Commit graph

63 commits

Author SHA1 Message Date
Andrey Markovytch
a15fd37785 qseecom: added small sleep between busy-wait calls to TZ
In case of time penalty coming from TZ side when the wrong password
is entered too many times, there should be sleep between the scm calls
to give other HLOS tasks opportunity to run. Otherwise starvation may
occur.

Change-Id: I345a9b6c82fb5e591d8bdcf48afed48ccaafddc3
Signed-off-by: Andrey Markovytch <andreym@codeaurora.org>
2016-06-09 15:11:59 -07:00
Zhen Kong
404b7fade5 qseecom: add a new flag commonlib64-loaded-by-uefi
Add flag commonlib64-loaded-by-uefi to indicate commonlib64
is loaded by uefi already.

Change-Id: I9dd3f6bf92e178f1207424b09f39f2e08164df17
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-05-05 15:14:36 -07:00
Zhen Kong
2afa009826 qseecom: don't release ion share memory if scm_call unload TA failed
If a scm_call request to shutdown a TA fails, the TA is not shut down
and still in use, and the resources aren't necessarily leaked. Since
shared memory are still locked in this situation, ion shared memory
cannot be released, otherwise XPU violation occurs. Only need to
release shared memory if TA is unloaded success or that TA cannot
be found

Change-Id: I971485fb541193f77960cc7ca14b5b09de938a43
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-25 16:03:33 -07:00
Zhen Kong
d328092b8d qseecom: move compat_qseecom.h
The uapi directory shouldn't contain compat definitions,
so move this file out of there.

Change-Id: Ieef35ec02157c253a137c1b1bce3c6518c7f1b31
Signed-off-by: Jeremy Gebben <jgebben@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-25 16:03:16 -07:00
AnilKumar Chimata
9a11e43908 qseecom: Remove the dead code from driver
For kernel clients, some of the flags are maintained which is not required
as those are specific to userspace clients. So remove the code which is
not required.

Change-Id: If7fb51cc17e9a8c0f3c2632e9c42d84489bda4f6
Signed-off-by: Mallikarjuna Reddy Amireddy <mamire@codeaurora.org>
2016-03-25 16:02:31 -07:00
Zhen Kong
f6b4ea8dca qseecom: release ION memory if qseecom failed to unload app
To avoid memory leakage, make change to release ION memory if qseecom
failed to unload TZ app, which is allocated when starting app.

CRs-Fixed: 977073
Change-Id: Ic4c9a7d7a118ff5026ce6ce7769a4c053906ed2d
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-23 21:20:46 -07:00
AnilKumar Chimata
2f0b2a8d5f qseecom: Fix stack out of bounds issue
While copying the request buffer to temporary buffer large size
of request buffer is copied which leads to accessing stack out
of its size.

<3>[   24.265116] ==================================================================
<3>[   24.271333] BUG: KASAN: stack-out-of-bounds in memcpy+0x28/0x54 at addr ffffffc05890b744
<3>[   24.279388] Read of size 4096 by task vold/362
<0>[   24.283819] page:ffffffba494e3790 count:0 mapcount:0 mapping:          (null) index:0x0
<0>[   24.291800] flags: 0x0()
<1>[   24.294318] page dumped because: kasan: bad access detected
<6>[   24.299884] CPU: 1 PID: 362 Comm: vold Not tainted 3.18.20-g7bb9977 #1
<6>[   24.299895] Hardware name: Qualcomm Technologies, Inc. MSM8937-PMI8950 MTP (DT)
<0>[   24.299904] Call trace:
<6>[   24.302314] [<ffffffc00008c80c>] dump_backtrace+0x0/0x284
<6>[   24.302329] [<ffffffc00008caa0>] show_stack+0x10/0x1c
<6>[   24.302345] [<ffffffc001e7c4ac>] dump_stack+0x74/0xfc
<6>[   24.302362] [<ffffffc0002f8880>] kasan_report+0x3b4/0x504
<6>[   24.302376] [<ffffffc0002f7ae0>] __asan_loadN+0x20/0x14c
<6>[   24.302389] [<ffffffc0002f7fe4>] memcpy+0x24/0x54
<6>[   24.302406] [<ffffffc000bfdf80>] qseecom_scm_call2+0xec0/0x1c94
<6>[   24.302421] [<ffffffc000c00798>] qseecom_scm_call.constprop.41+0x64/0x7c
<6>[   24.302436] [<ffffffc000c0513c>] qseecom_create_key+0x304/0x680
<6>[   24.302450] [<ffffffc000c1084c>] qseecom_ioctl+0x2fb8/0x4944
<6>[   24.302464] [<ffffffc000333f70>] do_vfs_ioctl+0x9c8/0xb0c
<6>[   24.302476] [<ffffffc00033410c>] SyS_ioctl+0x58/0x8c
<3>[   24.302484] Memory state around the buggy address:
<3>[   24.307080]  ffffffc05890b680: f2 f2 f2 f2 00 04 f4 f4 f2 f2 f2 f2 00 00 00 00
<3>[   24.314283]  ffffffc05890b700: 04 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00
<3>[   24.321488] >ffffffc05890b780: 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00
<3>[   24.328690]                       ^
<3>[   24.332164]  ffffffc05890b800: 00 00 04 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00
<3>[   24.339369]  ffffffc05890b880: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
<3>[   24.346571] ==================================================================
<4>[   24.353777] Disabling lock debugging due to kernel taint
<3>[   24.533597] QSEECOM: __qseecom_process_incomplete_cmd: fail:resp res= -65,app_id = 0,lstr = 12288
<6>[   24.541522] get_ice_device_from_storage_type: found ice device ffffffc05bd61f80
<3>[   24.545296] ==================================================================
<3>[   24.551503] BUG: KASAN: stack-out-of-bounds in memcpy+0x28/0x54 at addr ffffffc05890b7c4
<3>[   24.559558] Read of size 4096 by task vold/362
<0>[   24.563989] page:ffffffba494e3790 count:0 mapcount:0 mapping:          (null) index:0x0
<0>[   24.571966] flags: 0x0()
<1>[   24.574485] page dumped because: kasan: bad access detected
<6>[   24.580050] CPU: 1 PID: 362 Comm: vold Tainted: G    B          3.18.20-g7bb9977 #1
<6>[   24.580060] Hardware name: Qualcomm Technologies, Inc. MSM8937-PMI8950 MTP (DT)
<0>[   24.580069] Call trace:
<6>[   24.582482] [<ffffffc00008c80c>] dump_backtrace+0x0/0x284
<6>[   24.582497] [<ffffffc00008caa0>] show_stack+0x10/0x1c
<6>[   24.582513] [<ffffffc001e7c4ac>] dump_stack+0x74/0xfc
<6>[   24.582529] [<ffffffc0002f8880>] kasan_report+0x3b4/0x504
<6>[   24.582543] [<ffffffc0002f7ae0>] __asan_loadN+0x20/0x14c
<6>[   24.582556] [<ffffffc0002f7fe4>] memcpy+0x24/0x54
<6>[   24.582574] [<ffffffc000bfe128>] qseecom_scm_call2+0x1068/0x1c94
<6>[   24.582588] [<ffffffc000c00798>] qseecom_scm_call.constprop.41+0x64/0x7c
<6>[   24.582603] [<ffffffc000c04c30>] __qseecom_set_clear_ce_key+0xf4/0x2fc
<6>[   24.582616] [<ffffffc000c05334>] qseecom_create_key+0x4fc/0x680
<6>[   24.582630] [<ffffffc000c1084c>] qseecom_ioctl+0x2fb8/0x4944
<6>[   24.582644] [<ffffffc000333f70>] do_vfs_ioctl+0x9c8/0xb0c
<6>[   24.582656] [<ffffffc00033410c>] SyS_ioctl+0x58/0x8c
<3>[   24.582664] Memory state around the buggy address:
<3>[   24.587250]  ffffffc05890b700: 04 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00
<3>[   24.594453]  ffffffc05890b780: 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 00 00
<3>[   24.601656] >ffffffc05890b800: 00 00 04 f4 f3 f3 f3 f3 00 00 00 00 00 00 00 00
<3>[   24.608860]                          ^
<3>[   24.612596]  ffffffc05890b880: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
<3>[   24.619802]  ffffffc05890b900: 04 f4 f4 f4 f2 f2 f2 f2 00 f4 f4 f4 f2 f2 f2 f2
<3>[   24.627001] ==================================================================
<6>[   24.799462] get_ice_device_from_storage_type: found ice device ffffffc05bd61f80
<3>[   24.803065] QSEECOM: qseecom_create_key: Set the key successfully

Change-Id: Id683067d29531686dafe94114ba3329f87292923
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
2016-03-23 21:20:33 -07:00
Mallikarjuna Reddy Amireddy
1506b57673 qseecom: Get appsbl qseecom load status from bootargs
App region notification has to be sent only once, if appsbl
has already sent then kernel should not send.

Change-Id: Ie1c7bb78be30c723fef6d9b89d488fdac36bc07f
Signed-off-by: Mallikarjuna Reddy Amireddy <mamire@codeaurora.org>
2016-03-23 21:19:03 -07:00
Reut Zysman
f3a88b7433 qseecom: Fix MDTP cipher DIP
Enable CE clocks before calling SCM. This is required to
check if MDTP is activated during recovery and to update the DIP
as required in case it is.

Change-Id: I01907d7cebae007c7f6a33d4bf29b3e4fc6e493c
Signed-off-by: Reut Zysman <rzysman@codeaurora.org>
Signed-off-by: Amit Blay <ablay@codeaurora.org>
2016-03-23 21:17:29 -07:00
Zhen Kong
c3a112da96 qseecom: fix an error related to app name comparision
Make changes to use strcmp to compare app name, and
avoid the memcpy comparision error if the first
several chars of an app name is exactly equal to
another app name. Besides, on some targets, keymaster
app may be first loaded as "keymaste" by qseecomd,
and then used as "keymaster". To avoid checking app
name error, register "keymaster" into app_list and
thread private data.

Change-Id: I468b4e5cb1d5d77ac5d687d0bddc8614b972785f
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-23 21:17:04 -07:00
Zhen Kong
80a9c6a26b qseecom: Add a new smc cmd to check RPMB key provision status
A new smc cmd is added to check RPMB key provision status

Change-Id: I50411bf9ae7f31589be34d7b5aaf48f2c12f0018
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-23 21:14:58 -07:00
Zhen Kong
deb62ed21a qseecom: make change to support sg list entry number larger than 512
qseecom_send_modfd_cmd_64 converts non-contiguous ION memory fd to
scatter-gather physical address list, and supports up to 512 SG list
entries. Now, 512 is not enough if client wants to send large data
in a fragmented system. In this change, if SG list entry number is
larger than 512, we will allocate a new contiguous kernel buffer,
then save all SG entries into this new buffer.

Change-Id: Id90eefb98b63bf16db755dae8e1482e448090f47
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-23 21:13:51 -07:00
Zhen Kong
848e0a86b6 qseecom: add snapshot of qseecom driver
This snapshot is taken as of msm-3.18 commit e70ad0cd
(Promotion of kernel.lnx.3.18-151201.)

Signed-off-by: Zhen Kong <zkong@codeaurora.org>
2016-03-22 11:10:18 -07:00