1 // SPDX-License-Identifier: BSD-3-Clause 2 /* 3 * Copyright (c) 2024, STMicroelectronics - All Rights Reserved 4 */ 5 6 #include <assert.h> 7 #include <config.h> 8 #include <drivers/clk.h> 9 #include <drivers/clk_dt.h> 10 #include <io.h> 11 #include <kernel/boot.h> 12 #include <kernel/delay.h> 13 #include <kernel/dt.h> 14 #include <kernel/mutex.h> 15 #include <kernel/pm.h> 16 #include <kernel/pm.h> 17 #include <libfdt.h> 18 #include <mm/core_memprot.h> 19 #include <stm32_util.h> 20 #include <tee_api_types.h> 21 22 #include "common.h" 23 #include "stm32_pka.h" 24 25 /* 26 * For our comprehension in this file 27 * _len are in BITs 28 * _size are in BYTEs 29 * _nbw are in number of PKA_word (PKA_word = u64) 30 */ 31 32 #define INT8_LEN U(8) 33 #define INT64_LEN (INT8_LEN * sizeof(uint64_t)) 34 #define WORD_SIZE sizeof(uint64_t) 35 #define OP_NBW_FROM_LEN(len) (ROUNDUP_DIV((len), INT64_LEN) + 1) 36 #define OP_NBW_FROM_SIZE(s) OP_NBW_FROM_LEN((s) * INT8_LEN) 37 #define OP_SIZE_FROM_SIZE(s) (OP_NBW_FROM_SIZE(s) * WORD_SIZE) 38 39 #define MAX_EO_NBW OP_NBW_FROM_LEN(PKA_MAX_ECC_LEN) 40 41 /* PKA registers */ 42 #define _PKA_CR U(0x0) 43 #define _PKA_SR U(0x4) 44 #define _PKA_CLRFR U(0x8) 45 #define _PKA_VERR U(0x1FF4) 46 #define _PKA_IPIDR U(0x1FF8) 47 48 /* PKA control register fields */ 49 #define _PKA_CR_MODE_MASK GENMASK_32(13, 8) 50 #define _PKA_CR_MODE_R2MODN U(0x01) 51 #define _PKA_CR_MODE_SHIFT U(0x08) 52 #define _PKA_CR_MODE_ADD U(0x09) 53 #define _PKA_CR_MODE_ECC_KP U(0x20) 54 #define _PKA_CR_MODE_ECDSA_SIGN U(0x24) 55 #define _PKA_CR_MODE_ECDSA_VERIF U(0x26) 56 #define _PKA_CR_MODE_POINT_CHECK U(0x28) 57 #define _PKA_CR_START BIT(1) 58 #define _PKA_CR_EN BIT(0) 59 60 /* PKA status register fields */ 61 #define _PKA_SR_BUSY BIT(16) 62 #define _PKA_SR_LMF BIT(1) 63 #define _PKA_SR_INITOK BIT(0) 64 65 /* PKA it flag fields (used in CR, SR and CLRFR) */ 66 #define _PKA_IT_MASK (GENMASK_32(21, 19) | BIT(17)) 67 #define _PKA_IT_SHIFT U(17) 68 #define _PKA_IT_OPERR BIT(21) 69 #define _PKA_IT_ADDRERR BIT(20) 70 #define _PKA_IT_RAMERR BIT(19) 71 #define _PKA_IT_PROCEND BIT(17) 72 73 /* PKA version register fields */ 74 #define _PKA_VERR_MAJREV_MASK GENMASK_32(7, 4) 75 #define _PKA_VERR_MAJREV_SHIFT U(4) 76 #define _PKA_VERR_MINREV_MASK GENMASK_32(3, 0) 77 #define _PKA_VERR_MINREV_SHIFT U(0) 78 79 /* PKA identification register value */ 80 #define _PKA_IDID U(0x00170072) 81 82 /* RAM magic offset */ 83 #define _PKA_RAM_START U(0x400) 84 #define _PKA_RAM_SIZE U(5336) 85 86 /* Montgomery parameter computation (R*R mod n) */ 87 #define _PKA_RAM_R2MODN_N_LEN U(0x408) /* 64 */ 88 #define _PKA_RAM_R2MODN_PRIME_N U(0x1088) /* EOS */ 89 #define _PKA_RAM_R2MODN_OUT U(0x620) /* EOS */ 90 91 /* ECC check if point P is on curve */ 92 #define _PKA_RAM_ONCURVE_N_LEN U(0x408) /* 64 */ 93 #define _PKA_RAM_ONCURVE_A_SIGN U(0x410) /* 64 */ 94 #define _PKA_RAM_ONCURVE_A U(0x418) /* EOS */ 95 #define _PKA_RAM_ONCURVE_B U(0x520) /* EOS */ 96 #define _PKA_RAM_ONCURVE_P U(0x470) /* EOS */ 97 #define _PKA_RAM_ONCURVE_XP U(0x578) /* EOS */ 98 #define _PKA_RAM_ONCURVE_YP U(0x5D0) /* EOS */ 99 #define _PKA_RAM_ONCURVE_R2MODN U(0x4C8) /* EOS */ 100 #define _PKA_RAM_ONCURVE_RES U(0x680) /* 64 */ 101 #define _PKA_RAM_ONCURVE_RES_YES ULL(0xD60D) 102 #define _PKA_RAM_ONCURVE_RES_NO ULL(0xA3B7) 103 #define _PKA_RAM_ONCURVE_RES_TOOBIG ULL(0xF946) 104 105 /* ECC Fp scalar multiplication (kP) */ 106 #define _PKA_RAM_KP_N_LEN U(0x400) /* 64 */ 107 #define _PKA_RAM_KP_P_LEN U(0x408) /* 64 */ 108 #define _PKA_RAM_KP_A_SIGN U(0x410) /* 64 */ 109 #define _PKA_RAM_KP_A U(0x418) /* EOS */ 110 #define _PKA_RAM_KP_B U(0x520) /* EOS */ 111 #define _PKA_RAM_KP_P U(0x1088) /* EOS */ 112 #define _PKA_RAM_KP_K U(0x12A0) /* EOS */ 113 #define _PKA_RAM_KP_XP U(0x578) /* EOS */ 114 #define _PKA_RAM_KP_YP U(0x470) /* EOS */ 115 #define _PKA_RAM_KP_PRIME_N U(0xF88) /* EOS */ 116 #define _PKA_RAM_KP_RES U(0x680) /* 64 */ 117 #define _PKA_RAM_KP_RES_SUCCESS ULL(0xD60D) 118 #define _PKA_RAM_KP_RES_FAIL ULL(0xCBC9) 119 #define _PKA_RAM_KP_X U(0x578) /* EOS*/ 120 #define _PKA_RAM_KP_Y U(0x5D0) /* EOS*/ 121 122 /* ECDSA sign */ 123 #define _PKA_RAM_SIGN_N_LEN U(0x400) /* 64 */ 124 #define _PKA_RAM_SIGN_P_LEN U(0x408) /* 64 */ 125 #define _PKA_RAM_SIGN_A_SIGN U(0x410) /* 64 */ 126 #define _PKA_RAM_SIGN_A U(0x418) /* EOS */ 127 #define _PKA_RAM_SIGN_B U(0x520) /* EOS */ 128 #define _PKA_RAM_SIGN_P U(0x1088) /* EOS */ 129 #define _PKA_RAM_SIGN_K U(0x12A0) /* EOS */ 130 #define _PKA_RAM_SIGN_XG U(0x578) /* EOS */ 131 #define _PKA_RAM_SIGN_YG U(0x470) /* EOS */ 132 #define _PKA_RAM_SIGN_HASH_Z U(0xFE8) /* EOS */ 133 #define _PKA_RAM_SIGN_D U(0xF28) /* EOS */ 134 #define _PKA_RAM_SIGN_PRIME_N U(0xF88) /* EOS */ 135 #define _PKA_RAM_SIGN_RES U(0xFE0) /* 64 */ 136 #define _PKA_RAM_SIGN_RES_SUCCESS ULL(0xD60D) 137 #define _PKA_RAM_SIGN_RES_FAIL ULL(0xCBC9) 138 #define _PKA_RAM_SIGN_RES_R0 ULL(0xA3B7) 139 #define _PKA_RAM_SIGN_RES_S0 ULL(0xF946) 140 #define _PKA_RAM_SIGN_R U(0x730) /* EOS*/ 141 #define _PKA_RAM_SIGN_S U(0x788) /* EOS*/ 142 143 /* ECDSA verification */ 144 #define _PKA_RAM_VERIF_N_LEN U(0x408) /* 64 */ 145 #define _PKA_RAM_VERIF_P_LEN U(0x4C8) /* 64 */ 146 #define _PKA_RAM_VERIF_A_SIGN U(0x468) /* 64 */ 147 #define _PKA_RAM_VERIF_A U(0x470) /* EOS */ 148 #define _PKA_RAM_VERIF_P U(0x4D0) /* EOS */ 149 #define _PKA_RAM_VERIF_XG U(0x678) /* EOS */ 150 #define _PKA_RAM_VERIF_YG U(0x6D0) /* EOS */ 151 #define _PKA_RAM_VERIF_XQ U(0x12F8) /* EOS */ 152 #define _PKA_RAM_VERIF_YQ U(0x1350) /* EOS */ 153 #define _PKA_RAM_VERIF_SIGN_R U(0x10E0) /* EOS */ 154 #define _PKA_RAM_VERIF_SIGN_S U(0xC68) /* EOS */ 155 #define _PKA_RAM_VERIF_HASH_Z U(0x13A8) /* EOS */ 156 #define _PKA_RAM_VERIF_PRIME_N U(0x1088) /* EOS */ 157 #define _PKA_RAM_VERIF_RES U(0x5D0) /* 64 */ 158 #define _PKA_RAM_VERIF_RES_VALID ULL(0xD60D) 159 #define _PKA_RAM_VERIF_RES_INVALID ULL(0xA3B7) 160 161 #define PKA_TIMEOUT_US U(1000000) 162 #define TIMEOUT_US_1MS U(1000) 163 #define PKA_RESET_DELAY U(20) 164 165 enum pka_op { 166 SIGN, 167 VERIF, 168 SCALAR_MUL, 169 ON_CURVE, 170 171 PKA_OP_LAST 172 }; 173 174 enum pka_ram_index { 175 N_LEN, 176 P_LEN, 177 A_SIGN, 178 COEFF_A, 179 COEFF_B, 180 PRIME_N, 181 VAL_P, 182 GPOINT_X, 183 GPOINT_Y, 184 185 PKA_RAM_INDEX_LAST 186 }; 187 188 static const uint32_t pka_ram[PKA_OP_LAST][PKA_RAM_INDEX_LAST] = { 189 [SIGN] = { 190 [N_LEN] = _PKA_RAM_SIGN_N_LEN, 191 [P_LEN] = _PKA_RAM_SIGN_P_LEN, 192 [A_SIGN] = _PKA_RAM_SIGN_A_SIGN, 193 [COEFF_A] = _PKA_RAM_SIGN_A, 194 [COEFF_B] = _PKA_RAM_SIGN_B, 195 [PRIME_N] = _PKA_RAM_SIGN_PRIME_N, 196 [VAL_P] = _PKA_RAM_SIGN_P, 197 [GPOINT_X] = _PKA_RAM_SIGN_XG, 198 [GPOINT_Y] = _PKA_RAM_SIGN_YG 199 }, 200 [VERIF] = { 201 [N_LEN] = _PKA_RAM_VERIF_N_LEN, 202 [P_LEN] = _PKA_RAM_VERIF_P_LEN, 203 [A_SIGN] = _PKA_RAM_VERIF_A_SIGN, 204 [COEFF_A] = _PKA_RAM_VERIF_A, 205 [COEFF_B] = 0, 206 [PRIME_N] = _PKA_RAM_VERIF_PRIME_N, 207 [VAL_P] = _PKA_RAM_VERIF_P, 208 [GPOINT_X] = _PKA_RAM_VERIF_XG, 209 [GPOINT_Y] = _PKA_RAM_VERIF_YG 210 }, 211 [SCALAR_MUL] = { 212 [N_LEN] = _PKA_RAM_KP_N_LEN, 213 [P_LEN] = _PKA_RAM_KP_P_LEN, 214 [A_SIGN] = _PKA_RAM_KP_A_SIGN, 215 [COEFF_A] = _PKA_RAM_KP_A, 216 [COEFF_B] = _PKA_RAM_KP_B, 217 [PRIME_N] = _PKA_RAM_KP_PRIME_N, 218 [VAL_P] = _PKA_RAM_KP_P, 219 [GPOINT_X] = 0, 220 [GPOINT_Y] = 0, 221 }, 222 [ON_CURVE] = { 223 [N_LEN] = _PKA_RAM_ONCURVE_N_LEN, 224 [P_LEN] = 0, 225 [A_SIGN] = _PKA_RAM_ONCURVE_A_SIGN, 226 [COEFF_A] = _PKA_RAM_ONCURVE_A, 227 [COEFF_B] = _PKA_RAM_ONCURVE_B, 228 [PRIME_N] = 0, 229 [VAL_P] = _PKA_RAM_ONCURVE_P, 230 [GPOINT_X] = 0, 231 [GPOINT_Y] = 0, 232 }, 233 }; 234 235 /* struct curve_parameters - EC curve parameneters for PKA 236 * @a_sign: Sign of coefficient A: 0 positive, 1 negative 237 * @a: Curve coefficient |a| 238 * @b: Curve coefficient b 239 * @p: Curve modulus value 240 * @p_len: Modulus bit length 241 * @g: Curve base G point 242 * @n: Curve prime order n 243 * @n_len: Curve prime order bit size 244 */ 245 struct curve_parameters { 246 uint32_t a_sign; 247 struct stm32_pka_bn a; 248 struct stm32_pka_bn b; 249 struct stm32_pka_bn p; 250 uint32_t p_len; 251 struct stm32_pka_point g; 252 struct stm32_pka_bn n; 253 uint32_t n_len; 254 }; 255 256 static const struct curve_parameters curve_def[] = { 257 [PKA_NIST_P192] = { 258 .p_len = U(192), 259 .p = { 260 .val = (uint8_t[]){ 261 0xff, 0xff, 0xff, 0xff, 262 0xff, 0xff, 0xff, 0xff, 263 0xff, 0xff, 0xff, 0xff, 264 0xff, 0xff, 0xff, 0xfe, 265 0xff, 0xff, 0xff, 0xff, 266 0xff, 0xff, 0xff, 0xff 267 }, 268 .size = U(24), 269 }, 270 .n_len = U(192), 271 .n = { 272 .val = (uint8_t[]){ 273 0xff, 0xff, 0xff, 0xff, 274 0xff, 0xff, 0xff, 0xff, 275 0xff, 0xff, 0xff, 0xff, 276 0x99, 0xde, 0xf8, 0x36, 277 0x14, 0x6b, 0xc9, 0xb1, 278 0xb4, 0xd2, 0x28, 0x31 279 }, 280 .size = U(24), 281 }, 282 .a_sign = U(1), 283 .a = { 284 .val = (uint8_t[]){ 0x03 }, 285 .size = U(1), 286 }, 287 .b = { 288 .val = (uint8_t[]){ 289 0x64, 0x21, 0x05, 0x19, 290 0xe5, 0x9c, 0x80, 0xe7, 291 0x0f, 0xa7, 0xe9, 0xab, 292 0x72, 0x24, 0x30, 0x49, 293 0xfe, 0xb8, 0xde, 0xec, 294 0xc1, 0x46, 0xb9, 0xb1 295 }, 296 .size = U(24), 297 }, 298 .g = { 299 .x = { 300 .val = (uint8_t[]){ 301 0x18, 0x8d, 0xa8, 0x0e, 302 0xb0, 0x30, 0x90, 0xf6, 303 0x7c, 0xbf, 0x20, 0xeb, 304 0x43, 0xa1, 0x88, 0x00, 305 0xf4, 0xff, 0x0a, 0xfd, 306 0x82, 0xff, 0x10, 0x12 307 }, 308 .size = U(24), 309 }, 310 .y = { 311 .val = (uint8_t[]){ 312 0x07, 0x19, 0x2b, 0x95, 313 0xff, 0xc8, 0xda, 0x78, 314 0x63, 0x10, 0x11, 0xed, 315 0x6b, 0x24, 0xcd, 0xd5, 316 0x73, 0xf9, 0x77, 0xa1, 317 0x1e, 0x79, 0x48, 0x11 318 }, 319 .size = U(24), 320 }, 321 }, 322 }, 323 [PKA_NIST_P224] = { 324 .p_len = U(224), 325 .p = { 326 .val = (uint8_t[]){ 327 0xff, 0xff, 0xff, 0xff, 328 0xff, 0xff, 0xff, 0xff, 329 0xff, 0xff, 0xff, 0xff, 330 0xff, 0xff, 0xff, 0xff, 331 0x00, 0x00, 0x00, 0x00, 332 0x00, 0x00, 0x00, 0x00, 333 0x00, 0x00, 0x00, 0x01 334 }, 335 .size = U(28), 336 }, 337 .n_len = U(224), 338 .n = { 339 .val = (uint8_t[]){ 340 0xff, 0xff, 0xff, 0xff, 341 0xff, 0xff, 0xff, 0xff, 342 0xff, 0xff, 0xff, 0xff, 343 0xff, 0xff, 0x16, 0xa2, 344 0xe0, 0xb8, 0xf0, 0x3e, 345 0x13, 0xdd, 0x29, 0x45, 346 0x5c, 0x5c, 0x2a, 0x3d 347 }, 348 .size = U(28), 349 }, 350 .a_sign = U(1), 351 .a = { 352 .val = (uint8_t[]){ 0x03 }, 353 .size = U(1), 354 }, 355 .b = { 356 .val = (uint8_t[]){ 357 0xb4, 0x05, 0x0a, 0x85, 358 0x0c, 0x04, 0xb3, 0xab, 359 0xf5, 0x41, 0x32, 0x56, 360 0x50, 0x44, 0xb0, 0xb7, 361 0xd7, 0xbf, 0xd8, 0xba, 362 0x27, 0x0b, 0x39, 0x43, 363 0x23, 0x55, 0xff, 0xb4}, 364 .size = U(28), 365 }, 366 .g = { 367 .x = { 368 .val = (uint8_t[]){ 369 0xb7, 0x0e, 0x0c, 0xbd, 370 0x6b, 0xb4, 0xbf, 0x7f, 371 0x32, 0x13, 0x90, 0xb9, 372 0x4a, 0x03, 0xc1, 0xd3, 373 0x56, 0xc2, 0x11, 0x22, 374 0x34, 0x32, 0x80, 0xd6, 375 0x11, 0x5c, 0x1d, 0x21 376 }, 377 .size = U(28), 378 }, 379 .y = { 380 .val = (uint8_t[]){ 381 0xbd, 0x37, 0x63, 0x88, 382 0xb5, 0xf7, 0x23, 0xfb, 383 0x4c, 0x22, 0xdf, 0xe6, 384 0xcd, 0x43, 0x75, 0xa0, 385 0x5a, 0x07, 0x47, 0x64, 386 0x44, 0xd5, 0x81, 0x99, 387 0x85, 0x00, 0x7e, 0x34 388 }, 389 .size = U(28), 390 }, 391 }, 392 }, 393 [PKA_NIST_P256] = { 394 .p_len = U(256), 395 .p = { 396 .val = (uint8_t[]){ 397 0xff, 0xff, 0xff, 0xff, 398 0x00, 0x00, 0x00, 0x01, 399 0x00, 0x00, 0x00, 0x00, 400 0x00, 0x00, 0x00, 0x00, 401 0x00, 0x00, 0x00, 0x00, 402 0xff, 0xff, 0xff, 0xff, 403 0xff, 0xff, 0xff, 0xff, 404 0xff, 0xff, 0xff, 0xff 405 }, 406 .size = U(32), 407 }, 408 .n_len = U(256), 409 .n = { 410 .val = (uint8_t[]){ 411 0xff, 0xff, 0xff, 0xff, 412 0x00, 0x00, 0x00, 0x00, 413 0xff, 0xff, 0xff, 0xff, 414 0xff, 0xff, 0xff, 0xff, 415 0xbc, 0xe6, 0xfa, 0xad, 416 0xa7, 0x17, 0x9e, 0x84, 417 0xf3, 0xb9, 0xca, 0xc2, 418 0xfc, 0x63, 0x25, 0x51 419 }, 420 .size = U(32), 421 }, 422 .a_sign = U(1), 423 .a = { 424 .val = (uint8_t[]){ 0x03 }, 425 .size = U(1), 426 }, 427 .b = { 428 .val = (uint8_t[]){ 429 0x5a, 0xc6, 0x35, 0xd8, 430 0xaa, 0x3a, 0x93, 0xe7, 431 0xb3, 0xeb, 0xbd, 0x55, 432 0x76, 0x98, 0x86, 0xbc, 433 0x65, 0x1d, 0x06, 0xb0, 434 0xcc, 0x53, 0xb0, 0xf6, 435 0x3b, 0xce, 0x3c, 0x3e, 436 0x27, 0xd2, 0x60, 0x4b 437 }, 438 .size = U(32), 439 }, 440 .g = { 441 .x = { 442 .val = (uint8_t[]){ 443 0x6b, 0x17, 0xd1, 0xf2, 444 0xe1, 0x2c, 0x42, 0x47, 445 0xf8, 0xbc, 0xe6, 0xe5, 446 0x63, 0xa4, 0x40, 0xf2, 447 0x77, 0x03, 0x7d, 0x81, 448 0x2d, 0xeb, 0x33, 0xa0, 449 0xf4, 0xa1, 0x39, 0x45, 450 0xd8, 0x98, 0xc2, 0x96 451 }, 452 .size = U(32), 453 }, 454 .y = { 455 .val = (uint8_t[]){ 456 0x4f, 0xe3, 0x42, 0xe2, 457 0xfe, 0x1a, 0x7f, 0x9b, 458 0x8e, 0xe7, 0xeb, 0x4a, 459 0x7c, 0x0f, 0x9e, 0x16, 460 0x2b, 0xce, 0x33, 0x57, 461 0x6b, 0x31, 0x5e, 0xce, 462 0xcb, 0xb6, 0x40, 0x68, 463 0x37, 0xbf, 0x51, 0xf5 464 }, 465 .size = U(32), 466 }, 467 }, 468 }, 469 [PKA_NIST_P384] = { 470 .p_len = U(384), 471 .p = { 472 .val = (uint8_t[]){ 473 0xff, 0xff, 0xff, 0xff, 474 0xff, 0xff, 0xff, 0xff, 475 0xff, 0xff, 0xff, 0xff, 476 0xff, 0xff, 0xff, 0xff, 477 0xff, 0xff, 0xff, 0xff, 478 0xff, 0xff, 0xff, 0xff, 479 0xff, 0xff, 0xff, 0xff, 480 0xff, 0xff, 0xff, 0xfe, 481 0xff, 0xff, 0xff, 0xff, 482 0x00, 0x00, 0x00, 0x00, 483 0x00, 0x00, 0x00, 0x00, 484 0xff, 0xff, 0xff, 0xff 485 }, 486 .size = U(48), 487 }, 488 .n_len = U(384), 489 .n = { 490 .val = (uint8_t[]){ 491 0xff, 0xff, 0xff, 0xff, 492 0xff, 0xff, 0xff, 0xff, 493 0xff, 0xff, 0xff, 0xff, 494 0xff, 0xff, 0xff, 0xff, 495 0xff, 0xff, 0xff, 0xff, 496 0xff, 0xff, 0xff, 0xff, 497 0xc7, 0x63, 0x4d, 0x81, 498 0xf4, 0x37, 0x2d, 0xdf, 499 0x58, 0x1a, 0x0d, 0xb2, 500 0x48, 0xb0, 0xa7, 0x7a, 501 0xec, 0xec, 0x19, 0x6a, 502 0xcc, 0xc5, 0x29, 0x73 503 }, 504 .size = U(48), 505 }, 506 .a_sign = U(1), 507 .a = { 508 .val = (uint8_t[]){ 0x03 }, 509 .size = U(1), 510 }, 511 .b = { 512 .val = (uint8_t[]){ 513 0xb3, 0x31, 0x2f, 0xa7, 514 0xe2, 0x3e, 0xe7, 0xe4, 515 0x98, 0x8e, 0x05, 0x6b, 516 0xe3, 0xf8, 0x2d, 0x19, 517 0x18, 0x1d, 0x9c, 0x6e, 518 0xfe, 0x81, 0x41, 0x12, 519 0x03, 0x14, 0x08, 0x8f, 520 0x50, 0x13, 0x87, 0x5a, 521 0xc6, 0x56, 0x39, 0x8d, 522 0x8a, 0x2e, 0xd1, 0x9d, 523 0x2a, 0x85, 0xc8, 0xed, 524 0xd3, 0xec, 0x2a, 0xef 525 }, 526 .size = U(48), 527 }, 528 .g = { 529 .x = { 530 .val = (uint8_t[]){ 531 0xaa, 0x87, 0xca, 0x22, 532 0xbe, 0x8b, 0x05, 0x37, 533 0x8e, 0xb1, 0xc7, 0x1e, 534 0xf3, 0x20, 0xad, 0x74, 535 0x6e, 0x1d, 0x3b, 0x62, 536 0x8b, 0xa7, 0x9b, 0x98, 537 0x59, 0xf7, 0x41, 0xe0, 538 0x82, 0x54, 0x2a, 0x38, 539 0x55, 0x02, 0xf2, 0x5d, 540 0xbf, 0x55, 0x29, 0x6c, 541 0x3a, 0x54, 0x5e, 0x38, 542 0x72, 0x76, 0x0a, 0xb7 543 }, 544 .size = U(48), 545 }, 546 .y = { 547 .val = (uint8_t[]){ 548 0x36, 0x17, 0xde, 0x4a, 549 0x96, 0x26, 0x2c, 0x6f, 550 0x5d, 0x9e, 0x98, 0xbf, 551 0x92, 0x92, 0xdc, 0x29, 552 0xf8, 0xf4, 0x1d, 0xbd, 553 0x28, 0x9a, 0x14, 0x7c, 554 0xe9, 0xda, 0x31, 0x13, 555 0xb5, 0xf0, 0xb8, 0xc0, 556 0x0a, 0x60, 0xb1, 0xce, 557 0x1d, 0x7e, 0x81, 0x9d, 558 0x7a, 0x43, 0x1d, 0x7c, 559 0x90, 0xea, 0x0e, 0x5f 560 }, 561 .size = U(48), 562 }, 563 }, 564 }, 565 [PKA_NIST_P521] = { 566 .p_len = U(521), 567 .p = { 568 .val = (uint8_t[]){ 569 0x01, 0xff, 0xff, 0xff, 570 0xff, 0xff, 0xff, 0xff, 571 0xff, 0xff, 0xff, 0xff, 572 0xff, 0xff, 0xff, 0xff, 573 0xff, 0xff, 0xff, 0xff, 574 0xff, 0xff, 0xff, 0xff, 575 0xff, 0xff, 0xff, 0xff, 576 0xff, 0xff, 0xff, 0xff, 577 0xff, 0xff, 0xff, 0xff, 578 0xff, 0xff, 0xff, 0xff, 579 0xff, 0xff, 0xff, 0xff, 580 0xff, 0xff, 0xff, 0xff, 581 0xff, 0xff, 0xff, 0xff, 582 0xff, 0xff, 0xff, 0xff, 583 0xff, 0xff, 0xff, 0xff, 584 0xff, 0xff, 0xff, 0xff, 585 0xff, 0xff 586 }, 587 .size = U(66), 588 }, 589 .n_len = U(521), 590 .n = { 591 .val = (uint8_t[]){ 592 0x01, 0xff, 0xff, 0xff, 593 0xff, 0xff, 0xff, 0xff, 594 0xff, 0xff, 0xff, 0xff, 595 0xff, 0xff, 0xff, 0xff, 596 0xff, 0xff, 0xff, 0xff, 597 0xff, 0xff, 0xff, 0xff, 598 0xff, 0xff, 0xff, 0xff, 599 0xff, 0xff, 0xff, 0xff, 600 0xff, 0xfa, 0x51, 0x86, 601 0x87, 0x83, 0xbf, 0x2f, 602 0x96, 0x6b, 0x7f, 0xcc, 603 0x01, 0x48, 0xf7, 0x09, 604 0xa5, 0xd0, 0x3b, 0xb5, 605 0xc9, 0xb8, 0x89, 0x9c, 606 0x47, 0xae, 0xbb, 0x6f, 607 0xb7, 0x1e, 0x91, 0x38, 608 0x64, 0x09 609 }, 610 .size = U(66), 611 }, 612 .a_sign = U(1), 613 .a = { 614 .val = (uint8_t[]){ 0x03 }, 615 .size = U(1), 616 }, 617 .b = { 618 .val = (uint8_t[]){ 619 0x51, 0x95, 0x3e, 0xb9, 620 0x61, 0x8e, 0x1c, 0x9a, 621 0x1f, 0x92, 0x9a, 0x21, 622 0xa0, 0xb6, 0x85, 0x40, 623 0xee, 0xa2, 0xda, 0x72, 624 0x5b, 0x99, 0xb3, 0x15, 625 0xf3, 0xb8, 0xb4, 0x89, 626 0x91, 0x8e, 0xf1, 0x09, 627 0xe1, 0x56, 0x19, 0x39, 628 0x51, 0xec, 0x7e, 0x93, 629 0x7b, 0x16, 0x52, 0xc0, 630 0xbd, 0x3b, 0xb1, 0xbf, 631 0x07, 0x35, 0x73, 0xdf, 632 0x88, 0x3d, 0x2c, 0x34, 633 0xf1, 0xef, 0x45, 0x1f, 634 0xd4, 0x6b, 0x50, 0x3f, 635 0x00 636 }, 637 .size = U(65), 638 }, 639 .g = { 640 .x = { 641 .val = (uint8_t[]){ 642 0xc6, 0x85, 0x8e, 0x06, 643 0xb7, 0x04, 0x04, 0xe9, 644 0xcd, 0x9e, 0x3e, 0xcb, 645 0x66, 0x23, 0x95, 0xb4, 646 0x42, 0x9c, 0x64, 0x81, 647 0x39, 0x05, 0x3f, 0xb5, 648 0x21, 0xf8, 0x28, 0xaf, 649 0x60, 0x6b, 0x4d, 0x3d, 650 0xba, 0xa1, 0x4b, 0x5e, 651 0x77, 0xef, 0xe7, 0x59, 652 0x28, 0xfe, 0x1d, 0xc1, 653 0x27, 0xa2, 0xff, 0xa8, 654 0xde, 0x33, 0x48, 0xb3, 655 0xc1, 0x85, 0x6a, 0x42, 656 0x9b, 0xf9, 0x7e, 0x7e, 657 0x31, 0xc2, 0xe5, 0xbd, 658 0x66 659 }, 660 .size = U(65), 661 }, 662 .y = { 663 .val = (uint8_t[]){ 664 0x01, 0x18, 0x39, 0x29, 665 0x6a, 0x78, 0x9a, 0x3b, 666 0xc0, 0x04, 0x5c, 0x8a, 667 0x5f, 0xb4, 0x2c, 0x7d, 668 0x1b, 0xd9, 0x98, 0xf5, 669 0x44, 0x49, 0x57, 0x9b, 670 0x44, 0x68, 0x17, 0xaf, 671 0xbd, 0x17, 0x27, 0x3e, 672 0x66, 0x2c, 0x97, 0xee, 673 0x72, 0x99, 0x5e, 0xf4, 674 0x26, 0x40, 0xc5, 0x50, 675 0xb9, 0x01, 0x3f, 0xad, 676 0x07, 0x61, 0x35, 0x3c, 677 0x70, 0x86, 0xa2, 0x72, 678 0xc2, 0x40, 0x88, 0xbe, 679 0x94, 0x76, 0x9f, 0xd1, 680 0x66, 0x50 681 }, 682 .size = U(66), 683 }, 684 }, 685 }, 686 }; 687 688 struct stm32_pka_platdata { 689 vaddr_t base; 690 struct clk *clk; 691 struct clk *clk_rng; 692 struct rstctrl *reset; 693 /* Protect PKA HW instance access */ 694 struct mutex *lock; 695 }; 696 697 static struct stm32_pka_platdata pka_pdata; 698 static struct mutex pka_lock = MUTEX_INITIALIZER; 699 700 static TEE_Result pka_wait_bit(const vaddr_t base, const uint32_t bit_mask) 701 { 702 uint32_t value = 0; 703 704 if (IO_READ32_POLL_TIMEOUT(base + _PKA_SR, value, 705 (value & bit_mask) == bit_mask, 0, 706 PKA_TIMEOUT_US)) { 707 DMSG("timeout waiting 0x%"PRIx32, bit_mask); 708 return TEE_ERROR_BUSY; 709 } 710 711 return TEE_SUCCESS; 712 } 713 714 static void pka_disable(const vaddr_t base) 715 { 716 io_clrbits32(base + _PKA_CR, _PKA_CR_EN); 717 } 718 719 static TEE_Result pka_enable(const vaddr_t base, const uint32_t mode) 720 { 721 /* Set mode and disable interrupts */ 722 io_clrsetbits32(base + _PKA_CR, _PKA_IT_MASK | _PKA_CR_MODE_MASK, 723 SHIFT_U32(mode, _PKA_CR_MODE_SHIFT)); 724 725 io_setbits32(base + _PKA_CR, _PKA_CR_EN); 726 727 return pka_wait_bit(base, _PKA_SR_INITOK); 728 } 729 730 /* 731 * Data are already loaded in PKA internal RAM, 732 * MODE is set, 733 * we start process, and wait for its end. 734 */ 735 static TEE_Result stm32_pka_process(const vaddr_t base) 736 { 737 io_setbits32(base + _PKA_CR, _PKA_CR_START); 738 739 return pka_wait_bit(base, _PKA_IT_PROCEND); 740 } 741 742 /** 743 * Read ECC operand from PKA RAM 744 * 745 * PKA reads u64 words, for each u64 LSB is bit 0, MSB is bit 63. 746 * We read @eo_nbw (ECC operand Size) u64. The value of @eo_nbw depends 747 * on the chosen prime modulus length in bits. 748 * 749 * First less significant u64 is read from lowest address. 750 * Last u64 is expected to be equal to 0x0. 751 * 752 * This function manages: 753 * - Endianness (as bswap64 do) 754 * - Padding of incomplete u64 with 0 (if @data is not a u64 multiple). 755 * 756 * @addr: PKA_RAM address to read from to the buffer @data. 757 * @data: will be a BYTE list with most significant bytes first. 758 * @data_size: [in] @data size, 759 * [out] nb of bytes in @data. 760 * @eo_nbw: is ECC Operand size in 64-bit words (including the extra 0) 761 * (note it depends on the prime modulus length, not the @data size). 762 * @return TEE_SUCCESS if OK. 763 * TEE_ERROR_SECURITY if the last u64 word is not 0. 764 * TEE_ERROR_BAD_PARAMETERS if @data_size and @eo_nbw are inconsistent, 765 * i.e. @data doesn't fit in defined @eo_nbw, or @eo_nbw bigger than 766 * hardware limit, or if [in]@data_size is too small to get the @data. 767 */ 768 static TEE_Result read_eo_data(const vaddr_t addr, uint8_t *data, 769 const unsigned int data_size, 770 const unsigned int eo_nbw) 771 { 772 uint32_t word_index = U(0); 773 int data_index = (int)data_size - 1; 774 uint64_t tmp = ULL(0); 775 776 if (eo_nbw < OP_NBW_FROM_SIZE(data_size) || eo_nbw > MAX_EO_NBW) 777 return TEE_ERROR_BAD_PARAMETERS; 778 779 /* Fill value */ 780 for (word_index = U(0); word_index < eo_nbw - 1; word_index++) { 781 /* Index in the tmp U64 word */ 782 unsigned int i = U(0); 783 784 tmp = io_read64(addr + word_index * sizeof(tmp)); 785 786 while ((i < sizeof(tmp)) && (data_index >= 0)) { 787 data[data_index] = tmp & 0xFF; 788 tmp = tmp >> INT8_LEN; 789 790 /* Move byte index in current (u64)tmp */ 791 i++; 792 793 /* Move to next most significant byte */ 794 data_index--; 795 } 796 } 797 798 /* The last u64 should be 0 */ 799 tmp = io_read64(addr + word_index * sizeof(tmp)); 800 if (tmp) 801 return TEE_ERROR_SECURITY; 802 803 return TEE_SUCCESS; 804 } 805 806 /** 807 * Write ECC operand to PKA RAM. 808 * 809 * PKA expects to write u64 words, with each u64 word having the least 810 * significant bit as bit 0 and the most significant bit as bit 63. 811 * We write @eo_nbw (ECC operand size) u64 words, a value that depends on the 812 * chosen prime modulus length in bits. 813 * 814 * The least significant u64 word is written to the lowest address. 815 * Finally, at the last address, we write a u64(0x0). 816 * 817 * This function manages: 818 * - Endianness (as bswap64 does) 819 * - Padding incomplete u64 words with 0 (if data is not a u64 multiple) 820 * - Filling the last u64 address with 0. 821 * 822 * @addr: PKA_RAM address to write the buffer 'data'. 823 * @data: A byte array with the most significant bytes first. 824 * @data_size: Number of bytes in data. 825 * @eo_nbw: ECC Operand size in 64-bit words (including the extra 0) 826 * (Note: it depends on the prime modulus length, not the data size). 827 * 828 * @return TEE_SUCCESS if OK. 829 * TEE_ERROR_BAD_PARAMETERS if @data_size and @eo_nbw are inconsistent, 830 * i.e., @data doesn't fit in defined @eo_nbw, or @eo_nbw is bigger than 831 * the hardware limit. 832 */ 833 static TEE_Result write_eo_data(const vaddr_t addr, const uint8_t *data, 834 const unsigned int data_size, 835 const unsigned int eo_nbw) 836 { 837 uint32_t word_index = U(0); 838 int data_index = (int)data_size - 1; 839 840 if (eo_nbw < OP_NBW_FROM_SIZE(data_size) || eo_nbw > MAX_EO_NBW) 841 return TEE_ERROR_BAD_PARAMETERS; 842 843 /* Fill value */ 844 for (word_index = U(0); word_index < eo_nbw; word_index++) { 845 uint64_t tmp = ULL(0); 846 /* Index in the tmp U64 word */ 847 unsigned int i = U(0); 848 849 /* Stop if end of tmp or end of data */ 850 while ((i < sizeof(tmp)) && (data_index >= 0)) { 851 tmp |= SHIFT_U64(data[data_index], (INT8_LEN * i)); 852 /* Move byte index in current (u64)tmp */ 853 i++; 854 /* Move to next most significant byte */ 855 data_index--; 856 } 857 858 io_write64(addr + word_index * sizeof(tmp), tmp); 859 } 860 861 return TEE_SUCCESS; 862 } 863 864 static unsigned int get_ecc_op_nbword(const enum stm32_pka_curve_id cid) 865 { 866 if (cid < 0 || cid >= PKA_LAST_CID) 867 return 0; 868 869 return OP_NBW_FROM_LEN(curve_def[cid].n_len); 870 } 871 872 static TEE_Result stm32_pka_configure_curve(const vaddr_t base, 873 const enum pka_op op, 874 const enum stm32_pka_curve_id cid) 875 { 876 TEE_Result res = TEE_ERROR_GENERIC; 877 unsigned int eo_nbw = get_ecc_op_nbword(cid); 878 879 io_write64(base + pka_ram[op][N_LEN], curve_def[cid].n_len); 880 if (pka_ram[op][P_LEN]) 881 io_write64(base + pka_ram[op][P_LEN], curve_def[cid].p_len); 882 883 io_write64(base + pka_ram[op][A_SIGN], curve_def[cid].a_sign); 884 885 res = write_eo_data(base + pka_ram[op][COEFF_A], curve_def[cid].a.val, 886 curve_def[cid].a.size, eo_nbw); 887 if (res) 888 return res; 889 890 if (pka_ram[op][COEFF_B]) { 891 res = write_eo_data(base + pka_ram[op][COEFF_B], 892 curve_def[cid].b.val, curve_def[cid].b.size, 893 eo_nbw); 894 if (res) 895 return res; 896 } 897 898 if (pka_ram[op][PRIME_N]) { 899 res = write_eo_data(base + pka_ram[op][PRIME_N], 900 curve_def[cid].n.val, curve_def[cid].n.size, 901 eo_nbw); 902 if (res) 903 return res; 904 } 905 906 res = write_eo_data(base + pka_ram[op][VAL_P], curve_def[cid].p.val, 907 curve_def[cid].p.size, eo_nbw); 908 if (res) 909 return res; 910 911 if (pka_ram[op][GPOINT_X]) { 912 res = write_eo_data(base + pka_ram[op][GPOINT_X], 913 curve_def[cid].g.x.val, 914 curve_def[cid].g.x.size, eo_nbw); 915 if (res) 916 return res; 917 } 918 919 if (pka_ram[op][GPOINT_Y]) { 920 res = write_eo_data(base + pka_ram[op][GPOINT_Y], 921 curve_def[cid].g.y.val, 922 curve_def[cid].g.y.size, eo_nbw); 923 if (res) 924 return res; 925 } 926 927 return TEE_SUCCESS; 928 } 929 930 /** 931 * Check if stm32_pka_bn stored is equal to 0 932 * 933 * @d: Number to test. 934 * @return: true: if @d represents a 0 value (i.e. all bytes == 0) 935 * false: if @d represents a non-zero value. 936 */ 937 static bool is_zero(const struct stm32_pka_bn *d) 938 { 939 unsigned int i = U(0); 940 941 assert(d); 942 943 for (i = U(0); i < d->size; i++) 944 if (d->val[i] != U(0)) 945 return false; 946 947 return true; 948 } 949 950 /** 951 * Compare two stm32_pka_bn: 952 * 953 * @a: Number to test. 954 * @b: Number to test. 955 * @return: true if @a < @b 956 * false if @a >= @b 957 */ 958 static bool is_smaller(const struct stm32_pka_bn *a, 959 const struct stm32_pka_bn *b) 960 { 961 unsigned int i = 0; 962 963 for (i = MAX(a->size, b->size); i > U(0); i--) { 964 uint8_t _a = U(0); 965 uint8_t _b = U(0); 966 967 if (a->size >= i) 968 _a = a->val[a->size - i]; 969 if (b->size >= i) 970 _b = b->val[b->size - i]; 971 972 if (_a < _b) 973 return true; 974 if (_a > _b) 975 return false; 976 } 977 978 return false; 979 } 980 981 TEE_Result stm32_pka_get_max_size(size_t *bytes, size_t *bits, 982 const enum stm32_pka_curve_id cid) 983 { 984 if (cid < 0 || cid >= PKA_LAST_CID) 985 return TEE_ERROR_NOT_SUPPORTED; 986 987 if (bits) 988 *bits = curve_def[cid].n_len; 989 990 if (bytes) 991 *bytes = curve_def[cid].n.size; 992 993 return TEE_SUCCESS; 994 } 995 996 static TEE_Result stm32_pka_compute_r2modn_ret(const vaddr_t base, 997 struct stm32_pka_bn *v, 998 const unsigned int eo_nbw) 999 { 1000 uint32_t sr = U(0); 1001 1002 sr = io_read32(base + _PKA_SR); 1003 if ((sr & (_PKA_IT_OPERR | _PKA_IT_ADDRERR | _PKA_IT_RAMERR)) != 0) { 1004 EMSG("Detected error(s): %s%s%s", 1005 (sr & _PKA_IT_OPERR) ? "Operation " : "", 1006 (sr & _PKA_IT_ADDRERR) ? "Address " : "", 1007 (sr & _PKA_IT_RAMERR) ? "RAM" : ""); 1008 return TEE_ERROR_SECURITY; 1009 } 1010 1011 return read_eo_data(base + _PKA_RAM_R2MODN_OUT, v->val, v->size, 1012 eo_nbw); 1013 } 1014 1015 TEE_Result stm32_pka_compute_montgomery(const struct stm32_pka_bn *n, 1016 const size_t n_len, 1017 struct stm32_pka_bn *r2modn) 1018 { 1019 TEE_Result res = TEE_ERROR_GENERIC; 1020 vaddr_t base = pka_pdata.base; 1021 unsigned int eo_nbw = OP_NBW_FROM_LEN(n_len); 1022 1023 if (!n_len || !n || !r2modn) 1024 return TEE_ERROR_BAD_PARAMETERS; 1025 1026 mutex_lock(pka_pdata.lock); 1027 1028 if ((io_read32(base + _PKA_SR) & _PKA_SR_BUSY) == _PKA_SR_BUSY) { 1029 EMSG("PKA is busy"); 1030 res = TEE_ERROR_BUSY; 1031 goto out; 1032 } 1033 1034 /* Fill PKA RAM with n_len */ 1035 io_write64(base + _PKA_RAM_R2MODN_N_LEN, n_len); 1036 1037 /* Fill PKA RAM with n */ 1038 res = write_eo_data(base + _PKA_RAM_R2MODN_PRIME_N, n->val, n->size, 1039 eo_nbw); 1040 if (res) 1041 goto out; 1042 1043 /* Set mode to Montgomery parameter computation */ 1044 res = pka_enable(base, _PKA_CR_MODE_R2MODN); 1045 if (res) { 1046 EMSG("Set mode pka error %"PRIx32, res); 1047 goto out; 1048 } 1049 1050 /* Start processing and wait end */ 1051 res = stm32_pka_process(base); 1052 if (res) { 1053 EMSG("process error %"PRIx32, res); 1054 goto out; 1055 } 1056 1057 /* Get return value */ 1058 res = stm32_pka_compute_r2modn_ret(base, r2modn, eo_nbw); 1059 1060 /* Unset end proc */ 1061 io_setbits32(base + _PKA_CLRFR, _PKA_IT_PROCEND); 1062 1063 out: 1064 /* Disable PKA (will stop all pending process and reset RAM) */ 1065 pka_disable(base); 1066 1067 mutex_unlock(pka_pdata.lock); 1068 1069 return res; 1070 } 1071 1072 TEE_Result stm32_pka_ecc_compute_montgomery(struct stm32_pka_bn *r2modn, 1073 const enum stm32_pka_curve_id cid) 1074 { 1075 return stm32_pka_compute_montgomery(&curve_def[cid].p, 1076 curve_def[cid].p_len, r2modn); 1077 } 1078 1079 static TEE_Result stm32_pka_is_point_on_param(const struct stm32_pka_point *p, 1080 enum stm32_pka_curve_id cid) 1081 { 1082 /* Check Xp < p */ 1083 if (!is_smaller(&p->x, &curve_def[cid].p)) { 1084 EMSG("Xp < p inval"); 1085 return TEE_ERROR_BAD_PARAMETERS; 1086 } 1087 1088 /* Check Yp < p */ 1089 if (!is_smaller(&p->y, &curve_def[cid].p)) { 1090 EMSG("Yp < p inval"); 1091 return TEE_ERROR_BAD_PARAMETERS; 1092 } 1093 1094 return TEE_SUCCESS; 1095 } 1096 1097 static TEE_Result stm32_pka_is_point_on_curve_ret(const vaddr_t base) 1098 { 1099 uint64_t value = ULL(0); 1100 uint32_t sr = U(0); 1101 1102 sr = io_read32(base + _PKA_SR); 1103 if ((sr & (_PKA_IT_OPERR | _PKA_IT_ADDRERR | _PKA_IT_RAMERR)) != 0) { 1104 EMSG("Detected error(s): %s%s%s", 1105 (sr & _PKA_IT_OPERR) ? "Operation " : "", 1106 (sr & _PKA_IT_ADDRERR) ? "Address " : "", 1107 (sr & _PKA_IT_RAMERR) ? "RAM" : ""); 1108 return TEE_ERROR_SECURITY; 1109 } 1110 1111 value = io_read64(base + _PKA_RAM_ONCURVE_RES); 1112 if (value == _PKA_RAM_ONCURVE_RES_YES) 1113 return TEE_SUCCESS; 1114 else 1115 return TEE_ERROR_GENERIC; 1116 } 1117 1118 TEE_Result stm32_pka_is_point_on_curve(const struct stm32_pka_point *p, 1119 const struct stm32_pka_bn *r2modn, 1120 const enum stm32_pka_curve_id cid) 1121 { 1122 TEE_Result res = TEE_ERROR_GENERIC; 1123 vaddr_t base = pka_pdata.base; 1124 unsigned int eo_nbw = get_ecc_op_nbword(cid); 1125 1126 if (!eo_nbw || !p) 1127 return TEE_ERROR_BAD_PARAMETERS; 1128 1129 mutex_lock(pka_pdata.lock); 1130 1131 res = stm32_pka_is_point_on_param(p, cid); 1132 if (res) { 1133 EMSG("check param error %"PRIx32, res); 1134 goto out; 1135 } 1136 1137 if ((io_read32(base + _PKA_SR) & _PKA_SR_BUSY) == _PKA_SR_BUSY) { 1138 EMSG("PKA is busy"); 1139 res = TEE_ERROR_BUSY; 1140 goto out; 1141 } 1142 1143 /* Fill PKA RAM with curve id values */ 1144 res = stm32_pka_configure_curve(base, ON_CURVE, cid); 1145 if (res) 1146 goto out; 1147 1148 /* Fill PKA RAM with Montgomery parameter R*R mod n */ 1149 res = write_eo_data(base + _PKA_RAM_ONCURVE_R2MODN, r2modn->val, 1150 r2modn->size, eo_nbw); 1151 if (res) 1152 goto out; 1153 1154 /* Fill PKA RAM with P */ 1155 res = write_eo_data(base + _PKA_RAM_ONCURVE_XP, p->x.val, p->x.size, 1156 eo_nbw); 1157 if (res) 1158 goto out; 1159 1160 res = write_eo_data(base + _PKA_RAM_ONCURVE_YP, p->y.val, p->y.size, 1161 eo_nbw); 1162 if (res) 1163 goto out; 1164 1165 /* Set mode to point on the curve check */ 1166 res = pka_enable(base, _PKA_CR_MODE_POINT_CHECK); 1167 if (res) { 1168 EMSG("Set mode pka error %"PRIx32, res); 1169 goto out; 1170 } 1171 1172 /* Start processing and wait end */ 1173 res = stm32_pka_process(base); 1174 if (res) { 1175 EMSG("process error %"PRIx32, res); 1176 goto out; 1177 } 1178 1179 /* Get return value */ 1180 res = stm32_pka_is_point_on_curve_ret(base); 1181 1182 /* Unset end proc */ 1183 io_setbits32(base + _PKA_CLRFR, _PKA_IT_PROCEND); 1184 1185 out: 1186 /* Disable PKA (will stop all pending process and reset RAM) */ 1187 pka_disable(base); 1188 1189 mutex_unlock(pka_pdata.lock); 1190 1191 return res; 1192 } 1193 1194 static TEE_Result stm32_pka_ecdsa_verif_param(const struct stm32_pka_bn *sig_r, 1195 const struct stm32_pka_bn *sig_s, 1196 const struct stm32_pka_point *pk, 1197 const enum stm32_pka_curve_id cid) 1198 { 1199 /* Public Key check */ 1200 /* Check Xq < p */ 1201 if (!is_smaller(&pk->x, &curve_def[cid].p)) { 1202 EMSG("Xq < p inval"); 1203 return TEE_ERROR_BAD_PARAMETERS; 1204 } 1205 1206 /* Check Yq < p */ 1207 if (!is_smaller(&pk->y, &curve_def[cid].p)) { 1208 EMSG("Yq < p inval"); 1209 return TEE_ERROR_BAD_PARAMETERS; 1210 } 1211 1212 /* Signature check */ 1213 /* Check 0 < r < n */ 1214 if (!is_smaller(sig_r, &curve_def[cid].n) || is_zero(sig_r)) { 1215 EMSG("0 < r < n invalid"); 1216 return TEE_ERROR_BAD_PARAMETERS; 1217 } 1218 1219 /* Check 0 < s < n */ 1220 if (!is_smaller(sig_s, &curve_def[cid].n) || is_zero(sig_s)) { 1221 EMSG("0 < s < n invalid"); 1222 return TEE_ERROR_BAD_PARAMETERS; 1223 } 1224 1225 return TEE_SUCCESS; 1226 } 1227 1228 static TEE_Result stm32_pka_ecdsa_verif_ret(const vaddr_t base) 1229 { 1230 uint64_t value = ULL(0); 1231 uint32_t sr = U(0); 1232 1233 sr = io_read32(base + _PKA_SR); 1234 if ((sr & (_PKA_IT_OPERR | _PKA_IT_ADDRERR | _PKA_IT_RAMERR)) != 0) { 1235 EMSG("Detected error(s): %s%s%s", 1236 (sr & _PKA_IT_OPERR) ? "Operation " : "", 1237 (sr & _PKA_IT_ADDRERR) ? "Address " : "", 1238 (sr & _PKA_IT_RAMERR) ? "RAM" : ""); 1239 return TEE_ERROR_SECURITY; 1240 } 1241 1242 value = io_read64(base + _PKA_RAM_VERIF_RES); 1243 if (value == _PKA_RAM_VERIF_RES_VALID) 1244 return TEE_SUCCESS; 1245 1246 if (value == _PKA_RAM_VERIF_RES_INVALID) 1247 return TEE_ERROR_SIGNATURE_INVALID; 1248 1249 return TEE_ERROR_BAD_PARAMETERS; 1250 } 1251 1252 TEE_Result stm32_pka_ecdsa_verif(const void *hash, unsigned int hash_size, 1253 const struct stm32_pka_bn *sig_r, 1254 const struct stm32_pka_bn *sig_s, 1255 const struct stm32_pka_point *pk, 1256 const enum stm32_pka_curve_id cid) 1257 { 1258 TEE_Result res = TEE_ERROR_GENERIC; 1259 uint32_t n_len_bytes = curve_def[cid].n_len / INT8_LEN; 1260 vaddr_t base = pka_pdata.base; 1261 unsigned int eo_nbw = get_ecc_op_nbword(cid); 1262 1263 if (!eo_nbw || !hash || !sig_r || !sig_s || !pk) 1264 return TEE_ERROR_BAD_PARAMETERS; 1265 1266 mutex_lock(pka_pdata.lock); 1267 1268 res = stm32_pka_ecdsa_verif_param(sig_r, sig_s, pk, cid); 1269 if (res) { 1270 EMSG("check param error %"PRIx32, res); 1271 goto out; 1272 } 1273 1274 if ((io_read32(base + _PKA_SR) & _PKA_SR_BUSY) == _PKA_SR_BUSY) { 1275 EMSG("PKA is busy"); 1276 res = TEE_ERROR_BUSY; 1277 goto out; 1278 } 1279 1280 /* Fill PKA RAM with curve id values */ 1281 res = stm32_pka_configure_curve(base, VERIF, cid); 1282 if (res) 1283 goto out; 1284 1285 /* Fill PKA RAM with pubkey */ 1286 res = write_eo_data(base + _PKA_RAM_VERIF_XQ, pk->x.val, pk->x.size, 1287 eo_nbw); 1288 if (res) 1289 goto out; 1290 1291 res = write_eo_data(base + _PKA_RAM_VERIF_YQ, pk->y.val, pk->y.size, 1292 eo_nbw); 1293 if (res) 1294 goto out; 1295 1296 /* Fill PKA RAM with hash */ 1297 if (n_len_bytes < hash_size) { 1298 /* 1299 * Hash size is greater than ECDSA prime curve size. 1300 * Truncate hash and use leftmost bits of the hash. 1301 * NIST.FIPS.186-5.pdf 1302 */ 1303 hash_size = n_len_bytes; 1304 } 1305 res = write_eo_data(base + _PKA_RAM_VERIF_HASH_Z, hash, hash_size, 1306 eo_nbw); 1307 if (res) 1308 goto out; 1309 1310 /* Fill PKA RAM with signature */ 1311 res = write_eo_data(base + _PKA_RAM_VERIF_SIGN_R, sig_r->val, 1312 sig_r->size, eo_nbw); 1313 if (res) 1314 goto out; 1315 1316 res = write_eo_data(base + _PKA_RAM_VERIF_SIGN_S, sig_s->val, 1317 sig_s->size, eo_nbw); 1318 if (res) 1319 goto out; 1320 1321 /* Set mode to ECDSA signature verification */ 1322 res = pka_enable(base, _PKA_CR_MODE_ECDSA_VERIF); 1323 if (res) { 1324 EMSG("set mode pka error %"PRIx32, res); 1325 goto out; 1326 } 1327 1328 /* Start processing and wait end */ 1329 res = stm32_pka_process(base); 1330 if (res) { 1331 EMSG("process error %"PRIx32, res); 1332 goto out; 1333 } 1334 1335 /* Check return status */ 1336 res = stm32_pka_ecdsa_verif_ret(base); 1337 1338 /* Unset end proc */ 1339 io_setbits32(base + _PKA_CLRFR, _PKA_IT_PROCEND); 1340 1341 out: 1342 /* Disable PKA (will stop all pending process and reset RAM) */ 1343 pka_disable(base); 1344 1345 mutex_unlock(pka_pdata.lock); 1346 1347 return res; 1348 } 1349 1350 static TEE_Result stm32_pka_ecdsa_sign_param(const struct stm32_pka_bn *k) 1351 { 1352 if (k->size > PKA_MAX_ECC_SIZE) { 1353 EMSG("0 <= k < 2**640 invalid"); 1354 return TEE_ERROR_BAD_PARAMETERS; 1355 } 1356 1357 return TEE_SUCCESS; 1358 } 1359 1360 static TEE_Result stm32_pka_ecdsa_sign_ret(const vaddr_t base, 1361 struct stm32_pka_bn *sig_r, 1362 struct stm32_pka_bn *sig_s, 1363 const unsigned int eo_nbw) 1364 { 1365 TEE_Result res = TEE_ERROR_GENERIC; 1366 uint64_t value = ULL(0); 1367 uint32_t sr = U(0); 1368 1369 sr = io_read32(base + _PKA_SR); 1370 if ((sr & (_PKA_IT_OPERR | _PKA_IT_ADDRERR | _PKA_IT_RAMERR)) != 0) { 1371 EMSG("Detected error(s): %s%s%s", 1372 (sr & _PKA_IT_OPERR) ? "Operation " : "", 1373 (sr & _PKA_IT_ADDRERR) ? "Address " : "", 1374 (sr & _PKA_IT_RAMERR) ? "RAM" : ""); 1375 return TEE_ERROR_SECURITY; 1376 } 1377 1378 value = io_read64(base + _PKA_RAM_SIGN_RES); 1379 1380 if (value == _PKA_RAM_SIGN_RES_FAIL) 1381 return TEE_ERROR_SECURITY; 1382 1383 if (value == _PKA_RAM_SIGN_RES_R0) { 1384 value = _PKA_RAM_SIGN_RES_SUCCESS; 1385 memset(sig_r->val, 0, sig_r->size); 1386 } else { 1387 res = read_eo_data(base + _PKA_RAM_SIGN_R, sig_r->val, 1388 sig_r->size, eo_nbw); 1389 if (res) 1390 return res; 1391 } 1392 1393 if (value == _PKA_RAM_SIGN_RES_S0) { 1394 value = _PKA_RAM_SIGN_RES_SUCCESS; 1395 memset(sig_s->val, 0, sig_s->size); 1396 } else { 1397 res = read_eo_data(base + _PKA_RAM_SIGN_S, sig_s->val, 1398 sig_s->size, eo_nbw); 1399 if (res) 1400 return res; 1401 } 1402 1403 if (value != _PKA_RAM_SIGN_RES_SUCCESS) 1404 return TEE_ERROR_GENERIC; 1405 1406 return TEE_SUCCESS; 1407 } 1408 1409 TEE_Result stm32_pka_ecdsa_sign(const void *hash, unsigned int hash_size, 1410 struct stm32_pka_bn *sig_r, 1411 struct stm32_pka_bn *sig_s, 1412 const struct stm32_pka_bn *d, 1413 const struct stm32_pka_bn *k, 1414 const enum stm32_pka_curve_id cid) 1415 { 1416 TEE_Result res = TEE_ERROR_GENERIC; 1417 uint32_t n_len_bytes = curve_def[cid].n_len / INT8_LEN; 1418 vaddr_t base = pka_pdata.base; 1419 unsigned int eo_nbw = get_ecc_op_nbword(cid); 1420 1421 if (!eo_nbw || !hash || !sig_r || !sig_s || !d || !k) 1422 return TEE_ERROR_BAD_PARAMETERS; 1423 1424 mutex_lock(pka_pdata.lock); 1425 1426 res = stm32_pka_ecdsa_sign_param(k); 1427 if (res) { 1428 EMSG("check param error %"PRIx32, res); 1429 goto out; 1430 } 1431 1432 if ((io_read32(base + _PKA_SR) & _PKA_SR_BUSY) == _PKA_SR_BUSY) { 1433 EMSG("PKA is busy"); 1434 res = TEE_ERROR_BUSY; 1435 goto out; 1436 } 1437 1438 /* Fill PKA RAM */ 1439 /* With curve id values */ 1440 res = stm32_pka_configure_curve(base, SIGN, cid); 1441 if (res) 1442 goto out; 1443 1444 /* With K (random number) */ 1445 res = write_eo_data(base + _PKA_RAM_SIGN_K, k->val, k->size, eo_nbw); 1446 if (res) 1447 goto out; 1448 1449 /* With private key d */ 1450 res = write_eo_data(base + _PKA_RAM_SIGN_D, d->val, d->size, eo_nbw); 1451 if (res) 1452 goto out; 1453 1454 /* With hash */ 1455 if (n_len_bytes < hash_size) { 1456 /* 1457 * Hash size is greater than ECDSA prime curve size. 1458 * Truncate hash and use leftmost bits of the hash. 1459 * NIST.FIPS.186-4.pdf 1460 */ 1461 hash_size = n_len_bytes; 1462 } 1463 res = write_eo_data(base + _PKA_RAM_SIGN_HASH_Z, hash, hash_size, 1464 eo_nbw); 1465 if (res) 1466 goto out; 1467 1468 /* Set mode to ECDSA signature */ 1469 res = pka_enable(base, _PKA_CR_MODE_ECDSA_SIGN); 1470 if (res) { 1471 EMSG("Set mode pka error %"PRIx32, res); 1472 goto out; 1473 } 1474 1475 /* Start processing and wait end */ 1476 res = stm32_pka_process(base); 1477 if (res) { 1478 EMSG("process error %"PRIx32, res); 1479 goto out; 1480 } 1481 1482 /* Get return value */ 1483 res = stm32_pka_ecdsa_sign_ret(base, sig_r, sig_s, eo_nbw); 1484 1485 /* Unset end proc */ 1486 io_setbits32(base + _PKA_CLRFR, _PKA_IT_PROCEND); 1487 1488 out: 1489 /* Disable PKA (will stop all pending process and reset RAM) */ 1490 pka_disable(base); 1491 1492 mutex_unlock(pka_pdata.lock); 1493 1494 return res; 1495 } 1496 1497 static TEE_Result stm32_pka_ecc_sc_mul_param(const struct stm32_pka_bn *k, 1498 const struct stm32_pka_point *p, 1499 const enum stm32_pka_curve_id cid) 1500 { 1501 if (k->size > PKA_MAX_ECC_SIZE) { 1502 EMSG("0 <= k < 2**640 inval"); 1503 return TEE_ERROR_BAD_PARAMETERS; 1504 } 1505 1506 if (!is_smaller(&p->x, &curve_def[cid].p)) { 1507 EMSG("Xp < p inval"); 1508 return TEE_ERROR_BAD_PARAMETERS; 1509 } 1510 1511 if (!is_smaller(&p->y, &curve_def[cid].p)) { 1512 EMSG("Yp < p inval"); 1513 return TEE_ERROR_BAD_PARAMETERS; 1514 } 1515 1516 return TEE_SUCCESS; 1517 } 1518 1519 static TEE_Result stm32_pka_ecc_kp_ret(const vaddr_t base, 1520 struct stm32_pka_point *kp, 1521 const unsigned int eo_nbw) 1522 { 1523 TEE_Result res = TEE_ERROR_GENERIC; 1524 uint64_t value = ULL(0); 1525 uint32_t sr = U(0); 1526 1527 sr = io_read32(base + _PKA_SR); 1528 if ((sr & (_PKA_IT_OPERR | _PKA_IT_ADDRERR | _PKA_IT_RAMERR)) != 0) { 1529 EMSG("Detected error(s): %s%s%s", 1530 (sr & _PKA_IT_OPERR) ? "Operation " : "", 1531 (sr & _PKA_IT_ADDRERR) ? "Address " : "", 1532 (sr & _PKA_IT_RAMERR) ? "RAM" : ""); 1533 return TEE_ERROR_SECURITY; 1534 } 1535 1536 value = io_read64(base + _PKA_RAM_KP_RES); 1537 if (value == _PKA_RAM_KP_RES_FAIL) 1538 return TEE_ERROR_SECURITY; 1539 1540 if (value != _PKA_RAM_KP_RES_SUCCESS) 1541 return TEE_ERROR_GENERIC; 1542 1543 res = read_eo_data(base + _PKA_RAM_KP_X, kp->x.val, kp->x.size, eo_nbw); 1544 if (res) 1545 return res; 1546 1547 return read_eo_data(base + _PKA_RAM_KP_Y, kp->y.val, kp->y.size, 1548 eo_nbw); 1549 } 1550 1551 TEE_Result stm32_pka_ecc_scalar_mul(const struct stm32_pka_bn *k, 1552 const struct stm32_pka_point *p, 1553 struct stm32_pka_point *kp, 1554 const enum stm32_pka_curve_id cid) 1555 { 1556 TEE_Result res = TEE_ERROR_GENERIC; 1557 vaddr_t base = pka_pdata.base; 1558 unsigned int eo_nbw = get_ecc_op_nbword(cid); 1559 1560 if (!eo_nbw || !k || !p || !kp) 1561 return TEE_ERROR_BAD_PARAMETERS; 1562 1563 mutex_lock(pka_pdata.lock); 1564 1565 res = stm32_pka_ecc_sc_mul_param(k, p, cid); 1566 if (res) { 1567 EMSG("check param error %"PRIx32, res); 1568 goto out; 1569 } 1570 1571 if ((io_read32(base + _PKA_SR) & _PKA_SR_BUSY) == _PKA_SR_BUSY) { 1572 EMSG("PKA is busy"); 1573 res = TEE_ERROR_BUSY; 1574 goto out; 1575 } 1576 1577 /* Fill PKA RAM */ 1578 /* With curve id values */ 1579 res = stm32_pka_configure_curve(base, SCALAR_MUL, cid); 1580 if (res) 1581 goto out; 1582 1583 /* With k */ 1584 res = write_eo_data(base + _PKA_RAM_KP_K, k->val, k->size, eo_nbw); 1585 if (res) 1586 goto out; 1587 1588 /* With xP */ 1589 res = write_eo_data(base + _PKA_RAM_KP_XP, p->x.val, p->x.size, eo_nbw); 1590 if (res) 1591 goto out; 1592 1593 /* With yP */ 1594 res = write_eo_data(base + _PKA_RAM_KP_YP, p->y.val, p->y.size, eo_nbw); 1595 if (res) 1596 goto out; 1597 1598 /* Set mode to ecc scalar multiplication */ 1599 res = pka_enable(base, _PKA_CR_MODE_ECC_KP); 1600 if (res) { 1601 EMSG("Set mode pka error %"PRIx32, res); 1602 goto out; 1603 } 1604 1605 /* Start processing and wait end */ 1606 res = stm32_pka_process(base); 1607 if (res) { 1608 EMSG("process error %"PRIx32, res); 1609 goto out; 1610 } 1611 1612 /* Get return value */ 1613 res = stm32_pka_ecc_kp_ret(base, kp, eo_nbw); 1614 1615 /* Unset end proc */ 1616 io_setbits32(base + _PKA_CLRFR, _PKA_IT_PROCEND); 1617 1618 out: 1619 /* Disable PKA (will stop all pending process and reset RAM) */ 1620 pka_disable(base); 1621 1622 mutex_unlock(pka_pdata.lock); 1623 1624 return res; 1625 } 1626 1627 TEE_Result stm32_pka_edac_gen_pubkey(const struct stm32_pka_bn *k, 1628 struct stm32_pka_point *pk, 1629 const enum stm32_pka_curve_id cid) 1630 { 1631 return stm32_pka_ecc_scalar_mul(k, &curve_def[cid].g, pk, cid); 1632 } 1633 1634 static TEE_Result stm32_pka_parse_fdt(struct stm32_pka_platdata *pdata, 1635 const void *fdt, int node) 1636 { 1637 TEE_Result res = TEE_ERROR_GENERIC; 1638 size_t reg_size = 0; 1639 paddr_t reg = 0; 1640 1641 res = rstctrl_dt_get_by_index(fdt, node, 0, &pdata->reset); 1642 if (res != TEE_SUCCESS && res != TEE_ERROR_ITEM_NOT_FOUND) 1643 return res; 1644 1645 res = clk_dt_get_by_name(fdt, node, "bus", &pdata->clk); 1646 if (res) 1647 return res; 1648 1649 res = clk_dt_get_by_name(fdt, node, "rng", &pdata->clk_rng); 1650 if (res) 1651 return res; 1652 1653 if (fdt_reg_info(fdt, node, ®, ®_size)) 1654 return TEE_ERROR_BAD_PARAMETERS; 1655 1656 pdata->base = (vaddr_t)phys_to_virt(reg, MEM_AREA_IO_SEC, reg_size); 1657 if (!pdata->base) 1658 panic(); 1659 1660 return TEE_SUCCESS; 1661 } 1662 1663 static TEE_Result stm32_pka_reset(void) 1664 { 1665 TEE_Result res = TEE_ERROR_GENERIC; 1666 1667 if (!pka_pdata.reset) 1668 return TEE_SUCCESS; 1669 1670 res = rstctrl_assert_to(pka_pdata.reset, TIMEOUT_US_1MS); 1671 if (res) 1672 return res; 1673 1674 udelay(PKA_RESET_DELAY); 1675 1676 return rstctrl_deassert_to(pka_pdata.reset, TIMEOUT_US_1MS); 1677 } 1678 1679 static TEE_Result stm32_pka_pm(enum pm_op op, uint32_t pm_hint, 1680 const struct pm_callback_handle *hdl __unused) 1681 { 1682 switch (op) { 1683 case PM_OP_SUSPEND: 1684 clk_disable(pka_pdata.clk); 1685 clk_disable(pka_pdata.clk_rng); 1686 1687 return TEE_SUCCESS; 1688 case PM_OP_RESUME: 1689 if (clk_enable(pka_pdata.clk_rng) || clk_enable(pka_pdata.clk)) 1690 panic(); 1691 1692 if (PM_HINT_IS_STATE(pm_hint, CONTEXT) && stm32_pka_reset()) 1693 panic(); 1694 1695 return TEE_SUCCESS; 1696 default: 1697 return TEE_ERROR_NOT_IMPLEMENTED; 1698 } 1699 } 1700 1701 static TEE_Result stm32_pka_probe(const void *fdt, int node, 1702 const void *compat_data __unused) 1703 { 1704 TEE_Result res = TEE_ERROR_GENERIC; 1705 1706 res = stm32_pka_parse_fdt(&pka_pdata, fdt, node); 1707 if (res) 1708 return res; 1709 1710 if (clk_enable(pka_pdata.clk) || clk_enable(pka_pdata.clk_rng)) 1711 panic(); 1712 1713 if (stm32_pka_reset()) 1714 panic(); 1715 1716 pka_pdata.lock = &pka_lock; 1717 1718 if (IS_ENABLED(CFG_CRYPTO_DRV_ECC)) { 1719 res = stm32_register_ecc(); 1720 if (res) { 1721 EMSG("Failed to register to ecc: %#"PRIx32, res); 1722 panic(); 1723 } 1724 } 1725 1726 register_pm_core_service_cb(stm32_pka_pm, NULL, "stm32-pka"); 1727 1728 return TEE_SUCCESS; 1729 } 1730 1731 static const struct dt_device_match pka_match_table[] = { 1732 { .compatible = "st,stm32mp13-pka" }, 1733 { } 1734 }; 1735 1736 DEFINE_DT_DRIVER(stm32_pka_dt_driver) = { 1737 .name = "stm32-pka", 1738 .match_table = pka_match_table, 1739 .probe = &stm32_pka_probe, 1740 }; 1741