fpga: m10bmc-sec: support power on image

This patch supports the ability to set a default power-on FPGA image.
Additionally, one can select the fall-back image sequence. Two sysfs
files are added to the Intel MAX10 BMC Secure driver:

available_fpga_images (RO)
power-on-image        (RW)

The expected string to be read from available_fpga_images is:

        fpga_factory fpga_user1 fpga_user2

A string to be written to power-on-image is expected to be one of
the following:

        fpga_user1
        fpga_user2
        fpga_factory
        fpga_factory fpga_user1
        fpga_factory fpga_user2

A read from power-on-image will result in one of the following strings:

        fpga_user1 fpga_user2 fpga_factory
        fpga_user2 fpga_user1 fpga_factory
        fpga_factory fpga_user1 fpga_user2
        fpga_factory fpga_user2 fpga_user1

Signed-off-by: Russ Weight <russell.h.weight@intel.com>

Author: Figo-zhang

Documentation/ABI/testing/sysfs-driver-intel-m10-bmc-secure

@@ -59,3 +59,31 @@ Contact:	Russ Weight <russell.h.weight@intel.com>
 Description:	Read only. Returns number of times the secure update
 		staging area has been flashed.
 		Format: "%u".
+
+What:		/sys/bus/platform/drivers/intel-m10bmc-secure/.../available_fpga_images
+Date:		April 2021
+KernelVersion:  5.13
+Contact:	Tianfei zhang <tianfei.zhang@intel.com>
+Description:	Read-only. This file returns a space separated list of
+		key words that may be written into the power_on_image file
+		described below. These keywords identify the possible fpga
+		images that may be used as a default on the next boot of
+		the FPGA card.
+
+What:           /sys/bus/platform/drivers/intel-m10bmc-secure/.../power_on_image
+Date:		April 2021
+KernelVersion:  5.13
+Contact:	Tianfei zhang <tianfei.zhang@intel.com>
+Description:	Read/Write. A key word from the available_fpga_images file
+		may be written to this file to select the FPGA image to be
+		configured on the next boot of the FPGA card. One or more
+		additional keywords may be specified, separated by spaces,
+		to identify a sequence of fall-back images in the event that
+		the selected FPGA image fails to load. Reading this file
+		will return the space separated list of keywords identifying
+		the default power-on image and the current fall-back sequence.
+		Your specific device may not support all possible fall-back
+		sequences. The EINVAL error code will be returned if you
+		attempt to select an unsupported image or fall-back sequence.
+		Consult your product documentation for supported
+		configurations.

drivers/fpga/intel-m10-bmc-secure.c

@@ -14,6 +14,8 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
+struct m10bmc_sec;
+
 /* Supported fpga secure manager types */
 enum fpga_sec_type {
 	N3000BMC_SEC,
@@ -22,10 +24,31 @@ enum fpga_sec_type {
 	N6010BMC_SEC
 };
 
+/* Supported names for power-on images */
+enum fpga_image {
+	FPGA_FACTORY,
+	FPGA_USER1,
+	FPGA_USER2,
+	FPGA_MAX
+};
+
+static const char * const fpga_image_names[] = {
+	[FPGA_FACTORY] = "fpga_factory",
+	[FPGA_USER1] = "fpga_user1",
+	[FPGA_USER2] = "fpga_user2"
+};
+
+struct fpga_power_on {
+	u32 avail_image_mask;
+	int (*get_sequence)(struct m10bmc_sec *sec, char *buf);
+	int (*set_sequence)(struct m10bmc_sec *sec, enum fpga_image images[]);
+};
+
 struct m10bmc_sec {
 	struct device *dev;
 	struct intel_m10bmc *m10bmc;
 	enum fpga_sec_type type;
+	const struct fpga_power_on *poc;	/* power on image configuration */
 };
 
 /* Root Entry Hash (REH) support */
@@ -158,6 +181,189 @@ static ssize_t flash_count_show(struct device *dev,
 }
 static DEVICE_ATTR_RO(flash_count);
 
+static enum fpga_image
+fpga_image_by_name(struct m10bmc_sec *sec, char *image_name)
+{
+	enum fpga_image i;
+
+	for (i = 0; i < FPGA_MAX; i++)
+		if (sysfs_streq(image_name, fpga_image_names[i]))
+			return i;
+
+	return FPGA_MAX;
+}
+
+static int
+fpga_images(struct m10bmc_sec *sec, char *names, enum fpga_image images[])
+{
+	u32 image_mask = sec->poc->avail_image_mask;
+	enum fpga_image image;
+	char *image_name;
+	int i = 0;
+
+	while ((image_name = strsep(&names, " \n"))) {
+		image = fpga_image_by_name(sec, image_name);
+		if (image >= FPGA_MAX || !(image_mask & BIT(image)))
+			return -EINVAL;
+
+		images[i++] = image;
+		image_mask &= ~BIT(image);
+	}
+
+	return (i == 0) ? -EINVAL : 0;
+}
+
+static int
+pmci_set_power_on_image(struct m10bmc_sec *sec, enum fpga_image images[])
+{
+	u32 poc_mask = PMCI_FACTORY_IMAGE_SEL;
+	int ret, first_user = 0;
+	u32 poc = 0;
+
+	if (images[1] == FPGA_FACTORY)
+		return -EINVAL;
+
+	if (images[0] == FPGA_FACTORY) {
+		poc = PMCI_FACTORY_IMAGE_SEL;
+		first_user = 1;
+	}
+
+	if (images[first_user] == FPGA_USER1 || images[first_user] == FPGA_USER2) {
+		poc_mask |= PMCI_USER_IMAGE_PAGE;
+		if (images[first_user] == FPGA_USER1)
+			poc |= FIELD_PREP(PMCI_USER_IMAGE_PAGE, POC_USER_IMAGE_1);
+		else
+			poc |= FIELD_PREP(PMCI_USER_IMAGE_PAGE, POC_USER_IMAGE_2);
+	}
+
+	ret = m10bmc_sys_update_bits(sec->m10bmc,
+				     m10bmc_base(sec->m10bmc) + M10BMC_PMCI_FPGA_POC,
+				     poc_mask | PMCI_FPGA_POC, poc | PMCI_FPGA_POC);
+	if (ret)
+		return ret;
+
+	ret = regmap_read_poll_timeout(sec->m10bmc->regmap,
+				       m10bmc_base(sec->m10bmc) + M10BMC_PMCI_FPGA_POC,
+				       poc,
+				       (!(poc & PMCI_FPGA_POC)),
+				       NIOS_HANDSHAKE_INTERVAL_US,
+				       NIOS_HANDSHAKE_TIMEOUT_US);
+
+	if (ret || (FIELD_GET(PMCI_NIOS_STATUS, poc) != NIOS_STATUS_SUCCESS))
+		return -EIO;
+
+	return 0;
+}
+
+static int pmci_get_power_on_image(struct m10bmc_sec *sec, char *buf)
+{
+	const char *image_names[FPGA_MAX] = { 0 };
+	int ret, i = 0;
+	u32 poc;
+
+	ret = m10bmc_sys_read(sec->m10bmc, M10BMC_PMCI_FPGA_POC, &poc);
+	if (ret)
+		return ret;
+
+	if (poc & PMCI_FACTORY_IMAGE_SEL)
+		image_names[i++] = fpga_image_names[FPGA_FACTORY];
+
+	if (FIELD_GET(PMCI_USER_IMAGE_PAGE, poc) == POC_USER_IMAGE_1) {
+		image_names[i++] = fpga_image_names[FPGA_USER1];
+		image_names[i++] = fpga_image_names[FPGA_USER2];
+	} else {
+		image_names[i++] = fpga_image_names[FPGA_USER2];
+		image_names[i++] = fpga_image_names[FPGA_USER1];
+	}
+
+	if (!(poc & PMCI_FACTORY_IMAGE_SEL))
+		image_names[i] = fpga_image_names[FPGA_FACTORY];
+
+	return sysfs_emit(buf, "%s %s %s\n", image_names[0],
+			  image_names[1], image_names[2]);
+}
+
+static ssize_t
+available_fpga_images_show(struct device *dev,
+			   struct device_attribute *attr, char *buf)
+{
+	struct m10bmc_sec *sec = dev_get_drvdata(dev);
+	ssize_t count = 0;
+	enum fpga_image i;
+
+	for (i = 0; i < FPGA_MAX; i++)
+		if (BIT(i) & sec->poc->avail_image_mask)
+			count += scnprintf(buf + count, PAGE_SIZE - count,
+					   "%s ", fpga_image_names[i]);
+	buf[count - 1] = '\n';
+
+	return count;
+}
+static DEVICE_ATTR_RO(available_fpga_images);
+
+static ssize_t
+power_on_image_show(struct device *dev,
+		    struct device_attribute *attr, char *buf)
+{
+	struct m10bmc_sec *sec = dev_get_drvdata(dev);
+
+	return sec->poc->get_sequence(sec, buf);
+}
+
+static ssize_t
+power_on_image_store(struct device *dev,
+		     struct device_attribute *attr, const char *buf, size_t count)
+{
+	enum fpga_image images[FPGA_MAX] = { [0 ... FPGA_MAX - 1] = FPGA_MAX };
+	struct m10bmc_sec *sec = dev_get_drvdata(dev);
+	char *tokens;
+	int ret;
+
+	tokens = kmemdup_nul(buf, count, GFP_KERNEL);
+	if (!tokens)
+		ret = -ENOMEM;
+
+	ret = fpga_images(sec, tokens, images);
+	if (ret)
+		goto free_exit;
+
+	ret = sec->poc->set_sequence(sec, images);
+
+free_exit:
+	kfree(tokens);
+	return ret ? : count;
+}
+static DEVICE_ATTR_RW(power_on_image);
+
+static umode_t
+m10bmc_is_visible(struct kobject *kobj,
+		  struct attribute *attr, int n)
+{
+	struct m10bmc_sec *sec = dev_get_drvdata(kobj_to_dev(kobj));
+
+	if (sec->type != N6010BMC_SEC)
+		return 0;
+
+	return attr->mode;
+}
+
+static const struct fpga_power_on pmci_power_on_image = {
+	.avail_image_mask = BIT(FPGA_FACTORY) | BIT(FPGA_USER1) | BIT(FPGA_USER2),
+	.set_sequence = pmci_set_power_on_image,
+	.get_sequence = pmci_get_power_on_image,
+};
+
+static struct attribute *m10bmc_image_attrs[] = {
+	&dev_attr_power_on_image.attr,
+	&dev_attr_available_fpga_images.attr,
+	NULL,
+};
+
+static struct attribute_group m10bmc_image_attr_group = {
+	.attrs = m10bmc_image_attrs,
+	.is_visible = m10bmc_is_visible,
+};
+
 static struct attribute *m10bmc_security_attrs[] = {
 	&dev_attr_flash_count.attr,
 	&dev_attr_bmc_root_entry_hash.attr,
@@ -176,6 +382,7 @@ static struct attribute_group m10bmc_security_attr_group = {
 
 static const struct attribute_group *m10bmc_sec_attr_groups[] = {
 	&m10bmc_security_attr_group,
+	&m10bmc_image_attr_group,
 	NULL,
 };
 
@@ -981,6 +1188,9 @@ static int m10bmc_secure_probe(struct platform_device *pdev)
 		return -EINVAL;
 	}
 
+	if (type == N6010BMC_SEC)
+		sec->poc = &pmci_power_on_image;
+
 	smgr = devm_fpga_sec_mgr_create(sec->dev, "Max10 BMC Secure Update",
 					sops, sec);
 	if (!smgr) {

include/linux/mfd/intel-m10-bmc.h

@@ -204,6 +204,18 @@ enum m10bmc_type {
 #define PMCI_MAX10_REBOOT_REQ BIT(0)
 #define PMCI_MAX10_REBOOT_PAGE BIT(1)
 
+#define M10BMC_PMCI_FPGA_POC	0xb0
+#define PMCI_FPGA_POC		BIT(0)
+#define PMCI_NIOS_REQ_CLEAR	BIT(1)
+#define PMCI_NIOS_STATUS	GENMASK(5, 4)
+#define NIOS_STATUS_IDLE	0
+#define NIOS_STATUS_SUCCESS	1
+#define NIOS_STATUS_FAIL	2
+#define PMCI_USER_IMAGE_PAGE	GENMASK(10, 8)
+#define POC_USER_IMAGE_1	1
+#define POC_USER_IMAGE_2	2
+#define PMCI_FACTORY_IMAGE_SEL	BIT(31)
+
 #define M10BMC_PMCI_FPGA_RECONF 0xb8
 #define PMCI_FPGA_RECONF_PAGE  GENMASK(22, 20)
 #define PMCI_FPGA_RP_LOAD      BIT(23)