drivers/firmware/turris-mox-rwtm.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Turris Mox rWTM firmware driver
   4  *
   5  * Copyright (C) 2019, 2024 Marek Behún <[email protected]>
   6  */
   7
   8 #include <crypto/sha2.h>
   9 #include <linux/align.h>
  10 #include <linux/armada-37xx-rwtm-mailbox.h>
  11 #include <linux/completion.h>
  12 #include <linux/container_of.h>
  13 #include <linux/debugfs.h>
  14 #include <linux/device.h>
  15 #include <linux/dma-mapping.h>
  16 #include <linux/err.h>
  17 #include <linux/fs.h>
  18 #include <linux/hw_random.h>
  19 #include <linux/if_ether.h>
  20 #include <linux/kobject.h>
  21 #include <linux/mailbox_client.h>
  22 #include <linux/minmax.h>
  23 #include <linux/module.h>
  24 #include <linux/mutex.h>
  25 #include <linux/platform_device.h>
  26 #include <linux/sizes.h>
  27 #include <linux/sysfs.h>
  28 #include <linux/types.h>
  29
  30 #define DRIVER_NAME             "turris-mox-rwtm"
  31
  32 #define RWTM_DMA_BUFFER_SIZE    SZ_4K
  33
  34 /*
  35  * The macros and constants below come from Turris Mox's rWTM firmware code.
  36  * This firmware is open source and it's sources can be found at
  37  * https://gitlab.labs.nic.cz/turris/mox-boot-builder/tree/master/wtmi.
  38  */
  39
  40 #define MOX_ECC_NUMBER_WORDS    17
  41 #define MOX_ECC_NUMBER_LEN      (MOX_ECC_NUMBER_WORDS * sizeof(u32))
  42
  43 #define MOX_ECC_SIGNATURE_WORDS (2 * MOX_ECC_NUMBER_WORDS)
  44
  45 #define MBOX_STS_SUCCESS        (0 << 30)
  46 #define MBOX_STS_FAIL           (1 << 30)
  47 #define MBOX_STS_BADCMD         (2 << 30)
  48 #define MBOX_STS_ERROR(s)       ((s) & (3 << 30))
  49 #define MBOX_STS_VALUE(s)       (((s) >> 10) & 0xfffff)
  50 #define MBOX_STS_CMD(s)         ((s) & 0x3ff)
  51
  52 enum mbox_cmd {
  53         MBOX_CMD_GET_RANDOM     = 1,
  54         MBOX_CMD_BOARD_INFO     = 2,
  55         MBOX_CMD_ECDSA_PUB_KEY  = 3,
  56         MBOX_CMD_HASH           = 4,
  57         MBOX_CMD_SIGN           = 5,
  58         MBOX_CMD_VERIFY         = 6,
  59
  60         MBOX_CMD_OTP_READ       = 7,
  61         MBOX_CMD_OTP_WRITE      = 8,
  62 };
  63
  64 struct mox_rwtm {
  65         struct mbox_client mbox_client;
  66         struct mbox_chan *mbox;
  67         struct hwrng hwrng;
  68
  69         struct armada_37xx_rwtm_rx_msg reply;
  70
  71         void *buf;
  72         dma_addr_t buf_phys;
  73
  74         struct mutex busy;
  75         struct completion cmd_done;
  76
  77         /* board information */
  78         bool has_board_info;
  79         u64 serial_number;
  80         int board_version, ram_size;
  81         u8 mac_address1[ETH_ALEN], mac_address2[ETH_ALEN];
  82
  83         /* public key burned in eFuse */
  84         bool has_pubkey;
  85         u8 pubkey[135];
  86
  87 #ifdef CONFIG_DEBUG_FS
  88         /*
  89          * Signature process. This is currently done via debugfs, because it
  90          * does not conform to the sysfs standard "one file per attribute".
  91          * It should be rewritten via crypto API once akcipher API is available
  92          * from userspace.
  93          */
  94         u32 last_sig[MOX_ECC_SIGNATURE_WORDS];
  95         bool last_sig_done;
  96 #endif
  97 };
  98
  99 static inline struct device *rwtm_dev(struct mox_rwtm *rwtm)
 100 {
 101         return rwtm->mbox_client.dev;
 102 }
 103
 104 #define MOX_ATTR_RO(name, format, cat)                          \
 105 static ssize_t                                                  \
 106 name##_show(struct device *dev, struct device_attribute *a,     \
 107             char *buf)                                          \
 108 {                                                               \
 109         struct mox_rwtm *rwtm = dev_get_drvdata(dev);           \
 110         if (!rwtm->has_##cat)                                   \
 111                 return -ENODATA;                                \
 112         return sysfs_emit(buf, format, rwtm->name);             \
 113 }                                                               \
 114 static DEVICE_ATTR_RO(name)
 115
 116 MOX_ATTR_RO(serial_number, "%016llX\n", board_info);
 117 MOX_ATTR_RO(board_version, "%i\n", board_info);
 118 MOX_ATTR_RO(ram_size, "%i\n", board_info);
 119 MOX_ATTR_RO(mac_address1, "%pM\n", board_info);
 120 MOX_ATTR_RO(mac_address2, "%pM\n", board_info);
 121 MOX_ATTR_RO(pubkey, "%s\n", pubkey);
 122
 123 static struct attribute *turris_mox_rwtm_attrs[] = {
 124         &dev_attr_serial_number.attr,
 125         &dev_attr_board_version.attr,
 126         &dev_attr_ram_size.attr,
 127         &dev_attr_mac_address1.attr,
 128         &dev_attr_mac_address2.attr,
 129         &dev_attr_pubkey.attr,
 130         NULL
 131 };
 132 ATTRIBUTE_GROUPS(turris_mox_rwtm);
 133
 134 static int mox_get_status(enum mbox_cmd cmd, u32 retval)
 135 {
 136         if (MBOX_STS_CMD(retval) != cmd)
 137                 return -EIO;
 138         else if (MBOX_STS_ERROR(retval) == MBOX_STS_FAIL)
 139                 return -(int)MBOX_STS_VALUE(retval);
 140         else if (MBOX_STS_ERROR(retval) == MBOX_STS_BADCMD)
 141                 return -EOPNOTSUPP;
 142         else if (MBOX_STS_ERROR(retval) != MBOX_STS_SUCCESS)
 143                 return -EIO;
 144         else
 145                 return MBOX_STS_VALUE(retval);
 146 }
 147
 148 static void mox_rwtm_rx_callback(struct mbox_client *cl, void *data)
 149 {
 150         struct mox_rwtm *rwtm = dev_get_drvdata(cl->dev);
 151         struct armada_37xx_rwtm_rx_msg *msg = data;
 152
 153         if (completion_done(&rwtm->cmd_done))
 154                 return;
 155
 156         rwtm->reply = *msg;
 157         complete(&rwtm->cmd_done);
 158 }
 159
 160 static int mox_rwtm_exec(struct mox_rwtm *rwtm, enum mbox_cmd cmd,
 161                          struct armada_37xx_rwtm_tx_msg *msg,
 162                          bool interruptible)
 163 {
 164         struct armada_37xx_rwtm_tx_msg _msg = {};
 165         int ret;
 166
 167         if (!msg)
 168                 msg = &_msg;
 169
 170         msg->command = cmd;
 171
 172         ret = mbox_send_message(rwtm->mbox, msg);
 173         if (ret < 0)
 174                 return ret;
 175
 176         if (interruptible) {
 177                 ret = wait_for_completion_interruptible(&rwtm->cmd_done);
 178                 if (ret < 0)
 179                         return ret;
 180         } else {
 181                 if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2))
 182                         return -ETIMEDOUT;
 183         }
 184
 185         return mox_get_status(cmd, rwtm->reply.retval);
 186 }
 187
 188 static void reply_to_mac_addr(u8 *mac, u32 t1, u32 t2)
 189 {
 190         mac[0] = t1 >> 8;
 191         mac[1] = t1;
 192         mac[2] = t2 >> 24;
 193         mac[3] = t2 >> 16;
 194         mac[4] = t2 >> 8;
 195         mac[5] = t2;
 196 }
 197
 198 static int mox_get_board_info(struct mox_rwtm *rwtm)
 199 {
 200         struct device *dev = rwtm_dev(rwtm);
 201         struct armada_37xx_rwtm_rx_msg *reply = &rwtm->reply;
 202         int ret;
 203
 204         ret = mox_rwtm_exec(rwtm, MBOX_CMD_BOARD_INFO, NULL, false);
 205         if (ret == -ENODATA) {
 206                 dev_warn(dev,
 207                          "Board does not have manufacturing information burned!\n");
 208         } else if (ret == -EOPNOTSUPP) {
 209                 dev_notice(dev,
 210                            "Firmware does not support the BOARD_INFO command\n");
 211         } else if (ret < 0) {
 212                 return ret;
 213         } else {
 214                 rwtm->serial_number = reply->status[1];
 215                 rwtm->serial_number <<= 32;
 216                 rwtm->serial_number |= reply->status[0];
 217                 rwtm->board_version = reply->status[2];
 218                 rwtm->ram_size = reply->status[3];
 219                 reply_to_mac_addr(rwtm->mac_address1, reply->status[4],
 220                                   reply->status[5]);
 221                 reply_to_mac_addr(rwtm->mac_address2, reply->status[6],
 222                                   reply->status[7]);
 223                 rwtm->has_board_info = true;
 224
 225                 pr_info("Turris Mox serial number %016llX\n",
 226                         rwtm->serial_number);
 227                 pr_info("           board version %i\n", rwtm->board_version);
 228                 pr_info("           burned RAM size %i MiB\n", rwtm->ram_size);
 229         }
 230
 231         ret = mox_rwtm_exec(rwtm, MBOX_CMD_ECDSA_PUB_KEY, NULL, false);
 232         if (ret == -ENODATA) {
 233                 dev_warn(dev, "Board has no public key burned!\n");
 234         } else if (ret == -EOPNOTSUPP) {
 235                 dev_notice(dev,
 236                            "Firmware does not support the ECDSA_PUB_KEY command\n");
 237         } else if (ret < 0) {
 238                 return ret;
 239         } else {
 240                 u32 *s = reply->status;
 241
 242                 rwtm->has_pubkey = true;
 243                 sprintf(rwtm->pubkey,
 244                         "%06x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x",
 245                         ret, s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
 246                         s[8], s[9], s[10], s[11], s[12], s[13], s[14], s[15]);
 247         }
 248
 249         return 0;
 250 }
 251
 252 static int check_get_random_support(struct mox_rwtm *rwtm)
 253 {
 254         struct armada_37xx_rwtm_tx_msg msg = {
 255                 .args = { 1, rwtm->buf_phys, 4 },
 256         };
 257
 258         return mox_rwtm_exec(rwtm, MBOX_CMD_GET_RANDOM, &msg, false);
 259 }
 260
 261 static int mox_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 262 {
 263         struct mox_rwtm *rwtm = container_of(rng, struct mox_rwtm, hwrng);
 264         struct armada_37xx_rwtm_tx_msg msg = {
 265                 .args = { 1, rwtm->buf_phys, ALIGN(max, 4) },
 266         };
 267         int ret;
 268
 269         max = min(max, RWTM_DMA_BUFFER_SIZE);
 270
 271         if (!wait) {
 272                 if (!mutex_trylock(&rwtm->busy))
 273                         return -EBUSY;
 274         } else {
 275                 mutex_lock(&rwtm->busy);
 276         }
 277
 278         ret = mox_rwtm_exec(rwtm, MBOX_CMD_GET_RANDOM, &msg, true);
 279         if (ret < 0)
 280                 goto unlock_mutex;
 281
 282         memcpy(data, rwtm->buf, max);
 283         ret = max;
 284
 285 unlock_mutex:
 286         mutex_unlock(&rwtm->busy);
 287         return ret;
 288 }
 289
 290 #ifdef CONFIG_DEBUG_FS
 291 static int rwtm_debug_open(struct inode *inode, struct file *file)
 292 {
 293         file->private_data = inode->i_private;
 294
 295         return nonseekable_open(inode, file);
 296 }
 297
 298 static ssize_t do_sign_read(struct file *file, char __user *buf, size_t len,
 299                             loff_t *ppos)
 300 {
 301         struct mox_rwtm *rwtm = file->private_data;
 302         ssize_t ret;
 303
 304         /* only allow one read, of whole signature, from position 0 */
 305         if (*ppos != 0)
 306                 return 0;
 307
 308         if (len < sizeof(rwtm->last_sig))
 309                 return -EINVAL;
 310
 311         if (!rwtm->last_sig_done)
 312                 return -ENODATA;
 313
 314         ret = simple_read_from_buffer(buf, len, ppos, rwtm->last_sig,
 315                                       sizeof(rwtm->last_sig));
 316         rwtm->last_sig_done = false;
 317
 318         return ret;
 319 }
 320
 321 static ssize_t do_sign_write(struct file *file, const char __user *buf,
 322                              size_t len, loff_t *ppos)
 323 {
 324         struct mox_rwtm *rwtm = file->private_data;
 325         struct armada_37xx_rwtm_tx_msg msg;
 326         loff_t dummy = 0;
 327         ssize_t ret;
 328
 329         if (len != SHA512_DIGEST_SIZE)
 330                 return -EINVAL;
 331
 332         /* if last result is not zero user has not read that information yet */
 333         if (rwtm->last_sig_done)
 334                 return -EBUSY;
 335
 336         if (!mutex_trylock(&rwtm->busy))
 337                 return -EBUSY;
 338
 339         /*
 340          * Here we have to send:
 341          *   1. Address of the input to sign.
 342          *      The input is an array of 17 32-bit words, the first (most
 343          *      significat) is 0, the rest 16 words are copied from the SHA-512
 344          *      hash given by the user and converted from BE to LE.
 345          *   2. Address of the buffer where ECDSA signature value R shall be
 346          *      stored by the rWTM firmware.
 347          *   3. Address of the buffer where ECDSA signature value S shall be
 348          *      stored by the rWTM firmware.
 349          */
 350         memset(rwtm->buf, 0, sizeof(u32));
 351         ret = simple_write_to_buffer(rwtm->buf + sizeof(u32),
 352                                      SHA512_DIGEST_SIZE, &dummy, buf, len);
 353         if (ret < 0)
 354                 goto unlock_mutex;
 355         be32_to_cpu_array(rwtm->buf, rwtm->buf, MOX_ECC_NUMBER_WORDS);
 356
 357         msg.args[0] = 1;
 358         msg.args[1] = rwtm->buf_phys;
 359         msg.args[2] = rwtm->buf_phys + MOX_ECC_NUMBER_LEN;
 360         msg.args[3] = rwtm->buf_phys + 2 * MOX_ECC_NUMBER_LEN;
 361
 362         ret = mox_rwtm_exec(rwtm, MBOX_CMD_SIGN, &msg, true);
 363         if (ret < 0)
 364                 goto unlock_mutex;
 365
 366         /*
 367          * Here we read the R and S values of the ECDSA signature
 368          * computed by the rWTM firmware and convert their words from
 369          * LE to BE.
 370          */
 371         memcpy(rwtm->last_sig, rwtm->buf + MOX_ECC_NUMBER_LEN,
 372                sizeof(rwtm->last_sig));
 373         cpu_to_be32_array(rwtm->last_sig, rwtm->last_sig,
 374                           MOX_ECC_SIGNATURE_WORDS);
 375         rwtm->last_sig_done = true;
 376
 377         mutex_unlock(&rwtm->busy);
 378         return len;
 379 unlock_mutex:
 380         mutex_unlock(&rwtm->busy);
 381         return ret;
 382 }
 383
 384 static const struct file_operations do_sign_fops = {
 385         .owner  = THIS_MODULE,
 386         .open   = rwtm_debug_open,
 387         .read   = do_sign_read,
 388         .write  = do_sign_write,
 389 };
 390
 391 static void rwtm_debugfs_release(void *root)
 392 {
 393         debugfs_remove_recursive(root);
 394 }
 395
 396 static void rwtm_register_debugfs(struct mox_rwtm *rwtm)
 397 {
 398         struct dentry *root;
 399
 400         root = debugfs_create_dir("turris-mox-rwtm", NULL);
 401
 402         debugfs_create_file_unsafe("do_sign", 0600, root, rwtm, &do_sign_fops);
 403
 404         devm_add_action_or_reset(rwtm_dev(rwtm), rwtm_debugfs_release, root);
 405 }
 406 #else
 407 static inline void rwtm_register_debugfs(struct mox_rwtm *rwtm)
 408 {
 409 }
 410 #endif
 411
 412 static void rwtm_devm_mbox_release(void *mbox)
 413 {
 414         mbox_free_channel(mbox);
 415 }
 416
 417 static void rwtm_firmware_symlink_drop(void *parent)
 418 {
 419         sysfs_remove_link(parent, DRIVER_NAME);
 420 }
 421
 422 static int turris_mox_rwtm_probe(struct platform_device *pdev)
 423 {
 424         struct mox_rwtm *rwtm;
 425         struct device *dev = &pdev->dev;
 426         int ret;
 427
 428         rwtm = devm_kzalloc(dev, sizeof(*rwtm), GFP_KERNEL);
 429         if (!rwtm)
 430                 return -ENOMEM;
 431
 432         rwtm->buf = dmam_alloc_coherent(dev, RWTM_DMA_BUFFER_SIZE,
 433                                         &rwtm->buf_phys, GFP_KERNEL);
 434         if (!rwtm->buf)
 435                 return -ENOMEM;
 436
 437         platform_set_drvdata(pdev, rwtm);
 438
 439         ret = devm_mutex_init(dev, &rwtm->busy);
 440         if (ret)
 441                 return ret;
 442
 443         init_completion(&rwtm->cmd_done);
 444
 445         rwtm->mbox_client.dev = dev;
 446         rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback;
 447
 448         rwtm->mbox = mbox_request_channel(&rwtm->mbox_client, 0);
 449         if (IS_ERR(rwtm->mbox))
 450                 return dev_err_probe(dev, PTR_ERR(rwtm->mbox),
 451                                      "Cannot request mailbox channel!\n");
 452
 453         ret = devm_add_action_or_reset(dev, rwtm_devm_mbox_release, rwtm->mbox);
 454         if (ret)
 455                 return ret;
 456
 457         ret = mox_get_board_info(rwtm);
 458         if (ret < 0)
 459                 dev_warn(dev, "Cannot read board information: %i\n", ret);
 460
 461         ret = check_get_random_support(rwtm);
 462         if (ret < 0) {
 463                 dev_notice(dev,
 464                            "Firmware does not support the GET_RANDOM command\n");
 465                 return ret;
 466         }
 467
 468         rwtm->hwrng.name = DRIVER_NAME "_hwrng";
 469         rwtm->hwrng.read = mox_hwrng_read;
 470
 471         ret = devm_hwrng_register(dev, &rwtm->hwrng);
 472         if (ret)
 473                 return dev_err_probe(dev, ret, "Cannot register HWRNG!\n");
 474
 475         rwtm_register_debugfs(rwtm);
 476
 477         dev_info(dev, "HWRNG successfully registered\n");
 478
 479         /*
 480          * For sysfs ABI compatibility, create symlink
 481          * /sys/firmware/turris-mox-rwtm to this device's sysfs directory.
 482          */
 483         ret = sysfs_create_link(firmware_kobj, &dev->kobj, DRIVER_NAME);
 484         if (!ret)
 485                 devm_add_action_or_reset(dev, rwtm_firmware_symlink_drop,
 486                                          firmware_kobj);
 487
 488         return 0;
 489 }
 490
 491 static const struct of_device_id turris_mox_rwtm_match[] = {
 492         { .compatible = "cznic,turris-mox-rwtm", },
 493         { .compatible = "marvell,armada-3700-rwtm-firmware", },
 494         { },
 495 };
 496
 497 MODULE_DEVICE_TABLE(of, turris_mox_rwtm_match);
 498
 499 static struct platform_driver turris_mox_rwtm_driver = {
 500         .probe  = turris_mox_rwtm_probe,
 501         .driver = {
 502                 .name           = DRIVER_NAME,
 503                 .of_match_table = turris_mox_rwtm_match,
 504                 .dev_groups     = turris_mox_rwtm_groups,
 505         },
 506 };
 507 module_platform_driver(turris_mox_rwtm_driver);
 508
 509 MODULE_LICENSE("GPL v2");
 510 MODULE_DESCRIPTION("Turris Mox rWTM firmware driver");
 511 MODULE_AUTHOR("Marek Behun <[email protected]>");