linux-kernel - Re: [PATCH 00/15] Add CMDQ secure driver for SVP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Sep 2023 03:08:05 +0000
From:   CK Hu (胡俊光) <ck.hu@...iatek.com>
To:     "jassisinghbrar@...il.com" <jassisinghbrar@...il.com>,
        "matthias.bgg@...il.com" <matthias.bgg@...il.com>,
        Jason-JH Lin (林睿祥) 
        <Jason-JH.Lin@...iatek.com>,
        "chunkuang.hu@...nel.org" <chunkuang.hu@...nel.org>,
        "robh+dt@...nel.org" <robh+dt@...nel.org>,
        "krzysztof.kozlowski+dt@...aro.org" 
        <krzysztof.kozlowski+dt@...aro.org>,
        "angelogioacchino.delregno@...labora.com" 
        <angelogioacchino.delregno@...labora.com>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Singo Chang (張興國) 
        <Singo.Chang@...iatek.com>,
        Johnson Wang (王聖鑫) 
        <Johnson.Wang@...iatek.com>,
        Jason-ch Chen (陳建豪) 
        <Jason-ch.Chen@...iatek.com>,
        "devicetree@...r.kernel.org" <devicetree@...r.kernel.org>,
        Shawn Sung (宋孝謙) 
        <Shawn.Sung@...iatek.com>,
        "linux-mediatek@...ts.infradead.org" 
        <linux-mediatek@...ts.infradead.org>,
        Nancy Lin (林欣螢) <Nancy.Lin@...iatek.com>,
        "conor+dt@...nel.org" <conor+dt@...nel.org>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        Elvis Wang (王军) <Elvis.Wang@...iatek.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        Project_Global_Chrome_Upstream_Group 
        <Project_Global_Chrome_Upstream_Group@...iatek.com>
Subject: Re: [PATCH 00/15] Add CMDQ secure driver for SVP

Hi, Jason:

On Tue, 2023-09-19 at 03:21 +0800, Jason-JH.Lin wrote:
> For the Secure Video Path (SVP) feature, inculding the memory stored
> secure video content, the registers of display HW pipeline and the
> HW configure operations are required to execute in the secure world.
> 
> So using a CMDQ secure driver to make all display HW registers
> configuration secure DRAM access permision settings execute by GCE
> secure thread in the secure world.
> 
> We are landing this feature on mt8188 and mt8195 currently.

I'm doubt that GCE could be secure enough. Hacker would try any way to
hack TEE. If the interface is simple, it's easy to check in the
interface entry. But GCE command has enormous combination, how to check
it's not hacked? One example is that hacker could use cmdq_pkt_read_s()
and cmdq_pkt_write_s() to do memory copy and send this packet to secure
GCE. Could this memory copy touch secure memory? Or don't worry about 
this, once hacker find a way to break this, just find a way to fix it?

> 
> Jason-JH.Lin (15):
>   dt-bindings: mailbox: Add property for CMDQ secure driver
>   dt-bindings: gce: mt8195: Add CMDQ_SYNC_TOKEN_SECURE_THR_EOF event
> id
>   soc: mailbox: Add SPR definition for GCE
>   soc: mailbox: Add cmdq_pkt_logic_command to support math operation
>   mailbox: mediatek: Add cmdq_pkt_write_s_reg_value to CMDQ driver
>   mailbox: mediatek: Add cmdq_mbox_stop to disable GCE thread
>   mailbox: mediatek: Add loop pkt flag and irq handling for loop
> command
>   soc: mediatek: Add cmdq_pkt_finalize_loop to CMDQ driver
>   mailbox: mediatek: Add secure CMDQ driver support for CMDQ driver
>   mailbox: mediatek: Add CMDQ secure mailbox driver
>   soc: mediatek: Add cmdq_insert_backup_cookie before EOC for secure
> pkt
>   mailbox: mediatek: Add CMDQ driver support for mt8188
>   mailbox: mediatek: Add mt8188 support for CMDQ secure driver
>   mailbox: mediatek: Add mt8195 support for CMDQ secure driver
>   arm64: dts: mediatek: mt8195: Add CMDQ secure driver support for
> gce0
> 
>  .../mailbox/mediatek,gce-mailbox.yaml         |   30 +-
>  arch/arm64/boot/dts/mediatek/mt8195.dtsi      |    2 +
>  drivers/mailbox/Makefile                      |    2 +-
>  drivers/mailbox/mtk-cmdq-mailbox.c            |   67 +-
>  drivers/mailbox/mtk-cmdq-sec-mailbox.c        | 1103
> +++++++++++++++++
>  drivers/mailbox/mtk-cmdq-sec-tee.c            |  202 +++
>  drivers/soc/mediatek/mtk-cmdq-helper.c        |   81 ++
>  include/dt-bindings/gce/mt8195-gce.h          |    6 +
>  include/linux/mailbox/mtk-cmdq-mailbox.h      |   15 +
>  .../linux/mailbox/mtk-cmdq-sec-iwc-common.h   |  293 +++++
>  include/linux/mailbox/mtk-cmdq-sec-mailbox.h  |   83 ++
>  include/linux/mailbox/mtk-cmdq-sec-tee.h      |   31 +
>  include/linux/soc/mediatek/mtk-cmdq.h         |   65 +
>  13 files changed, 1971 insertions(+), 9 deletions(-)
>  create mode 100644 drivers/mailbox/mtk-cmdq-sec-mailbox.c
>  create mode 100644 drivers/mailbox/mtk-cmdq-sec-tee.c
>  create mode 100644 include/linux/mailbox/mtk-cmdq-sec-iwc-common.h
>  create mode 100644 include/linux/mailbox/mtk-cmdq-sec-mailbox.h
>  create mode 100644 include/linux/mailbox/mtk-cmdq-sec-tee.h
>