1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Intel MAX10 Board Management Controller Secure Update Driver 4 * 5 * Copyright (C) 2019-2022 Intel Corporation. All rights reserved. 6 * 7 */ 8 #include <linux/bitfield.h> 9 #include <linux/device.h> 10 #include <linux/firmware.h> 11 #include <linux/mfd/intel-m10-bmc.h> 12 #include <linux/module.h> 13 #include <linux/platform_device.h> 14 #include <linux/slab.h> 15 16 struct m10bmc_sec; 17 18 struct m10bmc_sec_ops { 19 int (*rsu_status)(struct m10bmc_sec *sec); 20 }; 21 22 struct m10bmc_sec { 23 struct device *dev; 24 struct intel_m10bmc *m10bmc; 25 struct fw_upload *fwl; 26 char *fw_name; 27 u32 fw_name_id; 28 bool cancel_request; 29 const struct m10bmc_sec_ops *ops; 30 }; 31 32 static DEFINE_XARRAY_ALLOC(fw_upload_xa); 33 34 /* Root Entry Hash (REH) support */ 35 #define REH_SHA256_SIZE 32 36 #define REH_SHA384_SIZE 48 37 #define REH_MAGIC GENMASK(15, 0) 38 #define REH_SHA_NUM_BYTES GENMASK(31, 16) 39 40 static int m10bmc_sec_write(struct m10bmc_sec *sec, const u8 *buf, u32 offset, u32 size) 41 { 42 struct intel_m10bmc *m10bmc = sec->m10bmc; 43 unsigned int stride = regmap_get_reg_stride(m10bmc->regmap); 44 u32 write_count = size / stride; 45 u32 leftover_offset = write_count * stride; 46 u32 leftover_size = size - leftover_offset; 47 u32 leftover_tmp = 0; 48 int ret; 49 50 if (sec->m10bmc->flash_bulk_ops) 51 return sec->m10bmc->flash_bulk_ops->write(m10bmc, buf, offset, size); 52 53 if (WARN_ON_ONCE(stride > sizeof(leftover_tmp))) 54 return -EINVAL; 55 56 ret = regmap_bulk_write(m10bmc->regmap, M10BMC_STAGING_BASE + offset, 57 buf + offset, write_count); 58 if (ret) 59 return ret; 60 61 /* If size is not aligned to stride, handle the remainder bytes with regmap_write() */ 62 if (leftover_size) { 63 memcpy(&leftover_tmp, buf + leftover_offset, leftover_size); 64 ret = regmap_write(m10bmc->regmap, M10BMC_STAGING_BASE + offset + leftover_offset, 65 leftover_tmp); 66 if (ret) 67 return ret; 68 } 69 70 return 0; 71 } 72 73 static int m10bmc_sec_read(struct m10bmc_sec *sec, u8 *buf, u32 addr, u32 size) 74 { 75 struct intel_m10bmc *m10bmc = sec->m10bmc; 76 unsigned int stride = regmap_get_reg_stride(m10bmc->regmap); 77 u32 read_count = size / stride; 78 u32 leftover_offset = read_count * stride; 79 u32 leftover_size = size - leftover_offset; 80 u32 leftover_tmp; 81 int ret; 82 83 if (sec->m10bmc->flash_bulk_ops) 84 return sec->m10bmc->flash_bulk_ops->read(m10bmc, buf, addr, size); 85 86 if (WARN_ON_ONCE(stride > sizeof(leftover_tmp))) 87 return -EINVAL; 88 89 ret = regmap_bulk_read(m10bmc->regmap, addr, buf, read_count); 90 if (ret) 91 return ret; 92 93 /* If size is not aligned to stride, handle the remainder bytes with regmap_read() */ 94 if (leftover_size) { 95 ret = regmap_read(m10bmc->regmap, addr + leftover_offset, &leftover_tmp); 96 if (ret) 97 return ret; 98 memcpy(buf + leftover_offset, &leftover_tmp, leftover_size); 99 } 100 101 return 0; 102 } 103 104 105 static ssize_t 106 show_root_entry_hash(struct device *dev, u32 exp_magic, 107 u32 prog_addr, u32 reh_addr, char *buf) 108 { 109 struct m10bmc_sec *sec = dev_get_drvdata(dev); 110 int sha_num_bytes, i, ret, cnt = 0; 111 u8 hash[REH_SHA384_SIZE]; 112 u32 magic; 113 114 ret = m10bmc_sec_read(sec, (u8 *)&magic, prog_addr, sizeof(magic)); 115 if (ret) 116 return ret; 117 118 if (FIELD_GET(REH_MAGIC, magic) != exp_magic) 119 return sysfs_emit(buf, "hash not programmed\n"); 120 121 sha_num_bytes = FIELD_GET(REH_SHA_NUM_BYTES, magic) / 8; 122 if (sha_num_bytes != REH_SHA256_SIZE && 123 sha_num_bytes != REH_SHA384_SIZE) { 124 dev_err(sec->dev, "%s bad sha num bytes %d\n", __func__, 125 sha_num_bytes); 126 return -EINVAL; 127 } 128 129 ret = m10bmc_sec_read(sec, hash, reh_addr, sha_num_bytes); 130 if (ret) { 131 dev_err(dev, "failed to read root entry hash\n"); 132 return ret; 133 } 134 135 for (i = 0; i < sha_num_bytes; i++) 136 cnt += sprintf(buf + cnt, "%02x", hash[i]); 137 cnt += sprintf(buf + cnt, "\n"); 138 139 return cnt; 140 } 141 142 #define DEVICE_ATTR_SEC_REH_RO(_name) \ 143 static ssize_t _name##_root_entry_hash_show(struct device *dev, \ 144 struct device_attribute *attr, \ 145 char *buf) \ 146 { \ 147 struct m10bmc_sec *sec = dev_get_drvdata(dev); \ 148 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; \ 149 \ 150 return show_root_entry_hash(dev, csr_map->_name##_magic, \ 151 csr_map->_name##_prog_addr, \ 152 csr_map->_name##_reh_addr, \ 153 buf); \ 154 } \ 155 static DEVICE_ATTR_RO(_name##_root_entry_hash) 156 157 DEVICE_ATTR_SEC_REH_RO(bmc); 158 DEVICE_ATTR_SEC_REH_RO(sr); 159 DEVICE_ATTR_SEC_REH_RO(pr); 160 161 #define CSK_BIT_LEN 128U 162 #define CSK_32ARRAY_SIZE DIV_ROUND_UP(CSK_BIT_LEN, 32) 163 164 static ssize_t 165 show_canceled_csk(struct device *dev, u32 addr, char *buf) 166 { 167 unsigned int i, size = CSK_32ARRAY_SIZE * sizeof(u32); 168 struct m10bmc_sec *sec = dev_get_drvdata(dev); 169 DECLARE_BITMAP(csk_map, CSK_BIT_LEN); 170 __le32 csk_le32[CSK_32ARRAY_SIZE]; 171 u32 csk32[CSK_32ARRAY_SIZE]; 172 int ret; 173 174 ret = m10bmc_sec_read(sec, (u8 *)&csk_le32, addr, size); 175 if (ret) { 176 dev_err(sec->dev, "failed to read CSK vector\n"); 177 return ret; 178 } 179 180 for (i = 0; i < CSK_32ARRAY_SIZE; i++) 181 csk32[i] = le32_to_cpu(((csk_le32[i]))); 182 183 bitmap_from_arr32(csk_map, csk32, CSK_BIT_LEN); 184 bitmap_complement(csk_map, csk_map, CSK_BIT_LEN); 185 return sysfs_emit(buf, "%*pbl\n", CSK_BIT_LEN, csk_map); 186 } 187 188 #define DEVICE_ATTR_SEC_CSK_RO(_name) \ 189 static ssize_t _name##_canceled_csks_show(struct device *dev, \ 190 struct device_attribute *attr, \ 191 char *buf) \ 192 { \ 193 struct m10bmc_sec *sec = dev_get_drvdata(dev); \ 194 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; \ 195 \ 196 return show_canceled_csk(dev, \ 197 csr_map->_name##_prog_addr + CSK_VEC_OFFSET, \ 198 buf); \ 199 } \ 200 static DEVICE_ATTR_RO(_name##_canceled_csks) 201 202 #define CSK_VEC_OFFSET 0x34 203 204 DEVICE_ATTR_SEC_CSK_RO(bmc); 205 DEVICE_ATTR_SEC_CSK_RO(sr); 206 DEVICE_ATTR_SEC_CSK_RO(pr); 207 208 #define FLASH_COUNT_SIZE 4096 /* count stored as inverted bit vector */ 209 210 static ssize_t flash_count_show(struct device *dev, 211 struct device_attribute *attr, char *buf) 212 { 213 struct m10bmc_sec *sec = dev_get_drvdata(dev); 214 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 215 unsigned int num_bits; 216 u8 *flash_buf; 217 int cnt, ret; 218 219 num_bits = FLASH_COUNT_SIZE * 8; 220 221 flash_buf = kmalloc(FLASH_COUNT_SIZE, GFP_KERNEL); 222 if (!flash_buf) 223 return -ENOMEM; 224 225 ret = m10bmc_sec_read(sec, flash_buf, csr_map->rsu_update_counter, 226 FLASH_COUNT_SIZE); 227 if (ret) { 228 dev_err(sec->dev, "failed to read flash count\n"); 229 goto exit_free; 230 } 231 cnt = num_bits - bitmap_weight((unsigned long *)flash_buf, num_bits); 232 233 exit_free: 234 kfree(flash_buf); 235 236 return ret ? : sysfs_emit(buf, "%u\n", cnt); 237 } 238 static DEVICE_ATTR_RO(flash_count); 239 240 static struct attribute *m10bmc_security_attrs[] = { 241 &dev_attr_flash_count.attr, 242 &dev_attr_bmc_root_entry_hash.attr, 243 &dev_attr_sr_root_entry_hash.attr, 244 &dev_attr_pr_root_entry_hash.attr, 245 &dev_attr_sr_canceled_csks.attr, 246 &dev_attr_pr_canceled_csks.attr, 247 &dev_attr_bmc_canceled_csks.attr, 248 NULL, 249 }; 250 251 static struct attribute_group m10bmc_security_attr_group = { 252 .name = "security", 253 .attrs = m10bmc_security_attrs, 254 }; 255 256 static const struct attribute_group *m10bmc_sec_attr_groups[] = { 257 &m10bmc_security_attr_group, 258 NULL, 259 }; 260 261 static void log_error_regs(struct m10bmc_sec *sec, u32 doorbell) 262 { 263 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 264 u32 auth_result; 265 266 dev_err(sec->dev, "Doorbell: 0x%08x\n", doorbell); 267 268 if (!m10bmc_sys_read(sec->m10bmc, csr_map->auth_result, &auth_result)) 269 dev_err(sec->dev, "RSU auth result: 0x%08x\n", auth_result); 270 } 271 272 static int m10bmc_sec_n3000_rsu_status(struct m10bmc_sec *sec) 273 { 274 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 275 u32 doorbell; 276 int ret; 277 278 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell); 279 if (ret) 280 return ret; 281 282 return FIELD_GET(DRBL_RSU_STATUS, doorbell); 283 } 284 285 static int m10bmc_sec_n6000_rsu_status(struct m10bmc_sec *sec) 286 { 287 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 288 u32 auth_result; 289 int ret; 290 291 ret = m10bmc_sys_read(sec->m10bmc, csr_map->auth_result, &auth_result); 292 if (ret) 293 return ret; 294 295 return FIELD_GET(AUTH_RESULT_RSU_STATUS, auth_result); 296 } 297 298 static bool rsu_status_ok(u32 status) 299 { 300 return (status == RSU_STAT_NORMAL || 301 status == RSU_STAT_NIOS_OK || 302 status == RSU_STAT_USER_OK || 303 status == RSU_STAT_FACTORY_OK); 304 } 305 306 static bool rsu_progress_done(u32 progress) 307 { 308 return (progress == RSU_PROG_IDLE || 309 progress == RSU_PROG_RSU_DONE); 310 } 311 312 static bool rsu_progress_busy(u32 progress) 313 { 314 return (progress == RSU_PROG_AUTHENTICATING || 315 progress == RSU_PROG_COPYING || 316 progress == RSU_PROG_UPDATE_CANCEL || 317 progress == RSU_PROG_PROGRAM_KEY_HASH); 318 } 319 320 static int m10bmc_sec_progress_status(struct m10bmc_sec *sec, u32 *doorbell_reg, 321 u32 *progress, u32 *status) 322 { 323 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 324 int ret; 325 326 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, doorbell_reg); 327 if (ret) 328 return ret; 329 330 ret = sec->ops->rsu_status(sec); 331 if (ret < 0) 332 return ret; 333 334 *status = ret; 335 *progress = rsu_prog(*doorbell_reg); 336 337 return 0; 338 } 339 340 static enum fw_upload_err rsu_check_idle(struct m10bmc_sec *sec) 341 { 342 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 343 u32 doorbell; 344 int ret; 345 346 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell); 347 if (ret) 348 return FW_UPLOAD_ERR_RW_ERROR; 349 350 if (!rsu_progress_done(rsu_prog(doorbell))) { 351 log_error_regs(sec, doorbell); 352 return FW_UPLOAD_ERR_BUSY; 353 } 354 355 return FW_UPLOAD_ERR_NONE; 356 } 357 358 static inline bool rsu_start_done(u32 doorbell_reg, u32 progress, u32 status) 359 { 360 if (doorbell_reg & DRBL_RSU_REQUEST) 361 return false; 362 363 if (status == RSU_STAT_ERASE_FAIL || status == RSU_STAT_WEAROUT) 364 return true; 365 366 if (!rsu_progress_done(progress)) 367 return true; 368 369 return false; 370 } 371 372 static enum fw_upload_err rsu_update_init(struct m10bmc_sec *sec) 373 { 374 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 375 u32 doorbell_reg, progress, status; 376 int ret, err; 377 378 ret = m10bmc_sys_update_bits(sec->m10bmc, csr_map->doorbell, 379 DRBL_RSU_REQUEST | DRBL_HOST_STATUS, 380 DRBL_RSU_REQUEST | 381 FIELD_PREP(DRBL_HOST_STATUS, 382 HOST_STATUS_IDLE)); 383 if (ret) 384 return FW_UPLOAD_ERR_RW_ERROR; 385 386 ret = read_poll_timeout(m10bmc_sec_progress_status, err, 387 err < 0 || rsu_start_done(doorbell_reg, progress, status), 388 NIOS_HANDSHAKE_INTERVAL_US, 389 NIOS_HANDSHAKE_TIMEOUT_US, 390 false, 391 sec, &doorbell_reg, &progress, &status); 392 393 if (ret == -ETIMEDOUT) { 394 log_error_regs(sec, doorbell_reg); 395 return FW_UPLOAD_ERR_TIMEOUT; 396 } else if (err) { 397 return FW_UPLOAD_ERR_RW_ERROR; 398 } 399 400 if (status == RSU_STAT_WEAROUT) { 401 dev_warn(sec->dev, "Excessive flash update count detected\n"); 402 return FW_UPLOAD_ERR_WEAROUT; 403 } else if (status == RSU_STAT_ERASE_FAIL) { 404 log_error_regs(sec, doorbell_reg); 405 return FW_UPLOAD_ERR_HW_ERROR; 406 } 407 408 return FW_UPLOAD_ERR_NONE; 409 } 410 411 static enum fw_upload_err rsu_prog_ready(struct m10bmc_sec *sec) 412 { 413 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 414 unsigned long poll_timeout; 415 u32 doorbell, progress; 416 int ret; 417 418 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell); 419 if (ret) 420 return FW_UPLOAD_ERR_RW_ERROR; 421 422 poll_timeout = jiffies + msecs_to_jiffies(RSU_PREP_TIMEOUT_MS); 423 while (rsu_prog(doorbell) == RSU_PROG_PREPARE) { 424 msleep(RSU_PREP_INTERVAL_MS); 425 if (time_after(jiffies, poll_timeout)) 426 break; 427 428 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell); 429 if (ret) 430 return FW_UPLOAD_ERR_RW_ERROR; 431 } 432 433 progress = rsu_prog(doorbell); 434 if (progress == RSU_PROG_PREPARE) { 435 log_error_regs(sec, doorbell); 436 return FW_UPLOAD_ERR_TIMEOUT; 437 } else if (progress != RSU_PROG_READY) { 438 log_error_regs(sec, doorbell); 439 return FW_UPLOAD_ERR_HW_ERROR; 440 } 441 442 return FW_UPLOAD_ERR_NONE; 443 } 444 445 static enum fw_upload_err rsu_send_data(struct m10bmc_sec *sec) 446 { 447 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 448 u32 doorbell_reg, status; 449 int ret; 450 451 ret = m10bmc_sys_update_bits(sec->m10bmc, csr_map->doorbell, 452 DRBL_HOST_STATUS, 453 FIELD_PREP(DRBL_HOST_STATUS, 454 HOST_STATUS_WRITE_DONE)); 455 if (ret) 456 return FW_UPLOAD_ERR_RW_ERROR; 457 458 ret = regmap_read_poll_timeout(sec->m10bmc->regmap, 459 csr_map->base + csr_map->doorbell, 460 doorbell_reg, 461 rsu_prog(doorbell_reg) != RSU_PROG_READY, 462 NIOS_HANDSHAKE_INTERVAL_US, 463 NIOS_HANDSHAKE_TIMEOUT_US); 464 465 if (ret == -ETIMEDOUT) { 466 log_error_regs(sec, doorbell_reg); 467 return FW_UPLOAD_ERR_TIMEOUT; 468 } else if (ret) { 469 return FW_UPLOAD_ERR_RW_ERROR; 470 } 471 472 ret = sec->ops->rsu_status(sec); 473 if (ret < 0) 474 return FW_UPLOAD_ERR_HW_ERROR; 475 status = ret; 476 477 if (!rsu_status_ok(status)) { 478 log_error_regs(sec, doorbell_reg); 479 return FW_UPLOAD_ERR_HW_ERROR; 480 } 481 482 return FW_UPLOAD_ERR_NONE; 483 } 484 485 static int rsu_check_complete(struct m10bmc_sec *sec, u32 *doorbell_reg) 486 { 487 u32 progress, status; 488 489 if (m10bmc_sec_progress_status(sec, doorbell_reg, &progress, &status)) 490 return -EIO; 491 492 if (!rsu_status_ok(status)) 493 return -EINVAL; 494 495 if (rsu_progress_done(progress)) 496 return 0; 497 498 if (rsu_progress_busy(progress)) 499 return -EAGAIN; 500 501 return -EINVAL; 502 } 503 504 static enum fw_upload_err rsu_cancel(struct m10bmc_sec *sec) 505 { 506 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 507 u32 doorbell; 508 int ret; 509 510 ret = m10bmc_sys_read(sec->m10bmc, csr_map->doorbell, &doorbell); 511 if (ret) 512 return FW_UPLOAD_ERR_RW_ERROR; 513 514 if (rsu_prog(doorbell) != RSU_PROG_READY) 515 return FW_UPLOAD_ERR_BUSY; 516 517 ret = m10bmc_sys_update_bits(sec->m10bmc, csr_map->doorbell, 518 DRBL_HOST_STATUS, 519 FIELD_PREP(DRBL_HOST_STATUS, 520 HOST_STATUS_ABORT_RSU)); 521 if (ret) 522 return FW_UPLOAD_ERR_RW_ERROR; 523 524 return FW_UPLOAD_ERR_CANCELED; 525 } 526 527 static enum fw_upload_err m10bmc_sec_prepare(struct fw_upload *fwl, 528 const u8 *data, u32 size) 529 { 530 struct m10bmc_sec *sec = fwl->dd_handle; 531 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 532 u32 ret; 533 534 sec->cancel_request = false; 535 536 if (!size || size > csr_map->staging_size) 537 return FW_UPLOAD_ERR_INVALID_SIZE; 538 539 if (sec->m10bmc->flash_bulk_ops) 540 if (sec->m10bmc->flash_bulk_ops->lock_write(sec->m10bmc)) 541 return FW_UPLOAD_ERR_BUSY; 542 543 ret = rsu_check_idle(sec); 544 if (ret != FW_UPLOAD_ERR_NONE) 545 goto unlock_flash; 546 547 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_SEC_UPDATE_PREPARE); 548 549 ret = rsu_update_init(sec); 550 if (ret != FW_UPLOAD_ERR_NONE) 551 goto fw_state_exit; 552 553 ret = rsu_prog_ready(sec); 554 if (ret != FW_UPLOAD_ERR_NONE) 555 goto fw_state_exit; 556 557 if (sec->cancel_request) { 558 ret = rsu_cancel(sec); 559 goto fw_state_exit; 560 } 561 562 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_SEC_UPDATE_WRITE); 563 564 return FW_UPLOAD_ERR_NONE; 565 566 fw_state_exit: 567 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_NORMAL); 568 569 unlock_flash: 570 if (sec->m10bmc->flash_bulk_ops) 571 sec->m10bmc->flash_bulk_ops->unlock_write(sec->m10bmc); 572 return ret; 573 } 574 575 #define WRITE_BLOCK_SIZE 0x4000 /* Default write-block size is 0x4000 bytes */ 576 577 static enum fw_upload_err m10bmc_sec_fw_write(struct fw_upload *fwl, const u8 *data, 578 u32 offset, u32 size, u32 *written) 579 { 580 struct m10bmc_sec *sec = fwl->dd_handle; 581 const struct m10bmc_csr_map *csr_map = sec->m10bmc->info->csr_map; 582 struct intel_m10bmc *m10bmc = sec->m10bmc; 583 u32 blk_size, doorbell; 584 int ret; 585 586 if (sec->cancel_request) 587 return rsu_cancel(sec); 588 589 ret = m10bmc_sys_read(m10bmc, csr_map->doorbell, &doorbell); 590 if (ret) { 591 return FW_UPLOAD_ERR_RW_ERROR; 592 } else if (rsu_prog(doorbell) != RSU_PROG_READY) { 593 log_error_regs(sec, doorbell); 594 return FW_UPLOAD_ERR_HW_ERROR; 595 } 596 597 WARN_ON_ONCE(WRITE_BLOCK_SIZE % regmap_get_reg_stride(m10bmc->regmap)); 598 blk_size = min_t(u32, WRITE_BLOCK_SIZE, size); 599 ret = m10bmc_sec_write(sec, data, offset, blk_size); 600 if (ret) 601 return FW_UPLOAD_ERR_RW_ERROR; 602 603 *written = blk_size; 604 return FW_UPLOAD_ERR_NONE; 605 } 606 607 static enum fw_upload_err m10bmc_sec_poll_complete(struct fw_upload *fwl) 608 { 609 struct m10bmc_sec *sec = fwl->dd_handle; 610 unsigned long poll_timeout; 611 u32 doorbell, result; 612 int ret; 613 614 if (sec->cancel_request) 615 return rsu_cancel(sec); 616 617 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_SEC_UPDATE_PROGRAM); 618 619 result = rsu_send_data(sec); 620 if (result != FW_UPLOAD_ERR_NONE) 621 return result; 622 623 poll_timeout = jiffies + msecs_to_jiffies(RSU_COMPLETE_TIMEOUT_MS); 624 do { 625 msleep(RSU_COMPLETE_INTERVAL_MS); 626 ret = rsu_check_complete(sec, &doorbell); 627 } while (ret == -EAGAIN && !time_after(jiffies, poll_timeout)); 628 629 if (ret == -EAGAIN) { 630 log_error_regs(sec, doorbell); 631 return FW_UPLOAD_ERR_TIMEOUT; 632 } else if (ret == -EIO) { 633 return FW_UPLOAD_ERR_RW_ERROR; 634 } else if (ret) { 635 log_error_regs(sec, doorbell); 636 return FW_UPLOAD_ERR_HW_ERROR; 637 } 638 639 return FW_UPLOAD_ERR_NONE; 640 } 641 642 /* 643 * m10bmc_sec_cancel() may be called asynchronously with an on-going update. 644 * All other functions are called sequentially in a single thread. To avoid 645 * contention on register accesses, m10bmc_sec_cancel() must only update 646 * the cancel_request flag. Other functions will check this flag and handle 647 * the cancel request synchronously. 648 */ 649 static void m10bmc_sec_cancel(struct fw_upload *fwl) 650 { 651 struct m10bmc_sec *sec = fwl->dd_handle; 652 653 sec->cancel_request = true; 654 } 655 656 static void m10bmc_sec_cleanup(struct fw_upload *fwl) 657 { 658 struct m10bmc_sec *sec = fwl->dd_handle; 659 660 (void)rsu_cancel(sec); 661 662 m10bmc_fw_state_set(sec->m10bmc, M10BMC_FW_STATE_NORMAL); 663 664 if (sec->m10bmc->flash_bulk_ops) 665 sec->m10bmc->flash_bulk_ops->unlock_write(sec->m10bmc); 666 } 667 668 static const struct fw_upload_ops m10bmc_ops = { 669 .prepare = m10bmc_sec_prepare, 670 .write = m10bmc_sec_fw_write, 671 .poll_complete = m10bmc_sec_poll_complete, 672 .cancel = m10bmc_sec_cancel, 673 .cleanup = m10bmc_sec_cleanup, 674 }; 675 676 static const struct m10bmc_sec_ops m10sec_n3000_ops = { 677 .rsu_status = m10bmc_sec_n3000_rsu_status, 678 }; 679 680 static const struct m10bmc_sec_ops m10sec_n6000_ops = { 681 .rsu_status = m10bmc_sec_n6000_rsu_status, 682 }; 683 684 #define SEC_UPDATE_LEN_MAX 32 685 static int m10bmc_sec_probe(struct platform_device *pdev) 686 { 687 char buf[SEC_UPDATE_LEN_MAX]; 688 struct m10bmc_sec *sec; 689 struct fw_upload *fwl; 690 unsigned int len; 691 int ret; 692 693 sec = devm_kzalloc(&pdev->dev, sizeof(*sec), GFP_KERNEL); 694 if (!sec) 695 return -ENOMEM; 696 697 sec->dev = &pdev->dev; 698 sec->m10bmc = dev_get_drvdata(pdev->dev.parent); 699 sec->ops = (struct m10bmc_sec_ops *)platform_get_device_id(pdev)->driver_data; 700 dev_set_drvdata(&pdev->dev, sec); 701 702 ret = xa_alloc(&fw_upload_xa, &sec->fw_name_id, sec, 703 xa_limit_32b, GFP_KERNEL); 704 if (ret) 705 return ret; 706 707 len = scnprintf(buf, SEC_UPDATE_LEN_MAX, "secure-update%d", 708 sec->fw_name_id); 709 sec->fw_name = kmemdup_nul(buf, len, GFP_KERNEL); 710 if (!sec->fw_name) { 711 ret = -ENOMEM; 712 goto fw_name_fail; 713 } 714 715 fwl = firmware_upload_register(THIS_MODULE, sec->dev, sec->fw_name, 716 &m10bmc_ops, sec); 717 if (IS_ERR(fwl)) { 718 dev_err(sec->dev, "Firmware Upload driver failed to start\n"); 719 ret = PTR_ERR(fwl); 720 goto fw_uploader_fail; 721 } 722 723 sec->fwl = fwl; 724 return 0; 725 726 fw_uploader_fail: 727 kfree(sec->fw_name); 728 fw_name_fail: 729 xa_erase(&fw_upload_xa, sec->fw_name_id); 730 return ret; 731 } 732 733 static void m10bmc_sec_remove(struct platform_device *pdev) 734 { 735 struct m10bmc_sec *sec = dev_get_drvdata(&pdev->dev); 736 737 firmware_upload_unregister(sec->fwl); 738 kfree(sec->fw_name); 739 xa_erase(&fw_upload_xa, sec->fw_name_id); 740 } 741 742 static const struct platform_device_id intel_m10bmc_sec_ids[] = { 743 { 744 .name = "n3000bmc-sec-update", 745 .driver_data = (kernel_ulong_t)&m10sec_n3000_ops, 746 }, 747 { 748 .name = "d5005bmc-sec-update", 749 .driver_data = (kernel_ulong_t)&m10sec_n3000_ops, 750 }, 751 { 752 .name = "n6000bmc-sec-update", 753 .driver_data = (kernel_ulong_t)&m10sec_n6000_ops, 754 }, 755 { } 756 }; 757 MODULE_DEVICE_TABLE(platform, intel_m10bmc_sec_ids); 758 759 static struct platform_driver intel_m10bmc_sec_driver = { 760 .probe = m10bmc_sec_probe, 761 .remove = m10bmc_sec_remove, 762 .driver = { 763 .name = "intel-m10bmc-sec-update", 764 .dev_groups = m10bmc_sec_attr_groups, 765 }, 766 .id_table = intel_m10bmc_sec_ids, 767 }; 768 module_platform_driver(intel_m10bmc_sec_driver); 769 770 MODULE_AUTHOR("Intel Corporation"); 771 MODULE_DESCRIPTION("Intel MAX10 BMC Secure Update"); 772 MODULE_LICENSE("GPL"); 773 MODULE_IMPORT_NS("INTEL_M10_BMC_CORE"); 774