RE: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support
Hi Moritz, Thanks for providing the review comments. Please find my response inline. > -Original Message- > From: Moritz Fischer > Sent: Thursday, March 4, 2021 4:42 AM > To: Moritz Fischer > Cc: Nava kishore Manne ; t...@redhat.com; > robh...@kernel.org; Michal Simek ; linux- > f...@vger.kernel.org; devicet...@vger.kernel.org; linux-arm- > ker...@lists.infradead.org; linux-kernel@vger.kernel.org; git > ; chinnikishore...@gmail.com > Subject: Re: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support > > Hi Nava, > > On Thu, Jan 21, 2021 at 09:17:10PM -0800, Moritz Fischer wrote: > > On Mon, Jan 18, 2021 at 08:20:57AM +0530, Nava kishore Manne wrote: > > > This commit adds secure flags to the framework to support secure > > > BitStream Loading. > > > > > > Signed-off-by: Nava kishore Manne > > > --- > > > drivers/fpga/of-fpga-region.c | 10 ++ > > > include/linux/fpga/fpga-mgr.h | 12 > > > 2 files changed, 22 insertions(+) > > > > > > diff --git a/drivers/fpga/of-fpga-region.c > > > b/drivers/fpga/of-fpga-region.c index e405309baadc..3a5eb480 > > > 100644 > > > --- a/drivers/fpga/of-fpga-region.c > > > +++ b/drivers/fpga/of-fpga-region.c > > > @@ -228,6 +228,16 @@ static struct fpga_image_info > *of_fpga_region_parse_ov( > > > if (of_property_read_bool(overlay, "encrypted-fpga-config")) > > > info->flags |= FPGA_MGR_ENCRYPTED_BITSTREAM; > > > > > > + if (of_property_read_bool(overlay, "userkey-encrypted-fpga- > config")) > > > + info->flags |= > FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM; > > > > Can this just be encrypted-fpga-config/FPGA_MGR_ENCRYPTED? > > > + > > > + if (of_property_read_bool(overlay, "ddrmem-authenticated-fpga- > config")) > > > + info->flags |= FPGA_MGR_DDR_MEM_AUTH_BITSTREAM; > > > + > > > + if (of_property_read_bool(overlay, > > > + "securemem-authenticated-fpga-config")) > > > + info->flags |= FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM; > Shouldn't all these get binding docs? I remember Richard adding > authentication support for an Intel platform, too and I'd like to avoid adding > random bindings per vendor. > > Would it be possible to have an 'authentication method / type' that is more > extensible with different methods maybe? > Yes, I agree this flags should not be a vendor specific we should make it as generic. can we have flags something like below . 1) authenticated-fpga-config --> By default it uses kernel memory(DDR) to authenticate the image(FPGA_MGR_MEM_AUTH_BITSTREAM) 2) authenticated-onchip-fpga-config --> It uses the On chip memory to authenticate the image ( FPGA_MGR_AUTH_ON_CHIP_BITSTREAM) if you have any other thoughts let me know will try to adopt the same... Regards, Navakishore.
Re: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support
Hi Nava,
On Thu, Jan 21, 2021 at 09:17:10PM -0800, Moritz Fischer wrote:
> On Mon, Jan 18, 2021 at 08:20:57AM +0530, Nava kishore Manne wrote:
> > This commit adds secure flags to the framework to support
> > secure BitStream Loading.
> >
> > Signed-off-by: Nava kishore Manne
> > ---
> > drivers/fpga/of-fpga-region.c | 10 ++
> > include/linux/fpga/fpga-mgr.h | 12
> > 2 files changed, 22 insertions(+)
> >
> > diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
> > index e405309baadc..3a5eb480 100644
> > --- a/drivers/fpga/of-fpga-region.c
> > +++ b/drivers/fpga/of-fpga-region.c
> > @@ -228,6 +228,16 @@ static struct fpga_image_info *of_fpga_region_parse_ov(
> > if (of_property_read_bool(overlay, "encrypted-fpga-config"))
> > info->flags |= FPGA_MGR_ENCRYPTED_BITSTREAM;
> >
> > + if (of_property_read_bool(overlay, "userkey-encrypted-fpga-config"))
> > + info->flags |= FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM;
>
> Can this just be encrypted-fpga-config/FPGA_MGR_ENCRYPTED?
> > +
> > + if (of_property_read_bool(overlay, "ddrmem-authenticated-fpga-config"))
> > + info->flags |= FPGA_MGR_DDR_MEM_AUTH_BITSTREAM;
> > +
> > + if (of_property_read_bool(overlay,
> > + "securemem-authenticated-fpga-config"))
> > + info->flags |= FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM;
Shouldn't all these get binding docs? I remember Richard adding
authentication support for an Intel platform, too and I'd like to avoid
adding random bindings per vendor.
Would it be possible to have an 'authentication method / type' that is more
extensible with different methods maybe?
> > +
> > if (!of_property_read_string(overlay, "firmware-name",
> > &firmware_name)) {
> > info->firmware_name = devm_kstrdup(dev, firmware_name,
> > diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h
> > index 2bc3030a69e5..2f7455a60666 100644
> > --- a/include/linux/fpga/fpga-mgr.h
> > +++ b/include/linux/fpga/fpga-mgr.h
> > @@ -67,12 +67,24 @@ enum fpga_mgr_states {
> > * %FPGA_MGR_BITSTREAM_LSB_FIRST: SPI bitstream bit order is LSB first
> > *
> > * %FPGA_MGR_COMPRESSED_BITSTREAM: FPGA bitstream is compressed
> > + *
> > + * %FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM: indicates bitstream is encrypted
> > with
> > + *user key
> > + *
> > + * %FPGA_MGR_DDR_MEM_AUTH_BITSTREAM: do bitstream authentication using DDR
> > + * memory if supported
> > + *
> > + * %FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM: do bitstream authentication using
> > secure
> > + * memory if supported
> > */
> > #define FPGA_MGR_PARTIAL_RECONFIG BIT(0)
> > #define FPGA_MGR_EXTERNAL_CONFIG BIT(1)
> > #define FPGA_MGR_ENCRYPTED_BITSTREAM BIT(2)
> > #define FPGA_MGR_BITSTREAM_LSB_FIRST BIT(3)
> > #define FPGA_MGR_COMPRESSED_BITSTREAM BIT(4)
> > +#define FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM BIT(5)
> > +#define FPGA_MGR_DDR_MEM_AUTH_BITSTREAMBIT(6)
> > +#define FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM BIT(7)
> >
> > /**
> > * struct fpga_image_info - information specific to a FPGA image
> > --
> > 2.18.0
> >
>
> Thanks,
> Moritz
Moritz
RE: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support
Ping! > -Original Message- > From: Nava kishore Manne > Sent: Wednesday, January 27, 2021 2:43 PM > To: Moritz Fischer > Cc: t...@redhat.com; robh...@kernel.org; Michal Simek > ; linux-f...@vger.kernel.org; > devicet...@vger.kernel.org; linux-arm-ker...@lists.infradead.org; linux- > ker...@vger.kernel.org; git ; chinnikishore...@gmail.com > Subject: RE: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support > > Hi Moritz, > > Thanks for the review. > Please find my response inline. > > > -Original Message- > > From: Moritz Fischer > > Sent: Friday, January 22, 2021 10:47 AM > > To: Nava kishore Manne > > Cc: m...@kernel.org; t...@redhat.com; robh...@kernel.org; Michal Simek > > ; linux-f...@vger.kernel.org; > > devicet...@vger.kernel.org; linux-arm-ker...@lists.infradead.org; > > linux- ker...@vger.kernel.org; git ; > > chinnikishore...@gmail.com > > Subject: Re: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading > > support > > > > On Mon, Jan 18, 2021 at 08:20:57AM +0530, Nava kishore Manne wrote: > > > This commit adds secure flags to the framework to support secure > > > BitStream Loading. > > > > > > Signed-off-by: Nava kishore Manne > > > --- > > > drivers/fpga/of-fpga-region.c | 10 ++ > > > include/linux/fpga/fpga-mgr.h | 12 > > > 2 files changed, 22 insertions(+) > > > > > > diff --git a/drivers/fpga/of-fpga-region.c > > > b/drivers/fpga/of-fpga-region.c index e405309baadc..3a5eb480 > > > 100644 > > > --- a/drivers/fpga/of-fpga-region.c > > > +++ b/drivers/fpga/of-fpga-region.c > > > @@ -228,6 +228,16 @@ static struct fpga_image_info > > *of_fpga_region_parse_ov( > > > if (of_property_read_bool(overlay, "encrypted-fpga-config")) > > > info->flags |= FPGA_MGR_ENCRYPTED_BITSTREAM; > > > > > > + if (of_property_read_bool(overlay, "userkey-encrypted-fpga- > > config")) > > > + info->flags |= > > FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM; > > > > Can this just be encrypted-fpga-config/FPGA_MGR_ENCRYPTED? > > In Encryption we have two kinds of use case one is Encrypted Bitstream > loading with Device-key and Other one is Encrypted Bitstream loading with > User-key. To differentiate both the use cases this Changes are needed. > > Regards, > Navakishore.
RE: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support
Hi Moritz, Thanks for the review. Please find my response inline. > -Original Message- > From: Moritz Fischer > Sent: Friday, January 22, 2021 10:47 AM > To: Nava kishore Manne > Cc: m...@kernel.org; t...@redhat.com; robh...@kernel.org; Michal Simek > ; linux-f...@vger.kernel.org; > devicet...@vger.kernel.org; linux-arm-ker...@lists.infradead.org; linux- > ker...@vger.kernel.org; git ; chinnikishore...@gmail.com > Subject: Re: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support > > On Mon, Jan 18, 2021 at 08:20:57AM +0530, Nava kishore Manne wrote: > > This commit adds secure flags to the framework to support secure > > BitStream Loading. > > > > Signed-off-by: Nava kishore Manne > > --- > > drivers/fpga/of-fpga-region.c | 10 ++ > > include/linux/fpga/fpga-mgr.h | 12 > > 2 files changed, 22 insertions(+) > > > > diff --git a/drivers/fpga/of-fpga-region.c > > b/drivers/fpga/of-fpga-region.c index e405309baadc..3a5eb480 > > 100644 > > --- a/drivers/fpga/of-fpga-region.c > > +++ b/drivers/fpga/of-fpga-region.c > > @@ -228,6 +228,16 @@ static struct fpga_image_info > *of_fpga_region_parse_ov( > > if (of_property_read_bool(overlay, "encrypted-fpga-config")) > > info->flags |= FPGA_MGR_ENCRYPTED_BITSTREAM; > > > > + if (of_property_read_bool(overlay, "userkey-encrypted-fpga- > config")) > > + info->flags |= > FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM; > > Can this just be encrypted-fpga-config/FPGA_MGR_ENCRYPTED? In Encryption we have two kinds of use case one is Encrypted Bitstream loading with Device-key and Other one is Encrypted Bitstream loading with User-key. To differentiate both the use cases this Changes are needed. Regards, Navakishore.
Re: [PATCH 1/2] fpga: mgr: Adds secure BitStream loading support
On Mon, Jan 18, 2021 at 08:20:57AM +0530, Nava kishore Manne wrote:
> This commit adds secure flags to the framework to support
> secure BitStream Loading.
>
> Signed-off-by: Nava kishore Manne
> ---
> drivers/fpga/of-fpga-region.c | 10 ++
> include/linux/fpga/fpga-mgr.h | 12
> 2 files changed, 22 insertions(+)
>
> diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
> index e405309baadc..3a5eb480 100644
> --- a/drivers/fpga/of-fpga-region.c
> +++ b/drivers/fpga/of-fpga-region.c
> @@ -228,6 +228,16 @@ static struct fpga_image_info *of_fpga_region_parse_ov(
> if (of_property_read_bool(overlay, "encrypted-fpga-config"))
> info->flags |= FPGA_MGR_ENCRYPTED_BITSTREAM;
>
> + if (of_property_read_bool(overlay, "userkey-encrypted-fpga-config"))
> + info->flags |= FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM;
Can this just be encrypted-fpga-config/FPGA_MGR_ENCRYPTED?
> +
> + if (of_property_read_bool(overlay, "ddrmem-authenticated-fpga-config"))
> + info->flags |= FPGA_MGR_DDR_MEM_AUTH_BITSTREAM;
> +
> + if (of_property_read_bool(overlay,
> + "securemem-authenticated-fpga-config"))
> + info->flags |= FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM;
> +
> if (!of_property_read_string(overlay, "firmware-name",
>&firmware_name)) {
> info->firmware_name = devm_kstrdup(dev, firmware_name,
> diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h
> index 2bc3030a69e5..2f7455a60666 100644
> --- a/include/linux/fpga/fpga-mgr.h
> +++ b/include/linux/fpga/fpga-mgr.h
> @@ -67,12 +67,24 @@ enum fpga_mgr_states {
> * %FPGA_MGR_BITSTREAM_LSB_FIRST: SPI bitstream bit order is LSB first
> *
> * %FPGA_MGR_COMPRESSED_BITSTREAM: FPGA bitstream is compressed
> + *
> + * %FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM: indicates bitstream is encrypted
> with
> + *user key
> + *
> + * %FPGA_MGR_DDR_MEM_AUTH_BITSTREAM: do bitstream authentication using DDR
> + * memory if supported
> + *
> + * %FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM: do bitstream authentication using
> secure
> + * memory if supported
> */
> #define FPGA_MGR_PARTIAL_RECONFIGBIT(0)
> #define FPGA_MGR_EXTERNAL_CONFIG BIT(1)
> #define FPGA_MGR_ENCRYPTED_BITSTREAM BIT(2)
> #define FPGA_MGR_BITSTREAM_LSB_FIRST BIT(3)
> #define FPGA_MGR_COMPRESSED_BITSTREAMBIT(4)
> +#define FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM BIT(5)
> +#define FPGA_MGR_DDR_MEM_AUTH_BITSTREAM BIT(6)
> +#define FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM BIT(7)
>
> /**
> * struct fpga_image_info - information specific to a FPGA image
> --
> 2.18.0
>
Thanks,
Moritz
[PATCH 1/2] fpga: mgr: Adds secure BitStream loading support
This commit adds secure flags to the framework to support
secure BitStream Loading.
Signed-off-by: Nava kishore Manne
---
drivers/fpga/of-fpga-region.c | 10 ++
include/linux/fpga/fpga-mgr.h | 12
2 files changed, 22 insertions(+)
diff --git a/drivers/fpga/of-fpga-region.c b/drivers/fpga/of-fpga-region.c
index e405309baadc..3a5eb480 100644
--- a/drivers/fpga/of-fpga-region.c
+++ b/drivers/fpga/of-fpga-region.c
@@ -228,6 +228,16 @@ static struct fpga_image_info *of_fpga_region_parse_ov(
if (of_property_read_bool(overlay, "encrypted-fpga-config"))
info->flags |= FPGA_MGR_ENCRYPTED_BITSTREAM;
+ if (of_property_read_bool(overlay, "userkey-encrypted-fpga-config"))
+ info->flags |= FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM;
+
+ if (of_property_read_bool(overlay, "ddrmem-authenticated-fpga-config"))
+ info->flags |= FPGA_MGR_DDR_MEM_AUTH_BITSTREAM;
+
+ if (of_property_read_bool(overlay,
+ "securemem-authenticated-fpga-config"))
+ info->flags |= FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM;
+
if (!of_property_read_string(overlay, "firmware-name",
&firmware_name)) {
info->firmware_name = devm_kstrdup(dev, firmware_name,
diff --git a/include/linux/fpga/fpga-mgr.h b/include/linux/fpga/fpga-mgr.h
index 2bc3030a69e5..2f7455a60666 100644
--- a/include/linux/fpga/fpga-mgr.h
+++ b/include/linux/fpga/fpga-mgr.h
@@ -67,12 +67,24 @@ enum fpga_mgr_states {
* %FPGA_MGR_BITSTREAM_LSB_FIRST: SPI bitstream bit order is LSB first
*
* %FPGA_MGR_COMPRESSED_BITSTREAM: FPGA bitstream is compressed
+ *
+ * %FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM: indicates bitstream is encrypted with
+ *user key
+ *
+ * %FPGA_MGR_DDR_MEM_AUTH_BITSTREAM: do bitstream authentication using DDR
+ * memory if supported
+ *
+ * %FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM: do bitstream authentication using
secure
+ * memory if supported
*/
#define FPGA_MGR_PARTIAL_RECONFIG BIT(0)
#define FPGA_MGR_EXTERNAL_CONFIG BIT(1)
#define FPGA_MGR_ENCRYPTED_BITSTREAM BIT(2)
#define FPGA_MGR_BITSTREAM_LSB_FIRST BIT(3)
#define FPGA_MGR_COMPRESSED_BITSTREAM BIT(4)
+#define FPGA_MGR_USERKEY_ENCRYPTED_BITSTREAM BIT(5)
+#define FPGA_MGR_DDR_MEM_AUTH_BITSTREAMBIT(6)
+#define FPGA_MGR_SECURE_MEM_AUTH_BITSTREAM BIT(7)
/**
* struct fpga_image_info - information specific to a FPGA image
--
2.18.0
