cachepc-linux

Fork of AMDESE/linux with modifications for CachePC side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-linux
Log | Files | Refs | README | LICENSE | sfeed.txt

bcm_kona_smc.c (5065B)


      1/*
      2 * Copyright (C) 2013 Broadcom Corporation
      3 *
      4 * This program is free software; you can redistribute it and/or
      5 * modify it under the terms of the GNU General Public License as
      6 * published by the Free Software Foundation version 2.
      7 *
      8 * This program is distributed "as is" WITHOUT ANY WARRANTY of any
      9 * kind, whether express or implied; without even the implied warranty
     10 * of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     11 * GNU General Public License for more details.
     12 */
     13#include <linux/smp.h>
     14#include <linux/io.h>
     15#include <linux/ioport.h>
     16
     17#include <asm/cacheflush.h>
     18#include <linux/of_address.h>
     19
     20#include "bcm_kona_smc.h"
     21
     22static u32		bcm_smc_buffer_phys;	/* physical address */
     23static void __iomem	*bcm_smc_buffer;	/* virtual address */
     24
     25struct bcm_kona_smc_data {
     26	unsigned service_id;
     27	unsigned arg0;
     28	unsigned arg1;
     29	unsigned arg2;
     30	unsigned arg3;
     31	unsigned result;
     32};
     33
     34static const struct of_device_id bcm_kona_smc_ids[] __initconst = {
     35	{.compatible = "brcm,kona-smc"},
     36	{.compatible = "bcm,kona-smc"}, /* deprecated name */
     37	{},
     38};
     39
     40/* Map in the args buffer area */
     41int __init bcm_kona_smc_init(void)
     42{
     43	struct device_node *node;
     44	const __be32 *prop_val;
     45	u64 prop_size = 0;
     46	unsigned long buffer_size;
     47	u32 buffer_phys;
     48
     49	/* Read buffer addr and size from the device tree node */
     50	node = of_find_matching_node(NULL, bcm_kona_smc_ids);
     51	if (!node)
     52		return -ENODEV;
     53
     54	prop_val = of_get_address(node, 0, &prop_size, NULL);
     55	if (!prop_val)
     56		return -EINVAL;
     57
     58	/* We assume space for four 32-bit arguments */
     59	if (prop_size < 4 * sizeof(u32) || prop_size > (u64)ULONG_MAX)
     60		return -EINVAL;
     61	buffer_size = (unsigned long)prop_size;
     62
     63	buffer_phys = be32_to_cpup(prop_val);
     64	if (!buffer_phys)
     65		return -EINVAL;
     66
     67	bcm_smc_buffer = ioremap(buffer_phys, buffer_size);
     68	if (!bcm_smc_buffer)
     69		return -ENOMEM;
     70	bcm_smc_buffer_phys = buffer_phys;
     71
     72	pr_info("Kona Secure API initialized\n");
     73
     74	return 0;
     75}
     76
     77/*
     78 * int bcm_kona_do_smc(u32 service_id, u32 buffer_addr)
     79 *
     80 * Only core 0 can run the secure monitor code.  If an "smc" request
     81 * is initiated on a different core it must be redirected to core 0
     82 * for execution.  We rely on the caller to handle this.
     83 *
     84 * Each "smc" request supplies a service id and the address of a
     85 * buffer containing parameters related to the service to be
     86 * performed.  A flags value defines the behavior of the level 2
     87 * cache and interrupt handling while the secure monitor executes.
     88 *
     89 * Parameters to the "smc" request are passed in r4-r6 as follows:
     90 *     r4	service id
     91 *     r5	flags (SEC_ROM_*)
     92 *     r6	physical address of buffer with other parameters
     93 *
     94 * Execution of an "smc" request produces two distinct results.
     95 *
     96 * First, the secure monitor call itself (regardless of the specific
     97 * service request) can succeed, or can produce an error.  When an
     98 * "smc" request completes this value is found in r12; it should
     99 * always be SEC_EXIT_NORMAL.
    100 *
    101 * In addition, the particular service performed produces a result.
    102 * The values that should be expected depend on the service.  We
    103 * therefore return this value to the caller, so it can handle the
    104 * request result appropriately.  This result value is found in r0
    105 * when the "smc" request completes.
    106 */
    107static int bcm_kona_do_smc(u32 service_id, u32 buffer_phys)
    108{
    109	register u32 ip asm("ip");	/* Also called r12 */
    110	register u32 r0 asm("r0");
    111	register u32 r4 asm("r4");
    112	register u32 r5 asm("r5");
    113	register u32 r6 asm("r6");
    114
    115	r4 = service_id;
    116	r5 = 0x3;		/* Keep IRQ and FIQ off in SM */
    117	r6 = buffer_phys;
    118
    119	asm volatile (
    120		/* Make sure we got the registers we want */
    121		__asmeq("%0", "ip")
    122		__asmeq("%1", "r0")
    123		__asmeq("%2", "r4")
    124		__asmeq("%3", "r5")
    125		__asmeq("%4", "r6")
    126		".arch_extension sec\n"
    127		"	smc    #0\n"
    128		: "=r" (ip), "=r" (r0)
    129		: "r" (r4), "r" (r5), "r" (r6)
    130		: "r1", "r2", "r3", "r7", "lr");
    131
    132	BUG_ON(ip != SEC_EXIT_NORMAL);
    133
    134	return r0;
    135}
    136
    137/* __bcm_kona_smc() should only run on CPU 0, with pre-emption disabled */
    138static void __bcm_kona_smc(void *info)
    139{
    140	struct bcm_kona_smc_data *data = info;
    141	u32 __iomem *args = bcm_smc_buffer;
    142
    143	BUG_ON(smp_processor_id() != 0);
    144	BUG_ON(!args);
    145
    146	/* Copy the four 32 bit argument values into the bounce area */
    147	writel_relaxed(data->arg0, args++);
    148	writel_relaxed(data->arg1, args++);
    149	writel_relaxed(data->arg2, args++);
    150	writel(data->arg3, args);
    151
    152	/* Flush caches for input data passed to Secure Monitor */
    153	flush_cache_all();
    154
    155	/* Trap into Secure Monitor and record the request result */
    156	data->result = bcm_kona_do_smc(data->service_id, bcm_smc_buffer_phys);
    157}
    158
    159unsigned bcm_kona_smc(unsigned service_id, unsigned arg0, unsigned arg1,
    160		  unsigned arg2, unsigned arg3)
    161{
    162	struct bcm_kona_smc_data data;
    163
    164	data.service_id = service_id;
    165	data.arg0 = arg0;
    166	data.arg1 = arg1;
    167	data.arg2 = arg2;
    168	data.arg3 = arg3;
    169	data.result = 0;
    170
    171	/*
    172	 * Due to a limitation of the secure monitor, we must use the SMP
    173	 * infrastructure to forward all secure monitor calls to Core 0.
    174	 */
    175	smp_call_function_single(0, __bcm_kona_smc, &data, 1);
    176
    177	return data.result;
    178}