All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCHv5 2/6] cmd: SCP03: enable and provision command
@ 2021-02-14 15:18 Jorge Ramirez-Ortiz
  2021-02-15 13:13 ` Igor Opaniuk
  0 siblings, 1 reply; 6+ messages in thread
From: Jorge Ramirez-Ortiz @ 2021-02-14 15:18 UTC (permalink / raw)
  To: u-boot

Enable and provision the SCP03 keys on a TEE controlled secured elemt
from the U-Boot shell.

Executing this command will generate and program new SCP03 encryption
keys on the secure element NVM.

Depending on the TEE implementation, the keys would then be stored in
some persistent storage or better derived from some platform secret
(so they can't be lost).

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 cmd/Kconfig  |  8 ++++++++
 cmd/Makefile |  3 +++
 cmd/scp03.c  | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 63 insertions(+)
 create mode 100644 cmd/scp03.c

diff --git a/cmd/Kconfig b/cmd/Kconfig
index 928a2a0a2d..6327374f2c 100644
--- a/cmd/Kconfig
+++ b/cmd/Kconfig
@@ -2021,6 +2021,14 @@ config HASH_VERIFY
 	help
 	  Add -v option to verify data against a hash.
 
+config CMD_SCP03
+	bool "scp03 - SCP03 enable and rotate/provision operations"
+	depends on SCP03
+	help
+	  This command provides access to a Trusted Application
+	  running in a TEE to request Secure Channel Protocol 03
+	  (SCP03) enablement and/or rotation of its SCP03 keys.
+
 config CMD_TPM_V1
 	bool
 
diff --git a/cmd/Makefile b/cmd/Makefile
index 176bf925fd..a7017e8452 100644
--- a/cmd/Makefile
+++ b/cmd/Makefile
@@ -193,6 +193,9 @@ obj-$(CONFIG_CMD_BLOB) += blob.o
 # Android Verified Boot 2.0
 obj-$(CONFIG_CMD_AVB) += avb.o
 
+# Foundries.IO SCP03
+obj-$(CONFIG_CMD_SCP03) += scp03.o
+
 obj-$(CONFIG_ARM) += arm/
 obj-$(CONFIG_RISCV) += riscv/
 obj-$(CONFIG_SANDBOX) += sandbox/
diff --git a/cmd/scp03.c b/cmd/scp03.c
new file mode 100644
index 0000000000..655e0bba08
--- /dev/null
+++ b/cmd/scp03.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * (C) Copyright 2021, Foundries.IO
+ *
+ */
+
+#include <common.h>
+#include <command.h>
+#include <env.h>
+#include <scp03.h>
+
+int do_scp03_enable(struct cmd_tbl *cmdtp, int flag, int argc,
+		    char *const argv[])
+{
+	if (argc != 1)
+		return CMD_RET_USAGE;
+
+	if (tee_enable_scp03()) {
+		printf("TEE failed to enable SCP03\n");
+		return CMD_RET_FAILURE;
+	}
+
+	printf("SCP03 is enabled\n");
+
+	return CMD_RET_SUCCESS;
+}
+
+int do_scp03_provision(struct cmd_tbl *cmdtp, int flag, int argc,
+		       char *const argv[])
+{
+	if (argc != 1)
+		return CMD_RET_USAGE;
+
+	if (tee_provision_scp03()) {
+		printf("TEE failed to provision SCP03 keys\n");
+		return CMD_RET_FAILURE;
+	}
+
+	printf("SCP03 is provisioned\n");
+
+	return CMD_RET_SUCCESS;
+}
+
+static char text[] =
+	"provides a command to enable SCP03 and provision the SCP03 keys\n"
+	" enable    - enable SCP03 on the TEE\n"
+	" provision - provision SCP03 on the TEE\n";
+
+U_BOOT_CMD_WITH_SUBCMDS(scp03, "Secure Channel Protocol 03 control", text,
+	U_BOOT_SUBCMD_MKENT(enable, 1, 1, do_scp03_enable),
+	U_BOOT_SUBCMD_MKENT(provision, 1, 1, do_scp03_provision));
+
-- 
2.30.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCHv5 0/6] SCP03 control, documentation and tests.
@ 2021-02-14 15:27 Jorge Ramirez-Ortiz
  2021-02-14 15:27 ` [PATCHv5 2/6] cmd: SCP03: enable and provision command Jorge Ramirez-Ortiz
  0 siblings, 1 reply; 6+ messages in thread
From: Jorge Ramirez-Ortiz @ 2021-02-14 15:27 UTC (permalink / raw)
  To: u-boot

Simply adding the reviewed-by tags to the v5 series.

Igor Opaniuk (2):
  sandbox: imply SCP03 and CMD_SCP03
  test: py: add initial coverage for scp03 cmd

Jorge Ramirez-Ortiz (4):
  common: SCP03 control (enable and provision of keys)
  cmd: SCP03: enable and provision command
  drivers: tee: sandbox: SCP03 control emulator
  doc: describe the scp03 command

 arch/Kconfig                 |  2 ++
 cmd/Kconfig                  |  8 +++++
 cmd/Makefile                 |  3 ++
 cmd/scp03.c                  | 52 ++++++++++++++++++++++++++++++++
 common/Kconfig               |  8 +++++
 common/Makefile              |  1 +
 common/scp03.c               | 53 +++++++++++++++++++++++++++++++++
 doc/usage/index.rst          |  1 +
 doc/usage/scp03.rst          | 33 +++++++++++++++++++++
 drivers/tee/optee/Kconfig    |  6 ++++
 drivers/tee/sandbox.c        | 57 ++++++++++++++++++++++++++++++++++--
 include/scp03.h              | 21 +++++++++++++
 include/tee/optee_ta_scp03.h | 21 +++++++++++++
 test/py/tests/test_scp03.py  | 27 +++++++++++++++++
 14 files changed, 291 insertions(+), 2 deletions(-)
 create mode 100644 cmd/scp03.c
 create mode 100644 common/scp03.c
 create mode 100644 doc/usage/scp03.rst
 create mode 100644 include/scp03.h
 create mode 100644 include/tee/optee_ta_scp03.h
 create mode 100644 test/py/tests/test_scp03.py

-- 
2.30.0

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCHv5 1/6] common: SCP03 control (enable and provision of keys)
@ 2021-02-09 20:10 Jorge Ramirez-Ortiz
  2021-02-09 20:10 ` [PATCHv5 2/6] cmd: SCP03: enable and provision command Jorge Ramirez-Ortiz
  0 siblings, 1 reply; 6+ messages in thread
From: Jorge Ramirez-Ortiz @ 2021-02-09 20:10 UTC (permalink / raw)
  To: u-boot

This Trusted Application allows enabling SCP03 as well as provisioning
the keys on TEE controlled secure element (ie, NXP SE050).

All the information flowing on buses (ie I2C) between the processor
and the secure element must be encrypted. Secure elements are
pre-provisioned with a set of keys known to the user so that the
secure channel protocol (encryption) can be enforced on the first
boot. This situation is however unsafe since the keys are publically
available.

For example, in the case of the NXP SE050, these keys would be
available in the OP-TEE source tree [2] and of course in the
documentation corresponding to the part.

To address that, users are required to rotate/provision those keys
(ie, generate new keys and write them in the secure element's
persistent memory).

For information on SCP03, check the Global Platform HomePage and
google for that term [1]
[1] globalplatform.org
[2] https://github.com/OP-TEE/optee_os/
    check:
    core/drivers/crypto/se050/adaptors/utils/scp_config.c

Signed-off-by: Jorge Ramirez-Ortiz <jorge@foundries.io>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
 common/Kconfig               |  8 ++++++
 common/Makefile              |  1 +
 common/scp03.c               | 53 ++++++++++++++++++++++++++++++++++++
 include/scp03.h              | 21 ++++++++++++++
 include/tee/optee_ta_scp03.h | 21 ++++++++++++++
 5 files changed, 104 insertions(+)
 create mode 100644 common/scp03.c
 create mode 100644 include/scp03.h
 create mode 100644 include/tee/optee_ta_scp03.h

diff --git a/common/Kconfig b/common/Kconfig
index 2bb3798f80..482f123534 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -588,6 +588,14 @@ config AVB_BUF_SIZE
 
 endif # AVB_VERIFY
 
+config SCP03
+	bool "Build SCP03 - Secure Channel Protocol O3 - controls"
+	depends on OPTEE || SANDBOX
+	depends on TEE
+	help
+	  This option allows U-Boot to enable and or provision SCP03 on an OPTEE
+	  controlled Secured Element.
+
 config SPL_HASH
 	bool # "Support hashing API (SHA1, SHA256, etc.)"
 	help
diff --git a/common/Makefile b/common/Makefile
index daeea67cf2..215b8b26fd 100644
--- a/common/Makefile
+++ b/common/Makefile
@@ -137,3 +137,4 @@ obj-$(CONFIG_CMD_LOADB) += xyzModem.o
 obj-$(CONFIG_$(SPL_TPL_)YMODEM_SUPPORT) += xyzModem.o
 
 obj-$(CONFIG_AVB_VERIFY) += avb_verify.o
+obj-$(CONFIG_SCP03) += scp03.o
diff --git a/common/scp03.c b/common/scp03.c
new file mode 100644
index 0000000000..09ef7b5ba3
--- /dev/null
+++ b/common/scp03.c
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * (C) Copyright 2021, Foundries.IO
+ *
+ */
+
+#include <common.h>
+#include <scp03.h>
+#include <tee.h>
+#include <tee/optee_ta_scp03.h>
+
+static int scp03_enable(bool provision)
+{
+	const struct tee_optee_ta_uuid uuid = PTA_SCP03_UUID;
+	struct tee_open_session_arg session;
+	struct tee_invoke_arg invoke;
+	struct tee_param param;
+	struct udevice *tee = NULL;
+
+	tee = tee_find_device(tee, NULL, NULL, NULL);
+	if (!tee)
+		return -ENODEV;
+
+	memset(&session, 0, sizeof(session));
+	tee_optee_ta_uuid_to_octets(session.uuid, &uuid);
+	if (tee_open_session(tee, &session, 0, NULL))
+		return -ENXIO;
+
+	memset(&param, 0, sizeof(param));
+	param.attr = TEE_PARAM_ATTR_TYPE_VALUE_INPUT;
+	param.u.value.a = provision;
+
+	memset(&invoke, 0, sizeof(invoke));
+	invoke.func = PTA_CMD_ENABLE_SCP03;
+	invoke.session = session.session;
+
+	if (tee_invoke_func(tee, &invoke, 1, &param))
+		return -EIO;
+
+	tee_close_session(tee, session.session);
+
+	return 0;
+}
+
+int tee_enable_scp03(void)
+{
+	return scp03_enable(false);
+}
+
+int tee_provision_scp03(void)
+{
+	return scp03_enable(true);
+}
diff --git a/include/scp03.h b/include/scp03.h
new file mode 100644
index 0000000000..729667ccd1
--- /dev/null
+++ b/include/scp03.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0+ */
+/*
+ * (C) Copyright 2021, Foundries.IO
+ *
+ */
+
+#ifndef _SCP03_H
+#define _SCP03_H
+
+/*
+ * Requests to OPTEE to enable or provision the Secure Channel Protocol on its
+ * Secure Element
+ *
+ *  If key provisioning is requested, OPTEE shall generate new SCP03 keys and
+ *  write them to the Secure Element.
+ *
+ *  Both functions return < 0 on error else 0.
+ */
+int tee_enable_scp03(void);
+int tee_provision_scp03(void);
+#endif /* _SCP03_H */
diff --git a/include/tee/optee_ta_scp03.h b/include/tee/optee_ta_scp03.h
new file mode 100644
index 0000000000..13f9956d98
--- /dev/null
+++ b/include/tee/optee_ta_scp03.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: BSD-3-Clause */
+/*
+ * (C) Copyright 2021, Foundries.IO
+ *
+ */
+#ifndef __TA_SCP03_H
+#define __TA_SCP03_H
+
+#define PTA_SCP03_UUID { 0xbe0e5821, 0xe718, 0x4f77, \
+			{ 0xab, 0x3e, 0x8e, 0x6c, 0x73, 0xa9, 0xc7, 0x35 } }
+
+/*
+ * Enable Secure Channel Protocol functionality (SCP03) on the Secure Element.
+ *   Setting the operation value to something different than NULL will trigger
+ *   the SCP03 provisioning request.
+ *
+ *   in	params[0].a = operation
+ */
+#define PTA_CMD_ENABLE_SCP03	0
+
+#endif /*__TA_SCP03_H*/
-- 
2.30.0

^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-03-15 15:52 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2021-02-14 15:18 [PATCHv5 2/6] cmd: SCP03: enable and provision command Jorge Ramirez-Ortiz
2021-02-15 13:13 ` Igor Opaniuk
  -- strict thread matches above, loose matches on Subject: below --
2021-02-14 15:27 [PATCHv5 0/6] SCP03 control, documentation and tests Jorge Ramirez-Ortiz
2021-02-14 15:27 ` [PATCHv5 2/6] cmd: SCP03: enable and provision command Jorge Ramirez-Ortiz
2021-02-15 13:14   ` Igor Opaniuk
2021-03-15 15:52   ` Tom Rini
2021-02-09 20:10 [PATCHv5 1/6] common: SCP03 control (enable and provision of keys) Jorge Ramirez-Ortiz
2021-02-09 20:10 ` [PATCHv5 2/6] cmd: SCP03: enable and provision command Jorge Ramirez-Ortiz

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.