| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20250327-qcom-tee-using-tee-ss-without-mem-obj-v3-9-7f457073282d@oss.qualcomm.com>
Date: Thu, 27 Mar 2025 19:47:31 -0700
From: Amirreza Zarrabi <amirreza.zarrabi@....qualcomm.com>
To: Jens Wiklander <jens.wiklander@...aro.org>,
Sumit Garg <sumit.garg@...nel.org>,
Bjorn Andersson <andersson@...nel.org>,
Konrad Dybcio <konradybcio@...nel.org>,
Bartosz Golaszewski <bartosz.golaszewski@...aro.org>,
Apurupa Pattapu <quic_apurupa@...cinc.com>,
Kees Cook <kees@...nel.org>,
"Gustavo A. R. Silva" <gustavoars@...nel.org>,
Sumit Semwal <sumit.semwal@...aro.org>,
Christian König <christian.koenig@....com>
Cc: linux-arm-msm@...r.kernel.org, op-tee@...ts.trustedfirmware.org,
linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org,
dri-devel@...ts.freedesktop.org, linaro-mm-sig@...ts.linaro.org,
linux-doc@...r.kernel.org,
Amirreza Zarrabi <amirreza.zarrabi@....qualcomm.com>
Subject: [PATCH v3 09/11] qcomtee: add primordial object
After booting, the kernel provides a static object known as the
primordial object. This object is utilized by QTEE for native
kernel services such as yield or privileged operations.
Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@....qualcomm.com>
---
drivers/tee/qcomtee/Makefile | 1 +
drivers/tee/qcomtee/core.c | 19 +++++++---
drivers/tee/qcomtee/primordial_obj.c | 65 +++++++++++++++++++++++++++++++++++
drivers/tee/qcomtee/qcomtee_private.h | 3 ++
4 files changed, 83 insertions(+), 5 deletions(-)
diff --git a/drivers/tee/qcomtee/Makefile b/drivers/tee/qcomtee/Makefile
index 1b14b943e5f5..a3a2d00e83f0 100644
--- a/drivers/tee/qcomtee/Makefile
+++ b/drivers/tee/qcomtee/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_QCOMTEE) += qcomtee.o
qcomtee-objs += async.o
qcomtee-objs += call.o
qcomtee-objs += core.o
+qcomtee-objs += primordial_obj.o
qcomtee-objs += qcom_scm.o
qcomtee-objs += release.o
qcomtee-objs += shm.o
diff --git a/drivers/tee/qcomtee/core.c b/drivers/tee/qcomtee/core.c
index 162e32db656a..76944241e8e8 100644
--- a/drivers/tee/qcomtee/core.c
+++ b/drivers/tee/qcomtee/core.c
@@ -31,10 +31,12 @@ int qcomtee_next_arg_type(struct qcomtee_arg *u, int i,
}
/*
- * QTEE expects IDs with the QCOMTEE_MSG_OBJECT_NS_BIT set for objects
- * of the QCOMTEE_OBJECT_TYPE_CB type.
+ * QTEE expects IDs with QCOMTEE_MSG_OBJECT_NS_BIT set for objects of
+ * QCOMTEE_OBJECT_TYPE_CB type. The first ID with QCOMTEE_MSG_OBJECT_NS_BIT
+ * set is reserved for the primordial object.
*/
-#define QCOMTEE_OBJECT_ID_START (QCOMTEE_MSG_OBJECT_NS_BIT + 1)
+#define QCOMTEE_OBJECT_PRIMORDIAL (QCOMTEE_MSG_OBJECT_NS_BIT)
+#define QCOMTEE_OBJECT_ID_START (QCOMTEE_OBJECT_PRIMORDIAL + 1)
#define QCOMTEE_OBJECT_ID_END (UINT_MAX)
#define QCOMTEE_OBJECT_SET(p, type, ...) \
@@ -112,7 +114,9 @@ static void qcomtee_object_release(struct kref *refcount)
*/
int qcomtee_object_get(struct qcomtee_object *object)
{
- if (object != NULL_QCOMTEE_OBJECT && object != ROOT_QCOMTEE_OBJECT)
+ if (object != &qcomtee_primordial_object &&
+ object != NULL_QCOMTEE_OBJECT &&
+ object != ROOT_QCOMTEE_OBJECT)
return kref_get_unless_zero(&object->refcount);
return 0;
@@ -125,7 +129,9 @@ EXPORT_SYMBOL_GPL(qcomtee_object_get);
*/
void qcomtee_object_put(struct qcomtee_object *object)
{
- if (object != NULL_QCOMTEE_OBJECT && object != ROOT_QCOMTEE_OBJECT)
+ if (object != &qcomtee_primordial_object &&
+ object != NULL_QCOMTEE_OBJECT &&
+ object != ROOT_QCOMTEE_OBJECT)
kref_put(&object->refcount, qcomtee_object_release);
}
EXPORT_SYMBOL_GPL(qcomtee_object_put);
@@ -215,6 +221,9 @@ static struct qcomtee_object *qcomtee_local_object_get(unsigned int object_id)
{
struct qcomtee_object *object;
+ if (object_id == QCOMTEE_OBJECT_PRIMORDIAL)
+ return &qcomtee_primordial_object;
+
/*
* This is not protected by an RCU read lock because we are
* confident that QTEE does not issue a RELEASE request and
diff --git a/drivers/tee/qcomtee/primordial_obj.c b/drivers/tee/qcomtee/primordial_obj.c
new file mode 100644
index 000000000000..a30967d89c91
--- /dev/null
+++ b/drivers/tee/qcomtee/primordial_obj.c
@@ -0,0 +1,65 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (c) 2024 Qualcomm Innovation Center, Inc. All rights reserved.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/delay.h>
+#include "qcomtee_private.h"
+
+/**
+ * DOC: Primordial Object
+ *
+ * After boot, the kernel provides a static object of type
+ * %QCOMTEE_OBJECT_TYPE_CB called the primordial object. This object is used
+ * for native kernel services or privileged operations.
+ *
+ * We support:
+ * - %QCOMTEE_OBJECT_OP_YIELD to yield by the thread running in QTEE.
+ * - %QCOMTEE_OBJECT_OP_SLEEP to wait for a period of time.
+ */
+
+#define QCOMTEE_OBJECT_OP_YIELD 1
+#define QCOMTEE_OBJECT_OP_SLEEP 2
+
+static int
+qcomtee_primordial_obj_dispatch(struct qcomtee_object_invoke_ctx *oic,
+ struct qcomtee_object *primordial_object_unused,
+ u32 op, struct qcomtee_arg *args)
+{
+ int err = 0;
+
+ switch (op) {
+ case QCOMTEE_OBJECT_OP_YIELD:
+ cond_resched();
+ /* No output object. */
+ oic->data = NULL;
+ break;
+ case QCOMTEE_OBJECT_OP_SLEEP:
+ /* Check message format matched QCOMTEE_OBJECT_OP_SLEEP op. */
+ if (qcomtee_args_len(args) != 1 ||
+ args[0].type != QCOMTEE_ARG_TYPE_IB ||
+ args[0].b.size < sizeof(u32))
+ return -EINVAL;
+
+ msleep(*(u32 *)(args[0].b.addr));
+ /* No output object. */
+ oic->data = NULL;
+ break;
+ default:
+ err = -EINVAL;
+ }
+
+ return err;
+}
+
+static struct qcomtee_object_operations qcomtee_primordial_obj_ops = {
+ .dispatch = qcomtee_primordial_obj_dispatch,
+};
+
+struct qcomtee_object qcomtee_primordial_object = {
+ .name = "primordial",
+ .object_type = QCOMTEE_OBJECT_TYPE_CB,
+ .ops = &qcomtee_primordial_obj_ops
+};
diff --git a/drivers/tee/qcomtee/qcomtee_private.h b/drivers/tee/qcomtee/qcomtee_private.h
index ab3acad40359..a5d05a72af15 100644
--- a/drivers/tee/qcomtee/qcomtee_private.h
+++ b/drivers/tee/qcomtee/qcomtee_private.h
@@ -219,4 +219,7 @@ int qcomtee_user_object_submit(struct tee_context *ctx,
struct tee_param *params, int num_params,
int req_id, int errno);
+/* (2) Primordial Object. */
+extern struct qcomtee_object qcomtee_primordial_object;
+
#endif /* QCOMTEE_PRIVATE_H */
--
2.34.1
Powered by blists - more mailing lists