lkml.org 
[lkml]   [2020]   [Oct]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v2 0/7] Intel FPGA Security Manager Class Driver
    From
    Date

    On 10/2/20 3:36 PM, Russ Weight wrote:
    > The Intel FPGA Security Manager class driver provides a common
    > API for user-space tools to manage updates for secure Intel FPGA
    > devices. Device drivers that instantiate the Intel Security
    > Manager class driver will interact with a HW secure update
    > engine in order to transfer new FPGA and BMC images to FLASH so
    > that they will be automatically loaded when the FPGA card reboots.
    >
    > A significant difference between the FPGA Manager and the Intel FPGA
    > Security Manager is that the FPGA Manager does a live update (Partial
    > Reconfiguration) to a device whereas the Intel FPGA Security Manager
    > updates the FLASH images for the Static Region and the BMC so that
    > they will be loaded the next time the FPGA card boots. Security is
    > enforced by hardware and firmware. The security manager interacts
    > with the firmware to initiate an update, pass in the necessary data,
    > and collect status on the update.
    >
    > The n3000bmc-secure driver is the first driver to use the Intel FPG
    > Security Manager. This driver was previously submittied in the same
    > patch set, but has been split out in to a separate patch set for V2.
    > Follow-on Intel devices will also make use of this common API for
    > secure updates.
    >
    > In addition to managing secure updates of the FPGA and BMC images,
    > the Intel FPGA Security Manager update process may also used to
    > program root entry hashes and cancellation keys for the FPGA static
    > region, the FPGA partial reconfiguration region, and the BMC.
    >
    > Secure updates make use of the request_firmware framework, which
    > requires that image files are accessible under /lib/firmware. A request
    > for a secure update returns immediately, while the update itself
    > proceeds in the context of a kernel worker thread. Sysfs files provide
    > a means for monitoring the progress of a secure update and for
    > retrieving error information in the event of a failure.
    >
    > The API consists of sysfs nodes and supports the following functions:
    >
    > (1) Instantiate and monitor a secure update
    > (2) Display security information including: Root Entry Hashes (REH),
    > Cancelled Code Signing Keys (CSK), and flash update counts for
    > both BMC and FPGA images.
    >
    > Changelog v1 -> v2:
    > - Separated out the MAX10 BMC Security Engine to be submitted in
    > a separate patch-set.
    > - Bumped documentation dates and versions
    > - Split ifpga_sec_mgr_register() into create() and register() functions
    > - Added devm_ifpga_sec_mgr_create()
    > - Added Documentation/fpga/ifpga-sec-mgr.rst
    > - Changed progress state "read_file" to "reading"
    > - Added sec_error() function (similar to sec_progress())
    > - Removed references to bmc_flash_count & smbus_flash_count (not supported)
    > - Removed typedefs for imgr ops
    > - Removed explicit value assignments in enums
    > - Other minor code cleanup per review comments
    >
    > Russ Weight (7):
    > fpga: sec-mgr: intel fpga security manager class driver
    > fpga: sec-mgr: enable secure updates
    > fpga: sec-mgr: expose sec-mgr update status
    > fpga: sec-mgr: expose sec-mgr update errors
    > fpga: sec-mgr: expose sec-mgr update size
    > fpga: sec-mgr: enable cancel of secure update
    > fpga: sec-mgr: expose hardware error info
    >
    > .../ABI/testing/sysfs-class-ifpga-sec-mgr | 143 ++++
    > Documentation/fpga/ifpga-sec-mgr.rst | 50 ++
    > Documentation/fpga/index.rst | 1 +
    > MAINTAINERS | 9 +
    > drivers/fpga/Kconfig | 9 +
    > drivers/fpga/Makefile | 3 +
    > drivers/fpga/ifpga-sec-mgr.c | 781 ++++++++++++++++++
    > include/linux/fpga/ifpga-sec-mgr.h | 137 +++
    > 8 files changed, 1133 insertions(+)
    > create mode 100644 Documentation/ABI/testing/sysfs-class-ifpga-sec-mgr
    > create mode 100644 Documentation/fpga/ifpga-sec-mgr.rst
    > create mode 100644 drivers/fpga/ifpga-sec-mgr.c
    > create mode 100644 include/linux/fpga/ifpga-sec-mgr.h

    Russ,

    This set has all the changes I was looking for.

    Thanks,

    Tom

    \
     
     \ /
      Last update: 2020-10-04 23:21    [W:4.514 / U:0.064 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site