tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

crypto: caam - warn if blob_gen key is insecure

If CAAM is not in "trusted" or "secure" state, a fixed non-volatile key
is used instead of the unique device key. This is the default mode of
operation without secure boot (HAB). In this scenario, CAAM encrypted
blobs should be used only for testing but not in a production
environment, so issue a warning.

Signed-off-by: Nikolaus Voss <nikolaus.voss@haag-streit.com>
Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

authored by

Nikolaus Voss and committed by
Herbert Xu 6a83830f 31f81401

+12
+9
drivers/crypto/caam/blob_gen.c
··· 6 6 7 7 #define pr_fmt(fmt) "caam blob_gen: " fmt 8 8 9 + #include <linux/bitfield.h> 9 10 #include <linux/device.h> 10 11 #include <soc/fsl/caam-blob.h> 11 12 ··· 62 61 int caam_process_blob(struct caam_blob_priv *priv, 63 62 struct caam_blob_info *info, bool encap) 64 63 { 64 + const struct caam_drv_private *ctrlpriv; 65 65 struct caam_blob_job_result testres; 66 66 struct device *jrdev = &priv->jrdev; 67 67 dma_addr_t dma_in, dma_out; 68 68 int op = OP_PCLID_BLOB; 69 69 size_t output_len; 70 70 u32 *desc; 71 + u32 moo; 71 72 int ret; 72 73 73 74 if (info->key_mod_len > CAAM_BLOB_KEYMOD_LENGTH) ··· 102 99 ret = -ENOMEM; 103 100 goto out_unmap_in; 104 101 } 102 + 103 + ctrlpriv = dev_get_drvdata(jrdev->parent); 104 + moo = FIELD_GET(CSTA_MOO, ioread32(&ctrlpriv->ctrl->perfmon.status)); 105 + if (moo != CSTA_MOO_SECURE && moo != CSTA_MOO_TRUSTED) 106 + dev_warn(jrdev, 107 + "using insecure test key, enable HAB to use unique device key!\n"); 105 108 106 109 /* 107 110 * A data blob is encrypted using a blob key (BK); a random number.
+3
drivers/crypto/caam/regs.h
··· 426 426 u32 rsvd2; 427 427 #define CSTA_PLEND BIT(10) 428 428 #define CSTA_ALT_PLEND BIT(18) 429 + #define CSTA_MOO GENMASK(9, 8) 430 + #define CSTA_MOO_SECURE 1 431 + #define CSTA_MOO_TRUSTED 2 429 432 u32 status; /* CSTA - CAAM Status */ 430 433 u64 rsvd3; 431 434