From patchwork Thu Aug 23 10:43:19 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jens Wiklander X-Patchwork-Id: 144906 Delivered-To: patches@linaro.org Received: by 2002:a2e:1648:0:0:0:0:0 with SMTP id 8-v6csp30492ljw; Thu, 23 Aug 2018 03:43:40 -0700 (PDT) X-Received: by 2002:a2e:8147:: with SMTP id t7-v6mr15639387ljg.32.1535021020701; Thu, 23 Aug 2018 03:43:40 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1535021020; cv=none; d=google.com; s=arc-20160816; b=opYYhM79fjZMtAWqPt6R5CUtCl8cCXxpgGrPdkfELcL5z0iqQvS1SqqH0BRk7Otdw0 zENazGln5twwF69R6PaGOyvJXIyc8r/C+OAARTXQRxNgLEd/+Y2i5yXvZmWpxpSTqbbc eSOGspI8fhh7uuiBdEmRcQg6RMfP2A6IAQJLBVWVmZt2pGhkfY1+VSnwISamduTuVtHt Vriuq5NP0gY6HTu09GkSMOWeA8xZohqCN/TF59tcZ0Ic9b40JMxDhUxJeXgg0LzZzG3a A8p0Lx4Pt3iV32b2/VZ2+1Qg/FDruVxLEo8vOrmiEocsohNszurulUqrNEY3R7GAjMwg tA6A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=C7oO/dIC3h9PWWHPX8JJeS1PvP3NksDR4ilr0cfbdDU=; b=Oy91wgLfSPdYbi7gKPW9fuoJT7m1C+ZkLTQ+LiR186qmKRL9ZoncRmBFH6RHRLrnqh RKFdFrbAiuRT9MX6NYjuRd9+gBy+bKehQL8nPyEV0yhPNHx+cuHD9qFwcbsvVSENrwz9 6Ey9IhsSF6HHCZcTnweukTaAvVj/8NFHCccvVLk5C/CegazQrwPOVGZCYm7iLO00Q0Po 1lUXPIF5juIlLIaBcZQsw0Kplo/S2nYHyUZN43fXhTPbipWfKlwlWp1G45FzkjQ+MJ1X YpV0eu8JM1I7z/Foe+VSR35ZCI3Sxcp2NX6k7TD62zZZmF7a1Mm4zOZ+15tlvwPPqKxE IV6w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fTg5hkl0; spf=pass (google.com: domain of jens.wiklander@linaro.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=jens.wiklander@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from mail-sor-f41.google.com (mail-sor-f41.google.com. [209.85.220.41]) by mx.google.com with SMTPS id p74-v6sor513990lfp.122.2018.08.23.03.43.40 for (Google Transport Security); Thu, 23 Aug 2018 03:43:40 -0700 (PDT) Received-SPF: pass (google.com: domain of jens.wiklander@linaro.org designates 209.85.220.41 as permitted sender) client-ip=209.85.220.41; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=fTg5hkl0; spf=pass (google.com: domain of jens.wiklander@linaro.org designates 209.85.220.41 as permitted sender) smtp.mailfrom=jens.wiklander@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=C7oO/dIC3h9PWWHPX8JJeS1PvP3NksDR4ilr0cfbdDU=; b=fTg5hkl0tGarT9aZKieEiTRC9cMoLpELU5Y+NsIpiyp8lbYpeugE8O7ZuJD5B2jbWH tUOkw4bCkSON6I4BTWZVg10NF2S3t1RRcaEe2JWeto4XjwUbo28+YUjCQUW5ajO8f044 SD2WylduQaA653klWE9epwJEH82YVPmv9bQ4I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=C7oO/dIC3h9PWWHPX8JJeS1PvP3NksDR4ilr0cfbdDU=; b=qB2Lu1vHfp0d9kTJ0AwYsE8gc0NSjuBasvQabGckPL1GhcSGHz/qSvV3SJPN5OqxrC GLAmiCM942PVY9DcaPaa5iVdK2gzHfvwvHZ+d7pcNKm9J5FNuZS8rVldha78QtRLHGfr 3uXt0gqtYLsnBk9dQiB/fSjG9Nf4rvbMCsWSQrcqDK2sDUYToeZMBURuYi2z3v+t9WCx 4UmC93Zu82yiqSQ9BQSsE9r86B7Mf/EANRcC0VMgnKbFrNVSGAX8T/RRA9+KHXvLwvVB xjET4aMPTY+Z+R+8BD8PrdMckszag8/4LtGlX+jKTOXNsYfpYzPMjRfZjZmAvAd4ewfg +W6A== X-Gm-Message-State: AOUpUlH2qmc9kIbfWxsTdFL4+L78wjD0ErRM9PAY0sqSj10+FdrDrTkU aCdfXq+itsMSHnyn/jwBnadzidVQ X-Google-Smtp-Source: AA+uWPzCjMZsUs3ZXDL38m3YwKfINw8nzsi6aqu61zjx+smICv6LLS5KGjKrhE6EEnF7lIfT6u1WgQ== X-Received: by 2002:a19:c38b:: with SMTP id t133-v6mr19957541lff.7.1535021020379; Thu, 23 Aug 2018 03:43:40 -0700 (PDT) Return-Path: Received: from jax.ideon.se ([85.235.10.227]) by smtp.gmail.com with ESMTPSA id y5-v6sm679771ljj.75.2018.08.23.03.43.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 23 Aug 2018 03:43:39 -0700 (PDT) From: Jens Wiklander To: u-boot@lists.denx.de Cc: Simon Glass , Igor Opaniuk , Tom Rini , Jaehoon Chung , Pierre Aubert , Albert Aribaud , Peter Griffin , Michal Simek , Jens Wiklander Subject: [PATCH v2 00/15] AVB using OP-TEE Date: Thu, 23 Aug 2018 12:43:19 +0200 Message-Id: <20180823104334.16083-1-jens.wiklander@linaro.org> X-Mailer: git-send-email 2.17.1 Hi, This adds support for storing AVB rollback indexes in the RPMB partition. The RPMB partition (content and key) is managed by OP-TEE (https://www.op-tee.org/) which is a secure OS leveraging ARM TrustZone. The Linux kernel can already support OP-TEE with reading and updating rollback indexes in the RPMB partition, the catch is that this is needed before the kernel has booted. The design here is the same as what is in the Linux kernel, with the exception that the user space daemon tee-supplicant is integrated in the OP-TEE driver here (drivers/tee/optee/supplicant.c) instead. A new uclass (UCLASS_TEE) is introduced to provide an abstraction for interfacing with a Trusted Execution Environment (TEE). There's also the OP-TEE driver using UCLASS_TEE for registration. A Trusted Application (TA) interface is added to be used by the AVB verify functions which are updated accordingly. The TA is managed by OP-TEE and is executed in a secure TrustZone protected environment. The header files drivers/tee/optee/optee_{msg,msg_supplicant,smc}.h and include/tee/optee_ta_avb.h are copied from https://github.com/OP-TEE/optee_os/tree/master more or less unmodified. They may need to be updated from time to time in order to support new features. In MMC there's a new function, mmc_rpmb_route_frames(), which as the name suggests is used to route RPMB frames to/from the MMC. This saves OP-TEE from implementing an MMC driver which would need to share resources with its counterpart here in U-boot. This was tested on a Hikey (Kirin 620) board. I've added myself as maintainer of the TEE stuff. v2: * Added sandbox driver and a test in test/dm for the new TEE uclass: Commit ("test: tee: test TEE uclass") and the enabling commits ("sandbox: dt: add sandbox_tee node") and ("configs: sandbox: enable CONFIG_TEE (TEE uclass)") * Added descriptions of exported structs and functions * Added documentation for the TEE uclass and the OP-TEE driver with the new commit ("Documentation: tee uclass and op-tee driver") * Added documentation for the changes in avb_verify * Addressed review comments from Simon Glass * Added the commit ("cmd: avb: print error message if command fails") * Made a few functions static in the OP-TEE driver * Commit ("cmd: avb read_rb: print rb_idx in hexadecimal") and ("tee: optee: support AVB trusted application"); Reviewed-by: Igor Opaniuk Thanks, Jens Jens Wiklander (15): dm: fdt: scan for devices under /firmware too cmd: avb read_rb: print rb_idx in hexadecimal cmd: avb: print error message if command fails mmc: rpmb: add mmc_rpmb_route_frames() Add UCLASS_TEE for Trusted Execution Environment dt/bindings: add bindings for optee tee: add OP-TEE driver Documentation: tee uclass and op-tee driver test: tee: test TEE uclass sandbox: dt: add sandbox_tee node configs: sandbox: enable CONFIG_TEE (TEE uclass) arm: dt: hikey: Add optee node optee: support routing of rpmb data frames to mmc tee: optee: support AVB trusted application avb_verify: support using OP-TEE TA AVB MAINTAINERS | 7 + arch/arm/dts/hi6220-hikey.dts | 7 + arch/sandbox/dts/sandbox.dts | 4 + arch/sandbox/dts/sandbox64.dts | 4 + arch/sandbox/dts/test.dts | 4 + cmd/avb.c | 19 +- common/avb_verify.c | 132 +++- configs/sandbox64_defconfig | 1 + configs/sandbox_defconfig | 1 + configs/sandbox_flattree_defconfig | 1 + configs/sandbox_noblk_defconfig | 1 + configs/sandbox_spl_defconfig | 1 + doc/README.avb2 | 13 + doc/README.tee | 112 ++++ .../firmware/linaro,optee-tz.txt | 31 + drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/core/root.c | 15 +- drivers/mmc/rpmb.c | 160 +++++ drivers/tee/Kconfig | 17 + drivers/tee/Makefile | 4 + drivers/tee/optee/Kconfig | 23 + drivers/tee/optee/Makefile | 5 + drivers/tee/optee/core.c | 622 ++++++++++++++++++ drivers/tee/optee/optee_msg.h | 423 ++++++++++++ drivers/tee/optee/optee_msg_supplicant.h | 234 +++++++ drivers/tee/optee/optee_private.h | 41 ++ drivers/tee/optee/optee_smc.h | 444 +++++++++++++ drivers/tee/optee/rpmb.c | 184 ++++++ drivers/tee/optee/supplicant.c | 92 +++ drivers/tee/tee-uclass.c | 192 ++++++ include/avb_verify.h | 4 + include/dm/uclass-id.h | 1 + include/mmc.h | 2 + include/tee.h | 297 +++++++++ include/tee/optee_ta_avb.h | 48 ++ test/dm/Makefile | 1 + test/dm/tee.c | 182 +++++ 38 files changed, 3325 insertions(+), 7 deletions(-) create mode 100644 doc/README.tee create mode 100644 doc/device-tree-bindings/firmware/linaro,optee-tz.txt create mode 100644 drivers/tee/Kconfig create mode 100644 drivers/tee/Makefile create mode 100644 drivers/tee/optee/Kconfig create mode 100644 drivers/tee/optee/Makefile create mode 100644 drivers/tee/optee/core.c create mode 100644 drivers/tee/optee/optee_msg.h create mode 100644 drivers/tee/optee/optee_msg_supplicant.h create mode 100644 drivers/tee/optee/optee_private.h create mode 100644 drivers/tee/optee/optee_smc.h create mode 100644 drivers/tee/optee/rpmb.c create mode 100644 drivers/tee/optee/supplicant.c create mode 100644 drivers/tee/tee-uclass.c create mode 100644 include/tee.h create mode 100644 include/tee/optee_ta_avb.h create mode 100644 test/dm/tee.c -- 2.17.1