target/linux/layerscape/patches-5.4/810-keys-0001-security-keys-secure_key-Adds-the-secure-key-support.patch

   1 From 808871b2943a386165614daf2e7f5fb5b33e9fd1 Mon Sep 17 00:00:00 2001
   2 From: Udit Agarwal <udit.agarwal@nxp.com>
   3 Date: Wed, 4 Jul 2018 09:51:59 +0530
   4 Subject: [PATCH] security/keys/secure_key: Adds the secure key support based
   5  on CAAM.
   6
   7 Secure keys are derieved using CAAM crypto block.
   8
   9 Secure keys derieved are the random number symmetric keys from CAAM.
  10 Blobs corresponding to the key are formed using CAAM. User space
  11 will only be able to view the blob of the key.
  12
  13 Signed-off-by: Udit Agarwal <udit.agarwal@nxp.com>
  14 Reviewed-by: Sahil Malhotra <sahil.malhotra@nxp.com>
  15 ---
  16  Documentation/security/keys/secure-key.rst |  67 ++++
  17  MAINTAINERS                                |  11 +
  18  include/keys/secure-type.h                 |  33 ++
  19  security/keys/Kconfig                      |  11 +
  20  security/keys/Makefile                     |   5 +
  21  security/keys/secure_key.c                 | 339 ++++++++++++++++
  22  security/keys/securekey_desc.c             | 608 +++++++++++++++++++++++++++++
  23  security/keys/securekey_desc.h             | 141 +++++++
  24  8 files changed, 1215 insertions(+)
  25  create mode 100644 Documentation/security/keys/secure-key.rst
  26  create mode 100644 include/keys/secure-type.h
  27  create mode 100644 security/keys/secure_key.c
  28  create mode 100644 security/keys/securekey_desc.c
  29  create mode 100644 security/keys/securekey_desc.h
  30
  31 --- /dev/null
  32 +++ b/Documentation/security/keys/secure-key.rst
  33 @@ -0,0 +1,67 @@
  34 +==========
  35 +Secure Key
  36 +==========
  37 +
  38 +Secure key is the new type added to kernel key ring service.
  39 +Secure key is a symmetric type key of minimum length 32 bytes
  40 +and with maximum possible length to be 128 bytes. It is produced
  41 +in kernel using the CAAM crypto engine. Userspace can only see
  42 +the blob for the corresponding key. All the blobs are displayed
  43 +or loaded in hex ascii.
  44 +
  45 +Secure key can be created on platforms which supports CAAM
  46 +hardware block. Secure key can also be used as a master key to
  47 +create the encrypted keys along with the existing key types in
  48 +kernel.
  49 +
  50 +Secure key uses CAAM hardware to generate the key and blobify its
  51 +content for userspace. Generated blobs are tied up with the hardware
  52 +secret key stored in CAAM, hence the same blob will not be able to
  53 +de-blobify with the different secret key on another machine.
  54 +
  55 +Usage::
  56 +
  57 +       keyctl add secure <name> "new <keylen>" <ring>
  58 +       keyctl load secure <name> "load <hex_blob>" <ring>
  59 +       keyctl print <key_id>
  60 +
  61 +"keyctl add secure" option will create the random data of the
  62 +specified key len using CAAM and store it as a key in kernel.
  63 +Key contents will be displayed as blobs to the user in hex ascii.
  64 +User can input key len from 32 bytes to 128 bytes.
  65 +
  66 +"keyctl load secure" option will load the blob contents. In kernel,
  67 +key will be deirved using input blob and CAAM, along with the secret
  68 +key stored in CAAM.
  69 +
  70 +"keyctl print" will return the hex string of the blob corresponding to
  71 +key_id. Returned blob will be of key_len + 48 bytes. Extra 48 bytes are
  72 +the header bytes added by the CAAM.
  73 +
  74 +Example of secure key usage::
  75 +
  76 +1. Create the secure key with name kmk-master of length 32 bytes::
  77 +
  78 +       $ keyctl add secure kmk-master "new 32" @u
  79 +       46001928
  80 +
  81 +       $keyctl show
  82 +       Session Keyring
  83 +       1030783626 --alswrv      0 65534  keyring: _uid_ses.0
  84 +        695927745 --alswrv      0 65534   \_ keyring: _uid.0
  85 +         46001928 --als-rv      0     0       \_ secure: kmk-master
  86 +
  87 +2. Print the blob contents for the kmk-master key::
  88 +
  89 +       $ keyctl print 46001928
  90 +       d9743445b640f3d59c1670dddc0bc9c2
  91 +       34fc9aab7dd05c965e6120025012f029b
  92 +       07faa4776c4f6ed02899e35a135531e9a
  93 +       6e5c2b51132f9d5aef28f68738e658296
  94 +       3fe583177cfe50d2542b659a13039
  95 +
  96 +       $ keyctl pipe 46001928 > secure_key.blob
  97 +
  98 +3. Load the blob in the user key ring::
  99 +
 100 +       $ keyctl load secure kmk-master "load 'cat secure_key.blob'" @u
 101 --- a/MAINTAINERS
 102 +++ b/MAINTAINERS
 103 @@ -9074,6 +9074,17 @@ F:       include/keys/trusted-type.h
 104  F:     security/keys/trusted.c
 105  F:     include/keys/trusted.h
 106
 107 +KEYS-SECURE
 108 +M:     Udit Agarwal <udit.agarwal@nxp.com>
 109 +R:     Sahil Malhotra <sahil.malhotra@nxp.com>
 110 +L:     linux-security-module@vger.kernel.org
 111 +L:     keyrings@vger.kernel.org
 112 +S:     Supported
 113 +F:     include/keys/secure-type.h
 114 +F:     security/keys/secure_key.c
 115 +F:     security/keys/securekey_desc.c
 116 +F:     security/keys/securekey_desc.h
 117 +
 118  KEYS/KEYRINGS:
 119  M:     David Howells <dhowells@redhat.com>
 120  M:     Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
 121 --- /dev/null
 122 +++ b/include/keys/secure-type.h
 123 @@ -0,0 +1,33 @@
 124 +/* SPDX-License-Identifier: GPL-2.0 */
 125 +/*
 126 + * Copyright (C) 2018 NXP.
 127 + *
 128 + */
 129 +
 130 +#ifndef _KEYS_SECURE_TYPE_H
 131 +#define _KEYS_SECURE_TYPE_H
 132 +
 133 +#include <linux/key.h>
 134 +#include <linux/rcupdate.h>
 135 +
 136 +/* Minimum key size to be used is 32 bytes and maximum key size fixed
 137 + * is 128 bytes.
 138 + * Blob size to be kept is Maximum key size + blob header added by CAAM.
 139 + */
 140 +
 141 +#define MIN_KEY_SIZE                    32
 142 +#define MAX_KEY_SIZE                    128
 143 +#define BLOB_HEADER_SIZE               48
 144 +
 145 +#define MAX_BLOB_SIZE                   (MAX_KEY_SIZE + BLOB_HEADER_SIZE)
 146 +
 147 +struct secure_key_payload {
 148 +       struct rcu_head rcu;
 149 +       unsigned int key_len;
 150 +       unsigned int blob_len;
 151 +       unsigned char key[MAX_KEY_SIZE + 1];
 152 +       unsigned char blob[MAX_BLOB_SIZE];
 153 +};
 154 +
 155 +extern struct key_type key_type_secure;
 156 +#endif
 157 --- a/security/keys/Kconfig
 158 +++ b/security/keys/Kconfig
 159 @@ -90,6 +90,17 @@ config TRUSTED_KEYS
 160
 161           If you are unsure as to whether this is required, answer N.
 162
 163 +config SECURE_KEYS
 164 +       tristate "SECURE_KEYS"
 165 +       depends on KEYS && CRYPTO_DEV_FSL_CAAM && CRYPTO_DEV_FSL_CAAM_JR
 166 +       help
 167 +         This option provide support for creating secure-type key and blobs
 168 +         in kernel. Secure keys are random number symmetric keys generated
 169 +         from CAAM. The CAAM creates the blobs for the random key.
 170 +         Userspace will only be able to see the blob.
 171 +
 172 +         If you are unsure as to whether this is required, answer N.
 173 +
 174  config ENCRYPTED_KEYS
 175         tristate "ENCRYPTED KEYS"
 176         depends on KEYS
 177 --- a/security/keys/Makefile
 178 +++ b/security/keys/Makefile
 179 @@ -29,4 +29,9 @@ obj-$(CONFIG_ASYMMETRIC_KEY_TYPE) += key
 180  #
 181  obj-$(CONFIG_BIG_KEYS) += big_key.o
 182  obj-$(CONFIG_TRUSTED_KEYS) += trusted.o
 183 +CFLAGS_secure_key.o += -I$(obj)/../../drivers/crypto/caam/
 184 +CFLAGS_securekey_desc.o += -I$(obj)/../../drivers/crypto/caam/
 185 +obj-$(CONFIG_SECURE_KEYS) += securekey.o
 186 +securekey-y := securekey_desc.o \
 187 +              secure_key.o
 188  obj-$(CONFIG_ENCRYPTED_KEYS) += encrypted-keys/
 189 --- /dev/null
 190 +++ b/security/keys/secure_key.c
 191 @@ -0,0 +1,339 @@
 192 +// SPDX-License-Identifier: GPL-2.0
 193 +/* Copyright (C) 2018 NXP
 194 + * Secure key is generated using NXP CAAM hardware block. CAAM generates the
 195 + * random number (used as a key) and creates its blob for the user.
 196 + */
 197 +
 198 +#include <linux/slab.h>
 199 +#include <linux/parser.h>
 200 +#include <linux/string.h>
 201 +#include <linux/key-type.h>
 202 +#include <linux/rcupdate.h>
 203 +#include <keys/secure-type.h>
 204 +#include <linux/completion.h>
 205 +
 206 +#include "securekey_desc.h"
 207 +
 208 +static const char hmac_alg[] = "hmac(sha1)";
 209 +static const char hash_alg[] = "sha1";
 210 +
 211 +static struct crypto_shash *hashalg;
 212 +static struct crypto_shash *hmacalg;
 213 +
 214 +enum {
 215 +       error = -1,
 216 +       new_key,
 217 +       load_blob,
 218 +};
 219 +
 220 +static const match_table_t key_tokens = {
 221 +       {new_key, "new"},
 222 +       {load_blob, "load"},
 223 +       {error, NULL}
 224 +};
 225 +
 226 +static struct secure_key_payload *secure_payload_alloc(struct key *key)
 227 +{
 228 +       struct secure_key_payload *sec_key = NULL;
 229 +       int ret = 0;
 230 +
 231 +       ret = key_payload_reserve(key, sizeof(*sec_key));
 232 +       if (ret < 0)
 233 +               goto out;
 234 +
 235 +       sec_key = kzalloc(sizeof(*sec_key), GFP_KERNEL);
 236 +       if (!sec_key)
 237 +               goto out;
 238 +
 239 +out:
 240 +       return sec_key;
 241 +}
 242 +
 243 +/*
 244 + * parse_inputdata - parse the keyctl input data and fill in the
 245 + *                  payload structure for key or its blob.
 246 + * param[in]: data pointer to the data to be parsed for creating key.
 247 + * param[in]: p pointer to secure key payload structure to fill parsed data
 248 + * On success returns 0, otherwise -EINVAL.
 249 + */
 250 +static int parse_inputdata(char *data, struct secure_key_payload *p)
 251 +{
 252 +       substring_t args[MAX_OPT_ARGS];
 253 +       long keylen = 0;
 254 +       int ret = -EINVAL;
 255 +       int key_cmd = -EINVAL;
 256 +       char *c = NULL;
 257 +
 258 +       c = strsep(&data, " \t");
 259 +       if (!c) {
 260 +               ret = -EINVAL;
 261 +               goto out;
 262 +       }
 263 +
 264 +       /* Get the keyctl command i.e. new_key or load_blob etc */
 265 +       key_cmd = match_token(c, key_tokens, args);
 266 +
 267 +       switch (key_cmd) {
 268 +       case new_key:
 269 +               /* first argument is key size */
 270 +               c = strsep(&data, " \t");
 271 +               if (!c) {
 272 +                       ret = -EINVAL;
 273 +                       goto out;
 274 +               }
 275 +
 276 +               ret = kstrtol(c, 10, &keylen);
 277 +               if (ret < 0 || keylen < MIN_KEY_SIZE ||
 278 +                                               keylen > MAX_KEY_SIZE) {
 279 +                       ret = -EINVAL;
 280 +                       goto out;
 281 +               }
 282 +
 283 +               p->key_len = keylen;
 284 +               ret = new_key;
 285 +
 286 +               break;
 287 +       case load_blob:
 288 +               /* first argument is blob data for CAAM*/
 289 +               c = strsep(&data, " \t");
 290 +               if (!c) {
 291 +                       ret = -EINVAL;
 292 +                       goto out;
 293 +               }
 294 +
 295 +               /* Blob_len = No of characters in blob/2 */
 296 +               p->blob_len = strlen(c) / 2;
 297 +               if (p->blob_len > MAX_BLOB_SIZE) {
 298 +                       ret = -EINVAL;
 299 +                       goto out;
 300 +               }
 301 +
 302 +               ret = hex2bin(p->blob, c, p->blob_len);
 303 +               if (ret < 0) {
 304 +                       ret = -EINVAL;
 305 +                       goto out;
 306 +               }
 307 +               ret = load_blob;
 308 +
 309 +               break;
 310 +       case error:
 311 +               ret = -EINVAL;
 312 +               break;
 313 +       }
 314 +
 315 +out:
 316 +       return ret;
 317 +}
 318 +
 319 +/*
 320 + * secure_instantiate - create a new secure type key.
 321 + * Supports the operation to generate a new key. A random number
 322 + * is generated from CAAM as key data and the corresponding red blob
 323 + * is formed and stored as key_blob.
 324 + * Also supports the operation to load the blob and key is derived using
 325 + * that blob from CAAM.
 326 + * On success, return 0. Otherwise return errno.
 327 + */
 328 +static int secure_instantiate(struct key *key,
 329 +               struct key_preparsed_payload *prep)
 330 +{
 331 +       struct secure_key_payload *payload = NULL;
 332 +       size_t datalen = prep->datalen;
 333 +       char *data = NULL;
 334 +       int key_cmd = 0;
 335 +       int ret = 0;
 336 +       enum sk_req_type sk_op_type;
 337 +       struct device *dev = NULL;
 338 +
 339 +       if (datalen <= 0 || datalen > 32767 || !prep->data) {
 340 +               ret = -EINVAL;
 341 +               goto out;
 342 +       }
 343 +
 344 +       data = kmalloc(datalen + 1, GFP_KERNEL);
 345 +       if (!data) {
 346 +               ret = -ENOMEM;
 347 +               goto out;
 348 +       }
 349 +
 350 +       memcpy(data, prep->data, datalen);
 351 +       data[datalen] = '\0';
 352 +
 353 +       payload = secure_payload_alloc(key);
 354 +       if (!payload) {
 355 +               ret = -ENOMEM;
 356 +               goto out;
 357 +       }
 358 +
 359 +       /* Allocate caam job ring for operation to be performed from CAAM */
 360 +       dev = caam_jr_alloc();
 361 +       if (!dev) {
 362 +               pr_info("caam_jr_alloc failed\n");
 363 +               ret = -ENODEV;
 364 +               goto out;
 365 +       }
 366 +
 367 +       key_cmd = parse_inputdata(data, payload);
 368 +       if (key_cmd < 0) {
 369 +               ret = key_cmd;
 370 +               goto out;
 371 +       }
 372 +
 373 +       switch (key_cmd) {
 374 +       case load_blob:
 375 +               /*
 376 +                * Red blob decryption to be done for load operation
 377 +                * to derive the key.
 378 +                */
 379 +               sk_op_type = sk_red_blob_dec;
 380 +               ret = key_deblob(payload, sk_op_type, dev);
 381 +               if (ret != 0) {
 382 +                       pr_info("secure_key: key_blob decap fail (%d)\n", ret);
 383 +                       goto out;
 384 +               }
 385 +               break;
 386 +       case new_key:
 387 +               /* Get Random number from caam of the specified length */
 388 +               sk_op_type = sk_get_random;
 389 +               ret = caam_get_random(payload, sk_op_type, dev);
 390 +               if (ret != 0) {
 391 +                       pr_info("secure_key: get_random fail (%d)\n", ret);
 392 +                       goto out;
 393 +               }
 394 +
 395 +               /* Generate red blob of key random bytes with CAAM */
 396 +               sk_op_type = sk_red_blob_enc;
 397 +               ret = key_blob(payload, sk_op_type, dev);
 398 +               if (ret != 0) {
 399 +                       pr_info("secure_key: key_blob encap fail (%d)\n", ret);
 400 +                       goto out;
 401 +               }
 402 +               break;
 403 +       default:
 404 +               ret = -EINVAL;
 405 +               goto out;
 406 +       }
 407 +out:
 408 +       if (data)
 409 +               kzfree(data);
 410 +       if (dev)
 411 +               caam_jr_free(dev);
 412 +
 413 +       if (!ret)
 414 +               rcu_assign_keypointer(key, payload);
 415 +       else
 416 +               kzfree(payload);
 417 +
 418 +       return ret;
 419 +}
 420 +
 421 +/*
 422 + * secure_read - copy the  blob data to userspace in hex.
 423 + * param[in]: key pointer to key struct
 424 + * param[in]: buffer pointer to user data for creating key
 425 + * param[in]: buflen is the length of the buffer
 426 + * On success, return to userspace the secure key data size.
 427 + */
 428 +static long secure_read(const struct key *key, char __user *buffer,
 429 +                        size_t buflen)
 430 +{
 431 +       const struct secure_key_payload *p = NULL;
 432 +       char *ascii_buf;
 433 +       char *bufp;
 434 +       int i;
 435 +
 436 +       p = dereference_key_locked(key);
 437 +       if (!p)
 438 +               return -EINVAL;
 439 +
 440 +       if (buffer && buflen >= 2 * p->blob_len) {
 441 +               ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
 442 +               if (!ascii_buf)
 443 +                       return -ENOMEM;
 444 +
 445 +               bufp = ascii_buf;
 446 +               for (i = 0; i < p->blob_len; i++)
 447 +                       bufp = hex_byte_pack(bufp, p->blob[i]);
 448 +               if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
 449 +                       kzfree(ascii_buf);
 450 +                       return -EFAULT;
 451 +               }
 452 +               kzfree(ascii_buf);
 453 +       }
 454 +       return 2 * p->blob_len;
 455 +}
 456 +
 457 +/*
 458 + * secure_destroy - clear and free the key's payload
 459 + */
 460 +static void secure_destroy(struct key *key)
 461 +{
 462 +       kzfree(key->payload.data[0]);
 463 +}
 464 +
 465 +struct key_type key_type_secure = {
 466 +       .name = "secure",
 467 +       .instantiate = secure_instantiate,
 468 +       .destroy = secure_destroy,
 469 +       .read = secure_read,
 470 +};
 471 +EXPORT_SYMBOL_GPL(key_type_secure);
 472 +
 473 +static void secure_shash_release(void)
 474 +{
 475 +       if (hashalg)
 476 +               crypto_free_shash(hashalg);
 477 +       if (hmacalg)
 478 +               crypto_free_shash(hmacalg);
 479 +}
 480 +
 481 +static int __init secure_shash_alloc(void)
 482 +{
 483 +       int ret;
 484 +
 485 +       hmacalg = crypto_alloc_shash(hmac_alg, 0, CRYPTO_ALG_ASYNC);
 486 +       if (IS_ERR(hmacalg)) {
 487 +               pr_info("secure_key: could not allocate crypto %s\n",
 488 +                               hmac_alg);
 489 +               return PTR_ERR(hmacalg);
 490 +       }
 491 +
 492 +       hashalg = crypto_alloc_shash(hash_alg, 0, CRYPTO_ALG_ASYNC);
 493 +       if (IS_ERR(hashalg)) {
 494 +               pr_info("secure_key: could not allocate crypto %s\n",
 495 +                               hash_alg);
 496 +               ret = PTR_ERR(hashalg);
 497 +               goto hashalg_fail;
 498 +       }
 499 +
 500 +       return 0;
 501 +
 502 +hashalg_fail:
 503 +       crypto_free_shash(hmacalg);
 504 +       return ret;
 505 +}
 506 +
 507 +static int __init init_secure_key(void)
 508 +{
 509 +       int ret;
 510 +
 511 +       ret = secure_shash_alloc();
 512 +       if (ret < 0)
 513 +               return ret;
 514 +
 515 +       ret = register_key_type(&key_type_secure);
 516 +       if (ret < 0)
 517 +               secure_shash_release();
 518 +       return ret;
 519 +}
 520 +
 521 +static void __exit cleanup_secure_key(void)
 522 +{
 523 +       secure_shash_release();
 524 +       unregister_key_type(&key_type_secure);
 525 +}
 526 +
 527 +late_initcall(init_secure_key);
 528 +module_exit(cleanup_secure_key);
 529 +
 530 +MODULE_LICENSE("GPL");
 531 --- /dev/null
 532 +++ b/security/keys/securekey_desc.c
 533 @@ -0,0 +1,608 @@
 534 +// SPDX-License-Identifier: GPL-2.0
 535 +/*
 536 + * Copyright (C) 2018 NXP
 537 + *
 538 + */
 539 +
 540 +#include <keys/secure-type.h>
 541 +#include "securekey_desc.h"
 542 +
 543 +/* key modifier for blob encapsulation & decapsulation descriptor */
 544 +u8 key_modifier[] = "SECURE_KEY";
 545 +u32 key_modifier_len = 10;
 546 +
 547 +void caam_sk_rng_desc(struct sk_req *skreq, struct sk_desc *skdesc)
 548 +{
 549 +       struct sk_fetch_rnd_data *fetch_rnd_data = NULL;
 550 +       struct random_desc *rnd_desc = NULL;
 551 +       size_t len = 0;
 552 +       u32 *desc = skreq->hwdesc;
 553 +
 554 +       init_job_desc(desc, 0);
 555 +
 556 +       fetch_rnd_data = &skreq->req_u.sk_fetch_rnd_data;
 557 +       rnd_desc = &skdesc->dma_u.random_descp;
 558 +       len = fetch_rnd_data->key_len;
 559 +
 560 +       /* command 0x82500000 */
 561 +       append_cmd(desc, CMD_OPERATION | OP_TYPE_CLASS1_ALG |
 562 +                       OP_ALG_ALGSEL_RNG);
 563 +       /* command 0x60340000 | len */
 564 +       append_cmd(desc, CMD_FIFO_STORE | FIFOST_TYPE_RNGSTORE | len);
 565 +       append_ptr(desc, rnd_desc->rnd_data);
 566 +}
 567 +
 568 +void caam_sk_redblob_encap_desc(struct sk_req *skreq, struct sk_desc *skdesc)
 569 +{
 570 +       struct redblob_encap_desc *red_blob_desc =
 571 +                                       &skdesc->dma_u.redblob_encapdesc;
 572 +       struct sk_red_blob_encap *red_blob_req =
 573 +                                       &skreq->req_u.sk_red_blob_encap;
 574 +       u32 *desc = skreq->hwdesc;
 575 +
 576 +       init_job_desc(desc, 0);
 577 +
 578 +       /* Load class 2 key with key modifier. */
 579 +       append_key_as_imm(desc, key_modifier, key_modifier_len,
 580 +                         key_modifier_len, CLASS_2 | KEY_DEST_CLASS_REG);
 581 +
 582 +       /* SEQ IN PTR Command. */
 583 +       append_seq_in_ptr(desc, red_blob_desc->in_data, red_blob_req->data_sz,
 584 +                         0);
 585 +
 586 +       /* SEQ OUT PTR Command. */
 587 +       append_seq_out_ptr(desc, red_blob_desc->redblob,
 588 +                          red_blob_req->redblob_sz, 0);
 589 +
 590 +       /* RedBlob encapsulation PROTOCOL Command. */
 591 +       append_operation(desc, OP_TYPE_ENCAP_PROTOCOL | OP_PCLID_BLOB);
 592 +}
 593 +
 594 +/* void caam_sk_redblob_decap_desc(struct sk_req *skreq, struct sk_desc *skdesc)
 595 + * brief CAAM Descriptor creator from redblob to plaindata.
 596 + * param[in] skreq Pointer to secure key request structure
 597 + * param[in] skdesc Pointer to secure key descriptor structure
 598 + */
 599 +void caam_sk_redblob_decap_desc(struct sk_req *skreq, struct sk_desc *skdesc)
 600 +{
 601 +       struct redblob_decap_desc *red_blob_desc =
 602 +                                       &skdesc->dma_u.redblob_decapdesc;
 603 +       struct sk_red_blob_decap *red_blob_req =
 604 +                                       &skreq->req_u.sk_red_blob_decap;
 605 +       u32 *desc = skreq->hwdesc;
 606 +
 607 +       init_job_desc(desc, 0);
 608 +
 609 +       /* Load class 2 key with key modifier. */
 610 +       append_key_as_imm(desc, key_modifier, key_modifier_len,
 611 +                         key_modifier_len, CLASS_2 | KEY_DEST_CLASS_REG);
 612 +
 613 +       /* SEQ IN PTR Command. */
 614 +       append_seq_in_ptr(desc, red_blob_desc->redblob,
 615 +                         red_blob_req->redblob_sz, 0);
 616 +
 617 +       /* SEQ OUT PTR Command. */
 618 +       append_seq_out_ptr(desc, red_blob_desc->out_data,
 619 +                          red_blob_req->data_sz, 0);
 620 +
 621 +       /* RedBlob decapsulation PROTOCOL Command. */
 622 +       append_operation(desc, OP_TYPE_DECAP_PROTOCOL | OP_PCLID_BLOB);
 623 +}
 624 +
 625 +/* int caam_sk_get_random_map(struct device *dev, struct sk_req *req,
 626 + *                           struct sk_desc *skdesc)
 627 + * brief DMA map the buffer virtual pointers to physical address.
 628 + * param[in] dev Pointer to job ring device structure
 629 + * param[in] req Pointer to secure key request structure
 630 + * param[in] skdesc Pointer to secure key descriptor structure
 631 + * return 0 on success, error value otherwise.
 632 + */
 633 +int caam_sk_get_random_map(struct device *dev, struct sk_req *req,
 634 +                          struct sk_desc *skdesc)
 635 +{
 636 +       struct sk_fetch_rnd_data *fetch_rnd_data;
 637 +       struct random_desc *rnd_desc;
 638 +
 639 +       fetch_rnd_data = &req->req_u.sk_fetch_rnd_data;
 640 +       rnd_desc = &skdesc->dma_u.random_descp;
 641 +
 642 +       rnd_desc->rnd_data = dma_map_single(dev, fetch_rnd_data->data,
 643 +                               fetch_rnd_data->key_len, DMA_FROM_DEVICE);
 644 +
 645 +       if (dma_mapping_error(dev, rnd_desc->rnd_data)) {
 646 +               dev_err(dev, "Unable to map memory\n");
 647 +               goto sk_random_map_fail;
 648 +       }
 649 +       return 0;
 650 +
 651 +sk_random_map_fail:
 652 +       return -ENOMEM;
 653 +}
 654 +
 655 +/* int caam_sk_redblob_encap_map(struct device *dev, struct sk_req *req,
 656 + *                                     struct sk_desc *skdesc)
 657 + * brief DMA map the buffer virtual pointers to physical address.
 658 + * param[in] dev Pointer to job ring device structure
 659 + * param[in] req Pointer to secure key request structure
 660 + * param[in] skdesc Pointer to secure key descriptor structure
 661 + * return 0 on success, error value otherwise.
 662 + */
 663 +int caam_sk_redblob_encap_map(struct device *dev, struct sk_req *req,
 664 +                             struct sk_desc *skdesc)
 665 +{
 666 +       struct sk_red_blob_encap *red_blob_encap;
 667 +       struct redblob_encap_desc *red_blob_desc;
 668 +
 669 +       red_blob_encap = &req->req_u.sk_red_blob_encap;
 670 +       red_blob_desc = &skdesc->dma_u.redblob_encapdesc;
 671 +
 672 +       red_blob_desc->in_data = dma_map_single(dev, red_blob_encap->data,
 673 +                                       red_blob_encap->data_sz, DMA_TO_DEVICE);
 674 +       if (dma_mapping_error(dev, red_blob_desc->in_data)) {
 675 +               dev_err(dev, "Unable to map memory\n");
 676 +               goto sk_data_fail;
 677 +       }
 678 +
 679 +       red_blob_desc->redblob = dma_map_single(dev, red_blob_encap->redblob,
 680 +                               red_blob_encap->redblob_sz, DMA_FROM_DEVICE);
 681 +       if (dma_mapping_error(dev, red_blob_desc->redblob)) {
 682 +               dev_err(dev, "Unable to map memory\n");
 683 +               goto sk_redblob_fail;
 684 +       }
 685 +
 686 +       return 0;
 687 +
 688 +sk_redblob_fail:
 689 +       dma_unmap_single(dev, red_blob_desc->in_data, red_blob_encap->data_sz,
 690 +                        DMA_TO_DEVICE);
 691 +sk_data_fail:
 692 +       return -ENOMEM;
 693 +}
 694 +
 695 +/* static int caam_sk_redblob_decap_map(struct device *dev,
 696 + *                                         struct sk_req *req,
 697 + *                                         struct sk_desc *skdesc)
 698 + * brief DMA map the buffer virtual pointers to physical address.
 699 + * param[in] dev Pointer to job ring device structure
 700 + * param[in] req Pointer to secure key request structure
 701 + * param[in] skdesc Pointer to secure key descriptor structure
 702 + * return 0 on success, error value otherwise.
 703 + */
 704 +int caam_sk_redblob_decap_map(struct device *dev, struct sk_req *req,
 705 +                             struct sk_desc *skdesc)
 706 +{
 707 +       struct sk_red_blob_decap *red_blob_decap;
 708 +       struct redblob_decap_desc *red_blob_desc;
 709 +
 710 +       red_blob_decap = &req->req_u.sk_red_blob_decap;
 711 +       red_blob_desc = &skdesc->dma_u.redblob_decapdesc;
 712 +
 713 +       red_blob_desc->redblob = dma_map_single(dev, red_blob_decap->redblob,
 714 +                               red_blob_decap->redblob_sz, DMA_TO_DEVICE);
 715 +       if (dma_mapping_error(dev, red_blob_desc->redblob)) {
 716 +               dev_err(dev, "Unable to map memory\n");
 717 +               goto sk_redblob_fail;
 718 +       }
 719 +
 720 +       red_blob_desc->out_data = dma_map_single(dev, red_blob_decap->data,
 721 +                               red_blob_decap->data_sz, DMA_FROM_DEVICE);
 722 +       if (dma_mapping_error(dev, red_blob_desc->out_data)) {
 723 +               dev_err(dev, "Unable to map memory\n");
 724 +               goto sk_data_fail;
 725 +       }
 726 +
 727 +       return 0;
 728 +
 729 +sk_data_fail:
 730 +       dma_unmap_single(dev, red_blob_desc->redblob,
 731 +                        red_blob_decap->redblob_sz, DMA_TO_DEVICE);
 732 +sk_redblob_fail:
 733 +       return -ENOMEM;
 734 +}
 735 +
 736 +/* @fn void securekey_unmap(struct device *dev,
 737 + *                         struct sk_desc *skdesc, struct sk_req *req)
 738 + * @brief DMA unmap the buffer pointers.
 739 + * @param[in] dev Pointer to job ring device structure
 740 + * @param[in] skdesc Pointer to secure key descriptor structure
 741 + * @param[in] req Pointer to secure key request structure
 742 + */
 743 +void securekey_unmap(struct device *dev,
 744 +                    struct sk_desc *skdesc, struct sk_req *req)
 745 +{
 746 +
 747 +       switch (req->type) {
 748 +       case sk_get_random:
 749 +               {
 750 +                       struct sk_fetch_rnd_data *fetch_rnd_data;
 751 +                       struct random_desc *rnd_desc;
 752 +
 753 +                       fetch_rnd_data = &req->req_u.sk_fetch_rnd_data;
 754 +                       rnd_desc = &skdesc->dma_u.random_descp;
 755 +
 756 +                       /* Unmap Descriptor buffer pointers. */
 757 +                       dma_unmap_single(dev, rnd_desc->rnd_data,
 758 +                                        fetch_rnd_data->key_len,
 759 +                                        DMA_FROM_DEVICE);
 760 +                       break;
 761 +               }
 762 +       case sk_red_blob_enc:
 763 +               {
 764 +                       struct sk_red_blob_encap *red_blob_encap;
 765 +                       struct redblob_encap_desc *red_blob_desc;
 766 +
 767 +                       red_blob_encap = &req->req_u.sk_red_blob_encap;
 768 +                       red_blob_desc = &skdesc->dma_u.redblob_encapdesc;
 769 +
 770 +                       /* Unmap Descriptor buffer pointers. */
 771 +                       dma_unmap_single(dev, red_blob_desc->in_data,
 772 +                                        red_blob_encap->data_sz,
 773 +                                        DMA_TO_DEVICE);
 774 +
 775 +                       dma_unmap_single(dev, red_blob_desc->redblob,
 776 +                                        red_blob_encap->redblob_sz,
 777 +                                        DMA_FROM_DEVICE);
 778 +
 779 +                       break;
 780 +               }
 781 +       case sk_red_blob_dec:
 782 +               {
 783 +                       struct sk_red_blob_decap *red_blob_decap;
 784 +                       struct redblob_decap_desc *red_blob_desc;
 785 +
 786 +                       red_blob_decap = &req->req_u.sk_red_blob_decap;
 787 +                       red_blob_desc = &skdesc->dma_u.redblob_decapdesc;
 788 +
 789 +                       /* Unmap Descriptor buffer pointers. */
 790 +                       dma_unmap_single(dev, red_blob_desc->redblob,
 791 +                                        red_blob_decap->redblob_sz,
 792 +                                        DMA_TO_DEVICE);
 793 +
 794 +                       dma_unmap_single(dev, red_blob_desc->out_data,
 795 +                                        red_blob_decap->data_sz,
 796 +                                        DMA_FROM_DEVICE);
 797 +
 798 +                       break;
 799 +               }
 800 +       default:
 801 +               dev_err(dev, "Unable to find request type\n");
 802 +               break;
 803 +       }
 804 +       kfree(skdesc);
 805 +}
 806 +
 807 +/*  int caam_securekey_desc_init(struct device *dev, struct sk_req *req)
 808 + *  brief CAAM Descriptor creator for secure key operations.
 809 + *  param[in] dev Pointer to job ring device structure
 810 + *  param[in] req Pointer to secure key request structure
 811 + *  return 0 on success, error value otherwise.
 812 + */
 813 +int caam_securekey_desc_init(struct device *dev, struct sk_req *req)
 814 +{
 815 +       struct sk_desc *skdesc = NULL;
 816 +       int ret = 0;
 817 +
 818 +       switch (req->type) {
 819 +       case sk_get_random:
 820 +               {
 821 +                       skdesc = kmalloc(sizeof(*skdesc), GFP_DMA);
 822 +                       if (!skdesc) {
 823 +                               ret = -ENOMEM;
 824 +                               goto out;
 825 +                       }
 826 +                       skdesc->req_type = req->type;
 827 +
 828 +                       if (caam_sk_get_random_map(dev, req, skdesc)) {
 829 +                               dev_err(dev, "caam get_random map fail\n");
 830 +                               ret = -ENOMEM;
 831 +                               goto out;
 832 +                       }
 833 +                       caam_sk_rng_desc(req, skdesc);
 834 +                       break;
 835 +               }
 836 +       case sk_red_blob_enc:
 837 +               {
 838 +                       skdesc = kmalloc(sizeof(*skdesc), GFP_DMA);
 839 +                       if (!skdesc) {
 840 +                               ret = -ENOMEM;
 841 +                               goto out;
 842 +                       }
 843 +
 844 +                       skdesc->req_type = req->type;
 845 +
 846 +                       if (caam_sk_redblob_encap_map(dev, req, skdesc)) {
 847 +                               dev_err(dev, "caam redblob_encap map fail\n");
 848 +                               ret = -ENOMEM;
 849 +                               goto out;
 850 +                       }
 851 +
 852 +                       /* Descriptor function to create redblob from data. */
 853 +                       caam_sk_redblob_encap_desc(req, skdesc);
 854 +                       break;
 855 +               }
 856 +
 857 +       case sk_red_blob_dec:
 858 +               {
 859 +                       skdesc = kmalloc(sizeof(*skdesc), GFP_DMA);
 860 +                       if (!skdesc) {
 861 +                               ret = -ENOMEM;
 862 +                               goto out;
 863 +                       }
 864 +
 865 +                       skdesc->req_type = req->type;
 866 +
 867 +                       if (caam_sk_redblob_decap_map(dev, req, skdesc)) {
 868 +                               dev_err(dev, "caam redblob_decap map fail\n");
 869 +                               ret = -ENOMEM;
 870 +                               goto out;
 871 +                       }
 872 +
 873 +                       /* Descriptor function to decap data from redblob. */
 874 +                       caam_sk_redblob_decap_desc(req, skdesc);
 875 +                       break;
 876 +               }
 877 +       default:
 878 +               pr_debug("Unknown request type\n");
 879 +               ret = -EINVAL;
 880 +               goto out;
 881 +       }
 882 +
 883 +       req->desc_pointer = (void *)skdesc;
 884 +
 885 +out:
 886 +       return ret;
 887 +}
 888 +
 889 +/* static void caam_op_done (struct device *dev, u32 *desc, u32 ret,
 890 + *                          void *context)
 891 + * brief callback function to be called when descriptor executed.
 892 + * param[in] dev Pointer to device structure
 893 + * param[in] desc descriptor pointer
 894 + * param[in] ret return status of Job submitted
 895 + * param[in] context void pointer
 896 + */
 897 +static void caam_op_done(struct device *dev, u32 *desc, u32 ret,
 898 +                        void *context)
 899 +{
 900 +       struct sk_req *req = context;
 901 +
 902 +       if (ret) {
 903 +               dev_err(dev, "caam op done err: %x\n", ret);
 904 +               /* print the error source name. */
 905 +               caam_jr_strstatus(dev, ret);
 906 +       }
 907 +       /* Call securekey_unmap function for unmapping the buffer pointers. */
 908 +       securekey_unmap(dev, req->desc_pointer, req);
 909 +
 910 +       req->ret = ret;
 911 +       complete(&req->comp);
 912 +}
 913 +
 914 +
 915 +/*  static int sk_job_submit(struct device *jrdev, struct sk_req *req)
 916 + *  brief Enqueue a Job descriptor to Job ring and wait until SEC returns.
 917 + *  param[in] jrdev Pointer to job ring device structure
 918 + *  param[in] req Pointer to secure key request structure
 919 + *  return 0 on success, error value otherwise.
 920 + */
 921 +static int sk_job_submit(struct device *jrdev, struct sk_req *req)
 922 +{
 923 +       int ret;
 924 +
 925 +       init_completion(&req->comp);
 926 +
 927 +       /* caam_jr_enqueue function for Enqueue a job descriptor */
 928 +       ret = caam_jr_enqueue(jrdev, req->hwdesc, caam_op_done, req);
 929 +       if (!ret)
 930 +               wait_for_completion_interruptible(&req->comp);
 931 +
 932 +       ret = req->ret;
 933 +       return ret;
 934 +}
 935 +
 936 +/* caam_get_random(struct secure_key_payload *p,  enum sk_req_type fetch_rnd,
 937 + *                struct device *dev)
 938 + * Create the random number of the specified length using CAAM block
 939 + * param[in]: out pointer to place the random bytes
 940 + * param[in]: length for the random data bytes.
 941 + * param[in]: dev Pointer to job ring device structure
 942 + * If operation is successful return 0, otherwise error.
 943 + */
 944 +int caam_get_random(struct secure_key_payload *p,  enum sk_req_type fetch_rnd,
 945 +                   struct device *dev)
 946 +{
 947 +       struct sk_fetch_rnd_data *fetch_rnd_data = NULL;
 948 +       struct sk_req *req = NULL;
 949 +       int ret = 0;
 950 +       void *temp = NULL;
 951 +
 952 +       req = kmalloc(sizeof(struct sk_req), GFP_DMA);
 953 +       if (!req) {
 954 +               ret = -ENOMEM;
 955 +               goto out;
 956 +       }
 957 +
 958 +       req->type = fetch_rnd;
 959 +       fetch_rnd_data = &(req->req_u.sk_fetch_rnd_data);
 960 +
 961 +       /* initialise with key length */
 962 +       fetch_rnd_data->key_len = p->key_len;
 963 +
 964 +       temp = kmalloc(fetch_rnd_data->key_len, GFP_DMA);
 965 +       if (!temp) {
 966 +               ret = -ENOMEM;
 967 +               goto out;
 968 +       }
 969 +       fetch_rnd_data->data = temp;
 970 +
 971 +       ret = caam_securekey_desc_init(dev, req);
 972 +
 973 +       if (ret) {
 974 +               pr_info("caam_securekey_desc_init failed\n");
 975 +               goto out;
 976 +       }
 977 +
 978 +       ret = sk_job_submit(dev, req);
 979 +       if (!ret) {
 980 +               /*Copy output to key buffer. */
 981 +               memcpy(p->key, fetch_rnd_data->data, p->key_len);
 982 +       } else {
 983 +               ret = -EINVAL;
 984 +       }
 985 +
 986 +out:
 987 +       if (req)
 988 +               kfree(req);
 989 +
 990 +       if (temp)
 991 +               kfree(temp);
 992 +
 993 +       return ret;
 994 +}
 995 +EXPORT_SYMBOL(caam_get_random);
 996 +
 997 +/* key_deblob(struct secure_key_payload *p, enum sk_req_type decap_type
 998 + *             struct device *dev)
 999 + * Deblobify the blob to get the key data and fill in secure key payload struct
1000 + * param[in] p pointer to the secure key payload
1001 + * param[in] decap_type operation to be done.
1002 + * param[in] dev dev Pointer to job ring device structure
1003 + * If operation is successful return 0, otherwise error.
1004 + */
1005 +int key_deblob(struct secure_key_payload *p, enum sk_req_type decap_type,
1006 +              struct device *dev)
1007 +{
1008 +       unsigned int blob_len;
1009 +       struct sk_red_blob_decap *d_blob;
1010 +       struct sk_req *req = NULL;
1011 +       int total_sz = 0, *temp = NULL, ret = 0;
1012 +
1013 +       req = kmalloc(sizeof(struct sk_req), GFP_DMA);
1014 +       if (!req) {
1015 +               ret = -ENOMEM;
1016 +               goto out;
1017 +       }
1018 +
1019 +       d_blob = &(req->req_u.sk_red_blob_decap);
1020 +       blob_len = p->blob_len;
1021 +       req->type = decap_type;
1022 +
1023 +       /*
1024 +        * Red blob size is the blob_len filled in payload struct
1025 +        * Data_sz i.e. key is the blob_len - blob header size
1026 +        */
1027 +
1028 +       d_blob->redblob_sz = blob_len;
1029 +       d_blob->data_sz = blob_len - (SK_BLOB_KEY_SZ + SK_BLOB_MAC_SZ);
1030 +       total_sz = d_blob->data_sz + d_blob->redblob_sz;
1031 +
1032 +       temp = kmalloc(total_sz, GFP_DMA);
1033 +       if (!temp) {
1034 +               ret = -ENOMEM;
1035 +               goto out;
1036 +       }
1037 +
1038 +       req->mem_pointer = temp;
1039 +       d_blob->redblob = temp;
1040 +       d_blob->data = d_blob->redblob + d_blob->redblob_sz;
1041 +       memcpy(d_blob->redblob, p->blob, blob_len);
1042 +
1043 +       ret = caam_securekey_desc_init(dev, req);
1044 +
1045 +       if (ret) {
1046 +               pr_info("caam_securekey_desc_init: Failed\n");
1047 +               goto out;
1048 +       }
1049 +
1050 +       ret = sk_job_submit(dev, req);
1051 +       if (!ret) {
1052 +               /*Copy output to key buffer. */
1053 +               p->key_len = d_blob->data_sz;
1054 +               memcpy(p->key, d_blob->data, p->key_len);
1055 +       } else {
1056 +               ret = -EINVAL;
1057 +       }
1058 +
1059 +out:
1060 +       if (temp)
1061 +               kfree(temp);
1062 +       if (req)
1063 +               kfree(req);
1064 +       return ret;
1065 +}
1066 +EXPORT_SYMBOL(key_deblob);
1067 +
1068 +/* key_blob(struct secure_key_payload *p, enum sk_req_type encap_type,
1069 + *             struct device *dev)
1070 + * To blobify the key data to get the blob. This blob can only be seen by
1071 + * userspace.
1072 + * param[in] p pointer to the secure key payload
1073 + * param[in] decap_type operation to be done.
1074 + * param[in] dev dev Pointer to job ring device structure
1075 + * If operation is successful return 0, otherwise error.
1076 + */
1077 +int key_blob(struct secure_key_payload *p, enum sk_req_type encap_type,
1078 +            struct device *dev)
1079 +{
1080 +       unsigned int key_len;
1081 +       struct sk_red_blob_encap *k_blob;
1082 +       struct sk_req *req = NULL;
1083 +       int total_sz = 0, *temp = NULL, ret = 0;
1084 +
1085 +       req = kmalloc(sizeof(struct sk_req), GFP_DMA);
1086 +       if (!req) {
1087 +               ret = -ENOMEM;
1088 +               goto out;
1089 +       }
1090 +
1091 +       key_len = p->key_len;
1092 +
1093 +       req->type = encap_type;
1094 +       k_blob = &(req->req_u.sk_red_blob_encap);
1095 +
1096 +       /*
1097 +        * Data_sz i.e. key len and the corresponding blob_len is
1098 +        * key_len + BLOB header size.
1099 +        */
1100 +
1101 +       k_blob->data_sz = key_len;
1102 +       k_blob->redblob_sz = key_len + SK_BLOB_KEY_SZ + SK_BLOB_MAC_SZ;
1103 +       total_sz = k_blob->data_sz + k_blob->redblob_sz;
1104 +
1105 +       temp = kmalloc(total_sz, GFP_DMA);
1106 +       if (!temp) {
1107 +               ret = -ENOMEM;
1108 +               goto out;
1109 +       }
1110 +
1111 +       req->mem_pointer = temp;
1112 +       k_blob->data = temp;
1113 +
1114 +       k_blob->redblob = k_blob->data + k_blob->data_sz;
1115 +       memcpy(k_blob->data, p->key, key_len);
1116 +
1117 +       ret = caam_securekey_desc_init(dev, req);
1118 +
1119 +       if (ret) {
1120 +               pr_info("caam_securekey_desc_init failed\n");
1121 +               goto out;
1122 +       }
1123 +
1124 +       ret = sk_job_submit(dev, req);
1125 +       if (!ret) {
1126 +               /*Copy output to key buffer. */
1127 +               p->blob_len = k_blob->redblob_sz;
1128 +               memcpy(p->blob, k_blob->redblob, p->blob_len);
1129 +       } else {
1130 +               ret = -EINVAL;
1131 +       }
1132 +
1133 +out:
1134 +       if (temp)
1135 +               kfree(req->mem_pointer);
1136 +       if (req)
1137 +               kfree(req);
1138 +       return ret;
1139 +
1140 +}
1141 +EXPORT_SYMBOL(key_blob);
1142 --- /dev/null
1143 +++ b/security/keys/securekey_desc.h
1144 @@ -0,0 +1,141 @@
1145 +/* SPDX-License-Identifier: GPL-2.0 */
1146 +/*
1147 + * Copyright 2018 NXP
1148 + *
1149 + */
1150 +#ifndef _SECUREKEY_DESC_H_
1151 +#define _SECUREKEY_DESC_H_
1152 +
1153 +#include "compat.h"
1154 +#include "regs.h"
1155 +#include "intern.h"
1156 +#include "desc.h"
1157 +#include "desc_constr.h"
1158 +#include "jr.h"
1159 +#include "error.h"
1160 +#include "pdb.h"
1161 +
1162 +#define SK_BLOB_KEY_SZ         32      /* Blob key size. */
1163 +#define SK_BLOB_MAC_SZ         16      /* Blob MAC size. */
1164 +
1165 +/*
1166 + * brief defines different kinds of operations supported by this module.
1167 + */
1168 +enum sk_req_type {
1169 +       sk_get_random,
1170 +       sk_red_blob_enc,
1171 +       sk_red_blob_dec,
1172 +};
1173 +
1174 +
1175 +/*
1176 + * struct random_des
1177 + * param[out] rnd_data output buffer for random data.
1178 + */
1179 +struct random_desc {
1180 +       dma_addr_t rnd_data;
1181 +};
1182 +
1183 +/* struct redblob_encap_desc
1184 + * details Structure containing dma address for redblob encapsulation.
1185 + * param[in] in_data input data to redblob encap descriptor.
1186 + * param[out] redblob output buffer for redblob.
1187 + */
1188 +struct redblob_encap_desc {
1189 +       dma_addr_t in_data;
1190 +       dma_addr_t redblob;
1191 +};
1192 +
1193 +/* struct redblob_decap_desc
1194 + * details Structure containing dma address for redblob decapsulation.
1195 + * param[in] redblob input buffer to redblob decap descriptor.
1196 + * param[out] out_data output data from redblob decap descriptor.
1197 + */
1198 +struct redblob_decap_desc {
1199 +       dma_addr_t redblob;
1200 +       dma_addr_t out_data;
1201 +};
1202 +
1203 +/* struct sk_desc
1204 + * details Structure for securekey descriptor creation.
1205 + * param[in] req_type operation supported.
1206 + * param[in] dma_u union of struct for supported operation.
1207 + */
1208 +struct sk_desc {
1209 +       u32 req_type;
1210 +       union {
1211 +               struct redblob_encap_desc redblob_encapdesc;
1212 +               struct redblob_decap_desc redblob_decapdesc;
1213 +               struct random_desc random_descp;
1214 +       } dma_u;
1215 +};
1216 +
1217 +/* struct sk_fetch_rnd_data
1218 + * decriptor structure containing key length.
1219 + */
1220 +struct sk_fetch_rnd_data {
1221 +       void *data;
1222 +       size_t key_len;
1223 +};
1224 +
1225 +/* struct sk_red_blob_encap
1226 + * details Structure containing buffer pointers for redblob encapsulation.
1227 + * param[in] data Input data.
1228 + * param[in] data_sz size of Input data.
1229 + * param[out] redblob output buffer for redblob.
1230 + * param[in] redblob_sz size of redblob.
1231 + */
1232 +struct sk_red_blob_encap {
1233 +       void *data;
1234 +       uint32_t data_sz;
1235 +       void *redblob;
1236 +       uint32_t redblob_sz;
1237 +};
1238 +
1239 +/* struct sk_red_blob_decap
1240 + * details Structure containing buffer pointers for redblob decapsulation.
1241 + * param[in] redblob Input redblob.
1242 + * param[in] redblob_sz size of redblob.
1243 + * param[out] data output buffer for data.
1244 + * param[in] data_sz size of output data.
1245 + */
1246 +struct sk_red_blob_decap {
1247 +       void *redblob;
1248 +       uint32_t redblob_sz;
1249 +       void *data;
1250 +       uint32_t data_sz;
1251 +};
1252 +
1253 +/* struct sk_req
1254 + * details Structure for securekey request creation.
1255 + * param[in] type operation supported.
1256 + * param[in] req_u union of struct for supported operation.
1257 + * param[out] ret return status of CAAM operation.
1258 + * param[in] mem_pointer memory pointer for allocated kernel memory.
1259 + * param[in] desc_pointer Pointer to securekey descriptor creation structure.
1260 + * param[in] comp struct completion object.
1261 + * param[in] hwdesc contains descriptor instructions.
1262 + */
1263 +struct sk_req {
1264 +       enum sk_req_type type;
1265 +       void *arg;
1266 +       union {
1267 +               struct sk_red_blob_encap sk_red_blob_encap;
1268 +               struct sk_red_blob_decap sk_red_blob_decap;
1269 +               struct sk_fetch_rnd_data sk_fetch_rnd_data;
1270 +       } req_u;
1271 +       int ret;
1272 +       void *mem_pointer;
1273 +       void *desc_pointer;
1274 +       struct completion comp;
1275 +       u32 hwdesc[MAX_CAAM_DESCSIZE];
1276 +};
1277 +
1278 +int caam_get_random(struct secure_key_payload *p,  enum sk_req_type fetch_rnd,
1279 +                   struct device *dev);
1280 +int key_blob(struct secure_key_payload *p, enum sk_req_type encap_type,
1281 +            struct device *dev);
1282 +int key_deblob(struct secure_key_payload *p, enum sk_req_type decap_type,
1283 +              struct device *dev);
1284 +
1285 +#endif /*_SECUREKEY_DESC_H_*/