imx: ele_ahab: Add HUK derivation support
Add a new ahab_derive command that derives the hardware unique key (HUK)
into a 16 or 32 bytes key and stores it at the given address.
Signed-off-by: Mathieu Othacehe <othacehe@gnu.org>
Reviewed-by: Ye Li <ye.li@nxp.com>
diff --git a/arch/arm/include/asm/mach-imx/ele_api.h b/arch/arm/include/asm/mach-imx/ele_api.h
index a29b849..d4ac567 100644
--- a/arch/arm/include/asm/mach-imx/ele_api.h
+++ b/arch/arm/include/asm/mach-imx/ele_api.h
@@ -26,6 +26,7 @@
#define ELE_GET_EVENTS_REQ (0xA2)
#define ELE_COMMIT_REQ (0xA8)
#define ELE_START_RNG (0xA3)
+#define ELE_CMD_DERIVE_KEY (0xA9)
#define ELE_GENERATE_DEK_BLOB (0xAF)
#define ELE_ENABLE_PATCH_REQ (0xC3)
#define ELE_RELEASE_RDC_REQ (0xC4)
@@ -143,6 +144,7 @@
int ele_release_caam(u32 core_did, u32 *response);
int ele_get_fw_version(u32 *fw_version, u32 *sha1, u32 *response);
int ele_get_events(u32 *events, u32 *events_cnt, u32 *response);
+int ele_derive_huk(u8 *key, size_t key_size, u8 *ctx, size_t seed_size);
int ele_commit(u16 fuse_id, u32 *response, u32 *info_type);
int ele_generate_dek_blob(u32 key_id, u32 src_paddr, u32 dst_paddr, u32 max_output_size);
int ele_dump_buffer(u32 *buffer, u32 buffer_length);
diff --git a/arch/arm/mach-imx/ele_ahab.c b/arch/arm/mach-imx/ele_ahab.c
index c13d9f0e..647daeb 100644
--- a/arch/arm/mach-imx/ele_ahab.c
+++ b/arch/arm/mach-imx/ele_ahab.c
@@ -624,6 +624,31 @@
return CMD_RET_SUCCESS;
}
+static int do_ahab_derive(struct cmd_tbl *cmdtp, int flag, int argc,
+ char *const argv[])
+{
+ ulong key;
+ size_t key_size;
+ char seed[] = "_ELE_AHAB_SEED_";
+
+ if (argc != 3)
+ return CMD_RET_USAGE;
+
+ key = hextoul(argv[1], NULL);
+ key_size = simple_strtoul(argv[2], NULL, 10);
+ if (key_size != 16 && key_size != 32) {
+ printf("key size can only be 16 or 32\n");
+ return CMD_RET_FAILURE;
+ }
+
+ if (ele_derive_huk((u8 *)key, key_size, seed, sizeof(seed))) {
+ printf("Error in AHAB derive\n");
+ return CMD_RET_FAILURE;
+ }
+
+ return CMD_RET_SUCCESS;
+}
+
static int do_ahab_commit(struct cmd_tbl *cmdtp, int flag, int argc,
char *const argv[])
{
@@ -680,6 +705,12 @@
"addr - Return lifecycle message block signed by OEM SRK\n"
);
+U_BOOT_CMD(ahab_derive, CONFIG_SYS_MAXARGS, 3, do_ahab_derive,
+ "Derive the hardware unique key",
+ "addr [16|32]\n"
+ "Store at addr the derivation of the HUK on 16 or 32 bytes.\n"
+);
+
U_BOOT_CMD(ahab_commit, CONFIG_SYS_MAXARGS, 1, do_ahab_commit,
"commit into the fuses any new SRK revocation and FW version information\n"
"that have been found into the NXP (ELE FW) and OEM containers",