mirror of
https://github.com/torvalds/linux.git
synced 2026-04-18 14:53:58 -04:00
6ac142bf26
Anti-Rollback (ARB) is a QAT GEN6 hardware feature that prevents loading firmware with a Security Version Number (SVN) lower than an authorized minimum. This protects against downgrade attacks by ensuring that only firmware at or above a committed SVN can run on the acceleration device. During firmware loading, the driver checks the SVN validation status via a hardware CSR. If the check reports a failure, firmware authentication is aborted. If it reports a retry status, the driver reissues the authentication command up to a maximum number of retries. Extend the firmware admin interface with two new messages, ICP_QAT_FW_SVN_READ and ICP_QAT_FW_SVN_COMMIT, to query and commit the SVN, respectively. Integrate the SVN check into the firmware authentication path in qat_uclo.c so the driver can react to anti-rollback status during device bring-up. Expose SVN information to userspace via a new sysfs attribute group, qat_svn, under the PCI device directory. The group provides read-only attributes for the active, enforced minimum, and permanent minimum SVN values, as well as a write-only commit attribute that allows a system administrator to commit the currently active SVN as the new authorized minimum. This is based on earlier work by Ciunas Bennett. Signed-off-by: Suman Kumar Chakraborty <suman.kumar.chakraborty@intel.com> Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
34 lines
1.6 KiB
C
34 lines
1.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/* Copyright(c) 2023 Intel Corporation */
|
|
#ifndef ADF_ADMIN
|
|
#define ADF_ADMIN
|
|
|
|
#include "icp_qat_fw_init_admin.h"
|
|
|
|
struct adf_accel_dev;
|
|
|
|
int adf_init_admin_comms(struct adf_accel_dev *accel_dev);
|
|
void adf_exit_admin_comms(struct adf_accel_dev *accel_dev);
|
|
int adf_send_admin_init(struct adf_accel_dev *accel_dev);
|
|
int adf_get_ae_fw_counters(struct adf_accel_dev *accel_dev, u16 ae, u64 *reqs, u64 *resps);
|
|
int adf_init_admin_pm(struct adf_accel_dev *accel_dev, u32 idle_delay);
|
|
int adf_send_admin_tim_sync(struct adf_accel_dev *accel_dev, u32 cnt);
|
|
int adf_send_admin_hb_timer(struct adf_accel_dev *accel_dev, uint32_t ticks);
|
|
int adf_send_admin_rl_init(struct adf_accel_dev *accel_dev,
|
|
struct icp_qat_fw_init_admin_slice_cnt *slices);
|
|
int adf_send_admin_rl_add_update(struct adf_accel_dev *accel_dev,
|
|
struct icp_qat_fw_init_admin_req *req);
|
|
int adf_send_admin_rl_delete(struct adf_accel_dev *accel_dev, u16 node_id,
|
|
u8 node_type);
|
|
int adf_get_fw_timestamp(struct adf_accel_dev *accel_dev, u64 *timestamp);
|
|
int adf_get_pm_info(struct adf_accel_dev *accel_dev, dma_addr_t p_state_addr, size_t buff_size);
|
|
int adf_get_cnv_stats(struct adf_accel_dev *accel_dev, u16 ae, u16 *err_cnt, u16 *latest_err);
|
|
int adf_send_admin_tl_start(struct adf_accel_dev *accel_dev,
|
|
dma_addr_t tl_dma_addr, size_t layout_sz, u8 *rp_indexes,
|
|
struct icp_qat_fw_init_admin_slice_cnt *slice_count);
|
|
int adf_send_admin_tl_stop(struct adf_accel_dev *accel_dev);
|
|
int adf_send_admin_arb_query(struct adf_accel_dev *accel_dev, int cmd, u8 *svn);
|
|
int adf_send_admin_arb_commit(struct adf_accel_dev *accel_dev);
|
|
|
|
#endif
|