Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
39 commits
Select commit Hold shift + click to select a range
90574a0
dt/bindings: add bindings for optee
jenswi-linaro May 21, 2015
0fb737a
tee: generic TEE subsystem
jenswi-linaro Mar 11, 2015
b13c037
tee: add OP-TEE driver
jenswi-linaro Apr 14, 2015
e796f39
Documentation: tee subsystem and op-tee driver
jenswi-linaro Jun 1, 2015
85501a9
arm64: dt: hikey: Add optee node
jforissier Mar 22, 2016
289847c
arm64: dt: Remove timer from mt8173 **not for mainline**
jockebech Apr 1, 2016
182770e
arm64: dt: PSCI for foundation-v8 **not for mainline**
jenswi-linaro Aug 17, 2016
7af7d49
arm64: dt: use GICv2 for foundation-v8 **not for mainline**
jenswi-linaro Aug 17, 2016
1ed5abf
arm64: dt: OP-TEE for foundation-v8 **not for mainline**
jenswi-linaro Aug 17, 2016
1860878
arm64: dt: OP-TEE for Juno **not for mainline**
jenswi-linaro Mar 29, 2016
05bf811
arm64: dt: Add no-map to the reserved-memory node for OP-TEE for foun…
jenswi-linaro Dec 2, 2016
253e930
include/linux/arm-smccc.h: avoid sign extension problem
jenswi-linaro May 24, 2016
41e21e5
tee: new ioctl to a register tee_shm from a dmabuf file descriptor
etienne-lms Oct 27, 2016
1bdaf42
arm64: dt: Add no-map to the reserved-memory node for OP-TEE for juno…
jenswi-linaro Jan 3, 2017
860c460
tee: add kernel internal client interface **not for mainline**
jenswi-linaro Nov 19, 2015
9c74fe7
arm64: dt: hikey: Add optee node
jforissier Mar 22, 2016
18f9316
arm64: dt: Add OP-TEE firmware to mt8173 **not for mainline**
jockebech Mar 24, 2016
dc4d9f4
optee: sync patch set v14
jenswi-linaro Jan 20, 2017
627497c
tee: indicate privileged dev in gen_caps
jenswi-linaro Feb 16, 2017
747f680
tee: add tee_param_is_memref() for driver use
jenswi-linaro Dec 23, 2016
66d81fc
tee: add TEE_IOCTL_PARAM_ATTR_META
jenswi-linaro Dec 23, 2016
c0b5b08
optee: support asynchronous supplicant requests
jenswi-linaro Dec 23, 2016
2a10c8a
tee: apply v15 delta
jenswi-linaro Mar 15, 2017
f5ec10b
tee: apply v16 delta
jenswi-linaro Mar 15, 2017
e31dd54
staging/ion: add Allwinner ION "secure" heap **not for mainline**
etienne-lms Mar 23, 2017
4a95713
ion: "unmapped" heap for secure data path **not for mainline**
etienne-lms Mar 23, 2017
961993f
ion: unmapped heap support in ion dummy driver **not for mainline**
etienne-lms Mar 23, 2017
49ece5d
Sync OP-TEE driver with new naming of interrupts
david-wang-2015 Feb 16, 2017
5613392
arm64: dts: hi6220: Reset the mmc hosts
dlezcano Mar 16, 2017
51848d1
tee: optee: interruptible RPC sleep
tiger-yu99 May 5, 2017
4867f93
OP-TEE Benchmark **not for mainline**
Oct 25, 2016
9805d79
tee: optee: optee_bench.h: remove useless include **not for mainline**
jforissier May 31, 2017
2e26af9
tee: add forward declaration for struct device
jforissier May 31, 2017
cc2e97b
tee: optee: fix uninitialized symbol 'parg'
jenswi-linaro May 15, 2017
ac0c2c2
ion: fix unmapped heap test settings **not for mainline**
etienne-lms Aug 24, 2017
7c7d9c4
staging/ion: CONFIG_ION_UNMAPPED_HEAP conditions unmapped heap
etienne-lms Sep 8, 2017
916d9f3
staging/ion: ARM64 supports ION_UNMAPPED_HEAP
etienne-lms Sep 18, 2017
bf829aa
staging/ion: fix unmapped heap conditional support
etienne-lms Sep 18, 2017
80455bf
benchmark: use arm generic timers as time/tick source
Sep 16, 2017
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions Documentation/00-INDEX
Original file line number Diff line number Diff line change
Expand Up @@ -436,6 +436,8 @@ sysrq.txt
- info on the magic SysRq key.
target/
- directory with info on generating TCM v4 fabric .ko modules
tee.txt
- info on the TEE subsystem and drivers
this_cpu_ops.txt
- List rationale behind and the way to use this_cpu operations.
thermal/
Expand Down
31 changes: 31 additions & 0 deletions Documentation/devicetree/bindings/arm/firmware/linaro,optee-tz.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
OP-TEE Device Tree Bindings

OP-TEE is a piece of software using hardware features to provide a Trusted
Execution Environment. The security can be provided with ARM TrustZone, but
also by virtualization or a separate chip.

We're using "linaro" as the first part of the compatible property for
the reference implementation maintained by Linaro.

* OP-TEE based on ARM TrustZone required properties:

- compatible : should contain "linaro,optee-tz"

- method : The method of calling the OP-TEE Trusted OS. Permitted
values are:

"smc" : SMC #0, with the register assignments specified
in drivers/tee/optee/optee_smc.h

"hvc" : HVC #0, with the register assignments specified
in drivers/tee/optee/optee_smc.h



Example:
firmware {
optee {
compatible = "linaro,optee-tz";
method = "smc";
};
};
1 change: 1 addition & 0 deletions Documentation/devicetree/bindings/vendor-prefixes.txt
Original file line number Diff line number Diff line change
Expand Up @@ -155,6 +155,7 @@ lacie LaCie
lantiq Lantiq Semiconductor
lenovo Lenovo Group Ltd.
lg LG Corporation
linaro Linaro Limited
linux Linux-specific binding
lltc Linear Technology Corporation
lsi LSI Corp. (LSI Logic)
Expand Down
1 change: 1 addition & 0 deletions Documentation/ioctl/ioctl-number.txt
Original file line number Diff line number Diff line change
Expand Up @@ -308,6 +308,7 @@ Code Seq#(hex) Include File Comments
0xA3 80-8F Port ACL in development:
<mailto:tlewis@mindspring.com>
0xA3 90-9F linux/dtlk.h
0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
0xAA 00-3F linux/uapi/linux/userfaultfd.h
0xAB 00-1F linux/nbd.h
0xAC 00-1F linux/raw.h
Expand Down
118 changes: 118 additions & 0 deletions Documentation/tee.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,118 @@
TEE subsystem
This document describes the TEE subsystem in Linux.

A TEE (Trusted Execution Environment) is a trusted OS running in some
secure environment, for example, TrustZone on ARM CPUs, or a separate
secure co-processor etc. A TEE driver handles the details needed to
communicate with the TEE.

This subsystem deals with:

- Registration of TEE drivers

- Managing shared memory between Linux and the TEE

- Providing a generic API to the TEE

The TEE interface
=================

include/uapi/linux/tee.h defines the generic interface to a TEE.

User space (the client) connects to the driver by opening /dev/tee[0-9]* or
/dev/teepriv[0-9]*.

- TEE_IOC_SHM_ALLOC allocates shared memory and returns a file descriptor
which user space can mmap. When user space doesn't need the file
descriptor any more, it should be closed. When shared memory isn't needed
any longer it should be unmapped with munmap() to allow the reuse of
memory.

- TEE_IOC_VERSION lets user space know which TEE this driver handles and
the its capabilities.

- TEE_IOC_OPEN_SESSION opens a new session to a Trusted Application.

- TEE_IOC_INVOKE invokes a function in a Trusted Application.

- TEE_IOC_CANCEL may cancel an ongoing TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE.

- TEE_IOC_CLOSE_SESSION closes a session to a Trusted Application.

There are two classes of clients, normal clients and supplicants. The latter is
a helper process for the TEE to access resources in Linux, for example file
system access. A normal client opens /dev/tee[0-9]* and a supplicant opens
/dev/teepriv[0-9].

Much of the communication between clients and the TEE is opaque to the
driver. The main job for the driver is to receive requests from the
clients, forward them to the TEE and send back the results. In the case of
supplicants the communication goes in the other direction, the TEE sends
requests to the supplicant which then sends back the result.

OP-TEE driver
=============

The OP-TEE driver handles OP-TEE [1] based TEEs. Currently it is only the ARM
TrustZone based OP-TEE solution that is supported.

Lowest level of communication with OP-TEE builds on ARM SMC Calling
Convention (SMCCC) [2], which is the foundation for OP-TEE's SMC interface
[3] used internally by the driver. Stacked on top of that is OP-TEE Message
Protocol [4].

OP-TEE SMC interface provides the basic functions required by SMCCC and some
additional functions specific for OP-TEE. The most interesting functions are:

- OPTEE_SMC_FUNCID_CALLS_UID (part of SMCCC) returns the version information
which is then returned by TEE_IOC_VERSION

- OPTEE_SMC_CALL_GET_OS_UUID returns the particular OP-TEE implementation, used
to tell, for instance, a TrustZone OP-TEE apart from an OP-TEE running on a
separate secure co-processor.

- OPTEE_SMC_CALL_WITH_ARG drives the OP-TEE message protocol

- OPTEE_SMC_GET_SHM_CONFIG lets the driver and OP-TEE agree on which memory
range to used for shared memory between Linux and OP-TEE.

The GlobalPlatform TEE Client API [5] is implemented on top of the generic
TEE API.

Picture of the relationship between the different components in the
OP-TEE architecture.

User space Kernel Secure world
~~~~~~~~~~ ~~~~~~ ~~~~~~~~~~~~
+--------+ +-------------+
| Client | | Trusted |
+--------+ | Application |
/\ +-------------+
|| +----------+ /\
|| |tee- | ||
|| |supplicant| \/
|| +----------+ +-------------+
\/ /\ | TEE Internal|
+-------+ || | API |
+ TEE | || +--------+--------+ +-------------+
| Client| || | TEE | OP-TEE | | OP-TEE |
| API | \/ | subsys | driver | | Trusted OS |
+-------+----------------+----+-------+----+-----------+-------------+
| Generic TEE API | | OP-TEE MSG |
| IOCTL (TEE_IOC_*) | | SMCCC (OPTEE_SMC_CALL_*) |
+-----------------------------+ +------------------------------+

RPC (Remote Procedure Call) are requests from secure world to kernel driver
or tee-supplicant. An RPC is identified by a special range of SMCCC return
values from OPTEE_SMC_CALL_WITH_ARG. RPC messages which are intended for the
kernel are handled by the kernel driver. Other RPC messages will be forwarded to
tee-supplicant without further involvement of the driver, except switching
shared memory buffer representation.

References:
[1] https://github.com/OP-TEE/optee_os
[2] http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html
[3] drivers/tee/optee/optee_smc.h
[4] drivers/tee/optee/optee_msg.h
[5] http://www.globalplatform.org/specificationsdevice.asp look for
"TEE Client API Specification v1.0" and click download.
13 changes: 13 additions & 0 deletions MAINTAINERS
Original file line number Diff line number Diff line change
Expand Up @@ -9010,6 +9010,11 @@ F: arch/*/oprofile/
F: drivers/oprofile/
F: include/linux/oprofile.h

OP-TEE DRIVER
M: Jens Wiklander <jens.wiklander@linaro.org>
S: Maintained
F: drivers/tee/optee/

ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
M: Mark Fasheh <mfasheh@versity.com>
M: Joel Becker <jlbec@evilplan.org>
Expand Down Expand Up @@ -10655,6 +10660,14 @@ F: drivers/hwtracing/stm/
F: include/linux/stm.h
F: include/uapi/linux/stm.h

TEE SUBSYSTEM
M: Jens Wiklander <jens.wiklander@linaro.org>
S: Maintained
F: include/linux/tee_drv.h
F: include/uapi/linux/tee.h
F: drivers/tee/
F: Documentation/tee.txt

THUNDERBOLT DRIVER
M: Andreas Noever <andreas.noever@gmail.com>
S: Maintained
Expand Down
10 changes: 5 additions & 5 deletions arch/arm64/boot/dts/arm/foundation-v8.dts
Original file line number Diff line number Diff line change
Expand Up @@ -7,15 +7,15 @@
#include "foundation-v8.dtsi"

/ {
gic: interrupt-controller@2c001000 {
gic: interrupt-controller@2f000000 {
compatible = "arm,cortex-a15-gic", "arm,cortex-a9-gic";
#interrupt-cells = <3>;
#address-cells = <2>;
interrupt-controller;
reg = <0x0 0x2c001000 0 0x1000>,
<0x0 0x2c002000 0 0x2000>,
<0x0 0x2c004000 0 0x2000>,
<0x0 0x2c006000 0 0x2000>;
reg = <0x0 0x2f000000 0 0x10000>,
<0x0 0x2c000000 0 0x2000>,
<0x0 0x2c010000 0 0x2000>,
<0x0 0x2c02F000 0 0x2000>;
interrupts = <1 9 0xf04>;
};
};
49 changes: 32 additions & 17 deletions arch/arm64/boot/dts/arm/foundation-v8.dtsi
Original file line number Diff line number Diff line change
Expand Up @@ -19,11 +19,19 @@

aliases {
serial0 = &v2m_serial0;
serial1 = &v2m_serial1;
serial2 = &v2m_serial2;
serial3 = &v2m_serial3;
};

psci {
compatible = "arm,psci";
method = "smc";
cpu_suspend = <0xc4000001>;
cpu_off = <0x84000002>;
cpu_on = <0xc4000003>;
};


cpus {
#address-cells = <2>;
#size-cells = <0>;
Expand All @@ -32,32 +40,28 @@
device_type = "cpu";
compatible = "arm,armv8";
reg = <0x0 0x0>;
enable-method = "spin-table";
cpu-release-addr = <0x0 0x8000fff8>;
enable-method = "psci";
next-level-cache = <&L2_0>;
};
cpu@1 {
device_type = "cpu";
compatible = "arm,armv8";
reg = <0x0 0x1>;
enable-method = "spin-table";
cpu-release-addr = <0x0 0x8000fff8>;
enable-method = "psci";
next-level-cache = <&L2_0>;
};
cpu@2 {
device_type = "cpu";
compatible = "arm,armv8";
reg = <0x0 0x2>;
enable-method = "spin-table";
cpu-release-addr = <0x0 0x8000fff8>;
enable-method = "psci";
next-level-cache = <&L2_0>;
};
cpu@3 {
device_type = "cpu";
compatible = "arm,armv8";
reg = <0x0 0x3>;
enable-method = "spin-table";
cpu-release-addr = <0x0 0x8000fff8>;
enable-method = "psci";
next-level-cache = <&L2_0>;
};

Expand All @@ -72,6 +76,17 @@
<0x00000008 0x80000000 0 0x80000000>;
};

reserved-memory {
#address-cells = <2>;
#size-cells = <2>;
ranges;

optee@0x83000000 {
reg = <0x00000000 0x83000000 0 0x01000000>;
no-map;
};
};

timer {
compatible = "arm,armv8-timer";
interrupts = <1 13 0xf08>,
Expand Down Expand Up @@ -202,14 +217,6 @@
clock-names = "uartclk", "apb_pclk";
};

v2m_serial1: uart@0a0000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x0a0000 0x1000>;
interrupts = <6>;
clocks = <&v2m_clk24mhz>, <&v2m_clk24mhz>;
clock-names = "uartclk", "apb_pclk";
};

v2m_serial2: uart@0b0000 {
compatible = "arm,pl011", "arm,primecell";
reg = <0x0b0000 0x1000>;
Expand All @@ -233,4 +240,12 @@
};
};
};

firmware {
optee {
compatible = "linaro,optee-tz";
method = "smc";
};
};

};
20 changes: 20 additions & 0 deletions arch/arm64/boot/dts/arm/juno-base.dtsi
Original file line number Diff line number Diff line change
Expand Up @@ -600,6 +600,19 @@
<0x00000008 0x80000000 0x1 0x80000000>;
};

reserved-memory {
#address-cells = <2>;
#size-cells = <2>;
ranges;

/* Shared memory between secure and non-secure world */
optee@0xfee00000 {
reg = <0x00000000 0xfee00000 0 0x00200000>;
no-map;
};
};


smb@08000000 {
compatible = "simple-bus";
#address-cells = <2>;
Expand Down Expand Up @@ -639,3 +652,10 @@
interrupt-map-mask = <0 0>;
interrupt-map = <0 0 &gic 0 0 0 168 IRQ_TYPE_LEVEL_HIGH>;
};

firmware {
optee {
compatible = "linaro,optee-tz";
method = "smc";
};
};
14 changes: 14 additions & 0 deletions arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts
Original file line number Diff line number Diff line change
Expand Up @@ -406,6 +406,20 @@
};
};
};

firmware {
optee {
compatible = "linaro,optee-tz";
method = "smc";
};
};

firmware {
optee {
compatible = "linaro,optee-tz";
method = "smc";
};
};
};

&uart2 {
Expand Down
Loading