1026 struct caambuf dbMask = { };
1027 struct caambuf maskedDB = { };
1028 struct caambuf maskedSeed = { };
1029 struct caambuf EM = { };
1030 size_t db_size = 0;
1031 size_t ps_size = 0;
1032 struct drvcrypt_rsa_mgf mgf_data = { };
1033 struct drvcrypt_rsa_ed enc_data = { };
1034 struct drvcrypt_mod_op mod_op = { };
1035
1036 RSA_TRACE("RSA OAEP Encoding");
1037
1038 /*
1039 * DB = lHash || PS || 0x01 || M
1040 * DB length = k - hLen - 1
1041 *
1042 * PS is a 0's buffer of length h - mLen - 2hLen - 2
1043 *
1044 * k is the key modulus length
1045 * hLen is the Hash digest length
1046 * mLen is the input RSA message length
1047 */
1048 /* Calculate the DB size */
1049 db_size = rsa_data->key.n_size - rsa_data->digest_size - 1;
1050 RSA_TRACE("DB is %zu bytes", db_size);
1051
1052 /* Allocate the DB buffer */
1053 retstatus = caam_calloc_align_buf(&DB, db_size);
1054 if (retstatus != CAAM_NO_ERROR) {
1055 ret = caam_status_to_tee_result(retstatus);
1056 goto exit_oaep_encrypt;
1057 }
1058
1059 /*
1060 * Step a
1061 * Generate the lHash
1062 */
1063 lHash.length = rsa_data->digest_size;
1064 lHash.data = DB.data;
1065
1066 RSA_TRACE("Hash the RSA Label of %zu bytes", rsa_data->label.length);
1067 ret = tee_hash_createdigest(rsa_data->hash_algo, rsa_data->label.data,
1068 rsa_data->label.length, lHash.data,
1069 lHash.length);
1070 RSA_TRACE("Hash the RSA Label returned 0x%08" PRIx32, ret);
1071 if (ret != TEE_SUCCESS)
1072 goto exit_oaep_encrypt;
1073 RSA_DUMPBUF("lHash", lHash.data, lHash.length);
1074
1075 /*
1076 * Step b
1077 * Add PS 0's
1078 * Note: DB is already filled with 0's at the allocation
1079 */
1080 ps_size = rsa_data->key.n_size - rsa_data->message.length -
1081 2 * rsa_data->digest_size - 2;
1082 RSA_TRACE("PS is %zu bytes", ps_size);
1083
1084 /*
1085 * Step c
1086 * Set the value 0x01 after the lHash and the PS
1087 * Concatenate result with input message
1088 */
1089 DB.data[lHash.length + ps_size] = 0x01;
1090 memcpy(&DB.data[lHash.length + ps_size + 1], rsa_data->message.data,
1091 rsa_data->message.length);
1092
1093 RSA_DUMPBUF("DB", DB.data, DB.length);
1094
1095 /*
1096 * Step d
1097 * Generate a random seed of hLen
1098 */
1099 /* Allocate the seed buffer */
1100 retstatus = caam_calloc_align_buf(&seed, rsa_data->digest_size);
1101 if (retstatus != CAAM_NO_ERROR) {
1102 ret = caam_status_to_tee_result(retstatus);
1103 goto exit_oaep_encrypt;
1104 }
1105
1106 /* Allocate the dbMask buffer */
1107 retstatus = caam_calloc_align_buf(&dbMask, db_size);
1108 if (retstatus != CAAM_NO_ERROR) {
1109 ret = caam_status_to_tee_result(retstatus);
1110 goto exit_oaep_encrypt;
1111 }
1112
1113 ret = crypto_rng_read(seed.data, seed.length);
1114 RSA_TRACE("Get seed of %zu bytes (ret = 0x%08" PRIx32 ")", seed.length,
1115 ret);
1116 if (ret != TEE_SUCCESS)
1117 goto exit_oaep_encrypt;
1118
1119 RSA_DUMPBUF("Seed", seed.data, seed.length);
1120
1121 /*
1122 * Step e
1123 * Generate a Mask of the seed value
1124 * dbMask = MGF(seed, k - hLen - 1)
1125 */
1126 mgf_data.hash_algo = rsa_data->mgf_algo;
1127 mgf_data.digest_size = rsa_data->mgf_size;
1128 mgf_data.seed.data = seed.data;
1129 mgf_data.seed.length = seed.length;
1130 mgf_data.mask.data = dbMask.data;
1131 mgf_data.mask.length = dbMask.length;
1132
1133 ret = rsa_data->mgf(&mgf_data);
1134 if (ret != TEE_SUCCESS)
1135 goto exit_oaep_encrypt;
1136
1137 /*
1138 * Step f
1139 * maskedDB = DB xor dbMask
1140 */
1141 retstatus = caam_calloc_align_buf(&EM, rsa_data->key.n_size);
1142 if (retstatus != CAAM_NO_ERROR) {
1143 ret = caam_status_to_tee_result(retstatus);
1144 goto exit_oaep_encrypt;
1145 }
1146
1147 maskedDB.data = &EM.data[1 + rsa_data->digest_size];
1148 maskedDB.length = dbMask.length;
1149 maskedDB.paddr = EM.paddr + sizeof(uint8_t) + rsa_data->digest_size;
1150
1151 mod_op.n.length = maskedDB.length;
1152 mod_op.a.data = DB.data;
1153 mod_op.a.length = DB.length;
1154 mod_op.b.data = dbMask.data;
1155 mod_op.b.length = dbMask.length;
1156 mod_op.result.data = maskedDB.data;
1157 mod_op.result.length = maskedDB.length;
1158
1159 ret = drvcrypt_xor_mod_n(&mod_op);
1160 if (ret != TEE_SUCCESS)
1161 goto exit_oaep_encrypt;
1162
1163 /*
1164 * Step g
1165 * Generate a Mask of the maskedDB
1166 * seedMask = MGF(maskedDB, hLen)
1167 *
1168 * Note: Use same buffer for seedMask and maskedSeed
1169 */
1170 maskedSeed.data = &EM.data[1];
1171 maskedSeed.length = rsa_data->digest_size;
1172 maskedSeed.paddr = EM.paddr + sizeof(uint8_t);
1173
1174 mgf_data.seed.data = maskedDB.data;
1175 mgf_data.seed.length = maskedDB.length;
1176 mgf_data.mask.data = maskedSeed.data;
1177 mgf_data.mask.length = maskedSeed.length;
1178 ret = rsa_data->mgf(&mgf_data);
1179 if (ret != TEE_SUCCESS)
1180 goto exit_oaep_encrypt;
1181
1182 /*
1183 * Step h
1184 * maskedSeed = seed xor seedMask
1185 */
1186 mod_op.n.length = maskedSeed.length;
1187 mod_op.a.data = seed.data;
1188 mod_op.a.length = seed.length;
1189 mod_op.b.data = maskedSeed.data;
1190 mod_op.b.length = maskedSeed.length;
1191 mod_op.result.data = maskedSeed.data;
1192 mod_op.result.length = maskedSeed.length;
1193
1194 ret = drvcrypt_xor_mod_n(&mod_op);
1195 if (ret != TEE_SUCCESS)
1196 goto exit_oaep_encrypt;
1197
1198 RSA_DUMPBUF("EM", EM.data, EM.length);
1199
1200 /*
1201 * Last Encryption of the EM of modulus size to Cipher
1202 */
1203 memcpy(&enc_data, rsa_data, sizeof(enc_data));
1204
1205 enc_data.message.data = EM.data;
1206 enc_data.message.length = EM.length;
1207
1208 ret = do_caam_encrypt(&enc_data, RSA_ENCRYPT(NO));
1209
1210 exit_oaep_encrypt:
1211 caam_free_buf(&DB);
1212 caam_free_buf(&seed);
1213 caam_free_buf(&dbMask);
1214 caam_free_buf(&EM);
1215
1216 return ret;
1217 }
1218
1219 /*
1220 * CAAM RSA Encryption of the input message to a cipher
1221 *
1222 * @rsa_data [in/out] RSA Data to encrypt
1223 * @operation CAAM RSA Encryption operation
1224 */
do_caam_encrypt(struct drvcrypt_rsa_ed * rsa_data,uint32_t operation)1225 static TEE_Result do_caam_encrypt(struct drvcrypt_rsa_ed *rsa_data,
1226 uint32_t operation)
1227 {
1228 TEE_Result ret = TEE_ERROR_GENERIC;
1229 enum caam_status retstatus = CAAM_FAILURE;
1230 struct caam_rsa_keypair key = { };
1231 struct caamdmaobj msg = { };
1232 struct caamdmaobj cipher = { };
1233 struct caam_jobctx jobctx = { };
1234 uint32_t *desc = NULL;
1235 uint32_t desclen = 0;
1236 uint32_t pdb_sgt_flags = 0;
1237
1238 RSA_TRACE("RSA Encrypt mode %d", rsa_data->rsa_id);
1239
1240 /* Allocate the job descriptor */
1241 desc = caam_calloc_desc(MAX_DESC_ENC);
1242 if (!desc) {
1243 ret = TEE_ERROR_OUT_OF_MEMORY;
1244 goto exit_encrypt;
1245 }
1246
1247 /*
1248 * Convert TEE rsa key type to CAAM rsa key type
1249 * Push key value to memory
1250 */
1251 retstatus = do_keypub_conv(&key, rsa_data->key.key);
1252 if (retstatus != CAAM_NO_ERROR) {
1253 ret = caam_status_to_tee_result(retstatus);
1254 goto exit_encrypt;
1255 }
1256
1257 /*
1258 * ReAllocate the cipher result buffer with a maximum size
1259 * of the Key Modulus's size (N) if not cache aligned
1260 */
1261 ret = caam_dmaobj_output_sgtbuf(&cipher, rsa_data->cipher.data,
1262 rsa_data->cipher.length, key.n.length);
1263 if (ret)
1264 goto exit_encrypt;
1265
1266 if (cipher.sgtbuf.sgt_type)
1267 pdb_sgt_flags |= PDB_RSA_ENC_SGT_G;
1268
1269 caam_dmaobj_cache_push(&cipher);
1270
1271 /* Prepare the input message CAAM descriptor entry */
1272 ret = caam_dmaobj_input_sgtbuf(&msg, rsa_data->message.data,
1273 rsa_data->message.length);
1274 if (ret)
1275 goto exit_encrypt;
1276
1277 if (msg.sgtbuf.sgt_type)
1278 pdb_sgt_flags |= PDB_RSA_ENC_SGT_F;
1279
1280 caam_dmaobj_cache_push(&msg);
1281
1282 caam_desc_init(desc);
1283 caam_desc_add_word(desc, DESC_HEADER(0));
1284 caam_desc_add_word(desc, PDB_RSA_ENC_E_SIZE(key.e.length) |
1285 PDB_RSA_ENC_N_SIZE(key.n.length) |
1286 pdb_sgt_flags);
1287 caam_desc_add_ptr(desc, msg.sgtbuf.paddr);
1288 caam_desc_add_ptr(desc, cipher.sgtbuf.paddr);
1289 caam_desc_add_ptr(desc, key.n.paddr);
1290 caam_desc_add_ptr(desc, key.e.paddr);
1291 caam_desc_add_word(desc, PDB_RSA_ENC_F_SIZE(rsa_data->message.length));
1292 caam_desc_add_word(desc, operation);
1293
1294 /* Set the descriptor Header with length */
1295 desclen = caam_desc_get_len(desc);
1296 caam_desc_update_hdr(desc, DESC_HEADER_IDX(desclen, desclen - 1));
1297 RSA_DUMPDESC(desc);
1298
1299 jobctx.desc = desc;
1300 retstatus = caam_jr_enqueue(&jobctx, NULL);
1301
1302 if (retstatus == CAAM_NO_ERROR) {
1303 rsa_data->cipher.length = caam_dmaobj_copy_to_orig(&cipher);
1304
1305 RSA_DUMPBUF("Output", rsa_data->cipher.data,
1306 rsa_data->cipher.length);
1307 ret = caam_status_to_tee_result(retstatus);
1308 } else {
1309 RSA_TRACE("CAAM Status 0x%08" PRIx32, jobctx.status);
1310 ret = job_status_to_tee_result(jobctx.status);
1311 }
1312
1313 exit_encrypt:
1314 caam_free_desc(&desc);
1315 do_keypair_free(&key);
1316 caam_dmaobj_free(&msg);
1317 caam_dmaobj_free(&cipher);
1318
1319 return ret;
1320 }
1321
1322 /*
1323 * Get RSA key pair key type
1324 *
1325 * @kp RSA key pair
1326 */
get_caam_key_type(const struct caam_rsa_keypair kp)1327 static enum caam_key_type get_caam_key_type(const struct caam_rsa_keypair kp)
1328 {
1329 switch (kp.format) {
1330 case RSA_PRIVATE_KEY_FORMAT_1:
1331 return kp.d.key_type;
1332 case RSA_PRIVATE_KEY_FORMAT_2:
1333 if (kp.p.key_type == kp.q.key_type &&
1334 kp.q.key_type == kp.d.key_type)
1335 return kp.p.key_type;
1336 else
1337 return CAAM_KEY_MAX_VALUE;
1338 case RSA_PRIVATE_KEY_FORMAT_3:
1339 if (kp.p.key_type == kp.q.key_type &&
1340 kp.q.key_type == kp.dp.key_type &&
1341 kp.dp.key_type == kp.dq.key_type &&
1342 kp.dq.key_type == kp.qp.key_type)
1343 return kp.p.key_type;
1344 else
1345 return CAAM_KEY_MAX_VALUE;
1346 default:
1347 return CAAM_KEY_MAX_VALUE;
1348 }
1349 }
1350
1351 /*
1352 * CAAM RSA Decryption of the input cipher to a message
1353 *
1354 * @rsa_data [in/out] RSA Data to decrypt
1355 * @operation CAAM RSA Decryption operation
1356 */
do_caam_decrypt(struct drvcrypt_rsa_ed * rsa_data,uint32_t operation)1357 static TEE_Result do_caam_decrypt(struct drvcrypt_rsa_ed *rsa_data,
1358 uint32_t operation)
1359 {
1360 TEE_Result ret = TEE_ERROR_GENERIC;
1361 enum caam_status retstatus = CAAM_FAILURE;
1362 struct caam_rsa_keypair key = { };
1363 struct caamdmaobj cipher = { };
1364 struct caamdmaobj msg = { };
1365 struct caam_jobctx jobctx = { };
1366 uint32_t *desc = NULL;
1367 uint32_t desclen = 0;
1368 uint32_t pdb_sgt_flags = 0;
1369 struct caambuf size_msg = { };
1370 struct caamkey tmp_1 = { };
1371 struct caamkey tmp_2 = { };
1372 enum caam_key_type g_key_type = CAAM_KEY_MAX_VALUE;
1373
1374 RSA_TRACE("RSA Decrypt mode %d", rsa_data->rsa_id);
1375
1376 /*
1377 * Convert TEE rsa key type to CAAM rsa key type
1378 * Push key value to memory
1379 */
1380 retstatus = do_keypair_conv(&key, rsa_data->key.key);
1381 if (retstatus != CAAM_NO_ERROR) {
1382 RSA_TRACE("do_keypair_conv returned 0x%" PRIx32, retstatus);
1383 ret = caam_status_to_tee_result(retstatus);
1384 goto exit_decrypt;
1385 }
1386
1387 /*
1388 * Allocate the temporary result buffer with a maximum size
1389 * of the Key Modulus's size (N)
1390 */
1391 ret = caam_dmaobj_output_sgtbuf(&msg, rsa_data->message.data,
1392 rsa_data->message.length, key.n.length);
1393
1394 if (ret)
1395 goto exit_decrypt;
1396
1397 if (msg.sgtbuf.sgt_type)
1398 pdb_sgt_flags |= PDB_RSA_DEC_SGT_F;
1399
1400 caam_dmaobj_cache_push(&msg);
1401
1402 /* Allocate the returned computed size when PKCS V1.5 */
1403 if ((operation & PROT_RSA_FMT_MASK) == PROT_RSA_FMT(PKCS_V1_5)) {
1404 retstatus = caam_alloc_align_buf(&size_msg, 4);
1405 if (retstatus != CAAM_NO_ERROR)
1406 goto exit_decrypt;
1407
1408 cache_operation(TEE_CACHEFLUSH, size_msg.data, size_msg.length);
1409 }
1410
1411 /* Prepare the input cipher CAAM descriptor entry */
1412 ret = caam_dmaobj_input_sgtbuf(&cipher, rsa_data->cipher.data,
1413 rsa_data->cipher.length);
1414
1415 if (cipher.sgtbuf.sgt_type)
1416 pdb_sgt_flags |= PDB_RSA_DEC_SGT_G;
1417
1418 caam_dmaobj_cache_push(&cipher);
1419
1420 /* Allocate the job descriptor function of the Private key format */
1421 switch (key.format) {
1422 case RSA_PRIVATE_KEY_FORMAT_1:
1423 desc = caam_calloc_desc(MAX_DESC_DEC_1);
1424 if (!desc) {
1425 ret = TEE_ERROR_OUT_OF_MEMORY;
1426 goto exit_decrypt;
1427 }
1428 break;
1429
1430 case RSA_PRIVATE_KEY_FORMAT_2:
1431 case RSA_PRIVATE_KEY_FORMAT_3:
1432 if (key.format == RSA_PRIVATE_KEY_FORMAT_2)
1433 desc = caam_calloc_desc(MAX_DESC_DEC_2);
1434 else
1435 desc = caam_calloc_desc(MAX_DESC_DEC_3);
1436
1437 if (!desc) {
1438 ret = TEE_ERROR_OUT_OF_MEMORY;
1439 goto exit_decrypt;
1440 }
1441 /* Allocate two temporary buffers used by the CAAM */
1442 tmp_1.key_type = CAAM_KEY_PLAIN_TEXT;
1443 tmp_1.sec_size = key.p.sec_size;
1444 tmp_1.is_blob = false;
1445
1446 retstatus = caam_key_alloc(&tmp_1);
1447 if (retstatus != CAAM_NO_ERROR) {
1448 ret = caam_status_to_tee_result(retstatus);
1449 goto exit_decrypt;
1450 }
1451
1452 tmp_2.key_type = CAAM_KEY_PLAIN_TEXT;
1453 tmp_2.sec_size = key.q.sec_size;
1454 tmp_2.is_blob = false;
1455
1456 retstatus = caam_key_alloc(&tmp_2);
1457 if (retstatus != CAAM_NO_ERROR) {
1458 ret = caam_status_to_tee_result(retstatus);
1459 goto exit_decrypt;
1460 }
1461
1462 caam_key_cache_op(TEE_CACHEFLUSH, &tmp_1);
1463 caam_key_cache_op(TEE_CACHEFLUSH, &tmp_2);
1464 break;
1465
1466 default:
1467 ret = TEE_ERROR_GENERIC;
1468 goto exit_decrypt;
1469 }
1470
1471 caam_desc_init(desc);
1472 caam_desc_add_word(desc, DESC_HEADER(0));
1473
1474 /* Build the descriptor function of the Private Key format */
1475 switch (key.format) {
1476 case RSA_PRIVATE_KEY_FORMAT_1:
1477 caam_desc_add_word(desc,
1478 PDB_RSA_DEC_D_SIZE(key.d.sec_size) |
1479 PDB_RSA_DEC_N_SIZE(key.n.length) |
1480 pdb_sgt_flags);
1481 caam_desc_add_ptr(desc, cipher.sgtbuf.paddr);
1482 caam_desc_add_ptr(desc, msg.sgtbuf.paddr);
1483 caam_desc_add_ptr(desc, key.n.paddr);
1484 caam_desc_add_ptr(desc, key.d.buf.paddr);
1485
1486 break;
1487
1488 case RSA_PRIVATE_KEY_FORMAT_2:
1489 caam_desc_add_word(desc,
1490 PDB_RSA_DEC_D_SIZE(key.d.sec_size) |
1491 PDB_RSA_DEC_N_SIZE(key.n.length) |
1492 pdb_sgt_flags);
1493 caam_desc_add_ptr(desc, cipher.sgtbuf.paddr);
1494 caam_desc_add_ptr(desc, msg.sgtbuf.paddr);
1495 caam_desc_add_ptr(desc, key.d.buf.paddr);
1496 caam_desc_add_ptr(desc, key.p.buf.paddr);
1497 caam_desc_add_ptr(desc, key.q.buf.paddr);
1498 caam_desc_add_ptr(desc, tmp_1.buf.paddr);
1499 caam_desc_add_ptr(desc, tmp_2.buf.paddr);
1500 caam_desc_add_word(desc,
1501 PDB_RSA_DEC_Q_SIZE(key.q.sec_size) |
1502 PDB_RSA_DEC_P_SIZE(key.p.sec_size));
1503 break;
1504
1505 case RSA_PRIVATE_KEY_FORMAT_3:
1506 caam_desc_add_word(desc, PDB_RSA_DEC_N_SIZE(key.n.length) |
1507 pdb_sgt_flags);
1508 caam_desc_add_ptr(desc, cipher.sgtbuf.paddr);
1509 caam_desc_add_ptr(desc, msg.sgtbuf.paddr);
1510 caam_desc_add_ptr(desc, key.qp.buf.paddr);
1511 caam_desc_add_ptr(desc, key.p.buf.paddr);
1512 caam_desc_add_ptr(desc, key.q.buf.paddr);
1513 caam_desc_add_ptr(desc, key.dp.buf.paddr);
1514 caam_desc_add_ptr(desc, key.dq.buf.paddr);
1515 caam_desc_add_ptr(desc, tmp_1.buf.paddr);
1516 caam_desc_add_ptr(desc, tmp_2.buf.paddr);
1517 caam_desc_add_word(desc,
1518 PDB_RSA_DEC_Q_SIZE(key.q.sec_size) |
1519 PDB_RSA_DEC_P_SIZE(key.p.sec_size));
1520 break;
1521
1522 default:
1523 ret = TEE_ERROR_GENERIC;
1524 goto exit_decrypt;
1525 }
1526
1527 /* Set the Decryption operation type */
1528 operation |= PROT_RSA_DEC_KEYFORM(key.format);
1529
1530 /* Get key type */
1531 g_key_type = get_caam_key_type(key);
1532 switch (g_key_type) {
1533 case CAAM_KEY_PLAIN_TEXT:
1534 operation |= PROT_RSA_KEY_ENC(NONE);
1535 break;
1536 case CAAM_KEY_BLACK_ECB:
1537 operation |= PROT_RSA_KEY_ENC(ECB);
1538 break;
1539 case CAAM_KEY_BLACK_CCM:
1540 operation |= PROT_RSA_KEY_ENC(CCM);
1541 break;
1542 default:
1543 ret = TEE_ERROR_GENERIC;
1544 goto exit_decrypt;
1545 }
1546
1547 caam_desc_add_word(desc, operation);
1548
1549 if ((operation & PROT_RSA_FMT_MASK) == PROT_RSA_FMT(PKCS_V1_5)) {
1550 /* Get the PKCS1 v1.5 Message length generated */
1551 caam_desc_add_word(desc,
1552 ST_NOIMM_OFF(CLASS_DECO, REG_MATH0, 4, 4));
1553 caam_desc_add_ptr(desc, size_msg.paddr);
1554 /* Set the descriptor Header with length */
1555 desclen = caam_desc_get_len(desc);
1556 #ifdef CFG_CAAM_64BIT
1557 caam_desc_update_hdr(desc,
1558 DESC_HEADER_IDX(desclen, desclen - 1 - 3));
1559 #else
1560 caam_desc_update_hdr(desc,
1561 DESC_HEADER_IDX(desclen, desclen - 1 - 2));
1562 #endif /* CFG_CAAM_64BIT */
1563 } else {
1564 desclen = caam_desc_get_len(desc);
1565 /* Set the descriptor Header with length */
1566 caam_desc_update_hdr(desc,
1567 DESC_HEADER_IDX(desclen, desclen - 1));
1568 }
1569
1570 RSA_DUMPDESC(desc);
1571
1572 jobctx.desc = desc;
1573 retstatus = caam_jr_enqueue(&jobctx, NULL);
1574
1575 if (retstatus != CAAM_NO_ERROR) {
1576 RSA_TRACE("CAAM Status 0x%08" PRIx32, jobctx.status);
1577 ret = job_status_to_tee_result(jobctx.status);
1578 goto exit_decrypt;
1579 }
1580
1581 if ((operation & PROT_RSA_FMT_MASK) == PROT_RSA_FMT(NO) &&
1582 rsa_data->rsa_id == DRVCRYPT_RSA_NOPAD) {
1583 rsa_data->message.length = caam_dmaobj_copy_ltrim_to_orig(&msg);
1584 } else {
1585 if ((operation & PROT_RSA_FMT_MASK) ==
1586 PROT_RSA_FMT(PKCS_V1_5)) {
1587 /* PKCS 1 v1.5 */
1588 cache_operation(TEE_CACHEINVALIDATE, size_msg.data,
1589 size_msg.length);
1590
1591 /* Check if the original buffer size is large enough */
1592 if (msg.orig.length < caam_read_val32(size_msg.data)) {
1593 rsa_data->message.length =
1594 caam_read_val32(size_msg.data);
1595 ret = TEE_ERROR_SHORT_BUFFER;
1596 goto exit_decrypt;
1597 }
1598
1599 msg.orig.length = caam_read_val32(size_msg.data);
1600 RSA_TRACE("New length %zu", msg.orig.length);
1601 }
1602
1603 rsa_data->message.length = caam_dmaobj_copy_to_orig(&msg);
1604 }
1605
1606 RSA_DUMPBUF("Output", rsa_data->message.data, rsa_data->message.length);
1607 ret = TEE_SUCCESS;
1608
1609 exit_decrypt:
1610 caam_free_desc(&desc);
1611 do_keypair_free(&key);
1612 caam_free_buf(&size_msg);
1613 caam_dmaobj_free(&msg);
1614 caam_dmaobj_free(&cipher);
1615
1616 caam_key_free(&tmp_1);
1617 caam_key_free(&tmp_2);
1618
1619 return ret;
1620 }
1621
1622 /*
1623 * RSA Encryption
1624 *
1625 * @rsa_data [in/out] RSA Data to encrypt / Cipher resulting
1626 */
do_encrypt(struct drvcrypt_rsa_ed * rsa_data)1627 static TEE_Result do_encrypt(struct drvcrypt_rsa_ed *rsa_data)
1628 {
1629 TEE_Result ret = TEE_ERROR_NOT_IMPLEMENTED;
1630
1631 switch (rsa_data->rsa_id) {
1632 case DRVCRYPT_RSA_NOPAD:
1633 case DRVCRYPT_RSASSA_PKCS_V1_5:
1634 case DRVCRYPT_RSASSA_PSS:
1635 ret = do_caam_encrypt(rsa_data, RSA_ENCRYPT(NO));
1636 break;
1637
1638 case DRVCRYPT_RSA_PKCS_V1_5:
1639 ret = do_caam_encrypt(rsa_data, RSA_ENCRYPT(PKCS_V1_5));
1640 break;
1641
1642 case DRVCRYPT_RSA_OAEP:
1643 ret = do_oaep_encoding(rsa_data);
1644 break;
1645
1646 default:
1647 break;
1648 }
1649
1650 return ret;
1651 }
1652
1653 /*
1654 * RSA Decryption
1655 *
1656 * @rsa_data [in/out] RSA Data to decrypt / Message resulting
1657 */
do_decrypt(struct drvcrypt_rsa_ed * rsa_data)1658 static TEE_Result do_decrypt(struct drvcrypt_rsa_ed *rsa_data)
1659 {
1660 TEE_Result ret = TEE_ERROR_NOT_IMPLEMENTED;
1661
1662 switch (rsa_data->rsa_id) {
1663 case DRVCRYPT_RSA_NOPAD:
1664 case DRVCRYPT_RSASSA_PKCS_V1_5:
1665 case DRVCRYPT_RSASSA_PSS:
1666 ret = do_caam_decrypt(rsa_data, RSA_DECRYPT(NO));
1667 break;
1668
1669 case DRVCRYPT_RSA_PKCS_V1_5:
1670 ret = do_caam_decrypt(rsa_data, RSA_DECRYPT(PKCS_V1_5));
1671 break;
1672
1673 case DRVCRYPT_RSA_OAEP:
1674 ret = do_oaep_decoding(rsa_data);
1675 break;
1676
1677 default:
1678 break;
1679 }
1680
1681 return ret;
1682 }
1683
1684 /*
1685 * Registration of the RSA Driver
1686 */
1687 static const struct drvcrypt_rsa driver_rsa = {
1688 .alloc_keypair = do_allocate_keypair,
1689 .alloc_publickey = do_allocate_publickey,
1690 .free_publickey = do_free_publickey,
1691 .free_keypair = do_free_keypair,
1692 .gen_keypair = do_gen_keypair,
1693 .encrypt = do_encrypt,
1694 .decrypt = do_decrypt,
1695 .optional.ssa_sign = NULL,
1696 .optional.ssa_verify = NULL,
1697 };
1698
caam_rsa_init(struct caam_jrcfg * caam_jrcfg)1699 enum caam_status caam_rsa_init(struct caam_jrcfg *caam_jrcfg)
1700 {
1701 enum caam_status retstatus = CAAM_FAILURE;
1702 vaddr_t jr_base = caam_jrcfg->base + caam_jrcfg->offset;
1703
1704 if (caam_hal_ctrl_pknum(jr_base)) {
1705 caam_era = caam_hal_ctrl_era(jr_base);
1706 RSA_TRACE("CAAM Era %d", caam_era);
1707
1708 if (!drvcrypt_register_rsa(&driver_rsa))
1709 retstatus = CAAM_NO_ERROR;
1710 }
1711
1712 return retstatus;
1713 }
1714