mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-30 16:07:39 +00:00
e9c5048c2d
The Cryptographic Acceleration and Assurance Module (CAAM) is an IP core built into many newer i.MX and QorIQ SoCs by NXP. The CAAM does crypto acceleration, hardware number generation and has a blob mechanism for encapsulation/decapsulation of sensitive material. This blob mechanism depends on a device specific random 256-bit One Time Programmable Master Key that is fused in each SoC at manufacturing time. This key is unreadable and can only be used by the CAAM for AES encryption/decryption of user data. This makes it a suitable backend (source) for kernel trusted keys. Previous commits generalized trusted keys to support multiple backends and added an API to access the CAAM blob mechanism. Based on these, provide the necessary glue to use the CAAM for trusted keys. Reviewed-by: David Gstir <david@sigma-star.at> Reviewed-by: Pankaj Gupta <pankaj.gupta@nxp.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Tested-by: Tim Harvey <tharvey@gateworks.com> Tested-by: Matthias Schiffer <matthias.schiffer@ew.tq-group.com> Tested-by: Pankaj Gupta <pankaj.gupta@nxp.com> Tested-by: Michael Walle <michael@walle.cc> # on ls1028a (non-E and E) Tested-by: John Ernberg <john.ernberg@actia.se> # iMX8QXP Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
80 lines
1.8 KiB
C
80 lines
1.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2021 Pengutronix, Ahmad Fatoum <kernel@pengutronix.de>
|
|
*/
|
|
|
|
#include <keys/trusted_caam.h>
|
|
#include <keys/trusted-type.h>
|
|
#include <linux/build_bug.h>
|
|
#include <linux/key-type.h>
|
|
#include <soc/fsl/caam-blob.h>
|
|
|
|
static struct caam_blob_priv *blobifier;
|
|
|
|
#define KEYMOD "SECURE_KEY"
|
|
|
|
static_assert(MAX_KEY_SIZE + CAAM_BLOB_OVERHEAD <= CAAM_BLOB_MAX_LEN);
|
|
static_assert(MAX_BLOB_SIZE <= CAAM_BLOB_MAX_LEN);
|
|
|
|
static int trusted_caam_seal(struct trusted_key_payload *p, char *datablob)
|
|
{
|
|
int ret;
|
|
struct caam_blob_info info = {
|
|
.input = p->key, .input_len = p->key_len,
|
|
.output = p->blob, .output_len = MAX_BLOB_SIZE,
|
|
.key_mod = KEYMOD, .key_mod_len = sizeof(KEYMOD) - 1,
|
|
};
|
|
|
|
ret = caam_encap_blob(blobifier, &info);
|
|
if (ret)
|
|
return ret;
|
|
|
|
p->blob_len = info.output_len;
|
|
return 0;
|
|
}
|
|
|
|
static int trusted_caam_unseal(struct trusted_key_payload *p, char *datablob)
|
|
{
|
|
int ret;
|
|
struct caam_blob_info info = {
|
|
.input = p->blob, .input_len = p->blob_len,
|
|
.output = p->key, .output_len = MAX_KEY_SIZE,
|
|
.key_mod = KEYMOD, .key_mod_len = sizeof(KEYMOD) - 1,
|
|
};
|
|
|
|
ret = caam_decap_blob(blobifier, &info);
|
|
if (ret)
|
|
return ret;
|
|
|
|
p->key_len = info.output_len;
|
|
return 0;
|
|
}
|
|
|
|
static int trusted_caam_init(void)
|
|
{
|
|
int ret;
|
|
|
|
blobifier = caam_blob_gen_init();
|
|
if (IS_ERR(blobifier))
|
|
return PTR_ERR(blobifier);
|
|
|
|
ret = register_key_type(&key_type_trusted);
|
|
if (ret)
|
|
caam_blob_gen_exit(blobifier);
|
|
|
|
return ret;
|
|
}
|
|
|
|
static void trusted_caam_exit(void)
|
|
{
|
|
unregister_key_type(&key_type_trusted);
|
|
caam_blob_gen_exit(blobifier);
|
|
}
|
|
|
|
struct trusted_key_ops trusted_key_caam_ops = {
|
|
.migratable = 0, /* non-migratable */
|
|
.init = trusted_caam_init,
|
|
.seal = trusted_caam_seal,
|
|
.unseal = trusted_caam_unseal,
|
|
.exit = trusted_caam_exit,
|
|
};
|