+ tee-dev ML
On Tue, 12 Feb 2019 at 17:36, Alexander Graf <agraf(a)suse.de> wrote:
>
> On 02/12/2019 12:34 PM, Heinrich Schuchardt wrote:
> > On 2/12/19 10:49 AM, Alexander Graf wrote:
> >> On 02/03/2019 07:32 PM, Heinrich Schuchardt wrote:
> >>> Hello Alex, hello Takahiro,
> >>>
> >>> this morning I met Daniel Thompson of Linaro. He thinks it would be
> >>> quite valuable if U-Boot would at least offer read access to EFI
> >>> variables at runtime.
> >>>
> >>> I think what it takes is only a RAM buffer that we put between our
> >>> current storage backend (i.e. synchronization with U-Boot variables)
> >>> and the API implementation.
> >>>
> >>> We will need such a buffer anyway for non-permanent variables once we
> >>> have a SPI flash storage.
> >> I think slowly we need to take a critical design decision: Do we want to
> >> be in the business of managing runtime UEFI variables?
> >>
> >> I don't have a fully cohesive answer to that yet. My gut feeling tells
> >> me, that runtime variables would be much better off if they lived in
> >> TrustZone. That way we don't have to play relocation tricks, and devices
> >> that give you persistency are owned by the secure world anyway, so there
> >> is no weird intersection between OS and RTS.
> >>
> >> So maybe the path forward would be to implement variable services in ATF
> >> (or OP-TEE rather I suppose) and just provide shim stubs to communicate
> >> with them from runtime services? That would keep all the variable logic
> >> platform agnostic, and we would not have to jump through weird hoops
> >> with DM.
> > U-Boot' major asset are the many boards supported by drivers. Does ATF
> > or OP-TEE have drivers for SPI?
> >
> > Or is your idea that U-Boot would provide a module that is set up as a
> > trusted driver or trusted app, cf.
> > https://developer.arm.com/-/media/developer/Block%20Diagrams/Architecture-o…
>
> I think it's perfectly possible to build a special OP-TEE U-Boot target
> that can then reuse its drivers, similar to Simon's idea. But we should
> probably not try to target RTS with that, but only secure enclaves.
>
One of OP-TEE design goals [1] being:
Small footprint - the TEE should remain small enough to reside in a
reasonable amount of on-chip memory as found on Arm based systems.
I think this was one of main reason to have tee-supplicant
infrastructure in normal world to reuse drivers and keep small
footprint of OP-TEE.
So if we build a special OP-TEE u-boot target and link it with
optee-os as part of secure enclave then I am not sure how it will
align with above design goal.
[1] https://optee.readthedocs.io/general/about.html
-Sumit
>
> Alex
>
> _______________________________________________
> U-Boot mailing list
> U-Boot(a)lists.denx.de
> https://lists.denx.de/listinfo/u-boot
This series introduces a generic TEE bus driver concept for TEE based
kernel drivers which would like to communicate with TEE based devices/
services.
Patch #1 adds TEE bus concept where devices/services are identified via
Universally Unique Identifier (UUID) and drivers register a table of
device UUIDs which they can support. This concept also allows for device
enumeration to be specific to corresponding TEE implementation like
OP-TEE etc.
Patch #2 adds supp_nowait flag for non-blocking requests arising via
TEE internal client interface.
Patch #3 adds TEE bus device enumeration support for OP-TEE. OP-TEE
provides a pseudo TA to enumerate TAs which can act as devices/services
for TEE bus.
Patch #4 adds OP-TEE based hwrng driver which act as TEE bus driver.
On ARM SoC's with TrustZone enabled, peripherals like entropy sources
might not be accessible to normal world (linux in this case) and rather
accessible to secure world (OP-TEE in this case) only. So this driver
aims to provides a generic interface to OP-TEE based random number
generator service.
Example case is Developerbox based on Socionext's Synquacer SoC [1]
which provides 7 thermal sensors accessible from secure world only which
could be used as entropy sources (thermal/measurement noise).
[1] https://www.96boards.org/product/developerbox/
Changes in v6:
1. Incorporate some nitpicks in patch #1 and #3.
2. Bundle all statics in a data structure in patch #4 and use dev_*
instead of pr_*.
3. Add reviewed-by tags for patch #1, #2 and #3.
Changes in v5:
1. Add support in module device table for TEE bus devices.
2. Correct license for optee-rng module.
Changes in v4:
1. Use typedef instead of single member tee_client_device_id struct.
2. Incorporate TEE bus nitpicks.
Changes in v3:
1. Fixed bus error path in Patch #1.
2. Reversed order of Patch #2 and #3.
3. Fixed miscellaneous syntax comments and memory leak.
4. Added comments in Patch #2 for supp_nowait flag.
Changes in v2:
Based on review comments, the scope of this series has increased as
follows:
1. Added TEE bus driver framework.
2. Added OP-TEE based device enumeration.
3. Register optee-rng driver as TEE bus driver.
4. Removed DT dependency for optee-rng device UUID.
5. Added supp_nowait flag.
Sumit Garg (4):
tee: add bus driver framework for TEE based devices
tee: add supp_nowait flag in tee_context struct
tee: optee: add TEE bus device enumeration support
hwrng: add OP-TEE based rng driver
MAINTAINERS | 5 +
drivers/char/hw_random/Kconfig | 15 ++
drivers/char/hw_random/Makefile | 1 +
drivers/char/hw_random/optee-rng.c | 298 +++++++++++++++++++++++++++++++++++++
drivers/tee/optee/Makefile | 1 +
drivers/tee/optee/core.c | 4 +
drivers/tee/optee/device.c | 155 +++++++++++++++++++
drivers/tee/optee/optee_private.h | 3 +
drivers/tee/optee/supp.c | 10 +-
drivers/tee/tee_core.c | 67 ++++++++-
include/linux/mod_devicetable.h | 9 ++
include/linux/tee_drv.h | 38 ++++-
scripts/mod/devicetable-offsets.c | 3 +
scripts/mod/file2alias.c | 19 +++
14 files changed, 622 insertions(+), 6 deletions(-)
create mode 100644 drivers/char/hw_random/optee-rng.c
create mode 100644 drivers/tee/optee/device.c
--
2.7.4
This series introduces a generic TEE bus driver concept for TEE based
kernel drivers which would like to communicate with TEE based devices/
services.
Patch #1 adds TEE bus concept where devices/services are identified via
Universally Unique Identifier (UUID) and drivers register a table of
device UUIDs which they can support. This concept also allows for device
enumeration to be specific to corresponding TEE implementation like
OP-TEE etc.
Patch #2 adds supp_nowait flag for non-blocking requests arising via
TEE internal client interface.
Patch #3 adds TEE bus device enumeration support for OP-TEE. OP-TEE
provides a pseudo TA to enumerate TAs which can act as devices/services
for TEE bus.
Patch #4 adds OP-TEE based hwrng driver which act as TEE bus driver.
On ARM SoC's with TrustZone enabled, peripherals like entropy sources
might not be accessible to normal world (linux in this case) and rather
accessible to secure world (OP-TEE in this case) only. So this driver
aims to provides a generic interface to OP-TEE based random number
generator service.
Example case is Developerbox based on Socionext's Synquacer SoC [1]
which provides 7 thermal sensors accessible from secure world only which
could be used as entropy sources (thermal/measurement noise).
[1] https://www.96boards.org/product/developerbox/
Changes in v5:
1. Add support in module device table for TEE bus devices.
2. Correct license for optee-rng module.
Changes in v4:
1. Use typedef instead of single member tee_client_device_id struct.
2. Incorporate TEE bus nitpicks.
Changes in v3:
1. Fixed bus error path in Patch #1.
2. Reversed order of Patch #2 and #3.
3. Fixed miscellaneous syntax comments and memory leak.
4. Added comments in Patch #2 for supp_nowait flag.
Changes in v2:
Based on review comments, the scope of this series has increased as
follows:
1. Added TEE bus driver framework.
2. Added OP-TEE based device enumeration.
3. Register optee-rng driver as TEE bus driver.
4. Removed DT dependency for optee-rng device UUID.
5. Added supp_nowait flag.
Sumit Garg (4):
tee: add bus driver framework for TEE based devices
tee: add supp_nowait flag in tee_context struct
tee: optee: add TEE bus device enumeration support
hwrng: add OP-TEE based rng driver
MAINTAINERS | 5 +
drivers/char/hw_random/Kconfig | 15 ++
drivers/char/hw_random/Makefile | 1 +
drivers/char/hw_random/optee-rng.c | 274 +++++++++++++++++++++++++++++++++++++
drivers/tee/optee/Makefile | 1 +
drivers/tee/optee/core.c | 4 +
drivers/tee/optee/device.c | 153 +++++++++++++++++++++
drivers/tee/optee/optee_private.h | 3 +
drivers/tee/optee/supp.c | 10 +-
drivers/tee/tee_core.c | 70 +++++++++-
include/linux/mod_devicetable.h | 9 ++
include/linux/tee_drv.h | 38 ++++-
scripts/mod/devicetable-offsets.c | 3 +
scripts/mod/file2alias.c | 19 +++
14 files changed, 599 insertions(+), 6 deletions(-)
create mode 100644 drivers/char/hw_random/optee-rng.c
create mode 100644 drivers/tee/optee/device.c
--
2.7.4
This series introduces a generic TEE bus driver concept for TEE based
kernel drivers which would like to communicate with TEE based devices/
services.
Patch #1 adds TEE bus concept where devices/services are identified via
Universally Unique Identifier (UUID) and drivers register a table of
device UUIDs which they can support. This concept also allows for device
enumeration to be specific to corresponding TEE implementation like
OP-TEE etc.
Patch #2 adds supp_nowait flag for non-blocking requests arising via
TEE internal client interface.
Patch #3 adds TEE bus device enumeration support for OP-TEE. OP-TEE
provides a pseudo TA to enumerate TAs which can act as devices/services
for TEE bus.
Patch #4 adds OP-TEE based hwrng driver which act as TEE bus driver.
On ARM SoC's with TrustZone enabled, peripherals like entropy sources
might not be accessible to normal world (linux in this case) and rather
accessible to secure world (OP-TEE in this case) only. So this driver
aims to provides a generic interface to OP-TEE based random number
generator service.
Example case is Developerbox based on Socionext's Synquacer SoC [1]
which provides 7 thermal sensors accessible from secure world only which
could be used as entropy sources (thermal/measurement noise).
[1] https://www.96boards.org/product/developerbox/
Changes in v4:
1. Use typedef instead of single member tee_client_device_id struct.
2. Incorporate TEE bus nitpicks.
Changes in v3:
1. Fixed bus error path in Patch #1.
2. Reversed order of Patch #2 and #3.
3. Fixed miscellaneous syntax comments and memory leak.
4. Added comments in Patch #2 for supp_nowait flag.
Changes in v2:
Based on review comments, the scope of this series has increased as
follows:
1. Added TEE bus driver framework.
2. Added OP-TEE based device enumeration.
3. Register optee-rng driver as TEE bus driver.
4. Removed DT dependency for optee-rng device UUID.
5. Added supp_nowait flag.
Sumit Garg (4):
tee: add bus driver framework for TEE based devices
tee: add supp_nowait flag in tee_context struct
tee: optee: add TEE bus device enumeration support
hwrng: add OP-TEE based rng driver
MAINTAINERS | 5 +
drivers/char/hw_random/Kconfig | 15 ++
drivers/char/hw_random/Makefile | 1 +
drivers/char/hw_random/optee-rng.c | 272 +++++++++++++++++++++++++++++++++++++
drivers/tee/optee/Makefile | 1 +
drivers/tee/optee/core.c | 4 +
drivers/tee/optee/device.c | 153 +++++++++++++++++++++
drivers/tee/optee/optee_private.h | 3 +
drivers/tee/optee/supp.c | 10 +-
drivers/tee/tee_core.c | 58 +++++++-
include/linux/tee_drv.h | 43 +++++-
11 files changed, 559 insertions(+), 6 deletions(-)
create mode 100644 drivers/char/hw_random/optee-rng.c
create mode 100644 drivers/tee/optee/device.c
--
2.7.4
[Sent to all e-mail addresses found in optee_os/MAINTAINERS]
Dear OP-TEE users and contributors,
FYI, the next OP-TEE release (3.4.0) is scheduled for January 25th. As
usual, I will create the -rc1 tag one week before. In the meantime, please
update your pending pull requests, help review patches on GitHub, run some
tests on master etc.
I will let you know when the -rc1 tag is ready for testing, at which point
I will collect Tested-bys in a pull request and merge only bug fixes into
master.
Thanks for your continued help and support!
Regards,
--
Jerome
This series introduces a generic TEE bus driver concept for TEE based
kernel drivers which would like to communicate with TEE based devices/
services.
Patch #1 adds TEE bus concept where devices/services are identified via
Universally Unique Identifier (UUID) and drivers register a table of
device UUIDs which they can support. This concept also allows for device
enumeration to be specific to corresponding TEE implementation like
OP-TEE etc.
Patch #2 adds supp_nowait flag for non-blocking requests arising via
TEE internal client interface.
Patch #3 adds TEE bus device enumeration support for OP-TEE. OP-TEE
provides a pseudo TA to enumerate TAs which can act as devices/services
for TEE bus.
Patch #4 adds OP-TEE based hwrng driver which act as TEE bus driver.
On ARM SoC's with TrustZone enabled, peripherals like entropy sources
might not be accessible to normal world (linux in this case) and rather
accessible to secure world (OP-TEE in this case) only. So this driver
aims to provides a generic interface to OP-TEE based random number
generator service.
Example case is Developerbox based on Socionext's Synquacer SoC [1]
which provides 7 thermal sensors accessible from secure world only which
could be used as entropy sources (thermal/measurement noise).
[1] https://www.96boards.org/product/developerbox/
Changes in v3:
1. Fixed bus error path in Patch #1.
2. Reversed order of Patch #2 and #3.
3. Fixed miscellaneous syntax comments and memory leak.
4. Added comments in Patch #2 for supp_nowait flag.
Changes in v2:
Based on review comments, the scope of this series has increased as
follows:
1. Added TEE bus driver framework.
2. Added OP-TEE based device enumeration.
3. Register optee-rng driver as TEE bus driver.
4. Removed DT dependency for optee-rng device UUID.
5. Added supp_nowait flag.
Sumit Garg (4):
tee: add bus driver framework for TEE based devices
tee: add supp_nowait flag in tee_context struct
tee: optee: add TEE bus device enumeration support
hwrng: add OP-TEE based rng driver
MAINTAINERS | 5 +
drivers/char/hw_random/Kconfig | 15 ++
drivers/char/hw_random/Makefile | 1 +
drivers/char/hw_random/optee-rng.c | 272 +++++++++++++++++++++++++++++++++++++
drivers/tee/optee/Makefile | 1 +
drivers/tee/optee/core.c | 4 +
drivers/tee/optee/device.c | 153 +++++++++++++++++++++
drivers/tee/optee/optee_private.h | 3 +
drivers/tee/optee/supp.c | 10 +-
drivers/tee/tee_core.c | 56 +++++++-
include/linux/tee_drv.h | 42 ++++++
11 files changed, 558 insertions(+), 4 deletions(-)
create mode 100644 drivers/char/hw_random/optee-rng.c
create mode 100644 drivers/tee/optee/device.c
--
2.7.4