1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (C) 2021 sigma star gmbh 4 */ 5 6 #include <crypto/aead.h> 7 #include <crypto/aes.h> 8 #include <crypto/algapi.h> 9 #include <crypto/gcm.h> 10 #include <crypto/skcipher.h> 11 #include <keys/trusted-type.h> 12 #include <linux/key-type.h> 13 #include <linux/module.h> 14 #include <linux/printk.h> 15 #include <linux/random.h> 16 #include <linux/scatterlist.h> 17 #include <soc/fsl/dcp.h> 18 19 #define DCP_BLOB_VERSION 1 20 #define DCP_BLOB_AUTHLEN 16 21 22 /** 23 * struct dcp_blob_fmt - DCP BLOB format. 24 * 25 * @fmt_version: Format version, currently being %1. 26 * @blob_key: Random AES 128 key which is used to encrypt @payload, 27 * @blob_key itself is encrypted with OTP or UNIQUE device key in 28 * AES-128-ECB mode by DCP. 29 * @nonce: Random nonce used for @payload encryption. 30 * @payload_len: Length of the plain text @payload. 31 * @payload: The payload itself, encrypted using AES-128-GCM and @blob_key, 32 * GCM auth tag of size DCP_BLOB_AUTHLEN is attached at the end of it. 33 * 34 * The total size of a DCP BLOB is sizeof(struct dcp_blob_fmt) + @payload_len + 35 * DCP_BLOB_AUTHLEN. 36 */ 37 struct dcp_blob_fmt { 38 __u8 fmt_version; 39 __u8 blob_key[AES_KEYSIZE_128]; 40 __u8 nonce[AES_KEYSIZE_128]; 41 __le32 payload_len; 42 __u8 payload[]; 43 } __packed; 44 45 static bool use_otp_key; 46 module_param_named(dcp_use_otp_key, use_otp_key, bool, 0); 47 MODULE_PARM_DESC(dcp_use_otp_key, "Use OTP instead of UNIQUE key for sealing"); 48 49 static bool skip_zk_test; 50 module_param_named(dcp_skip_zk_test, skip_zk_test, bool, 0); 51 MODULE_PARM_DESC(dcp_skip_zk_test, "Don't test whether device keys are zero'ed"); 52 53 static unsigned int calc_blob_len(unsigned int payload_len) 54 { 55 return sizeof(struct dcp_blob_fmt) + payload_len + DCP_BLOB_AUTHLEN; 56 } 57 58 static int do_dcp_crypto(u8 *in, u8 *out, bool do_encrypt) 59 { 60 struct skcipher_request *req = NULL; 61 struct scatterlist src_sg, dst_sg; 62 struct crypto_skcipher *tfm; 63 u8 paes_key[DCP_PAES_KEYSIZE]; 64 DECLARE_CRYPTO_WAIT(wait); 65 int res = 0; 66 67 if (use_otp_key) 68 paes_key[0] = DCP_PAES_KEY_OTP; 69 else 70 paes_key[0] = DCP_PAES_KEY_UNIQUE; 71 72 tfm = crypto_alloc_skcipher("ecb-paes-dcp", CRYPTO_ALG_INTERNAL, 73 CRYPTO_ALG_INTERNAL); 74 if (IS_ERR(tfm)) { 75 res = PTR_ERR(tfm); 76 tfm = NULL; 77 goto out; 78 } 79 80 req = skcipher_request_alloc(tfm, GFP_NOFS); 81 if (!req) { 82 res = -ENOMEM; 83 goto out; 84 } 85 86 skcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG | 87 CRYPTO_TFM_REQ_MAY_SLEEP, 88 crypto_req_done, &wait); 89 res = crypto_skcipher_setkey(tfm, paes_key, sizeof(paes_key)); 90 if (res < 0) 91 goto out; 92 93 sg_init_one(&src_sg, in, AES_KEYSIZE_128); 94 sg_init_one(&dst_sg, out, AES_KEYSIZE_128); 95 skcipher_request_set_crypt(req, &src_sg, &dst_sg, AES_KEYSIZE_128, 96 NULL); 97 98 if (do_encrypt) 99 res = crypto_wait_req(crypto_skcipher_encrypt(req), &wait); 100 else 101 res = crypto_wait_req(crypto_skcipher_decrypt(req), &wait); 102 103 out: 104 skcipher_request_free(req); 105 crypto_free_skcipher(tfm); 106 107 return res; 108 } 109 110 static int do_aead_crypto(u8 *in, u8 *out, size_t len, u8 *key, u8 *nonce, 111 bool do_encrypt) 112 { 113 struct aead_request *aead_req = NULL; 114 struct scatterlist src_sg, dst_sg; 115 struct crypto_aead *aead; 116 int ret; 117 118 aead = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC); 119 if (IS_ERR(aead)) { 120 ret = PTR_ERR(aead); 121 goto out; 122 } 123 124 ret = crypto_aead_setauthsize(aead, DCP_BLOB_AUTHLEN); 125 if (ret < 0) { 126 pr_err("Can't set crypto auth tag len: %d\n", ret); 127 goto free_aead; 128 } 129 130 aead_req = aead_request_alloc(aead, GFP_KERNEL); 131 if (!aead_req) { 132 ret = -ENOMEM; 133 goto free_aead; 134 } 135 136 sg_init_one(&src_sg, in, len); 137 if (do_encrypt) { 138 /* 139 * If we encrypt our buffer has extra space for the auth tag. 140 */ 141 sg_init_one(&dst_sg, out, len + DCP_BLOB_AUTHLEN); 142 } else { 143 sg_init_one(&dst_sg, out, len); 144 } 145 146 aead_request_set_crypt(aead_req, &src_sg, &dst_sg, len, nonce); 147 aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, 148 NULL); 149 aead_request_set_ad(aead_req, 0); 150 151 if (crypto_aead_setkey(aead, key, AES_KEYSIZE_128)) { 152 pr_err("Can't set crypto AEAD key\n"); 153 ret = -EINVAL; 154 goto free_req; 155 } 156 157 if (do_encrypt) 158 ret = crypto_aead_encrypt(aead_req); 159 else 160 ret = crypto_aead_decrypt(aead_req); 161 162 free_req: 163 aead_request_free(aead_req); 164 free_aead: 165 crypto_free_aead(aead); 166 out: 167 return ret; 168 } 169 170 static int decrypt_blob_key(u8 *key) 171 { 172 return do_dcp_crypto(key, key, false); 173 } 174 175 static int encrypt_blob_key(u8 *key) 176 { 177 return do_dcp_crypto(key, key, true); 178 } 179 180 static int trusted_dcp_seal(struct trusted_key_payload *p, char *datablob) 181 { 182 struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob; 183 int blen, ret; 184 185 blen = calc_blob_len(p->key_len); 186 if (blen > MAX_BLOB_SIZE) 187 return -E2BIG; 188 189 b->fmt_version = DCP_BLOB_VERSION; 190 get_random_bytes(b->nonce, AES_KEYSIZE_128); 191 get_random_bytes(b->blob_key, AES_KEYSIZE_128); 192 193 ret = do_aead_crypto(p->key, b->payload, p->key_len, b->blob_key, 194 b->nonce, true); 195 if (ret) { 196 pr_err("Unable to encrypt blob payload: %i\n", ret); 197 return ret; 198 } 199 200 ret = encrypt_blob_key(b->blob_key); 201 if (ret) { 202 pr_err("Unable to encrypt blob key: %i\n", ret); 203 return ret; 204 } 205 206 b->payload_len = get_unaligned_le32(&p->key_len); 207 p->blob_len = blen; 208 return 0; 209 } 210 211 static int trusted_dcp_unseal(struct trusted_key_payload *p, char *datablob) 212 { 213 struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob; 214 int blen, ret; 215 216 if (b->fmt_version != DCP_BLOB_VERSION) { 217 pr_err("DCP blob has bad version: %i, expected %i\n", 218 b->fmt_version, DCP_BLOB_VERSION); 219 ret = -EINVAL; 220 goto out; 221 } 222 223 p->key_len = le32_to_cpu(b->payload_len); 224 blen = calc_blob_len(p->key_len); 225 if (blen != p->blob_len) { 226 pr_err("DCP blob has bad length: %i != %i\n", blen, 227 p->blob_len); 228 ret = -EINVAL; 229 goto out; 230 } 231 232 ret = decrypt_blob_key(b->blob_key); 233 if (ret) { 234 pr_err("Unable to decrypt blob key: %i\n", ret); 235 goto out; 236 } 237 238 ret = do_aead_crypto(b->payload, p->key, p->key_len + DCP_BLOB_AUTHLEN, 239 b->blob_key, b->nonce, false); 240 if (ret) { 241 pr_err("Unwrap of DCP payload failed: %i\n", ret); 242 goto out; 243 } 244 245 ret = 0; 246 out: 247 return ret; 248 } 249 250 static int test_for_zero_key(void) 251 { 252 /* 253 * Encrypting a plaintext of all 0x55 bytes will yield 254 * this ciphertext in case the DCP test key is used. 255 */ 256 static const u8 bad[] = {0x9a, 0xda, 0xe0, 0x54, 0xf6, 0x3d, 0xfa, 0xff, 257 0x5e, 0xa1, 0x8e, 0x45, 0xed, 0xf6, 0xea, 0x6f}; 258 void *buf = NULL; 259 int ret = 0; 260 261 if (skip_zk_test) 262 goto out; 263 264 buf = kmalloc(AES_BLOCK_SIZE, GFP_KERNEL); 265 if (!buf) { 266 ret = -ENOMEM; 267 goto out; 268 } 269 270 memset(buf, 0x55, AES_BLOCK_SIZE); 271 272 ret = do_dcp_crypto(buf, buf, true); 273 if (ret) 274 goto out; 275 276 if (memcmp(buf, bad, AES_BLOCK_SIZE) == 0) { 277 pr_warn("Device neither in secure nor trusted mode!\n"); 278 ret = -EINVAL; 279 } 280 out: 281 kfree(buf); 282 return ret; 283 } 284 285 static int trusted_dcp_init(void) 286 { 287 int ret; 288 289 if (use_otp_key) 290 pr_info("Using DCP OTP key\n"); 291 292 ret = test_for_zero_key(); 293 if (ret) { 294 pr_warn("Test for zero'ed keys failed: %i\n", ret); 295 296 return -EINVAL; 297 } 298 299 return register_key_type(&key_type_trusted); 300 } 301 302 static void trusted_dcp_exit(void) 303 { 304 unregister_key_type(&key_type_trusted); 305 } 306 307 struct trusted_key_ops dcp_trusted_key_ops = { 308 .exit = trusted_dcp_exit, 309 .init = trusted_dcp_init, 310 .seal = trusted_dcp_seal, 311 .unseal = trusted_dcp_unseal, 312 .migratable = 0, 313 }; 314