From: Richard Gong <[email protected]>
Add authenticate-fpga-config property for FPGA bitstream authentication,
which makes sure a signed bitstream has valid signatures.
Signed-off-by: Richard Gong <[email protected]>
---
v4: explain authenticate-fpga-config flag further
v3: no change
v2: put authenticate-fpga-config above partial-fpga-config
update commit messages
---
Documentation/devicetree/bindings/fpga/fpga-region.txt | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/Documentation/devicetree/bindings/fpga/fpga-region.txt b/Documentation/devicetree/bindings/fpga/fpga-region.txt
index e811cf8..e2740b6 100644
--- a/Documentation/devicetree/bindings/fpga/fpga-region.txt
+++ b/Documentation/devicetree/bindings/fpga/fpga-region.txt
@@ -182,6 +182,10 @@ Optional properties:
This property is optional if the FPGA Manager handles the bridges.
If the fpga-region is the child of a fpga-bridge, the list should not
contain the parent bridge.
+- authenticate-fpga-config : boolean, set if do bitstream authentication only.
+ flag authenticate-fpga-config is used to first check the integrity of
+ the bitstream. If the authentication is passed, the user can perform
+ other operations.
- partial-fpga-config : boolean, set if partial reconfiguration is to be done,
otherwise full reconfiguration is done.
- external-fpga-config : boolean, set if the FPGA has already been configured
--
2.7.4
On Mon, Feb 01, 2021 at 09:21:58AM -0600, [email protected] wrote:
> From: Richard Gong <[email protected]>
>
> Add authenticate-fpga-config property for FPGA bitstream authentication,
> which makes sure a signed bitstream has valid signatures.
>
> Signed-off-by: Richard Gong <[email protected]>
> ---
> v4: explain authenticate-fpga-config flag further
> v3: no change
> v2: put authenticate-fpga-config above partial-fpga-config
> update commit messages
> ---
> Documentation/devicetree/bindings/fpga/fpga-region.txt | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/fpga/fpga-region.txt b/Documentation/devicetree/bindings/fpga/fpga-region.txt
> index e811cf8..e2740b6 100644
> --- a/Documentation/devicetree/bindings/fpga/fpga-region.txt
> +++ b/Documentation/devicetree/bindings/fpga/fpga-region.txt
> @@ -182,6 +182,10 @@ Optional properties:
> This property is optional if the FPGA Manager handles the bridges.
> If the fpga-region is the child of a fpga-bridge, the list should not
> contain the parent bridge.
> +- authenticate-fpga-config : boolean, set if do bitstream authentication only.
> + flag authenticate-fpga-config is used to first check the integrity of
> + the bitstream. If the authentication is passed, the user can perform
> + other operations.
From the other commits it looks like it *also* writes to QSPI? If so
please document that.
If not, feel free to ignore :)
Maybe I would highlight two things:
a) If you add 'authenticate-fpga-config' you are not allowed to add new
nodes
b) If you add 'authenticate-fpga-config' you are not alllowed to add
other operations
> - partial-fpga-config : boolean, set if partial reconfiguration is to be done,
> otherwise full reconfiguration is done.
> - external-fpga-config : boolean, set if the FPGA has already been configured
> --
> 2.7.4
>
Thanks,
Moritz
Hi Moritz,
On 2/1/21 10:27 PM, Moritz Fischer wrote:
> On Mon, Feb 01, 2021 at 09:21:58AM -0600, [email protected] wrote:
>> From: Richard Gong <[email protected]>
>>
>> Add authenticate-fpga-config property for FPGA bitstream authentication,
>> which makes sure a signed bitstream has valid signatures.
>>
>> Signed-off-by: Richard Gong <[email protected]>
>> ---
>> v4: explain authenticate-fpga-config flag further
>> v3: no change
>> v2: put authenticate-fpga-config above partial-fpga-config
>> update commit messages
>> ---
>> Documentation/devicetree/bindings/fpga/fpga-region.txt | 4 ++++
>> 1 file changed, 4 insertions(+)
>>
>> diff --git a/Documentation/devicetree/bindings/fpga/fpga-region.txt b/Documentation/devicetree/bindings/fpga/fpga-region.txt
>> index e811cf8..e2740b6 100644
>> --- a/Documentation/devicetree/bindings/fpga/fpga-region.txt
>> +++ b/Documentation/devicetree/bindings/fpga/fpga-region.txt
>> @@ -182,6 +182,10 @@ Optional properties:
>> This property is optional if the FPGA Manager handles the bridges.
>> If the fpga-region is the child of a fpga-bridge, the list should not
>> contain the parent bridge.
>> +- authenticate-fpga-config : boolean, set if do bitstream authentication only.
>> + flag authenticate-fpga-config is used to first check the integrity of
>> + the bitstream. If the authentication is passed, the user can perform
>> + other operations.
> From the other commits it looks like it *also* writes to QSPI? If so
> please document that.
>
> If not, feel free to ignore :)
>
> Maybe I would highlight two things:
> a) If you add 'authenticate-fpga-config' you are not allowed to add new
> nodes
> b) If you add 'authenticate-fpga-config' you are not alllowed to add
> other operations
How about the descriptions below?
- authenticate-fpga-config : boolean, set if do bitstream authentication
only.
If 'authenticate-fpga-config' is added then adding a new node or another
operation is not allowed.
Flag authenticate-fpga-config is used to check the integrity of the
bitstream.
Except for the actual configuration of the device, the authentication
works in the same way as FPGA configuration. If the authentication
passes, other operations such as full or partial reconfiguration can be
performed. When the bitstream into QSPI flash memory at device is
programmed, it is expected that there will be no issue when starting the
device.
>> - partial-fpga-config : boolean, set if partial reconfiguration is to be done,
>> otherwise full reconfiguration is done.
>> - external-fpga-config : boolean, set if the FPGA has already been configured
>> --
>> 2.7.4
>>
> Thanks,
> Moritz
>
Regards,
Richard