All of lore.kernel.org
 help / color / mirror / Atom feed
* [RFC PATCH 0/3] Generic TrustZone Driver in Linux Kernel
@ 2014-11-28 15:03 Javier González
  2014-11-28 15:03 ` [RFC PATCH 1/3] Add generic TrustZone driver Javier González
                   ` (3 more replies)
  0 siblings, 4 replies; 11+ messages in thread
From: Javier González @ 2014-11-28 15:03 UTC (permalink / raw)
  To: linux-security-module, linux-kernel, gregkh, joshc,
	johannes.thumshirn, kheitke, laurent.pinchart+renesas,
	geert+renesas, horms+renesas, damm, tomi.valkeinen, mbohan,
	michal.simek
  Cc: pawel.moll, Andrew.Thoelke, javier

Hi all,

This set of patches is a first iteration to introduce a generic
TrustZone driver to the Linux Kernel. Since there is no place to add
drivers related to secure processors, a new subsystem for secure
hardware in general (drivers/sechw) is also introduced. TPM is a good
candidate to me moved here if this change is accepted.

Today, TrustZone solutions are implementation specific. In user space,
mobile devices are normally compliant with Global Platform's API
<http://www.globalplatform.org>. However, there is no common TrustZone
interface for kernel space, as it exists for Trusted Computing Module
(TPM). As a result, different TrustZone frameworks use different kernel
loadable modules to provide the context to communicate with the Trusted
Execution Environment leveraged by TrustZone's secure world.

Regarding use cases, TrustZone has traditionally been used for
offloading secure tasks to the secure world. Examples include banking
applications, Digital Rights Management (DRM), or specific secure
solutions. As more and more frameworks enabling TrustZone appear, new
use cases are starting to emerge: key management, encryption, integrity
checking, etc. Extreme cases today involve running a RTOS in the secure
world, or using the secure world toimplement usage control policies
governing the normal world. The advent of ARMv8 will only expand this
list.

This set of patches introduce a generic TrustZone driver for kernel
space. The first design goal is to be flexible enough as to NOT
introduce policy regarding the TrustZone interface. In this way, we
introduce a session-based open/close read/write interface where
several TrustZone drivers can potentially be used. The design is
simple and it consist on an interface that different TrustZone drivers
can implement to communicate with the specific frameworks.

Major TODO's:
 * Patch has TODOs, FIXMEs and XXXs that need to be cleaned.
 * Refactor part of Open Virtualization's driver. Some part are complex
 * and can be simplified.
 * Add support for different boards. At the moment only zynq-7000 ZC702
 is supported. A sepparate patch containing the patch for ZC702 will be
 sent sepparately - rebasing from 3.8 to 3.17 at the moment.

Development is taking place at:
	https://github.com/TrustZoneGenericDriver/linux-xlnx tz_driver
At 14.5_trd_tz_driver_generic it can be found the same driver together
with TEE support for Zynq ZC702 in 3.8

Since all testing is being done in the Xilinx ZC702 board, using
Xilinx's Linux tree is convenient. Once the board rebasing to 3.17 is
completed, development will move to:
	https://github.com/TrustZoneGenericDriver/linux

Feedback regarding the code, the interface, or its placement in
drivers/sechw is more than welcome. The idea is to refine ths TrustZone
driver while working on supporting more targets.

Thanks,

Javier.

Javier Gonzalez (3):
  Add generic TrustZone driver
  Open Virtualization driver
  TrustZone driver: wrap OV driver

 drivers/Kconfig                           |    2 +
 drivers/Makefile                          |    2 +
 drivers/sechw/Kconfig                     |   11 +
 drivers/sechw/Makefile                    |    5 +
 drivers/sechw/trustzone/Kconfig           |   32 +
 drivers/sechw/trustzone/Makefile          |    8 +
 drivers/sechw/trustzone/otz_api.h         | 1318 ++++++++++
 drivers/sechw/trustzone/otz_client.h      |  127 +
 drivers/sechw/trustzone/otz_client_main.c | 3803 +++++++++++++++++++++++++++++
 drivers/sechw/trustzone/otz_common.h      |  112 +
 drivers/sechw/trustzone/otz_id.h          |  246 ++
 drivers/sechw/trustzone/smc_id.h          |   75 +
 drivers/sechw/trustzone/sw_common_types.h |   35 +
 drivers/sechw/trustzone/sw_config.h       |   40 +
 drivers/sechw/trustzone/trustzone.c       |  349 +++
 drivers/sechw/trustzone/trustzone.h       |   68 +
 include/linux/trustzone.h                 |   95 +
 17 files changed, 6328 insertions(+)

-- 
1.9.1



^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2014-11-30 12:15 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-11-28 15:03 [RFC PATCH 0/3] Generic TrustZone Driver in Linux Kernel Javier González
2014-11-28 15:03 ` [RFC PATCH 1/3] Add generic TrustZone driver Javier González
2014-11-28 19:15   ` Greg KH
2014-11-28 21:09     ` Javier González
2014-11-28 22:16       ` Greg KH
2014-11-28 22:41         ` Javier González
2014-11-28 15:03 ` [RFC PATCH 2/3] Open Virtualization driver Javier González
2014-11-28 15:03 ` [RFC PATCH 3/3] TrustZone driver: wrap OV driver Javier González
2014-11-29 18:18 ` [RFC PATCH 0/3] Generic TrustZone Driver in Linux Kernel Jason Cooper
2014-11-29 18:48   ` Greg KH
2014-11-30 12:14   ` Javier González

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.