1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Turris Mox rWTM firmware driver 4 * 5 * Copyright (C) 2019, 2024 Marek Behún <kabel@kernel.org> 6 */ 7 8 #include <linux/armada-37xx-rwtm-mailbox.h> 9 #include <linux/completion.h> 10 #include <linux/debugfs.h> 11 #include <linux/dma-mapping.h> 12 #include <linux/hw_random.h> 13 #include <linux/mailbox_client.h> 14 #include <linux/module.h> 15 #include <linux/mutex.h> 16 #include <linux/of.h> 17 #include <linux/platform_device.h> 18 #include <linux/slab.h> 19 20 #define DRIVER_NAME "turris-mox-rwtm" 21 22 /* 23 * The macros and constants below come from Turris Mox's rWTM firmware code. 24 * This firmware is open source and it's sources can be found at 25 * https://gitlab.labs.nic.cz/turris/mox-boot-builder/tree/master/wtmi. 26 */ 27 28 #define MBOX_STS_SUCCESS (0 << 30) 29 #define MBOX_STS_FAIL (1 << 30) 30 #define MBOX_STS_BADCMD (2 << 30) 31 #define MBOX_STS_ERROR(s) ((s) & (3 << 30)) 32 #define MBOX_STS_VALUE(s) (((s) >> 10) & 0xfffff) 33 #define MBOX_STS_CMD(s) ((s) & 0x3ff) 34 35 enum mbox_cmd { 36 MBOX_CMD_GET_RANDOM = 1, 37 MBOX_CMD_BOARD_INFO = 2, 38 MBOX_CMD_ECDSA_PUB_KEY = 3, 39 MBOX_CMD_HASH = 4, 40 MBOX_CMD_SIGN = 5, 41 MBOX_CMD_VERIFY = 6, 42 43 MBOX_CMD_OTP_READ = 7, 44 MBOX_CMD_OTP_WRITE = 8, 45 }; 46 47 struct mox_kobject; 48 49 struct mox_rwtm { 50 struct device *dev; 51 struct mbox_client mbox_client; 52 struct mbox_chan *mbox; 53 struct mox_kobject *kobj; 54 struct hwrng hwrng; 55 56 struct armada_37xx_rwtm_rx_msg reply; 57 58 void *buf; 59 dma_addr_t buf_phys; 60 61 struct mutex busy; 62 struct completion cmd_done; 63 64 /* board information */ 65 int has_board_info; 66 u64 serial_number; 67 int board_version, ram_size; 68 u8 mac_address1[6], mac_address2[6]; 69 70 /* public key burned in eFuse */ 71 int has_pubkey; 72 u8 pubkey[135]; 73 74 #ifdef CONFIG_DEBUG_FS 75 /* 76 * Signature process. This is currently done via debugfs, because it 77 * does not conform to the sysfs standard "one file per attribute". 78 * It should be rewritten via crypto API once akcipher API is available 79 * from userspace. 80 */ 81 struct dentry *debugfs_root; 82 u32 last_sig[34]; 83 int last_sig_done; 84 #endif 85 }; 86 87 struct mox_kobject { 88 struct kobject kobj; 89 struct mox_rwtm *rwtm; 90 }; 91 92 static inline struct kobject *rwtm_to_kobj(struct mox_rwtm *rwtm) 93 { 94 return &rwtm->kobj->kobj; 95 } 96 97 static inline struct mox_rwtm *to_rwtm(struct kobject *kobj) 98 { 99 return container_of(kobj, struct mox_kobject, kobj)->rwtm; 100 } 101 102 static void mox_kobj_release(struct kobject *kobj) 103 { 104 kfree(to_rwtm(kobj)->kobj); 105 } 106 107 static const struct kobj_type mox_kobj_ktype = { 108 .release = mox_kobj_release, 109 .sysfs_ops = &kobj_sysfs_ops, 110 }; 111 112 static int mox_kobj_create(struct mox_rwtm *rwtm) 113 { 114 rwtm->kobj = kzalloc(sizeof(*rwtm->kobj), GFP_KERNEL); 115 if (!rwtm->kobj) 116 return -ENOMEM; 117 118 kobject_init(rwtm_to_kobj(rwtm), &mox_kobj_ktype); 119 if (kobject_add(rwtm_to_kobj(rwtm), firmware_kobj, "turris-mox-rwtm")) { 120 kobject_put(rwtm_to_kobj(rwtm)); 121 return -ENXIO; 122 } 123 124 rwtm->kobj->rwtm = rwtm; 125 126 return 0; 127 } 128 129 #define MOX_ATTR_RO(name, format, cat) \ 130 static ssize_t \ 131 name##_show(struct kobject *kobj, struct kobj_attribute *a, \ 132 char *buf) \ 133 { \ 134 struct mox_rwtm *rwtm = to_rwtm(kobj); \ 135 if (!rwtm->has_##cat) \ 136 return -ENODATA; \ 137 return sprintf(buf, format, rwtm->name); \ 138 } \ 139 static struct kobj_attribute mox_attr_##name = __ATTR_RO(name) 140 141 MOX_ATTR_RO(serial_number, "%016llX\n", board_info); 142 MOX_ATTR_RO(board_version, "%i\n", board_info); 143 MOX_ATTR_RO(ram_size, "%i\n", board_info); 144 MOX_ATTR_RO(mac_address1, "%pM\n", board_info); 145 MOX_ATTR_RO(mac_address2, "%pM\n", board_info); 146 MOX_ATTR_RO(pubkey, "%s\n", pubkey); 147 148 static int mox_get_status(enum mbox_cmd cmd, u32 retval) 149 { 150 if (MBOX_STS_CMD(retval) != cmd) 151 return -EIO; 152 else if (MBOX_STS_ERROR(retval) == MBOX_STS_FAIL) 153 return -(int)MBOX_STS_VALUE(retval); 154 else if (MBOX_STS_ERROR(retval) == MBOX_STS_BADCMD) 155 return -ENOSYS; 156 else if (MBOX_STS_ERROR(retval) != MBOX_STS_SUCCESS) 157 return -EIO; 158 else 159 return MBOX_STS_VALUE(retval); 160 } 161 162 static const struct attribute *mox_rwtm_attrs[] = { 163 &mox_attr_serial_number.attr, 164 &mox_attr_board_version.attr, 165 &mox_attr_ram_size.attr, 166 &mox_attr_mac_address1.attr, 167 &mox_attr_mac_address2.attr, 168 &mox_attr_pubkey.attr, 169 NULL 170 }; 171 172 static void mox_rwtm_rx_callback(struct mbox_client *cl, void *data) 173 { 174 struct mox_rwtm *rwtm = dev_get_drvdata(cl->dev); 175 struct armada_37xx_rwtm_rx_msg *msg = data; 176 177 if (completion_done(&rwtm->cmd_done)) 178 return; 179 180 rwtm->reply = *msg; 181 complete(&rwtm->cmd_done); 182 } 183 184 static void reply_to_mac_addr(u8 *mac, u32 t1, u32 t2) 185 { 186 mac[0] = t1 >> 8; 187 mac[1] = t1; 188 mac[2] = t2 >> 24; 189 mac[3] = t2 >> 16; 190 mac[4] = t2 >> 8; 191 mac[5] = t2; 192 } 193 194 static int mox_get_board_info(struct mox_rwtm *rwtm) 195 { 196 struct armada_37xx_rwtm_tx_msg msg; 197 struct armada_37xx_rwtm_rx_msg *reply = &rwtm->reply; 198 int ret; 199 200 msg.command = MBOX_CMD_BOARD_INFO; 201 ret = mbox_send_message(rwtm->mbox, &msg); 202 if (ret < 0) 203 return ret; 204 205 if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) 206 return -ETIMEDOUT; 207 208 ret = mox_get_status(MBOX_CMD_BOARD_INFO, reply->retval); 209 if (ret == -ENODATA) { 210 dev_warn(rwtm->dev, 211 "Board does not have manufacturing information burned!\n"); 212 } else if (ret == -ENOSYS) { 213 dev_notice(rwtm->dev, 214 "Firmware does not support the BOARD_INFO command\n"); 215 } else if (ret < 0) { 216 return ret; 217 } else { 218 rwtm->serial_number = reply->status[1]; 219 rwtm->serial_number <<= 32; 220 rwtm->serial_number |= reply->status[0]; 221 rwtm->board_version = reply->status[2]; 222 rwtm->ram_size = reply->status[3]; 223 reply_to_mac_addr(rwtm->mac_address1, reply->status[4], 224 reply->status[5]); 225 reply_to_mac_addr(rwtm->mac_address2, reply->status[6], 226 reply->status[7]); 227 rwtm->has_board_info = 1; 228 229 pr_info("Turris Mox serial number %016llX\n", 230 rwtm->serial_number); 231 pr_info(" board version %i\n", rwtm->board_version); 232 pr_info(" burned RAM size %i MiB\n", rwtm->ram_size); 233 } 234 235 msg.command = MBOX_CMD_ECDSA_PUB_KEY; 236 ret = mbox_send_message(rwtm->mbox, &msg); 237 if (ret < 0) 238 return ret; 239 240 if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) 241 return -ETIMEDOUT; 242 243 ret = mox_get_status(MBOX_CMD_ECDSA_PUB_KEY, reply->retval); 244 if (ret == -ENODATA) { 245 dev_warn(rwtm->dev, "Board has no public key burned!\n"); 246 } else if (ret == -ENOSYS) { 247 dev_notice(rwtm->dev, 248 "Firmware does not support the ECDSA_PUB_KEY command\n"); 249 } else if (ret < 0) { 250 return ret; 251 } else { 252 u32 *s = reply->status; 253 254 rwtm->has_pubkey = 1; 255 sprintf(rwtm->pubkey, 256 "%06x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x%08x", 257 ret, s[0], s[1], s[2], s[3], s[4], s[5], s[6], s[7], 258 s[8], s[9], s[10], s[11], s[12], s[13], s[14], s[15]); 259 } 260 261 return 0; 262 } 263 264 static int check_get_random_support(struct mox_rwtm *rwtm) 265 { 266 struct armada_37xx_rwtm_tx_msg msg; 267 int ret; 268 269 msg.command = MBOX_CMD_GET_RANDOM; 270 msg.args[0] = 1; 271 msg.args[1] = rwtm->buf_phys; 272 msg.args[2] = 4; 273 274 ret = mbox_send_message(rwtm->mbox, &msg); 275 if (ret < 0) 276 return ret; 277 278 if (!wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2)) 279 return -ETIMEDOUT; 280 281 return mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval); 282 } 283 284 static int mox_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) 285 { 286 struct mox_rwtm *rwtm = (struct mox_rwtm *) rng->priv; 287 struct armada_37xx_rwtm_tx_msg msg; 288 int ret; 289 290 if (max > 4096) 291 max = 4096; 292 293 msg.command = MBOX_CMD_GET_RANDOM; 294 msg.args[0] = 1; 295 msg.args[1] = rwtm->buf_phys; 296 msg.args[2] = (max + 3) & ~3; 297 298 if (!wait) { 299 if (!mutex_trylock(&rwtm->busy)) 300 return -EBUSY; 301 } else { 302 mutex_lock(&rwtm->busy); 303 } 304 305 ret = mbox_send_message(rwtm->mbox, &msg); 306 if (ret < 0) 307 goto unlock_mutex; 308 309 ret = wait_for_completion_interruptible(&rwtm->cmd_done); 310 if (ret < 0) 311 goto unlock_mutex; 312 313 ret = mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval); 314 if (ret < 0) 315 goto unlock_mutex; 316 317 memcpy(data, rwtm->buf, max); 318 ret = max; 319 320 unlock_mutex: 321 mutex_unlock(&rwtm->busy); 322 return ret; 323 } 324 325 #ifdef CONFIG_DEBUG_FS 326 static int rwtm_debug_open(struct inode *inode, struct file *file) 327 { 328 file->private_data = inode->i_private; 329 330 return nonseekable_open(inode, file); 331 } 332 333 static ssize_t do_sign_read(struct file *file, char __user *buf, size_t len, 334 loff_t *ppos) 335 { 336 struct mox_rwtm *rwtm = file->private_data; 337 ssize_t ret; 338 339 /* only allow one read, of 136 bytes, from position 0 */ 340 if (*ppos != 0) 341 return 0; 342 343 if (len < 136) 344 return -EINVAL; 345 346 if (!rwtm->last_sig_done) 347 return -ENODATA; 348 349 /* 2 arrays of 17 32-bit words are 136 bytes */ 350 ret = simple_read_from_buffer(buf, len, ppos, rwtm->last_sig, 136); 351 rwtm->last_sig_done = 0; 352 353 return ret; 354 } 355 356 static ssize_t do_sign_write(struct file *file, const char __user *buf, 357 size_t len, loff_t *ppos) 358 { 359 struct mox_rwtm *rwtm = file->private_data; 360 struct armada_37xx_rwtm_rx_msg *reply = &rwtm->reply; 361 struct armada_37xx_rwtm_tx_msg msg; 362 loff_t dummy = 0; 363 ssize_t ret; 364 365 /* the input is a SHA-512 hash, so exactly 64 bytes have to be read */ 366 if (len != 64) 367 return -EINVAL; 368 369 /* if last result is not zero user has not read that information yet */ 370 if (rwtm->last_sig_done) 371 return -EBUSY; 372 373 if (!mutex_trylock(&rwtm->busy)) 374 return -EBUSY; 375 376 /* 377 * Here we have to send: 378 * 1. Address of the input to sign. 379 * The input is an array of 17 32-bit words, the first (most 380 * significat) is 0, the rest 16 words are copied from the SHA-512 381 * hash given by the user and converted from BE to LE. 382 * 2. Address of the buffer where ECDSA signature value R shall be 383 * stored by the rWTM firmware. 384 * 3. Address of the buffer where ECDSA signature value S shall be 385 * stored by the rWTM firmware. 386 */ 387 memset(rwtm->buf, 0, 4); 388 ret = simple_write_to_buffer(rwtm->buf + 4, 64, &dummy, buf, len); 389 if (ret < 0) 390 goto unlock_mutex; 391 be32_to_cpu_array(rwtm->buf, rwtm->buf, 17); 392 393 msg.command = MBOX_CMD_SIGN; 394 msg.args[0] = 1; 395 msg.args[1] = rwtm->buf_phys; 396 msg.args[2] = rwtm->buf_phys + 68; 397 msg.args[3] = rwtm->buf_phys + 2 * 68; 398 ret = mbox_send_message(rwtm->mbox, &msg); 399 if (ret < 0) 400 goto unlock_mutex; 401 402 ret = wait_for_completion_interruptible(&rwtm->cmd_done); 403 if (ret < 0) 404 goto unlock_mutex; 405 406 ret = MBOX_STS_VALUE(reply->retval); 407 if (MBOX_STS_ERROR(reply->retval) != MBOX_STS_SUCCESS) 408 goto unlock_mutex; 409 410 /* 411 * Here we read the R and S values of the ECDSA signature 412 * computed by the rWTM firmware and convert their words from 413 * LE to BE. 414 */ 415 memcpy(rwtm->last_sig, rwtm->buf + 68, 136); 416 cpu_to_be32_array(rwtm->last_sig, rwtm->last_sig, 34); 417 rwtm->last_sig_done = 1; 418 419 mutex_unlock(&rwtm->busy); 420 return len; 421 unlock_mutex: 422 mutex_unlock(&rwtm->busy); 423 return ret; 424 } 425 426 static const struct file_operations do_sign_fops = { 427 .owner = THIS_MODULE, 428 .open = rwtm_debug_open, 429 .read = do_sign_read, 430 .write = do_sign_write, 431 .llseek = no_llseek, 432 }; 433 434 static int rwtm_register_debugfs(struct mox_rwtm *rwtm) 435 { 436 struct dentry *root, *entry; 437 438 root = debugfs_create_dir("turris-mox-rwtm", NULL); 439 440 if (IS_ERR(root)) 441 return PTR_ERR(root); 442 443 entry = debugfs_create_file_unsafe("do_sign", 0600, root, rwtm, 444 &do_sign_fops); 445 if (IS_ERR(entry)) 446 goto err_remove; 447 448 rwtm->debugfs_root = root; 449 450 return 0; 451 err_remove: 452 debugfs_remove_recursive(root); 453 return PTR_ERR(entry); 454 } 455 456 static void rwtm_unregister_debugfs(struct mox_rwtm *rwtm) 457 { 458 debugfs_remove_recursive(rwtm->debugfs_root); 459 } 460 #else 461 static inline int rwtm_register_debugfs(struct mox_rwtm *rwtm) 462 { 463 return 0; 464 } 465 466 static inline void rwtm_unregister_debugfs(struct mox_rwtm *rwtm) 467 { 468 } 469 #endif 470 471 static int turris_mox_rwtm_probe(struct platform_device *pdev) 472 { 473 struct mox_rwtm *rwtm; 474 struct device *dev = &pdev->dev; 475 int ret; 476 477 rwtm = devm_kzalloc(dev, sizeof(*rwtm), GFP_KERNEL); 478 if (!rwtm) 479 return -ENOMEM; 480 481 rwtm->dev = dev; 482 rwtm->buf = dmam_alloc_coherent(dev, PAGE_SIZE, &rwtm->buf_phys, 483 GFP_KERNEL); 484 if (!rwtm->buf) 485 return -ENOMEM; 486 487 ret = mox_kobj_create(rwtm); 488 if (ret < 0) { 489 dev_err(dev, "Cannot create turris-mox-rwtm kobject!\n"); 490 return ret; 491 } 492 493 ret = sysfs_create_files(rwtm_to_kobj(rwtm), mox_rwtm_attrs); 494 if (ret < 0) { 495 dev_err(dev, "Cannot create sysfs files!\n"); 496 goto put_kobj; 497 } 498 499 platform_set_drvdata(pdev, rwtm); 500 501 mutex_init(&rwtm->busy); 502 init_completion(&rwtm->cmd_done); 503 504 rwtm->mbox_client.dev = dev; 505 rwtm->mbox_client.rx_callback = mox_rwtm_rx_callback; 506 507 rwtm->mbox = mbox_request_channel(&rwtm->mbox_client, 0); 508 if (IS_ERR(rwtm->mbox)) { 509 ret = PTR_ERR(rwtm->mbox); 510 if (ret != -EPROBE_DEFER) 511 dev_err(dev, "Cannot request mailbox channel: %i\n", 512 ret); 513 goto remove_files; 514 } 515 516 ret = mox_get_board_info(rwtm); 517 if (ret < 0) 518 dev_warn(dev, "Cannot read board information: %i\n", ret); 519 520 ret = check_get_random_support(rwtm); 521 if (ret < 0) { 522 dev_notice(dev, 523 "Firmware does not support the GET_RANDOM command\n"); 524 goto free_channel; 525 } 526 527 rwtm->hwrng.name = DRIVER_NAME "_hwrng"; 528 rwtm->hwrng.read = mox_hwrng_read; 529 rwtm->hwrng.priv = (unsigned long) rwtm; 530 531 ret = devm_hwrng_register(dev, &rwtm->hwrng); 532 if (ret < 0) { 533 dev_err(dev, "Cannot register HWRNG: %i\n", ret); 534 goto free_channel; 535 } 536 537 ret = rwtm_register_debugfs(rwtm); 538 if (ret < 0) { 539 dev_err(dev, "Failed creating debugfs entries: %i\n", ret); 540 goto free_channel; 541 } 542 543 dev_info(dev, "HWRNG successfully registered\n"); 544 545 return 0; 546 547 free_channel: 548 mbox_free_channel(rwtm->mbox); 549 remove_files: 550 sysfs_remove_files(rwtm_to_kobj(rwtm), mox_rwtm_attrs); 551 put_kobj: 552 kobject_put(rwtm_to_kobj(rwtm)); 553 return ret; 554 } 555 556 static void turris_mox_rwtm_remove(struct platform_device *pdev) 557 { 558 struct mox_rwtm *rwtm = platform_get_drvdata(pdev); 559 560 rwtm_unregister_debugfs(rwtm); 561 sysfs_remove_files(rwtm_to_kobj(rwtm), mox_rwtm_attrs); 562 kobject_put(rwtm_to_kobj(rwtm)); 563 mbox_free_channel(rwtm->mbox); 564 } 565 566 static const struct of_device_id turris_mox_rwtm_match[] = { 567 { .compatible = "cznic,turris-mox-rwtm", }, 568 { .compatible = "marvell,armada-3700-rwtm-firmware", }, 569 { }, 570 }; 571 572 MODULE_DEVICE_TABLE(of, turris_mox_rwtm_match); 573 574 static struct platform_driver turris_mox_rwtm_driver = { 575 .probe = turris_mox_rwtm_probe, 576 .remove_new = turris_mox_rwtm_remove, 577 .driver = { 578 .name = DRIVER_NAME, 579 .of_match_table = turris_mox_rwtm_match, 580 }, 581 }; 582 module_platform_driver(turris_mox_rwtm_driver); 583 584 MODULE_LICENSE("GPL v2"); 585 MODULE_DESCRIPTION("Turris Mox rWTM firmware driver"); 586 MODULE_AUTHOR("Marek Behun <kabel@kernel.org>"); 587