Parse the external Root of Trust capability and use a fresh device-capability
snapshot for each flash attempt. When firmware reports eRoT presence,
require NVM, OROM, NetList and Manifest together. Reject single-component
requests, duplicates and incomplete images before erase, and reject an
empty applicable component list before activation.
An omitted capability is treated as absent, preserving legacy full-image
and fw.mgmt component updates in normal and recovery modes. Manifest is
accepted only when firmware explicitly reports eRoT presence. Older eRoT
hardware whose firmware omits the capability is not protected by these
early completeness checks. No fuse fallback or hardware-ID inference is
used.
Explicit values other than 0 or 1 and capability-discovery errors stop the
attempt before pending-update cancellation or the NVM write lock. Recovery
mode bypasses only the unified-update capability check. Cancellation
already calls capability discovery in the base driver, so that query must
work for recovery flashing even without this series. Its error handling
is unchanged.
The AQ activation-select mask defines NVM, OROM and NetList bits, but no
Manifest bit; the Manifest flag remains zero. This interface limitation
does not establish a physical layout or implicit activation with NVM.
Manifest activation timing and the firmware contract still need
confirmation. No firmware specification was supplied for that contract,
and this series has not been hardware validated. The component checks do
not authenticate images or make updates atomic.
Changes in this v2 respin:
- Treat omission as absent; retain a separate invalid-value bit.
- Define and initialize the scoped capability allocation together after
overwrite-mask validation, without changing lock scopes.
- Explain the missing Manifest selector with a one-line comment.
- Document the legacy omission limitation and recovery query dependency.
- Preserve the component and finalization guards, original author dates,
and two-patch split. No review tags are carried.
Validation: source-extracted executable parser and update tests, including
automatic-cleanup accounting; strict checkpatch, kernel-doc and whitespace
checks; actual W=1 ice.ko links for both commits with matching base config
and symbol versions. The tests mock firmware I/O and PLDM image parsing;
they do not establish the hardware or firmware behavior described above.
Aleksandr Loktionov (2):
ice: parse external Root of Trust capability
ice: reject partial NVM update on eRoT adapters
Documentation/networking/devlink/ice.rst | 21 +++++
.../net/ethernet/intel/ice/ice_adminq_cmd.h | 1 +
drivers/net/ethernet/intel/ice/ice_common.c | 6 ++
.../net/ethernet/intel/ice/ice_fw_update.c | 87 ++++++++++++++++++-
drivers/net/ethernet/intel/ice/ice_type.h | 3 +
include/linux/net/intel/libie/adminq.h | 1 +
6 files changed, 115 insertions(+), 4 deletions(-)
--
2.52.0
