Commit 452c53d7 authored by Gilad Ben-Yossef's avatar Gilad Ben-Yossef Committed by Herbert Xu
Browse files

crypto: ccree - notify TEE on FIPS tests errors 



Register a FIPS test failure notifier and use it to notify
TEE side of FIPS test failures on our side prior to panic.

Signed-off-by: default avatarGilad Ben-Yossef <gilad@benyossef.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
parent 9552389c

drivers/crypto/ccree/cc_fips.c

+23 −0
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 


#include <linux/kernel.h>

#include <linux/fips.h>

#include <linux/notifier.h>



#include "cc_driver.h"

#include "cc_fips.h"
@@ -11,6 +12,8 @@ static void fips_dsr(unsigned long devarg); 


struct cc_fips_handle {

	struct tasklet_struct tasklet;

	struct notifier_block nb;

	struct cc_drvdata *drvdata;

};



/* The function called once at driver entry point to check
@@ -46,6 +49,21 @@ void cc_set_ree_fips_status(struct cc_drvdata *drvdata, bool status) 
	cc_iowrite(drvdata, CC_REG(HOST_GPR0), val);

}



/* Push REE side FIPS test failure to TEE side */

static int cc_ree_fips_failure(struct notifier_block *nb, unsigned long unused1,

			       void *unused2)

{

	struct cc_fips_handle *fips_h =

				container_of(nb, struct cc_fips_handle, nb);

	struct cc_drvdata *drvdata = fips_h->drvdata;

	struct device *dev = drvdata_to_dev(drvdata);



	cc_set_ree_fips_status(drvdata, false);

	dev_info(dev, "Notifying TEE of FIPS test failure...\n");



	return NOTIFY_OK;

}



void cc_fips_fini(struct cc_drvdata *drvdata)

{

	struct cc_fips_handle *fips_h = drvdata->fips_handle;
@@ -53,6 +71,8 @@ void cc_fips_fini(struct cc_drvdata *drvdata) 
	if (drvdata->hw_rev < CC_HW_REV_712 || !fips_h)

		return;



	atomic_notifier_chain_unregister(&fips_fail_notif_chain, &fips_h->nb);



	/* Kill tasklet */

	tasklet_kill(&fips_h->tasklet);

	drvdata->fips_handle = NULL;
@@ -124,6 +144,9 @@ int cc_fips_init(struct cc_drvdata *p_drvdata) 


	dev_dbg(dev, "Initializing fips tasklet\n");

	tasklet_init(&fips_h->tasklet, fips_dsr, (unsigned long)p_drvdata);

	fips_h->drvdata = p_drvdata;

	fips_h->nb.notifier_call = cc_ree_fips_failure;

	atomic_notifier_chain_register(&fips_fail_notif_chain, &fips_h->nb);



	cc_tee_handle_fips_error(p_drvdata);