fpga: zynq: encrypted bitstreams plus one
Subsystems (3)
PATCH 2/4 fpga: Add flag to indicate bitstream needs decrypting
In reply to Alan TullFrom: Moritz Fischer <[email protected]>
Add a flag that is passed to the write_init() callback, indicating that the bitstream is encrypted.
The low-level driver will deal with the flag, or return an error, if encrypted bitstreams are not supported.
--- include/linux/fpga/fpga-mgr.h | 1 + 1 file changed, 1 insertion(+)
include/linux/fpga/fpga-mgr.h +1 -0
@@ -70,6 +70,7 @@ enum fpga_mgr_states {*/ #define FPGA_MGR_PARTIAL_RECONFIG BIT(0)#define FPGA_MGR_EXTERNAL_CONFIG BIT(1) +#define FPGA_MGR_ENCRYPTED_BITSTREAM BIT(2)/** * struct fpga_image_info - information specific to a FPGA image
Signature · 1 line
2.7.4
PATCH 3/4 fpga: zynq: Add support for encrypted bitstreams
In reply to Alan TullFrom: Moritz Fischer <[email protected]>
Add support for encrypted bitstreams. For this to work the system must be booted in secure mode.
In order for on-the-fly decryption to work, the PCAP clock rate needs to be lowered via the PCAP_RATE_EN bit.
--- drivers/fpga/zynq-fpga.c | 28 +++++++++++++++++++++++++--- 1 file changed, 25 insertions(+), 3 deletions(-)
drivers/fpga/zynq-fpga.c +25 -3
@@ -72,6 +72,10 @@#define CTRL_PCAP_PR_MASK BIT(27)/* Enable PCAP */ #define CTRL_PCAP_MODE_MASK BIT(26) +/* Lower rate to allow decrypt on the fly */ +#define CTRL_PCAP_RATE_EN_MASK BIT(25) +/* System booted in secure mode */ +#define CTRL_SEC_EN_MASK BIT(7)/* Miscellaneous Control Register bit definitions */ /* Internal PCAP loopback */
@@ -266,6 +270,17 @@ static int zynq_fpga_ops_write_init(struct fpga_manager *mgr,if (err)return err; +/* check if bitstream is encrypted & and system's still secure */ +if (info->flags &FPGA_MGR_ENCRYPTED_BITSTREAM ) { + ctrl =zynq_fpga_read (priv,CTRL_OFFSET ); +if (!(ctrl &CTRL_SEC_EN_MASK )) { +dev_err (&mgr->dev, +"System not secure, can't use crypted bitstreams\n" ); + err = -EINVAL ; + goto out_err; + } + } +/* don't globally reset PL if we're doing partial reconfig */ if (!(info->flags &FPGA_MGR_PARTIAL_RECONFIG )) {if (!zynq_fpga_has_sync (buf, count)) {
@@ -337,12 +352,19 @@ static int zynq_fpga_ops_write_init(struct fpga_manager *mgr,/* set configuration register with following options: * - enable PCAP interface -* - set throughput for maximum speed +* - set throughput for maximum speed (if bistream not crypted) * - set CPU in user mode */ ctrl =zynq_fpga_read (priv,CTRL_OFFSET ); -zynq_fpga_write (priv,CTRL_OFFSET , - (CTRL_PCAP_PR_MASK |CTRL_PCAP_MODE_MASK | ctrl)); +if (info->flags &FPGA_MGR_ENCRYPTED_BITSTREAM ) +zynq_fpga_write (priv,CTRL_OFFSET , + (CTRL_PCAP_PR_MASK |CTRL_PCAP_MODE_MASK + |CTRL_PCAP_RATE_EN_MASK | ctrl)); +else +zynq_fpga_write (priv,CTRL_OFFSET , + (CTRL_PCAP_PR_MASK |CTRL_PCAP_MODE_MASK + | ctrl)); +/* We expect that the command queue is empty right now. */ status =zynq_fpga_read (priv,STATUS_OFFSET );
Signature · 1 line
2.7.4
PATCH 4/4 fpga: region: Add fpga-region property 'encrypted-fpga-config'
In reply to Alan TullFrom: Moritz Fischer <[email protected]>
Add fpga-region property to allow passing the fact that the bitstream is encrypted to the fpga-region and ultimately to the low-level driver.
--- Documentation/devicetree/bindings/fpga/fpga-region.txt | 1 + drivers/fpga/fpga-region.c | 8 ++++++-- 2 files changed, 7 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/fpga/fpga-region.txt +1 -0
@@ -186,6 +186,7 @@ Optional properties: otherwise full reconfiguration is done. - external-fpga-config : boolean, set if the FPGA has already been configured prior to OS boot up. +- encrypted-fpga-config : boolean, set if the bitstream is encrypted - region-unfreeze-timeout-us : The maximum time in microseconds to wait for bridges to successfully become enabled after the region has been programmed.
drivers/fpga/fpga-region.c +6 -2
@@ -337,8 +337,9 @@ static int child_regions_with_firmware(struct device_node *overlay)* The overlay must add either firmware-name or external-fpga-config property * to the FPGA Region. * -* firmware-name : program the FPGA -* external-fpga-config : FPGA is already programmed +* firmware-name : program the FPGA +* external-fpga-config : FPGA is already programmed +* encrypted-fpga-config : FPGA bitstream is encrypted * * The overlay can add other FPGA regions, but child FPGA regions cannot have a * firmware-name property since those regions don't exist yet.
@@ -373,6 +374,9 @@ static int fpga_region_notify_pre_apply(struct fpga_region *region,if (of_property_read_bool (nd->overlay,"external-fpga-config" )) info->flags |=FPGA_MGR_EXTERNAL_CONFIG ; +if (of_property_read_bool (nd->overlay,"encrypted-fpga-config" )) + info->flags |=FPGA_MGR_ENCRYPTED_BITSTREAM ; +of_property_read_string (nd->overlay,"firmware-name" , &firmware_name); of_property_read_u32(nd->overlay, "region-unfreeze-timeout-us",
Signature · 1 line
2.7.4
cover fpga: zynq: encrypted bitstreams plus one
Hi Greg,
Please take these patches that have been reviewed on the lkml and linux-fpga lists. Dihn's patch fixes minor sparse warnings. Moritz's patch adds some functionality for Zynq.
Thanks,
Alan
Dinh Nguyen (1):
fpga: fix sparse warnings in fpga-mgr and fpga-bridge
Moritz Fischer (3):
fpga: Add flag to indicate bitstream needs decrypting
fpga: zynq: Add support for encrypted bitstreams
fpga: region: Add fpga-region property 'encrypted-fpga-config'
.../devicetree/bindings/fpga/fpga-region.txt | 1 + drivers/fpga/fpga-bridge.c | 2 +- drivers/fpga/fpga-mgr.c | 2 +- drivers/fpga/fpga-region.c | 8 +++++-- drivers/fpga/zynq-fpga.c | 28 +++++++++++++++++++--- include/linux/fpga/fpga-mgr.h | 1 + 6 files changed, 35 insertions(+), 7 deletions(-)
Signature · 1 line
2.7.4
PATCH 1/4 fpga: fix sparse warnings in fpga-mgr and fpga-bridge
From: Dinh Nguyen <[email protected]>
Fix up these sparse warnings:
drivers/fpga/fpga-mgr.c:189:21: warning: symbol '__fpga_mgr_get' was not declared. Should it be static? drivers/fpga/fpga-bridge.c:30:12: warning: symbol 'bridge_list_lock' was not declared. Should it be static?
--- drivers/fpga/fpga-bridge.c | 2 +- drivers/fpga/fpga-mgr.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/fpga/fpga-bridge.c +1 -1
@@ -27,7 +27,7 @@ static DEFINE_IDA(fpga_bridge_ida);static struct class *fpga_bridge_class;/* Lock for adding/removing bridges to linked lists*/ -spinlock_t bridge_list_lock; +static spinlock_t bridge_list_lock;static int fpga_bridge_of_node_match (struct device *dev,const void *data) {
drivers/fpga/fpga-mgr.c +1 -1
@@ -361,7 +361,7 @@ static struct attribute *fpga_mgr_attrs[] = { };ATTRIBUTE_GROUPS (fpga_mgr); -struct fpga_manager *__fpga_mgr_get (struct device *dev) +static struct fpga_manager *__fpga_mgr_get (struct device *dev) {struct fpga_manager *mgr;int ret = -ENODEV ;
Signature · 1 line
2.7.4