1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * Intel MAX10 Board Management Controller Secure Update Driver
4 *
5 * Copyright (C) 2019-2022 Intel Corporation. All rights reserved.
6 *
7 */
8 #include <linux/bitfield.h>
9 #include <linux/device.h>
10 #include <linux/firmware.h>
11 #include <linux/mfd/intel-m10-bmc.h>
12 #include <linux/module.h>
13 #include <linux/platform_device.h>
14 #include <linux/slab.h>
15
16 struct m10bmc_sec;
17
18 struct m10bmc_sec_ops {
19 int (*rsu_status)(struct m10bmc_sec *sec);
20 };
21
22 struct m10bmc_sec {
23 struct device *dev;
24 struct intel_m10bmc *m10bmc;
25 struct fw_upload *fwl;
26 char *fw_name;
27 u32 fw_name_id;
28 bool cancel_request;
29 const struct m10bmc_sec_ops *ops;
30 };
31
32 static DEFINE_XARRAY_ALLOC(fw_upload_xa);
33
34 /* Root Entry Hash (REH) support */
35 #define REH_SHA256_SIZE 32
36 #define REH_SHA384_SIZE 48
37 #define REH_MAGIC GENMASK(15, 0)
38 #define REH_SHA_NUM_BYTES GENMASK(31, 16)
39
m10bmc_sec_write(struct m10bmc_sec * sec,const u8 * buf,u32 offset,u32 size)40 static int m10bmc_sec_write(struct m10bmc_sec *sec, const u8 *buf, u32 offset, u32 size)
41 {
42 struct intel_m10bmc *m10bmc = sec->m10bmc;
43 unsigned int stride = regmap_get_reg_stride(m10bmc->regmap);
44 u32 write_count = size / stride;
45 u32 leftover_offset = write_count * stride;
46 u32 leftover_size = size - leftover_offset;
47 u32 leftover_tmp = 0;
48 int ret;
49
50 if (sec->m10bmc->flash_bulk_ops)
51 return sec->m10bmc->flash_bulk_ops->write(m10bmc, buf, offset, size);
52
53 if (WARN_ON_ONCE(stride > sizeof(leftover_tmp)))
54 return -EINVAL;
55
56 ret = regmap_bulk_write(m10bmc->regmap, M10BMC_STAGING_BASE + offset,
57 buf + offset, write_count);
58 if (ret)
59 return ret;
60
61 /* If size is not aligned to stride, handle the remainder bytes with regmap_write() */
62 if (leftover_size) {
63 memcpy(&leftover_tmp, buf + leftover_offset, leftover_size);
64 ret = regmap_write(m10bmc->regmap, M10BMC_STAGING_BASE + offset + leftover_offset,
65 leftover_tmp);
66 if (ret)
67 return ret;
68 }
69
70 return 0;
71 }
72
m10bmc_sec_read(struct m10bmc_sec * sec,u8 * buf,u32 addr,u32 size)73 static int m10bmc_sec_read(struct m10bmc_sec *sec, u8 *buf, u32 addr, u32 size)
74 {
75 struct intel_m10bmc *m10bmc = sec->m10bmc;
76 unsigned int stride = regmap_get_reg_stride(m10bmc->regmap);
77 u32 read_count = size / stride;
78 u32 leftover_offset = read_count * stride;
79 u32 leftover_size = size - leftover_offset;
80 u32 leftover_tmp;
81 int ret;
82
83 if (sec->m10bmc->flash_bulk_ops)
84 return sec->m10bmc->flash_bulk_ops->read(m10bmc, buf, addr, size);
85
86 if (WARN_ON_ONCE(stride > sizeof(leftover_tmp)))
87 return -EINVAL;
88
89 ret = regmap_bulk_read(m10bmc->regmap, addr, buf, read_count);
90 if (ret)
91 return ret;
92
93 /* If size is not aligned to stride, handle the remainder bytes with regmap_read() */
94 if (leftover_size) {
95 ret = regmap_read(m10bmc->regmap, addr + leftover_offset, &leftover_tmp);
96 if (ret)
97 return ret;
98 memcpy(buf + leftover_offset, &leftover_tmp, leftover_size);
99 }
100
101 return 0;
102 }
103
104
105 static ssize_t
show_root_entry_hash(struct device * dev,u32 exp_magic,u32 prog_addr,u32 reh_addr,char * buf)106 show_root_entry_hash(struct device *dev, u32 exp_magic,
107 u32 prog_addr, u32 reh_addr, char *buf)
108 {
109 struct m10bmc_sec *sec = dev_get_drvdata(dev);
110 int sha_num_bytes, i, ret, cnt = 0;
111 u8 hash[REH_SHA384_SIZE];
112 u32 magic;
113
114 ret = m10bmc_sec_read(sec, (u8 *)&magic, prog_addr, sizeof(magic));
115 if (ret)
116 return ret;
117
118 if (FIELD_GET(REH_MAGIC, magic) != exp_magic)
119 return sysfs_emit(buf, "hash not programmed\n");
120
121 sha_num_bytes = FIELD_GET(REH_SHA_NUM_BYTES, magic) / 8;
122 if (sha_num_bytes != REH_SHA256_SIZE &&
123 sha_num_bytes != REH_SHA384_SIZE) {
124 dev_err(sec->dev, "%s bad sha num bytes %d\n", __func__,
125 sha_num_bytes);
126 return -EINVAL;
127 }
128
129 ret = m10bmc_sec_read(sec, hash, reh_addr, sha_num_bytes);
130 if (ret) {
131 dev_err(dev, "failed to read root entry hash\n");
132 return ret;
133 }
134
135 for (i = 0; i < sha_num_bytes; i++)
136 cnt += sprintf(buf + cnt, "%02x", hash[i]);
137 cnt += sprintf(buf + cnt, "\n");
138
139 return cnt;
140 }
141
142 #define DEVICE_ATTR_SEC_REH_RO(_name) \
143 static ssize_t _name##_root_entry_hash_show(struct device *dev, \
144 struct device_attribute *attr, \
145 char *buf) \
146 { \
147 struct m10bmc_sec *sec = dev_get_drvdata(dev); \
148 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; \
149 \
150 return show_root_entry_hash(dev, csr_map->_name##_magic, \
151 csr_map->_name##_prog_addr, \
152 csr_map->_name##_reh_addr, \
153 buf); \
154 } \
155 static DEVICE_ATTR_RO(_name##_root_entry_hash)
156
157 DEVICE_ATTR_SEC_REH_RO(bmc);
158 DEVICE_ATTR_SEC_REH_RO(sr);
159 DEVICE_ATTR_SEC_REH_RO(pr);
160
161 #define CSK_BIT_LEN 128U
162 #define CSK_32ARRAY_SIZE DIV_ROUND_UP(CSK_BIT_LEN, 32)
163
164 static ssize_t
show_canceled_csk(struct device * dev,u32 addr,char * buf)165 show_canceled_csk(struct device *dev, u32 addr, char *buf)
166 {
167 unsigned int i, size = CSK_32ARRAY_SIZE * sizeof(u32);
168 struct m10bmc_sec *sec = dev_get_drvdata(dev);
169 DECLARE_BITMAP(csk_map, CSK_BIT_LEN);
170 __le32 csk_le32[CSK_32ARRAY_SIZE];
171 u32 csk32[CSK_32ARRAY_SIZE];
172 int ret;
173
174 ret = m10bmc_sec_read(sec, (u8 *)&csk_le32, addr, size);
175 if (ret) {
176 dev_err(sec->dev, "failed to read CSK vector\n");
177 return ret;
178 }
179
180 for (i = 0; i < CSK_32ARRAY_SIZE; i++)
181 csk32[i] = le32_to_cpu(((csk_le32[i])));
182
183 bitmap_from_arr32(csk_map, csk32, CSK_BIT_LEN);
184 bitmap_complement(csk_map, csk_map, CSK_BIT_LEN);
185 return sysfs_emit(buf, "%*pbl\n", CSK_BIT_LEN, csk_map);
186 }
187
188 #define DEVICE_ATTR_SEC_CSK_RO(_name) \
189 static ssize_t _name##_canceled_csks_show(struct device *dev, \
190 struct device_attribute *attr, \
191 char *buf) \
192 { \
193 struct m10bmc_sec *sec = dev_get_drvdata(dev); \
194 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; \
195 \
196 return show_canceled_csk(dev, \
197 csr_map->_name##_prog_addr + CSK_VEC_OFFSET, \
198 buf); \
199 } \
200 static DEVICE_ATTR_RO(_name##_canceled_csks)
201
202 #define CSK_VEC_OFFSET 0x34
203
204 DEVICE_ATTR_SEC_CSK_RO(bmc);
205 DEVICE_ATTR_SEC_CSK_RO(sr);
206 DEVICE_ATTR_SEC_CSK_RO(pr);
207
208 #define FLASH_COUNT_SIZE 4096 /* count stored as inverted bit vector */
209
flash_count_show(struct device * dev,struct device_attribute * attr,char * buf)210 static ssize_t flash_count_show(struct device *dev,
211 struct device_attribute *attr, char *buf)
212 {
213 struct m10bmc_sec *sec = dev_get_drvdata(dev);
214 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
215 unsigned int num_bits;
216 u8 *flash_buf;
217 int cnt, ret;
218
219 num_bits = FLASH_COUNT_SIZE * 8;
220
221 flash_buf = kmalloc(FLASH_COUNT_SIZE, GFP_KERNEL);
222 if (!flash_buf)
223 return -ENOMEM;
224
225 ret = m10bmc_sec_read(sec, flash_buf, csr_map->rsu_update_counter,
226 FLASH_COUNT_SIZE);
227 if (ret) {
228 dev_err(sec->dev, "failed to read flash count\n");
229 goto exit_free;
230 }
231 cnt = num_bits - bitmap_weight((unsigned long *)flash_buf, num_bits);
232
233 exit_free:
234 kfree(flash_buf);
235
236 return ret ? : sysfs_emit(buf, "%u\n", cnt);
237 }
238 static DEVICE_ATTR_RO(flash_count);
239
240 static struct attribute *m10bmc_security_attrs[] = {
241 &dev_attr_flash_count.attr,
242 &dev_attr_bmc_root_entry_hash.attr,
243 &dev_attr_sr_root_entry_hash.attr,
244 &dev_attr_pr_root_entry_hash.attr,
245 &dev_attr_sr_canceled_csks.attr,
246 &dev_attr_pr_canceled_csks.attr,
247 &dev_attr_bmc_canceled_csks.attr,
248 NULL,
249 };
250
251 static struct attribute_group m10bmc_security_attr_group = {
252 .name = "security",
253 .attrs = m10bmc_security_attrs,
254 };
255
256 static const struct attribute_group *m10bmc_sec_attr_groups[] = {
257 &m10bmc_security_attr_group,
258 NULL,
259 };
260
log_error_regs(struct m10bmc_sec * sec,u32 doorbell)261 static void log_error_regs(struct m10bmc_sec *sec, u32 doorbell)
262 {
263 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
264 u32 auth_result;
265
266 dev_err(sec->dev, "Doorbell: 0x%08x\n", doorbell);
267
268 if (!m10bmc_sys_read(sec->m10bmc, csr_map->auth_result, &auth_result))
269 dev_err(sec->dev, "RSU auth result: 0x%08x\n", auth_result);
270 }
271
m10bmc_sec_n3000_rsu_status(struct m10bmc_sec * sec)272 static int m10bmc_sec_n3000_rsu_status(struct m10bmc_sec *sec)
273 {
274 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
275 u32 doorbell;
276 int ret;
277
278 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell);
279 if (ret)
280 return ret;
281
282 return FIELD_GET(DRBL_RSU_STATUS, doorbell);
283 }
284
m10bmc_sec_n6000_rsu_status(struct m10bmc_sec * sec)285 static int m10bmc_sec_n6000_rsu_status(struct m10bmc_sec *sec)
286 {
287 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
288 u32 auth_result;
289 int ret;
290
291 ret = m10bmc_sys_read(sec->m10bmc, csr_map->auth_result, &auth_result);
292 if (ret)
293 return ret;
294
295 return FIELD_GET(AUTH_RESULT_RSU_STATUS, auth_result);
296 }
297
rsu_status_ok(u32 status)298 static bool rsu_status_ok(u32 status)
299 {
300 return (status == RSU_STAT_NORMAL ||
301 status == RSU_STAT_NIOS_OK ||
302 status == RSU_STAT_USER_OK ||
303 status == RSU_STAT_FACTORY_OK);
304 }
305
rsu_progress_done(u32 progress)306 static bool rsu_progress_done(u32 progress)
307 {
308 return (progress == RSU_PROG_IDLE ||
309 progress == RSU_PROG_RSU_DONE);
310 }
311
rsu_progress_busy(u32 progress)312 static bool rsu_progress_busy(u32 progress)
313 {
314 return (progress == RSU_PROG_AUTHENTICATING ||
315 progress == RSU_PROG_COPYING ||
316 progress == RSU_PROG_UPDATE_CANCEL ||
317 progress == RSU_PROG_PROGRAM_KEY_HASH);
318 }
319
m10bmc_sec_progress_status(struct m10bmc_sec * sec,u32 * doorbell_reg,u32 * progress,u32 * status)320 static int m10bmc_sec_progress_status(struct m10bmc_sec *sec, u32 *doorbell_reg,
321 u32 *progress, u32 *status)
322 {
323 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
324 int ret;
325
326 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, doorbell_reg);
327 if (ret)
328 return ret;
329
330 ret = sec->ops->rsu_status(sec);
331 if (ret < 0)
332 return ret;
333
334 *status = ret;
335 *progress = rsu_prog(*doorbell_reg);
336
337 return 0;
338 }
339
rsu_check_idle(struct m10bmc_sec * sec)340 static enum fw_upload_err rsu_check_idle(struct m10bmc_sec *sec)
341 {
342 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
343 u32 doorbell;
344 int ret;
345
346 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell);
347 if (ret)
348 return FW_UPLOAD_ERR_RW_ERROR;
349
350 if (!rsu_progress_done(rsu_prog(doorbell))) {
351 log_error_regs(sec, doorbell);
352 return FW_UPLOAD_ERR_BUSY;
353 }
354
355 return FW_UPLOAD_ERR_NONE;
356 }
357
rsu_start_done(u32 doorbell_reg,u32 progress,u32 status)358 static inline bool rsu_start_done(u32 doorbell_reg, u32 progress, u32 status)
359 {
360 if (doorbell_reg & DRBL_RSU_REQUEST)
361 return false;
362
363 if (status == RSU_STAT_ERASE_FAIL || status == RSU_STAT_WEAROUT)
364 return true;
365
366 if (!rsu_progress_done(progress))
367 return true;
368
369 return false;
370 }
371
rsu_update_init(struct m10bmc_sec * sec)372 static enum fw_upload_err rsu_update_init(struct m10bmc_sec *sec)
373 {
374 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
375 u32 doorbell_reg, progress, status;
376 int ret, err;
377
378 ret = m10bmc_sys_update_bits(sec->m10bmc, csr_map->doorbell,
379 DRBL_RSU_REQUEST | DRBL_HOST_STATUS,
380 DRBL_RSU_REQUEST |
381 FIELD_PREP(DRBL_HOST_STATUS,
382 HOST_STATUS_IDLE));
383 if (ret)
384 return FW_UPLOAD_ERR_RW_ERROR;
385
386 ret = read_poll_timeout(m10bmc_sec_progress_status, err,
387 err < 0 || rsu_start_done(doorbell_reg, progress, status),
388 NIOS_HANDSHAKE_INTERVAL_US,
389 NIOS_HANDSHAKE_TIMEOUT_US,
390 false,
391 sec, &doorbell_reg, &progress, &status);
392
393 if (ret == -ETIMEDOUT) {
394 log_error_regs(sec, doorbell_reg);
395 return FW_UPLOAD_ERR_TIMEOUT;
396 } else if (err) {
397 return FW_UPLOAD_ERR_RW_ERROR;
398 }
399
400 if (status == RSU_STAT_WEAROUT) {
401 dev_warn(sec->dev, "Excessive flash update count detected\n");
402 return FW_UPLOAD_ERR_WEAROUT;
403 } else if (status == RSU_STAT_ERASE_FAIL) {
404 log_error_regs(sec, doorbell_reg);
405 return FW_UPLOAD_ERR_HW_ERROR;
406 }
407
408 return FW_UPLOAD_ERR_NONE;
409 }
410
rsu_prog_ready(struct m10bmc_sec * sec)411 static enum fw_upload_err rsu_prog_ready(struct m10bmc_sec *sec)
412 {
413 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
414 unsigned long poll_timeout;
415 u32 doorbell, progress;
416 int ret;
417
418 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell);
419 if (ret)
420 return FW_UPLOAD_ERR_RW_ERROR;
421
422 poll_timeout = jiffies + msecs_to_jiffies(RSU_PREP_TIMEOUT_MS);
423 while (rsu_prog(doorbell) == RSU_PROG_PREPARE) {
424 msleep(RSU_PREP_INTERVAL_MS);
425 if (time_after(jiffies, poll_timeout))
426 break;
427
428 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell);
429 if (ret)
430 return FW_UPLOAD_ERR_RW_ERROR;
431 }
432
433 progress = rsu_prog(doorbell);
434 if (progress == RSU_PROG_PREPARE) {
435 log_error_regs(sec, doorbell);
436 return FW_UPLOAD_ERR_TIMEOUT;
437 } else if (progress != RSU_PROG_READY) {
438 log_error_regs(sec, doorbell);
439 return FW_UPLOAD_ERR_HW_ERROR;
440 }
441
442 return FW_UPLOAD_ERR_NONE;
443 }
444
rsu_send_data(struct m10bmc_sec * sec)445 static enum fw_upload_err rsu_send_data(struct m10bmc_sec *sec)
446 {
447 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
448 u32 doorbell_reg, status;
449 int ret;
450
451 ret = m10bmc_sys_update_bits(sec->m10bmc, csr_map->doorbell,
452 DRBL_HOST_STATUS,
453 FIELD_PREP(DRBL_HOST_STATUS,
454 HOST_STATUS_WRITE_DONE));
455 if (ret)
456 return FW_UPLOAD_ERR_RW_ERROR;
457
458 ret = regmap_read_poll_timeout(sec->m10bmc->regmap,
459 csr_map->base + csr_map->doorbell,
460 doorbell_reg,
461 rsu_prog(doorbell_reg) != RSU_PROG_READY,
462 NIOS_HANDSHAKE_INTERVAL_US,
463 NIOS_HANDSHAKE_TIMEOUT_US);
464
465 if (ret == -ETIMEDOUT) {
466 log_error_regs(sec, doorbell_reg);
467 return FW_UPLOAD_ERR_TIMEOUT;
468 } else if (ret) {
469 return FW_UPLOAD_ERR_RW_ERROR;
470 }
471
472 ret = sec->ops->rsu_status(sec);
473 if (ret < 0)
474 return FW_UPLOAD_ERR_HW_ERROR;
475 status = ret;
476
477 if (!rsu_status_ok(status)) {
478 log_error_regs(sec, doorbell_reg);
479 return FW_UPLOAD_ERR_HW_ERROR;
480 }
481
482 return FW_UPLOAD_ERR_NONE;
483 }
484
rsu_check_complete(struct m10bmc_sec * sec,u32 * doorbell_reg)485 static int rsu_check_complete(struct m10bmc_sec *sec, u32 *doorbell_reg)
486 {
487 u32 progress, status;
488
489 if (m10bmc_sec_progress_status(sec, doorbell_reg, &progress, &status))
490 return -EIO;
491
492 if (!rsu_status_ok(status))
493 return -EINVAL;
494
495 if (rsu_progress_done(progress))
496 return 0;
497
498 if (rsu_progress_busy(progress))
499 return -EAGAIN;
500
501 return -EINVAL;
502 }
503
rsu_cancel(struct m10bmc_sec * sec)504 static enum fw_upload_err rsu_cancel(struct m10bmc_sec *sec)
505 {
506 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
507 u32 doorbell;
508 int ret;
509
510 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell);
511 if (ret)
512 return FW_UPLOAD_ERR_RW_ERROR;
513
514 if (rsu_prog(doorbell) != RSU_PROG_READY)
515 return FW_UPLOAD_ERR_BUSY;
516
517 ret = m10bmc_sys_update_bits(sec->m10bmc, csr_map->doorbell,
518 DRBL_HOST_STATUS,
519 FIELD_PREP(DRBL_HOST_STATUS,
520 HOST_STATUS_ABORT_RSU));
521 if (ret)
522 return FW_UPLOAD_ERR_RW_ERROR;
523
524 return FW_UPLOAD_ERR_CANCELED;
525 }
526
m10bmc_sec_prepare(struct fw_upload * fwl,const u8 * data,u32 size)527 static enum fw_upload_err m10bmc_sec_prepare(struct fw_upload *fwl,
528 const u8 *data, u32 size)
529 {
530 struct m10bmc_sec *sec = fwl->dd_handle;
531 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
532 u32 ret;
533
534 sec->cancel_request = false;
535
536 if (!size || size > csr_map->staging_size)
537 return FW_UPLOAD_ERR_INVALID_SIZE;
538
539 if (sec->m10bmc->flash_bulk_ops)
540 if (sec->m10bmc->flash_bulk_ops->lock_write(sec->m10bmc))
541 return FW_UPLOAD_ERR_BUSY;
542
543 ret = rsu_check_idle(sec);
544 if (ret != FW_UPLOAD_ERR_NONE)
545 goto unlock_flash;
546
547 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_SEC_UPDATE_PREPARE);
548
549 ret = rsu_update_init(sec);
550 if (ret != FW_UPLOAD_ERR_NONE)
551 goto fw_state_exit;
552
553 ret = rsu_prog_ready(sec);
554 if (ret != FW_UPLOAD_ERR_NONE)
555 goto fw_state_exit;
556
557 if (sec->cancel_request) {
558 ret = rsu_cancel(sec);
559 goto fw_state_exit;
560 }
561
562 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_SEC_UPDATE_WRITE);
563
564 return FW_UPLOAD_ERR_NONE;
565
566 fw_state_exit:
567 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_NORMAL);
568
569 unlock_flash:
570 if (sec->m10bmc->flash_bulk_ops)
571 sec->m10bmc->flash_bulk_ops->unlock_write(sec->m10bmc);
572 return ret;
573 }
574
575 #define WRITE_BLOCK_SIZE 0x4000 /* Default write-block size is 0x4000 bytes */
576
m10bmc_sec_fw_write(struct fw_upload * fwl,const u8 * data,u32 offset,u32 size,u32 * written)577 static enum fw_upload_err m10bmc_sec_fw_write(struct fw_upload *fwl, const u8 *data,
578 u32 offset, u32 size, u32 *written)
579 {
580 struct m10bmc_sec *sec = fwl->dd_handle;
581 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map;
582 struct intel_m10bmc *m10bmc = sec->m10bmc;
583 u32 blk_size, doorbell;
584 int ret;
585
586 if (sec->cancel_request)
587 return rsu_cancel(sec);
588
589 ret = m10bmc_sys_read(m10bmc, csr_map->doorbell, &doorbell);
590 if (ret) {
591 return FW_UPLOAD_ERR_RW_ERROR;
592 } else if (rsu_prog(doorbell) != RSU_PROG_READY) {
593 log_error_regs(sec, doorbell);
594 return FW_UPLOAD_ERR_HW_ERROR;
595 }
596
597 WARN_ON_ONCE(WRITE_BLOCK_SIZE % regmap_get_reg_stride(m10bmc->regmap));
598 blk_size = min_t(u32, WRITE_BLOCK_SIZE, size);
599 ret = m10bmc_sec_write(sec, data, offset, blk_size);
600 if (ret)
601 return FW_UPLOAD_ERR_RW_ERROR;
602
603 *written = blk_size;
604 return FW_UPLOAD_ERR_NONE;
605 }
606
m10bmc_sec_poll_complete(struct fw_upload * fwl)607 static enum fw_upload_err m10bmc_sec_poll_complete(struct fw_upload *fwl)
608 {
609 struct m10bmc_sec *sec = fwl->dd_handle;
610 unsigned long poll_timeout;
611 u32 doorbell, result;
612 int ret;
613
614 if (sec->cancel_request)
615 return rsu_cancel(sec);
616
617 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_SEC_UPDATE_PROGRAM);
618
619 result = rsu_send_data(sec);
620 if (result != FW_UPLOAD_ERR_NONE)
621 return result;
622
623 poll_timeout = jiffies + msecs_to_jiffies(RSU_COMPLETE_TIMEOUT_MS);
624 do {
625 msleep(RSU_COMPLETE_INTERVAL_MS);
626 ret = rsu_check_complete(sec, &doorbell);
627 } while (ret == -EAGAIN && !time_after(jiffies, poll_timeout));
628
629 if (ret == -EAGAIN) {
630 log_error_regs(sec, doorbell);
631 return FW_UPLOAD_ERR_TIMEOUT;
632 } else if (ret == -EIO) {
633 return FW_UPLOAD_ERR_RW_ERROR;
634 } else if (ret) {
635 log_error_regs(sec, doorbell);
636 return FW_UPLOAD_ERR_HW_ERROR;
637 }
638
639 return FW_UPLOAD_ERR_NONE;
640 }
641
642 /*
643 * m10bmc_sec_cancel() may be called asynchronously with an on-going update.
644 * All other functions are called sequentially in a single thread. To avoid
645 * contention on register accesses, m10bmc_sec_cancel() must only update
646 * the cancel_request flag. Other functions will check this flag and handle
647 * the cancel request synchronously.
648 */
m10bmc_sec_cancel(struct fw_upload * fwl)649 static void m10bmc_sec_cancel(struct fw_upload *fwl)
650 {
651 struct m10bmc_sec *sec = fwl->dd_handle;
652
653 sec->cancel_request = true;
654 }
655
m10bmc_sec_cleanup(struct fw_upload * fwl)656 static void m10bmc_sec_cleanup(struct fw_upload *fwl)
657 {
658 struct m10bmc_sec *sec = fwl->dd_handle;
659
660 (void)rsu_cancel(sec);
661
662 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_NORMAL);
663
664 if (sec->m10bmc->flash_bulk_ops)
665 sec->m10bmc->flash_bulk_ops->unlock_write(sec->m10bmc);
666 }
667
668 static const struct fw_upload_ops m10bmc_ops = {
669 .prepare = m10bmc_sec_prepare,
670 .write = m10bmc_sec_fw_write,
671 .poll_complete = m10bmc_sec_poll_complete,
672 .cancel = m10bmc_sec_cancel,
673 .cleanup = m10bmc_sec_cleanup,
674 };
675
676 static const struct m10bmc_sec_ops m10sec_n3000_ops = {
677 .rsu_status = m10bmc_sec_n3000_rsu_status,
678 };
679
680 static const struct m10bmc_sec_ops m10sec_n6000_ops = {
681 .rsu_status = m10bmc_sec_n6000_rsu_status,
682 };
683
684 #define SEC_UPDATE_LEN_MAX 32
m10bmc_sec_probe(struct platform_device * pdev)685 static int m10bmc_sec_probe(struct platform_device *pdev)
686 {
687 char buf[SEC_UPDATE_LEN_MAX];
688 struct m10bmc_sec *sec;
689 struct fw_upload *fwl;
690 unsigned int len;
691 int ret;
692
693 sec = devm_kzalloc(&pdev->dev, sizeof(*sec), GFP_KERNEL);
694 if (!sec)
695 return -ENOMEM;
696
697 sec->dev = &pdev->dev;
698 sec->m10bmc = dev_get_drvdata(pdev->dev.parent);
699 sec->ops = (struct m10bmc_sec_ops *)platform_get_device_id(pdev)->driver_data;
700 dev_set_drvdata(&pdev->dev, sec);
701
702 ret = xa_alloc(&fw_upload_xa, &sec->fw_name_id, sec,
703 xa_limit_32b, GFP_KERNEL);
704 if (ret)
705 return ret;
706
707 len = scnprintf(buf, SEC_UPDATE_LEN_MAX, "secure-update%d",
708 sec->fw_name_id);
709 sec->fw_name = kmemdup_nul(buf, len, GFP_KERNEL);
710 if (!sec->fw_name) {
711 ret = -ENOMEM;
712 goto fw_name_fail;
713 }
714
715 fwl = firmware_upload_register(THIS_MODULE, sec->dev, sec->fw_name,
716 &m10bmc_ops, sec);
717 if (IS_ERR(fwl)) {
718 dev_err(sec->dev, "Firmware Upload driver failed to start\n");
719 ret = PTR_ERR(fwl);
720 goto fw_uploader_fail;
721 }
722
723 sec->fwl = fwl;
724 return 0;
725
726 fw_uploader_fail:
727 kfree(sec->fw_name);
728 fw_name_fail:
729 xa_erase(&fw_upload_xa, sec->fw_name_id);
730 return ret;
731 }
732
m10bmc_sec_remove(struct platform_device * pdev)733 static void m10bmc_sec_remove(struct platform_device *pdev)
734 {
735 struct m10bmc_sec *sec = dev_get_drvdata(&pdev->dev);
736
737 firmware_upload_unregister(sec->fwl);
738 kfree(sec->fw_name);
739 xa_erase(&fw_upload_xa, sec->fw_name_id);
740 }
741
742 static const struct platform_device_id intel_m10bmc_sec_ids[] = {
743 {
744 .name = "n3000bmc-sec-update",
745 .driver_data = (kernel_ulong_t)&m10sec_n3000_ops,
746 },
747 {
748 .name = "d5005bmc-sec-update",
749 .driver_data = (kernel_ulong_t)&m10sec_n3000_ops,
750 },
751 {
752 .name = "n6000bmc-sec-update",
753 .driver_data = (kernel_ulong_t)&m10sec_n6000_ops,
754 },
755 { }
756 };
757 MODULE_DEVICE_TABLE(platform, intel_m10bmc_sec_ids);
758
759 static struct platform_driver intel_m10bmc_sec_driver = {
760 .probe = m10bmc_sec_probe,
761 .remove = m10bmc_sec_remove,
762 .driver = {
763 .name = "intel-m10bmc-sec-update",
764 .dev_groups = m10bmc_sec_attr_groups,
765 },
766 .id_table = intel_m10bmc_sec_ids,
767 };
768 module_platform_driver(intel_m10bmc_sec_driver);
769
770 MODULE_AUTHOR("Intel Corporation");
771 MODULE_DESCRIPTION("Intel MAX10 BMC Secure Update");
772 MODULE_LICENSE("GPL");
773 MODULE_IMPORT_NS("INTEL_M10_BMC_CORE");
774