core: stm32_gpio: register firewall controllers for GPIO access rights #7102

etienne-lms · 2024-11-04T08:56:45Z

This P-R makes stm32mp platforms to OP-TEE secure DTB to manage STM32 GPIO access rights. It tried to nicely split changes but it now spreads on almost 20 commits.

The series start with 7 patches in stm32mp platform DT source files to explicitly describe GPIOs and pins used by OP-TEE but accessible from non-secure world.
"dt-bindings: gpio: stm32mp: flags for non-secure GPIOs"
"dt-bindings: pinctrl: stm32mp: flags for non-secure pins"
"dts: stm32: ..."
Follows 5 patches to implement firewall support in stm32_gpio driver, for stm32mp1 and stm32mp2 platforms.
"drivers: stm32_gpio: check GPIO is not already consumed"
"drivers: stm32_gpio: factorize apply_rif_config()"
"drivers: stm32_gpio: register to firewall framework"
"drivers: stm32_gpio: check secure state of consumed GPIOs"
"drivers: stm32_gpio: check secure state of pinctrl states"
The series ends with 7 patches that removes deprecated shared_resource driver implementation related to STM32 pin muxing.
"drivers: stm32_xxx: remove use of xxx() ..."
"plat-stm32mp1: remove use of xxx() ..."

etienne-lms · 2024-11-05T13:54:19Z

Rebased to fix merge conflicts.

CI / Code Style checkpatch reports are all false positive:
trace message exceeding 80char/line + BIT() not used in DT bindings header file.

core/include/dt-bindings/gpio/stm32mp_gpio.h

core/arch/arm/dts/stm32mp13-pinctrl.dtsi

GseoC · 2024-11-07T14:43:46Z

7 first patches (device tree):

For dts: stm32: define SoC GPIO banks that are firewall controllers, in commit message: register to the firewall framework as a firewall controller
Some comments to address

etienne-lms · 2024-11-12T11:18:10Z

Comments on the 7 first commits addressed.

CI / Code style reports false positive (trace message impl. exceeding 80char/line + use BIT() in DT binding header file).

CI / make check (QEMUv8, Clang) failed on optee_rust_examples_ext-1.0 build:

2024-11-12T10:29:03.1227175Z error: failed to get `uuid` as a dependency of package `ta v0.2.0 (/__w/optee_os/optee_repo_qemu_v8/out-br/build/optee_rust_examples_ext-1.0/examples/digest-rs/ta)`
(...)
2024-11-12T10:29:03.1232776Z Caused by:
2024-11-12T10:29:03.1233923Z   [7] Couldn't connect to server (Failed to connect to index.crates.io port 443 after 0 ms: Couldn't connect to server)

core/drivers/stm32_gpio.c

core/drivers/stm32_uart.c

core/arch/arm/plat-stm32mp1/drivers/stm32mp1_pmic.c

GseoC · 2024-11-12T13:43:00Z

For commit core: stm32_gpio: register firewall controllers for GPIO access rights
s/STM32 GPIO driver verifies/ STM32 GPIO driver now verifies

ditto for following pinctrl commit

For commits:
drivers: stm32_i2c: remove use of stm32_pinctrl_set_secure_cfg()
drivers: stm32_uart: remove use of stm32_pinctrl_set_secure_cfg()
In the commit message, it's not the ETZPC driver, it's rather the GPIO one

For commit: drivers: stm32_uart: remove use of shared_resource for pincltr
typo in commit title

etienne-lms

Review comments addressed or answered.
I'll rebase the series to resolve some rebase conflicts.

core/drivers/stm32_gpio.c

core/drivers/stm32_uart.c

etienne-lms · 2024-11-12T16:33:32Z

Rebased

etienne-lms · 2024-11-14T17:15:46Z

@GseoC, may I squash the fixup commits and fix the commit messages as you suggested?

core/drivers/stm32_gpio.c

GseoC · 2024-11-15T14:28:03Z

@GseoC, may I squash the fixup commits and fix the commit messages as you suggested?

Please do when addressing the comment above so that I can make another round, thanks!

etienne-lms · 2024-11-15T14:56:33Z

Fixup commits squashed and commits messages updated as per #7102 (comment) and #7102 (comment) review comments.

etienne-lms · 2024-11-19T10:38:37Z

Rebased to solve merge conflicts.

GseoC · 2024-11-20T10:16:01Z

core/arch/arm/plat-stm32mp1/shared_resources.c

-			     id - STM32MP1_SHRES_GPIOZ(0), get_gpioz_nbpin());
-			panic();
-		}
+		panic("Deprecated registering of GPIOz resources");


s/GPIOz/GPIOZ

Could merge with PLL3 and specify only usage of deprecated shared resource

I plan to send another series to fully remove this plat-stm32mp1/shared_resources.c driver once this P-R and #7111 are merged so all these line will then disappear. It's something we referred to in this comment.

core/drivers/stm32_uart.c

GseoC · 2024-11-20T10:32:21Z

core/drivers/stm32_gpio.c

+		/* Resource can be accessed if CID1 is statically allowed */
+		accessible = true;
+	} else if (stm32_rif_semaphore_enabled_and_ok(cidcfgr, RIF_CID1)) {
+		/* We must acquire the semaphore to access the resource */


We should add a stm32_rif_semaphore_is_available_or_taken() to check if the current CID has already taken the semaphore. This will avoid some issue when acquiring the semaphore (spurious IAC). Maybe we can do this in another P-R. (I can take care of that)

To prevent such issues when acquiring an already taken semaphore, I think we should rather fix stm32_rif_acquire_semaphore():

TEE_Result stm32_rif_acquire_semaphore(vaddr_t addr, unsigned int nb_cid_supp) { uint32_t scid_mask = get_scid_mask(nb_cid_supp); - /* Take the semaphore */ - io_setbits32(addr, _SEMCR_MUTEX); + /* Take the semaphore is not already taken */ + if (stm32_rif_semaphore_is_available(addr)) + io_setbits32(addr, _SEMCR_MUTEX); /* Check that the Cortex-A has the semaphore */ if (stm32_rif_semaphore_is_available(addr) || ((io_read32(addr) & scid_mask) >> _CIDCFGR_SCID_SHIFT) != RIF_CID1) return TEE_ERROR_ACCESS_DENIED; return TEE_SUCCESS; }

I've removed the acquisition of the semaphore here pin_is_accessible() and added it in stm32_pinctrl_conf_apply() and stm32_gpio_get_dt(). See the appended fixup commit.

core/drivers/stm32_gpio.c

etienne-lms · 2024-11-28T11:32:19Z

Comments addressed.

GseoC · 2024-12-05T14:26:26Z

Commit : dts: stm32: define SoC GPIO banks that are firewall controllers => ...as firewall controllers

Commit [review] drivers: stm32_gpio: check secure state of consumed GPIOs:
Missing word: pinctrl consumers will **** only the required semaphore

Commit: drivers: stm32_gpio: remove gpio/pinctrl API function to set secure state:
Commit message not intelligible IMO. I would mention that the only legitimate configuration comes from the device tree

GseoC · 2024-12-05T14:29:25Z

Can you squash the commits so that I can do one last round please?

etienne-lms · 2024-12-05T16:28:44Z

Commit : dts: stm32: define SoC GPIO banks that are firewall controllers => ...as firewall controllers

Sorry niticking a bit but STM32MP15 flavors have GPIO banks that do not have "firewall" capabilities hence the "that area" wording I've used.

Thanks for the other comments, I'll address them.

core/arch/arm/dts/stm32mp15-pinctrl.dtsi

GseoC

3 comments remaining, otherwise I'm happy with this P-R.

core/drivers/stm32_gpio.c

etienne-lms · 2024-12-06T10:08:29Z

Comments addressed.

GseoC · 2024-12-06T10:54:12Z

Reviewed-by: Gatien Chevallier <[email protected]>

Define STM32 GPIO DT bindings bit flags for GPIOs that are to be used in non-secure state. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Define stm32 pinctrl DT bindings bit flags for pins that are expected to be used in non-secure state. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Add property #access-controller-cells to GPIO banks that register to the firewall framework. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

On STM32MP15 based devices, UART2/3/4/5/6/7/8 cannot be secured. Explicitly state that in the pinctrl nodes. This change ease the use of a non-secure UART for OP-TEE output console on STM32MP15 based boards. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Explicitly state that legacy pinctrl phandles i2c4_pins_a and i2c4_sleep_pins_a refer to non-secure I2C4 pin muxing on STM32MP15 based platforms. Define secure I2C4 bus pinctrl states for boards that use the I2C4 bus in secure state on STM32MP15 SoCs. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Explicitly state that legacy pinctrl phandles usart4_pins_a refer to non-secure USART4 pin muxing, used in STM32MP13 based boards for OP-TEE console using a non-secure UART bus. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Explicitly state that legacy pinctrl phandles usart2_pins_a refer to non-secure USART2 pin muxing, used in STM32MP23 and STM32MP25 based boards for OP-TEE console using a non-secure UART bus. Define secure USART2 bus pinctrl states for board that needs to use the USART2 bus in secure state. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Check that a GPIO requested by a consumer is not already consumed by another device. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Change apply_rif_config() to be able to call it for a subset of pins in a GPIO bank. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Register secure aware STM32 GPIO banks to the firewall framework as a firewall controller to allow GPIO and pinctrl consumer devices to load alternate configurations for pins. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Release RIF semaphore taken at GPIO bank initialization and acquire them only when the GPIO or pinctrl is used or when a firewall configuration is requested. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

STM32 GPIO driver now verifies that any GPIO consumed by OP-TEE can be accessed and has the expected secure hardening configuration. If a driver attempts to consume a GPIO that cannot be accessed by OP-TEE, core panics. When a GPIO is used with an inappropriate secure configuration state, STM32 GPIO driver panics or prints an info level message, depending on CFG_INSECURE. This change is based on the recently added GPIO_STM32_NSEC bindings macro in STM32 GPIO driver DT bindings header file that is a hint on whether a consumed GPIO is expected secure or shared with non-secure world. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Make STM32 GPIO driver to verify that any all pins of applied pinctrl states be accessed and has the expected secure hardening configuration when used. Non-secure pins must have the STM32_PIN_NSEC bit set in the pin handler argument unless what the pin is expected to be secure. The driver returns an error when the expected secure state of a pin does not match its effective secure state or it cannot be accessed, unless CFG_INSECURE is enabled in which case the driver only prints an info level trace message. If a driver attempts to consume a pinctrl with pins that do not exist, core panics. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Remove management of GPIO and pinctrl secure state since this is now handled from STM32 ETZPC driver based through the firewall framework. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Remove use of stm32_pinctrl_set_secure_cfg() to set the secure state of the pins of a pinctrl state since this is now handled from STM32 GPIO driver based on the firewall framework. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Remove use of shared_resources platform driver to manage the secure state of the pins of a pinctrl state since this is now managed using the firewall framework. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

…ctrl Remove use of shared_resources platform driver in STM32MP15 PMIC driver to manage the secure state of the pins of a pinctrl state since this is now managed using the firewall framework. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

…tate Remove stm32_gpio_set_secure_cfg() and stm32_pinctrl_set_secure_cfg() functions that are no more used since the STM32 GPIO and pins secure configurations are managed only through the firewall framework facilities. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

Remove the pin and GPIO secure state management from shared_resources platform driver since this is now managed using the firewall framework. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

etienne-lms · 2024-12-06T14:58:46Z

Fixup commits squashed and review tag applied.
Many thanks @GseoC for the review and maturation of this quite long series.
FYI I've slightly reword the commit message of "drivers: stm32_gpio: check secure state of pinctrl states".

CI checkpatch will report the same false positive warnings stated in #7102 (comment).

etienne-lms force-pushed the stm32-gpio branch from 523c9ca to d049439 Compare November 5, 2024 13:51

GseoC reviewed Nov 7, 2024

View reviewed changes

core/include/dt-bindings/gpio/stm32mp_gpio.h Outdated Show resolved Hide resolved

core/arch/arm/dts/stm32mp13-pinctrl.dtsi Show resolved Hide resolved

GseoC reviewed Nov 12, 2024

View reviewed changes

etienne-lms commented Nov 12, 2024

View reviewed changes

etienne-lms force-pushed the stm32-gpio branch from 0feb9c2 to c3886b1 Compare November 12, 2024 16:32

etienne-lms force-pushed the stm32-gpio branch from a063d7d to 31d7a49 Compare November 12, 2024 17:01

GseoC reviewed Nov 15, 2024

View reviewed changes

core/drivers/stm32_gpio.c Outdated Show resolved Hide resolved

etienne-lms force-pushed the stm32-gpio branch from 31d7a49 to 1cdf807 Compare November 15, 2024 14:55

etienne-lms force-pushed the stm32-gpio branch from 1cdf807 to ec60416 Compare November 19, 2024 10:36

GseoC reviewed Nov 20, 2024

View reviewed changes

etienne-lms force-pushed the stm32-gpio branch from 68cc90a to a68be58 Compare November 28, 2024 11:31

etienne-lms force-pushed the stm32-gpio branch from a68be58 to 6b8f610 Compare December 5, 2024 17:49

GseoC reviewed Dec 6, 2024

View reviewed changes

core/arch/arm/dts/stm32mp15-pinctrl.dtsi Show resolved Hide resolved

GseoC reviewed Dec 6, 2024

View reviewed changes

core/drivers/stm32_gpio.c Outdated Show resolved Hide resolved

core/drivers/stm32_gpio.c Show resolved Hide resolved

core/drivers/stm32_gpio.c Outdated Show resolved Hide resolved

dt-bindings: gpio: stm32mp: flags for non-secure GPIOs

1f0fed5

Define STM32 GPIO DT bindings bit flags for GPIOs that are to be used in non-secure state. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

etienne-lms added 19 commits December 6, 2024 15:45

dt-bindings: pinctrl: stm32mp: flags for non-secure pins

c80834b

Define stm32 pinctrl DT bindings bit flags for pins that are expected to be used in non-secure state. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

dts: stm32: define SoC GPIO banks that are firewall controllers

a229b2a

Add property #access-controller-cells to GPIO banks that register to the firewall framework. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

drivers: stm32_gpio: check GPIO is not already consumed

37541a9

Check that a GPIO requested by a consumer is not already consumed by another device. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

drivers: stm32_gpio: factorize apply_rif_config()

8625e4a

Change apply_rif_config() to be able to call it for a subset of pins in a GPIO bank. Signed-off-by: Etienne Carriere <[email protected]> Reviewed-by: Gatien Chevallier <[email protected]>

etienne-lms force-pushed the stm32-gpio branch from 314b668 to b2a5f61 Compare December 6, 2024 14:53

jforissier merged commit 40848ef into OP-TEE:master Dec 6, 2024
9 of 10 checks passed

etienne-lms mentioned this pull request Dec 9, 2024

plat-stm32mp1: remove registering to platform shared_resources driver #7169

Open

etienne-lms deleted the stm32-gpio branch December 11, 2024 14:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

core: stm32_gpio: register firewall controllers for GPIO access rights #7102

core: stm32_gpio: register firewall controllers for GPIO access rights #7102

etienne-lms commented Nov 4, 2024

etienne-lms commented Nov 5, 2024

GseoC commented Nov 7, 2024

etienne-lms commented Nov 12, 2024

GseoC commented Nov 12, 2024

etienne-lms left a comment

etienne-lms commented Nov 12, 2024

etienne-lms commented Nov 14, 2024

GseoC commented Nov 15, 2024

etienne-lms commented Nov 15, 2024

etienne-lms commented Nov 19, 2024

GseoC Nov 20, 2024

GseoC Nov 20, 2024

etienne-lms Nov 20, 2024

GseoC Nov 20, 2024

etienne-lms Nov 20, 2024

etienne-lms Nov 27, 2024

etienne-lms commented Nov 28, 2024

GseoC commented Dec 5, 2024

GseoC commented Dec 5, 2024

etienne-lms commented Dec 5, 2024

GseoC left a comment

etienne-lms commented Dec 6, 2024

GseoC commented Dec 6, 2024

etienne-lms commented Dec 6, 2024 •

edited

Loading

core: stm32_gpio: register firewall controllers for GPIO access rights #7102

core: stm32_gpio: register firewall controllers for GPIO access rights #7102

Conversation

etienne-lms commented Nov 4, 2024

etienne-lms commented Nov 5, 2024

GseoC commented Nov 7, 2024

etienne-lms commented Nov 12, 2024

GseoC commented Nov 12, 2024

etienne-lms left a comment

Choose a reason for hiding this comment

etienne-lms commented Nov 12, 2024

etienne-lms commented Nov 14, 2024

GseoC commented Nov 15, 2024

etienne-lms commented Nov 15, 2024

etienne-lms commented Nov 19, 2024

GseoC Nov 20, 2024

Choose a reason for hiding this comment

GseoC Nov 20, 2024

Choose a reason for hiding this comment

etienne-lms Nov 20, 2024

Choose a reason for hiding this comment

GseoC Nov 20, 2024

Choose a reason for hiding this comment

etienne-lms Nov 20, 2024

Choose a reason for hiding this comment

etienne-lms Nov 27, 2024

Choose a reason for hiding this comment

etienne-lms commented Nov 28, 2024

GseoC commented Dec 5, 2024

GseoC commented Dec 5, 2024

etienne-lms commented Dec 5, 2024

GseoC left a comment

Choose a reason for hiding this comment

etienne-lms commented Dec 6, 2024

GseoC commented Dec 6, 2024

etienne-lms commented Dec 6, 2024 • edited Loading

etienne-lms commented Dec 6, 2024 •

edited

Loading