[PATCH RFC 3/3] firmware: arm-firme: TSM_REPORT support using FIRME

[Yeoreum Yun <yeoreum.yun@arm.com>]

Introduce TSM report support using FIRME with the configfs-tsm module to
provide user interfaces for retrieving an attestation token for host.

When a new report is requested firme driver invokes the appropriate
FIRME interfaces to query an attestation token.

The steps to retrieve an attestation token are as follows:

  1. mount -t configfs . /sys/kernel/config
  2. Generate an attestation token

       cd /sys/kernel/config/tsm/report
       mkdir report0
       dd if=/dev/urandom bs=64 count=1 > report0/inblob
       hexdump -C report0/outblob

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
---
 drivers/firmware/arm_firme/Kconfig  |  8 ++++
 drivers/firmware/arm_firme/Makefile |  1 +
 drivers/firmware/arm_firme/driver.c |  5 +++
 drivers/firmware/arm_firme/firme.h  |  8 ++++
 drivers/firmware/arm_firme/report.c | 88 +++++++++++++++++++++++++++++++++++++
 5 files changed, 110 insertions(+)

diff --git a/drivers/firmware/arm_firme/Kconfig b/drivers/firmware/arm_firme/Kconfig
index 7e7a826879f1..44fd9a00e6d1 100644
--- a/drivers/firmware/arm_firme/Kconfig
+++ b/drivers/firmware/arm_firme/Kconfig
@@ -32,3 +32,11 @@ config ARM_FIRME
 
 	  This driver provides the common FIRME framework and service
 	  discovery support for client drivers using FIRME services.
+
+config ARM_FIRME_TSM_REPORT
+	bool "Support TSM report using FIRME"
+	depends on ARM_FIRME && TSM_REPORTS
+	depends on ARM_FIRME = m || TSM_REPORTS = y
+
+config ARM_FIRME_TSM_REPORT_ENABLED
+	def_tristate ARM_FIRME if ARM_FIRME_TSM_REPORT
diff --git a/drivers/firmware/arm_firme/Makefile b/drivers/firmware/arm_firme/Makefile
index dccac0a2b50e..bc4f45d38c91 100644
--- a/drivers/firmware/arm_firme/Makefile
+++ b/drivers/firmware/arm_firme/Makefile
@@ -3,3 +3,4 @@
 obj-$(CONFIG_ARM_FIRME) += arm-firme.o
 
 arm-firme-$(CONFIG_ARM_FIRME) := driver.o base.o attest.o
+arm-firme-$(CONFIG_ARM_FIRME_TSM_REPORT_ENABLED) += report.o
diff --git a/drivers/firmware/arm_firme/driver.c b/drivers/firmware/arm_firme/driver.c
index 97ae1f3c0569..f919cbd00970 100644
--- a/drivers/firmware/arm_firme/driver.c
+++ b/drivers/firmware/arm_firme/driver.c
@@ -91,6 +91,10 @@ static int firme_driver_probe(struct arm_smccc_device *sdev)
 	firme_service_info->instance->dev = &sdev->dev;
 	firme_service_info->instance->ops = &firme_ops;
 
+	err = firme_tsm_report_register();
+	if (err)
+		pr_info("Failed to register tsm_report. err: %d\n", err);
+
 	return 0;
 
 err_out:
@@ -104,6 +108,7 @@ static int firme_driver_probe(struct arm_smccc_device *sdev)
 
 static void firme_driver_remove(struct arm_smccc_device *sdev)
 {
+	firme_tsm_report_unregister();
 	kfree(firme_service_info->instance);
 	kfree(firme_service_info);
 	firme_service_info = NULL;
diff --git a/drivers/firmware/arm_firme/firme.h b/drivers/firmware/arm_firme/firme.h
index 34cf40681a64..da6a08edf70c 100644
--- a/drivers/firmware/arm_firme/firme.h
+++ b/drivers/firmware/arm_firme/firme.h
@@ -36,6 +36,14 @@ int firme_status_to_errno(firme_status_t status);
 int firme_base_service_init(struct firme_service_info *info);
 int firme_attest_service_init(struct firme_service_info *info);
 
+#if IS_ENABLED(CONFIG_ARM_FIRME_TSM_REPORT)
+int firme_tsm_report_register(void);
+void firme_tsm_report_unregister(void);
+#else
+static __always_inline int firme_tsm_report_register(void) { return 0; }
+static __always_inline void firme_tsm_report_unregister(void) { }
+#endif
+
 static __always_inline void invoke_firme_service(firme_value_t args,
 						 firme_value_t *res)
 {
diff --git a/drivers/firmware/arm_firme/report.c b/drivers/firmware/arm_firme/report.c
new file mode 100644
index 000000000000..52dd5ef2138e
--- /dev/null
+++ b/drivers/firmware/arm_firme/report.c
@@ -0,0 +1,88 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (C) 2026 Arm Ltd.
+ */
+
+#define DRIVER_NAME "ARM FIRME"
+#define pr_fmt(fmt) DRIVER_NAME ": " fmt
+
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/tsm.h>
+
+#include "firme.h"
+
+static bool report_registered;
+
+static int firme_report_new(struct tsm_report *report, void *data)
+{
+	int err;
+	const struct firme_instance *fi;
+	struct firme_attest_info info;
+	void *token;
+	size_t token_size;
+	struct tsm_report_desc *desc = &report->desc;
+
+	fi = data;
+
+	err = fi->ops->attest_ops->get_attest_info(&info);
+	if (err)
+		return err;
+
+	if (desc->inblob_len > info.max_challenge_size)
+		return -EINVAL;
+
+	token_size = info.max_pat_size;
+
+	token = kvzalloc(token_size, GFP_KERNEL);
+	if (!token)
+		return -ENOMEM;
+
+	err = fi->ops->attest_ops->get_platform_attestion_token(desc->inblob,
+								desc->inblob_len,
+								token, &token_size);
+	if (err)
+		goto err_out;
+
+	report->outblob = token;
+	report->outblob_len = token_size;
+
+	return 0;
+
+err_out:
+	kvfree(token);
+
+	return err;
+}
+
+static const struct tsm_report_ops firme_tsm_report_ops = {
+	.name = FIRME_DEV_NAME,
+	.report_new = firme_report_new,
+};
+
+int firme_tsm_report_register(void)
+{
+	int ret;
+	struct firme_instance *fi;
+	struct firme_attest_info info;
+
+	fi = firme_get_instance();
+	if (IS_ERR(fi))
+		return PTR_ERR(fi);
+
+	ret = fi->ops->attest_ops->get_attest_info(&info);
+	if (ret)
+		return ret;
+
+	ret = tsm_report_register(&firme_tsm_report_ops, fi);
+	if (!ret)
+		report_registered = true;
+
+	return ret;
+}
+
+void firme_tsm_report_unregister(void)
+{
+	if (report_registered)
+		tsm_report_unregister(&firme_tsm_report_ops);
+}

-- 
2.43.0