| Age | Commit message (Collapse) | Author |
|---|
|
The CAAM JR driver is initialized from arch_misc_init(). If
ARCH_MISC_INIT is not enabled, the driver is never initialized,
which can lead to crashes or hangs (e.g. during hash operations).
Select ARCH_MISC_INIT when enabling FSL_CAAM to ensure proper
initialization.
Signed-off-by: Heiko Schocher <[email protected]>
Suggested-by: Fabio Estevam <[email protected]>
Reviewed-by: Peng Fan <[email protected]>
|
|
tmp_buffer is allocated using malloc but failure
is not handled.
This commit ensures that we do not use a NULL pointer
if malloc fails.
Signed-off-by: Francois Berder <[email protected]>
|
|
This driver relies on tegra-specific headers to compile so make it
depend on ARCH_TEGRA.
Signed-off-by: Tom Rini <[email protected]>
Reviewed-by: Svyatoslav Ryhel <[email protected]>
|
|
During entropy evaluation, if the generated samples fail any statistical test,
then, all of the bits will be discarded, and a second set of samples will be
generated and tested.
Double the ent_delay to give more chance to pass before performing retry.
Signed-off-by: Gaurav Jain <[email protected]>
Signed-off-by: Peng Fan <[email protected]>
|
|
u-boot internals were being corrupted following an EFI callback to
get_rng(). One of the many footprints was a corruption of the EFI
protocols linked list.
A request for >16 bytes of random data is broken into smaller requests.
Those requests are fed in a loop to the CAAM RNG, which uses a job
queue ring for interaction.
However, the job queue descriptor is created only at probe time. That
descriptor may end up needing an endian swap (LS1046A) before being fed
to the CAAM RNG. This corrupts the descriptor for the next iteration,
since it will be blindly endian swapped yet again.
Two issues arise. The number of words to endian swap is taken from the
input descriptor itself. So on the second iteration, the length has been
corrupted. This results in a corruption past the end of the descriptor:
whatever is after in memory is endian swapped too. Second, some of the
entries in the descriptor are DMA addresses. If the descriptor is still
somehow considered valid after swapping, the data at the corrupted DMA
address is now trampled.
Linux properly initializes the descriptor for each iteration. This is
what is now done with this commit.
Signed-off-by: Anthony Pighin <[email protected]>
Signed-off-by: Peng Fan <[email protected]>
|
|
This driver allows using Tegra AES engines within BSEV and BSEA blocks to
encrypt and decrypt data using different AES algorithms.
One use case is allowing u-boot to self update by using the already loaded
AES key in the engine's SBK slot by the bootrom.
Particular care must be taken as chainloaded u-boot's may not have the SBK
slot loaded as the vendor bootloader erases it before leaving it.
Signed-off-by: Ion Agorria <[email protected]>
|
|
Svyatoslav Ryhel <[email protected]> says:
Add uclass for HW AES cryptographic devices found on some devices, like
Tegra20/Tegra30 SoC AES engine.
Link: https://lore.kernel.org/r/[email protected]
|
|
This adds AES crypto engine using the AES Uclass implemented in software,
serves as example implementation and for uclass tests.
Those implementing HW AES crypto engine drivers can use this as basis and
replace software parts with the HW specifics of their device.
Signed-off-by: Ion Agorria <[email protected]>
|
|
Create a basic framework for a group of devices that perform AES
cryptographic operations.
Signed-off-by: Ion Agorria <[email protected]>
Signed-off-by: Svyatoslav Ryhel <[email protected]>
|
|
Some of the aspeed platform drivers cannot build without platform
specific headers being available. Express those requirements in Kconfig as
well.
Signed-off-by: Tom Rini <[email protected]>
|
|
These drivers require various headers which only exist on the ARM /
PowerPC platforms which implement the hardware. Express that requirement
in Kconfig as well.
Reviewed-by: Peng Fan <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
The nuvoton AES driver cannot build without platform specific headers
being available. Express that requirement in Kconfig as well.
Signed-off-by: Tom Rini <[email protected]>
|
|
This reverts commit 159b6f0e119962ce5da645f548cefe9196c8778e.
Since commit 159b6f0e1199 ("caam: Fix CAAM error on startup") the following
regression was reported by Tim Harvey:
"I've found that this patch causes a regression on an imx8mm board
(imx8mm_venice_defconfig) where the first call to caam_rng_read fails
here in jr_dequeue but if you call it again it works. With some
debugging added:
SEC0: RNG instantiated
...
Hit any key to stop autoboot: 0
u-boot=> rng list
RNG #0 - caam-rng
u-boot=> rng 0 10
caam_rng_read caam-rng len=16
run_descriptor_jr_idx idx=0
Error in SEC deq: -1
caam_rng_read_one run_descriptor_jr failed: -1
caam_rng_read caam-rng caam_rng_read_one failed: -5
Reading RNG failed
u-boot=> rng 0 10
caam_rng_read caam-rng len=16
run_descriptor_jr_idx idx=0
00000000: ad 2e ad c0 2a 12 27 c4 65 82 66 19 be ef f6 07 ....*.'.e.f.....
If I revert your patch caam_rng_read works initially and on subsequent
calls."
" I ran into this when I was testing
lwIP HTTPS as it causes anything that uses dm_rng to fail the first
time (such as HTTPS)."
Revert it for now to avoid the regression.
Reported-by: Tim Harvey <[email protected]>
Signed-off-by: Fabio Estevam <[email protected]>
Acked-by: Peng Fan <[email protected]>
|
|
In rare cases U-Boot returns an error message when intantiating the RNG
of the CAAM device:
“SEC0: RNG4 SH0 instantiation failed with error 0xffffffff”
This means, that even when the CAAM device reports a finished
descriptor, none is found in the output ring.
This might be caused by a missing cache invalidation before
reading the memory of the output ring
This patch moves the cache invalidation of the output ring from start of
the job to immediately after the notification from hardware where the
output ring will be read.
Signed-off-by: Olaf Baehring <[email protected]>
Signed-off-by: Fabio Estevam <[email protected]>
|
|
Loading a FIT kernel image with hash hardware acceleration enabled
(CONFIG_SHA_HW_ACCEL=y) displays the following CACHE warning:
[...]
Trying 'kernel-1' kernel subimage
[...]
Verifying Hash Integrity ... sha256CACHE: Misaligned operation at
range [16000128, 1673fae8]
[...]
Trying 'ramdisk-1' ramdisk subimage
[...]
Verifying Hash Integrity ... sha256CACHE: Misaligned operation at
range [1676d6d4, 1737a5d4]
[...]
Trying 'fdt-imx6q-xxx.dtb' fdt subimage
[...]
Verifying Hash Integrity ... sha256CACHE: Misaligned operation at
range [1673fbdc, 1674b0dc]
[...]
This patch fixes it.
Tested on:
- i.MX 6 custom board
- LS1021A custom board
Signed-off-by: Benjamin Lemouzy <[email protected]>
Signed-off-by: Peng Fan <[email protected]>
|
|
%s/volatge/voltage/g
Signed-off-by: Heinrich Schuchardt <[email protected]>
Acked-by: Peng Fan <[email protected]>
|
|
Aspeed AST27xx SoCs integrate the CPTRA 1.0 secure IP, which export
an ECDSA384_SIGNATURE_VERIFY mailbox command service for SoC to use.
This patch is verified by the FIT signature verification using the
"sha384,ecdsa384" algorithm.
Signed-off-by: Chia-Wei Wang <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Use PHASE_ as the symbol to select a particular XPL build. This means
that SPL_TPL_ is no-longer set.
Update the comment in bootstage to refer to this symbol, instead of
SPL_
Signed-off-by: Simon Glass <[email protected]>
|
|
Use the new symbol to refer to any 'SPL' build, including TPL and VPL
Signed-off-by: Simon Glass <[email protected]>
|
|
Aspeed AST27xx SoCs integrate the CPTRA 1.0 secure IP, which
export a SHA accelerator interface for SoC to use.
Note that CPTRA 1.0 supports only SHA384 and SHA512 and this
patch is verified by the 'hash test sha384/sha512' commands.
Signed-off-by: Chia-Wei Wang <[email protected]>
|
|
Drop all duplicate newlines. No functional change.
Signed-off-by: Marek Vasut <[email protected]>
|
|
Raymond Mao <[email protected]> says:
This patch set is picked from the previously posted serie:
"[RFC] Integrate MbedTLS v3.6 LTS with U-Boot"
They are not directly related to MbedTLS integration, but the
prerequisite for a few clean-up, refactoring and minor fixes.
For V2, the linker script patch is dropped and added one patch
to move the snprintf to stdio.h
|
|
Use of typedef is beneficial for porting with other crypto libs
without changing the API callers.
Secondly, it is for the code consistency with other digest libs.
SHA1, SHA256 and SHA512 are all using typedef for their context.
Signed-off-by: Raymond Mao <[email protected]>
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Ilias Apalodimas <[email protected]>
|
|
As part of bringing the master branch back in to next, we need to allow
for all of these changes to exist here.
Reported-by: Jonas Karlman <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
Prepare v2024.07-rc3
|
|
When bringing in the series 'arm: dts: am62-beagleplay: Fix Beagleplay
Ethernet"' I failed to notice that b4 noticed it was based on next and
so took that as the base commit and merged that part of next to master.
This reverts commit c8ffd1356d42223cbb8c86280a083cc3c93e6426, reversing
changes made to 2ee6f3a5f7550de3599faef9704e166e5dcace35.
Reported-by: Jonas Karlman <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
1. Use vendor naming rule to rename each function
2. add SHA 384/512 support
Signed-off-by: Jim Liu <[email protected]>
|
|
Remove <common.h> from this driver directory and when needed
add missing include files directly.
Signed-off-by: Tom Rini <[email protected]>
|
|
Differentiate between "Enable Random Number Generator support" and
"Enable Random Number Generator support" in Kconfig entry, mark the
first as CAAM and the second as DCP, otherwise users cannot easily
decide which of the options is which and enable the correct one.
Signed-off-by: Marek Vasut <[email protected]>
|
|
Add SPL variant of SPL_FSL_CAAM_RNG so that the SPL_FSL_CAAM_RNG can
be disabled in SPL if necessary. This may be necessary due to e.g.
size constraints of the SPL.
Signed-off-by: Marek Vasut <[email protected]>
|
|
Add SPL variant of DM_RNG so that the DM_RNG can be disabled in SPL
if necessary. This may be necessary due to e.g. size constraints of
the SPL.
Signed-off-by: Marek Vasut <[email protected]>
|
|
All errors are generated by ./tools/qconfig.py -b -j8 -i whatever.
Error look like this:
drivers/crypto/Kconfig:9: warning: style: quotes recommended around
'drivers/crypto/nuvoton/Kconfig' in 'source drivers/crypto/nuvoton/Kconfig'
Signed-off-by: Michal Simek <[email protected]>
|
|
Add a new kconfig option to allow non-secure world access
to the CAAM Job Ring.
This is needed, for example, when running linux without
OP-TEE services, as it's done on Colibri iMX7.
Fixes: 51f1357f3428 ("Revert "drivers/crypto/fsl: assign job-rings to non-TrustZone"")
Signed-off-by: Emanuele Ghidoli <[email protected]>
|
|
In order to make it easier to move on to dropping common.h from code
directly, remove common.h inclusion from the rest of the header file
which had been including it.
Reviewed-by: Simon Glass <[email protected]>
Signed-off-by: Tom Rini <[email protected]>
|
|
Similar change was done by commit b4c2c151b14b ("Kconfig: Remove all
default n/no options") and again sync is required.
default n/no doesn't need to be specified. It is default option anyway.
Signed-off-by: Michal Simek <[email protected]>
Reviewed-by: Svyatoslav Ryhel <[email protected]> # tegra
Reviewed-by: Tom Rini <[email protected]>
Reviewed-by: Angelo Dureghello <[email protected]>
|
|
The last user of the NEEDS_MANUAL_RELOC has been removed in commit
26af162ac8f8 ("arch: m68k: Implement relocation")
Remove now unused NEEDS_MANUAL_RELOC code.
Signed-off-by: Marek Vasut <[email protected]>
|
|
This converts 2 usages of this option to the non-SPL form, since there is
no SPL_HW_WATCHDOG defined in Kconfig
Signed-off-by: Simon Glass <[email protected]>
Reviewed-by: Chia-Wei Wang <[email protected]>
|
|
At this point, the remaining places where we have a symbol that is
defined as CONFIG_... are in fairly odd locations. While as much dead
code has been removed as possible, some of these locations are simply
less obvious at first. In other cases, this code is used, but was
defined in such a way as to have been missed by earlier checks. Perform
a rename of all such remaining symbols to be CFG_... rather than
CONFIG_...
Signed-off-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
This commit introduces Random number generator to uboot. It uses DCP
driver for number generation.
RNG driver can be invoked by using below command on uboot prompt:-
rng <number of bytes>
Signed-off-by: Kshitiz Varshney <[email protected]>
Reviewed-by: Ye Li <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Migrate all of COFIG_SYS_FSL* to the CFG_SYS namespace.
Signed-off-by: Tom Rini <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
|
|
Fix SHA512 config name and add missing SHA384 config.
Signed-off-by: Benjamin Bara <[email protected]>
|
|
issue:
CAAM fails with key error when perform Modular Exponentiation
using PKHA Block in CAAM
Fix:
add flush and invalidate dcache for keys, signature
and output decrypted data processed by CAAM.
Fixes: 34276478f7 (DM: crypto/fsl - Add Freescale rsa DM driver)
Signed-off-by: Ye Li <[email protected]>
Reviewed-by: Gaurav Jain <[email protected]>
Acked-by: Peng Fan <[email protected]>
|
|
This function is also available as ofnode_is_enabled(), so use that
instead.
Signed-off-by: Simon Glass <[email protected]>
|
|
Signed-off-by: Tom Rini <[email protected]>
|
|
wrong end address passed to flush_dcache_range.
modified the flush_dache logic for scatter list elements.
Fixes: 1919f58a8f (crypto/fsl: fsl_hash: Fix dcache issue in caam_hash_finish)
Signed-off-by: Gaurav Jain <[email protected]>
|
|
Globally replace all occurances of WATCHDOG_RESET() with schedule(),
which handles the HW_WATCHDOG functionality and the cyclic
infrastructure.
Signed-off-by: Stefan Roese <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Tested-by: Tom Rini <[email protected]> [am335x_evm, mx6cuboxi, rpi_3,dra7xx_evm, pine64_plus, am65x_evm, j721e_evm]
|
|
This converts the following to Kconfig:
CONFIG_SYS_FSL_MAX_NUM_OF_SEC
Signed-off-by: Tom Rini <[email protected]>
|
|
add nuvoton BMC npcm750 SHA driver
Signed-off-by: Jim Liu <[email protected]>
|
|
add nuvoton BMC npcm750 AES driver
Signed-off-by: Jim Liu <[email protected]>
|
|
While working on an LX2160 based board and updating to latest mainline
I noticed problems using the HW accelerated hash functions on this
platform, when trying to boot a FIT Kernel image. Here the resulting
error message:
Using 'conf-freescale_lx2160a.dtb' configuration
Trying 'kernel-1' kernel subimage
Verifying Hash Integrity ... sha256Error: Address arguments are not aligned
CAAM was not setup properly or it is faulty
error!
Bad hash value for 'hash-1' hash node in 'kernel-1' image node
Bad Data Hash
ERROR: can't get kernel image!
Testing and checking with Gaurav Jain from NXP has revealed, that this
alignment check is not necessary here at all. So let's remove this
check completely.
Signed-off-by: Stefan Roese <[email protected]>
Cc: Gaurav Jain <[email protected]>
Cc: [email protected]
Reviewed-by: Gaurav Jain <[email protected]>
|
