linux-kernel - [PATCH v6 0/3] firmware: Add support for Qualcomm UEFI Secure Application

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230827211408.689076-1-luzmaximilian@gmail.com>
Date:   Sun, 27 Aug 2023 23:14:03 +0200
From:   Maximilian Luz <luzmaximilian@...il.com>
To:     Bjorn Andersson <andersson@...nel.org>
Cc:     Maximilian Luz <luzmaximilian@...il.com>,
        Andy Gross <agross@...nel.org>,
        Konrad Dybcio <konrad.dybcio@...aro.org>,
        Ard Biesheuvel <ardb@...nel.org>,
        Ilias Apalodimas <ilias.apalodimas@...aro.org>,
        Srinivas Kandagatla <srinivas.kandagatla@...aro.org>,
        Sudeep Holla <sudeep.holla@....com>,
        Johan Hovold <johan@...nel.org>,
        Steev Klimaszewski <steev@...i.org>,
        linux-arm-msm@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH v6 0/3] firmware: Add support for Qualcomm UEFI Secure Application

This series adds basic support for the QSEECOM interface used to
communicate with secure applications running in the TrustZone on certain
Qualcomm devices. In addition to that, it also provides a driver for
"uefisecapp", the secure application managing access to UEFI variables
on such platforms.

For a more detailed description, see the blurb of v1.

Previous versions:

 - V5: https://lore.kernel.org/lkml/20230730161906.606163-1-luzmaximilian@gmail.com/t/
 - V4: https://lore.kernel.org/lkml/72c0359a-eda6-30ea-0ec0-b7e9b804b87b@gmail.com/t/
 - V3: https://lore.kernel.org/lkml/20230305022119.1331495-4-luzmaximilian@gmail.com/t/
 - V2: https://lore.kernel.org/lkml/20230127184650.756795-1-luzmaximilian@gmail.com/
 - V1: https://lore.kernel.org/lkml/20220723224949.1089973-1-luzmaximilian@gmail.com/

Changes in v5:

 - Small code fixes (e.g., missing 'static inline', missing includes,
   removal of unnecessary functions, improvements and fixes for
   documentation and comments). No larger or structural changes.

Changes in v5:

 - Re-introduce a dedicated platform device for managing QSEECOM client
   devices. The device is now added via qcom_scm.c instead of the device
   tree (as has been done in v3).

 - Replace ucs2_strlcpy() with ucs2_strscpy()

 - Drop "firmware: qcom_scm: Clear scm pointer on probe failure" and
   sort out probe-related issue.

 - Clean up comments in qcom_qseecom_uefisecapp.c

Changes in v4:

 - Integrate the QSEECOM interface into qcom_scm.c instead of
   instantiating a custom device and requiring device-tree bindings for
   it. With that, drop the respective patches exporting SCM call
   functions from qcom_scm.c and the DT bindings.

 - Restructure management of DMA memory and move DMA mapping entirely
   into the app_send() command, removing the need for DMA handling in
   app client drivers.

 - Add support for EFI's query_variable_info() call.

 - Move UCS-2 string helpers to lib/ucs2_string.c (introduces patch 1).

 - Add fix for related cleanup-issue in qcom_scm.c (introduces patch 2).

 (Refer to individual patches for more details.)

Changes in v3:

 - Fix doc comment in qcom_scm.c
 - Rebase on top of latest changes to qcom_scm.

Changes in v2:

 - Bind the qseecom interface to a device.

 - Establish a device link between the new qseecom device and the SCM
   device to ensure proper PM and remove ordering.

 - Remove the compatible for uefisecapp. Instead, introduce a compatible
   for the qseecom device. This directly reflects ACPI tables and the
   QCOM0476 device described therein, which is responsible for the
   secure app / qseecom interface (i.e., the same purpose).

   Client devices representing apps handled by the kernel (such as
   uefisecapp) are now directly instantiated by the qseecom driver,
   based on the respective platform-specific compatible.

 - Rename the base name (qctree -> qseecom) to allow differentiation
   between old (qseecom) and new (smcinvoke) interfaces to the trusted
   execution environment. This directly reflects downstream naming by
   Qualcomm.

Maximilian Luz (3):
  lib/ucs2_string: Add UCS-2 strscpy function
  firmware: qcom_scm: Add support for Qualcomm Secure Execution
    Environment SCM interface
  firmware: Add support for Qualcomm UEFI Secure Application

 MAINTAINERS                                |  12 +
 drivers/firmware/Kconfig                   |  32 +
 drivers/firmware/Makefile                  |   2 +
 drivers/firmware/qcom_qseecom.c            | 120 +++
 drivers/firmware/qcom_qseecom_uefisecapp.c | 871 +++++++++++++++++++++
 drivers/firmware/qcom_scm.c                | 394 ++++++++++
 include/linux/firmware/qcom/qcom_qseecom.h |  46 ++
 include/linux/firmware/qcom/qcom_scm.h     |  22 +
 include/linux/ucs2_string.h                |   1 +
 lib/ucs2_string.c                          |  52 ++
 10 files changed, 1552 insertions(+)
 create mode 100644 drivers/firmware/qcom_qseecom.c
 create mode 100644 drivers/firmware/qcom_qseecom_uefisecapp.c
 create mode 100644 include/linux/firmware/qcom/qcom_qseecom.h

-- 
2.42.0