1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright 2016 NXP Semiconductor, Inc.
4 */
5
6 #include <common.h>
7 #include <errno.h>
8 #include <linux/kernel.h>
9 #include <asm/io.h>
10 #include <asm/system.h>
11 #include <asm/types.h>
12 #include <asm/macro.h>
13 #include <asm/armv8/sec_firmware.h>
14
15 DECLARE_GLOBAL_DATA_PTR;
16 extern void c_runtime_cpu_setup(void);
17
18 #define SEC_FIRMWARE_LOADED 0x1
19 #define SEC_FIRMWARE_RUNNING 0x2
20 #define SEC_FIRMWARE_ADDR_MASK (~0x3)
21 /*
22 * Secure firmware load addr
23 * Flags used: 0x1 secure firmware has been loaded to secure memory
24 * 0x2 secure firmware is running
25 */
26 phys_addr_t sec_firmware_addr;
27
28 #ifndef SEC_FIRMWARE_FIT_IMAGE
29 #define SEC_FIRMWARE_FIT_IMAGE "firmware"
30 #endif
31 #ifndef SEC_FIRMEWARE_FIT_CNF_NAME
32 #define SEC_FIRMEWARE_FIT_CNF_NAME "config-1"
33 #endif
34 #ifndef SEC_FIRMWARE_TARGET_EL
35 #define SEC_FIRMWARE_TARGET_EL 2
36 #endif
37
sec_firmware_get_data(const void * sec_firmware_img,const void ** data,size_t * size)38 static int sec_firmware_get_data(const void *sec_firmware_img,
39 const void **data, size_t *size)
40 {
41 int conf_node_off, fw_node_off;
42 char *conf_node_name = NULL;
43 char *desc;
44 int ret;
45
46 conf_node_name = SEC_FIRMEWARE_FIT_CNF_NAME;
47
48 conf_node_off = fit_conf_get_node(sec_firmware_img, conf_node_name);
49 if (conf_node_off < 0) {
50 printf("SEC Firmware: %s: no such config\n", conf_node_name);
51 return -ENOENT;
52 }
53
54 fw_node_off = fit_conf_get_prop_node(sec_firmware_img, conf_node_off,
55 SEC_FIRMWARE_FIT_IMAGE);
56 if (fw_node_off < 0) {
57 printf("SEC Firmware: No '%s' in config\n",
58 SEC_FIRMWARE_FIT_IMAGE);
59 return -ENOLINK;
60 }
61
62 /* Verify secure firmware image */
63 if (!(fit_image_verify(sec_firmware_img, fw_node_off))) {
64 printf("SEC Firmware: Bad firmware image (bad CRC)\n");
65 return -EINVAL;
66 }
67
68 if (fit_image_get_data(sec_firmware_img, fw_node_off, data, size)) {
69 printf("SEC Firmware: Can't get %s subimage data/size",
70 SEC_FIRMWARE_FIT_IMAGE);
71 return -ENOENT;
72 }
73
74 ret = fit_get_desc(sec_firmware_img, fw_node_off, &desc);
75 if (ret)
76 printf("SEC Firmware: Can't get description\n");
77 else
78 printf("%s\n", desc);
79
80 return ret;
81 }
82
83 /*
84 * SEC Firmware FIT image parser checks if the image is in FIT
85 * format, verifies integrity of the image and calculates raw
86 * image address and size values.
87 *
88 * Returns 0 on success and a negative errno on error task fail.
89 */
sec_firmware_parse_image(const void * sec_firmware_img,const void ** raw_image_addr,size_t * raw_image_size)90 static int sec_firmware_parse_image(const void *sec_firmware_img,
91 const void **raw_image_addr,
92 size_t *raw_image_size)
93 {
94 int ret;
95
96 ret = sec_firmware_get_data(sec_firmware_img, raw_image_addr,
97 raw_image_size);
98 if (ret)
99 return ret;
100
101 debug("SEC Firmware: raw_image_addr = 0x%p, raw_image_size = 0x%lx\n",
102 *raw_image_addr, *raw_image_size);
103
104 return 0;
105 }
106
107 /*
108 * SEC Firmware FIT image parser to check if any loadable is
109 * present. If present, verify integrity of the loadable and
110 * copy loadable to address provided in (loadable_h, loadable_l).
111 *
112 * Returns 0 on success and a negative errno on error task fail.
113 */
sec_firmware_check_copy_loadable(const void * sec_firmware_img,u32 * loadable_l,u32 * loadable_h)114 static int sec_firmware_check_copy_loadable(const void *sec_firmware_img,
115 u32 *loadable_l, u32 *loadable_h)
116 {
117 phys_addr_t sec_firmware_loadable_addr = 0;
118 int conf_node_off, ld_node_off, images;
119 char *conf_node_name = NULL;
120 const void *data;
121 size_t size;
122 ulong load;
123 const char *name, *str, *type;
124 int len;
125
126 conf_node_name = SEC_FIRMEWARE_FIT_CNF_NAME;
127
128 conf_node_off = fit_conf_get_node(sec_firmware_img, conf_node_name);
129 if (conf_node_off < 0) {
130 printf("SEC Firmware: %s: no such config\n", conf_node_name);
131 return -ENOENT;
132 }
133
134 /* find the node holding the images information */
135 images = fdt_path_offset(sec_firmware_img, FIT_IMAGES_PATH);
136 if (images < 0) {
137 printf("%s: Cannot find /images node: %d\n", __func__, images);
138 return -1;
139 }
140
141 type = FIT_LOADABLE_PROP;
142
143 name = fdt_getprop(sec_firmware_img, conf_node_off, type, &len);
144 if (!name) {
145 /* Loadables not present */
146 return 0;
147 }
148
149 printf("SEC Firmware: '%s' present in config\n", type);
150
151 for (str = name; str && ((str - name) < len);
152 str = strchr(str, '\0') + 1) {
153 printf("%s: '%s'\n", type, str);
154 ld_node_off = fdt_subnode_offset(sec_firmware_img, images, str);
155 if (ld_node_off < 0) {
156 printf("cannot find image node '%s': %d\n", str,
157 ld_node_off);
158 return -EINVAL;
159 }
160
161 /* Verify secure firmware image */
162 if (!(fit_image_verify(sec_firmware_img, ld_node_off))) {
163 printf("SEC Loadable: Bad loadable image (bad CRC)\n");
164 return -EINVAL;
165 }
166
167 if (fit_image_get_data(sec_firmware_img, ld_node_off,
168 &data, &size)) {
169 printf("SEC Loadable: Can't get subimage data/size");
170 return -ENOENT;
171 }
172
173 /* Get load address, treated as load offset to secure memory */
174 if (fit_image_get_load(sec_firmware_img, ld_node_off, &load)) {
175 printf("SEC Loadable: Can't get subimage load");
176 return -ENOENT;
177 }
178
179 /* Compute load address for loadable in secure memory */
180 sec_firmware_loadable_addr = (sec_firmware_addr -
181 gd->arch.tlb_size) + load;
182
183 /* Copy loadable to secure memory and flush dcache */
184 debug("%s copied to address 0x%p\n",
185 FIT_LOADABLE_PROP, (void *)sec_firmware_loadable_addr);
186 memcpy((void *)sec_firmware_loadable_addr, data, size);
187 flush_dcache_range(sec_firmware_loadable_addr,
188 sec_firmware_loadable_addr + size);
189
190 /* Populate loadable address only for Trusted OS */
191 if (!strcmp(str, "trustedOS@1")) {
192 /*
193 * Populate address ptrs for loadable image with
194 * loadbale addr
195 */
196 out_le32(loadable_l, (sec_firmware_loadable_addr &
197 WORD_MASK));
198 out_le32(loadable_h, (sec_firmware_loadable_addr >>
199 WORD_SHIFT));
200 }
201 }
202
203 return 0;
204 }
205
sec_firmware_copy_image(const char * title,u64 image_addr,u32 image_size,u64 sec_firmware)206 static int sec_firmware_copy_image(const char *title,
207 u64 image_addr, u32 image_size, u64 sec_firmware)
208 {
209 debug("%s copied to address 0x%p\n", title, (void *)sec_firmware);
210 memcpy((void *)sec_firmware, (void *)image_addr, image_size);
211 flush_dcache_range(sec_firmware, sec_firmware + image_size);
212
213 return 0;
214 }
215
216 /*
217 * This function will parse the SEC Firmware image, and then load it
218 * to secure memory. Also load any loadable if present along with SEC
219 * Firmware image.
220 */
sec_firmware_load_image(const void * sec_firmware_img,u32 * loadable_l,u32 * loadable_h)221 static int sec_firmware_load_image(const void *sec_firmware_img,
222 u32 *loadable_l, u32 *loadable_h)
223 {
224 const void *raw_image_addr;
225 size_t raw_image_size = 0;
226 int ret;
227
228 /*
229 * The Excetpion Level must be EL3 to load and initialize
230 * the SEC Firmware.
231 */
232 if (current_el() != 3) {
233 ret = -EACCES;
234 goto out;
235 }
236
237 #ifdef CONFIG_SYS_MEM_RESERVE_SECURE
238 /*
239 * The SEC Firmware must be stored in secure memory.
240 * Append SEC Firmware to secure mmu table.
241 */
242 if (!(gd->arch.secure_ram & MEM_RESERVE_SECURE_MAINTAINED)) {
243 ret = -ENXIO;
244 goto out;
245 }
246
247 sec_firmware_addr = (gd->arch.secure_ram & MEM_RESERVE_SECURE_ADDR_MASK) +
248 gd->arch.tlb_size;
249 #else
250 #error "The CONFIG_SYS_MEM_RESERVE_SECURE must be defined when enabled SEC Firmware support"
251 #endif
252
253 /* Align SEC Firmware base address to 4K */
254 sec_firmware_addr = (sec_firmware_addr + 0xfff) & ~0xfff;
255 debug("SEC Firmware: Load address: 0x%llx\n",
256 sec_firmware_addr & SEC_FIRMWARE_ADDR_MASK);
257
258 ret = sec_firmware_parse_image(sec_firmware_img, &raw_image_addr,
259 &raw_image_size);
260 if (ret)
261 goto out;
262
263 /* TODO:
264 * Check if the end addr of SEC Firmware has been extend the secure
265 * memory.
266 */
267
268 /* Copy the secure firmware to secure memory */
269 ret = sec_firmware_copy_image("SEC Firmware", (u64)raw_image_addr,
270 raw_image_size, sec_firmware_addr &
271 SEC_FIRMWARE_ADDR_MASK);
272 if (ret)
273 goto out;
274
275 /*
276 * Check if any loadable are present along with firmware image, if
277 * present load them.
278 */
279 ret = sec_firmware_check_copy_loadable(sec_firmware_img, loadable_l,
280 loadable_h);
281 if (ret)
282 goto out;
283
284 sec_firmware_addr |= SEC_FIRMWARE_LOADED;
285 debug("SEC Firmware: Entry point: 0x%llx\n",
286 sec_firmware_addr & SEC_FIRMWARE_ADDR_MASK);
287
288 return 0;
289
290 out:
291 printf("SEC Firmware: error (%d)\n", ret);
292 sec_firmware_addr = 0;
293
294 return ret;
295 }
296
sec_firmware_entry(u32 * eret_hold_l,u32 * eret_hold_h)297 static int sec_firmware_entry(u32 *eret_hold_l, u32 *eret_hold_h)
298 {
299 const void *entry = (void *)(sec_firmware_addr &
300 SEC_FIRMWARE_ADDR_MASK);
301
302 return _sec_firmware_entry(entry, eret_hold_l, eret_hold_h);
303 }
304
305 /* Check the secure firmware FIT image */
sec_firmware_is_valid(const void * sec_firmware_img)306 __weak bool sec_firmware_is_valid(const void *sec_firmware_img)
307 {
308 if (fdt_check_header(sec_firmware_img)) {
309 printf("SEC Firmware: Bad firmware image (not a FIT image)\n");
310 return false;
311 }
312
313 if (!fit_check_format(sec_firmware_img)) {
314 printf("SEC Firmware: Bad firmware image (bad FIT header)\n");
315 return false;
316 }
317
318 return true;
319 }
320
321 #ifdef CONFIG_SEC_FIRMWARE_ARMV8_PSCI
322 /*
323 * The PSCI_VERSION function is added from PSCI v0.2. When the PSCI
324 * v0.1 received this function, the NOT_SUPPORTED (0xffff_ffff) error
325 * number will be returned according to SMC Calling Conventions. But
326 * when getting the NOT_SUPPORTED error number, we cannot ensure if
327 * the PSCI version is v0.1 or other error occurred. So, PSCI v0.1
328 * won't be supported by this framework.
329 * And if the secure firmware isn't running, return NOT_SUPPORTED.
330 *
331 * The return value on success is PSCI version in format
332 * major[31:16]:minor[15:0].
333 */
sec_firmware_support_psci_version(void)334 unsigned int sec_firmware_support_psci_version(void)
335 {
336 if (current_el() == SEC_FIRMWARE_TARGET_EL)
337 return _sec_firmware_support_psci_version();
338
339 return PSCI_INVALID_VER;
340 }
341 #endif
342
343 /*
344 * Check with sec_firmware if it supports random number generation
345 * via HW RNG
346 *
347 * The return value will be true if it is supported
348 */
sec_firmware_support_hwrng(void)349 bool sec_firmware_support_hwrng(void)
350 {
351 if (sec_firmware_addr & SEC_FIRMWARE_RUNNING) {
352 return true;
353 }
354
355 return false;
356 }
357
358 /*
359 * sec_firmware_get_random - Get a random number from SEC Firmware
360 * @rand: random number buffer to be filled
361 * @bytes: Number of bytes of random number to be supported
362 * @eret: -1 in case of error, 0 for success
363 */
sec_firmware_get_random(uint8_t * rand,int bytes)364 int sec_firmware_get_random(uint8_t *rand, int bytes)
365 {
366 unsigned long long num;
367 struct pt_regs regs;
368 int param1;
369
370 if (!bytes || bytes > 8) {
371 printf("Max Random bytes genration supported is 8\n");
372 return -1;
373 }
374 #define SIP_RNG_64 0xC200FF11
375 regs.regs[0] = SIP_RNG_64;
376
377 if (bytes <= 4)
378 param1 = 0;
379 else
380 param1 = 1;
381 regs.regs[1] = param1;
382
383 smc_call(®s);
384
385 if (regs.regs[0])
386 return -1;
387
388 num = regs.regs[1];
389 memcpy(rand, &num, bytes);
390
391 return 0;
392 }
393
394 /*
395 * sec_firmware_init - Initialize the SEC Firmware
396 * @sec_firmware_img: the SEC Firmware image address
397 * @eret_hold_l: the address to hold exception return address low
398 * @eret_hold_h: the address to hold exception return address high
399 * @loadable_l: the address to hold loadable address low
400 * @loadable_h: the address to hold loadable address high
401 */
sec_firmware_init(const void * sec_firmware_img,u32 * eret_hold_l,u32 * eret_hold_h,u32 * loadable_l,u32 * loadable_h)402 int sec_firmware_init(const void *sec_firmware_img,
403 u32 *eret_hold_l,
404 u32 *eret_hold_h,
405 u32 *loadable_l,
406 u32 *loadable_h)
407 {
408 int ret;
409
410 if (!sec_firmware_is_valid(sec_firmware_img))
411 return -EINVAL;
412
413 ret = sec_firmware_load_image(sec_firmware_img, loadable_l,
414 loadable_h);
415 if (ret) {
416 printf("SEC Firmware: Failed to load image\n");
417 return ret;
418 } else if (sec_firmware_addr & SEC_FIRMWARE_LOADED) {
419 ret = sec_firmware_entry(eret_hold_l, eret_hold_h);
420 if (ret) {
421 printf("SEC Firmware: Failed to initialize\n");
422 return ret;
423 }
424 }
425
426 debug("SEC Firmware: Return from SEC Firmware: current_el = %d\n",
427 current_el());
428
429 /*
430 * The PE will be turned into target EL when returned from
431 * SEC Firmware.
432 */
433 if (current_el() != SEC_FIRMWARE_TARGET_EL)
434 return -EACCES;
435
436 sec_firmware_addr |= SEC_FIRMWARE_RUNNING;
437
438 /* Set exception table and enable caches if it isn't EL3 */
439 if (current_el() != 3) {
440 c_runtime_cpu_setup();
441 enable_caches();
442 }
443
444 return 0;
445 }
446
447 /*
448 * fdt_fix_kaslr - Add kalsr-seed node in Device tree
449 * @fdt: Device tree
450 * @eret: 0 in case of error, 1 for success
451 */
fdt_fixup_kaslr(void * fdt)452 int fdt_fixup_kaslr(void *fdt)
453 {
454 int nodeoffset;
455 int err, ret = 0;
456 u8 rand[8];
457
458 #if defined(CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT)
459 /* Check if random seed generation is supported */
460 if (sec_firmware_support_hwrng() == false) {
461 printf("WARNING: SEC firmware not running, no kaslr-seed\n");
462 return 0;
463 }
464
465 ret = sec_firmware_get_random(rand, 8);
466 if (ret < 0) {
467 printf("WARNING: No random number to set kaslr-seed\n");
468 return 0;
469 }
470
471 err = fdt_check_header(fdt);
472 if (err < 0) {
473 printf("fdt_chosen: %s\n", fdt_strerror(err));
474 return 0;
475 }
476
477 /* find or create "/chosen" node. */
478 nodeoffset = fdt_find_or_add_subnode(fdt, 0, "chosen");
479 if (nodeoffset < 0)
480 return 0;
481
482 err = fdt_setprop(fdt, nodeoffset, "kaslr-seed", rand,
483 sizeof(rand));
484 if (err < 0) {
485 printf("WARNING: can't set kaslr-seed %s.\n",
486 fdt_strerror(err));
487 return 0;
488 }
489 ret = 1;
490 #endif
491
492 return ret;
493 }
494