From: tien.sung.ang@intel.com
To: Dinh Nguyen <dinguyen@kernel.org>
Cc: linux-kernel@vger.kernel.org, Ang Tien Sung <tien.sung.ang@intel.com>
Subject: [PATCH 3/3] firmware: stratix10-svc: extend to support new FPGA attestation
Date: Wed, 21 Jun 2023 14:15:08 +0800 [thread overview]
Message-ID: <20230621061508.1429913-4-tien.sung.ang@intel.com> (raw)
In-Reply-To: <20230621061508.1429913-1-tien.sung.ang@intel.com>
From: Ang Tien Sung <tien.sung.ang@intel.com>
Support the new FPGA attestation get_certificate and
certificate_reload features.
Signed-off-by: Ang Tien Sung <tien.sung.ang@intel.com>
---
drivers/firmware/stratix10-svc.c | 15 +++++++
include/linux/firmware/intel/stratix10-smc.h | 45 +++++++++++++++++++
.../firmware/intel/stratix10-svc-client.h | 9 ++++
3 files changed, 69 insertions(+)
diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c
index be0a39900570..403a660f1df7 100644
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -330,6 +330,7 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
case COMMAND_FCS_DATA_DECRYPTION:
case COMMAND_FCS_PSGSIGMA_TEARDOWN:
case COMMAND_FCS_COUNTER_SET_PREAUTHORIZED:
+ case COMMAND_FCS_ATTESTATION_CERTIFICATE_RELOAD:
cb_data->status = BIT(SVC_STATUS_OK);
break;
case COMMAND_RECONFIG_DATA_SUBMIT:
@@ -370,6 +371,7 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data,
break;
case COMMAND_FCS_ATTESTATION_SUBKEY:
case COMMAND_FCS_ATTESTATION_MEASUREMENTS:
+ case COMMAND_FCS_ATTESTATION_CERTIFICATE:
cb_data->status = BIT(SVC_STATUS_OK);
cb_data->kaddr2 = svc_pa_to_va(res.a2);
cb_data->kaddr3 = &res.a3;
@@ -560,6 +562,17 @@ static int svc_normal_to_secure_thread(void *data)
a3 = (unsigned long)pdata->paddr_output;
a4 = (unsigned long)pdata->size_output;
break;
+ case COMMAND_FCS_ATTESTATION_CERTIFICATE:
+ a0 = INTEL_SIP_SMC_FCS_GET_ATTESTATION_CERTIFICATE;
+ a1 = pdata->arg[0];
+ a2 = (unsigned long)pdata->paddr_output;
+ a3 = (unsigned long)pdata->size_output;
+ break;
+ case COMMAND_FCS_ATTESTATION_CERTIFICATE_RELOAD:
+ a0 = INTEL_SIP_SMC_FCS_CREATE_CERTIFICATE_ON_RELOAD;
+ a1 = pdata->arg[0];
+ a2 = 0;
+ break;
/* for polling */
case COMMAND_POLL_SERVICE_STATUS:
a0 = INTEL_SIP_SMC_SERVICE_COMPLETED;
@@ -644,6 +657,8 @@ static int svc_normal_to_secure_thread(void *data)
case COMMAND_FCS_ATTESTATION_SUBKEY:
case COMMAND_FCS_ATTESTATION_MEASUREMENTS:
case COMMAND_FCS_COUNTER_SET_PREAUTHORIZED:
+ case COMMAND_FCS_ATTESTATION_CERTIFICATE:
+ case COMMAND_FCS_ATTESTATION_CERTIFICATE_RELOAD:
cbdata->status = BIT(SVC_STATUS_INVALID_PARAM);
cbdata->kaddr1 = NULL;
cbdata->kaddr2 = NULL;
diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h
index 8f92a55ba51d..ddfffda6ba0e 100644
--- a/include/linux/firmware/intel/stratix10-smc.h
+++ b/include/linux/firmware/intel/stratix10-smc.h
@@ -67,6 +67,9 @@
*
* INTEL_SIP_SMC_RSU_ERROR:
* There is error during the process of remote status update request.
+ *
+ * INTEL_SIP_SMC_STATUS_NOT_SUPPORTED:
+ * Secure monitor software doesn't support the request
*/
#define INTEL_SIP_SMC_RETURN_UNKNOWN_FUNCTION 0xFFFFFFFF
#define INTEL_SIP_SMC_STATUS_OK 0x0
@@ -74,6 +77,7 @@
#define INTEL_SIP_SMC_STATUS_REJECTED 0x2
#define INTEL_SIP_SMC_STATUS_ERROR 0x4
#define INTEL_SIP_SMC_RSU_ERROR 0x7
+#define INTEL_SIP_SMC_STATUS_NOT_SUPPORTED 0x8
/**
* Request INTEL_SIP_SMC_FPGA_CONFIG_START
@@ -696,4 +700,45 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE)
#define INTEL_SIP_SMC_FUNCID_FCS_ATTESTATION_MEASUREMENTS 103
#define INTEL_SIP_SMC_FCS_ATTESTATION_MEASUREMENTS \
INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_ATTESTATION_MEASUREMENTS)
+
+/**
+ * Request INTEL_SIP_SMC_FCS_GET_ATTESTATION_CERTIFICATE
+ * Sync call to get device attestation certificate
+ *
+ * Call register usage:
+ * a0 INTEL_SIP_SMC_FCS_GET_ATTESTATION_CERTIFICATE
+ * a1 the type of certificate request
+ * a2 the physical address which holds certificate response data
+ * a3 the size of the certificate response data
+ * a4-a7 not used
+ *
+ * Return status:
+ * a0 INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_STATUS_NOT_SUPPORTED or
+ * INTEL_SIP_SMC_STATUS_ERROR
+ * a1 mailbox error if a0 is INTEL_SIP_SMC_STATUS_ERROR
+ * a2 physical address of the requested certificate
+ * a3 sized of the requested certificate
+ */
+#define INTEL_SIP_SMC_FUNCID_FCS_GET_ATTESTATION_CERTIFICATE 104
+#define INTEL_SIP_SMC_FCS_GET_ATTESTATION_CERTIFICATE \
+ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_ATTESTATION_CERTIFICATE)
+
+/**
+ * Request INTEL_SIP_SMC_FCS_CREATE_CERTIFICATE_ON_RELOAD
+ * Sync call to specify what certificate is to be generated
+ *
+ * Call register usage:
+ * a0 INTEL_SIP_SMC_FCS_CREATE_CERTIFICATE_ON_RELOAD
+ * a1 the type of certificat request
+ * a2-a7 not used
+ *
+ * Return status:
+ * a0 INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_STATUS_NOT_SUPPORTED or
+ * INTEL_SIP_SMC_STATUS_ERROR
+ * a1 mailbox error if a0 is INTEL_SIP_SMC_STATUS_ERROR
+ * a2-a3 not used
+ */
+#define INTEL_SIP_SMC_FUNCID_FCS_CREATE_CERTIFICATE_ON_RELOAD 105
+#define INTEL_SIP_SMC_FCS_CREATE_CERTIFICATE_ON_RELOAD \
+ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_CREATE_CERTIFICATE_ON_RELOAD)
#endif
diff --git a/include/linux/firmware/intel/stratix10-svc-client.h b/include/linux/firmware/intel/stratix10-svc-client.h
index 4703f6c486a1..f3b0a69114fd 100644
--- a/include/linux/firmware/intel/stratix10-svc-client.h
+++ b/include/linux/firmware/intel/stratix10-svc-client.h
@@ -155,6 +155,13 @@ struct stratix10_svc_chan;
*
* @COMMAND_FCS_ATTESTATION_MEASUREMENTS: to get device's attestation
* measurements, return status is SVC_STATUS_SUBMITTED or SVC_STATUS_ERROR
+ *
+ * @COMMAND_FCS_ATTESTATION_CERTIFICATE: get FPGA attestation certificate,
+ * return status is SVC_STATUS_OK or SVC_STATUS_ERROR
+ *
+ * @COMMAND_FCS_ATTESTATION_CERTIFICATE_RELOAD: reload FPGA attestation
+ * certificate, return status is SVC_STATUS_OK or SVC_STATUS_ERROR
+ *
*/
enum stratix10_svc_command_code {
/* for FPGA */
@@ -185,6 +192,8 @@ enum stratix10_svc_command_code {
COMMAND_FCS_GET_CHIP_ID,
COMMAND_FCS_ATTESTATION_SUBKEY,
COMMAND_FCS_ATTESTATION_MEASUREMENTS,
+ COMMAND_FCS_ATTESTATION_CERTIFICATE,
+ COMMAND_FCS_ATTESTATION_CERTIFICATE_RELOAD,
/* for general status poll */
COMMAND_POLL_SERVICE_STATUS = 40,
/* Non-mailbox SMC Call */
--
2.25.1
prev parent reply other threads:[~2023-06-21 6:16 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-21 6:15 [PATCH 0/3] extend svc to support attestation tien.sung.ang
2023-06-21 6:15 ` [PATCH 1/3] firmware: stratix10-svc: extend svc for attestation tien.sung.ang
2023-06-22 22:26 ` Dinh Nguyen
2023-06-23 7:32 ` Ang, Tien Sung
2023-06-21 6:15 ` [PATCH 2/3] firmware: stratix10-svc: extend for single certificate tien.sung.ang
2023-06-21 6:15 ` tien.sung.ang [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230621061508.1429913-4-tien.sung.ang@intel.com \
--to=tien.sung.ang@intel.com \
--cc=dinguyen@kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®