From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 8B280C5478C for ; Fri, 23 Feb 2024 18:38:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=4zA11EfEgndU+MnIlXYVFccmAjwg+aomxr2PK/9SOQM=; b=EWZP93KCQhASoy Q3b/aw5N5hwWB5Zvh7B5HcI5Qf7AmpJpxfJDmYv7GF0Lq5AlFe08t5/Mv/T5W8FEn0eNkwIMw9yud 8+Yct4eptUZlvu+Qv8dUiR/fhEwyLift3lCuwUvX68230vLA4HDCci8+gp+RcXuPu225JxsnGy45A a8GYEXqvMgzAGy+O+FG72JatZtHTDH2Cz3vPmztXTkr/iKuwa6GY7o3GxQNVgPN/AtBygjhi57ZVZ U6TlqoWfbdL1keV5av3YbtdAXlDtqqt4/BwWAe7axYzFmPkxNp6YnKqm1lXZMSDjAmqKPqPO//Owe 20Mo3nKlGf9B5wDmYJBA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.97.1 #2 (Red Hat Linux)) id 1rdaR1-0000000Asjc-3Rll; Fri, 23 Feb 2024 18:38:11 +0000 Received: from mail-pl1-x632.google.com ([2607:f8b0:4864:20::632]) by bombadil.infradead.org with esmtps (Exim 4.97.1 #2 (Red Hat Linux)) id 1rdaQS-0000000AsVj-1Q1m for linux-arm-kernel@lists.infradead.org; Fri, 23 Feb 2024 18:37:38 +0000 Received: by mail-pl1-x632.google.com with SMTP id d9443c01a7336-1d71cb97937so12723865ad.3 for ; Fri, 23 Feb 2024 10:37:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1708713452; x=1709318252; darn=lists.infradead.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=KZoiqAY2Uur/aGWMy2naDtSDhhq1uQ0pWzfI5wkuDOg=; b=lp+IBXqvMUsiENfpKANsbjg40XN1HR3hOFjhrz0q8XzqaOKIqcbEjotJfzA7AjV74A stH46OmIo2khWcpbTky+QEwRsZKophQrkSAehL5Qj0Pwv7XIbCWC8cniZONt5Okqq7JT n3fCSwzC1hMDl4BoiZqyEicRhTMluis50hpPRA7MnlGXJmBdWtj1XkWQyGVbHxhC7eKm iM7Vk/JMPhOZjdp+kmDkm0sx7N3j/59dhS5KmaRtnt0eZ1GK40+8QCUmLV+RUg7ZmFoy bLL/D1GTj7HaPqE5bQ9ACr6zG+cIl9Ee52TbAPK3KdUIzcdtLBcGWjo1F24FAP9ge6El O/qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1708713452; x=1709318252; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=KZoiqAY2Uur/aGWMy2naDtSDhhq1uQ0pWzfI5wkuDOg=; b=EYciy3a1SJxhUtoZclDqCU3OywYSoXkrgRwR1t4uZ7o5DtHQklvQgs7nUsPbG5AMbH 57m6++5vhmp+aMVRg5xYxGkCvBEd/Vuy/9FLPO/geAb9PP+IisOB+TUZoTHWQAelQxv1 SkyV9AsqARFB/33viHBqWOTZUHQ7t0twg3a6zdscF2wysGwJ0wUvXn8AXk5zsW41DG6B RuDEHoPp7Dz8g9apn4KaXz1N1zlrOuuVR2O0cDC6LnkWp4+OfR54t2P0rx7R5dv7jzvH pws5UmMy/btc9b8f7ZTpr0l1HxgC9h/0BSrSoZeCsrl9cGpoCjZDYd1UwG2sF7rKqclx ByYw== X-Forwarded-Encrypted: i=1; AJvYcCXL1rtZFZp/J+ML9nvMpBQerQTHHT9/7PFE0lWuSKMwo6WhKS8Ria7G39ocmatxcKekPF7Zt8NyqUIQUAIJGXUDgsMxpJG0yI50MaUTv532Qkx0vKg= X-Gm-Message-State: AOJu0YzWx1cM0oHXPrkEr4QSGeAIIKAMU2GmdZW3Yu+m0Qd/yWxHOCO1 EETAIf+GDXvIDFcmViJS7zg/Tc3VE+D1CbTCfdJhheXHJFfbnAVrFfDpn4laUc4= X-Google-Smtp-Source: AGHT+IEFnq/adSWGsq0T7PG+TvSPinae6jkrUQ6p7/FCofH5i6KR3wHNsGv2ykbTotKDS+HU96hvow== X-Received: by 2002:a17:902:c146:b0:1dc:5ae8:174c with SMTP id 6-20020a170902c14600b001dc5ae8174cmr624284plj.17.1708713452286; Fri, 23 Feb 2024 10:37:32 -0800 (PST) Received: from p14s ([2604:3d09:148c:c800:a9ba:9d9e:b797:23f1]) by smtp.gmail.com with ESMTPSA id kb6-20020a170903338600b001db5bdd5e3bsm12042829plb.13.2024.02.23.10.37.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 23 Feb 2024 10:37:31 -0800 (PST) Date: Fri, 23 Feb 2024 11:37:29 -0700 From: Mathieu Poirier To: Arnaud POULIQUEN Cc: Bjorn Andersson , Jens Wiklander , Rob Herring , Krzysztof Kozlowski , Conor Dooley , linux-stm32@st-md-mailman.stormreply.com, linux-arm-kernel@lists.infradead.org, linux-remoteproc@vger.kernel.org, linux-kernel@vger.kernel.org, op-tee@lists.trustedfirmware.org, devicetree@vger.kernel.org Subject: Re: [PATCH v3 7/7] remoteproc: stm32: Add support of an OP-TEE TA to load the firmware Message-ID: References: <20240214172127.1022199-1-arnaud.pouliquen@foss.st.com> <20240214172127.1022199-8-arnaud.pouliquen@foss.st.com> <609373ba-c81d-4aee-81cb-8628e2c6897b@foss.st.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <609373ba-c81d-4aee-81cb-8628e2c6897b@foss.st.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20240223_103736_727991_5AE3D188 X-CRM114-Status: GOOD ( 48.76 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Fri, Feb 23, 2024 at 02:54:13PM +0100, Arnaud POULIQUEN wrote: > Hello Mathieu, > > On 2/22/24 20:02, Mathieu Poirier wrote: > > Hi, > > > > On Wed, Feb 14, 2024 at 06:21:27PM +0100, Arnaud Pouliquen wrote: > >> The new TEE remoteproc device is used to manage remote firmware in a > >> secure, trusted context. The 'st,stm32mp1-m4-tee' compatibility is > >> introduced to delegate the loading of the firmware to the trusted > >> execution context. In such cases, the firmware should be signed and > >> adhere to the image format defined by the TEE. > >> > >> A new "to_attach" field is introduced to differentiate the use cases > >> "firmware loaded by the boot stage" and "firmware loaded by the TEE". > >> > >> Signed-off-by: Arnaud Pouliquen > >> --- > >> V2 to V3 update: > >> - remove stm32_rproc_tee_elf_sanity_check(), stm32_rproc_tee_elf_load() > >> stm32_rproc_tee_elf_find_loaded_rsc_table() and stm32_rproc_tee_start() that are bnow unused > >> - use new rproc::alt_boot field to sepcify that the alternate fboot method is used > >> - use stm32_rproc::to_attach field to differenciate attch mode from remoteproc tee boot mode. > >> - remove the used of stm32_rproc::fw_loaded > >> --- > >> drivers/remoteproc/stm32_rproc.c | 85 +++++++++++++++++++++++++++++--- > >> 1 file changed, 79 insertions(+), 6 deletions(-) > >> > >> diff --git a/drivers/remoteproc/stm32_rproc.c b/drivers/remoteproc/stm32_rproc.c > >> index fcc0001e2657..9cfcf66462e0 100644 > >> --- a/drivers/remoteproc/stm32_rproc.c > >> +++ b/drivers/remoteproc/stm32_rproc.c > >> @@ -20,6 +20,7 @@ > >> #include > >> #include > >> #include > >> +#include > >> #include > >> > >> #include "remoteproc_internal.h" > >> @@ -49,6 +50,9 @@ > >> #define M4_STATE_STANDBY 4 > >> #define M4_STATE_CRASH 5 > >> > >> +/* Remote processor unique identifier aligned with the Trusted Execution Environment definitions */ > >> +#define STM32_MP1_M4_PROC_ID 0 > >> + > >> struct stm32_syscon { > >> struct regmap *map; > >> u32 reg; > >> @@ -90,6 +94,8 @@ struct stm32_rproc { > >> struct stm32_mbox mb[MBOX_NB_MBX]; > >> struct workqueue_struct *workqueue; > >> bool hold_boot_smc; > >> + bool to_attach; > >> + struct tee_rproc *trproc; > >> void __iomem *rsc_va; > >> }; > >> > >> @@ -253,10 +259,30 @@ static int stm32_rproc_release(struct rproc *rproc) > >> return err; > >> } > >> } > >> + ddata->to_attach = false; > >> > >> return err; > >> } > >> > >> +static int stm32_rproc_tee_attach(struct rproc *rproc) > >> +{ > >> + /* Nothing to do, remote proc already started by the secured context. */ > >> + return 0; > >> +} > >> + > >> +static int stm32_rproc_tee_stop(struct rproc *rproc) > >> +{ > >> + int err; > >> + > >> + stm32_rproc_request_shutdown(rproc); > >> + > >> + err = tee_rproc_stop(rproc); > >> + if (err) > >> + return err; > >> + > >> + return stm32_rproc_release(rproc); > >> +} > >> + > >> static int stm32_rproc_prepare(struct rproc *rproc) > >> { > >> struct device *dev = rproc->dev.parent; > >> @@ -637,10 +663,14 @@ stm32_rproc_get_loaded_rsc_table(struct rproc *rproc, size_t *table_sz) > >> { > >> struct stm32_rproc *ddata = rproc->priv; > >> struct device *dev = rproc->dev.parent; > >> + struct tee_rproc *trproc = ddata->trproc; > >> phys_addr_t rsc_pa; > >> u32 rsc_da; > >> int err; > >> > >> + if (trproc && !ddata->to_attach) > >> + return tee_rproc_get_loaded_rsc_table(rproc, table_sz); > >> + > > > > Why do we need a flag at all? Why can't st_rproc_tee_ops::get_loaded_rsc_table > > be set to tee_rproc_get_loaded_rsc_table()? > > > This function is used to retrieve the address of the resource table in 3 cases > - attach to a firmware started by the boot loader (U-boot). > - load of the firmware by OP-TEE. > - crash recovery on a signed firmware started by the boot loader. > > The flag is used to differentiate the attch from the other uses cases > For instance we support this use case. > 1) attach to the firmware on boot > 2) crash during runtime > 2a) stop the firmware by OP-TEE( ddata->to_attach set to 0) > 2b) load the firmware by OP-TEE > 2c) get the loaded resource table from OP-TEE (we can not guaranty > that the firmware loaded on recovery is the same) > 2d) restart the firmware by OP-TEE This is not maintainable and needs to be broken down into smaller building blocks. The introduction of tee_rproc_parse_fw() should help dealing with some of the complexity. > > > > >> /* The resource table has already been mapped, nothing to do */ > >> if (ddata->rsc_va) > >> goto done; > >> @@ -693,8 +723,20 @@ static const struct rproc_ops st_rproc_ops = { > >> .get_boot_addr = rproc_elf_get_boot_addr, > >> }; > >> > >> +static const struct rproc_ops st_rproc_tee_ops = { > >> + .prepare = stm32_rproc_prepare, > >> + .start = tee_rproc_start, > >> + .stop = stm32_rproc_tee_stop, > >> + .attach = stm32_rproc_tee_attach, > >> + .kick = stm32_rproc_kick, > >> + .get_loaded_rsc_table = stm32_rproc_get_loaded_rsc_table, > >> + .find_loaded_rsc_table = tee_rproc_find_loaded_rsc_table, > >> + .load = tee_rproc_load_fw, > >> +}; > >> + > >> static const struct of_device_id stm32_rproc_match[] = { > >> - { .compatible = "st,stm32mp1-m4" }, > >> + {.compatible = "st,stm32mp1-m4",}, > >> + {.compatible = "st,stm32mp1-m4-tee",}, > >> {}, > >> }; > >> MODULE_DEVICE_TABLE(of, stm32_rproc_match); > >> @@ -853,6 +895,7 @@ static int stm32_rproc_probe(struct platform_device *pdev) > >> struct device *dev = &pdev->dev; > >> struct stm32_rproc *ddata; > >> struct device_node *np = dev->of_node; > >> + struct tee_rproc *trproc = NULL; > >> struct rproc *rproc; > >> unsigned int state; > >> int ret; > >> @@ -861,12 +904,33 @@ static int stm32_rproc_probe(struct platform_device *pdev) > >> if (ret) > >> return ret; > >> > >> - rproc = rproc_alloc(dev, np->name, &st_rproc_ops, NULL, sizeof(*ddata)); > >> - if (!rproc) > >> - return -ENOMEM; > > > > This patch doesn't apply to rproc-next - please rebase. > > Yes, sure. I forgot to mention in my cover letter that my series has been > applied and tested on 841c35169323 (Linux 6.8-rc4). > > > > > > >> + if (of_device_is_compatible(np, "st,stm32mp1-m4-tee")) { > >> + /* > >> + * Delegate the firmware management to the secure context. > >> + * The firmware loaded has to be signed. > >> + */ > >> + trproc = tee_rproc_register(dev, STM32_MP1_M4_PROC_ID); > >> + if (IS_ERR(trproc)) { > >> + dev_err_probe(dev, PTR_ERR(trproc), > >> + "signed firmware not supported by TEE\n"); > >> + return PTR_ERR(trproc); > >> + } > >> + } > >> > >> - ddata = rproc->priv; > >> + rproc = rproc_alloc(dev, np->name, > >> + trproc ? &st_rproc_tee_ops : &st_rproc_ops, > >> + NULL, sizeof(*ddata)); > >> + if (!rproc) { > >> + ret = -ENOMEM; > >> + goto free_tee; > >> + } > >> > >> + ddata = rproc->priv; > >> + ddata->trproc = trproc; > > > > My opinion hasn't changed from the previous patchet, i.e tee_rproc should be > > folded in struct rproc as rproc::tee_interface. > > Sure, I will do it in next version > > > > > More comments to come shortly... > > > > Thanks! > Arnaud > > >> + if (trproc) { > >> + rproc->alt_boot = true; > >> + trproc->rproc = rproc; > >> + } > >> rproc_coredump_set_elf_info(rproc, ELFCLASS32, EM_NONE); > >> > >> ret = stm32_rproc_parse_dt(pdev, ddata, &rproc->auto_boot); > >> @@ -881,8 +945,10 @@ static int stm32_rproc_probe(struct platform_device *pdev) > >> if (ret) > >> goto free_rproc; > >> > >> - if (state == M4_STATE_CRUN) > >> + if (state == M4_STATE_CRUN) { > >> rproc->state = RPROC_DETACHED; > >> + ddata->to_attach = true; > >> + } > >> > >> rproc->has_iommu = false; > >> ddata->workqueue = create_workqueue(dev_name(dev)); > >> @@ -916,6 +982,10 @@ static int stm32_rproc_probe(struct platform_device *pdev) > >> device_init_wakeup(dev, false); > >> } > >> rproc_free(rproc); > >> +free_tee: > >> + if (trproc) > >> + tee_rproc_unregister(trproc); > >> + > >> return ret; > >> } > >> > >> @@ -923,6 +993,7 @@ static void stm32_rproc_remove(struct platform_device *pdev) > >> { > >> struct rproc *rproc = platform_get_drvdata(pdev); > >> struct stm32_rproc *ddata = rproc->priv; > >> + struct tee_rproc *trproc = ddata->trproc; > >> struct device *dev = &pdev->dev; > >> > >> if (atomic_read(&rproc->power) > 0) > >> @@ -937,6 +1008,8 @@ static void stm32_rproc_remove(struct platform_device *pdev) > >> device_init_wakeup(dev, false); > >> } > >> rproc_free(rproc); > >> + if (trproc) > >> + tee_rproc_unregister(trproc); > >> } > >> > >> static int stm32_rproc_suspend(struct device *dev) > >> -- > >> 2.25.1 > >> > > _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel