1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* Copyright (C) 2012-2019 ARM Limited (or its affiliates). */ |
3 | |
4 | #include <linux/kernel.h> |
5 | #include <linux/fips.h> |
6 | #include <linux/notifier.h> |
7 | |
8 | #include "cc_driver.h" |
9 | #include "cc_fips.h" |
10 | |
11 | static void fips_dsr(unsigned long devarg); |
12 | |
13 | struct cc_fips_handle { |
14 | struct tasklet_struct tasklet; |
15 | struct notifier_block nb; |
16 | struct cc_drvdata *drvdata; |
17 | }; |
18 | |
19 | /* The function called once at driver entry point to check |
20 | * whether TEE FIPS error occurred. |
21 | */ |
22 | static bool cc_get_tee_fips_status(struct cc_drvdata *drvdata) |
23 | { |
24 | u32 reg; |
25 | |
26 | reg = cc_ioread(drvdata, CC_REG(GPR_HOST)); |
27 | /* Did the TEE report status? */ |
28 | if (reg & CC_FIPS_SYNC_TEE_STATUS) |
29 | /* Yes. Is it OK? */ |
30 | return (reg & CC_FIPS_SYNC_MODULE_OK); |
31 | |
32 | /* No. It's either not in use or will be reported later */ |
33 | return true; |
34 | } |
35 | |
36 | /* |
37 | * This function should push the FIPS REE library status towards the TEE library |
38 | * by writing the error state to HOST_GPR0 register. |
39 | */ |
40 | void cc_set_ree_fips_status(struct cc_drvdata *drvdata, bool status) |
41 | { |
42 | int val = CC_FIPS_SYNC_REE_STATUS; |
43 | |
44 | if (drvdata->hw_rev < CC_HW_REV_712) |
45 | return; |
46 | |
47 | val |= (status ? CC_FIPS_SYNC_MODULE_OK : CC_FIPS_SYNC_MODULE_ERROR); |
48 | |
49 | cc_iowrite(drvdata, CC_REG(HOST_GPR0), val); |
50 | } |
51 | |
52 | /* Push REE side FIPS test failure to TEE side */ |
53 | static int cc_ree_fips_failure(struct notifier_block *nb, unsigned long unused1, |
54 | void *unused2) |
55 | { |
56 | struct cc_fips_handle *fips_h = |
57 | container_of(nb, struct cc_fips_handle, nb); |
58 | struct cc_drvdata *drvdata = fips_h->drvdata; |
59 | struct device *dev = drvdata_to_dev(drvdata); |
60 | |
61 | cc_set_ree_fips_status(drvdata, false); |
62 | dev_info(dev, "Notifying TEE of FIPS test failure...\n" ); |
63 | |
64 | return NOTIFY_OK; |
65 | } |
66 | |
67 | void cc_fips_fini(struct cc_drvdata *drvdata) |
68 | { |
69 | struct cc_fips_handle *fips_h = drvdata->fips_handle; |
70 | |
71 | if (drvdata->hw_rev < CC_HW_REV_712 || !fips_h) |
72 | return; |
73 | |
74 | atomic_notifier_chain_unregister(nh: &fips_fail_notif_chain, nb: &fips_h->nb); |
75 | |
76 | /* Kill tasklet */ |
77 | tasklet_kill(t: &fips_h->tasklet); |
78 | drvdata->fips_handle = NULL; |
79 | } |
80 | |
81 | void fips_handler(struct cc_drvdata *drvdata) |
82 | { |
83 | struct cc_fips_handle *fips_handle_ptr = drvdata->fips_handle; |
84 | |
85 | if (drvdata->hw_rev < CC_HW_REV_712) |
86 | return; |
87 | |
88 | tasklet_schedule(t: &fips_handle_ptr->tasklet); |
89 | } |
90 | |
91 | static inline void tee_fips_error(struct device *dev) |
92 | { |
93 | if (fips_enabled) |
94 | panic(fmt: "ccree: TEE reported cryptographic error in fips mode!\n" ); |
95 | else |
96 | dev_err(dev, "TEE reported error!\n" ); |
97 | } |
98 | |
99 | /* |
100 | * This function check if cryptocell tee fips error occurred |
101 | * and in such case triggers system error |
102 | */ |
103 | void cc_tee_handle_fips_error(struct cc_drvdata *p_drvdata) |
104 | { |
105 | struct device *dev = drvdata_to_dev(drvdata: p_drvdata); |
106 | |
107 | if (!cc_get_tee_fips_status(drvdata: p_drvdata)) |
108 | tee_fips_error(dev); |
109 | } |
110 | |
111 | /* Deferred service handler, run as interrupt-fired tasklet */ |
112 | static void fips_dsr(unsigned long devarg) |
113 | { |
114 | struct cc_drvdata *drvdata = (struct cc_drvdata *)devarg; |
115 | u32 irq, val; |
116 | |
117 | irq = (drvdata->irq & (CC_GPR0_IRQ_MASK)); |
118 | |
119 | if (irq) { |
120 | cc_tee_handle_fips_error(drvdata); |
121 | } |
122 | |
123 | /* after verifying that there is nothing to do, |
124 | * unmask AXI completion interrupt. |
125 | */ |
126 | val = (CC_REG(HOST_IMR) & ~irq); |
127 | cc_iowrite(drvdata, CC_REG(HOST_IMR), val); |
128 | } |
129 | |
130 | /* The function called once at driver entry point .*/ |
131 | int cc_fips_init(struct cc_drvdata *p_drvdata) |
132 | { |
133 | struct cc_fips_handle *fips_h; |
134 | struct device *dev = drvdata_to_dev(drvdata: p_drvdata); |
135 | |
136 | if (p_drvdata->hw_rev < CC_HW_REV_712) |
137 | return 0; |
138 | |
139 | fips_h = devm_kzalloc(dev, size: sizeof(*fips_h), GFP_KERNEL); |
140 | if (!fips_h) |
141 | return -ENOMEM; |
142 | |
143 | p_drvdata->fips_handle = fips_h; |
144 | |
145 | dev_dbg(dev, "Initializing fips tasklet\n" ); |
146 | tasklet_init(t: &fips_h->tasklet, func: fips_dsr, data: (unsigned long)p_drvdata); |
147 | fips_h->drvdata = p_drvdata; |
148 | fips_h->nb.notifier_call = cc_ree_fips_failure; |
149 | atomic_notifier_chain_register(nh: &fips_fail_notif_chain, nb: &fips_h->nb); |
150 | |
151 | cc_tee_handle_fips_error(p_drvdata); |
152 | |
153 | return 0; |
154 | } |
155 | |