All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/2] tee: define session login identifiers
@ 2021-05-12 15:05 Etienne Carriere
  2021-05-12 15:05 ` [PATCH 2/2] tee: optee: support session login as REE kernel Etienne Carriere
                   ` (2 more replies)
  0 siblings, 3 replies; 6+ messages in thread
From: Etienne Carriere @ 2021-05-12 15:05 UTC (permalink / raw)
  To: u-boot

TEE header file defines a clnt_login field in struct tee_open_session_arg
but does not define the values expected. This change define identifiers
for the field using a enumerated type. Back end TEE driver is expected to
convert these IDs into IDs meaningful to the TEE.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
---
 include/tee.h | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/include/tee.h b/include/tee.h
index 99367b258e..b8297601b4 100644
--- a/include/tee.h
+++ b/include/tee.h
@@ -31,6 +31,19 @@
 #define TEE_PARAM_ATTR_MASK			(TEE_PARAM_ATTR_TYPE_MASK | \
 						 TEE_PARAM_ATTR_META)
 
+/*
+ * Value for tee_open_session_arg::clnt_login
+ */
+enum tee_session_login {
+	TEE_SESSION_LOGIN_PUBLIC = 0,
+	TEE_SESSION_LOGIN_USER,
+	TEE_SESSION_LOGIN_GROUP,
+	TEE_SESSION_LOGIN_APPLICATION,
+	TEE_SESSION_LOGIN_APPLICATION_USER,
+	TEE_SESSION_LOGIN_APPLICATION_GROUP,
+	TEE_SESSION_LOGIN_REE_KERNEL,
+};
+
 /*
  * Some Global Platform error codes which has a meaning if the
  * TEE_GEN_CAP_GP bit is returned by the driver in
@@ -135,8 +148,8 @@ struct tee_param {
 /**
  * struct tee_open_session_arg - extra arguments for tee_open_session()
  * @uuid:	[in] UUID of the Trusted Application
- * @clnt_uuid:	[in] Normally zeroes
- * @clnt_login:	[in] Normally 0
+ * @clnt_uuid:	[in] UUID of client, zeroes for PUBLIC/REE_KERNEL
+ * @clnt_login:	[in] Class of client TEE_SESSION_LOGIN_*
  * @session:	[out] Session id
  * @ret:	[out] return value
  * @ret_origin:	[out] origin of the return value
@@ -144,7 +157,7 @@ struct tee_param {
 struct tee_open_session_arg {
 	u8 uuid[TEE_UUID_LEN];
 	u8 clnt_uuid[TEE_UUID_LEN];
-	u32 clnt_login;
+	enum tee_session_login clnt_login;
 	u32 session;
 	u32 ret;
 	u32 ret_origin;
-- 
2.17.1

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH 2/2] tee: optee: support session login as REE kernel
  2021-05-12 15:05 [PATCH 1/2] tee: define session login identifiers Etienne Carriere
@ 2021-05-12 15:05 ` Etienne Carriere
  2021-05-17  6:08   ` Jens Wiklander
  2021-05-17  6:02 ` [PATCH 1/2] tee: define session login identifiers Jens Wiklander
  2021-11-08  9:29 ` Patrick DELAUNAY
  2 siblings, 1 reply; 6+ messages in thread
From: Etienne Carriere @ 2021-05-12 15:05 UTC (permalink / raw)
  To: u-boot

OP-TEE supports an API extension to allow client to open a TEE session
as REE kernel which OP-TEE uses to differentiate client application
services from system services that only the REE OS kernel can access.

This change allows U-Boot to invoke OP-TEE which such kernel identity
and therefore access kernel client specific services.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
---
 drivers/tee/optee/core.c      | 24 +++++++++++++++++++++++-
 drivers/tee/optee/optee_msg.h |  2 ++
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
index 73dbb22ba0..526bf125a0 100644
--- a/drivers/tee/optee/core.c
+++ b/drivers/tee/optee/core.c
@@ -349,6 +349,28 @@ static int optee_close_session(struct udevice *dev, u32 session)
 	return 0;
 }
 
+static uint32_t optee_login_id(enum tee_session_login login)
+{
+	/* Treat invalid IDs as public login */
+	switch (login) {
+	case TEE_SESSION_LOGIN_USER:
+		return OPTEE_MSG_LOGIN_USER;
+	case TEE_SESSION_LOGIN_GROUP:
+		return OPTEE_MSG_LOGIN_GROUP;
+	case TEE_SESSION_LOGIN_APPLICATION:
+		return OPTEE_MSG_LOGIN_APPLICATION;
+	case TEE_SESSION_LOGIN_APPLICATION_USER:
+		return OPTEE_MSG_LOGIN_APPLICATION;
+	case TEE_SESSION_LOGIN_APPLICATION_GROUP:
+		return OPTEE_MSG_LOGIN_APPLICATION;
+	case TEE_SESSION_LOGIN_REE_KERNEL:
+		return OPTEE_MSG_LOGIN_REE_KERNEL;
+	case TEE_SESSION_LOGIN_PUBLIC:
+	default:
+		return OPTEE_MSG_LOGIN_PUBLIC;
+	}
+}
+
 static int optee_open_session(struct udevice *dev,
 			      struct tee_open_session_arg *arg,
 			      uint num_params, struct tee_param *params)
@@ -372,7 +394,7 @@ static int optee_open_session(struct udevice *dev,
 				  OPTEE_MSG_ATTR_META;
 	memcpy(&msg_arg->params[0].u.value, arg->uuid, sizeof(arg->uuid));
 	memcpy(&msg_arg->params[1].u.value, arg->uuid, sizeof(arg->clnt_uuid));
-	msg_arg->params[1].u.value.c = arg->clnt_login;
+	msg_arg->params[1].u.value.c = optee_login_id(arg->clnt_login);
 
 	rc = to_msg_param(msg_arg->params + 2, num_params, params);
 	if (rc)
diff --git a/drivers/tee/optee/optee_msg.h b/drivers/tee/optee/optee_msg.h
index 8d40ce60c2..17e8d28e52 100644
--- a/drivers/tee/optee/optee_msg.h
+++ b/drivers/tee/optee/optee_msg.h
@@ -95,6 +95,8 @@
 #define OPTEE_MSG_LOGIN_APPLICATION		0x00000004
 #define OPTEE_MSG_LOGIN_APPLICATION_USER	0x00000005
 #define OPTEE_MSG_LOGIN_APPLICATION_GROUP	0x00000006
+/* OP-TEE extension: log as REE kernel */
+#define OPTEE_MSG_LOGIN_REE_KERNEL		0x80000000
 
 /*
  * Page size used in non-contiguous buffer entries
-- 
2.17.1

^ permalink raw reply related	[flat|nested] 6+ messages in thread
* [PATCH 1/2] tee: define session login identifiers
  2021-05-12 15:05 [PATCH 1/2] tee: define session login identifiers Etienne Carriere
  2021-05-12 15:05 ` [PATCH 2/2] tee: optee: support session login as REE kernel Etienne Carriere
@ 2021-05-17  6:02 ` Jens Wiklander
  2021-11-08  9:29 ` Patrick DELAUNAY
  2 siblings, 0 replies; 6+ messages in thread
From: Jens Wiklander @ 2021-05-17  6:02 UTC (permalink / raw)
  To: u-boot

On Wed, May 12, 2021 at 5:06 PM Etienne Carriere
<etienne.carriere@linaro.org> wrote:
>
> TEE header file defines a clnt_login field in struct tee_open_session_arg
> but does not define the values expected. This change define identifiers
> for the field using a enumerated type. Back end TEE driver is expected to
> convert these IDs into IDs meaningful to the TEE.
>
> Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
> ---
>  include/tee.h | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/include/tee.h b/include/tee.h
> index 99367b258e..b8297601b4 100644
> --- a/include/tee.h
> +++ b/include/tee.h
> @@ -31,6 +31,19 @@
>  #define TEE_PARAM_ATTR_MASK                    (TEE_PARAM_ATTR_TYPE_MASK | \
>                                                  TEE_PARAM_ATTR_META)
>
> +/*
> + * Value for tee_open_session_arg::clnt_login
> + */
> +enum tee_session_login {
> +       TEE_SESSION_LOGIN_PUBLIC = 0,
> +       TEE_SESSION_LOGIN_USER,
> +       TEE_SESSION_LOGIN_GROUP,
> +       TEE_SESSION_LOGIN_APPLICATION,

This is defined as 4 in the spec.

> +       TEE_SESSION_LOGIN_APPLICATION_USER,
> +       TEE_SESSION_LOGIN_APPLICATION_GROUP,

Please make these USER_APPLICATION and GROUP_APPLICATION since that's
the order used in the spec.

> +       TEE_SESSION_LOGIN_REE_KERNEL,

The Linux kernel defines the REE kernel stuff as:
/*
 * Disallow user-space to use GP implementation specific login
 * method range (0x80000000 - 0xBFFFFFFF). This range is rather
 * being reserved for REE kernel clients or TEE implementation.
 */
#define TEE_IOCTL_LOGIN_REE_KERNEL_MIN          0x80000000
#define TEE_IOCTL_LOGIN_REE_KERNEL_MAX          0xBFFFFFFF
/* Private login method for REE kernel clients */
#define TEE_IOCTL_LOGIN_REE_KERNEL              0x80000000

We should at least try to be in the same implementation defined range.

> +};

I think that using a TEE_LOGIN_ prefix should be enough.

> +
>  /*
>   * Some Global Platform error codes which has a meaning if the
>   * TEE_GEN_CAP_GP bit is returned by the driver in
> @@ -135,8 +148,8 @@ struct tee_param {
>  /**
>   * struct tee_open_session_arg - extra arguments for tee_open_session()
>   * @uuid:      [in] UUID of the Trusted Application
> - * @clnt_uuid: [in] Normally zeroes
> - * @clnt_login:        [in] Normally 0
> + * @clnt_uuid: [in] UUID of client, zeroes for PUBLIC/REE_KERNEL
> + * @clnt_login:        [in] Class of client TEE_SESSION_LOGIN_*
>   * @session:   [out] Session id
>   * @ret:       [out] return value
>   * @ret_origin:        [out] origin of the return value
> @@ -144,7 +157,7 @@ struct tee_param {
>  struct tee_open_session_arg {
>         u8 uuid[TEE_UUID_LEN];
>         u8 clnt_uuid[TEE_UUID_LEN];
> -       u32 clnt_login;
> +       enum tee_session_login clnt_login;

Please keep this as an u32. It's part of the ABI.

Cheers,
Jens

>         u32 session;
>         u32 ret;
>         u32 ret_origin;
> --
> 2.17.1
>

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH 2/2] tee: optee: support session login as REE kernel
  2021-05-12 15:05 ` [PATCH 2/2] tee: optee: support session login as REE kernel Etienne Carriere
@ 2021-05-17  6:08   ` Jens Wiklander
  2021-05-17 17:22     ` Etienne Carriere
  0 siblings, 1 reply; 6+ messages in thread
From: Jens Wiklander @ 2021-05-17  6:08 UTC (permalink / raw)
  To: u-boot

On Wed, May 12, 2021 at 5:06 PM Etienne Carriere
<etienne.carriere@linaro.org> wrote:
>
> OP-TEE supports an API extension to allow client to open a TEE session
> as REE kernel which OP-TEE uses to differentiate client application
> services from system services that only the REE OS kernel can access.
>
> This change allows U-Boot to invoke OP-TEE which such kernel identity
> and therefore access kernel client specific services.
>
> Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
> ---
>  drivers/tee/optee/core.c      | 24 +++++++++++++++++++++++-
>  drivers/tee/optee/optee_msg.h |  2 ++
>  2 files changed, 25 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
> index 73dbb22ba0..526bf125a0 100644
> --- a/drivers/tee/optee/core.c
> +++ b/drivers/tee/optee/core.c
> @@ -349,6 +349,28 @@ static int optee_close_session(struct udevice *dev, u32 session)
>         return 0;
>  }
>
> +static uint32_t optee_login_id(enum tee_session_login login)
> +{
> +       /* Treat invalid IDs as public login */
> +       switch (login) {
> +       case TEE_SESSION_LOGIN_USER:
> +               return OPTEE_MSG_LOGIN_USER;
> +       case TEE_SESSION_LOGIN_GROUP:
> +               return OPTEE_MSG_LOGIN_GROUP;
> +       case TEE_SESSION_LOGIN_APPLICATION:
> +               return OPTEE_MSG_LOGIN_APPLICATION;
> +       case TEE_SESSION_LOGIN_APPLICATION_USER:
> +               return OPTEE_MSG_LOGIN_APPLICATION;
> +       case TEE_SESSION_LOGIN_APPLICATION_GROUP:
> +               return OPTEE_MSG_LOGIN_APPLICATION;
> +       case TEE_SESSION_LOGIN_REE_KERNEL:
> +               return OPTEE_MSG_LOGIN_REE_KERNEL;
> +       case TEE_SESSION_LOGIN_PUBLIC:
> +       default:
> +               return OPTEE_MSG_LOGIN_PUBLIC;
> +       }
> +}
> +

I don't see any point in this translation, we could just as well use
the correct values from the start.

Cheers,
Jens

>  static int optee_open_session(struct udevice *dev,
>                               struct tee_open_session_arg *arg,
>                               uint num_params, struct tee_param *params)
> @@ -372,7 +394,7 @@ static int optee_open_session(struct udevice *dev,
>                                   OPTEE_MSG_ATTR_META;
>         memcpy(&msg_arg->params[0].u.value, arg->uuid, sizeof(arg->uuid));
>         memcpy(&msg_arg->params[1].u.value, arg->uuid, sizeof(arg->clnt_uuid));
> -       msg_arg->params[1].u.value.c = arg->clnt_login;
> +       msg_arg->params[1].u.value.c = optee_login_id(arg->clnt_login);
>
>         rc = to_msg_param(msg_arg->params + 2, num_params, params);
>         if (rc)
> diff --git a/drivers/tee/optee/optee_msg.h b/drivers/tee/optee/optee_msg.h
> index 8d40ce60c2..17e8d28e52 100644
> --- a/drivers/tee/optee/optee_msg.h
> +++ b/drivers/tee/optee/optee_msg.h
> @@ -95,6 +95,8 @@
>  #define OPTEE_MSG_LOGIN_APPLICATION            0x00000004
>  #define OPTEE_MSG_LOGIN_APPLICATION_USER       0x00000005
>  #define OPTEE_MSG_LOGIN_APPLICATION_GROUP      0x00000006
> +/* OP-TEE extension: log as REE kernel */
> +#define OPTEE_MSG_LOGIN_REE_KERNEL             0x80000000
>
>  /*
>   * Page size used in non-contiguous buffer entries
> --
> 2.17.1
>

^ permalink raw reply	[flat|nested] 6+ messages in thread
* [PATCH 2/2] tee: optee: support session login as REE kernel
  2021-05-17  6:08   ` Jens Wiklander
@ 2021-05-17 17:22     ` Etienne Carriere
  0 siblings, 0 replies; 6+ messages in thread
From: Etienne Carriere @ 2021-05-17 17:22 UTC (permalink / raw)
  To: u-boot

On Mon, 17 May 2021 at 08:08, Jens Wiklander <jens.wiklander@linaro.org> wrote:
>
> On Wed, May 12, 2021 at 5:06 PM Etienne Carriere
> <etienne.carriere@linaro.org> wrote:
> >
> > OP-TEE supports an API extension to allow client to open a TEE session
> > as REE kernel which OP-TEE uses to differentiate client application
> > services from system services that only the REE OS kernel can access.
> >
> > This change allows U-Boot to invoke OP-TEE which such kernel identity
> > and therefore access kernel client specific services.
> >
> > Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
> > ---
> >  drivers/tee/optee/core.c      | 24 +++++++++++++++++++++++-
> >  drivers/tee/optee/optee_msg.h |  2 ++
> >  2 files changed, 25 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
> > index 73dbb22ba0..526bf125a0 100644
> > --- a/drivers/tee/optee/core.c
> > +++ b/drivers/tee/optee/core.c
> > @@ -349,6 +349,28 @@ static int optee_close_session(struct udevice *dev, u32 session)
> >         return 0;
> >  }
> >
> > +static uint32_t optee_login_id(enum tee_session_login login)
> > +{
> > +       /* Treat invalid IDs as public login */
> > +       switch (login) {
> > +       case TEE_SESSION_LOGIN_USER:
> > +               return OPTEE_MSG_LOGIN_USER;
> > +       case TEE_SESSION_LOGIN_GROUP:
> > +               return OPTEE_MSG_LOGIN_GROUP;
> > +       case TEE_SESSION_LOGIN_APPLICATION:
> > +               return OPTEE_MSG_LOGIN_APPLICATION;
> > +       case TEE_SESSION_LOGIN_APPLICATION_USER:
> > +               return OPTEE_MSG_LOGIN_APPLICATION;
> > +       case TEE_SESSION_LOGIN_APPLICATION_GROUP:
> > +               return OPTEE_MSG_LOGIN_APPLICATION;
> > +       case TEE_SESSION_LOGIN_REE_KERNEL:
> > +               return OPTEE_MSG_LOGIN_REE_KERNEL;
> > +       case TEE_SESSION_LOGIN_PUBLIC:
> > +       default:
> > +               return OPTEE_MSG_LOGIN_PUBLIC;
> > +       }
> > +}
> > +
>
> I don't see any point in this translation, we could just as well use
> the correct values from the start.
>
> Cheers,
> Jens

Right, i'll check that.

thanks
etienne

^ permalink raw reply	[flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] tee: define session login identifiers
  2021-05-12 15:05 [PATCH 1/2] tee: define session login identifiers Etienne Carriere
  2021-05-12 15:05 ` [PATCH 2/2] tee: optee: support session login as REE kernel Etienne Carriere
  2021-05-17  6:02 ` [PATCH 1/2] tee: define session login identifiers Jens Wiklander
@ 2021-11-08  9:29 ` Patrick DELAUNAY
  2 siblings, 0 replies; 6+ messages in thread
From: Patrick DELAUNAY @ 2021-11-08  9:29 UTC (permalink / raw)
  To: Etienne Carriere, u-boot; +Cc: Jens Wiklander, Simon Glass

Hi

On 5/12/21 5:05 PM, Etienne Carriere wrote:
> TEE header file defines a clnt_login field in struct tee_open_session_arg
> but does not define the values expected. This change define identifiers
> for the field using a enumerated type. Back end TEE driver is expected to
> convert these IDs into IDs meaningful to the TEE.
>
> Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
> ---
>   include/tee.h | 19 ++++++++++++++++---
>   1 file changed, 16 insertions(+), 3 deletions(-)
>

Reviewed-by: Patrick Delaunay <patrick.delaunay@foss.st.com>

Thanks
Patrick


^ permalink raw reply	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-11-08  9:29 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-12 15:05 [PATCH 1/2] tee: define session login identifiers Etienne Carriere
2021-05-12 15:05 ` [PATCH 2/2] tee: optee: support session login as REE kernel Etienne Carriere
2021-05-17  6:08   ` Jens Wiklander
2021-05-17 17:22     ` Etienne Carriere
2021-05-17  6:02 ` [PATCH 1/2] tee: define session login identifiers Jens Wiklander
2021-11-08  9:29 ` Patrick DELAUNAY

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.