linux-kernel - [PATCH 1/2] dma-buf: heaps: secure_heap: Add secure ops for CMA heap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Nov 2023 19:17:46 +0530
From:   Pratyush Brahma <quic_pbrahma@...cinc.com>
To:     <sumit.semwal@...aro.org>, <benjamin.gaignard@...labora.com>,
        <Brian.Starkey@....com>, <jstultz@...gle.com>,
        <tjmercier@...gle.com>, <christian.koenig@....com>,
        <linux-media@...r.kernel.org>, <dri-devel@...ts.freedesktop.org>,
        <linaro-mm-sig@...ts.linaro.org>, <linux-kernel@...r.kernel.org>,
        <quic_guptap@...cinc.com>
CC:     Vijayanand Jitta <quic_vjitta@...cinc.com>
Subject: [PATCH 1/2] dma-buf: heaps: secure_heap: Add secure ops for CMA heap

From: Vijayanand Jitta <quic_vjitta@...cinc.com>

Add secure ops for CMA heap which would use qcom_scm_assign_mem
to assign the memory to VMID.

Change-Id: I05aff9cb9b7b9668c4352a24bec163b52e38835a
Signed-off-by: Vijayanand Jitta <quic_vjitta@...cinc.com>
---
 drivers/dma-buf/heaps/secure_heap.c | 50 +++++++++++++++++++++++++++--
 1 file changed, 47 insertions(+), 3 deletions(-)

diff --git a/drivers/dma-buf/heaps/secure_heap.c b/drivers/dma-buf/heaps/secure_heap.c
index 8989ad5d03e9..04e2ee000e19 100644
--- a/drivers/dma-buf/heaps/secure_heap.c
+++ b/drivers/dma-buf/heaps/secure_heap.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/tee_drv.h>
 #include <linux/uuid.h>
+#include <linux/firmware/qcom/qcom_scm.h>
 
 #define TZ_TA_MEM_UUID_MTK		"4477588a-8476-11e2-ad15-e41f1390d676"
 
@@ -83,6 +84,12 @@ struct secure_heap_prv_data {
 	 */
 	const int			tee_command_id_base;
 
+	/*
+	 * VMID and permissions which will be used by QCOM secure system heap to assign mem.
+	 */
+	int	vmid;
+	int 	perm;
+
 	int	(*heap_init)(struct secure_heap *sec_heap);
 	int	(*memory_alloc)(struct secure_heap *sec_heap, struct secure_buffer *sec_buf);
 	void	(*memory_free)(struct secure_heap *sec_heap, struct secure_buffer *sec_buf);
@@ -311,10 +318,47 @@ static void cma_secure_memory_free(struct secure_heap *sec_heap,
 	cma_release(sec_heap->cma, sec_buf->cma_page, sec_buf->size >> PAGE_SHIFT);
 }
 
-const struct secure_heap_prv_data cma_sec_mem_data = {
+static int secure_heap_qcom_secure_memory(struct secure_heap *sec_heap,
+					 struct secure_buffer *sec_buf)
+{
+	struct qcom_scm_vmperm next[1];
+	u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
+	const struct secure_heap_prv_data *data = sec_heap->data;
+	int ret = 0;
+
+	next[0].vmid = data->vmid;
+	next[0].perm = data->perm;
+
+
+	ret = qcom_scm_assign_mem(page_to_phys(sec_buf->cma_page),
+				sec_buf->size, &src_perms,
+				next, 1);
+
+	return ret;
+}
+
+static void secure_heap_qcom_unsecure_memory(struct secure_heap *sec_heap,
+					    struct secure_buffer *sec_buf)
+{
+	struct qcom_scm_vmperm next[1];
+	const struct secure_heap_prv_data *data = sec_heap->data;
+	u64 src_perms = BIT(data->vmid);
+
+	next[0].vmid = QCOM_SCM_VMID_HLOS;
+	next[0].perm = QCOM_SCM_PERM_RWX;
+
+	qcom_scm_assign_mem(page_to_phys(sec_buf->cma_page),
+				sec_buf->size, &src_perms,
+				next, 1);
+}
+
+const struct secure_heap_prv_data qcom_cma_sec_mem_data = {
+	.vmid           = QCOM_SCM_VMID_CP_BITSTREAM,
+	.perm		= QCOM_SCM_PERM_RW,
 	.memory_alloc	= cma_secure_memory_allocate,
 	.memory_free	= cma_secure_memory_free,
-	/* TODO : secure the buffer. */
+	.secure_the_memory      = secure_heap_qcom_secure_memory,
+	.unsecure_the_memory    = secure_heap_qcom_unsecure_memory,
 };
 
 static int secure_heap_secure_memory_allocate(struct secure_heap *sec_heap,
@@ -529,7 +573,7 @@ static struct secure_heap secure_heaps[] = {
 	{
 		.name		= "secure_cma",
 		.mem_type	= SECURE_MEMORY_TYPE_CMA,
-		.data		= &cma_sec_mem_data,
+		.data		= &qcom_cma_sec_mem_data,
 	},
 	{
 		.name		= "secure_mtk_cm",
-- 
2.34.1