1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * Copyright 2016 NXP Semiconductor, Inc.
4 */
5
6 #include <common.h>
7 #include <errno.h>
8 #include <linux/kernel.h>
9 #include <asm/io.h>
10 #include <asm/system.h>
11 #include <asm/types.h>
12 #include <asm/macro.h>
13 #include <asm/armv8/sec_firmware.h>
14
15 DECLARE_GLOBAL_DATA_PTR;
16 extern void c_runtime_cpu_setup(void);
17
18 #define SEC_FIRMWARE_LOADED 0x1
19 #define SEC_FIRMWARE_RUNNING 0x2
20 #define SEC_FIRMWARE_ADDR_MASK (~0x3)
21 /*
22 * Secure firmware load addr
23 * Flags used: 0x1 secure firmware has been loaded to secure memory
24 * 0x2 secure firmware is running
25 */
26 phys_addr_t sec_firmware_addr;
27
28 #ifndef SEC_FIRMWARE_FIT_IMAGE
29 #define SEC_FIRMWARE_FIT_IMAGE "firmware"
30 #endif
31 #ifndef SEC_FIRMEWARE_FIT_CNF_NAME
32 #define SEC_FIRMEWARE_FIT_CNF_NAME "config-1"
33 #endif
34 #ifndef SEC_FIRMWARE_TARGET_EL
35 #define SEC_FIRMWARE_TARGET_EL 2
36 #endif
37
sec_firmware_get_data(const void * sec_firmware_img,const void ** data,size_t * size)38 static int sec_firmware_get_data(const void *sec_firmware_img,
39 const void **data, size_t *size)
40 {
41 int conf_node_off, fw_node_off;
42 char *conf_node_name = NULL;
43 char *desc;
44 int ret;
45
46 conf_node_name = SEC_FIRMEWARE_FIT_CNF_NAME;
47
48 conf_node_off = fit_conf_get_node(sec_firmware_img, conf_node_name);
49 if (conf_node_off < 0) {
50 printf("SEC Firmware: %s: no such config\n", conf_node_name);
51 return -ENOENT;
52 }
53
54 fw_node_off = fit_conf_get_prop_node(sec_firmware_img, conf_node_off,
55 SEC_FIRMWARE_FIT_IMAGE);
56 if (fw_node_off < 0) {
57 printf("SEC Firmware: No '%s' in config\n",
58 SEC_FIRMWARE_FIT_IMAGE);
59 return -ENOLINK;
60 }
61
62 /* Verify secure firmware image */
63 if (!(fit_image_verify(sec_firmware_img, fw_node_off))) {
64 printf("SEC Firmware: Bad firmware image (bad CRC)\n");
65 return -EINVAL;
66 }
67
68 if (fit_image_get_data(sec_firmware_img, fw_node_off, data, size)) {
69 printf("SEC Firmware: Can't get %s subimage data/size",
70 SEC_FIRMWARE_FIT_IMAGE);
71 return -ENOENT;
72 }
73
74 ret = fit_get_desc(sec_firmware_img, fw_node_off, &desc);
75 if (ret)
76 printf("SEC Firmware: Can't get description\n");
77 else
78 printf("%s\n", desc);
79
80 return ret;
81 }
82
83 /*
84 * SEC Firmware FIT image parser checks if the image is in FIT
85 * format, verifies integrity of the image and calculates raw
86 * image address and size values.
87 *
88 * Returns 0 on success and a negative errno on error task fail.
89 */
sec_firmware_parse_image(const void * sec_firmware_img,const void ** raw_image_addr,size_t * raw_image_size)90 static int sec_firmware_parse_image(const void *sec_firmware_img,
91 const void **raw_image_addr,
92 size_t *raw_image_size)
93 {
94 int ret;
95
96 ret = sec_firmware_get_data(sec_firmware_img, raw_image_addr,
97 raw_image_size);
98 if (ret)
99 return ret;
100
101 debug("SEC Firmware: raw_image_addr = 0x%p, raw_image_size = 0x%lx\n",
102 *raw_image_addr, *raw_image_size);
103
104 return 0;
105 }
106
107 /*
108 * SEC Firmware FIT image parser to check if any loadable is
109 * present. If present, verify integrity of the loadable and
110 * copy loadable to address provided in (loadable_h, loadable_l).
111 *
112 * Returns 0 on success and a negative errno on error task fail.
113 */
sec_firmware_check_copy_loadable(const void * sec_firmware_img,u32 * loadable_l,u32 * loadable_h)114 static int sec_firmware_check_copy_loadable(const void *sec_firmware_img,
115 u32 *loadable_l, u32 *loadable_h)
116 {
117 phys_addr_t sec_firmware_loadable_addr = 0;
118 int conf_node_off, ld_node_off, images;
119 char *conf_node_name = NULL;
120 const void *data;
121 size_t size;
122 ulong load;
123 const char *name, *str, *type;
124 int len;
125
126 conf_node_name = SEC_FIRMEWARE_FIT_CNF_NAME;
127
128 conf_node_off = fit_conf_get_node(sec_firmware_img, conf_node_name);
129 if (conf_node_off < 0) {
130 printf("SEC Firmware: %s: no such config\n", conf_node_name);
131 return -ENOENT;
132 }
133
134 /* find the node holding the images information */
135 images = fdt_path_offset(sec_firmware_img, FIT_IMAGES_PATH);
136 if (images < 0) {
137 printf("%s: Cannot find /images node: %d\n", __func__, images);
138 return -1;
139 }
140
141 type = FIT_LOADABLE_PROP;
142
143 name = fdt_getprop(sec_firmware_img, conf_node_off, type, &len);
144 if (!name) {
145 /* Loadables not present */
146 return 0;
147 }
148
149 printf("SEC Firmware: '%s' present in config\n", type);
150
151 for (str = name; str && ((str - name) < len);
152 str = strchr(str, '\0') + 1) {
153 printf("%s: '%s'\n", type, str);
154 ld_node_off = fdt_subnode_offset(sec_firmware_img, images, str);
155 if (ld_node_off < 0) {
156 printf("cannot find image node '%s': %d\n", str,
157 ld_node_off);
158 return -EINVAL;
159 }
160
161 /* Verify secure firmware image */
162 if (!(fit_image_verify(sec_firmware_img, ld_node_off))) {
163 printf("SEC Loadable: Bad loadable image (bad CRC)\n");
164 return -EINVAL;
165 }
166
167 if (fit_image_get_data(sec_firmware_img, ld_node_off,
168 &data, &size)) {
169 printf("SEC Loadable: Can't get subimage data/size");
170 return -ENOENT;
171 }
172
173 /* Get load address, treated as load offset to secure memory */
174 if (fit_image_get_load(sec_firmware_img, ld_node_off, &load)) {
175 printf("SEC Loadable: Can't get subimage load");
176 return -ENOENT;
177 }
178
179 /* Compute load address for loadable in secure memory */
180 sec_firmware_loadable_addr = (sec_firmware_addr -
181 gd->arch.tlb_size) + load;
182
183 /* Copy loadable to secure memory and flush dcache */
184 debug("%s copied to address 0x%p\n",
185 FIT_LOADABLE_PROP, (void *)sec_firmware_loadable_addr);
186 memcpy((void *)sec_firmware_loadable_addr, data, size);
187 flush_dcache_range(sec_firmware_loadable_addr,
188 sec_firmware_loadable_addr + size);
189
190 /* Populate loadable address only for Trusted OS */
191 if (!strcmp(str, "trustedOS@1")) {
192 /*
193 * Populate address ptrs for loadable image with
194 * loadbale addr
195 */
196 out_le32(loadable_l, (sec_firmware_loadable_addr &
197 WORD_MASK));
198 out_le32(loadable_h, (sec_firmware_loadable_addr >>
199 WORD_SHIFT));
200 }
201 }
202
203 return 0;
204 }
205
sec_firmware_copy_image(const char * title,u64 image_addr,u32 image_size,u64 sec_firmware)206 static int sec_firmware_copy_image(const char *title,
207 u64 image_addr, u32 image_size, u64 sec_firmware)
208 {
209 debug("%s copied to address 0x%p\n", title, (void *)sec_firmware);
210 memcpy((void *)sec_firmware, (void *)image_addr, image_size);
211 flush_dcache_range(sec_firmware, sec_firmware + image_size);
212
213 return 0;
214 }
215
216 /*
217 * This function will parse the SEC Firmware image, and then load it
218 * to secure memory. Also load any loadable if present along with SEC
219 * Firmware image.
220 */
sec_firmware_load_image(const void * sec_firmware_img,u32 * loadable_l,u32 * loadable_h)221 static int sec_firmware_load_image(const void *sec_firmware_img,
222 u32 *loadable_l, u32 *loadable_h)
223 {
224 const void *raw_image_addr;
225 size_t raw_image_size = 0;
226 int ret;
227
228 /*
229 * The Excetpion Level must be EL3 to load and initialize
230 * the SEC Firmware.
231 */
232 if (current_el() != 3) {
233 ret = -EACCES;
234 goto out;
235 }
236
237 #ifdef CONFIG_SYS_MEM_RESERVE_SECURE
238 /*
239 * The SEC Firmware must be stored in secure memory.
240 * Append SEC Firmware to secure mmu table.
241 */
242 if (!(gd->arch.secure_ram & MEM_RESERVE_SECURE_MAINTAINED)) {
243 ret = -ENXIO;
244 goto out;
245 }
246
247 sec_firmware_addr = (gd->arch.secure_ram & MEM_RESERVE_SECURE_ADDR_MASK) +
248 gd->arch.tlb_size;
249 #else
250 #error "The CONFIG_SYS_MEM_RESERVE_SECURE must be defined when enabled SEC Firmware support"
251 #endif
252
253 /* Align SEC Firmware base address to 4K */
254 sec_firmware_addr = (sec_firmware_addr + 0xfff) & ~0xfff;
255 debug("SEC Firmware: Load address: 0x%llx\n",
256 sec_firmware_addr & SEC_FIRMWARE_ADDR_MASK);
257
258 ret = sec_firmware_parse_image(sec_firmware_img, &raw_image_addr,
259 &raw_image_size);
260 if (ret)
261 goto out;
262
263 /* TODO:
264 * Check if the end addr of SEC Firmware has been extend the secure
265 * memory.
266 */
267
268 /* Copy the secure firmware to secure memory */
269 ret = sec_firmware_copy_image("SEC Firmware", (u64)raw_image_addr,
270 raw_image_size, sec_firmware_addr &
271 SEC_FIRMWARE_ADDR_MASK);
272 if (ret)
273 goto out;
274
275 /*
276 * Check if any loadable are present along with firmware image, if
277 * present load them.
278 */
279 ret = sec_firmware_check_copy_loadable(sec_firmware_img, loadable_l,
280 loadable_h);
281 if (ret)
282 goto out;
283
284 sec_firmware_addr |= SEC_FIRMWARE_LOADED;
285 debug("SEC Firmware: Entry point: 0x%llx\n",
286 sec_firmware_addr & SEC_FIRMWARE_ADDR_MASK);
287
288 return 0;
289
290 out:
291 printf("SEC Firmware: error (%d)\n", ret);
292 sec_firmware_addr = 0;
293
294 return ret;
295 }
296
sec_firmware_entry(u32 * eret_hold_l,u32 * eret_hold_h)297 static int sec_firmware_entry(u32 *eret_hold_l, u32 *eret_hold_h)
298 {
299 const void *entry = (void *)(sec_firmware_addr &
300 SEC_FIRMWARE_ADDR_MASK);
301
302 return _sec_firmware_entry(entry, eret_hold_l, eret_hold_h);
303 }
304
305 /* Check the secure firmware FIT image */
sec_firmware_is_valid(const void * sec_firmware_img)306 __weak bool sec_firmware_is_valid(const void *sec_firmware_img)
307 {
308 if (fdt_check_header(sec_firmware_img)) {
309 printf("SEC Firmware: Bad firmware image (not a FIT image)\n");
310 return false;
311 }
312
313 if (!fit_check_format(sec_firmware_img)) {
314 printf("SEC Firmware: Bad firmware image (bad FIT header)\n");
315 return false;
316 }
317
318 return true;
319 }
320
321 #ifdef CONFIG_SEC_FIRMWARE_ARMV8_PSCI
322 /*
323 * The PSCI_VERSION function is added from PSCI v0.2. When the PSCI
324 * v0.1 received this function, the NOT_SUPPORTED (0xffff_ffff) error
325 * number will be returned according to SMC Calling Conventions. But
326 * when getting the NOT_SUPPORTED error number, we cannot ensure if
327 * the PSCI version is v0.1 or other error occurred. So, PSCI v0.1
328 * won't be supported by this framework.
329 * And if the secure firmware isn't running, return NOT_SUPPORTED.
330 *
331 * The return value on success is PSCI version in format
332 * major[31:16]:minor[15:0].
333 */
sec_firmware_support_psci_version(void)334 unsigned int sec_firmware_support_psci_version(void)
335 {
336 if (current_el() == SEC_FIRMWARE_TARGET_EL)
337 return _sec_firmware_support_psci_version();
338
339 return PSCI_INVALID_VER;
340 }
341 #endif
342
343 /*
344 * Check with sec_firmware if it supports random number generation
345 * via HW RNG
346 *
347 * The return value will be true if it is supported
348 */
sec_firmware_support_hwrng(void)349 bool sec_firmware_support_hwrng(void)
350 {
351 #ifdef CONFIG_TFABOOT
352 /* return true as TFA has one job ring reserved */
353 return true;
354 #endif
355 if (sec_firmware_addr & SEC_FIRMWARE_RUNNING) {
356 return true;
357 }
358
359 return false;
360 }
361
362 /*
363 * sec_firmware_get_random - Get a random number from SEC Firmware
364 * @rand: random number buffer to be filled
365 * @bytes: Number of bytes of random number to be supported
366 * @eret: -1 in case of error, 0 for success
367 */
sec_firmware_get_random(uint8_t * rand,int bytes)368 int sec_firmware_get_random(uint8_t *rand, int bytes)
369 {
370 unsigned long long num;
371 struct pt_regs regs;
372 int param1;
373
374 if (!bytes || bytes > 8) {
375 printf("Max Random bytes genration supported is 8\n");
376 return -1;
377 }
378 #define SIP_RNG_64 0xC200FF11
379 regs.regs[0] = SIP_RNG_64;
380
381 if (bytes <= 4)
382 param1 = 0;
383 else
384 param1 = 1;
385 regs.regs[1] = param1;
386
387 smc_call(®s);
388
389 if (regs.regs[0])
390 return -1;
391
392 num = regs.regs[1];
393 memcpy(rand, &num, bytes);
394
395 return 0;
396 }
397
398 /*
399 * sec_firmware_init - Initialize the SEC Firmware
400 * @sec_firmware_img: the SEC Firmware image address
401 * @eret_hold_l: the address to hold exception return address low
402 * @eret_hold_h: the address to hold exception return address high
403 * @loadable_l: the address to hold loadable address low
404 * @loadable_h: the address to hold loadable address high
405 */
sec_firmware_init(const void * sec_firmware_img,u32 * eret_hold_l,u32 * eret_hold_h,u32 * loadable_l,u32 * loadable_h)406 int sec_firmware_init(const void *sec_firmware_img,
407 u32 *eret_hold_l,
408 u32 *eret_hold_h,
409 u32 *loadable_l,
410 u32 *loadable_h)
411 {
412 int ret;
413
414 if (!sec_firmware_is_valid(sec_firmware_img))
415 return -EINVAL;
416
417 ret = sec_firmware_load_image(sec_firmware_img, loadable_l,
418 loadable_h);
419 if (ret) {
420 printf("SEC Firmware: Failed to load image\n");
421 return ret;
422 } else if (sec_firmware_addr & SEC_FIRMWARE_LOADED) {
423 ret = sec_firmware_entry(eret_hold_l, eret_hold_h);
424 if (ret) {
425 printf("SEC Firmware: Failed to initialize\n");
426 return ret;
427 }
428 }
429
430 debug("SEC Firmware: Return from SEC Firmware: current_el = %d\n",
431 current_el());
432
433 /*
434 * The PE will be turned into target EL when returned from
435 * SEC Firmware.
436 */
437 if (current_el() != SEC_FIRMWARE_TARGET_EL)
438 return -EACCES;
439
440 sec_firmware_addr |= SEC_FIRMWARE_RUNNING;
441
442 /* Set exception table and enable caches if it isn't EL3 */
443 if (current_el() != 3) {
444 c_runtime_cpu_setup();
445 enable_caches();
446 }
447
448 return 0;
449 }
450
451 /*
452 * fdt_fix_kaslr - Add kalsr-seed node in Device tree
453 * @fdt: Device tree
454 * @eret: 0 in case of error, 1 for success
455 */
fdt_fixup_kaslr(void * fdt)456 int fdt_fixup_kaslr(void *fdt)
457 {
458 int nodeoffset;
459 int err, ret = 0;
460 u8 rand[8];
461
462 #if defined(CONFIG_ARMV8_SEC_FIRMWARE_SUPPORT)
463 /* Check if random seed generation is supported */
464 if (sec_firmware_support_hwrng() == false) {
465 printf("WARNING: SEC firmware not running, no kaslr-seed\n");
466 return 0;
467 }
468
469 ret = sec_firmware_get_random(rand, 8);
470 if (ret < 0) {
471 printf("WARNING: No random number to set kaslr-seed\n");
472 return 0;
473 }
474
475 err = fdt_check_header(fdt);
476 if (err < 0) {
477 printf("fdt_chosen: %s\n", fdt_strerror(err));
478 return 0;
479 }
480
481 /* find or create "/chosen" node. */
482 nodeoffset = fdt_find_or_add_subnode(fdt, 0, "chosen");
483 if (nodeoffset < 0)
484 return 0;
485
486 err = fdt_setprop(fdt, nodeoffset, "kaslr-seed", rand,
487 sizeof(rand));
488 if (err < 0) {
489 printf("WARNING: can't set kaslr-seed %s.\n",
490 fdt_strerror(err));
491 return 0;
492 }
493 ret = 1;
494 #endif
495
496 return ret;
497 }
498