1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Copyright(c) 2022 Intel Corporation. */ 3 4 #include <linux/firmware.h> 5 #include <asm/cpu.h> 6 #include <asm/microcode.h> 7 8 #include "ifs.h" 9 10 #define IFS_CHUNK_ALIGNMENT 256 11 union meta_data { 12 struct { 13 u32 meta_type; // metadata type 14 u32 meta_size; // size of this entire struct including hdrs. 15 u32 test_type; // IFS test type 16 u32 fusa_info; // Fusa info 17 u32 total_images; // Total number of images 18 u32 current_image; // Current Image # 19 u32 total_chunks; // Total number of chunks in this image 20 u32 starting_chunk; // Starting chunk number in this image 21 u32 size_per_chunk; // size of each chunk 22 u32 chunks_per_stride; // number of chunks in a stride 23 }; 24 u8 padding[IFS_CHUNK_ALIGNMENT]; 25 }; 26 27 #define IFS_HEADER_SIZE (sizeof(struct microcode_header_intel)) 28 #define META_TYPE_IFS 1 29 static struct microcode_header_intel *ifs_header_ptr; /* pointer to the ifs image header */ 30 static u64 ifs_hash_ptr; /* Address of ifs metadata (hash) */ 31 static u64 ifs_test_image_ptr; /* 256B aligned address of test pattern */ 32 static DECLARE_COMPLETION(ifs_done); 33 34 static const char * const scan_hash_status[] = { 35 [0] = "No error reported", 36 [1] = "Attempt to copy scan hashes when copy already in progress", 37 [2] = "Secure Memory not set up correctly", 38 [3] = "FuSaInfo.ProgramID does not match or ff-mm-ss does not match", 39 [4] = "Reserved", 40 [5] = "Integrity check failed", 41 [6] = "Scan reload or test is in progress" 42 }; 43 44 static const char * const scan_authentication_status[] = { 45 [0] = "No error reported", 46 [1] = "Attempt to authenticate a chunk which is already marked as authentic", 47 [2] = "Chunk authentication error. The hash of chunk did not match expected value" 48 }; 49 50 #define MC_HEADER_META_TYPE_END (0) 51 52 struct metadata_header { 53 unsigned int type; 54 unsigned int blk_size; 55 }; 56 57 static struct metadata_header *find_meta_data(void *ucode, unsigned int meta_type) 58 { 59 struct microcode_header_intel *hdr = &((struct microcode_intel *)ucode)->hdr; 60 struct metadata_header *meta_header; 61 unsigned long data_size, total_meta; 62 unsigned long meta_size = 0; 63 64 data_size = intel_microcode_get_datasize(hdr); 65 total_meta = hdr->metasize; 66 if (!total_meta) 67 return NULL; 68 69 meta_header = (ucode + MC_HEADER_SIZE + data_size) - total_meta; 70 71 while (meta_header->type != MC_HEADER_META_TYPE_END && 72 meta_header->blk_size && 73 meta_size < total_meta) { 74 meta_size += meta_header->blk_size; 75 if (meta_header->type == meta_type) 76 return meta_header; 77 78 meta_header = (void *)meta_header + meta_header->blk_size; 79 } 80 return NULL; 81 } 82 83 /* 84 * To copy scan hashes and authenticate test chunks, the initiating cpu must point 85 * to the EDX:EAX to the test image in linear address. 86 * Run wrmsr(MSR_COPY_SCAN_HASHES) for scan hash copy and run wrmsr(MSR_AUTHENTICATE_AND_COPY_CHUNK) 87 * for scan hash copy and test chunk authentication. 88 */ 89 static void copy_hashes_authenticate_chunks(struct work_struct *work) 90 { 91 struct ifs_work *local_work = container_of(work, struct ifs_work, w); 92 union ifs_scan_hashes_status hashes_status; 93 union ifs_chunks_auth_status chunk_status; 94 struct device *dev = local_work->dev; 95 int i, num_chunks, chunk_size; 96 struct ifs_data *ifsd; 97 u64 linear_addr, base; 98 u32 err_code; 99 100 ifsd = ifs_get_data(dev); 101 /* run scan hash copy */ 102 wrmsrl(MSR_COPY_SCAN_HASHES, ifs_hash_ptr); 103 rdmsrl(MSR_SCAN_HASHES_STATUS, hashes_status.data); 104 105 /* enumerate the scan image information */ 106 num_chunks = hashes_status.num_chunks; 107 chunk_size = hashes_status.chunk_size * 1024; 108 err_code = hashes_status.error_code; 109 110 if (!hashes_status.valid) { 111 ifsd->loading_error = true; 112 if (err_code >= ARRAY_SIZE(scan_hash_status)) { 113 dev_err(dev, "invalid error code 0x%x for hash copy\n", err_code); 114 goto done; 115 } 116 dev_err(dev, "Hash copy error : %s", scan_hash_status[err_code]); 117 goto done; 118 } 119 120 /* base linear address to the scan data */ 121 base = ifs_test_image_ptr; 122 123 /* scan data authentication and copy chunks to secured memory */ 124 for (i = 0; i < num_chunks; i++) { 125 linear_addr = base + i * chunk_size; 126 linear_addr |= i; 127 128 wrmsrl(MSR_AUTHENTICATE_AND_COPY_CHUNK, linear_addr); 129 rdmsrl(MSR_CHUNKS_AUTHENTICATION_STATUS, chunk_status.data); 130 131 ifsd->valid_chunks = chunk_status.valid_chunks; 132 err_code = chunk_status.error_code; 133 134 if (err_code) { 135 ifsd->loading_error = true; 136 if (err_code >= ARRAY_SIZE(scan_authentication_status)) { 137 dev_err(dev, 138 "invalid error code 0x%x for authentication\n", err_code); 139 goto done; 140 } 141 dev_err(dev, "Chunk authentication error %s\n", 142 scan_authentication_status[err_code]); 143 goto done; 144 } 145 } 146 done: 147 complete(&ifs_done); 148 } 149 150 static int validate_ifs_metadata(struct device *dev) 151 { 152 struct ifs_data *ifsd = ifs_get_data(dev); 153 union meta_data *ifs_meta; 154 char test_file[64]; 155 int ret = -EINVAL; 156 157 snprintf(test_file, sizeof(test_file), "%02x-%02x-%02x-%02x.scan", 158 boot_cpu_data.x86, boot_cpu_data.x86_model, 159 boot_cpu_data.x86_stepping, ifsd->cur_batch); 160 161 ifs_meta = (union meta_data *)find_meta_data(ifs_header_ptr, META_TYPE_IFS); 162 if (!ifs_meta) { 163 dev_err(dev, "IFS Metadata missing in file %s\n", test_file); 164 return ret; 165 } 166 167 ifs_test_image_ptr = (u64)ifs_meta + sizeof(union meta_data); 168 169 /* Scan chunk start must be 256 byte aligned */ 170 if (!IS_ALIGNED(ifs_test_image_ptr, IFS_CHUNK_ALIGNMENT)) { 171 dev_err(dev, "Scan pattern is not aligned on %d bytes aligned in %s\n", 172 IFS_CHUNK_ALIGNMENT, test_file); 173 return ret; 174 } 175 176 if (ifs_meta->current_image != ifsd->cur_batch) { 177 dev_warn(dev, "Mismatch between filename %s and batch metadata 0x%02x\n", 178 test_file, ifs_meta->current_image); 179 return ret; 180 } 181 182 return 0; 183 } 184 185 /* 186 * IFS requires scan chunks authenticated per each socket in the platform. 187 * Once the test chunk is authenticated, it is automatically copied to secured memory 188 * and proceed the authentication for the next chunk. 189 */ 190 static int scan_chunks_sanity_check(struct device *dev) 191 { 192 struct ifs_data *ifsd = ifs_get_data(dev); 193 struct ifs_work local_work; 194 int curr_pkg, cpu, ret; 195 196 memset(ifs_pkg_auth, 0, (topology_max_packages() * sizeof(bool))); 197 ret = validate_ifs_metadata(dev); 198 if (ret) 199 return ret; 200 201 ifsd->loading_error = false; 202 ifsd->loaded_version = ifs_header_ptr->rev; 203 204 /* copy the scan hash and authenticate per package */ 205 cpus_read_lock(); 206 for_each_online_cpu(cpu) { 207 curr_pkg = topology_physical_package_id(cpu); 208 if (ifs_pkg_auth[curr_pkg]) 209 continue; 210 reinit_completion(&ifs_done); 211 local_work.dev = dev; 212 INIT_WORK_ONSTACK(&local_work.w, copy_hashes_authenticate_chunks); 213 schedule_work_on(cpu, &local_work.w); 214 wait_for_completion(&ifs_done); 215 if (ifsd->loading_error) { 216 ret = -EIO; 217 goto out; 218 } 219 ifs_pkg_auth[curr_pkg] = 1; 220 } 221 ret = 0; 222 out: 223 cpus_read_unlock(); 224 225 return ret; 226 } 227 228 static int image_sanity_check(struct device *dev, const struct microcode_header_intel *data) 229 { 230 struct ucode_cpu_info uci; 231 232 /* Provide a specific error message when loading an older/unsupported image */ 233 if (data->hdrver != MC_HEADER_TYPE_IFS) { 234 dev_err(dev, "Header version %d not supported\n", data->hdrver); 235 return -EINVAL; 236 } 237 238 if (intel_microcode_sanity_check((void *)data, true, MC_HEADER_TYPE_IFS)) { 239 dev_err(dev, "sanity check failed\n"); 240 return -EINVAL; 241 } 242 243 intel_cpu_collect_info(&uci); 244 245 if (!intel_find_matching_signature((void *)data, 246 uci.cpu_sig.sig, 247 uci.cpu_sig.pf)) { 248 dev_err(dev, "cpu signature, processor flags not matching\n"); 249 return -EINVAL; 250 } 251 252 return 0; 253 } 254 255 /* 256 * Load ifs image. Before loading ifs module, the ifs image must be located 257 * in /lib/firmware/intel/ifs_x/ and named as family-model-stepping-02x.{testname}. 258 */ 259 int ifs_load_firmware(struct device *dev) 260 { 261 const struct ifs_test_caps *test = ifs_get_test_caps(dev); 262 struct ifs_data *ifsd = ifs_get_data(dev); 263 const struct firmware *fw; 264 char scan_path[64]; 265 int ret = -EINVAL; 266 267 snprintf(scan_path, sizeof(scan_path), "intel/ifs_%d/%02x-%02x-%02x-%02x.scan", 268 test->test_num, boot_cpu_data.x86, boot_cpu_data.x86_model, 269 boot_cpu_data.x86_stepping, ifsd->cur_batch); 270 271 ret = request_firmware_direct(&fw, scan_path, dev); 272 if (ret) { 273 dev_err(dev, "ifs file %s load failed\n", scan_path); 274 goto done; 275 } 276 277 ret = image_sanity_check(dev, (struct microcode_header_intel *)fw->data); 278 if (ret) 279 goto release; 280 281 ifs_header_ptr = (struct microcode_header_intel *)fw->data; 282 ifs_hash_ptr = (u64)(ifs_header_ptr + 1); 283 284 ret = scan_chunks_sanity_check(dev); 285 if (ret) 286 dev_err(dev, "Load failure for batch: %02x\n", ifsd->cur_batch); 287 288 release: 289 release_firmware(fw); 290 done: 291 ifsd->loaded = (ret == 0); 292 293 return ret; 294 } 295