xref: /openbmc/linux/drivers/crypto/ccree/cc_fips.c (revision e86eca41)
1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (C) 2012-2019 ARM Limited (or its affiliates). */
3 
4 #include <linux/kernel.h>
5 #include <linux/fips.h>
6 #include <linux/notifier.h>
7 
8 #include "cc_driver.h"
9 #include "cc_fips.h"
10 
11 static void fips_dsr(unsigned long devarg);
12 
13 struct cc_fips_handle {
14 	struct tasklet_struct tasklet;
15 	struct notifier_block nb;
16 	struct cc_drvdata *drvdata;
17 };
18 
19 /* The function called once at driver entry point to check
20  * whether TEE FIPS error occurred.
21  */
cc_get_tee_fips_status(struct cc_drvdata * drvdata)22 static bool cc_get_tee_fips_status(struct cc_drvdata *drvdata)
23 {
24 	u32 reg;
25 
26 	reg = cc_ioread(drvdata, CC_REG(GPR_HOST));
27 	/* Did the TEE report status? */
28 	if (reg & CC_FIPS_SYNC_TEE_STATUS)
29 		/* Yes. Is it OK? */
30 		return (reg & CC_FIPS_SYNC_MODULE_OK);
31 
32 	/* No. It's either not in use or will be reported later */
33 	return true;
34 }
35 
36 /*
37  * This function should push the FIPS REE library status towards the TEE library
38  * by writing the error state to HOST_GPR0 register.
39  */
cc_set_ree_fips_status(struct cc_drvdata * drvdata,bool status)40 void cc_set_ree_fips_status(struct cc_drvdata *drvdata, bool status)
41 {
42 	int val = CC_FIPS_SYNC_REE_STATUS;
43 
44 	if (drvdata->hw_rev < CC_HW_REV_712)
45 		return;
46 
47 	val |= (status ? CC_FIPS_SYNC_MODULE_OK : CC_FIPS_SYNC_MODULE_ERROR);
48 
49 	cc_iowrite(drvdata, CC_REG(HOST_GPR0), val);
50 }
51 
52 /* Push REE side FIPS test failure to TEE side */
cc_ree_fips_failure(struct notifier_block * nb,unsigned long unused1,void * unused2)53 static int cc_ree_fips_failure(struct notifier_block *nb, unsigned long unused1,
54 			       void *unused2)
55 {
56 	struct cc_fips_handle *fips_h =
57 				container_of(nb, struct cc_fips_handle, nb);
58 	struct cc_drvdata *drvdata = fips_h->drvdata;
59 	struct device *dev = drvdata_to_dev(drvdata);
60 
61 	cc_set_ree_fips_status(drvdata, false);
62 	dev_info(dev, "Notifying TEE of FIPS test failure...\n");
63 
64 	return NOTIFY_OK;
65 }
66 
cc_fips_fini(struct cc_drvdata * drvdata)67 void cc_fips_fini(struct cc_drvdata *drvdata)
68 {
69 	struct cc_fips_handle *fips_h = drvdata->fips_handle;
70 
71 	if (drvdata->hw_rev < CC_HW_REV_712 || !fips_h)
72 		return;
73 
74 	atomic_notifier_chain_unregister(&fips_fail_notif_chain, &fips_h->nb);
75 
76 	/* Kill tasklet */
77 	tasklet_kill(&fips_h->tasklet);
78 	drvdata->fips_handle = NULL;
79 }
80 
fips_handler(struct cc_drvdata * drvdata)81 void fips_handler(struct cc_drvdata *drvdata)
82 {
83 	struct cc_fips_handle *fips_handle_ptr = drvdata->fips_handle;
84 
85 	if (drvdata->hw_rev < CC_HW_REV_712)
86 		return;
87 
88 	tasklet_schedule(&fips_handle_ptr->tasklet);
89 }
90 
tee_fips_error(struct device * dev)91 static inline void tee_fips_error(struct device *dev)
92 {
93 	if (fips_enabled)
94 		panic("ccree: TEE reported cryptographic error in fips mode!\n");
95 	else
96 		dev_err(dev, "TEE reported error!\n");
97 }
98 
99 /*
100  * This function check if cryptocell tee fips error occurred
101  * and in such case triggers system error
102  */
cc_tee_handle_fips_error(struct cc_drvdata * p_drvdata)103 void cc_tee_handle_fips_error(struct cc_drvdata *p_drvdata)
104 {
105 	struct device *dev = drvdata_to_dev(p_drvdata);
106 
107 	if (!cc_get_tee_fips_status(p_drvdata))
108 		tee_fips_error(dev);
109 }
110 
111 /* Deferred service handler, run as interrupt-fired tasklet */
fips_dsr(unsigned long devarg)112 static void fips_dsr(unsigned long devarg)
113 {
114 	struct cc_drvdata *drvdata = (struct cc_drvdata *)devarg;
115 	u32 irq, val;
116 
117 	irq = (drvdata->irq & (CC_GPR0_IRQ_MASK));
118 
119 	if (irq) {
120 		cc_tee_handle_fips_error(drvdata);
121 	}
122 
123 	/* after verifying that there is nothing to do,
124 	 * unmask AXI completion interrupt.
125 	 */
126 	val = (CC_REG(HOST_IMR) & ~irq);
127 	cc_iowrite(drvdata, CC_REG(HOST_IMR), val);
128 }
129 
130 /* The function called once at driver entry point .*/
cc_fips_init(struct cc_drvdata * p_drvdata)131 int cc_fips_init(struct cc_drvdata *p_drvdata)
132 {
133 	struct cc_fips_handle *fips_h;
134 	struct device *dev = drvdata_to_dev(p_drvdata);
135 
136 	if (p_drvdata->hw_rev < CC_HW_REV_712)
137 		return 0;
138 
139 	fips_h = devm_kzalloc(dev, sizeof(*fips_h), GFP_KERNEL);
140 	if (!fips_h)
141 		return -ENOMEM;
142 
143 	p_drvdata->fips_handle = fips_h;
144 
145 	dev_dbg(dev, "Initializing fips tasklet\n");
146 	tasklet_init(&fips_h->tasklet, fips_dsr, (unsigned long)p_drvdata);
147 	fips_h->drvdata = p_drvdata;
148 	fips_h->nb.notifier_call = cc_ree_fips_failure;
149 	atomic_notifier_chain_register(&fips_fail_notif_chain, &fips_h->nb);
150 
151 	cc_tee_handle_fips_error(p_drvdata);
152 
153 	return 0;
154 }
155