mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Rouven Czerwinski <r.czerwinski@pengutronix.de>
To: barebox@lists.infradead.org
Cc: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Subject: [PATCH v3 3/5] ARM: add optee early loading function
Date: Tue, 28 Jan 2020 06:38:20 +0100	[thread overview]
Message-ID: <20200128053821.677207-4-r.czerwinski@pengutronix.de> (raw)
In-Reply-To: <20200128053821.677207-1-r.czerwinski@pengutronix.de>

Add a OP-TEE early loading function which expects a pointer to a valid
tee binary and the device tree. OP-TEE will then be started and barebox
will continue to run in normal mode.

The function start_optee_early should be used in a boards lowlevel.c
file. Ensure that barebox has been relocated and a proper c environment
has been setup beforehand. Depending on the OP-TEE configuration, the
fdt will be modified. If the internal barebox device tree is passed,
OP-TEE will overwrite barebox PBL memory during this modification. Copy
the fdt to a save memory location beforehand to avoid a corruption of
barebox PBL memory.

This also moves the OP-TEE Kconfig symbols into a separate menu.

Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
---
 arch/arm/lib32/Makefile             |  2 ++
 arch/arm/lib32/optee-early.c        | 38 ++++++++++++++++++++
 common/Kconfig                      | 54 ++++++++++++++++++-----------
 common/Makefile                     |  1 +
 include/asm-generic/memory_layout.h |  4 +--
 include/tee/optee.h                 |  6 ++++
 6 files changed, 82 insertions(+), 23 deletions(-)
 create mode 100644 arch/arm/lib32/optee-early.c

diff --git a/arch/arm/lib32/Makefile b/arch/arm/lib32/Makefile
index cfcf3bc8f1..597bc07905 100644
--- a/arch/arm/lib32/Makefile
+++ b/arch/arm/lib32/Makefile
@@ -30,3 +30,5 @@ pbl-y	+= ashldi3.o
 pbl-y	+= div0.o
 
 obj-pbl-y	+= setjmp.o
+
+pbl-$(CONFIG_PBL_OPTEE)	+= optee-early.o
diff --git a/arch/arm/lib32/optee-early.c b/arch/arm/lib32/optee-early.c
new file mode 100644
index 0000000000..197325b8a0
--- /dev/null
+++ b/arch/arm/lib32/optee-early.c
@@ -0,0 +1,38 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * optee-early.c - start OP-TEE during PBL
+ *
+ * Copyright (c) 2019 Rouven Czerwinski <r.czerwinski@pengutronix.de>, Pengutronix
+ *
+ */
+#include <asm/cache.h>
+#include <asm/setjmp.h>
+#include <tee/optee.h>
+#include <debug_ll.h>
+
+static jmp_buf tee_buf;
+
+int start_optee_early(void *fdt, void *tee)
+{
+	void (*tee_start)(void *r0, void *r1, void *r2);
+	struct optee_header *hdr;
+	int ret;
+
+	hdr = tee;
+	ret = optee_verify_header(hdr);
+	if (ret < 0)
+		return ret;
+
+	memcpy((void *)hdr->init_load_addr_lo, tee + sizeof(*hdr), hdr->init_size);
+	tee_start = (void *) hdr->init_load_addr_lo;
+
+	/* We use setjmp/longjmp here because OP-TEE clobbers most registers */
+	ret = setjmp(tee_buf);
+	if (ret == 0) {
+		sync_caches_for_execution();
+		tee_start(0, 0, fdt);
+		longjmp(tee_buf, 1);
+	}
+
+	return 0;
+}
diff --git a/common/Kconfig b/common/Kconfig
index 60237d3056..25587d1927 100644
--- a/common/Kconfig
+++ b/common/Kconfig
@@ -643,27 +643,6 @@ config BOOTM_FORCE_SIGNED_IMAGES
 	  are refused to boot. Effectively this means only FIT images can be booted
 	  since they are the only supported image type that support signing.
 
-config BOOTM_OPTEE
-	bool
-	prompt "support booting OP-TEE"
-	depends on BOOTM && ARM
-	help
-	  OP-TEE is a trusted execution environment (TEE). With this option
-	  enabled barebox supports starting optee_os as part of the bootm command.
-	  Instead of the kernel bootm starts the optee_os binary which then starts
-	  the kernel in nonsecure mode. Pass the optee_os binary with the -t option
-	  or in the global.bootm.tee variable.
-
-config BOOTM_OPTEE_SIZE
-	hex
-	default 0x02000000
-	prompt "OP-TEE Memory Size"
-	depends on BOOTM_OPTEE
-	help
-	  Size to reserve in main memory for OP-TEE.
-	  Can be smaller than the actual size used by OP-TEE, this is used to prevent
-	  barebox from allocating memory in this area.
-
 config BLSPEC
 	depends on FLEXIBLE_BOOTARGS
 	depends on !SHELL_NONE
@@ -1000,6 +979,39 @@ config MACHINE_ID
 	  Note: if no hashable information is available no machine id will be passed
 	  to the kernel.
 
+menu "OP-TEE loading"
+
+config OPTEE_SIZE
+	hex
+	default 0x02000000
+	prompt "OP-TEE Memory Size"
+	depends on BOOTM_OPTEE || PBL_OPTEE
+	help
+	  Size to reserve in main memory for OP-TEE.
+	  Can be smaller than the actual size used by OP-TEE, this is used to prevent
+	  barebox from allocating memory in this area.
+
+config BOOTM_OPTEE
+	bool
+	prompt "support booting OP-TEE"
+	depends on BOOTM && ARM
+	help
+	  OP-TEE is a trusted execution environment (TEE). With this option
+	  enabled barebox supports starting optee_os as part of the bootm command.
+	  Instead of the kernel bootm starts the optee_os binary which then starts
+	  the kernel in nonsecure mode. Pass the optee_os binary with the -t option
+	  or in the global.bootm.tee variable.
+
+config PBL_OPTEE
+	bool "Enable OP-TEE early start"
+	depends on ARM
+	depends on !THUMB2_BAREBOX
+	help
+	  Allows starting OP-TEE during lowlevel initialization of the PBL.
+	  Requires explicit support in the boards lowlevel file.
+
+endmenu
+
 endmenu
 
 menu "Debugging"
diff --git a/common/Makefile b/common/Makefile
index fbdd74a9fd..8312e88572 100644
--- a/common/Makefile
+++ b/common/Makefile
@@ -66,6 +66,7 @@ obj-$(CONFIG_BAREBOX_UPDATE_IMX_NAND_FCB) += imx-bbu-nand-fcb.o
 obj-$(CONFIG_BOOT)		+= boot.o
 obj-$(CONFIG_SERIAL_DEV_BUS)	+= serdev.o
 obj-$(CONFIG_USBGADGET_START)	+= usbgadget.o
+pbl-$(CONFIG_PBL_OPTEE)		+= optee.o
 obj-$(CONFIG_BOOTM_OPTEE)	+= optee.o
 
 ifdef CONFIG_PASSWORD
diff --git a/include/asm-generic/memory_layout.h b/include/asm-generic/memory_layout.h
index 3f69664aa0..0d7ce3fe02 100644
--- a/include/asm-generic/memory_layout.h
+++ b/include/asm-generic/memory_layout.h
@@ -11,8 +11,8 @@
 #define MALLOC_BASE CONFIG_MALLOC_BASE
 #endif
 
-#ifdef CONFIG_BOOTM_OPTEE_SIZE
-#define OPTEE_SIZE CONFIG_BOOTM_OPTEE_SIZE
+#ifdef CONFIG_OPTEE_SIZE
+#define OPTEE_SIZE CONFIG_OPTEE_SIZE
 #else
 #define OPTEE_SIZE 0
 #endif
diff --git a/include/tee/optee.h b/include/tee/optee.h
index 9fb27fcec0..fa124236ba 100644
--- a/include/tee/optee.h
+++ b/include/tee/optee.h
@@ -32,4 +32,10 @@ struct optee_header {
 
 int optee_verify_header (struct optee_header *hdr);
 
+#ifdef __PBL__
+
+int start_optee_early(void* fdt, void* tee);
+
+#endif /* __PBL__ */
+
 #endif /* _OPTEE_H */
-- 
2.25.0


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

  parent reply	other threads:[~2020-01-28  5:38 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-01-28  5:38 [PATCH v3 0/5] OP-TEE early loading Rouven Czerwinski
2020-01-28  5:38 ` [PATCH v3 1/5] optee: move optee_verify_header() to common Rouven Czerwinski
2020-01-28  6:19   ` Ahmad Fatoum
2020-01-28  9:23     ` Sascha Hauer
2020-01-28  5:38 ` [PATCH v3 2/5] ARM: import setjmp implementation from U-Boot Rouven Czerwinski
2020-01-28  5:38 ` Rouven Czerwinski [this message]
2020-01-28  5:38 ` [PATCH v3 4/5] ARM: mach-imx: test PL310 write access Rouven Czerwinski
2020-01-28  5:38 ` [PATCH v3 5/5] user: add documentation for OP-TEE loading Rouven Czerwinski
2020-01-28  9:23 ` [PATCH v3 0/5] OP-TEE early loading Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200128053821.677207-4-r.czerwinski@pengutronix.de \
    --to=r.czerwinski@pengutronix.de \
    --cc=barebox@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox