// SPDX-License-Identifier: BSD-2-Clause
/*
 * SPDX-FileCopyrightText: Copyright (c) 2021-2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
 */

#ifndef __TEGRA_SE_KEYSLOT_H__
#define __TEGRA_SE_KEYSLOT_H__

#include <tee_api_types.h>

#define TEGRA_SE_AES_BLOCK_SIZE		16
#define TEGRA_SE_AES_IV_SIZE		16
#define TEGRA_SE_KEY_128_SIZE		16
#define TEGRA_SE_KEY_256_SIZE		32

#define TEGRA_SE_AES_QUAD_KEYS_128	0
#define TEGRA_SE_AES_QUAD_KEYS_256	1
#define TEGRA_SE_AES_QUAD_ORG_IV	2
#define TEGRA_SE_AES_QUAD_UPDTD_IV	3
#define TEGRA_SE_AES_QUAD_MAX		TEGRA_SE_AES_QUAD_UPDTD_IV

typedef enum
{
#if defined(PLATFORM_FLAVOR_t234)
	SE_AES_KEYSLOT_11 = 11,
	SE_AES_KEYSLOT_12 = 12,

	// Fuse keys: OEM_K1 -> slot 12, OEM_K2 -> slot 11
	SE_AES_KEYSLOT_OEM_K1 = SE_AES_KEYSLOT_12,
	SE_AES_KEYSLOT_OEM_K2 = SE_AES_KEYSLOT_11,

	SE_AES_KEYSLOT_COUNT = 16,
#elif defined(PLATFORM_FLAVOR_t264)
	SE_AES_KEYSLOT_10 = 10,
	SE_AES_KEYSLOT_11 = 11,
	SE_AES_KEYSLOT_12 = 12,
	SE_AES_KEYSLOT_13 = 13,
	/*
	 * SE_AES_KEYSLOT_TZ_RK: TZ RK derived from OEM_KDK1 (PSC)
	 * Purpose: KDK
	 * Keyslot: 10
	 *
	 * SE_AES_KEYSLOT_EKB_RK: EKB Root Key derived from TZ RK
	 * Purpose: KDK
	 * Keyslot: 11
	 *
	 * SE_AES_KEYSLOT_EKB_AK: EKB Authentication Key derived form EKB RK
	 * Purpose: DK
	 * Keyslot: 11
	 *
	 * SE_AES_KEYSLOT_EKB_EK: EKB Encryption Key derived form EKB RK
	 * Purpose: DK
	 * Keyslot: 12
	 *
	 * SE_AES_KEYSLOT_HUK_RK: Hardware Unique Key RK derived form TZ RK
	 * Purpose: KDK
	 * Keyslot: 13
	 *
	 * SE_AES_KEYSLOT_HUK: Hardware Unique Key derived form HUK RK
	 * Purpose: DK
	 * Keyslot: 13
	 */
	SE_AES_KEYSLOT_TZ_RK = SE_AES_KEYSLOT_10,
	SE_AES_KEYSLOT_EKB_RK = SE_AES_KEYSLOT_11,
	SE_AES_KEYSLOT_EKB_AK = SE_AES_KEYSLOT_11,
	SE_AES_KEYSLOT_EKB_EK = SE_AES_KEYSLOT_12,
	SE_AES_KEYSLOT_HUK_RK = SE_AES_KEYSLOT_13,
	SE_AES_KEYSLOT_HUK = SE_AES_KEYSLOT_13,
#else
	SE_AES_KEYSLOT_COUNT = 0,
#endif
} se_aes_keyslot_t;

#if defined(PLATFORM_FLAVOR_t264)
/* KDS */
#define TZ_KDS_SRC_KEYID					2U
#define TZ_KDS_REGION_ID					0U
#define TZ_KDS_TABLE_ID						0U
#endif

/*
 * Write key into the AES keyslot.
 *
 * input_key		[in] the pointer of the input key buffer.
 * keylen		[in] the length of the input key.
 * key_quad_sel		[in] the quad selection of the key.
 * keyslot		[in] the target keyslot index.
 */
TEE_Result tegra_se_write_aes_keyslot(uint8_t *input_key, uint32_t keylen,
				      uint32_t key_quad_sel,
				      se_aes_keyslot_t keyslot);

/* Clear the AES keyslots */
TEE_Result tegra_se_clear_aes_keyslots(void);

#endif
