From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1F377C47258 for ; Wed, 31 Jan 2024 18:52:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=HoS6aSzUzrYKmgkT7A+KxkgHQu3JQ9LeXTmGwUoyAE8=; b=tTiR5qBkZ6wimo lyfU2XvxrkOwohaXTHzNOLVlJqprMoPyHSOjaBoA6BkszGNK0s06VMuThFrB/UKSw8QnH0vFkoTzu XIhq0KZOPbEKOQAu/PkrvzIy+yx4CQN4156e1DPM4Sj8UnV/SJrfns4G5hHvC3Qsy5NuCTnNydVkL D8j5EQ85L8l+53tZuFKL/He4qZSpm4cAnVXmm8JJeYcxynTEAvxGsbfm6Z9Wf4kkIDD5Oou1xvu28 J9Gl9AAF1OmCW/yolVCQlItHjHCh5MQgYsL86vOpWeJfnEvDud00zUaXn3KwZvbxgJl6tzr7UPfcn Cv42T8EyMKIIzwhD2kHA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rVFhG-0000000588Y-0lIL; Wed, 31 Jan 2024 18:52:30 +0000 Received: from mail-pf1-x42f.google.com ([2607:f8b0:4864:20::42f]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rVFhD-0000000587Q-1Lkb for linux-arm-kernel@lists.infradead.org; Wed, 31 Jan 2024 18:52:28 +0000 Received: by mail-pf1-x42f.google.com with SMTP id d2e1a72fcca58-6de2f8d6fb9so36664b3a.1 for ; Wed, 31 Jan 2024 10:52:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1706727144; x=1707331944; darn=lists.infradead.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=25r5gOm14IJEMHyveKwAf4p2gsLmehhu/N00VeJ591Y=; b=xBtH9ZyoUSqdWyupeBSpufCQQ5hSuFZr/gr3b4eyFhiCVKPdcdWH5AIbCeQi8MLYe5 QWxwEFW9xEKCGTqFmpsqivpO/zeNrylig54tR86viHeyiFtUv42dTE4VNzIDbV+aiot3 7tPcK15R5dKoxcH0eB1GrJYZfYTJurSDViJoySEUFSdLGd4GJkxwjeTaMMB/AcazkvjX MZ/AlEnsmSSQMWLHQu0T3b7vhemFJ0rxUOz4CPo4Xjo17pWcQYyP2mD1dRXbqXXB+NGv g8H/PoGYzmEOMaVmwwDhBFbGGF8lQS9TyHvfMBR7YPEHJIFTmZVuaZ4oHWiZ5rcs2XGD RQpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1706727144; x=1707331944; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=25r5gOm14IJEMHyveKwAf4p2gsLmehhu/N00VeJ591Y=; b=q4BShs6Rmuz22ie9SqIhnh+K2MEVTD62Zji5coYHe2jEUkLBy0uEh9mald+mFYR4VF 6JXNpSs6ie6HxN6T73rDm6dtiWvRsi2CPnnw9EYDgF/8z2dW8WH/SxxfMwNp3Z14NsCt eH+dmMLzn5XKoDcqADR0u3zPKwYUgc7XhV21hc9TRiYnMrC02vfLxFWG5wr6Kk5i1Uxg rpiujsuDVyjlTQfU88VkwjmxveGdekaQpCzTJBdatgOwHEb+4812BKf4+BAso5vA8Uzi bnMeTX0fTCFL6gLw2l4v92pcyk7LRyYzO5tCWLdRn3kV+eVS1oY1XZ+YPszAnOLoUZHp oPFg== X-Gm-Message-State: AOJu0YwlDn6+3gew/LSze6nspicbAnmqK01CLEkpi2cVUVN/1pzIExIp wXXfVA9WdmA/BoFdyeo3sL5g8qmqPi3+FQlJsqrEPBKH6XCEnO1axnmOEfy7yts= X-Google-Smtp-Source: AGHT+IFt7HhwIpxyhcBUyO5WrVAx3ZZVqZxLhljiEsHbdkGMIfzL6iqPgPDoivsMk5MeYNfBz4nY2A== X-Received: by 2002:a05:6a00:1acf:b0:6df:dfd5:1b1e with SMTP id f15-20020a056a001acf00b006dfdfd51b1emr1625498pfv.7.1706727144422; Wed, 31 Jan 2024 10:52:24 -0800 (PST) Received: from p14s ([2604:3d09:148c:c800:130d:9bb4:89ef:ab9e]) by smtp.gmail.com with ESMTPSA id b185-20020a6334c2000000b0059d6f5196fasm10722471pga.78.2024.01.31.10.52.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 31 Jan 2024 10:52:24 -0800 (PST) Date: Wed, 31 Jan 2024 11:52:21 -0700 From: Mathieu Poirier To: Arnaud POULIQUEN Cc: Bjorn Andersson , Jens Wiklander , Rob Herring , Krzysztof Kozlowski , Conor Dooley , linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org, op-tee@lists.trustedfirmware.org, devicetree@vger.kernel.org Subject: Re: [PATCH v2 4/4] remoteproc: stm32: Add support of an OP-TEE TA to load the firmware Message-ID: References: <20240118100433.3984196-1-arnaud.pouliquen@foss.st.com> <20240118100433.3984196-5-arnaud.pouliquen@foss.st.com> <7ec6c9e8-9267-4e7c-81a4-abcdb2ab4239@foss.st.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <7ec6c9e8-9267-4e7c-81a4-abcdb2ab4239@foss.st.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240131_105227_413900_05BD055D X-CRM114-Status: GOOD ( 56.54 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Tue, Jan 30, 2024 at 10:13:48AM +0100, Arnaud POULIQUEN wrote: > > > On 1/26/24 18:11, Mathieu Poirier wrote: > > On Thu, Jan 18, 2024 at 11:04:33AM +0100, Arnaud Pouliquen wrote: > >> The new TEE remoteproc device is used to manage remote firmware in a > >> secure, trusted context. The 'st,stm32mp1-m4-tee' compatibility is > >> introduced to delegate the loading of the firmware to the trusted > >> execution context. In such cases, the firmware should be signed and > >> adhere to the image format defined by the TEE. > >> > >> Signed-off-by: Arnaud Pouliquen > >> --- > >> V1 to V2 update: > >> - remove the select "TEE_REMOTEPROC" in STM32_RPROC config as detected by > >> the kernel test robot: > >> WARNING: unmet direct dependencies detected for TEE_REMOTEPROC > >> Depends on [n]: REMOTEPROC [=y] && OPTEE [=n] > >> Selected by [y]: > >> - STM32_RPROC [=y] && (ARCH_STM32 || COMPILE_TEST [=y]) && REMOTEPROC [=y] > >> - Fix initialized trproc variable in stm32_rproc_probe > >> --- > >> drivers/remoteproc/stm32_rproc.c | 149 +++++++++++++++++++++++++++++-- > >> 1 file changed, 144 insertions(+), 5 deletions(-) > >> > >> diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c > >> index fcc0001e2657..cf6a21bac945 100644 > >> --- a/drivers/remoteproc/stm32_rproc.c > >> +++ b/drivers/remoteproc/stm32_rproc.c > >> @@ -20,6 +20,7 @@ > >> #include > >> #include > >> #include > >> +#include > >> #include > >> > >> #include "remoteproc_internal.h" > >> @@ -49,6 +50,9 @@ > >> #define M4_STATE_STANDBY 4 > >> #define M4_STATE_CRASH 5 > >> > >> +/* Remote processor unique identifier aligned with the Trusted Execution Environment definitions */ > >> +#define STM32_MP1_M4_PROC_ID 0 > >> + > >> struct stm32_syscon { > >> struct regmap *map; > >> u32 reg; > >> @@ -90,6 +94,8 @@ struct stm32_rproc { > >> struct stm32_mbox mb[MBOX_NB_MBX]; > >> struct workqueue_struct *workqueue; > >> bool hold_boot_smc; > >> + bool fw_loaded; > >> + struct tee_rproc *trproc; > >> void __iomem *rsc_va; > >> }; > >> > >> @@ -257,6 +263,91 @@ static int stm32_rproc_release(struct rproc *rproc) > >> return err; > >> } > >> > >> +static int stm32_rproc_tee_elf_sanity_check(struct rproc *rproc, > >> + const struct firmware *fw) > >> +{ > >> + struct stm32_rproc *ddata = rproc->priv; > >> + unsigned int ret = 0; > >> + > >> + if (rproc->state == RPROC_DETACHED) > >> + return 0; > >> + > >> + ret = tee_rproc_load_fw(ddata->trproc, fw); > >> + if (!ret) > >> + ddata->fw_loaded = true; > >> + > >> + return ret; > >> +} > >> + > >> +static int stm32_rproc_tee_elf_load(struct rproc *rproc, > >> + const struct firmware *fw) > >> +{ > >> + struct stm32_rproc *ddata = rproc->priv; > >> + unsigned int ret; > >> + > >> + /* > >> + * This function can be called by remote proc for recovery > >> + * without the sanity check. In this case we need to load the firmware > >> + * else nothing done here as the firmware has been preloaded for the > >> + * sanity check to be able to parse it for the resource table. > >> + */ > > > > This comment is very confusing - please consider refactoring. > > > >> + if (ddata->fw_loaded) > >> + return 0; > >> + > > > > I'm not sure about keeping a flag to indicate the status of the loaded firmware. > > It is not done for the non-secure method, I don't see why it would be needed for > > the secure one. > > > > The difference is on the sanity check. > - in rproc_elf_sanity_check we parse the elf file to verify that it is > valid. > - in stm32_rproc_tee_elf_sanity_check we have to do the same, that means to > authenticate it. the authentication is done during the load. > > So this flag is used to avoid to reload it twice time. > refactoring the comment should help to understand this flag > > > An alternative would be to bypass the sanity check. But this lead to same > limitation. > Before loading the firmware in remoteproc_core, we call rproc_parse_fw() that is > used to get the resource table address. To get it from tee we need to > authenticate the firmware so load it... > I spent a long time thinking about this patchset. Looking at the code as it is now, request_firmware() in rproc_boot() is called even when the TEE is responsible for loading the firmware. There should be some conditional code that calls either request_firmware() or tee_rproc_load_fw(). The latter should also be renamed to tee_rproc_request_firmware() to avoid confusion. I touched on that before but please rename rproc_tee_get_rsc_table() to rproc_tee_elf_load_rsc_table(). I also suggest to introduce a new function, rproc_tee_get_loaded_rsc_table() that would be called from rproc_tee_elf_load_rsc_table(). That way we don't need trproc->rsc_va. I also think tee_rproc should be renamed to "rproc_tee_interface" and folded under struct rproc. With the above most of the problems with the current implementation should naturally go away. Thanks, Mathieu > > >> + ret = tee_rproc_load_fw(ddata->trproc, fw); > >> + if (ret) > >> + return ret; > >> + ddata->fw_loaded = true; > >> + > >> + /* Update the resource table parameters. */ > >> + if (rproc_tee_get_rsc_table(ddata->trproc)) { > >> + /* No resource table: reset the related fields. */ > >> + rproc->cached_table = NULL; > >> + rproc->table_ptr = NULL; > >> + rproc->table_sz = 0; > >> + } > >> + > >> + return 0; > >> +} > >> + > >> +static struct resource_table * > >> +stm32_rproc_tee_elf_find_loaded_rsc_table(struct rproc *rproc, > >> + const struct firmware *fw) > >> +{ > >> + struct stm32_rproc *ddata = rproc->priv; > >> + > >> + return tee_rproc_get_loaded_rsc_table(ddata->trproc); > >> +} > >> + > >> +static int stm32_rproc_tee_start(struct rproc *rproc) > >> +{ > >> + struct stm32_rproc *ddata = rproc->priv; > >> + > >> + return tee_rproc_start(ddata->trproc); > >> +} > >> + > >> +static int stm32_rproc_tee_attach(struct rproc *rproc) > >> +{ > >> + /* Nothing to do, remote proc already started by the secured context. */ > >> + return 0; > >> +} > >> + > >> +static int stm32_rproc_tee_stop(struct rproc *rproc) > >> +{ > >> + struct stm32_rproc *ddata = rproc->priv; > >> + int err; > >> + > >> + stm32_rproc_request_shutdown(rproc); > >> + > >> + err = tee_rproc_stop(ddata->trproc); > >> + if (err) > >> + return err; > >> + > >> + ddata->fw_loaded = false; > >> + > >> + return stm32_rproc_release(rproc); > >> +} > >> + > >> static int stm32_rproc_prepare(struct rproc *rproc) > >> { > >> struct device *dev = rproc->dev.parent; > >> @@ -319,7 +410,14 @@ static int stm32_rproc_prepare(struct rproc *rproc) > >> > >> static int stm32_rproc_parse_fw(struct rproc *rproc, const struct firmware *fw) > >> { > >> - if (rproc_elf_load_rsc_table(rproc, fw)) > >> + struct stm32_rproc *ddata = rproc->priv; > >> + int ret; > >> + > >> + if (ddata->trproc) > >> + ret = rproc_tee_get_rsc_table(ddata->trproc); > >> + else > >> + ret = rproc_elf_load_rsc_table(rproc, fw); > >> + if (ret) > >> dev_warn(&rproc->dev, "no resource table found for this firmware\n"); > >> > >> return 0; > >> @@ -693,8 +791,22 @@ static const struct rproc_ops st_rproc_ops = { > >> .get_boot_addr = rproc_elf_get_boot_addr, > >> }; > >> > >> +static const struct rproc_ops st_rproc_tee_ops = { > >> + .prepare = stm32_rproc_prepare, > >> + .start = stm32_rproc_tee_start, > >> + .stop = stm32_rproc_tee_stop, > >> + .attach = stm32_rproc_tee_attach, > >> + .kick = stm32_rproc_kick, > >> + .parse_fw = stm32_rproc_parse_fw, > >> + .find_loaded_rsc_table = stm32_rproc_tee_elf_find_loaded_rsc_table, > >> + .get_loaded_rsc_table = stm32_rproc_get_loaded_rsc_table, > >> + .sanity_check = stm32_rproc_tee_elf_sanity_check, > >> + .load = stm32_rproc_tee_elf_load, > >> +}; > >> + > >> static const struct of_device_id stm32_rproc_match[] = { > >> - { .compatible = "st,stm32mp1-m4" }, > >> + {.compatible = "st,stm32mp1-m4",}, > >> + {.compatible = "st,stm32mp1-m4-tee",}, > >> {}, > >> }; > >> MODULE_DEVICE_TABLE(of, stm32_rproc_match); > >> @@ -853,6 +965,7 @@ static int stm32_rproc_probe(struct platform_device *pdev) > >> struct device *dev = &pdev->dev; > >> struct stm32_rproc *ddata; > >> struct device_node *np = dev->of_node; > >> + struct tee_rproc *trproc = NULL; > >> struct rproc *rproc; > >> unsigned int state; > >> int ret; > >> @@ -861,11 +974,31 @@ static int stm32_rproc_probe(struct platform_device *pdev) > >> if (ret) > >> return ret; > >> > >> - rproc = rproc_alloc(dev, np->name, &st_rproc_ops, NULL, sizeof(*ddata)); > >> - if (!rproc) > >> - return -ENOMEM; > >> + if (of_device_is_compatible(np, "st,stm32mp1-m4-tee")) { > >> + trproc = tee_rproc_register(dev, STM32_MP1_M4_PROC_ID); > >> + if (IS_ERR(trproc)) { > >> + dev_err_probe(dev, PTR_ERR(trproc), > >> + "signed firmware not supported by TEE\n"); > >> + return PTR_ERR(trproc); > >> + } > >> + /* > >> + * Delegate the firmware management to the secure context. > >> + * The firmware loaded has to be signed. > >> + */ > >> + dev_info(dev, "Support of signed firmware only\n"); > > > > Not sure what this adds. Please remove. > > This is used to inform the user that only a signed firmware can be loaded, not > an ELF file. > I have a patch in my pipe to provide the supported format in the debugfs. In a > first step, I can suppress this message and we can revisit the issue when I push > the debugfs proposal. > > Thanks, > Arnaud > > > > >> + } > >> + rproc = rproc_alloc(dev, np->name, > >> + trproc ? &st_rproc_tee_ops : &st_rproc_ops, > >> + NULL, sizeof(*ddata)); > >> + if (!rproc) { > >> + ret = -ENOMEM; > >> + goto free_tee; > >> + } > >> > >> ddata = rproc->priv; > >> + ddata->trproc = trproc; > >> + if (trproc) > >> + trproc->rproc = rproc; > >> > >> rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE); > >> > >> @@ -916,6 +1049,10 @@ static int stm32_rproc_probe(struct platform_device *pdev) > >> device_init_wakeup(dev, false); > >> } > >> rproc_free(rproc); > >> +free_tee: > >> + if (trproc) > >> + tee_rproc_unregister(trproc); > >> + > >> return ret; > >> } > >> > >> @@ -937,6 +1074,8 @@ static void stm32_rproc_remove(struct platform_device *pdev) > >> device_init_wakeup(dev, false); > >> } > >> rproc_free(rproc); > >> + if (ddata->trproc) > >> + tee_rproc_unregister(ddata->trproc); > >> } > >> > >> static int stm32_rproc_suspend(struct device *dev) > >> -- > >> 2.25.1 > >> _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel