From patchwork Tue Oct 15 10:15:32 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jens Wiklander X-Patchwork-Id: 13836058 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 55857CFC283 for ; Tue, 15 Oct 2024 10:19:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help :List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding: MIME-Version:Message-ID:Date:Subject:Cc:To:From:Reply-To:Content-Type: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=/vsiyFH7AdAG35W+mWfukPu7OxX/u28De0FB1ag7l3I=; b=ouq3ck4uaWVeEKpPgbk1XsJZIS FXuIDAGXzMh4TbrrqFyg5HTX4HMafMvp7898sNW5VBXfs4p+n9t3efu1FoX5cyFkLFDtjadUyUvBn cA8qSIw6S4peheHDYLKLCig47agT5X30COgCyTmdvlv9lzITNQwfdOVCtjLJHE3iuDR4sBancY037 Wjb25YuG3XuBFwt1c8lIeajPxOuu0WnM3pCAGcklUT+TVsnWJrrD7lFEYvSfbTFaIzfP+RKgx/IGX s83Mmu2jqJZ5sLyQFMMPf354NhuQWFXlufm+XAAe+HejZz/jMkobHu3xf1hEwMH1XfAEnca7oUSOP hNMwVfBw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.98 #2 (Red Hat Linux)) id 1t0edw-00000007oMv-0Bym; Tue, 15 Oct 2024 10:19:08 +0000 Received: from mail-ed1-x52f.google.com ([2a00:1450:4864:20::52f]) by bombadil.infradead.org with esmtps (Exim 4.98 #2 (Red Hat Linux)) id 1t0ecR-00000007o33-0pbM for linux-arm-kernel@lists.infradead.org; Tue, 15 Oct 2024 10:17:37 +0000 Received: by mail-ed1-x52f.google.com with SMTP id 4fb4d7f45d1cf-5c97cc837c3so2715344a12.0 for ; Tue, 15 Oct 2024 03:17:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1728987453; x=1729592253; darn=lists.infradead.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=/vsiyFH7AdAG35W+mWfukPu7OxX/u28De0FB1ag7l3I=; b=IR5v/Yb6MrkeZOTi3RXMWJKLqOsF+8ThMVCOO50Q1Gq7vUPdUDkFKNrzp5fQmOzZmH +ZNNXnm6ykDC6cU3m/ipFt8D9NEj+ZXFh13RsLcnhAQQa84/yWWdRNnoD6ZuV99JG+8g 8SuijKd72gGLr2/C6Bhe8/mzbR/dYIVhLKWQwD1QUiqxbIplifAX/GatjpFZ3QRRCSyJ +ijZENm3QeXfdHIAeP4HFRahJdtLoixOnxhUOVXGKr143hKNT5ILei49dshTE+MRJIli lFrsaFtabzqwzFWxZpRPEodLzoUcb7B2RaDfeVrvMJV23/kKig1M8QRM97yqKXgsl4cJ RDcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1728987453; x=1729592253; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=/vsiyFH7AdAG35W+mWfukPu7OxX/u28De0FB1ag7l3I=; b=BU3rFmmb81bk1Q4n0L1MK2lV+xTL02ahecr78z/UWNkd8L42cf0PEe+Mv4Jv4C1PwG h4Aamj+xLPpENTaxzp4zoawS1tmkDB1vT+5J+SBqUeGkEnbQTj9AGBz98qU5gAt31wE9 KITdkOEiJLU68etg8urPbmqaDcTokIrfX89h4bUSFTNtLC8+wd1LXBUalYKkdAajx1IO R3itzrFWkVZ0Z3iS1HFDLak9SLcfB6FUa2oZnxdoWMvbFVQ0N4OdnDWZ/0LPi+WIxIYS irATpbd7ULmN4Y/Ty1l/znT2k8vQcMu1KapA/TYuMvzTd0ZnR5crnF/JD1Ccq/fS0c7w 8/kw== X-Forwarded-Encrypted: i=1; AJvYcCXWXR4hK/bZs4OWBq+73fqVhzXa+qaa+w08zlvMSq9KCFxfeRe3540VPod29RaJbr6bT0geiGSUa9ZyWJLRe7sU@lists.infradead.org X-Gm-Message-State: AOJu0YxwTSSuQbrcwNaV4EurCH81G0IjGzf4AUi3hOFIlisBsybJuz6y UNhiCsiR/Gic4jFS4NMTFe2AQyoT7PpMI+DQieZRycM7mf+uqbDj/X4BDCyveI0= X-Google-Smtp-Source: AGHT+IFoSBcZrkiChgB4pqL7tE0eZfJ4KXAE8/CROlLVwwwfJ7xMioU8E2x8rJrk0YsmPXDwWauSdg== X-Received: by 2002:a05:6402:43ce:b0:5c4:1320:e5a3 with SMTP id 4fb4d7f45d1cf-5c948cd8df1mr11041123a12.16.1728987452987; Tue, 15 Oct 2024 03:17:32 -0700 (PDT) Received: from rayden.urgonet (h-217-31-164-171.A175.priv.bahnhof.se. [217.31.164.171]) by smtp.gmail.com with ESMTPSA id 4fb4d7f45d1cf-5c98d778b80sm519581a12.78.2024.10.15.03.17.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 15 Oct 2024 03:17:32 -0700 (PDT) From: Jens Wiklander To: linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, linaro-mm-sig@lists.linaro.org, op-tee@lists.trustedfirmware.org, linux-arm-kernel@lists.infradead.org Cc: Olivier Masse , Thierry Reding , Yong Wu , Sumit Semwal , Benjamin Gaignard , Brian Starkey , John Stultz , "T . J . Mercier" , =?utf-8?q?Christian_K=C3=B6nig?= , Sumit Garg , Matthias Brugger , AngeloGioacchino Del Regno , azarrabi@qti.qualcomm.com, Jens Wiklander Subject: [RFC PATCH v2 0/2] TEE subsystem for restricted dma-buf allocations Date: Tue, 15 Oct 2024 12:15:32 +0200 Message-ID: <20241015101716.740829-1-jens.wiklander@linaro.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20241015_031735_270999_BB5D4B1B X-CRM114-Status: GOOD ( 16.27 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi, This patch set allocates the restricted DMA-bufs via the TEE subsystem. This a complete rewrite compared to the previous patch set [1], and other earlier proposals [2] and [3] with a separate restricted heap. The TEE subsystem handles the DMA-buf allocations since it is the TEE (OP-TEE, AMD-TEE, TS-TEE, or a future QTEE) which sets up the restrictions for the memory used for the DMA-bufs. I've added a new IOCTL, TEE_IOC_RSTMEM_ALLOC, to allocate the restricted DMA-bufs. This new IOCTL reaches the backend TEE driver, allowing it to choose how to allocate the restricted physical memory. TEE_IOC_RSTMEM_ALLOC is quite similar to TEE_IOC_SHM_ALLOC so it's tempting to extend TEE_IOC_SHM_ALLOC with two new flags TEE_IOC_SHM_FLAG_SECURE_VIDEO and TEE_IOC_SHM_FLAG_SECURE_TRUSTED_UI for the same feature. However, it might be a bit confusing since TEE_IOC_SHM_ALLOC only returns an anonymous file descriptor, but TEE_IOC_SHM_FLAG_SECURE_VIDEO and TEE_IOC_SHM_FLAG_SECURE_TRUSTED_UI would return a DMA-buf file descriptor instead. What do others think? This can be tested on QEMU with the following steps: repo init -u https://github.com/jenswi-linaro/manifest.git -m qemu_v8.xml \ -b prototype/sdp-v2 repo sync -j8 cd build make toolchains -j4 make all -j$(nproc) make run-only # login and at the prompt: xtest --sdp-basic https://optee.readthedocs.io/en/latest/building/prerequisites.html list dependencies needed to build the above. The tests are pretty basic, mostly checking that a Trusted Application in the secure world can access and manipulate the memory. There are also some negative tests for out of bounds buffers etc. Thanks, Jens [1] https://lore.kernel.org/lkml/20240830070351.2855919-1-jens.wiklander@linaro.org/ [2] https://lore.kernel.org/dri-devel/20240515112308.10171-1-yong.wu@mediatek.com/ [3] https://lore.kernel.org/lkml/20220805135330.970-1-olivier.masse@nxp.com/ Changes since the V1 RFC: * Based on v6.11 * Complete rewrite, replacing the restricted heap with TEE_IOC_RSTMEM_ALLOC Changes since Olivier's post [2]: * Based on Yong Wu's post [1] where much of dma-buf handling is done in the generic restricted heap * Simplifications and cleanup * New commit message for "dma-buf: heaps: add Linaro restricted dmabuf heap support" * Replaced the word "secure" with "restricted" where applicable Jens Wiklander (2): tee: add restricted memory allocation optee: support restricted memory allocation drivers/tee/Makefile | 1 + drivers/tee/optee/core.c | 21 ++++ drivers/tee/optee/optee_private.h | 6 + drivers/tee/optee/optee_smc.h | 35 ++++++ drivers/tee/optee/smc_abi.c | 45 ++++++- drivers/tee/tee_core.c | 33 ++++- drivers/tee/tee_private.h | 2 + drivers/tee/tee_rstmem.c | 200 ++++++++++++++++++++++++++++++ drivers/tee/tee_shm.c | 2 + drivers/tee/tee_shm_pool.c | 69 ++++++++++- include/linux/tee_core.h | 6 + include/linux/tee_drv.h | 9 ++ include/uapi/linux/tee.h | 33 ++++- 13 files changed, 455 insertions(+), 7 deletions(-) create mode 100644 drivers/tee/tee_rstmem.c