u-boot.git/include/fsl_sec.h, branch v2022.01 Unnamed repository; edit this file 'description' to name the repository. imx8m: Add DEK blob encapsulation for imx8m 2021-04-08T18:29:52+00:00 Clement Faure clement.faure@nxp.com 2021-03-25T09:30:33+00:00 56d2050f40287fe46757d4cbe69d62a1381c3c64 Add DEK blob encapsulation support for IMX8M through "dek_blob" command. On ARMv8, u-boot runs in non-secure, thus cannot encapsulate a DEK blob for encrypted boot. The DEK blob is encapsulated by OP-TEE through a trusted application call. U-boot sends and receives the DEK and the DEK blob binaries through OP-TEE dynamic shared memory. To enable the DEK blob encapsulation, add to the defconfig: CONFIG_SECURE_BOOT=y CONFIG_FAT_WRITE=y CONFIG_CMD_DEKBLOB=y Signed-off-by: Clement Faure <clement.faure@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> 
Add DEK blob encapsulation support for IMX8M through "dek_blob" command.
On ARMv8, u-boot runs in non-secure, thus cannot encapsulate a DEK blob
for encrypted boot.
The DEK blob is encapsulated by OP-TEE through a trusted application call.
U-boot sends and receives the DEK and the DEK blob binaries through OP-TEE
dynamic shared memory.

To enable the DEK blob encapsulation, add to the defconfig:
CONFIG_SECURE_BOOT=y
CONFIG_FAT_WRITE=y
CONFIG_CMD_DEKBLOB=y

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
crypto: caam: Add secure memory vid 3 support 2021-04-08T07:18:29+00:00 Aymen Sghaier aymen.sghaier@nxp.com 2021-03-25T09:30:29+00:00 45f39e9fb70dc8a9cb17135d2146de402494a59e In i.MX8M platforms the secure memory block has a newer version than those used in i.MX6/7 platforms, this patch update the driver to use the correct registers offsets. Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> 
In i.MX8M platforms the secure memory block has a newer version
than those used in i.MX6/7 platforms, this patch update the driver
to use the correct registers offsets.

Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
crypto: caam: Fix build warnings pointer casting 2021-04-08T07:18:29+00:00 Aymen Sghaier aymen.sghaier@nxp.com 2021-03-25T09:30:26+00:00 dde92e2d1501c0f4e7fc04e10b2a9614a1d63e32 Enabling CAAM driver for i.MX8M platforms, a 64 bits architecture, lead to casting warnings: from/to pointer to/from integer with different size. This patch fix these warnings Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> 
  Enabling CAAM driver for i.MX8M platforms, a 64 bits architecture,
 lead to casting warnings: from/to pointer to/from integer with
 different size. This patch fix these warnings

Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
crypto: caam: Add CAAM support to i.MX8M platforms 2021-04-08T07:18:29+00:00 Aymen Sghaier aymen.sghaier@nxp.com 2021-03-25T09:30:25+00:00 940d36d5d1d2dc2697b0b379712a3bf40a34e57a This patch enable CAAM support for i.MX8M platforms. Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> 
This patch enable CAAM support for i.MX8M platforms.

Signed-off-by: Aymen Sghaier <aymen.sghaier@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
caam: enable support for iMX7ULP 2021-04-08T07:18:29+00:00 Franck LENORMAND franck.lenormand@nxp.com 2021-03-25T09:30:23+00:00 b5438002416d24e09ddd9ad68dbd1b87548de157 Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> 
Signed-off-by: Franck LENORMAND <franck.lenormand@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
cmd: blob: Instantiate RNG before running CMD_BLOB 2021-04-08T07:18:29+00:00 Breno Lima breno.lima@nxp.com 2021-03-25T09:30:21+00:00 81d5605a8654ae735e751b59f3f2d7b09fe29471 U-Boot can instantiate CAAM RNG if needed by crypto operations. Call sec_init() prior running a blob operation to ensure RNG is correctly instantiated. Make sure CAAM clock is enabled and check if a job ring is available for that operation. Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> 
U-Boot can instantiate CAAM RNG if needed by crypto operations.
Call sec_init() prior running a blob operation to ensure
RNG is correctly instantiated.

Make sure CAAM clock is enabled and check if a job ring is
available for that operation.

Signed-off-by: Breno Lima <breno.lima@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
imx: imx7 Support for Manufacturing Protection 2021-04-08T07:18:29+00:00 Breno Lima breno.lima@nxp.com 2021-03-25T09:30:02+00:00 30e39ac7c937e07002e2868b23b679e6bb0f2a58 This code was originally developed by Raul Cardenas <raul.casas@nxp.com> and modified to be applied in U-Boot imx_v2017.03. More information about the initial submission can be seen in the link below: https://lists.denx.de/pipermail/u-boot/2016-February/245273.html i.MX7D has an a protection feature for Manufacturing process. This feature uses asymmetric encryption to sign and verify authenticated software handled between parties. This command enables the use of such feature. The private key is unique and generated once per device. And it is stored in secure memory and only accessible by CAAM. Therefore, the public key generation and signature functions are the only functions available for the user. The manufacturing-protection authentication process can be used to authenticate the chip to the OEM's server. Command usage: Print the public key for the device. - mfgprot pubk Generates Signature over given data. - mfgprot sign <data_address> <data_size> Signed-off-by: Raul Ulises Cardenas <raul.casas@nxp.com> Signed-off-by: Breno Lima <breno.lima@nxp.com> Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com> Reviewed-by: Ye Li <ye.li@nxp.com> Signed-off-by: Peng Fan <peng.fan@nxp.com> 
This code was originally developed by Raul Cardenas <raul.casas@nxp.com>
and modified to be applied in U-Boot imx_v2017.03.

More information about the initial submission can be seen
in the link below:
https://lists.denx.de/pipermail/u-boot/2016-February/245273.html

i.MX7D has an a protection feature for Manufacturing process.
This feature uses asymmetric encryption to sign and verify
authenticated software handled between parties. This command
enables the use of such feature.

The private key is unique and generated once per device.
And it is stored in secure memory and only accessible by CAAM.
Therefore, the public key generation and signature functions
are the only functions available for the user.

The manufacturing-protection authentication process can be used to
authenticate the chip to the OEM's server.

Command usage:

Print the public key for the device.
- mfgprot pubk

Generates Signature over given data.
- mfgprot sign <data_address> <data_size>

Signed-off-by: Raul Ulises Cardenas <raul.casas@nxp.com>
Signed-off-by: Breno Lima <breno.lima@nxp.com>
Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
Reviewed-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
crypto/fsl: instantiate the RNG with prediciton resistance 2020-07-27T08:46:29+00:00 Michael Walle michael@walle.cc 2020-06-27T20:58:52+00:00 b980f9e2597b52ce71247e79d534349f7d174b38 If it is already instantiated tear it down first and then reinstanciate it again with prediction resistance. Signed-off-by: Michael Walle <michael@walle.cc> Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com> 
If it is already instantiated tear it down first and then reinstanciate
it again with prediction resistance.

Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
crypto/fsl: don't regenerate secure keys 2020-07-27T08:46:29+00:00 Michael Walle michael@walle.cc 2020-06-27T20:58:51+00:00 c269a970f23fabbb0d35708ff021bf2962780f9f The secure keys (TDKEK, JDKEK, TDSK) can only be generated once after a POR. Otherwise the RNG4 will throw an error. Signed-off-by: Michael Walle <michael@walle.cc> Reviewed-by: Horia Geantă <horia.geanta@nxp.com> Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com> 
The secure keys (TDKEK, JDKEK, TDSK) can only be generated once after a
POR. Otherwise the RNG4 will throw an error.

Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>
crypto/fsl: support newer SEC modules 2020-07-27T08:46:29+00:00 Michael Walle michael@walle.cc 2020-06-27T20:58:50+00:00 0dc596127c55e5430bd8f213e41a24c8f440c01a Since Era 10, the version registers changed. Add the version registers and use them on newer modules. Signed-off-by: Michael Walle <michael@walle.cc> Reviewed-by: Horia Geantă <horia.geanta@nxp.com> Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com> 
Since Era 10, the version registers changed. Add the version registers
and use them on newer modules.

Signed-off-by: Michael Walle <michael@walle.cc>
Reviewed-by: Horia Geantă <horia.geanta@nxp.com>
Reviewed-by: Priyanka Jain <priyanka.jain@nxp.com>