[0/4] soc: imx: secvio: Add secvio support

Message

Vabhav Sharma May 9, 2024, 12:45 a.m. UTC

The tampers are security feature available on i.MX products and
managed by SNVS block.The tamper goal is to detect the variation
of hardware or physical parameters, which can indicate an attack.

The SNVS, which provides secure non-volatile storage, allows to
detect some hardware attacks against the SoC.They are connected
to the security-violation ports, which send an alert when an
out-of-range value is detected.

This detection is done by:
-Analog tampers: measure analogic values
	- External clock frequency.
	- Temperature.
	- Voltage.

- Digital tampers:
	- External tamper
	- Other detectors:
		- Secure real-time counter rollover tamper.
		- Monotonic counter rollover tamper.
		- Power supply glitch tamper.

The on-chip sensors for voltage, temperature, and clock frequency
indicate if tamper scenarios may be present. These sensors generate an
out-of-range signal that causes a security violation to clear the
authentication and storage keys and to block access to sensitive
information.

Add linux module secvio driver to handle security violation interrupt.

The "imx-secvio-sc" module is designed to report security violations
and tamper triggering to the user.

The functionalities of the module are accessible via the "debugfs"
kernel.The folder containing the interface files for the module is
"<kernel_debugfs>/secvio/".

Get status
Reading from the "info" file will return the status of security:
- Fuse related to security tampers.
- SNVS readable registers.
- DGO registers.

Signed-off-by: Vabhav Sharma <[e-mail]>
---
Vabhav Sharma (4):
      dt-bindings: firmware: secvio: Add device tree bindings
      firmware: imx: Add SC APIs required for secvio module
      soc: imx: secvio: Add support for SNVS secvio and tamper via SCFW
      arm64: dts: imx8q: Add node for Security Violation

 .../bindings/arm/freescale/fsl,scu-secvio.yaml     |  35 ++
 .../devicetree/bindings/firmware/fsl,scu.yaml      |  10 +
 arch/arm64/boot/dts/freescale/imx8qxp.dtsi         |   5 +
 drivers/firmware/imx/Makefile                      |   2 +-
 drivers/firmware/imx/imx-scu.c                     |   4 +-
 drivers/firmware/imx/seco.c                        | 216 ++++++++
 drivers/soc/imx/Kconfig                            |  11 +
 drivers/soc/imx/Makefile                           |   1 +
 drivers/soc/imx/secvio/Makefile                    |   2 +
 drivers/soc/imx/secvio/imx-secvio-debugfs.c        | 274 ++++++++++
 drivers/soc/imx/secvio/imx-secvio-sc.c             | 595 +++++++++++++++++++++
 include/linux/firmware/imx/ipc.h                   |   1 +
 include/linux/firmware/imx/sci.h                   |   4 +
 include/linux/firmware/imx/svc/seco.h              |  69 +++
 include/soc/imx/imx-secvio-sc.h                    | 216 ++++++++
 15 files changed, 1443 insertions(+), 2 deletions(-)
---
base-commit: 93a39e4766083050ca0ecd6a3548093a3b9eb60c
change-id: 20240508-secvio-8acfa2838385

Best regards,

Comments

Krzysztof Kozlowski May 9, 2024, 5:51 a.m. UTC | #1

On 09/05/2024 02:45, Vabhav Sharma wrote:
> The tampers are security feature available on i.MX products and
> managed by SNVS block.The tamper goal is to detect the variation
> of hardware or physical parameters, which can indicate an attack.
> 
> The SNVS, which provides secure non-volatile storage, allows to
> detect some hardware attacks against the SoC.They are connected
> to the security-violation ports, which send an alert when an
> out-of-range value is detected.
> 
> This detection is done by:
> -Analog tampers: measure analogic values
> 	- External clock frequency.
> 	- Temperature.
> 	- Voltage.
> 
> - Digital tampers:
> 	- External tamper
> 	- Other detectors:
> 		- Secure real-time counter rollover tamper.
> 		- Monotonic counter rollover tamper.
> 		- Power supply glitch tamper.
> 
> The on-chip sensors for voltage, temperature, and clock frequency
> indicate if tamper scenarios may be present. These sensors generate an
> out-of-range signal that causes a security violation to clear the
> authentication and storage keys and to block access to sensitive
> information.
> 
> Add linux module secvio driver to handle security violation interrupt.
> 
> The "imx-secvio-sc" module is designed to report security violations
> and tamper triggering to the user.
> 
> The functionalities of the module are accessible via the "debugfs"
> kernel.The folder containing the interface files for the module is
> "<kernel_debugfs>/secvio/".
> 
> Get status
> Reading from the "info" file will return the status of security:
> - Fuse related to security tampers.
> - SNVS readable registers.
> - DGO registers.
> 
> Signed-off-by: Vabhav Sharma <[e-mail]>
> ---
> Vabhav Sharma (4):
>       dt-bindings: firmware: secvio: Add device tree bindings
>       firmware: imx: Add SC APIs required for secvio module
>       soc: imx: secvio: Add support for SNVS secvio and tamper via SCFW
>       arm64: dts: imx8q: Add node for Security Violation

Please version your patches correctly and provide changelog.

I wrote about b4 already, which solves this as well.

What changed here?

Best regards,
Krzysztof

Vabhav Sharma June 7, 2024, 4:52 a.m. UTC | #2

> -----Original Message-----
> From: Krzysztof Kozlowski <[e-mail]>
> Sent: Thursday, May 9, 2024 11:21 AM
> To: Vabhav Sharma <[e-mail]>; Rob Herring
> <[e-mail]>; Krzysztof Kozlowski <[e-mail]>; Conor Dooley
> <[e-mail]>; Franck Lenormand <[e-mail]>;
> Aisheng Dong <[e-mail]>; Shawn Guo
> <[e-mail]>; Sascha Hauer <[e-mail]>;
> Pengutronix Kernel Team <[e-mail]>; Fabio Estevam
> <[e-mail]>; Peng Fan <[e-mail]>
> Cc: [e-mail]; [e-mail];
> [e-mail]; [e-mail]; Varun Sethi
> <[e-mail]>; Silvano Di Ninno <[e-mail]>; Pankaj
> Gupta <[e-mail]>; Frank Li <[e-mail]>; Daniel Baluta
> <[e-mail]>; Iuliana Prodan <[e-mail]>; Horia
> Geanta <[e-mail]>
> Subject: [EXT] Re: [PATCH 0/4] soc: imx: secvio: Add secvio support
> 
> Caution: This is an external email. Please take care when clicking links or
> opening attachments. When in doubt, report the message using the 'Report
> this email' button
> 
> 
> On 09/05/2024 02:45, Vabhav Sharma wrote:
> > The tampers are security feature available on i.MX products and
> > managed by SNVS block.The tamper goal is to detect the variation of
> > hardware or physical parameters, which can indicate an attack.
> >
> > The SNVS, which provides secure non-volatile storage, allows to detect
> > some hardware attacks against the SoC.They are connected to the
> > security-violation ports, which send an alert when an out-of-range
> > value is detected.
> >
> > This detection is done by:
> > -Analog tampers: measure analogic values
> >       - External clock frequency.
> >       - Temperature.
> >       - Voltage.
> >
> > - Digital tampers:
> >       - External tamper
> >       - Other detectors:
> >               - Secure real-time counter rollover tamper.
> >               - Monotonic counter rollover tamper.
> >               - Power supply glitch tamper.
> >
> > The on-chip sensors for voltage, temperature, and clock frequency
> > indicate if tamper scenarios may be present. These sensors generate an
> > out-of-range signal that causes a security violation to clear the
> > authentication and storage keys and to block access to sensitive
> > information.
> >
> > Add linux module secvio driver to handle security violation interrupt.
> >
> > The "imx-secvio-sc" module is designed to report security violations
> > and tamper triggering to the user.
> >
> > The functionalities of the module are accessible via the "debugfs"
> > kernel.The folder containing the interface files for the module is
> > "<kernel_debugfs>/secvio/".
> >
> > Get status
> > Reading from the "info" file will return the status of security:
> > - Fuse related to security tampers.
> > - SNVS readable registers.
> > - DGO registers.
> >
> > Signed-off-by: Vabhav Sharma <[e-mail]>
> > ---
> > Vabhav Sharma (4):
> >       dt-bindings: firmware: secvio: Add device tree bindings
> >       firmware: imx: Add SC APIs required for secvio module
> >       soc: imx: secvio: Add support for SNVS secvio and tamper via SCFW
> >       arm64: dts: imx8q: Add node for Security Violation
> 
> Please version your patches correctly and provide changelog.
Sure, I will update the changelog for v1 and v2.
> 
> I wrote about b4 already, which solves this as well.
Ok, I used it, will provide details for changelog in next version
> 
> What changed here?
As highlighted by you, Used b4 script to auto add all maintainer/reviewer.
> 
> Best regards,
> Krzysztof