diff options
| author | Ji Luo <ji.luo@nxp.com> | 2019-07-17 12:21:09 +0800 |
|---|---|---|
| committer | Ji Luo <ji.luo@nxp.com> | 2019-07-17 12:21:09 +0800 |
| commit | d38685ac5f99ea62e3b9c291e0396fec6fb222e7 (patch) | |
| tree | e1f5eda56539a5c0e7bb9554737417f926f65b5e | |
| parent | 827f6a10e4a1ca3dc4c3844cff3e97f5dcd35857 (diff) | |
MA-15151 Limit some hwcrypto commands within bootloader
It can be dangerous to export some hwcrypto commands to Linux,
add commands to limit some commands within bootloader.
Test: hwcrypto commands can't be used after locking boot state.
Change-Id: Ib0a96a87f661778c133178840d8dccf49f151c22
Signed-off-by: Ji Luo <ji.luo@nxp.com>
| -rw-r--r-- | drivers/usb/gadget/f_fastboot.c | 2 | ||||
| -rw-r--r-- | include/interface/hwcrypto/hwcrypto.h | 1 | ||||
| -rw-r--r-- | include/trusty/hwcrypto.h | 7 | ||||
| -rw-r--r-- | lib/trusty/ql-tipc/hwcrypto.c | 5 |
4 files changed, 15 insertions, 0 deletions
diff --git a/drivers/usb/gadget/f_fastboot.c b/drivers/usb/gadget/f_fastboot.c index 245372080d..cb37ca6cab 100644 --- a/drivers/usb/gadget/f_fastboot.c +++ b/drivers/usb/gadget/f_fastboot.c @@ -2520,6 +2520,8 @@ int do_boota(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { goto fail; /* lock the boot status and rollback_idx preventing Linux modify it */ trusty_lock_boot_state(); + /* lock the boot state so linux can't use some hwcrypto commands. */ + hwcrypto_lock_boot_state(); /* put ql-tipc to release resource for Linux */ trusty_ipc_shutdown(); #endif diff --git a/include/interface/hwcrypto/hwcrypto.h b/include/interface/hwcrypto/hwcrypto.h index 4579d8c2e7..b8afb94aef 100644 --- a/include/interface/hwcrypto/hwcrypto.h +++ b/include/interface/hwcrypto/hwcrypto.h @@ -40,6 +40,7 @@ enum hwcrypto_command { HWCRYPTO_ENCAP_BLOB = (2 << HWCRYPTO_REQ_SHIFT), HWCRYPTO_GEN_RNG = (3 << HWCRYPTO_REQ_SHIFT), HWCRYPTO_GEN_BKEK = (4 << HWCRYPTO_REQ_SHIFT), + HWCRYPTO_LOCK_BOOT_STATE = (5 << HWCRYPTO_REQ_SHIFT), }; /** diff --git a/include/trusty/hwcrypto.h b/include/trusty/hwcrypto.h index d6837d6f84..bf7ae4cd87 100644 --- a/include/trusty/hwcrypto.h +++ b/include/trusty/hwcrypto.h @@ -82,4 +82,11 @@ int hwcrypto_gen_rng(uint32_t buf, uint32_t len); * @len: size of required rng. * */ int hwcrypto_gen_bkek(uint32_t buf, uint32_t len); + +/* Send request to secure side to lock boot state, so some + * hwcrypto commands can't be used outside of bootloader. + * Returns one of trusty_err. + * */ +int hwcrypto_lock_boot_state(void); + #endif /* TRUSTY_HWCRYPTO_H_ */ diff --git a/lib/trusty/ql-tipc/hwcrypto.c b/lib/trusty/ql-tipc/hwcrypto.c index 50532b005b..800b759c53 100644 --- a/lib/trusty/ql-tipc/hwcrypto.c +++ b/lib/trusty/ql-tipc/hwcrypto.c @@ -262,3 +262,8 @@ int hwcrypto_gen_bkek(uint32_t buf, uint32_t len) sizeof(req), NULL, 0, false); return rc; } + +int hwcrypto_lock_boot_state(void) +{ + return hwcrypto_do_tipc(HWCRYPTO_LOCK_BOOT_STATE, NULL, 0, NULL, 0, false); +} |