diff options
| author | Mathieu Othacehe <othacehe@gnu.org> | 2024-08-26 12:07:07 +0200 |
|---|---|---|
| committer | Fabio Estevam <festevam@gmail.com> | 2024-08-30 15:50:36 -0300 |
| commit | ef53c7759507b51f6c7902cab6305597cbf37797 (patch) | |
| tree | 374e30793ece9c59256088c19d629b6e3ceb7362 /arch/arm | |
| parent | e83ced1a24095de66e526bd6c10f0f24584baaee (diff) | |
imx: ele_ahab: Add HUK derivation support
Add a new ahab_derive command that derives the hardware unique key (HUK)
into a 16 or 32 bytes key and stores it at the given address.
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
Reviewed-by: Ye Li <ye.li@nxp.com>
Diffstat (limited to 'arch/arm')
| -rw-r--r-- | arch/arm/include/asm/mach-imx/ele_api.h | 2 | ||||
| -rw-r--r-- | arch/arm/mach-imx/ele_ahab.c | 31 |
2 files changed, 33 insertions, 0 deletions
diff --git a/arch/arm/include/asm/mach-imx/ele_api.h b/arch/arm/include/asm/mach-imx/ele_api.h index a29b849d903..d4ac567e7ed 100644 --- a/arch/arm/include/asm/mach-imx/ele_api.h +++ b/arch/arm/include/asm/mach-imx/ele_api.h @@ -26,6 +26,7 @@ #define ELE_GET_EVENTS_REQ (0xA2) #define ELE_COMMIT_REQ (0xA8) #define ELE_START_RNG (0xA3) +#define ELE_CMD_DERIVE_KEY (0xA9) #define ELE_GENERATE_DEK_BLOB (0xAF) #define ELE_ENABLE_PATCH_REQ (0xC3) #define ELE_RELEASE_RDC_REQ (0xC4) @@ -143,6 +144,7 @@ int ele_read_common_fuse(u16 fuse_id, u32 *fuse_words, u32 fuse_num, u32 *respon int ele_release_caam(u32 core_did, u32 *response); int ele_get_fw_version(u32 *fw_version, u32 *sha1, u32 *response); int ele_get_events(u32 *events, u32 *events_cnt, u32 *response); +int ele_derive_huk(u8 *key, size_t key_size, u8 *ctx, size_t seed_size); int ele_commit(u16 fuse_id, u32 *response, u32 *info_type); int ele_generate_dek_blob(u32 key_id, u32 src_paddr, u32 dst_paddr, u32 max_output_size); int ele_dump_buffer(u32 *buffer, u32 buffer_length); diff --git a/arch/arm/mach-imx/ele_ahab.c b/arch/arm/mach-imx/ele_ahab.c index c13d9f0e00e..647daeb6562 100644 --- a/arch/arm/mach-imx/ele_ahab.c +++ b/arch/arm/mach-imx/ele_ahab.c @@ -624,6 +624,31 @@ static int do_ahab_return_lifecycle(struct cmd_tbl *cmdtp, int flag, int argc, c return CMD_RET_SUCCESS; } +static int do_ahab_derive(struct cmd_tbl *cmdtp, int flag, int argc, + char *const argv[]) +{ + ulong key; + size_t key_size; + char seed[] = "_ELE_AHAB_SEED_"; + + if (argc != 3) + return CMD_RET_USAGE; + + key = hextoul(argv[1], NULL); + key_size = simple_strtoul(argv[2], NULL, 10); + if (key_size != 16 && key_size != 32) { + printf("key size can only be 16 or 32\n"); + return CMD_RET_FAILURE; + } + + if (ele_derive_huk((u8 *)key, key_size, seed, sizeof(seed))) { + printf("Error in AHAB derive\n"); + return CMD_RET_FAILURE; + } + + return CMD_RET_SUCCESS; +} + static int do_ahab_commit(struct cmd_tbl *cmdtp, int flag, int argc, char *const argv[]) { @@ -680,6 +705,12 @@ U_BOOT_CMD(ahab_return_lifecycle, CONFIG_SYS_MAXARGS, 1, do_ahab_return_lifecycl "addr - Return lifecycle message block signed by OEM SRK\n" ); +U_BOOT_CMD(ahab_derive, CONFIG_SYS_MAXARGS, 3, do_ahab_derive, + "Derive the hardware unique key", + "addr [16|32]\n" + "Store at addr the derivation of the HUK on 16 or 32 bytes.\n" +); + U_BOOT_CMD(ahab_commit, CONFIG_SYS_MAXARGS, 1, do_ahab_commit, "commit into the fuses any new SRK revocation and FW version information\n" "that have been found into the NXP (ELE FW) and OEM containers", |