Skip to content
Snippets Groups Projects
  1. Mar 21, 2018
  2. Mar 20, 2018
  3. Mar 19, 2018
    • Tom Rini's avatar
      Merge git://git.denx.de/u-boot-sunxi · c17848a7
      Tom Rini authored
      c17848a7
    • Bryan O'Donoghue's avatar
      bootm: optee: Add a bootm command for type IH_OS_TEE · c225e7cf
      Bryan O'Donoghue authored
      
      This patch makes it possible to verify the contents and location of an
      OPTEE image in DRAM prior to handing off control to that image. If image
      verification fails we won't try to boot any further.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Suggested-by: default avatarAndrew F. Davis <afd@ti.com>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      c225e7cf
    • Bryan O'Donoghue's avatar
      image: Add IH_OS_TEE for TEE chain-load boot · 45b55712
      Bryan O'Donoghue authored
      
      This patch adds a new type IH_OS_TEE. This new OS type will be used for
      chain-loading to Linux via a TEE.
      
      With this patch in-place you can generate a bootable OPTEE image like this:
      
      mkimage -A arm -T kernel -O tee -C none -d tee.bin uTee.optee
      
      where "tee.bin" is the input binary prefixed with an OPTEE header and
      uTee.optee is the output prefixed with a u-boot wrapper header.
      
      This image type "-T kernel -O tee" is differentiated from the existing
      IH_TYPE_TEE "-T tee" in that the IH_TYPE is installed by u-boot (flow
      control returns to u-boot) whereas for the new IH_OS_TEE control passes to
      the OPTEE firmware and the firmware chainloads onto Linux.
      
      Andrew Davis gave the following ASCII diagram:
      
      IH_OS_TEE: (mkimage -T kernel -O tee)
      Non-Secure       Secure
      
                       BootROM
                         |
            -------------
           |
           v
          SPL
           |
           v
         U-Boot ------>
                <-----  OP-TEE
            |
            V
          Linux
      
      IH_TYPE_TEE: (mkimage -T tee)
      Non-Secure       Secure
      
                       BootROM
                         |
            -------------
           |
           v
          SPL ------->
               <-----  OP-TEE
           |
           v
         U-Boot
            |
            V
          Linux
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Suggested-by: default avatarAndrew F. Davis <afd@ti.com>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Link: http://mrvan.github.io/optee-imx6ul
      45b55712
    • Bryan O'Donoghue's avatar
      optee: Add error printout · 6ffc4200
      Bryan O'Donoghue authored
      
      When encountering an error in OPTEE verification print out various details
      of the OPTEE header to aid in further debugging of encountered errors.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Tested-by: default avatarPeng Fan <peng.fan@nxp.com>
      6ffc4200
    • Bryan O'Donoghue's avatar
      optee: Add optee_verify_bootm_image() · c5a6e8bd
      Bryan O'Donoghue authored
      
      This patch adds optee_verify_bootm_image() which will be subsequently used
      to verify the parameters encoded in the OPTEE header match the memory
      allocated to the OPTEE region, OPTEE header magic and version prior to
      handing off control to the OPTEE image.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      c5a6e8bd
    • Bryan O'Donoghue's avatar
      optee: Add optee_image_get_load_addr() · dd5a12e2
      Bryan O'Donoghue authored
      
      This patch adds optee_image_get_load_addr() a helper function used to
      calculate the load-address of an OPTEE image based on the lower
      entry-point address given in the OPTEE header.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Tested-by: default avatarPeng Fan <peng.fan@nxp.com>
      dd5a12e2
    • Bryan O'Donoghue's avatar
      optee: Add optee_image_get_entry_point() · f7944368
      Bryan O'Donoghue authored
      
      Add a helper function for extracting the least significant 32 bits from the
      OPTEE entry point address, which will be good enough to load OPTEE binaries
      up to (2^32)-1 bytes.
      
      We may need to extend this out later on but for now (2^32)-1 should be
      fine.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Tested-by: default avatarPeng Fan <peng.fan@nxp.com>
      f7944368
    • Bryan O'Donoghue's avatar
      optee: Add CONFIG_OPTEE_LOAD_ADDR · f25006b9
      Bryan O'Donoghue authored
      
      CONFIG_OPTEE_LOAD_ADDR is used to tell u-boot where to load the OPTEE
      binary into memory prior to handing off control to OPTEE.
      
      We need to pull this value out of u-boot in order to produce an IMX IVT/CSF
      signed pair for the purposes of secure boot. The best way to do that is to
      have CONFIG_OPTEE_LOAD_ADDR appear in u-boot.cfg.
      
      Adding new CONFIG entires to u-boot should be kconfig driven so this patch
      does just that.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Reviewed-by: default avatarRyan Harkin <ryan.harkin@linaro.org>
      f25006b9
    • Bryan O'Donoghue's avatar
      optee: Add CONFIG_OPTEE_TZDRAM_BASE · 35499baf
      Bryan O'Donoghue authored
      
      OPTEE is currently linked to a specific area of memory called the TrustZone
      DRAM. This patch adds a CONFIG entry for the default address of TrustZone
      DRAM that a board-port can over-ride. The region that U-Boot sets aside for
      the OPTEE run-time should be verified before attempting to hand off to the
      OPTEE run-time. Each board-port should carefully ensure that the TZDRAM
      address specified in the OPTEE build and the TZDRAM address specified in
      U-Boot match-up.
      
      Further patches will use TZDRAM address with other defines and variables to
      carry out a degree of automated verification in U-Boot prior to trying to
      boot an OPTEE image.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      35499baf
    • Bryan O'Donoghue's avatar
      optee: Add CONFIG_OPTEE_TZDRAM_SIZE · d89a5aa6
      Bryan O'Donoghue authored
      
      OPTEE is currently linked to a specific area of memory called the TrustZone
      DRAM. This patch adds a CONFIG entry for the default size of TrustZone DRAM
      that a board-port can over-ride. The region that U-Boot sets aside for the
      OPTEE run-time should be verified before attempting to hand off to the
      OPTEE run-time. Each board-port should carefully ensure that the TZDRAM
      size specified in the OPTEE build and the TZDRAM size specified in U-Boot
      match-up.
      
      Further patches will use TZDRAM size with other defines and variables to
      carry out a degree of automated verification in U-Boot prior to trying to
      boot an OPTEE image.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Tested-by: default avatarPeng Fan <peng.fan@nxp.com>
      d89a5aa6
    • Bryan O'Donoghue's avatar
      optee: Add lib entries for sharing OPTEE code across ports · 32ce6179
      Bryan O'Donoghue authored
      
      This patch adds code to lib to enable sharing of useful OPTEE code between
      board-ports and architectures. The code on lib/optee/optee.c comes from the
      TI omap2 port. Eventually the OMAP2 code will be patched to include the
      shared code. The intention here is to add more useful OPTEE specific code
      as more functionality gets added.
      
      Signed-off-by: default avatarBryan O'Donoghue <bryan.odonoghue@linaro.org>
      Cc: Harinarayan Bhatta <harinarayan@ti.com>
      Cc: Andrew F. Davis <afd@ti.com>
      Cc: Tom Rini <trini@konsulko.com>
      Cc: Kever Yang <kever.yang@rock-chips.com>
      Cc: Philipp Tomsich <philipp.tomsich@theobroma-systems.com>
      Cc: Peng Fan <peng.fan@nxp.com>
      Tested-by: default avatarPeng Fan <peng.fan@nxp.com>
      32ce6179
Loading