From patchwork Mon Sep 3 14:46:51 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jens Wiklander X-Patchwork-Id: 145797 Delivered-To: patches@linaro.org Received: by 2002:a2e:1648:0:0:0:0:0 with SMTP id 8-v6csp2575341ljw; Mon, 3 Sep 2018 07:47:19 -0700 (PDT) X-Received: by 2002:a2e:752:: with SMTP id i18-v6mr17416049ljd.118.1535986039103; Mon, 03 Sep 2018 07:47:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1535986039; cv=none; d=google.com; s=arc-20160816; b=vJxiRYS02eGnSTqlp9wNo8TAmML7LePa3ZW6hRGMxk70oMyyg9zAAE0aiKxXA38YpX 6tW2oGvmWePhwoiWiH0WTkAx8S2uTCLkcvPCIDSqf0PSkR+0fpgZgUAjAujvkHzX2JTO OAUw9s+gA9A0fqPQCyT2rt3JVlZsSoeLEyQiagcBXKTxJQt2FZ/1ixAKOF88YNiDAjGW Xnp893pLiFHvmnGNUjAm7JQet1Tcz152ECOPLoBVrSGnhqFwkq9AP15edLxveKc4bi+a pAEXVdSRCXDFKKX/if2GOYWACxF2ievXCnrycQdrOVjtlT3X6z/GP1eepuOBqG9S2l78 GUGw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=zmT6ypNCxudNJJZ7QCpn5ELo2KSG1RmN39e6M7zrjLY=; b=fpjpQmpEEpkmgNPNEiU8PRjQZgUjHgTm4oyJ31bzkyomgtOyQ9auZ2Stg7c1K7PPpr QKKJgErY15s61rFzAV/r+H29R8QUGQCPHOCjPxrLVl6bZpp9Tdo7b/4AJ3r9ZstgdlAR f3LF3HVO+Z/weWuK/vVDwjk6g0iPYKo2xzSHsE6BNUNHvY8MLGR9HvpWEDdAMuE0LwFL CyynX1i2qfORVU3hIG9ZUp5QG0CwKEMhNnMUKNHXkQfiA6i1pQ+iCpDDs2l2XemuNqO1 x0IrM/dKqCbGIlB3B+sNpWC5GsEjtnj+JtQYF5qNwt0qEPxI7le0/rD0RujY6+VVAleU GY6g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Joqw+UMV; spf=pass (google.com: domain of jens.wiklander@linaro.org designates 209.85.220.65 as permitted sender) smtp.mailfrom=jens.wiklander@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id k87-v6sor5708973lfi.32.2018.09.03.07.47.19 for (Google Transport Security); Mon, 03 Sep 2018 07:47:19 -0700 (PDT) Received-SPF: pass (google.com: domain of jens.wiklander@linaro.org designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=Joqw+UMV; spf=pass (google.com: domain of jens.wiklander@linaro.org designates 209.85.220.65 as permitted sender) smtp.mailfrom=jens.wiklander@linaro.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=zmT6ypNCxudNJJZ7QCpn5ELo2KSG1RmN39e6M7zrjLY=; b=Joqw+UMVNNwrtXvOQH88W82B35Nco8ShBCEfGhLheKcMC7i8pJsJM4MUbdM+72JaYL qbFjhU227GUSQgdmR1aohs+jFkXTR6f/PaDTceMceOPccq0Y2/5kvdn58755eP52cRLq 4aXC8QbRJtpr3qf27DWbsrefK2EZLYkykMvQw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=zmT6ypNCxudNJJZ7QCpn5ELo2KSG1RmN39e6M7zrjLY=; b=E2rHCi+dAJt7ZPyP+j+99rsemDzf3D2maVFFUHZphygx3hevL5uoouxqqBMM9qzxUe rf75IY0Y5wl3MHC9oUz9Qj0X9moe3xzkhtgK21nz9N4KGZaBx1IQ3BnwC4SNlIRP8cCx bCJzNc4VZOw8lVRppqUcf/i4Hho5lZZuFb3C0tDHzpukI5R4i7ZBJiZBhHcEXUr9sRCw TurXsPAVeum1kOUqk5fmZaVpTZsacZ7UkY7FWHEVjSF3TLr6DYYba4iLTtVxLDfvY+P8 JoZrYCKb8dxGYumZOxfcKvvxi3JwPau8OETMfwxSlDtrhtEojMWy7ItIelNWOWMh6aH5 gTbA== X-Gm-Message-State: APzg51CbNzEyMbkx1I/rBOGWuyan/8qPtNVQifhpTcknCuSke4lQhhIe FnqMmOmZ5lAgSESKjm7WgelD4nDT X-Google-Smtp-Source: ANB0VdaPYMbPq/7+Hj35C2lLPnkBCJHB4TgTEHmhcmFRoj0H1g4A6Z/LVLLp781Rip0IFsMRa5kEsA== X-Received: by 2002:a19:8f8c:: with SMTP id s12-v6mr18372251lfk.83.1535986038773; Mon, 03 Sep 2018 07:47:18 -0700 (PDT) Return-Path: Received: from jax.ideon.se ([85.235.10.227]) by smtp.gmail.com with ESMTPSA id w18-v6sm3343431ljd.73.2018.09.03.07.47.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 03 Sep 2018 07:47:17 -0700 (PDT) From: Jens Wiklander To: u-boot@lists.denx.de Cc: Simon Glass , Igor Opaniuk , Tom Rini , Jaehoon Chung , Pierre Aubert , Albert Aribaud , Peter Griffin , Michal Simek , Jens Wiklander Subject: [PATCH v3 00/20] AVB using OP-TEE Date: Mon, 3 Sep 2018 16:46:51 +0200 Message-Id: <20180903144711.31585-1-jens.wiklander@linaro.org> X-Mailer: git-send-email 2.17.1 Hi, This adds support for storing AVB rollback indexes in the RPMB partition. The RPMB partition (content and key) is managed by OP-TEE (https://www.op-tee.org/) which is a secure OS leveraging ARM TrustZone. The Linux kernel can already support OP-TEE with reading and updating rollback indexes in the RPMB partition, the catch is that this is needed before the kernel has booted. The design here is the same as what is in the Linux kernel, with the exception that the user space daemon tee-supplicant is integrated in the OP-TEE driver here (drivers/tee/optee/supplicant.c) instead. A new uclass (UCLASS_TEE) is introduced to provide an abstraction for interfacing with a Trusted Execution Environment (TEE). There's also the OP-TEE driver using UCLASS_TEE for registration. A Trusted Application (TA) interface is added to be used by the AVB verify functions which are updated accordingly. The TA is managed by OP-TEE and is executed in a secure TrustZone protected environment. The header files drivers/tee/optee/optee_{msg,msg_supplicant,smc}.h and include/tee/optee_ta_avb.h are copied from https://github.com/OP-TEE/optee_os/tree/master more or less unmodified. They may need to be updated from time to time in order to support new features. In MMC there's a new function, mmc_rpmb_route_frames(), which as the name suggests is used to route RPMB frames to/from the MMC. This saves OP-TEE from implementing an MMC driver which would need to share resources with its counterpart here in U-Boot. This was tested on a Hikey (Kirin 620) board. I've added myself as maintainer of the TEE stuff. changes in v3: * Addressed review comments from Simon Glass * A few new patches - "avb_verify: bugfix avb_ops_free() skipping free" - "tee: add sandbox driver" - "test_avb: Update pymark.buildconfigspec information for the AVB tests" - "avb_verify: support sandbox configuration" - "Kconfig: sandbox: enable cmd_avb and dependencies" * "sandbox: imply CONFIG_TEE (TEE uclass)", replacing "configs: sandbox: enable CONFIG_TEE (TEE uclass)" * Moved sandbox driver to drivers/tee and added code to emulate the AVB TA * Enabled a few AVB tests (test/py/tests/test_avb.py) for sandbox * Bugfix tee_find_device() * Commits "dm: fdt: scan for devices under /firmware too", "cmd: avb read_rb: print rb_idx in hexadecimal", "cmd: avb: print error message if command fails", "Add UCLASS_TEE for Trusted Execution Environment", "tee: add OP-TEE driver", "Documentation: tee uclass and op-tee driver", "test: tee: test TEE uclass", "arm: dt: hikey: Add optee node" and "sandbox: dt: add sandbox_tee node" Reviewed-by: Simon Glass changes in v2: * Added sandbox driver and a test in test/dm for the new TEE uclass: Commit ("test: tee: test TEE uclass") and the enabling commits ("sandbox: dt: add sandbox_tee node") and ("configs: sandbox: enable CONFIG_TEE (TEE uclass)") * Added descriptions of exported structs and functions * Added documentation for the TEE uclass and the OP-TEE driver with the new commit ("Documentation: tee uclass and op-tee driver") * Added documentation for the changes in avb_verify * Addressed review comments from Simon Glass * Added the commit ("cmd: avb: print error message if command fails") * Made a few functions static in the OP-TEE driver * Commit ("cmd: avb read_rb: print rb_idx in hexadecimal") and ("tee: optee: support AVB trusted application"); Reviewed-by: Igor Opaniuk Thanks, Jens Jens Wiklander (20): dm: fdt: scan for devices under /firmware too cmd: avb read_rb: print rb_idx in hexadecimal cmd: avb: print error message if command fails avb_verify: bugfix avb_ops_free() skipping free mmc: rpmb: add mmc_rpmb_route_frames() Add UCLASS_TEE for Trusted Execution Environment dt/bindings: add bindings for optee tee: add OP-TEE driver Documentation: tee uclass and op-tee driver arm: dt: hikey: Add optee node optee: support routing of rpmb data frames to mmc tee: optee: support AVB trusted application sandbox: dt: add sandbox_tee node sandbox: imply CONFIG_TEE (TEE uclass) tee: add sandbox driver test: tee: test TEE uclass avb_verify: support using OP-TEE TA AVB test_avb: Update pymark.buildconfigspec information for the AVB tests avb_verify: support sandbox configuration Kconfig: sandbox: enable cmd_avb and dependencies MAINTAINERS | 7 + arch/Kconfig | 5 + arch/arm/dts/hi6220-hikey.dts | 7 + arch/sandbox/dts/sandbox.dts | 4 + arch/sandbox/dts/sandbox64.dts | 4 + arch/sandbox/dts/test.dts | 4 + cmd/avb.c | 19 +- common/avb_verify.c | 120 +++- doc/README.avb2 | 13 + doc/README.tee | 112 +++ .../firmware/linaro,optee-tz.txt | 31 + drivers/Kconfig | 2 + drivers/Makefile | 1 + drivers/core/root.c | 15 +- drivers/fastboot/Kconfig | 2 + drivers/mmc/rpmb.c | 160 +++++ drivers/tee/Kconfig | 29 + drivers/tee/Makefile | 5 + drivers/tee/optee/Kconfig | 27 + drivers/tee/optee/Makefile | 5 + drivers/tee/optee/core.c | 662 ++++++++++++++++++ drivers/tee/optee/optee_msg.h | 425 +++++++++++ drivers/tee/optee/optee_msg_supplicant.h | 240 +++++++ drivers/tee/optee/optee_private.h | 65 ++ drivers/tee/optee/optee_smc.h | 450 ++++++++++++ drivers/tee/optee/rpmb.c | 181 +++++ drivers/tee/optee/supplicant.c | 96 +++ drivers/tee/sandbox.c | 299 ++++++++ drivers/tee/tee-uclass.c | 233 ++++++ include/avb_verify.h | 13 + include/dm/uclass-id.h | 1 + include/mmc.h | 2 + include/sandboxtee.h | 15 + include/tee.h | 374 ++++++++++ include/tee/optee_ta_avb.h | 48 ++ test/dm/Makefile | 1 + test/dm/tee.c | 98 +++ test/py/tests/test_avb.py | 8 +- 38 files changed, 3772 insertions(+), 11 deletions(-) create mode 100644 doc/README.tee create mode 100644 doc/device-tree-bindings/firmware/linaro,optee-tz.txt create mode 100644 drivers/tee/Kconfig create mode 100644 drivers/tee/Makefile create mode 100644 drivers/tee/optee/Kconfig create mode 100644 drivers/tee/optee/Makefile create mode 100644 drivers/tee/optee/core.c create mode 100644 drivers/tee/optee/optee_msg.h create mode 100644 drivers/tee/optee/optee_msg_supplicant.h create mode 100644 drivers/tee/optee/optee_private.h create mode 100644 drivers/tee/optee/optee_smc.h create mode 100644 drivers/tee/optee/rpmb.c create mode 100644 drivers/tee/optee/supplicant.c create mode 100644 drivers/tee/sandbox.c create mode 100644 drivers/tee/tee-uclass.c create mode 100644 include/sandboxtee.h create mode 100644 include/tee.h create mode 100644 include/tee/optee_ta_avb.h create mode 100644 test/dm/tee.c -- 2.17.1