sunxi-fel: handle H616 secure-FEL handoff

On H616 with the secure boot fuse set, FEL starts in non-secure state.
The old one-shot SMC workaround is not sufficient there because the SMC
returns through monitor mode, and returning to the BROM FEL command loop
is not reliable enough to make the transition global.

Add secure-SVC thunk variants for the paths that need secure state. SID
reads use a return thunk so protected SID words can be displayed, while
SPL execution uses a handoff thunk so U-Boot can switch the ARMv8 core
to AArch64.

Describe the SMC workaround method in SoC data and make every existing
secure-FEL user select the direct-SMC path explicitly. H616 selects the
secure-SVC thunk path and additionally gates the workaround on the secure
boot status word at SID + 0xa0, so non-secure H616 boards do not enter
the secure path just because the zero-word probe also reads as zero.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

Author: jameshilliard

fel.c

@@ -358,6 +358,14 @@ static uint32_t fel_to_spl_thunk[] = {
 	#include "thunks/fel-to-spl-thunk.h"
 };
 
+static uint32_t fel_to_secure_svc_spl_thunk[] = {
+	#include "thunks/fel-to-secure-svc-spl-thunk.h"
+};
+
+static uint32_t fel_to_secure_svc_return_thunk[] = {
+	#include "thunks/fel-to-secure-svc-return-thunk.h"
+};
+
 #define	DRAM_BASE		0x40000000
 #define	DRAM_SIZE		0x80000000
 
@@ -415,6 +423,8 @@ void fel_writel(feldev_handle *dev, uint32_t addr, uint32_t val)
 	fel_writel_n(dev, addr, &val, 1);
 }
 
+static void aw_apply_smc_workaround(feldev_handle *dev);
+
 void aw_fel_print_sid(feldev_handle *dev, bool force_workaround)
 {
 	uint32_t key[4];
@@ -426,6 +436,8 @@ void aw_fel_print_sid(feldev_handle *dev, bool force_workaround)
 		return;
 	}
 
+	aw_apply_smc_workaround(dev);
+
 	if (soc_info->sid_fix || force_workaround) {
 		pr_info("Read SID key via registers, base = 0x%08X\n",
 			soc_info->sid_base);
@@ -451,6 +463,8 @@ void aw_fel_dump_sid(feldev_handle *dev)
 		return;
 	}
 
+	aw_apply_smc_workaround(dev);
+
 	for (const sid_section *s = soc_info->sid_sections; s->name; s++) {
 		uint32_t count = s->size_bits / 32;
 
@@ -564,6 +578,29 @@ void aw_set_sctlr(feldev_handle *dev, soc_info_t *soc_info,
 	aw_write_arm_cp_reg(dev, soc_info, 15, 0, 1, 0, 0, sctlr);
 }
 
+static bool aw_fel_needs_smc_workaround(feldev_handle *dev)
+{
+	soc_info_t *soc_info = dev->soc_info;
+	uint32_t val;
+
+	if (soc_info->secure_boot_fuse_addr) {
+		aw_fel_read(dev, soc_info->secure_boot_fuse_addr,
+			    &val, sizeof(val));
+		if (!(le32toh(val) & soc_info->secure_boot_fuse_mask))
+			return false;
+
+		if (!soc_info->needs_smc_workaround_if_zero_word_at_addr)
+			return true;
+	}
+
+	if (!soc_info->needs_smc_workaround_if_zero_word_at_addr)
+		return false;
+	aw_fel_read(dev, soc_info->needs_smc_workaround_if_zero_word_at_addr,
+		    &val, sizeof(val));
+
+	return le32toh(val) == 0;
+}
+
 static void aw_fel_execute_raw_thunk(feldev_handle *dev,
 				     const uint32_t *thunk,
 				     size_t thunk_size)
@@ -622,36 +659,49 @@ static void aw_fel_execute_thunk(feldev_handle *dev,
 }
 
 /*
- * Issue a "smc #0" instruction. This brings a SoC booted in "secure boot"
- * state from the default non-secure FEL into secure FEL.
+ * Apply the "smc #0" workaround. This moves a secure-boot FEL session from
+ * the default non-secure state into secure state.
  * This crashes on devices using "non-secure boot", as the BROM does not
  * provide a handler address in MVBAR. So we have a runtime check.
+ * Some newer SoCs need to perform the SMC and return to FEL via a thunk,
+ * which handles the monitor-to-SVC transition details.
  */
-void aw_apply_smc_workaround(feldev_handle *dev)
+static void aw_apply_smc_workaround(feldev_handle *dev)
 {
 	soc_info_t *soc_info = dev->soc_info;
-	uint32_t val;
-	uint32_t arm_code[] = {
-		htole32(0xe1600070), /* smc	#0	*/
-		htole32(0xe12fff1e), /* bx	lr	*/
-	};
+	static bool applied;
 
-	/* Return if the SoC does not need this workaround */
-	if (!soc_info->needs_smc_workaround_if_zero_word_at_addr)
+	/* Return if the workaround is not needed or has been already applied */
+	if (applied || !aw_fel_needs_smc_workaround(dev))
 		return;
 
-	/* This has less overhead than fel_readl_n() and may be good enough */
-	aw_fel_read(dev, soc_info->needs_smc_workaround_if_zero_word_at_addr,
-	            &val, sizeof(val));
+	if (soc_info->smc_workaround == SMC_WORKAROUND_SECURE_SVC_THUNK) {
+		uint32_t arm_code[] = {
+			htole32(0xe12fff1e), /* bx	lr		*/
+		};
 
-	/* Return if the workaround is not needed or has been already applied */
-	if (val != 0)
-		return;
+		pr_info("Applying SMC workaround via secure-SVC return thunk... ");
+		aw_fel_write(dev, arm_code, soc_info->spl_addr,
+			     sizeof(arm_code));
+		aw_fel_execute_thunk(dev, fel_to_secure_svc_return_thunk,
+				     sizeof(fel_to_secure_svc_return_thunk),
+				     soc_info->spl_addr,
+				     soc_info->swap_buffers);
+		pr_info(" done.\n");
+	} else {
+		uint32_t arm_code[] = {
+			htole32(0xe1600070), /* smc	#0		*/
+			htole32(0xe12fff1e), /* bx	lr		*/
+		};
 
-	pr_info("Applying SMC workaround... ");
-	aw_fel_write(dev, arm_code, soc_info->scratch_addr, sizeof(arm_code));
-	aw_fel_execute(dev, soc_info->scratch_addr);
-	pr_info(" done.\n");
+		pr_info("Applying SMC workaround... ");
+		aw_fel_write(dev, arm_code, soc_info->scratch_addr,
+			     sizeof(arm_code));
+		aw_fel_execute(dev, soc_info->scratch_addr);
+		pr_info(" done.\n");
+	}
+
+	applied = true;
 }
 
 /*
@@ -814,14 +864,17 @@ void aw_restore_and_enable_mmu(feldev_handle *dev,
 /* Minimum offset of the main U-Boot image within u-boot-sunxi-with-spl.bin. */
 #define SPL_MIN_OFFSET 0x8000
 
-uint32_t aw_fel_write_and_execute_spl(feldev_handle *dev, uint8_t *buf, size_t len)
+static uint32_t aw_fel_write_and_execute_spl(feldev_handle *dev, uint8_t *buf,
+					     size_t len)
 {
 	soc_info_t *soc_info = dev->soc_info;
 	sram_swap_buffers *swap_buffers;
 	char header_signature[9] = { 0 };
 	size_t i;
 	uint32_t sp, sp_irq;
 	uint32_t spl_checksum, spl_len, spl_len_limit;
+	const uint32_t *thunk = fel_to_spl_thunk;
+	size_t thunk_code_size = sizeof(fel_to_spl_thunk);
 	uint32_t *buf32 = (uint32_t *)buf;
 	uint32_t cur_addr = soc_info->spl_addr;
 	uint32_t *tt = NULL;
@@ -913,8 +966,15 @@ uint32_t aw_fel_write_and_execute_spl(feldev_handle *dev, uint8_t *buf, size_t l
 	if (len > 0)
 		aw_fel_write(dev, buf, cur_addr, len);
 
+	if (soc_info->smc_workaround == SMC_WORKAROUND_SECURE_SVC_THUNK &&
+	    aw_fel_needs_smc_workaround(dev)) {
+		thunk = fel_to_secure_svc_spl_thunk;
+		thunk_code_size = sizeof(fel_to_secure_svc_spl_thunk);
+		pr_info("SPL: enabling secure-SVC transition workaround\n");
+	}
+
 	pr_info("=> Executing the SPL...");
-	aw_fel_execute_thunk(dev, fel_to_spl_thunk, sizeof(fel_to_spl_thunk),
+	aw_fel_execute_thunk(dev, thunk, thunk_code_size,
 			     soc_info->spl_addr, swap_buffers);
 	pr_info(" done.\n");
 
@@ -1414,8 +1474,15 @@ int main(int argc, char **argv)
 	 */
 	handle = feldev_open(busnum, devnum, AW_USB_VENDOR_ID, AW_USB_PRODUCT_ID);
 
-	/* Some SoCs need the SMC workaround to enter the secure boot mode */
-	aw_apply_smc_workaround(handle);
+	/*
+	 * Some SoCs need the SMC workaround to enter secure state. On H616,
+	 * SMC returns through monitor mode, and the secure-SVC transition is
+	 * only reliable when it is part of the operation that needs secure
+	 * state. Keep the global workaround for older SoCs, and let the SID
+	 * and SPL paths request the H616 thunk at their point of use.
+	 */
+	if (handle->soc_info->smc_workaround != SMC_WORKAROUND_SECURE_SVC_THUNK)
+		aw_apply_smc_workaround(handle);
 
 	/* Handle command-style arguments, in order of appearance */
 	while (argc > 1 ) {

soc_info.c

@@ -397,6 +397,7 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x017000A0,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x40004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h3_compat,
 	},{
 		.soc_id       = 0x1639, /* Allwinner A80 */
@@ -445,6 +446,7 @@ soc_info_t soc_info_table[] = {
 		.sid_sections = h3_sid_maps,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x40004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h3_compat,
 	},{
 		.soc_id       = 0x1681, /* Allwinner V3s */
@@ -483,6 +485,7 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x017000A0,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x40004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h3_compat,
 	},{
 		.soc_id       = 0x1701, /* Allwinner R40 */
@@ -522,6 +525,7 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x09010040,
 		/* Check L.NOP in the OpenRISC reset vector */
 		.needs_smc_workaround_if_zero_word_at_addr = 0x100004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h6_compat,
 	},{
 		.soc_id       = 0x1816, /* Allwinner V536 */
@@ -561,6 +565,10 @@ soc_info_t soc_info_table[] = {
 		.rvbar_reg    = 0x09010040,
 		.rvbar_reg_alt= 0x08100040,
 		.ver_reg      = 0x03000024,
+		.needs_smc_workaround_if_zero_word_at_addr = 0x03006240,
+		.secure_boot_fuse_addr = 0x030060a0,
+		.secure_boot_fuse_mask = 0xf,
+		.smc_workaround = SMC_WORKAROUND_SECURE_SVC_THUNK,
 		.watchdog     = &wd_h6_compat,
 	},{
 		.soc_id       = 0x1851, /* Allwinner R329 */
@@ -641,6 +649,7 @@ soc_info_t soc_info_table[] = {
 		.sid_sections = generic_2k_sid_maps,
 		.rvbar_reg    = 0x08100040,
 		.needs_smc_workaround_if_zero_word_at_addr = 0x100004,
+		.smc_workaround = SMC_WORKAROUND_DIRECT_SMC,
 		.watchdog     = &wd_h6_compat,
 	},{
 		.swap_buffers = NULL /* End of the table */

soc_info.h

@@ -107,13 +107,24 @@ typedef struct {
  * - No access to the secure side of the GIC, so it can't be configured to
  *   be accessible from non-secure world.
  * - No RMR trigger on ARMv8 cores to bring the core into AArch64.
- * However it has been found out that a simple "smc" call will immediately
- * return from monitor mode, but with the NS bit cleared, so access to all
- * secure peripherals is suddenly possible.
+ * On older SoCs, a simple "smc" call returns with the NS bit cleared,
+ * so access to all secure peripherals is suddenly possible. Newer SoCs
+ * may need a secure-SVC thunk to handle the monitor-to-SVC transition
+ * after the SMC call before returning to FEL.
  * The 'needs_smc_workaround_if_zero_word_at_addr' field can be used to
  * have a check for this condition (reading from restricted addresses
  * typically returns zero) and then activate the SMC workaround if needed.
+ * The 'secure_boot_fuse_addr' and 'secure_boot_fuse_mask' fields can be used
+ * when the SoC has an explicit readable secure boot status word. If both
+ * checks are configured, then both conditions must match.
+ * The 'smc_workaround' field selects how to apply the workaround once the
+ * runtime checks say that it is needed.
  */
+typedef enum {
+	SMC_WORKAROUND_DIRECT_SMC,
+	SMC_WORKAROUND_SECURE_SVC_THUNK,
+} smc_workaround_t;
+
 typedef struct {
 	uint32_t           soc_id;       /* ID of the SoC */
 	const char         *name;        /* human-readable SoC name string */
@@ -135,6 +146,11 @@ typedef struct {
 	bool               icache_fix;
 	/* Use SMC workaround (enter secure mode) if can't read from this address */
 	uint32_t           needs_smc_workaround_if_zero_word_at_addr;
+	/* Use SMC workaround if any of these secure boot fuse bits are set */
+	uint32_t           secure_boot_fuse_addr;
+	uint32_t           secure_boot_fuse_mask;
+	/* How to apply the SMC workaround */
+	smc_workaround_t   smc_workaround;
 	uint32_t           sram_size;	/* Usable contiguous SRAM at spl_addr */
 	sram_swap_buffers *swap_buffers;
 } soc_info_t;

thunks/Makefile

@@ -2,14 +2,16 @@
 # build "preprocessed" .h files for inclusion of ARM scratch code
 #
 
-SPL_THUNK := fel-to-spl-thunk.h
+FEL_EXEC_THUNKS := fel-to-spl-thunk.h
+FEL_EXEC_THUNKS += fel-to-secure-svc-spl-thunk.h
+FEL_EXEC_THUNKS += fel-to-secure-svc-return-thunk.h
 THUNKS := clrsetbits.h
 THUNKS += memcpy.h
 THUNKS += readl_writel.h
 THUNKS += rmr-thunk.h
 THUNKS += sid_read_root.h
 
-all: $(SPL_THUNK) $(THUNKS)
+all: $(FEL_EXEC_THUNKS) $(THUNKS)
 # clean up object files afterwards
 	rm -f *.o
 
@@ -24,9 +26,10 @@ OBJDUMP := $(CROSS_COMPILE)objdump
 
 AWK_O_TO_H := LC_ALL=C awk -f objdump_to_h.awk
 
-# The SPL thunk requires a different output format. The "style" variable for
-# awk controls this, and causes the htole32() conversion to be omitted.
-fel-to-spl-thunk.h: fel-to-spl-thunk.S FORCE
+# These thunks are copied into a uint32_t buffer and byte-swapped by fel.c.
+# The "style" variable for awk controls this, and causes the htole32()
+# conversion to be omitted.
+$(FEL_EXEC_THUNKS): %.h: %.S FORCE
 	$(AS) -o $(subst .S,.o,$<) -march=armv5te $<
 	$(OBJDUMP) -d $(subst .S,.o,$<) | $(AWK_O_TO_H) -v style=old > $@
 

thunks/README.md

@@ -7,11 +7,9 @@ can be transferred to a suitable target device and then executed 'remotely',
 usually via `sunxi-fel`.
 
 Normally you don't need to change or (re)build anything within this folder.
-Currently our main build process (via the parent directory's _Makefile_)
-only includes `fel-to-spl-thunk.h` directly. Other _.h_ files are provided
-**just for reference**. The main purpose of this folder is simply keeping
-track of _.S_ sources, to help with possible future maintenance of the
-various code snippets.
+Generated _.h_ files are included by the main build when referenced from
+`fel.c`. The main purpose of this folder is keeping track of _.S_ sources,
+to help with possible future maintenance of the various code snippets.
 
 Please note that any files lacking explicit license information are intended
 to be covered by the project's [overall license](../LICENSE.md) (GPLv2).

thunks/fel-secure-svc.inc.S

@@ -0,0 +1,43 @@
+SAVED_SP	.req	r10
+SAVED_LR	.req	r11
+
+.set	SUNXI_GICC_BASE,	0x03022000
+.set	SUNXI_GICD_BASE,	0x03021000
+
+.macro	switch_to_secure_svc
+	sync_before_branch
+	mov	SAVED_SP,  sp
+	mov	SAVED_LR,  lr
+	.word	0xe1600070			/* smc	#0 */
+	mov	TMP1,      #0
+	mcr	p15, 0, TMP1, c1, c1, 0		/* SCR = secure */
+	mcr	p15, 0, TMP1, c12, c0, 1	/* MVBAR = 0 */
+	bl	setup_secure_gic
+
+	.word	0xe123f30a			/* msr	SP_svc, SAVED_SP */
+	.word	0xe122f30b			/* msr	LR_svc, SAVED_LR */
+	.word	0xf57ff06f			/* isb */
+	mrs	TMP1,      cpsr
+	bic	TMP1,      TMP1, #0x1f
+	orr	TMP1,      TMP1, #0x13
+	msr	cpsr_fc,   TMP1			/* switch to secure-SVC mode */
+.endm
+
+.macro	emit_secure_svc_helpers
+setup_secure_gic:
+	/* Set the secure GIC view expected by secure-SVC FEL execution. */
+	ldr	TMP1,      gicc_ctlr
+	mov	TMP2,      #0xf
+	str	TMP2,      [TMP1]
+	mov	TMP2,      #0xf8
+	str	TMP2,      [TMP1, #4]
+	ldr	TMP1,      gicd_ctlr
+	mov	TMP2,      #3
+	str	TMP2,      [TMP1]
+	bx	lr
+
+gicc_ctlr:
+	.word	SUNXI_GICC_BASE
+gicd_ctlr:
+	.word	SUNXI_GICD_BASE
+.endm