feat(intel): initial commit for attestation service

This is to extend the functionality of FPGA Crypto Service (FCS)
to support FPGA Attestation feature in Stratix 10 device.

Signed-off-by: Boon Khai Ng <boon.khai.ng@intel.com>
Signed-off-by: Sieu Mun Tang <sieu.mun.tang@intel.com>
Change-Id: Ib15783383dc9a06a2f0dc6dc1786f44b89f32cb1

diff --git a/plat/intel/soc/common/include/socfpga_fcs.h b/plat/intel/soc/common/include/socfpga_fcs.h
index a3efd808c72da78cea8456c5a6705b975028ba05..d5125df711fbf38bcdf98610136a11e22ce27a6a 100644 (file)
--- a/plat/intel/soc/common/include/socfpga_fcs.h
+++ b/plat/intel/soc/common/include/socfpga_fcs.h
@@ -23,6 +23,12 @@
 #define FCS_DECRYPTION_DATA_0          0x10102
 #define FCS_OWNER_ID_OFFSET            0xC
 
+#define PSGSIGMA_TEARDOWN_MAGIC                0xB852E2A4
+#define        PSGSIGMA_SESSION_ID_ONE         0x1
+#define PSGSIGMA_UNKNOWN_SESSION       0xFFFFFFFF
+
+#define        RESERVED_AS_ZERO                0x0
+
 /* FCS Payload Structure */
 
 typedef struct fcs_encrypt_payload_t {
@@ -42,6 +48,13 @@ typedef struct fcs_decrypt_payload_t {
        uint32_t dst_size;
 } fcs_decrypt_payload;
 
+typedef struct psgsigma_teardown_msg_t {
+       uint32_t reserved_word;
+       uint32_t magic_word;
+       uint32_t session_id;
+} psgsigma_teardown_msg;
+
+
 /* Functions Definitions */
 
 uint32_t intel_fcs_random_number_gen(uint64_t addr, uint64_t *ret_size,
@@ -57,6 +70,14 @@ uint32_t intel_fcs_decryption(uint32_t src_addr, uint32_t src_size,
                                uint32_t dst_addr, uint32_t dst_size,
                                uint32_t *send_id);
 
+int intel_fcs_sigma_teardown(uint32_t session_id, uint32_t *mbox_error);
+int intel_fcs_chip_id(uint32_t *id_low, uint32_t *id_high, uint32_t *mbox_error);
+int intel_fcs_attestation_subkey(uint64_t src_addr, uint32_t src_size,
+                               uint64_t dst_addr, uint32_t *dst_size,
+                               uint32_t *mbox_error);
+int intel_fcs_get_measurement(uint64_t src_addr, uint32_t src_size,
+                               uint64_t dst_addr, uint32_t *dst_size,
+                               uint32_t *mbox_error);
 uint32_t intel_fcs_get_rom_patch_sha384(uint64_t addr, uint64_t *ret_size,
                                uint32_t *mbox_error);
 

diff --git a/plat/intel/soc/common/include/socfpga_mailbox.h b/plat/intel/soc/common/include/socfpga_mailbox.h
index b260a627ec9122cf8b94474994c9d243bb2250d5..eafe2411b128673b16b6dc08393a066ade5a4033 100644 (file)
--- a/plat/intel/soc/common/include/socfpga_mailbox.h
+++ b/plat/intel/soc/common/include/socfpga_mailbox.h
@@ -43,6 +43,7 @@
 #define MBOX_CMD_VAB_SRC_CERT          0x0B
 #define MBOX_CMD_GET_IDCODE            0x10
 #define MBOX_CMD_GET_USERCODE          0x13
+#define MBOX_CMD_GET_CHIPID            0x12
 #define MBOX_CMD_REBOOT_HPS            0x47
 
 /* Reconfiguration Commands */
@@ -73,6 +74,14 @@
 #define MBOX_FCS_ENCRYPT_REQ                   0x7E
 #define MBOX_FCS_DECRYPT_REQ                   0x7F
 #define MBOX_FCS_RANDOM_GEN                    0x80
+
+/* PSG SIGMA Commands */
+#define MBOX_PSG_SIGMA_TEARDOWN                0xD5
+
+/* Attestation Commands */
+#define MBOX_ATTESTATION_SUBKEY                0x182
+#define MBOX_GET_MEASUREMENT           0x183
+
 /* Miscellaneous commands */
 #define MBOX_GET_ROM_PATCH_SHA384      0x1B0
 

diff --git a/plat/intel/soc/common/include/socfpga_sip_svc.h b/plat/intel/soc/common/include/socfpga_sip_svc.h
index fcd54509837bcaa4932f80a1a0eea297013e956c..26db14b39ff43662a0ecde2c0ee8da06043d29f9 100644 (file)
--- a/plat/intel/soc/common/include/socfpga_sip_svc.h
+++ b/plat/intel/soc/common/include/socfpga_sip_svc.h
@@ -73,6 +73,10 @@
 
 /* FPGA Crypto Services */
 #define INTEL_SIP_SMC_FCS_CRYPTION                     0x4200005B
+#define INTEL_SIP_SMC_FCS_PSGSIGMA_TEARDOWN                    0xC2000064
+#define INTEL_SIP_SMC_FCS_CHIP_ID                              0xC2000065
+#define INTEL_SIP_SMC_FCS_ATTESTATION_SUBKEY                   0xC2000066
+#define INTEL_SIP_SMC_FCS_ATTESTATION_MEASUREMENTS             0xC2000067
 
 /* ECC DBE */
 #define WARM_RESET_WFI_FLAG                            BIT(31)

diff --git a/plat/intel/soc/common/sip/socfpga_sip_fcs.c b/plat/intel/soc/common/sip/socfpga_sip_fcs.c
index a174e5f2dee076d75a8d8c6c080b6475c6d45c8d..4b06fa60c4ad3b7799ad7d326f1e7842d8ea0856 100644 (file)
--- a/plat/intel/soc/common/sip/socfpga_sip_fcs.c
+++ b/plat/intel/soc/common/sip/socfpga_sip_fcs.c
@@ -198,3 +198,107 @@ uint32_t intel_fcs_get_rom_patch_sha384(uint64_t addr, uint64_t *ret_size,
 
        return INTEL_SIP_SMC_STATUS_OK;
 }
+
+int intel_fcs_sigma_teardown(uint32_t session_id, uint32_t *mbox_error)
+{
+       int status;
+
+       if ((session_id != PSGSIGMA_SESSION_ID_ONE) &&
+               (session_id != PSGSIGMA_UNKNOWN_SESSION)) {
+               return INTEL_SIP_SMC_STATUS_REJECTED;
+       }
+
+       psgsigma_teardown_msg message = {
+               RESERVED_AS_ZERO,
+               PSGSIGMA_TEARDOWN_MAGIC,
+               session_id
+       };
+
+       status = mailbox_send_cmd(MBOX_JOB_ID, MBOX_PSG_SIGMA_TEARDOWN,
+                       (uint32_t *) &message, sizeof(message) / MBOX_WORD_BYTE,
+                       CMD_CASUAL, NULL, NULL);
+
+       if (status < 0) {
+               *mbox_error = -status;
+               return INTEL_SIP_SMC_STATUS_ERROR;
+       }
+
+       return INTEL_SIP_SMC_STATUS_OK;
+}
+
+int intel_fcs_chip_id(uint32_t *id_low, uint32_t *id_high, uint32_t *mbox_error)
+{
+       int status;
+       uint32_t load_size;
+       uint32_t chip_id[2];
+
+       load_size = sizeof(chip_id) / MBOX_WORD_BYTE;
+
+       status = mailbox_send_cmd(MBOX_JOB_ID, MBOX_CMD_GET_CHIPID, NULL,
+                       0U, CMD_CASUAL, (uint32_t *) chip_id, &load_size);
+
+       if (status < 0) {
+               *mbox_error = -status;
+               return INTEL_SIP_SMC_STATUS_ERROR;
+       }
+
+       *id_low = chip_id[0];
+       *id_high = chip_id[1];
+
+       return INTEL_SIP_SMC_STATUS_OK;
+}
+
+int intel_fcs_attestation_subkey(uint64_t src_addr, uint32_t src_size,
+               uint64_t dst_addr, uint32_t *dst_size, uint32_t *mbox_error)
+{
+       int status;
+       uint32_t send_size = src_size / MBOX_WORD_BYTE;
+       uint32_t ret_size = *dst_size / MBOX_WORD_BYTE;
+
+
+       if (!is_address_in_ddr_range(src_addr, src_size) ||
+               !is_address_in_ddr_range(dst_addr, *dst_size)) {
+               return INTEL_SIP_SMC_STATUS_REJECTED;
+       }
+
+       status = mailbox_send_cmd(MBOX_JOB_ID, MBOX_ATTESTATION_SUBKEY,
+                       (uint32_t *) src_addr, send_size, CMD_CASUAL,
+                       (uint32_t *) dst_addr, &ret_size);
+
+       if (status < 0) {
+               *mbox_error = -status;
+               return INTEL_SIP_SMC_STATUS_ERROR;
+       }
+
+       *dst_size = ret_size * MBOX_WORD_BYTE;
+       flush_dcache_range(dst_addr, *dst_size);
+
+       return INTEL_SIP_SMC_STATUS_OK;
+}
+
+int intel_fcs_get_measurement(uint64_t src_addr, uint32_t src_size,
+               uint64_t dst_addr, uint32_t *dst_size, uint32_t *mbox_error)
+{
+       int status;
+       uint32_t send_size = src_size / MBOX_WORD_BYTE;
+       uint32_t ret_size = *dst_size / MBOX_WORD_BYTE;
+
+       if (!is_address_in_ddr_range(src_addr, src_size) ||
+               !is_address_in_ddr_range(dst_addr, *dst_size)) {
+               return INTEL_SIP_SMC_STATUS_REJECTED;
+       }
+
+       status = mailbox_send_cmd(MBOX_JOB_ID, MBOX_GET_MEASUREMENT,
+                       (uint32_t *) src_addr, send_size, CMD_CASUAL,
+                       (uint32_t *) dst_addr, &ret_size);
+
+       if (status < 0) {
+               *mbox_error = -status;
+               return INTEL_SIP_SMC_STATUS_ERROR;
+       }
+
+       *dst_size = ret_size * MBOX_WORD_BYTE;
+       flush_dcache_range(dst_addr, *dst_size);
+
+       return INTEL_SIP_SMC_STATUS_OK;
+}

diff --git a/plat/intel/soc/common/socfpga_sip_svc.c b/plat/intel/soc/common/socfpga_sip_svc.c
index a80208faec83f1e6d0d62454a7534a355034f61c..851bc941cf358aad8ae71058668d1bdd6a5bc4e3 100644 (file)
--- a/plat/intel/soc/common/socfpga_sip_svc.c
+++ b/plat/intel/soc/common/socfpga_sip_svc.c
@@ -565,9 +565,9 @@ uintptr_t sip_smc_handler(uint32_t smc_fid,
                         void *handle,
                         u_register_t flags)
 {
-       uint32_t retval = 0;
+       uint32_t retval = 0, completed_addr[3];
+       uint32_t retval2 = 0;
        uint32_t mbox_error = 0;
-       uint32_t completed_addr[3];
        uint64_t retval64, rsu_respbuf[9];
        int status = INTEL_SIP_SMC_STATUS_OK;
        int mbox_status;
@@ -728,6 +728,24 @@ uintptr_t sip_smc_handler(uint32_t smc_fid,
                status = intel_hps_set_bridges(x1, x2);
                SMC_RET1(handle, status);
 
+       case INTEL_SIP_SMC_FCS_PSGSIGMA_TEARDOWN:
+               status = intel_fcs_sigma_teardown(x1, &mbox_error);
+               SMC_RET2(handle, status, mbox_error);
+
+       case INTEL_SIP_SMC_FCS_CHIP_ID:
+               status = intel_fcs_chip_id(&retval, &retval2, &mbox_error);
+               SMC_RET4(handle, status, mbox_error, retval, retval2);
+
+       case INTEL_SIP_SMC_FCS_ATTESTATION_SUBKEY:
+               status = intel_fcs_attestation_subkey(x1, x2, x3,
+                                       (uint32_t *) &x4, &mbox_error);
+               SMC_RET4(handle, status, mbox_error, x3, x4);
+
+       case INTEL_SIP_SMC_FCS_ATTESTATION_MEASUREMENTS:
+               status = intel_fcs_get_measurement(x1, x2, x3,
+                                       (uint32_t *) &x4, &mbox_error);
+               SMC_RET4(handle, status, mbox_error, x3, x4);
+
        case INTEL_SIP_SMC_GET_ROM_PATCH_SHA384:
                status = intel_fcs_get_rom_patch_sha384(x1, &retval64,
                                                        &mbox_error);