sunxi-fel: handle H616 secure-FEL handoff

On H616 with the secure boot fuse set, FEL starts in non-secure
state. The older direct SMC workaround is not sufficient there because
the SMC returns through monitor mode instead of directly leaving the
BROM FEL command loop in secure SVC state.

Add a secure-SVC return thunk for this case and keep the existing
global startup workaround model. The thunk issues the SMC, switches
from monitor mode to secure SVC with the banked SP/LR restored,
restores the secure GIC view expected by the BROM, and returns to the
FEL command loop. It uses the same SRAM swap-table convention as the
SPL thunk to preserve the H616 BROM SRAM workspace while the uploaded
code runs and returns to FEL.

After the transition, the normal runtime probe sees secure state and
suppresses repeat application in that sunxi-fel process, so normal SID
reads and SPL execution use the existing code paths.

Describe the SMC workaround method in SoC data and make every existing
secure-FEL user select the direct-SMC path explicitly. H616 selects the
secure-SVC thunk path and additionally gates the workaround on the
secure boot status word at SID + 0xa0, so non-secure H616 boards do not
enter the secure path just because the zero-word probe also reads as
zero.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

Author: jameshilliard

Makefile

@@ -141,7 +141,7 @@ SOC_INFO := soc_info.c soc_info.h
 FEL_LIB  := fel_lib.c fel_lib.h
 SPI_FLASH:= fel-spiflash.c fel-spiflash.h fel-remotefunc-spi-data-transfer.h
 
-sunxi-fel: fel.c fit_image.c thunks/fel-to-spl-thunk.h $(PROGRESS) $(SOC_INFO) $(FEL_LIB) $(SPI_FLASH)
+sunxi-fel: fel.c fit_image.c thunks/fel-to-spl-thunk.h thunks/fel-to-secure-svc-return-thunk.h $(PROGRESS) $(SOC_INFO) $(FEL_LIB) $(SPI_FLASH)
 	$(CC) $(HOST_CFLAGS) $(LIBUSB_CFLAGS) $(ZLIB_CFLAGS) $(LDFLAGS) -o $@ \
 		$(filter %.c,$^) $(LIBS) $(LIBUSB_LIBS) $(ZLIB_LIBS) -lfdt
 

fel.c

@@ -390,6 +390,10 @@ static uint32_t fel_to_spl_thunk[] = {
 	#include "thunks/fel-to-spl-thunk.h"
 };
 
+static uint32_t fel_to_secure_svc_return_thunk[] = {
+	#include "thunks/fel-to-secure-svc-return-thunk.h"
+};
+
 #define	DRAM_BASE		0x40000000
 #define	DRAM_SIZE		0x80000000
 
@@ -596,36 +600,104 @@ void aw_set_sctlr(feldev_handle *dev, soc_info_t *soc_info,
 	aw_write_arm_cp_reg(dev, soc_info, 15, 0, 1, 0, 0, sctlr);
 }
 
-/*
- * Issue a "smc #0" instruction. This brings a SoC booted in "secure boot"
- * state from the default non-secure FEL into secure FEL.
- * This crashes on devices using "non-secure boot", as the BROM does not
- * provide a handler address in MVBAR. So we have a runtime check.
- */
-void aw_apply_smc_workaround(feldev_handle *dev)
+static bool aw_fel_needs_smc_workaround(feldev_handle *dev)
 {
 	soc_info_t *soc_info = dev->soc_info;
 	uint32_t val;
+
+	if (soc_info->secure_boot_fuse_addr) {
+		aw_fel_read(dev, soc_info->secure_boot_fuse_addr,
+			    &val, sizeof(val));
+		if (!(le32toh(val) & soc_info->secure_boot_fuse_mask))
+			return false;
+
+		if (!soc_info->needs_smc_workaround_if_zero_word_at_addr)
+			return true;
+	}
+
+	if (!soc_info->needs_smc_workaround_if_zero_word_at_addr)
+		return false;
+	aw_fel_read(dev, soc_info->needs_smc_workaround_if_zero_word_at_addr,
+		    &val, sizeof(val));
+
+	return le32toh(val) == 0;
+}
+
+static void aw_fel_execute_secure_svc_return_thunk(feldev_handle *dev)
+{
+	soc_info_t *soc_info = dev->soc_info;
+	const sram_swap_buffers *swap_buffers = soc_info->swap_buffers;
+	struct timespec req = { .tv_nsec = 250000000 }; /* 250ms */
 	uint32_t arm_code[] = {
-		htole32(0xe1600070), /* smc	#0	*/
-		htole32(0xe12fff1e), /* bx	lr	*/
+		htole32(0xe12fff1e), /* bx	lr		*/
 	};
+	uint32_t *thunk_buf;
+	size_t thunk_size;
+	size_t i;
 
-	/* Return if the SoC does not need this workaround */
-	if (!soc_info->needs_smc_workaround_if_zero_word_at_addr)
-		return;
+	for (i = 0; swap_buffers[i].size; i++)
+		;
 
-	/* This has less overhead than fel_readl_n() and may be good enough */
-	aw_fel_read(dev, soc_info->needs_smc_workaround_if_zero_word_at_addr,
-	            &val, sizeof(val));
+	thunk_size = sizeof(fel_to_secure_svc_return_thunk) +
+		     sizeof(soc_info->spl_addr) +
+		     (i + 1) * sizeof(*swap_buffers);
 
-	/* Return if the workaround is not needed or has been already applied */
-	if (val != 0)
+	if (thunk_size > soc_info->thunk_size)
+		pr_fatal("FEL thunk: bad size (need %zu, have %u)\n",
+			 thunk_size, soc_info->thunk_size);
+
+	thunk_buf = malloc(thunk_size);
+	if (!thunk_buf)
+		pr_fatal("FEL thunk: failed to allocate buffer\n");
+	memcpy(thunk_buf, fel_to_secure_svc_return_thunk,
+	       sizeof(fel_to_secure_svc_return_thunk));
+	memcpy(thunk_buf + ARRAY_SIZE(fel_to_secure_svc_return_thunk),
+	       &soc_info->spl_addr, sizeof(soc_info->spl_addr));
+	memcpy(thunk_buf + ARRAY_SIZE(fel_to_secure_svc_return_thunk) + 1,
+	       swap_buffers, (i + 1) * sizeof(*swap_buffers));
+
+	for (i = 0; i < thunk_size / sizeof(uint32_t); i++)
+		thunk_buf[i] = htole32(thunk_buf[i]);
+
+	aw_fel_write(dev, arm_code, soc_info->spl_addr, sizeof(arm_code));
+	aw_fel_write(dev, thunk_buf, soc_info->thunk_addr, thunk_size);
+	aw_fel_execute(dev, soc_info->thunk_addr);
+	free(thunk_buf);
+
+	/* TODO: Try to find and fix the bug, which needs this workaround */
+	nanosleep(&req, NULL);
+}
+
+/*
+ * Apply the "smc #0" workaround. This moves a secure-boot FEL session from
+ * the default non-secure state into secure state.
+ * This crashes on devices using "non-secure boot", as the BROM does not
+ * provide a handler address in MVBAR. So we have a runtime check.
+ * Some newer SoCs need to perform the SMC and return to FEL via a thunk,
+ * which handles the monitor-to-SVC transition details.
+ */
+static void aw_apply_smc_workaround(feldev_handle *dev)
+{
+	soc_info_t *soc_info = dev->soc_info;
+
+	/* Return if the workaround is not needed */
+	if (!aw_fel_needs_smc_workaround(dev))
 		return;
 
-	pr_info("Applying SMC workaround... ");
-	aw_fel_write(dev, arm_code, soc_info->scratch_addr, sizeof(arm_code));
-	aw_fel_execute(dev, soc_info->scratch_addr);
+	if (soc_info->smc_workaround == SMC_WORKAROUND_SECURE_SVC_THUNK) {
+		pr_info("Applying SMC workaround via secure-SVC return thunk... ");
+		aw_fel_execute_secure_svc_return_thunk(dev);
+	} else {
+		uint32_t arm_code[] = {
+			htole32(0xe1600070), /* smc	#0		*/
+			htole32(0xe12fff1e), /* bx	lr		*/
+		};
+
+		pr_info("Applying SMC workaround... ");
+		aw_fel_write(dev, arm_code, soc_info->scratch_addr,
+			     sizeof(arm_code));
+		aw_fel_execute(dev, soc_info->scratch_addr);
+	}
 	pr_info(" done.\n");
 }
 
@@ -1537,7 +1609,7 @@ int main(int argc, char **argv)
 	 */
 	handle = feldev_open(busnum, devnum, AW_USB_VENDOR_ID, AW_USB_PRODUCT_ID);
 
-	/* Some SoCs need the SMC workaround to enter the secure boot mode */
+	/* Some SoCs need the SMC workaround to enter secure state */
 	aw_apply_smc_workaround(handle);
 
 	/* Handle command-style arguments, in order of appearance */

soc_info.c

@@ -397,6 +397,7 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x017000A0,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x40004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h3_compat,
 	},{
 		.soc_id       = 0x1639, /* Allwinner A80 */
@@ -445,6 +446,7 @@ soc_info_t soc_info_table[] = {
 		.sid_sections = h3_sid_maps,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x40004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h3_compat,
 	},{
 		.soc_id       = 0x1681, /* Allwinner V3s */
@@ -483,6 +485,7 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x017000A0,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x40004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h3_compat,
 	},{
 		.soc_id       = 0x1701, /* Allwinner R40 */
@@ -522,6 +525,7 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x09010040,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x100004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h6_compat,
 	},{
 		.soc_id       = 0x1816, /* Allwinner V536 */
@@ -561,6 +565,10 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x09010040,
 		.rvbar_reg_alt= 0x08100040,
 		.ver_reg      = 0x03000024,
+		.needs_smc_workaround_if_zero_word_at_addr = 0x03006240,
+		.secure_boot_fuse_addr = 0x030060a0,
+		.secure_boot_fuse_mask = 0xf,
+		.smc_workaround = SMC_WORKAROUND_SECURE_SVC_THUNK,
 		.watchdog     = &wd_h6_compat,
 	},{
 		.soc_id       = 0x1851, /* Allwinner R329 */
@@ -641,6 +649,7 @@ soc_info_t soc_info_table[] = {
 		.sid_sections = generic_2k_sid_maps,
 		.rvbar_reg    = 0x08100040,
 		.needs_smc_workaround_if_zero_word_at_addr = 0x100004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h6_compat,
 	},{
 		.swap_buffers = NULL /* End of the table */

soc_info.h

@@ -107,13 +107,24 @@ typedef struct {
  * - No access to the secure side of the GIC, so it can't be configured to
  *   be accessible from non-secure world.
  * - No RMR trigger on ARMv8 cores to bring the core into AArch64.
- * However it has been found out that a simple "smc" call will immediately
- * return from monitor mode, but with the NS bit cleared, so access to all
- * secure peripherals is suddenly possible.
+ * On older SoCs, a simple "smc" call returns with the NS bit cleared,
+ * so access to all secure peripherals is suddenly possible. Newer SoCs
+ * may need a secure-SVC thunk to handle the monitor-to-SVC transition
+ * after the SMC call before returning to FEL.
  * The 'needs_smc_workaround_if_zero_word_at_addr' field can be used to
  * have a check for this condition (reading from restricted addresses
  * typically returns zero) and then activate the SMC workaround if needed.
+ * The 'secure_boot_fuse_addr' and 'secure_boot_fuse_mask' fields can be used
+ * when the SoC has an explicit readable secure boot status word. If both
+ * checks are configured, then both conditions must match.
+ * The 'smc_workaround' field selects how to apply the workaround once the
+ * runtime checks say that it is needed.
  */
+typedef enum {
+	SMC_WORKAROUND_DIRECT_SMC,
+	SMC_WORKAROUND_SECURE_SVC_THUNK,
+} smc_workaround_t;
+
 typedef struct {
 	uint32_t           soc_id;       /* ID of the SoC */
 	const char         *name;        /* human-readable SoC name string */
@@ -135,6 +146,11 @@ typedef struct {
 	bool               icache_fix;
 	/* Use SMC workaround (enter secure mode) if can't read from this address */
 	uint32_t           needs_smc_workaround_if_zero_word_at_addr;
+	/* Use SMC workaround if any of these secure boot fuse bits are set */
+	uint32_t           secure_boot_fuse_addr;
+	uint32_t           secure_boot_fuse_mask;
+	/* How to apply the SMC workaround */
+	smc_workaround_t   smc_workaround;
 	uint32_t           sram_size;	/* Usable contiguous SRAM at spl_addr */
 	sram_swap_buffers *swap_buffers;
 } soc_info_t;

thunks/Makefile

@@ -3,6 +3,7 @@
 #
 
 SPL_THUNK := fel-to-spl-thunk.h
+SPL_THUNK += fel-to-secure-svc-return-thunk.h
 THUNKS := clrsetbits.h
 THUNKS += memcpy.h
 THUNKS += readl_writel.h
@@ -24,9 +25,9 @@ OBJDUMP := $(CROSS_COMPILE)objdump
 
 AWK_O_TO_H := LC_ALL=C awk -f objdump_to_h.awk
 
-# The SPL thunk requires a different output format. The "style" variable for
+# These thunks require the old output format. The "style" variable for
 # awk controls this, and causes the htole32() conversion to be omitted.
-fel-to-spl-thunk.h: fel-to-spl-thunk.S FORCE
+$(SPL_THUNK): %.h: %.S FORCE
 	$(AS) -o $(subst .S,.o,$<) -march=armv5te $<
 	$(OBJDUMP) -d $(subst .S,.o,$<) | $(AWK_O_TO_H) -v style=old > $@
 

thunks/README.md

@@ -8,10 +8,10 @@ usually via `sunxi-fel`.
 
 Normally you don't need to change or (re)build anything within this folder.
 Currently our main build process (via the parent directory's _Makefile_)
-only includes `fel-to-spl-thunk.h` directly. Other _.h_ files are provided
-**just for reference**. The main purpose of this folder is simply keeping
-track of _.S_ sources, to help with possible future maintenance of the
-various code snippets.
+includes `fel-to-spl-thunk.h` and `fel-to-secure-svc-return-thunk.h` directly.
+Other _.h_ files are provided **just for reference**. The main purpose of this
+folder is simply keeping track of _.S_ sources, to help with possible future
+maintenance of the various code snippets.
 
 Please note that any files lacking explicit license information are intended
 to be covered by the project's [overall license](../LICENSE.md) (GPLv2).