Tee-dev

tee-dev@lists.linaro.org

1 participants
293 discussions

[PATCH 0/2] tee: optee: compatibility of natively running OS with virt-enabled OP-TEE

by Michalis Pappas

There are cases in a virtualized environment where a privileged guest needs to communicate with OP-TEE OS without the presence of a hypervisor (eg system recovery). As OP-TEE OS with virtualization support requires all guests to be announced and requests to be tagged with vm id, the above task would require reflashing OP-TEE OS with a build that disables virtualization support. The following patches introduce compatibilty between a natively running OS (ie without a hypervisor) and OP-TEE OS configured with virtualization support. This is achieved by the driver announcing itself to OP-TEE, and tagging subsequent requests with a predetermined vm id. For this change to be interoperable with virtualized environments, a hypervisor has the following options: 1. Filter out the OPTEE_SMC_SEC_CAP_VIRTUALIZATION capability, so that the driver is not aware of executing in a virtualized setup. In that case, the driver will not announce itself or update the vm id parameter. 2. Gracefully handle the announcement of addition / removal of guests from the driver (OPTEE_SMC_VM_CREATED / OPTEE_SMC_VM_DESTROYED), and overwrite the vm id parameter as normal. Enabling this option does not have an impact on OP-TEE OS configured without virtualization support. Please notice that this patch depends on 9733b072a12a from mainline Linux, which is not available in Linaro's tree. Michalis Pappas (2): tee: optee: Add protocol definitions for virtualization tee: optee: Allow native systems to interact with virtualization-enabled OP-TEE drivers/tee/optee/Kconfig | 23 +++++++++++++++ drivers/tee/optee/core.c | 43 ++++++++++++++++++++++++++++ drivers/tee/optee/optee_smc.h | 54 +++++++++++++++++++++++++++++++++++ 3 files changed, 120 insertions(+) -- 2.17.1 Please mind our privacy notice<https://www.opensynergy.com/datenschutzerklaerung/privacy-notice-for-busine…> pursuant to Art. 13 GDPR. // Unsere Hinweise zum Datenschutz gem. Art. 13 DSGVO finden Sie hier.<https://www.opensynergy.com/de/datenschutzerklaerung/datenschutzhinweise-fu…>

6 years, 2 months

[PATCH 12/15] drm/tee_shm: Drop dma_buf_k(unmap) support

by Daniel Vetter

There's no in-tree users anymore. Signed-off-by: Daniel Vetter <daniel.vetter(a)intel.com> Cc: Arnd Bergmann <arnd(a)arndb.de> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Jens Wiklander <jens.wiklander(a)linaro.org> Cc: tee-dev(a)lists.linaro.org -- Ack for merging this through drm trees very much appreciated. -Daniel --- drivers/misc/fastrpc.c | 8 -------- drivers/tee/tee_shm.c | 6 ------ 2 files changed, 14 deletions(-) diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c index 1b1a794d639d..d0cbef9ec28a 100644 --- a/drivers/misc/fastrpc.c +++ b/drivers/misc/fastrpc.c @@ -555,13 +555,6 @@ static void fastrpc_dma_buf_detatch(struct dma_buf *dmabuf, kfree(a); } -static void *fastrpc_kmap(struct dma_buf *dmabuf, unsigned long pgnum) -{ - struct fastrpc_buf *buf = dmabuf->priv; - - return buf->virt ? buf->virt + pgnum * PAGE_SIZE : NULL; -} - static void *fastrpc_vmap(struct dma_buf *dmabuf) { struct fastrpc_buf *buf = dmabuf->priv; @@ -585,7 +578,6 @@ static const struct dma_buf_ops fastrpc_dma_buf_ops = { .map_dma_buf = fastrpc_map_dma_buf, .unmap_dma_buf = fastrpc_unmap_dma_buf, .mmap = fastrpc_mmap, - .map = fastrpc_kmap, .vmap = fastrpc_vmap, .release = fastrpc_release, }; diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 09ddcd06c715..937ac5aaa6d8 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -71,11 +71,6 @@ static void tee_shm_op_release(struct dma_buf *dmabuf) tee_shm_release(shm); } -static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum) -{ - return NULL; -} - static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma) { struct tee_shm *shm = dmabuf->priv; @@ -93,7 +88,6 @@ static const struct dma_buf_ops tee_shm_dma_buf_ops = { .map_dma_buf = tee_shm_op_map_dma_buf, .unmap_dma_buf = tee_shm_op_unmap_dma_buf, .release = tee_shm_op_release, - .map = tee_shm_op_map, .mmap = tee_shm_op_mmap, }; -- 2.24.0

6 years, 2 months

[Patch v2] tee: optee: Fix dynamic shm pool allocations

by Sumit Garg

In case of dynamic shared memory pool, kernel memory allocated using dmabuf_mgr pool needs to be registered with OP-TEE prior to its usage during optee_open_session() or optee_invoke_func(). So fix dmabuf_mgr pool allocations via an additional call to optee_shm_register(). Also, allow kernel pages to be registered as shared memory with OP-TEE. Fixes: 9733b072a12a ("optee: allow to work without static shared memory") Signed-off-by: Sumit Garg <sumit.garg(a)linaro.org> --- Changes in v2: Merge the dependency patch: https://lkml.org/lkml/2019/10/31/431 drivers/tee/optee/call.c | 7 +++++++ drivers/tee/optee/shm_pool.c | 12 +++++++++++- 2 files changed, 18 insertions(+), 1 deletion(-) diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c index 13b0269..cf2367b 100644 --- a/drivers/tee/optee/call.c +++ b/drivers/tee/optee/call.c @@ -554,6 +554,13 @@ static int check_mem_type(unsigned long start, size_t num_pages) struct mm_struct *mm = current->mm; int rc; + /* + * Allow kernel address to register with OP-TEE as kernel + * pages are configured as normal memory only. + */ + if (virt_addr_valid(start)) + return 0; + down_read(&mm->mmap_sem); rc = __check_mem_type(find_vma(mm, start), start + num_pages * PAGE_SIZE); diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c index de1d9b8..0332a53 100644 --- a/drivers/tee/optee/shm_pool.c +++ b/drivers/tee/optee/shm_pool.c @@ -17,6 +17,7 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, { unsigned int order = get_order(size); struct page *page; + int rc = 0; page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); if (!page) @@ -26,12 +27,21 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, shm->paddr = page_to_phys(page); shm->size = PAGE_SIZE << order; - return 0; + if (shm->flags & TEE_SHM_DMA_BUF) { + shm->flags |= TEE_SHM_REGISTER; + rc = optee_shm_register(shm->ctx, shm, &page, 1 << order, + (unsigned long)shm->kaddr); + } + + return rc; } static void pool_op_free(struct tee_shm_pool_mgr *poolm, struct tee_shm *shm) { + if (shm->flags & TEE_SHM_DMA_BUF) + optee_shm_unregister(shm->ctx, shm); + free_pages((unsigned long)shm->kaddr, get_order(shm->size)); shm->kaddr = NULL; } -- 2.7.4

6 years, 2 months

Query regarding running TCP server in REE

by Nagesh shamnur

Hi Group, I am running optee v3.5.0 on QEMU v7 with custom CA/TA. I am running a TCP server on my CA in REE. I want to know how to connect to my TCP server from my host machine. I tried the loopback (127.0.0.1) for the connection as REE debugging also uses the same loopback address. Do I need to create a TAP interface using which I can connect ? Regards, Nagesh S

6 years, 2 months

optee Normal world debugging using GDB

by Nagesh shamnur

Dear Group, I am testing the TEE on QEMU v7 with my own proprietary TEE client and TA application. So, debug the normal world application, I followed the steps as explained in the section "GDB - Normal world" as explained in the link below. But I am facing the error in the normal world window when I try to attach the GDB to the normal world application as below. Window from where I am trying to attach GDB: (gdb) target remote :12345 Remote debugging using :12345 No executable file now. warning: Could not load vsyscall page because no executable was specified 0x76fd5b40 in ?? () (gdb) b main No symbol table is loaded. Use the "file" command. Make breakpoint pending on future shared library load? (y or [n]) n Normal World Application window: # gdbserver :12345 tls_server Process tls_server created; pid = 738 Listening on port 12345 Remote debugging from host 10.0.2.2 Can someone enlighten me on how to fix this issue? Regards, Nagesh S

6 years, 2 months

[PATCH AUTOSEL 4.14 002/103] tee: optee: take DT status property into account

by Sasha Levin

From: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> [ Upstream commit db878f76b9ff7487da9bb0f686153f81829f1230 ] DT nodes may have a 'status' property which, if set to anything other than 'ok' or 'okay', indicates to the OS that the DT node should be treated as if it was not present. So add that missing logic to the OP-TEE driver. Signed-off-by: Ard Biesheuvel <ard.biesheuvel(a)linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/tee/optee/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c index edb6e4e9ef3ac..ca79c2ba2ef2a 100644 --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -590,7 +590,7 @@ static int __init optee_driver_init(void) return -ENODEV; np = of_find_matching_node(fw_np, optee_match); - if (!np) + if (!np || !of_device_is_available(np)) return -ENODEV; optee = optee_probe(np); -- 2.20.1

6 years, 2 months

[PATCH] tee: optee: Fix dynamic shm pool allocations

by Sumit Garg

In case of dynamic shared memory pool, kernel memory allocated using dmabuf_mgr pool needs to be registered with OP-TEE prior to its usage during optee_open_session() or optee_invoke_func(). So fix dmabuf_mgr pool allocations via an additional call to optee_shm_register(). Fixes: 9733b072a12a ("optee: allow to work without static shared memory") Signed-off-by: Sumit Garg <sumit.garg(a)linaro.org> --- Depends on patch: https://lkml.org/lkml/2019/7/30/506 that adds support to allow registration of kernel buffers with OP-TEE. drivers/tee/optee/shm_pool.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c index de1d9b8..0332a53 100644 --- a/drivers/tee/optee/shm_pool.c +++ b/drivers/tee/optee/shm_pool.c @@ -17,6 +17,7 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, { unsigned int order = get_order(size); struct page *page; + int rc = 0; page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order); if (!page) @@ -26,12 +27,21 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm, shm->paddr = page_to_phys(page); shm->size = PAGE_SIZE << order; - return 0; + if (shm->flags & TEE_SHM_DMA_BUF) { + shm->flags |= TEE_SHM_REGISTER; + rc = optee_shm_register(shm->ctx, shm, &page, 1 << order, + (unsigned long)shm->kaddr); + } + + return rc; } static void pool_op_free(struct tee_shm_pool_mgr *poolm, struct tee_shm *shm) { + if (shm->flags & TEE_SHM_DMA_BUF) + optee_shm_unregister(shm->ctx, shm); + free_pages((unsigned long)shm->kaddr, get_order(shm->size)); shm->kaddr = NULL; } -- 2.7.4

6 years, 2 months

[PATCH] tee: optee: fix device enumeration error handling

by Jens Wiklander

Prior to this patch in optee_probe() when optee_enumerate_devices() was called the struct optee was fully initialized. If optee_enumerate_devices() returns an error optee_probe() is supposed to clean up and free the struct optee completely, but will at this late stage need to call optee_remove() instead. This isn't done and thus freeing the struct optee prematurely. With this patch the call to optee_enumerate_devices() is done after optee_probe() has returned successfully and in case optee_enumerate_devices() fails everything is cleaned up with a call to optee_remove(). Fixes: c3fa24af9244 ("tee: optee: add TEE bus device enumeration support") Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org> --- drivers/tee/optee/core.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c index 1854a3db7345..b830e0a87fba 100644 --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -643,11 +643,6 @@ static struct optee *optee_probe(struct device_node *np) if (optee->sec_caps & OPTEE_SMC_SEC_CAP_DYNAMIC_SHM) pr_info("dynamic shared memory is enabled\n"); - rc = optee_enumerate_devices(); - if (rc) - goto err; - - pr_info("initialized driver\n"); return optee; err: if (optee) { @@ -702,9 +697,10 @@ static struct optee *optee_svc; static int __init optee_driver_init(void) { - struct device_node *fw_np; - struct device_node *np; - struct optee *optee; + struct device_node *fw_np = NULL; + struct device_node *np = NULL; + struct optee *optee = NULL; + int rc = 0; /* Node is supposed to be below /firmware */ fw_np = of_find_node_by_name(NULL, "firmware"); @@ -723,6 +719,14 @@ static int __init optee_driver_init(void) if (IS_ERR(optee)) return PTR_ERR(optee); + rc = optee_enumerate_devices(); + if (rc) { + optee_remove(optee); + return rc; + } + + pr_info("initialized driver\n"); + optee_svc = optee; return 0; -- 2.17.1

6 years, 2 months

[Patch v3 0/7] Introduce TEE based Trusted Keys support

by Sumit Garg

Add support for TEE based trusted keys where TEE provides the functionality to seal and unseal trusted keys using hardware unique key. Also, this is an alternative in case platform doesn't possess a TPM device. This series also adds some TEE features like: Patch #1, #2 enables support for registered kernel shared memory with TEE. Patch #3 enables support for private kernel login method required for cases like trusted keys where we don't wan't user-space to directly access TEE service to retrieve trusted key contents. Rest of the patches from #4 to #7 adds support for TEE based trusted keys. This patch-set has been tested with OP-TEE based pseudo TA which can be found here [1]. [1] https://github.com/OP-TEE/optee_os/pull/3082 Changes in v3: 1. Update patch #2 to support registration of multiple kernel pages. 2. Incoporate dependency patch #4 in this patch-set: https://patchwork.kernel.org/patch/11091435/ 3. Rebased to latest tpmdd-master. Changes in v2: 1. Add reviewed-by tags for patch #1 and #2. 2. Incorporate comments from Jens for patch #3. 3. Switch to use generic trusted keys framework. Sumit Garg (7): tee: optee: allow kernel pages to register as shm tee: enable support to register kernel memory tee: add private login method for kernel clients KEYS: trusted: Add generic trusted keys framework KEYS: trusted: Introduce TEE based Trusted Keys doc: keys: Document usage of TEE based Trusted Keys MAINTAINERS: Add entry for TEE based Trusted Keys Documentation/security/keys/index.rst | 1 + Documentation/security/keys/tee-trusted.rst | 93 ++++++++ MAINTAINERS | 9 + drivers/tee/optee/call.c | 7 + drivers/tee/tee_core.c | 6 + drivers/tee/tee_shm.c | 26 ++- include/keys/trusted-type.h | 48 ++++ include/keys/trusted_tee.h | 66 ++++++ include/keys/trusted_tpm.h | 15 -- include/linux/tee_drv.h | 1 + include/uapi/linux/tee.h | 8 + security/keys/Kconfig | 3 + security/keys/trusted-keys/Makefile | 2 + security/keys/trusted-keys/trusted_common.c | 346 ++++++++++++++++++++++++++++ security/keys/trusted-keys/trusted_tee.c | 282 +++++++++++++++++++++++ security/keys/trusted-keys/trusted_tpm1.c | 345 +++++---------------------- 16 files changed, 954 insertions(+), 304 deletions(-) create mode 100644 Documentation/security/keys/tee-trusted.rst create mode 100644 include/keys/trusted_tee.h create mode 100644 security/keys/trusted-keys/trusted_common.c create mode 100644 security/keys/trusted-keys/trusted_tee.c -- 2.7.4

6 years, 3 months

[PATCH net-next V5 0/3] Add OP-TEE based bnxt f/w manager

by Sheetal Tigadoli

This patch series adds support for TEE based BNXT firmware management module and the driver changes to invoke OP-TEE APIs to fastboot firmware and to collect crash dump. Changes from v4: - update Kconfig to reflect dependency on TEE driver Vasundhara Volam (2): bnxt_en: Add support to invoke OP-TEE API to reset firmware bnxt_en: Add support to collect crash dump via ethtool Vikas Gupta (1): firmware: broadcom: add OP-TEE based BNXT f/w manager drivers/firmware/broadcom/Kconfig | 8 + drivers/firmware/broadcom/Makefile | 1 + drivers/firmware/broadcom/tee_bnxt_fw.c | 279 ++++++++++++++++++ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 6 + .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 37 ++- .../net/ethernet/broadcom/bnxt/bnxt_ethtool.h | 2 + include/linux/firmware/broadcom/tee_bnxt_fw.h | 14 + 8 files changed, 356 insertions(+), 4 deletions(-) create mode 100644 drivers/firmware/broadcom/tee_bnxt_fw.c create mode 100644 include/linux/firmware/broadcom/tee_bnxt_fw.h base-commit: d86784fe9b037baf06a154283a4e8cff46b6fe2f -- 2.17.1

6 years, 3 months

← Newer
1
...
9
10
11
12
13
14
15
...
30
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

Tee-dev