Skip to content

Commit e038d55

Browse files
arndbarndb
committed
Merge branch 'tee/initial-merge' into fixes
This is a dependency for the following fix * tee/initial-merge: arm64: dt: hikey: Add optee node Documentation: tee subsystem and op-tee driver tee: add OP-TEE driver tee: generic TEE subsystem dt/bindings: add bindings for optee
2 parents 6cde26f + 14e21cb commit e038d55

File tree

26 files changed

+5156
-0
lines changed

26 files changed

+5156
-0
lines changed

‎Documentation/00-INDEX

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -412,6 +412,8 @@ sysctl/
412412
- directory with info on the /proc/sys/* files.
413413
target/
414414
- directory with info on generating TCM v4 fabric .ko modules
415+
tee.txt
416+
- info on the TEE subsystem and drivers
415417
this_cpu_ops.txt
416418
- List rationale behind and the way to use this_cpu operations.
417419
thermal/

‎Documentation/devicetree/bindings/arm/firmware/linaro,optee-tz.txt

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
OP-TEE Device Tree Bindings
2+
3+
OP-TEE is a piece of software using hardware features to provide a Trusted
4+
Execution Environment. The security can be provided with ARM TrustZone, but
5+
also by virtualization or a separate chip.
6+
7+
We're using "linaro" as the first part of the compatible property for
8+
the reference implementation maintained by Linaro.
9+
10+
* OP-TEE based on ARM TrustZone required properties:
11+
12+
- compatible : should contain "linaro,optee-tz"
13+
14+
- method : The method of calling the OP-TEE Trusted OS. Permitted
15+
values are:
16+
17+
"smc" : SMC #0, with the register assignments specified
18+
in drivers/tee/optee/optee_smc.h
19+
20+
"hvc" : HVC #0, with the register assignments specified
21+
in drivers/tee/optee/optee_smc.h
22+
23+
24+
25+
Example:
26+
firmware {
27+
optee {
28+
compatible = "linaro,optee-tz";
29+
method = "smc";
30+
};
31+
};

‎Documentation/devicetree/bindings/vendor-prefixes.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -173,6 +173,7 @@ lego LEGO Systems A/S
173173
lenovo Lenovo Group Ltd.
174174
lg LG Corporation
175175
licheepi Lichee Pi
176+
linaro Linaro Limited
176177
linux Linux-specific binding
177178
lltc Linear Technology Corporation
178179
lsi LSI Corp. (LSI Logic)

‎Documentation/ioctl/ioctl-number.txt

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -309,6 +309,7 @@ Code Seq#(hex) Include File Comments
309309
0xA3 80-8F Port ACL in development:
310310
<mailto:[email protected]>
311311
0xA3 90-9F linux/dtlk.h
312+
0xA4 00-1F uapi/linux/tee.h Generic TEE subsystem
312313
0xAA 00-3F linux/uapi/linux/userfaultfd.h
313314
0xAB 00-1F linux/nbd.h
314315
0xAC 00-1F linux/raw.h

‎Documentation/tee.txt

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
TEE subsystem
2+
This document describes the TEE subsystem in Linux.
3+
4+
A TEE (Trusted Execution Environment) is a trusted OS running in some
5+
secure environment, for example, TrustZone on ARM CPUs, or a separate
6+
secure co-processor etc. A TEE driver handles the details needed to
7+
communicate with the TEE.
8+
9+
This subsystem deals with:
10+
11+
- Registration of TEE drivers
12+
13+
- Managing shared memory between Linux and the TEE
14+
15+
- Providing a generic API to the TEE
16+
17+
The TEE interface
18+
=================
19+
20+
include/uapi/linux/tee.h defines the generic interface to a TEE.
21+
22+
User space (the client) connects to the driver by opening /dev/tee[0-9]* or
23+
/dev/teepriv[0-9]*.
24+
25+
- TEE_IOC_SHM_ALLOC allocates shared memory and returns a file descriptor
26+
which user space can mmap. When user space doesn't need the file
27+
descriptor any more, it should be closed. When shared memory isn't needed
28+
any longer it should be unmapped with munmap() to allow the reuse of
29+
memory.
30+
31+
- TEE_IOC_VERSION lets user space know which TEE this driver handles and
32+
the its capabilities.
33+
34+
- TEE_IOC_OPEN_SESSION opens a new session to a Trusted Application.
35+
36+
- TEE_IOC_INVOKE invokes a function in a Trusted Application.
37+
38+
- TEE_IOC_CANCEL may cancel an ongoing TEE_IOC_OPEN_SESSION or TEE_IOC_INVOKE.
39+
40+
- TEE_IOC_CLOSE_SESSION closes a session to a Trusted Application.
41+
42+
There are two classes of clients, normal clients and supplicants. The latter is
43+
a helper process for the TEE to access resources in Linux, for example file
44+
system access. A normal client opens /dev/tee[0-9]* and a supplicant opens
45+
/dev/teepriv[0-9].
46+
47+
Much of the communication between clients and the TEE is opaque to the
48+
driver. The main job for the driver is to receive requests from the
49+
clients, forward them to the TEE and send back the results. In the case of
50+
supplicants the communication goes in the other direction, the TEE sends
51+
requests to the supplicant which then sends back the result.
52+
53+
OP-TEE driver
54+
=============
55+
56+
The OP-TEE driver handles OP-TEE [1] based TEEs. Currently it is only the ARM
57+
TrustZone based OP-TEE solution that is supported.
58+
59+
Lowest level of communication with OP-TEE builds on ARM SMC Calling
60+
Convention (SMCCC) [2], which is the foundation for OP-TEE's SMC interface
61+
[3] used internally by the driver. Stacked on top of that is OP-TEE Message
62+
Protocol [4].
63+
64+
OP-TEE SMC interface provides the basic functions required by SMCCC and some
65+
additional functions specific for OP-TEE. The most interesting functions are:
66+
67+
- OPTEE_SMC_FUNCID_CALLS_UID (part of SMCCC) returns the version information
68+
which is then returned by TEE_IOC_VERSION
69+
70+
- OPTEE_SMC_CALL_GET_OS_UUID returns the particular OP-TEE implementation, used
71+
to tell, for instance, a TrustZone OP-TEE apart from an OP-TEE running on a
72+
separate secure co-processor.
73+
74+
- OPTEE_SMC_CALL_WITH_ARG drives the OP-TEE message protocol
75+
76+
- OPTEE_SMC_GET_SHM_CONFIG lets the driver and OP-TEE agree on which memory
77+
range to used for shared memory between Linux and OP-TEE.
78+
79+
The GlobalPlatform TEE Client API [5] is implemented on top of the generic
80+
TEE API.
81+
82+
Picture of the relationship between the different components in the
83+
OP-TEE architecture.
84+
85+
User space Kernel Secure world
86+
~~~~~~~~~~ ~~~~~~ ~~~~~~~~~~~~
87+
+--------+ +-------------+
88+
| Client | | Trusted |
89+
+--------+ | Application |
90+
/\ +-------------+
91+
|| +----------+ /\
92+
|| |tee- | ||
93+
|| |supplicant| \/
94+
|| +----------+ +-------------+
95+
\/ /\ | TEE Internal|
96+
+-------+ || | API |
97+
+ TEE | || +--------+--------+ +-------------+
98+
| Client| || | TEE | OP-TEE | | OP-TEE |
99+
| API | \/ | subsys | driver | | Trusted OS |
100+
+-------+----------------+----+-------+----+-----------+-------------+
101+
| Generic TEE API | | OP-TEE MSG |
102+
| IOCTL (TEE_IOC_*) | | SMCCC (OPTEE_SMC_CALL_*) |
103+
+-----------------------------+ +------------------------------+
104+
105+
RPC (Remote Procedure Call) are requests from secure world to kernel driver
106+
or tee-supplicant. An RPC is identified by a special range of SMCCC return
107+
values from OPTEE_SMC_CALL_WITH_ARG. RPC messages which are intended for the
108+
kernel are handled by the kernel driver. Other RPC messages will be forwarded to
109+
tee-supplicant without further involvement of the driver, except switching
110+
shared memory buffer representation.
111+
112+
References:
113+
[1] https://github.com/OP-TEE/optee_os
114+
[2] http://infocenter.arm.com/help/topic/com.arm.doc.den0028a/index.html
115+
[3] drivers/tee/optee/optee_smc.h
116+
[4] drivers/tee/optee/optee_msg.h
117+
[5] http://www.globalplatform.org/specificationsdevice.asp look for
118+
"TEE Client API Specification v1.0" and click download.

‎MAINTAINERS

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9515,6 +9515,11 @@ F: arch/*/oprofile/
95159515
F: drivers/oprofile/
95169516
F: include/linux/oprofile.h
95179517

9518+
OP-TEE DRIVER
9519+
M: Jens Wiklander <[email protected]>
9520+
S: Maintained
9521+
F: drivers/tee/optee/
9522+
95189523
ORACLE CLUSTER FILESYSTEM 2 (OCFS2)
95199524
M: Mark Fasheh <[email protected]>
95209525
M: Joel Becker <[email protected]>
@@ -11296,6 +11301,14 @@ F: drivers/hwtracing/stm/
1129611301
F: include/linux/stm.h
1129711302
F: include/uapi/linux/stm.h
1129811303

11304+
TEE SUBSYSTEM
11305+
M: Jens Wiklander <[email protected]>
11306+
S: Maintained
11307+
F: include/linux/tee_drv.h
11308+
F: include/uapi/linux/tee.h
11309+
F: drivers/tee/
11310+
F: Documentation/tee.txt
11311+
1129911312
THUNDERBOLT DRIVER
1130011313
M: Andreas Noever <[email protected]>
1130111314
S: Maintained

‎arch/arm64/boot/dts/hisilicon/hi6220-hikey.dts

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,6 +411,13 @@
411411
};
412412
};
413413
};
414+
415+
firmware {
416+
optee {
417+
compatible = "linaro,optee-tz";
418+
method = "smc";
419+
};
420+
};
414421
};
415422

416423
&uart2 {

‎drivers/Kconfig

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -204,4 +204,6 @@ source "drivers/fpga/Kconfig"
204204

205205
source "drivers/fsi/Kconfig"
206206

207+
source "drivers/tee/Kconfig"
208+
207209
endmenu

‎drivers/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -180,3 +180,4 @@ obj-$(CONFIG_ANDROID) += android/
180180
obj-$(CONFIG_NVMEM) += nvmem/
181181
obj-$(CONFIG_FPGA) += fpga/
182182
obj-$(CONFIG_FSI) += fsi/
183+
obj-$(CONFIG_TEE) += tee/

‎drivers/tee/Kconfig

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Generic Trusted Execution Environment Configuration
2+
config TEE
3+
tristate "Trusted Execution Environment support"
4+
select DMA_SHARED_BUFFER
5+
select GENERIC_ALLOCATOR
6+
help
7+
This implements a generic interface towards a Trusted Execution
8+
Environment (TEE).
9+
10+
if TEE
11+
12+
menu "TEE drivers"
13+
14+
source "drivers/tee/optee/Kconfig"
15+
16+
endmenu
17+
18+
endif

‎drivers/tee/Makefile

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
obj-$(CONFIG_TEE) += tee.o
2+
tee-objs += tee_core.o
3+
tee-objs += tee_shm.o
4+
tee-objs += tee_shm_pool.o
5+
obj-$(CONFIG_OPTEE) += optee/

‎drivers/tee/optee/Kconfig

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# OP-TEE Trusted Execution Environment Configuration
2+
config OPTEE
3+
tristate "OP-TEE"
4+
depends on HAVE_ARM_SMCCC
5+
help
6+
This implements the OP-TEE Trusted Execution Environment (TEE)
7+
driver.

‎drivers/tee/optee/Makefile

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
obj-$(CONFIG_OPTEE) += optee.o
2+
optee-objs += core.o
3+
optee-objs += call.o
4+
optee-objs += rpc.o
5+
optee-objs += supp.o

0 commit comments

Comments
 (0)