From: Jorge Ramirez-Ortiz via U-Boot <u-boot@lists.u-boot-project.org>
To: jorge.ramirez@oss.qualcomm.com, neil.armstrong@linaro.org,
trini@konsulko.com, jens.wiklander@linaro.org,
ilias.apalodimas@linaro.org, bhupesh.linux@gmail.com,
n-francis@ti.com, marek.vasut+renesas@mailbox.org,
shawn.lin@rock-chips.com, igor.belwon@mentallysanemainliners.org,
yoshihiro.shimoda.uh@renesas.com, alchark@gmail.com,
tuyen.dang.xa@renesas.com, padmarao.begari@amd.com,
macpaul.lin@mediatek.com, jstephan@baylibre.com, bb@ti.com,
j-mcarthur@ti.com, venkyada@qti.qualcomm.com,
hayashi.kunihiko@socionext.com, dlechner@baylibre.com
Cc: u-boot@lists.denx.de
Subject: [PATCH v2 3/5] ufs: derive the per-region RPMB CID and size for OP-TEE
Date: Wed, 22 Jul 2026 08:07:45 +0200 [thread overview]
Message-ID: <20260722060805.1428110-4-jorge.ramirez@oss.qualcomm.com> (raw)
In-Reply-To: <20260722060805.1428110-1-jorge.ramirez@oss.qualcomm.com>
Read the UFS device, unit and geometry descriptors to report each RPMB
region's size and reliable-write count, and build a 16-byte CID by
BLAKE2b-hashing the same device-id string the Linux kernel derives
(ufshcd_create_device_id() plus a "-R<region>" suffix), so OP-TEE derives
an RPMB key that matches Linux. Exposed via ufs_rpmb_get_region_info().
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
---
drivers/ufs/ufs-rpmb.c | 141 +++++++++++++++++++++++++++++++++++++++
drivers/ufs/ufs-uclass.c | 4 +-
drivers/ufs/ufs.h | 2 +
include/ufs.h | 6 ++
4 files changed, 151 insertions(+), 2 deletions(-)
diff --git a/drivers/ufs/ufs-rpmb.c b/drivers/ufs/ufs-rpmb.c
index 5417a4ec0bc..49ecb38816b 100644
--- a/drivers/ufs/ufs-rpmb.c
+++ b/drivers/ufs/ufs-rpmb.c
@@ -1,10 +1,14 @@
// SPDX-License-Identifier: GPL-2.0+
#include <dm.h>
+#include <hexdump.h>
#include <log.h>
#include <malloc.h>
#include <scsi.h>
#include <ufs.h>
+#include <vsprintf.h>
+#include <u-boot/blake2.h>
#include <asm/cache.h>
+#include <asm/unaligned.h>
#include <linux/errno.h>
#include <linux/string.h>
#include "ufs.h"
@@ -25,6 +29,15 @@
#define GEOMETRY_DESC_RPMB_RW_SIZE 0x17
+#define RPMB_UNIT_DESC_LOGICAL_BLK_SIZE 0x0A
+#define RPMB_UNIT_DESC_LOGICAL_BLK_COUNT 0x0B
+#define RPMB_UNIT_DESC_REGION0_SIZE 0x13
+#define RPMB_UNIT_DESC_REGION1_SIZE 0x14
+#define RPMB_UNIT_DESC_REGION2_SIZE 0x15
+#define RPMB_UNIT_DESC_REGION3_SIZE 0x16
+#define UFS_RPMB_LEGACY_SPEC_VER 0x0220
+#define UFS_RPMB_REGION_UNIT_SHIFT 17
+
static u16 rpmb_frame_request(const void *frame)
{
const u8 *p = frame;
@@ -166,3 +179,131 @@ int ufs_rpmb_read_geometry(struct udevice *scsi_dev, u8 *rpmb_rw_size)
*rpmb_rw_size = desc[GEOMETRY_DESC_RPMB_RW_SIZE];
return 0;
}
+
+static int ufs_rpmb_read_region_sizes(struct ufs_hba *hba, u16 spec_ver,
+ u8 sizes[UFS_RPMB_NUM_REGIONS])
+{
+ u8 unit[QUERY_DESC_UNIT_DEF_SIZE] = { };
+ int ret;
+
+ ret = ufshcd_read_desc_param(hba, QUERY_DESC_IDN_UNIT,
+ UFS_UPIU_RPMB_WLUN, 0, unit, sizeof(unit));
+ if (ret)
+ return ret;
+
+ memset(sizes, 0, UFS_RPMB_NUM_REGIONS);
+
+ if (spec_ver > UFS_RPMB_LEGACY_SPEC_VER) {
+ sizes[0] = unit[RPMB_UNIT_DESC_REGION0_SIZE];
+ sizes[1] = unit[RPMB_UNIT_DESC_REGION1_SIZE];
+ sizes[2] = unit[RPMB_UNIT_DESC_REGION2_SIZE];
+ sizes[3] = unit[RPMB_UNIT_DESC_REGION3_SIZE];
+ } else {
+ u64 region = (get_unaligned_be64(unit +
+ RPMB_UNIT_DESC_LOGICAL_BLK_COUNT)
+ << unit[RPMB_UNIT_DESC_LOGICAL_BLK_SIZE])
+ >> UFS_RPMB_REGION_UNIT_SHIFT;
+
+ sizes[0] = region > 0xff ? 0xff : region;
+ }
+
+ return 0;
+}
+
+static void ufs_rpmb_string_to_ascii(const u8 *raw, char *out, size_t outsz)
+{
+ int nchars = ((int)raw[QUERY_DESC_LENGTH_OFFSET] - QUERY_DESC_HDR_SIZE);
+ int i, n = 0;
+
+ nchars = nchars > 0 ? nchars / 2 : 0;
+ for (i = 0; i < nchars && n < (int)outsz - 1; i++) {
+ u16 c = get_unaligned_be16(raw + QUERY_DESC_HDR_SIZE + i * 2);
+
+ out[n++] = (c >= 0x20 && c <= 0x7e) ? (char)c : ' ';
+ }
+ out[n] = '\0';
+}
+
+static int ufs_rpmb_build_cid(struct ufs_hba *hba, const u8 *dev_desc,
+ unsigned int region, u8 *cid)
+{
+ u8 raw[QUERY_DESC_MAX_SIZE];
+ char model[MAX_MODEL_LEN * 8];
+ char serial_hex[QUERY_DESC_MAX_SIZE * 2 + 1];
+ char idstr[QUERY_DESC_MAX_SIZE * 3];
+ u8 serial[QUERY_DESC_MAX_SIZE] = { };
+ u16 manf_id, spec_ver, dev_ver, manf_date;
+ u8 blen;
+ int ret;
+
+ manf_id = get_unaligned_be16(dev_desc + DEVICE_DESC_PARAM_MANF_ID);
+ spec_ver = get_unaligned_be16(dev_desc + DEVICE_DESC_PARAM_SPEC_VER);
+ dev_ver = get_unaligned_be16(dev_desc + DEVICE_DESC_PARAM_DEV_VER);
+ manf_date = get_unaligned_be16(dev_desc + DEVICE_DESC_PARAM_MANF_DATE);
+
+ ret = ufshcd_read_desc_param(hba, QUERY_DESC_IDN_STRING,
+ dev_desc[DEVICE_DESC_PARAM_PRDCT_NAME], 0,
+ raw, sizeof(raw));
+ if (ret)
+ return ret;
+ ufs_rpmb_string_to_ascii(raw, model, sizeof(model));
+
+ ret = ufshcd_read_desc_param(hba, QUERY_DESC_IDN_STRING,
+ dev_desc[DEVICE_DESC_PARAM_SN], 0,
+ raw, sizeof(raw));
+ if (ret)
+ return ret;
+ blen = raw[QUERY_DESC_LENGTH_OFFSET];
+ if (blen < QUERY_DESC_HDR_SIZE)
+ return -EINVAL;
+ memcpy(serial, raw + QUERY_DESC_HDR_SIZE, blen - QUERY_DESC_HDR_SIZE);
+ bin2hex(serial_hex, serial, blen);
+ serial_hex[blen * 2] = '\0';
+
+ snprintf(idstr, sizeof(idstr), "%04X-%04X-%s-%s-%04X-%04X-R%u",
+ manf_id, spec_ver, model, serial_hex, dev_ver, manf_date,
+ region);
+
+ if (blake2b(cid, UFS_RPMB_CID_SIZE, idstr, strlen(idstr), NULL, 0))
+ return -EIO;
+
+ return 0;
+}
+
+int ufs_rpmb_get_region_info(struct udevice *scsi_dev, unsigned int region,
+ u8 *size_mult, u8 *rel_wr, u8 *cid)
+{
+ struct ufs_hba *hba = dev_get_uclass_priv(scsi_dev->parent);
+ u8 dev_desc[QUERY_DESC_DEVICE_DEF_SIZE] = { };
+ u8 sizes[UFS_RPMB_NUM_REGIONS];
+ u16 spec_ver;
+ int ret;
+
+ if (region >= UFS_RPMB_NUM_REGIONS)
+ return 0;
+
+ ret = ufshcd_read_desc_param(hba, QUERY_DESC_IDN_DEVICE, 0, 0,
+ dev_desc, sizeof(dev_desc));
+ if (ret)
+ return ret;
+ spec_ver = get_unaligned_be16(dev_desc + DEVICE_DESC_PARAM_SPEC_VER);
+
+ ret = ufs_rpmb_read_region_sizes(hba, spec_ver, sizes);
+ if (ret)
+ return ret;
+ if (!sizes[region])
+ return 0;
+
+ ret = ufs_rpmb_read_geometry(scsi_dev, rel_wr);
+ if (ret)
+ return ret;
+ if (!*rel_wr)
+ *rel_wr = 1;
+
+ ret = ufs_rpmb_build_cid(hba, dev_desc, region, cid);
+ if (ret)
+ return ret;
+
+ *size_mult = sizes[region];
+ return 1;
+}
diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c
index e320a6dcfbc..3a0bcd287ea 100644
--- a/drivers/ufs/ufs-uclass.c
+++ b/drivers/ufs/ufs-uclass.c
@@ -1801,8 +1801,8 @@ out:
return err;
}
-static int ufs_get_device_desc(struct ufs_hba *hba,
- struct ufs_dev_desc *dev_desc)
+int ufs_get_device_desc(struct ufs_hba *hba,
+ struct ufs_dev_desc *dev_desc)
{
int err;
size_t buff_len;
diff --git a/drivers/ufs/ufs.h b/drivers/ufs/ufs.h
index 9f55735602b..5dae8dbef72 100644
--- a/drivers/ufs/ufs.h
+++ b/drivers/ufs/ufs.h
@@ -816,4 +816,6 @@ int ufshcd_read_desc_param(struct ufs_hba *hba, enum desc_idn desc_id,
int desc_index, u8 param_offset, u8 *param_read_buf,
u8 param_size);
+int ufs_get_device_desc(struct ufs_hba *hba, struct ufs_dev_desc *dev_desc);
+
#endif
diff --git a/include/ufs.h b/include/ufs.h
index f2e46bc5fbf..8cdd4724d66 100644
--- a/include/ufs.h
+++ b/include/ufs.h
@@ -20,10 +20,16 @@ int ufs_probe(void);
*/
int ufs_probe_dev(int index);
+#define UFS_RPMB_CID_SIZE 16
+#define UFS_RPMB_NUM_REGIONS 4
+
int ufs_rpmb_route_frames(struct udevice *scsi_dev, unsigned int region,
void *req, unsigned long reqlen, void *rsp,
unsigned long rsplen);
+int ufs_rpmb_get_region_info(struct udevice *scsi_dev, unsigned int region,
+ u8 *size_mult, u8 *rel_wr, u8 *cid);
+
int ufs_rpmb_read_geometry(struct udevice *scsi_dev, u8 *rpmb_rw_size);
#endif
--
2.54.0
next prev parent reply other threads:[~2026-07-22 6:08 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-22 6:07 [PATCH v2 0/5] ufs: rpmb: route OP-TEE RPMB secure storage over UFS Jorge Ramirez-Ortiz via U-Boot
2026-07-22 6:07 ` [PATCH v2 1/5] ufs: decode string descriptors as UTF-16 big-endian Jorge Ramirez-Ortiz via U-Boot
2026-07-22 6:07 ` [PATCH v2 2/5] ufs: add RPMB transport over SCSI SECURITY PROTOCOL Jorge Ramirez-Ortiz via U-Boot
2026-07-22 6:07 ` Jorge Ramirez-Ortiz via U-Boot [this message]
2026-07-22 8:33 ` [PATCH v2 3/5] ufs: derive the per-region RPMB CID and size for OP-TEE Neil Armstrong (Linaro) via U-Boot
2026-07-22 9:47 ` Jorge Ramirez via U-Boot
2026-07-22 6:07 ` [PATCH v2 4/5] optee: rename rpmb.c to rpmb_legacy.c Jorge Ramirez-Ortiz via U-Boot
2026-07-22 8:27 ` Neil Armstrong (Linaro) via U-Boot
2026-07-22 9:46 ` Jorge Ramirez via U-Boot
2026-07-22 12:23 ` Jorge Ramirez via U-Boot
2026-07-22 12:33 ` Peter Robinson via U-Boot
2026-07-22 13:10 ` Neil Armstrong via U-Boot
2026-07-22 14:35 ` Jorge Ramirez via U-Boot
2026-07-23 8:48 ` Neil Armstrong
2026-07-22 6:07 ` [PATCH v2 5/5] optee: implement the RPMB subsystem interface for UFS Jorge Ramirez-Ortiz via U-Boot
2026-07-22 8:31 ` Neil Armstrong (Linaro) via U-Boot
2026-07-22 14:12 ` Jorge Ramirez via U-Boot
2026-07-22 15:43 ` Neil Armstrong via U-Boot
2026-07-22 18:12 ` Jorge Ramirez via U-Boot
2026-07-22 18:44 ` Jorge Ramirez via U-Boot
2026-07-23 7:33 ` Neil Armstrong
2026-07-23 8:01 ` Jorge Ramirez via U-Boot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260722060805.1428110-4-jorge.ramirez@oss.qualcomm.com \
--to=u-boot@lists.u-boot-project.org \
--cc=alchark@gmail.com \
--cc=bb@ti.com \
--cc=bhupesh.linux@gmail.com \
--cc=dlechner@baylibre.com \
--cc=hayashi.kunihiko@socionext.com \
--cc=igor.belwon@mentallysanemainliners.org \
--cc=ilias.apalodimas@linaro.org \
--cc=j-mcarthur@ti.com \
--cc=jens.wiklander@linaro.org \
--cc=jorge.ramirez@oss.qualcomm.com \
--cc=jstephan@baylibre.com \
--cc=macpaul.lin@mediatek.com \
--cc=marek.vasut+renesas@mailbox.org \
--cc=n-francis@ti.com \
--cc=neil.armstrong@linaro.org \
--cc=padmarao.begari@amd.com \
--cc=shawn.lin@rock-chips.com \
--cc=trini@konsulko.com \
--cc=tuyen.dang.xa@renesas.com \
--cc=u-boot@lists.denx.de \
--cc=venkyada@qti.qualcomm.com \
--cc=yoshihiro.shimoda.uh@renesas.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.