[PATCH 0/5] Atmel sama5d2 security module support

[PATCH 0/5] Atmel sama5d2 security module support

[Alexandre Belloni]

Hi,

There has already been multiple tentatives trying to add support for the
Sama5d2 security module and in particular, access to its SRAM.
After multiple discussions, I believe adding support in the sram
driver/framework is probably the best because it allows exporting the
SRAM to the kernel, to userspace and also to run code from it.

As the support for the sama5d2 securam is fairly small, I've included it
directly in the mmio-sram driver.

Regards,

Cc: Rob Herring <robh+dt@kernel.org>
Cc: devicetree at vger.kernel.org
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Cc: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>

Alexandre Belloni (5):
  Documentation: dt: atmel-at91: Document secumod bindings
  ARM: dts: at91: sama5d2: Add secumod node
  ARM: at91: add secumod register definitions
  misc: sram: document new compatible
  misc: sram: add Atmel securam support

 .../devicetree/bindings/arm/atmel-at91.txt         | 17 +++++++
 Documentation/devicetree/bindings/sram/sram.txt    |  2 +-
 arch/arm/boot/dts/sama5d2.dtsi                     | 19 ++++++++
 drivers/misc/sram.c                                | 52 +++++++++++++++++++---
 include/soc/at91/atmel-secumod.h                   | 46 +++++++++++++++++++
 5 files changed, 128 insertions(+), 8 deletions(-)
 create mode 100644 include/soc/at91/atmel-secumod.h

-- 
2.9.3

[PATCH 1/5] Documentation: dt: atmel-at91: Document secumod bindings

[Alexandre Belloni]

A security module is available starting with sama5d2, add its bindings.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
---
Cc: Rob Herring <robh+dt@kernel.org>
Cc: devicetree at vger.kernel.org
 Documentation/devicetree/bindings/arm/atmel-at91.txt | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/Documentation/devicetree/bindings/arm/atmel-at91.txt b/Documentation/devicetree/bindings/arm/atmel-at91.txt
index e1f5ad855f14..eea1f44d5666 100644
--- a/Documentation/devicetree/bindings/arm/atmel-at91.txt
+++ b/Documentation/devicetree/bindings/arm/atmel-at91.txt
@@ -225,3 +225,20 @@ required properties:
 		compatible = "atmel,sama5d3-sfr", "syscon";
 		reg = <0xf0038000 0x60>;
 	};
+
+Security Module (SECUMOD)
+
+The Security Module macrocell provides all necessary secure functions to avoid
+voltage, temperature, frequency and mechanical attacks on the chip. It also
+embeds secure memories that can be scrambled
+
+required properties:
+- compatible: Should be "atmel,<chip>-secumod", "syscon".
+  <chip> can be "sama5d2".
+- reg: Should contain registers location and length
+
+	secumod at fc040000 {
+		compatible = "atmel,sama5d2-secumod", "syscon";
+		reg = <0xfc040000 0x100>;
+	};
+
-- 
2.9.3

[PATCH 1/5] Documentation: dt: atmel-at91: Document secumod bindings

[Rob Herring]

On Wed, Aug 31, 2016 at 06:11:04PM +0200, Alexandre Belloni wrote:
> A security module is available starting with sama5d2, add its bindings.
> 
> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
> ---
> Cc: Rob Herring <robh+dt@kernel.org>
> Cc: devicetree at vger.kernel.org
>  Documentation/devicetree/bindings/arm/atmel-at91.txt | 17 +++++++++++++++++
>  1 file changed, 17 insertions(+)

Acked-by: Rob Herring <robh@kernel.org>

[PATCH 2/5] ARM: dts: at91: sama5d2: Add secumod node

[Alexandre Belloni]

The sama5d2 has a security module, add its node.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
---
 arch/arm/boot/dts/sama5d2.dtsi | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi
index 353d0e5ec83b..b027e96e40ef 100644
--- a/arch/arm/boot/dts/sama5d2.dtsi
+++ b/arch/arm/boot/dts/sama5d2.dtsi
@@ -706,6 +706,11 @@
 						atmel,clk-output-range = <0 83000000>;
 					};
 
+					securam_clk: securam_clk {
+						#clock-cells = <0>;
+						reg = <51>;
+					};
+
 					i2s0_clk: i2s0_clk {
 						#clock-cells = <0>;
 						reg = <54>;
@@ -1029,6 +1034,15 @@
 				status = "disabled";
 			};
 
+			securam: sram at f8044000 {
+				compatible = "atmel,sama5d2-securam", "mmio-sram";
+				reg = <0xf8044000 0x40000>;
+				clocks = <&securam_clk>;
+				#address-cells = <1>;
+				#size-cells = <1>;
+				ranges = <0 0xf8044000 0x1420>;
+			};
+
 			rstc at f8048000 {
 				compatible = "atmel,sama5d3-rstc";
 				reg = <0xf8048000 0x10>;
@@ -1231,6 +1245,11 @@
 				clocks = <&pioA_clk>;
 			};
 
+			secumod at fc040000 {
+				compatible = "atmel,sama5d2-secumod", "syscon";
+				reg = <0xfc040000 0x100>;
+			};
+
 			tdes at fc044000 {
 				compatible = "atmel,at91sam9g46-tdes";
 				reg = <0xfc044000 0x100>;
-- 
2.9.3

[PATCH 3/5] ARM: at91: add secumod register definitions

[Alexandre Belloni]

Add registers and bits definitions for the security module found on
sama5d2.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
---
 include/soc/at91/atmel-secumod.h | 46 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 include/soc/at91/atmel-secumod.h

diff --git a/include/soc/at91/atmel-secumod.h b/include/soc/at91/atmel-secumod.h
new file mode 100644
index 000000000000..7b5c238eb69f
--- /dev/null
+++ b/include/soc/at91/atmel-secumod.h
@@ -0,0 +1,46 @@
+/*
+ * Atmel SFR (Special Function Registers) register offsets and bit definitions.
+ *
+ * Copyright (C) 2016 Atmel
+ *
+ * Author: Alexandre Belloni <alexandre.belloni@free-electrons.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef _LINUX_SOC_AT91_ATMEL_SECUMOD_H
+#define _LINUX_SOC_AT91_ATMEL_SECUMOD_H
+
+#define AT91_SECUMOD_CR		0x00
+#define AT91_SECUMOD_SYSR	0x04
+#define AT91_SECUMOD_SR		0x08
+#define AT91_SECUMOD_ASR	0x0C
+#define AT91_SECUMOD_SCR	0x10
+
+#define AT91_SECUMOD_RAMRDY	0x14
+#define AT91_SECUMOD_RAMRDY_READY	BIT(0)
+
+#define AT91_SECUMOD_PIOBU0	0x18
+#define AT91_SECUMOD_PIOBU1	0x1C
+#define AT91_SECUMOD_PIOBU2	0x20
+#define AT91_SECUMOD_PIOBU3	0x24
+#define AT91_SECUMOD_PIOBU4	0x28
+#define AT91_SECUMOD_PIOBU5	0x2C
+#define AT91_SECUMOD_PIOBU6	0x30
+#define AT91_SECUMOD_PIOBU7	0x34
+#define AT91_SECUMOD_JTAGCR	0x68
+#define AT91_SECUMOD_DYSTUNE	0x6C
+#define AT91_SECUMOD_SRCKEY	0x70
+#define AT91_SECUMOD_RAMACC	0x74
+#define AT91_SECUMOD_RAMACCSR	0x78
+#define AT91_SECUMOD_BMPR	0x7C
+#define AT91_SECUMOD_NMPR	0x80
+#define AT91_SECUMOD_NIEPR	0x84
+#define AT91_SECUMOD_NIDPR	0x88
+#define AT91_SECUMOD_NIMPR	0x8C
+#define AT91_SECUMOD_WKPR	0x90
+
+#endif /* _LINUX_SOC_AT91_ATMEL_SECUMOD_H */
+
-- 
2.9.3

[PATCH 4/5] misc: sram: document new compatible

[Alexandre Belloni]

Add atmel,sama5d2-securam to the compatible list.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
---
Cc: Rob Herring <robh+dt@kernel.org>
Cc: devicetree at vger.kernel.org
 Documentation/devicetree/bindings/sram/sram.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Documentation/devicetree/bindings/sram/sram.txt b/Documentation/devicetree/bindings/sram/sram.txt
index add48f09015e..068c2c03c38f 100644
--- a/Documentation/devicetree/bindings/sram/sram.txt
+++ b/Documentation/devicetree/bindings/sram/sram.txt
@@ -4,7 +4,7 @@ Simple IO memory regions to be managed by the genalloc API.
 
 Required properties:
 
-- compatible : mmio-sram
+- compatible : mmio-sram or atmel,sama5d2-securam
 
 - reg : SRAM iomem address range
 
-- 
2.9.3

[PATCH 4/5] misc: sram: document new compatible

[Rob Herring]

On Wed, Aug 31, 2016 at 06:11:07PM +0200, Alexandre Belloni wrote:
> Add atmel,sama5d2-securam to the compatible list.
> 
> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
> ---
> Cc: Rob Herring <robh+dt@kernel.org>
> Cc: devicetree at vger.kernel.org
>  Documentation/devicetree/bindings/sram/sram.txt | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Acked-by: Rob Herring <robh@kernel.org>

[PATCH 5/5] misc: sram: add Atmel securam support

[Alexandre Belloni]

The Atmel secure SRAM is connected to a security module and may be erased
automatically under certain conditions. For that reason, it is necessary to
wait for the security module to flag that SRAM accesses are allowed before
accessing it.

Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
---
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Cc: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
 drivers/misc/sram.c | 52 +++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 45 insertions(+), 7 deletions(-)

diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
index f84b53d6ce50..8d411c64d07f 100644
--- a/drivers/misc/sram.c
+++ b/drivers/misc/sram.c
@@ -19,12 +19,16 @@
  */
 
 #include <linux/clk.h>
+#include <linux/delay.h>
 #include <linux/genalloc.h>
 #include <linux/io.h>
 #include <linux/list_sort.h>
 #include <linux/of_address.h>
 #include <linux/platform_device.h>
+#include <linux/regmap.h>
 #include <linux/slab.h>
+#include <linux/mfd/syscon.h>
+#include <soc/at91/atmel-secumod.h>
 
 #define SRAM_GRANULARITY	32
 
@@ -334,12 +338,43 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
 	return ret;
 }
 
+static int atmel_securam_wait(void)
+{
+	struct regmap *regmap;
+	unsigned long timeout = jiffies + HZ;
+	u32 val;
+
+	regmap = syscon_regmap_lookup_by_compatible("atmel,sama5d2-secumod");
+	if (IS_ERR(regmap))
+		return -ENODEV;
+
+	regmap_read(regmap, AT91_SECUMOD_RAMRDY, &val);
+	while (!(val & AT91_SECUMOD_RAMRDY_READY) &&
+	       time_before(jiffies, timeout)) {
+		mdelay(10);
+		regmap_read(regmap, AT91_SECUMOD_RAMRDY, &val);
+	}
+	if (!time_before(jiffies, timeout))
+		return -ETIMEDOUT;
+
+	return 0;
+}
+
+#ifdef CONFIG_OF
+static const struct of_device_id sram_dt_ids[] = {
+	{ .compatible = "mmio-sram" },
+	{ .compatible = "atmel,sama5d2-securam", .data = atmel_securam_wait },
+	{}
+};
+#endif
+
 static int sram_probe(struct platform_device *pdev)
 {
 	struct sram_dev *sram;
 	struct resource *res;
 	size_t size;
 	int ret;
+	const struct of_device_id *match;
 
 	sram = devm_kzalloc(&pdev->dev, sizeof(*sram), GFP_KERNEL);
 	if (!sram)
@@ -384,6 +419,16 @@ static int sram_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, sram);
 
+	match = of_match_node(sram_dt_ids, pdev->dev.of_node);
+	if (match->data) {
+		int (*init_func)(void);
+
+		init_func = match->data;
+		ret = init_func();
+		if (ret)
+			return ret;
+	}
+
 	dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n",
 		gen_pool_size(sram->pool) / 1024, sram->virt_base);
 
@@ -405,13 +450,6 @@ static int sram_remove(struct platform_device *pdev)
 	return 0;
 }
 
-#ifdef CONFIG_OF
-static const struct of_device_id sram_dt_ids[] = {
-	{ .compatible = "mmio-sram" },
-	{}
-};
-#endif
-
 static struct platform_driver sram_driver = {
 	.driver = {
 		.name = "sram",
-- 
2.9.3

[PATCH 5/5] misc: sram: add Atmel securam support

[Philipp Zabel]

Hi Alexandre,

Am Mittwoch, den 31.08.2016, 18:11 +0200 schrieb Alexandre Belloni:
> The Atmel secure SRAM is connected to a security module and may be erased
> automatically under certain conditions. For that reason, it is necessary to
> wait for the security module to flag that SRAM accesses are allowed before
> accessing it.
> 
> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
> ---
> Cc: Arnd Bergmann <arnd@arndb.de>
> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Cc: Philipp Zabel <p.zabel@pengutronix.de>
> Cc: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
>  drivers/misc/sram.c | 52 +++++++++++++++++++++++++++++++++++++++++++++-------
>  1 file changed, 45 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
> index f84b53d6ce50..8d411c64d07f 100644
> --- a/drivers/misc/sram.c
> +++ b/drivers/misc/sram.c
> @@ -19,12 +19,16 @@
>   */
>  
>  #include <linux/clk.h>
> +#include <linux/delay.h>
>  #include <linux/genalloc.h>
>  #include <linux/io.h>
>  #include <linux/list_sort.h>
>  #include <linux/of_address.h>
>  #include <linux/platform_device.h>
> +#include <linux/regmap.h>
>  #include <linux/slab.h>
> +#include <linux/mfd/syscon.h>
> +#include <soc/at91/atmel-secumod.h>
>  
>  #define SRAM_GRANULARITY	32
>  
> @@ -334,12 +338,43 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
>  	return ret;
>  }
>  
> +static int atmel_securam_wait(void)
> +{
> +	struct regmap *regmap;
> +	unsigned long timeout = jiffies + HZ;

Can this really take up to a second?

> +	u32 val;
> +
> +	regmap = syscon_regmap_lookup_by_compatible("atmel,sama5d2-secumod");
> +	if (IS_ERR(regmap))
> +		return -ENODEV;
> +
> +	regmap_read(regmap, AT91_SECUMOD_RAMRDY, &val);
> +	while (!(val & AT91_SECUMOD_RAMRDY_READY) &&
> +	       time_before(jiffies, timeout)) {
> +		mdelay(10);
> +		regmap_read(regmap, AT91_SECUMOD_RAMRDY, &val);
> +	}
> +	if (!time_before(jiffies, timeout))
> +		return -ETIMEDOUT;
> +
> +	return 0;

Could you use regmap_read_poll_timeout here?

> +}
> +
> +#ifdef CONFIG_OF
> +static const struct of_device_id sram_dt_ids[] = {
> +	{ .compatible = "mmio-sram" },
> +	{ .compatible = "atmel,sama5d2-securam", .data = atmel_securam_wait },
> +	{}
> +};
> +#endif
> +
>  static int sram_probe(struct platform_device *pdev)
>  {
>  	struct sram_dev *sram;
>  	struct resource *res;
>  	size_t size;
>  	int ret;
> +	const struct of_device_id *match;
>  
>  	sram = devm_kzalloc(&pdev->dev, sizeof(*sram), GFP_KERNEL);
>  	if (!sram)
> @@ -384,6 +419,16 @@ static int sram_probe(struct platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, sram);
>  
> +	match = of_match_node(sram_dt_ids, pdev->dev.of_node);
> +	if (match->data) {

And of_device_get_match_data here?

> +		int (*init_func)(void);
> +
> +		init_func = match->data;
> +		ret = init_func();
> +		if (ret)
> +			return ret;
> +	}
> +
>  	dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n",
>  		gen_pool_size(sram->pool) / 1024, sram->virt_base);
>  
> @@ -405,13 +450,6 @@ static int sram_remove(struct platform_device *pdev)
>  	return 0;
>  }
>  
> -#ifdef CONFIG_OF
> -static const struct of_device_id sram_dt_ids[] = {
> -	{ .compatible = "mmio-sram" },
> -	{}
> -};
> -#endif
> -
>  static struct platform_driver sram_driver = {
>  	.driver = {
>  		.name = "sram",

regards
Philipp

[PATCH 5/5] misc: sram: add Atmel securam support

[Alexandre Belloni]

On 31/08/2016 at 18:45:37 +0200, Philipp Zabel wrote :
> Hi Alexandre,
> 
> Am Mittwoch, den 31.08.2016, 18:11 +0200 schrieb Alexandre Belloni:
> > The Atmel secure SRAM is connected to a security module and may be erased
> > automatically under certain conditions. For that reason, it is necessary to
> > wait for the security module to flag that SRAM accesses are allowed before
> > accessing it.
> > 
> > Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
> > ---
> > Cc: Arnd Bergmann <arnd@arndb.de>
> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > Cc: Philipp Zabel <p.zabel@pengutronix.de>
> > Cc: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
> >  drivers/misc/sram.c | 52 +++++++++++++++++++++++++++++++++++++++++++++-------
> >  1 file changed, 45 insertions(+), 7 deletions(-)
> > 
> > diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c
> > index f84b53d6ce50..8d411c64d07f 100644
> > --- a/drivers/misc/sram.c
> > +++ b/drivers/misc/sram.c
> > @@ -19,12 +19,16 @@
> >   */
> >  
> >  #include <linux/clk.h>
> > +#include <linux/delay.h>
> >  #include <linux/genalloc.h>
> >  #include <linux/io.h>
> >  #include <linux/list_sort.h>
> >  #include <linux/of_address.h>
> >  #include <linux/platform_device.h>
> > +#include <linux/regmap.h>
> >  #include <linux/slab.h>
> > +#include <linux/mfd/syscon.h>
> > +#include <soc/at91/atmel-secumod.h>
> >  
> >  #define SRAM_GRANULARITY	32
> >  
> > @@ -334,12 +338,43 @@ static int sram_reserve_regions(struct sram_dev *sram, struct resource *res)
> >  	return ret;
> >  }
> >  
> > +static int atmel_securam_wait(void)
> > +{
> > +	struct regmap *regmap;
> > +	unsigned long timeout = jiffies + HZ;
> 
> Can this really take up to a second?
> 

Well, probably not but it can take some time. My understanding is that
it can take up to almost half a second (4096 bytes at 8kHz). But quite
frankly, by the time linux is starting, the delay has probably already
expired so the while loop is unlikely to run.

-- 
Alexandre Belloni, Free Electrons
Embedded Linux and Kernel engineering
http://free-electrons.com