[v10,00/15] firmware: qcom: implement support for and enable SHM bridge

Message

Bartosz Golaszewski May 27, 2024, 12:54 p.m. UTC

SCM calls that take memory buffers as arguments require that they be
page-aligned, physically continuous and non-cachable. The same
requirements apply to the buffer used to pass additional arguments to SCM
calls that take more than 4.

To that end drivers typically use dma_alloc_coherent() to allocate memory
of suitable format which is slow and inefficient space-wise.

SHM Bridge is a safety mechanism that - once enabled - will only allow
passing buffers to the TrustZone that have been explicitly marked as
shared. It improves the overall system safety with SCM calls and is
required by the upcoming scminvoke functionality.

The end goal of this series is to enable SHM bridge support for those
architectures that support it but to that end we first need to unify the
way memory for SCM calls is allocated. This in itself is beneficial as
the current approach of using dma_alloc_coherent() in most places is quite
slow.

First let's add a new TZ Memory allocator that allows users to create
dynamic memory pools of format suitable for sharing with the TrustZone.
Make it ready for implementing multiple build-time modes.

Convert all relevant drivers to using it. Add separate pools for SCM core
and for qseecom.

Finally add support for SHM bridge and make it the default mode of
operation with the generic allocator as fallback for the platforms that
don't support SHM bridge.

Tested on db410c, RB5, sm8550-qrd, sa8775p-ride (verified the memory is
allocated from the dedicated pool) and lenovo X13s. I also tested on
sc8180x with SHM bridge disabled to make sure we can still use this SoC
with generic allocator.

v9 -> v10:
- add support for dedicated TZ FFI memory carveout and enable it for
  sa8775p
- add a blacklist of SoC known to not support SHM bridge correctly
  (currently only sc8180x)

v8 -> v9:
- split the qseecom driver rework into two parts: first convert it to using
  the __free() helper and then make it switch to tzmem
- use QCOM_SCM_PERM_RW instead of (QCOM_SCM_PERM_WRITE | QCOM_SCM_PERM_READ)
- add the TZMEM MAINTAINERS entry in correct alphabetical order
- add a missing break; in a switch case in the tzmem module

v7 -> v8:
- make the pool size dynamic and add different policies for pool growth
- improve commit messages and the cover letter: describe what the SHM
  bridge is and why do we need it and the new allocator, explain why it's
  useful to merge these changes already, independently from scminvoke
- improve kerneldoc format
- improve the comment on the PIL SCM calls
- fix license tags, drop "or-later" for GPL v2
- add lockdep and sleeping asserts
- minor tweaks and improvements

v6 -> v7:
- fix a Kconfig issue: TZMEM must select GENERIC_ALLOCATOR

v5 -> v6:
Fixed two issues reported by autobuilders:
- add a fix for memory leaks in the qseecom driver as the first patch for
  easier backporting to the v6.6.y branch
- explicitly cast the bus address stored in a variable of type dma_addr_t
  to phys_addr_t expected by the genpool API

v4 -> v5:
- fix the return value from qcom_tzmem_init() if SHM Bridge is not supported
- remove a comment that's no longer useful
- collect tags

v3 -> v4:
- include linux/sizes.h for SZ_X macros
- use dedicated RCU APIs to dereference radix tree slots
- fix kerneldocs
- fix the comment in patch 14/15: it's the hypervisor, not the TrustZone
  that creates the SHM bridge

v2 -> v3:
- restore pool management and use separate pools for different users
- don't use the new allocator in qcom_scm_pas_init_image() as the
  TrustZone will create an SHM bridge for us here
- rewrite the entire series again for most part

v1 -> v2:
- too many changes to list, it's a complete rewrite as explained above

---
Bartosz Golaszewski (15):
      dt-bindings: firmware: qcom,scm: add memory-region for sa8775p
      firmware: qcom: add a dedicated TrustZone buffer allocator
      firmware: qcom: scm: enable the TZ mem allocator
      firmware: qcom: scm: smc: switch to using the SCM allocator
      firmware: qcom: scm: make qcom_scm_assign_mem() use the TZ allocator
      firmware: qcom: scm: make qcom_scm_ice_set_key() use the TZ allocator
      firmware: qcom: scm: make qcom_scm_lmh_dcvsh() use the TZ allocator
      firmware: qcom: scm: make qcom_scm_qseecom_app_get_id() use the TZ allocator
      firmware: qcom: qseecom: convert to using the TZ allocator
      firmware: qcom: scm: add support for SHM bridge operations
      firmware: qcom: tzmem: enable SHM Bridge support
      firmware: qcom: scm: add support for SHM bridge memory carveout
      firmware: qcom: scm: clarify the comment in qcom_scm_pas_init_image()
      arm64: defconfig: enable SHM Bridge support for the TZ memory allocator
      arm64: dts: qcom: sa8775p: add a dedicated memory carveout for TZ

 .../devicetree/bindings/firmware/qcom,scm.yaml     |  15 +
 MAINTAINERS                                        |   8 +
 arch/arm64/boot/dts/qcom/sa8775p.dtsi              |   7 +
 arch/arm64/configs/defconfig                       |   1 +
 drivers/firmware/qcom/Kconfig                      |  31 ++
 drivers/firmware/qcom/Makefile                     |   1 +
 drivers/firmware/qcom/qcom_qseecom_uefisecapp.c    | 256 +++++------
 drivers/firmware/qcom/qcom_scm-smc.c               |  30 +-
 drivers/firmware/qcom/qcom_scm.c                   | 175 ++++++--
 drivers/firmware/qcom/qcom_scm.h                   |   6 +
 drivers/firmware/qcom/qcom_tzmem.c                 | 466 +++++++++++++++++++++
 drivers/firmware/qcom/qcom_tzmem.h                 |  13 +
 include/linux/firmware/qcom/qcom_qseecom.h         |   8 +-
 include/linux/firmware/qcom/qcom_scm.h             |  14 +-
 include/linux/firmware/qcom/qcom_tzmem.h           |  56 +++
 15 files changed, 854 insertions(+), 233 deletions(-)
---
base-commit: 3689b0ef08b70e4e03b82ebd37730a03a672853a
change-id: 20240527-shm-bridge-e2494fccb0b5

Best regards,

Comments

Bartosz Golaszewski June 17, 2024, 7:57 p.m. UTC | #1

On Mon, May 27, 2024 at 2:56 PM Bartosz Golaszewski <[e-mail]> wrote:
>
> SCM calls that take memory buffers as arguments require that they be
> page-aligned, physically continuous and non-cachable. The same
> requirements apply to the buffer used to pass additional arguments to SCM
> calls that take more than 4.
>

[...]

It's been three weeks. Ping?

Bart

Bjorn Andersson June 23, 2024, 10:09 p.m. UTC | #2

On Mon, 27 May 2024 14:54:50 +0200, Bartosz Golaszewski wrote:
> SCM calls that take memory buffers as arguments require that they be
> page-aligned, physically continuous and non-cachable. The same
> requirements apply to the buffer used to pass additional arguments to SCM
> calls that take more than 4.
> 
> To that end drivers typically use dma_alloc_coherent() to allocate memory
> of suitable format which is slow and inefficient space-wise.
> 
> [...]

Applied, thanks!

[15/15] arm64: dts: qcom: sa8775p: add a dedicated memory carveout for TZ
        commit: d7aeff30093888649789dcad070fe954745adf53

b4 gets confused by me applying patches across multiple branches, the other 14
patches has obviously also been applied.

Best regards,