drivers/firmware/turris-mox-rwtm.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  * Turris Mox rWTM firmware driver
   4  *
   5  * Copyright (C) 2019 Marek Behun <[email protected]>
   6  */
   7
   8 #include <linux/armada-37xx-rwtm-mailbox.h>
   9 #include <linux/completion.h>
  10 #include <linux/debugfs.h>
  11 #include <linux/dma-mapping.h>
  12 #include <linux/hw_random.h>
  13 #include <linux/mailbox_client.h>
  14 #include <linux/module.h>
  15 #include <linux/mutex.h>
  16 #include <linux/of.h>
  17 #include <linux/platform_device.h>
  18 #include <linux/slab.h>
  19
  20 #define DRIVER_NAME             "turris-mox-rwtm"
  21
  22 /*
  23  * The macros and constants below come from Turris Mox's rWTM firmware code.
  24  * This firmware is open source and it's sources can be found at
  25  * https://gitlab.labs.nic.cz/turris/mox-boot-builder/tree/master/wtmi.
  26  */
  27
  28 #define MBOX_STS_SUCCESS        (0 << 30)
  29 #define MBOX_STS_FAIL           (1 << 30)
  30 #define MBOX_STS_BADCMD         (2 << 30)
  31 #define MBOX_STS_ERROR(s)       ((s) & (3 << 30))
  32 #define MBOX_STS_VALUE(s)       (((s) >> 10) & 0xfffff)
  33 #define MBOX_STS_CMD(s)         ((s) & 0x3ff)
  34
  35 enum mbox_cmd {
  36         MBOX_CMD_GET_RANDOM     = 1,
  37         MBOX_CMD_BOARD_INFO     = 2,
  38         MBOX_CMD_ECDSA_PUB_KEY  = 3,
  39         MBOX_CMD_HASH           = 4,
  40         MBOX_CMD_SIGN           = 5,
  41         MBOX_CMD_VERIFY         = 6,
  42
  43         MBOX_CMD_OTP_READ       = 7,
  44         MBOX_CMD_OTP_WRITE      = 8,
  45 };
  46
  47 struct mox_kobject;
  48
  49 struct mox_rwtm {
  50         struct device *dev;
  51         struct mbox_client mbox_client;
  52         struct mbox_chan *mbox;
  53         struct mox_kobject *kobj;
  54         struct hwrng hwrng;
  55
  56         struct armada_37xx_rwtm_rx_msg reply;
  57
  58         void *buf;
  59         dma_addr_t buf_phys;
  60
  61         struct mutex busy;
  62         struct completion cmd_done;
  63
  64         /* board information */
  65         int has_board_info;
  66         u64 serial_number;
  67         int board_version, ram_size;
  68         u8 mac_address1[6], mac_address2[6];
  69
  70         /* public key burned in eFuse */
  71         int has_pubkey;
  72         u8 pubkey[135];
  73
  74 #ifdef CONFIG_DEBUG_FS
  75         /*
  76          * Signature process. This is currently done via debugfs, because it
  77          * does not conform to the sysfs standard "one file per attribute".
  78          * It should be rewritten via crypto API once akcipher API is available
  79          * from userspace.
  80          */
  81         struct dentry *debugfs_root;
  82         u32 last_sig[34];
  83         int last_sig_done;
  84 #endif
  85 };
  86
  87 struct mox_kobject {
  88         struct kobject kobj;
  89         struct mox_rwtm *rwtm;
  90 };
  91
  92 static inline struct kobject *rwtm_to_kobj(struct mox_rwtm *rwtm)
  93 {
  94         return &rwtm->kobj->kobj;
  95 }
  96
  97 static inline struct mox_rwtm *to_rwtm(struct kobject *kobj)
  98 {
  99         return container_of(kobj, struct mox_kobject, kobj)->rwtm;
 100 }
 101
 102 static void mox_kobj_release(struct kobject *kobj)
 103 {
 104         kfree(to_rwtm(kobj)->kobj);
 105 }
 106
 107 static struct kobj_type mox_kobj_ktype = {
 108         .release        = mox_kobj_release,
 109         .sysfs_ops      = &kobj_sysfs_ops,
 110 };
 111
 112 static int mox_kobj_create(struct mox_rwtm *rwtm)
 113 {
 114         rwtm->kobj = kzalloc(sizeof(*rwtm->kobj), GFP_KERNEL);
 115         if (!rwtm->kobj)
 116                 return -ENOMEM;
 117
 118         kobject_init(rwtm_to_kobj(rwtm), &mox_kobj_ktype);
 119         if (kobject_add(rwtm_to_kobj(rwtm), firmware_kobj, "turris-mox-rwtm")) {
 120                 kobject_put(rwtm_to_kobj(rwtm));
 121                 return -ENXIO;
 122         }
 123
 124         rwtm->kobj->rwtm = rwtm;
 125
 126         return 0;
 127 }
 128
 129 #define MOX_ATTR_RO(name, format, cat)                          \
 130 static ssize_t                                                  \
 131 name##_show(struct kobject *kobj, struct kobj_attribute *a,     \
 132             char *buf)                                          \
 133 {                                                               \
 134         struct mox_rwtm *rwtm = to_rwtm(kobj);  \
 135         if (!rwtm->has_##cat)                                   \
 136                 return -ENODATA;                                \
 137         return sprintf(buf, format, rwtm->name);                \
 138 }                                                               \
 139 static struct kobj_attribute mox_attr_##name = __ATTR_RO(name)
 140
 141 MOX_ATTR_RO(serial_number, "%016llX\n", board_info);
 142 MOX_ATTR_RO(board_version, "%i\n", board_info);
 143 MOX_ATTR_RO(ram_size, "%i\n", board_info);
 144 MOX_ATTR_RO(mac_address1, "%pM\n", board_info);
 145 MOX_ATTR_RO(mac_address2, "%pM\n", board_info);
 146 MOX_ATTR_RO(pubkey, "%s\n", pubkey);
 147
 148 static int mox_get_status(enum mbox_cmd cmd, u32 retval)
 149 {
 150         if (MBOX_STS_CMD(retval) != cmd ||
 151             MBOX_STS_ERROR(retval) != MBOX_STS_SUCCESS)
 152                 return -EIO;
 153         else if (MBOX_STS_ERROR(retval) == MBOX_STS_FAIL)
 154                 return -(int)MBOX_STS_VALUE(retval);
 155         else
 156                 return MBOX_STS_VALUE(retval);
 157 }
 158
 159 static const struct attribute *mox_rwtm_attrs[] = {
 160         &mox_attr_serial_number.attr,
 161         &mox_attr_board_version.attr,
 162         &mox_attr_ram_size.attr,
 163         &mox_attr_mac_address1.attr,
 164         &mox_attr_mac_address2.attr,
 165         &mox_attr_pubkey.attr,
 166         NULL
 167 };
 168
 169 static void mox_rwtm_rx_callback(struct mbox_client *cl, void *data)
 170 {
 171         struct mox_rwtm *rwtm = dev_get_drvdata(cl->dev);
 172         struct armada_37xx_rwtm_rx_msg *msg = data;
 173
 174         rwtm->reply = *msg;
 175         complete(&rwtm->cmd_done);
 176 }
 177
 178 static void reply_to_mac_addr(u8 *mac, u32 t1, u32 t2)
 179 {
 180         mac[0] = t1 >> 8;
 181         mac[1] = t1;
 182         mac[2] = t2 >> 24;
 183         mac[3] = t2 >> 16;
 184         mac[4] = t2 >> 8;
 185         mac[5] = t2;
 186 }
 187
 188 static int mox_get_board_info(struct mox_rwtm *rwtm)
 189 {
 190         struct armada_37xx_rwtm_tx_msg msg;
 191         struct armada_37xx_rwtm_rx_msg *reply = &rwtm->reply;
 192         int ret;
 193
 194         msg.command = MBOX_CMD_BOARD_INFO;
 195         ret = mbox_send_message(rwtm->mbox, &msg);
 196         if (ret < 0)
 197                 return ret;
 198
 199         ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
 200         if (ret < 0)
 201                 return ret;
 202
 203         ret = mox_get_status(MBOX_CMD_BOARD_INFO, reply->retval);
 204         if (ret < 0 && ret != -ENODATA) {
 205                 return ret;
 206         } else if (ret == -ENODATA) {
 207                 dev_warn(rwtm->dev,
 208                          "Board does not have manufacturing information burned!\n");
 209         } else {
 210                 rwtm->serial_number = reply->status[1];
 211                 rwtm->serial_number <<= 32;
 212                 rwtm->serial_number |= reply->status[0];
 213                 rwtm->board_version = reply->status[2];
 214                 rwtm->ram_size = reply->status[3];
 215                 reply_to_mac_addr(rwtm->mac_address1, reply->status[4],
 216                                   reply->status[5]);
 217                 reply_to_mac_addr(rwtm->mac_address2, reply->status[6],
 218                                   reply->status[7]);
 219                 rwtm->has_board_info = 1;
 220
 221                 pr_info("Turris Mox serial number %016llX\n",
 222                         rwtm->serial_number);
 223                 pr_info("           board version %i\n", rwtm->board_version);
 224                 pr_info("           burned RAM size %i MiB\n", rwtm->ram_size);
 225         }
 226
 227         msg.command = MBOX_CMD_ECDSA_PUB_KEY;
 228         ret = mbox_send_message(rwtm->mbox, &msg);
 229         if (ret < 0)
 230                 return ret;
 231
 232         ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2);
 233         if (ret < 0)
 234                 return ret;
 235
 236         ret = mox_get_status(MBOX_CMD_ECDSA_PUB_KEY, reply->retval);
 237         if (ret < 0 && ret != -ENODATA) {
 238                 return ret;
 239         } else if (ret == -ENODATA) {
 240                 dev_warn(rwtm->dev, "Board has no public key burned!\n");
 241         } else {
 242                 u32 *s = reply->status;
 243
 244                 rwtm->has_pubkey = 1;
 245                 sprintf(rwtm->pubkey,
 246                         "%06x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x",
 247                         ret, s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7],
 248                         s[8], s[9], s[10], s[11], s[12], s[13], s[14], s[15]);
 249         }
 250
 251         return 0;
 252 }
 253
 254 static int mox_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait)
 255 {
 256         struct mox_rwtm *rwtm = (struct mox_rwtm *) rng->priv;
 257         struct armada_37xx_rwtm_tx_msg msg;
 258         int ret;
 259
 260         if (max > 4096)
 261                 max = 4096;
 262
 263         msg.command = MBOX_CMD_GET_RANDOM;
 264         msg.args[0] = 1;
 265         msg.args[1] = rwtm->buf_phys;
 266         msg.args[2] = (max + 3) & ~3;
 267
 268         if (!wait) {
 269                 if (!mutex_trylock(&rwtm->busy))
 270                         return -EBUSY;
 271         } else {
 272                 mutex_lock(&rwtm->busy);
 273         }
 274
 275         ret = mbox_send_message(rwtm->mbox, &msg);
 276         if (ret < 0)
 277                 goto unlock_mutex;
 278
 279         ret = wait_for_completion_interruptible(&rwtm->cmd_done);
 280         if (ret < 0)
 281                 goto unlock_mutex;
 282
 283         ret = mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval);
 284         if (ret < 0)
 285                 goto unlock_mutex;
 286
 287         memcpy(data, rwtm->buf, max);
 288         ret = max;
 289
 290 unlock_mutex:
 291         mutex_unlock(&rwtm->busy);
 292         return ret;
 293 }
 294
 295 #ifdef CONFIG_DEBUG_FS
 296 static int rwtm_debug_open(struct inode *inode, struct file *file)
 297 {
 298         file->private_data = inode->i_private;
 299
 300         return nonseekable_open(inode, file);
 301 }
 302
 303 static ssize_t do_sign_read(struct file *file, char __user *buf, size_t len,
 304                             loff_t *ppos)
 305 {
 306         struct mox_rwtm *rwtm = file->private_data;
 307         ssize_t ret;
 308
 309         /* only allow one read, of 136 bytes, from position 0 */
 310         if (*ppos != 0)
 311                 return 0;
 312
 313         if (len < 136)
 314                 return -EINVAL;
 315
 316         if (!rwtm->last_sig_done)
 317                 return -ENODATA;
 318
 319         /* 2 arrays of 17 32-bit words are 136 bytes */
 320         ret = simple_read_from_buffer(buf, len, ppos, rwtm->last_sig, 136);
 321         rwtm->last_sig_done = 0;
 322
 323         return ret;
 324 }
 325
 326 static ssize_t do_sign_write(struct file *file, const char __user *buf,
 327                              size_t len, loff_t *ppos)
 328 {
 329         struct mox_rwtm *rwtm = file->private_data;
 330         struct armada_37xx_rwtm_rx_msg *reply = &rwtm->reply;
 331         struct armada_37xx_rwtm_tx_msg msg;
 332         loff_t dummy = 0;
 333         ssize_t ret;
 334
 335         /* the input is a SHA-512 hash, so exactly 64 bytes have to be read */
 336         if (len != 64)
 337                 return -EINVAL;
 338
 339         /* if last result is not zero user has not read that information yet */
 340         if (rwtm->last_sig_done)
 341                 return -EBUSY;
 342
 343         if (!mutex_trylock(&rwtm->busy))
 344                 return -EBUSY;
 345
 346         /*
 347          * Here we have to send:
 348          *   1. Address of the input to sign.
 349          *      The input is an array of 17 32-bit words, the first (most
 350          *      significat) is 0, the rest 16 words are copied from the SHA-512
 351          *      hash given by the user and converted from BE to LE.
 352          *   2. Address of the buffer where ECDSA signature value R shall be
 353          *      stored by the rWTM firmware.
 354          *   3. Address of the buffer where ECDSA signature value S shall be
 355          *      stored by the rWTM firmware.
 356          */
 357         memset(rwtm->buf, 0, 4);
 358         ret = simple_write_to_buffer(rwtm->buf + 4, 64, &dummy, buf, len);
 359         if (ret < 0)
 360                 goto unlock_mutex;
 361         be32_to_cpu_array(rwtm->buf, rwtm->buf, 17);
 362
 363         msg.command = MBOX_CMD_SIGN;
 364         msg.args[0] = 1;
 365         msg.args[1] = rwtm->buf_phys;
 366         msg.args[2] = rwtm->buf_phys + 68;
 367         msg.args[3] = rwtm->buf_phys + 2 * 68;
 368         ret = mbox_send_message(rwtm->mbox, &msg);
 369         if (ret < 0)
 370                 goto unlock_mutex;
 371
 372         ret = wait_for_completion_interruptible(&rwtm->cmd_done);
 373         if (ret < 0)
 374                 goto unlock_mutex;
 375
 376         ret = MBOX_STS_VALUE(reply->retval);
 377         if (MBOX_STS_ERROR(reply->retval) != MBOX_STS_SUCCESS)
 378                 goto unlock_mutex;
 379
 380         /*
 381          * Here we read the R and S values of the ECDSA signature
 382          * computed by the rWTM firmware and convert their words from
 383          * LE to BE.
 384          */
 385         memcpy(rwtm->last_sig, rwtm->buf + 68, 136);
 386         cpu_to_be32_array(rwtm->last_sig, rwtm->last_sig, 34);
 387         rwtm->last_sig_done = 1;
 388
 389         mutex_unlock(&rwtm->busy);
 390         return len;
 391 unlock_mutex:
 392         mutex_unlock(&rwtm->busy);
 393         return ret;
 394 }
 395
 396 static const struct file_operations do_sign_fops = {
 397         .owner  = THIS_MODULE,
 398         .open   = rwtm_debug_open,
 399         .read   = do_sign_read,
 400         .write  = do_sign_write,
 401         .llseek = no_llseek,
 402 };
 403
 404 static int rwtm_register_debugfs(struct mox_rwtm *rwtm)
 405 {
 406         struct dentry *root, *entry;
 407
 408         root = debugfs_create_dir("turris-mox-rwtm", NULL);
 409
 410         if (IS_ERR(root))
 411                 return PTR_ERR(root);
 412
 413         entry = debugfs_create_file_unsafe("do_sign", 0600, root, rwtm,
 414                                            &do_sign_fops);
 415         if (IS_ERR(entry))
 416                 goto err_remove;
 417
 418         rwtm->debugfs_root = root;
 419
 420         return 0;
 421 err_remove:
 422         debugfs_remove_recursive(root);
 423         return PTR_ERR(entry);
 424 }
 425
 426 static void rwtm_unregister_debugfs(struct mox_rwtm *rwtm)
 427 {
 428         debugfs_remove_recursive(rwtm->debugfs_root);
 429 }
 430 #else
 431 static inline int rwtm_register_debugfs(struct mox_rwtm *rwtm)
 432 {
 433         return 0;
 434 }
 435
 436 static inline void rwtm_unregister_debugfs(struct mox_rwtm *rwtm)
 437 {
 438 }
 439 #endif
 440
 441 static int turris_mox_rwtm_probe(struct platform_device *pdev)
 442 {
 443         struct mox_rwtm *rwtm;
 444         struct device *dev = &pdev->dev;
 445         int ret;
 446
 447         rwtm = devm_kzalloc(dev, sizeof(*rwtm), GFP_KERNEL);
 448         if (!rwtm)
 449                 return -ENOMEM;
 450
 451         rwtm->dev = dev;
 452         rwtm->buf = dmam_alloc_coherent(dev, PAGE_SIZE, &rwtm->buf_phys,
 453                                         GFP_KERNEL);
 454         if (!rwtm->buf)
 455                 return -ENOMEM;
 456
 457         ret = mox_kobj_create(rwtm);
 458         if (ret < 0) {
 459                 dev_err(dev, "Cannot create turris-mox-rwtm kobject!\n");
 460                 return ret;
 461         }
 462
 463         ret = sysfs_create_files(rwtm_to_kobj(rwtm), mox_rwtm_attrs);
 464         if (ret < 0) {
 465                 dev_err(dev, "Cannot create sysfs files!\n");
 466                 goto put_kobj;
 467         }
 468
 469         platform_set_drvdata(pdev, rwtm);
 470
 471         mutex_init(&rwtm->busy);
 472
 473         rwtm->mbox_client.dev = dev;
 474         rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback;
 475
 476         rwtm->mbox = mbox_request_channel(&rwtm->mbox_client, 0);
 477         if (IS_ERR(rwtm->mbox)) {
 478                 ret = PTR_ERR(rwtm->mbox);
 479                 if (ret != -EPROBE_DEFER)
 480                         dev_err(dev, "Cannot request mailbox channel: %i\n",
 481                                 ret);
 482                 goto remove_files;
 483         }
 484
 485         init_completion(&rwtm->cmd_done);
 486
 487         ret = mox_get_board_info(rwtm);
 488         if (ret < 0)
 489                 dev_warn(dev, "Cannot read board information: %i\n", ret);
 490
 491         rwtm->hwrng.name = DRIVER_NAME "_hwrng";
 492         rwtm->hwrng.read = mox_hwrng_read;
 493         rwtm->hwrng.priv = (unsigned long) rwtm;
 494         rwtm->hwrng.quality = 1024;
 495
 496         ret = devm_hwrng_register(dev, &rwtm->hwrng);
 497         if (ret < 0) {
 498                 dev_err(dev, "Cannot register HWRNG: %i\n", ret);
 499                 goto free_channel;
 500         }
 501
 502         ret = rwtm_register_debugfs(rwtm);
 503         if (ret < 0) {
 504                 dev_err(dev, "Failed creating debugfs entries: %i\n", ret);
 505                 goto free_channel;
 506         }
 507
 508         return 0;
 509
 510 free_channel:
 511         mbox_free_channel(rwtm->mbox);
 512 remove_files:
 513         sysfs_remove_files(rwtm_to_kobj(rwtm), mox_rwtm_attrs);
 514 put_kobj:
 515         kobject_put(rwtm_to_kobj(rwtm));
 516         return ret;
 517 }
 518
 519 static int turris_mox_rwtm_remove(struct platform_device *pdev)
 520 {
 521         struct mox_rwtm *rwtm = platform_get_drvdata(pdev);
 522
 523         rwtm_unregister_debugfs(rwtm);
 524         sysfs_remove_files(rwtm_to_kobj(rwtm), mox_rwtm_attrs);
 525         kobject_put(rwtm_to_kobj(rwtm));
 526         mbox_free_channel(rwtm->mbox);
 527
 528         return 0;
 529 }
 530
 531 static const struct of_device_id turris_mox_rwtm_match[] = {
 532         { .compatible = "cznic,turris-mox-rwtm", },
 533         { },
 534 };
 535
 536 MODULE_DEVICE_TABLE(of, turris_mox_rwtm_match);
 537
 538 static struct platform_driver turris_mox_rwtm_driver = {
 539         .probe  = turris_mox_rwtm_probe,
 540         .remove = turris_mox_rwtm_remove,
 541         .driver = {
 542                 .name           = DRIVER_NAME,
 543                 .of_match_table = turris_mox_rwtm_match,
 544         },
 545 };
 546 module_platform_driver(turris_mox_rwtm_driver);
 547
 548 MODULE_LICENSE("GPL v2");
 549 MODULE_DESCRIPTION("Turris Mox rWTM firmware driver");
 550 MODULE_AUTHOR("Marek Behun <[email protected]>");