- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP1 0/1] fix CVE-2024-42155
by Hongbo Li 31 Jul '24

31 Jul '24

Fix CVE-2024-42155. Holger Dengler (1): s390/pkey: Wipe copies of protected- and secure-keys drivers/s390/crypto/pkey_api.c | 81 ++++++++++++++++------------------ 1 file changed, 37 insertions(+), 44 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/1] fix CVE-2024-42155
by Hongbo Li 31 Jul '24

31 Jul '24

Fix CVE-2024-42155. Holger Dengler (1): s390/pkey: Wipe copies of protected- and secure-keys drivers/s390/crypto/pkey_api.c | 80 ++++++++++++++++------------------ 1 file changed, 37 insertions(+), 43 deletions(-) -- 2.34.1

2 2

[PATCH OLK-6.6 0/5] *** SUBJECT HERE ***
by hejingxian 31 Jul '24

31 Jul '24

From: ikarosYuuki <tujipei(a)huawei.com> *** BLURB HERE *** ikarosYuuki (5): add virtcca cvm host feature pmu: enable pmu phys irq inject for cvm mm: enable swiotlb alloc for cvm share mem config: modify arm64 defconfig for cvm feature gicv3: add lpi support for cvm guest arch/arm64/Kconfig | 8 + arch/arm64/configs/openeuler_defconfig | 5 +- arch/arm64/include/asm/kvm_emulate.h | 18 + arch/arm64/include/asm/kvm_host.h | 15 +- arch/arm64/include/asm/kvm_tmi.h | 333 ++++++++ arch/arm64/include/asm/kvm_tmm.h | 30 +- arch/arm64/include/asm/set_memory.h | 1 + arch/arm64/include/asm/virtcca_cvm_guest.h | 39 + arch/arm64/include/uapi/asm/kvm.h | 4 + arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/virtcca_cvm_guest.c | 93 +++ arch/arm64/kvm/Kconfig | 6 +- arch/arm64/kvm/Makefile | 3 + arch/arm64/kvm/arch_timer.c | 92 +++ arch/arm64/kvm/arm.c | 136 +++- arch/arm64/kvm/guest.c | 8 + arch/arm64/kvm/mmio.c | 17 +- arch/arm64/kvm/mmu.c | 7 + arch/arm64/kvm/pmu-emul.c | 9 + arch/arm64/kvm/psci.c | 12 +- arch/arm64/kvm/reset.c | 13 + arch/arm64/kvm/tmi.c | 141 ++++ arch/arm64/kvm/vgic/vgic-v3.c | 17 +- arch/arm64/kvm/vgic/vgic.c | 55 +- arch/arm64/kvm/virtcca_cvm.c | 889 +++++++++++++++++++++ arch/arm64/kvm/virtcca_cvm_exit.c | 221 +++++ arch/arm64/mm/init.c | 3 + arch/arm64/mm/mmu.c | 5 +- arch/arm64/mm/pageattr.c | 3 + drivers/irqchip/irq-gic-v3-its.c | 231 +++++- drivers/perf/arm_pmu.c | 17 + include/kvm/arm_arch_timer.h | 4 + include/linux/kvm_host.h | 22 + include/linux/perf/arm_pmu.h | 4 + include/uapi/linux/kvm.h | 13 + kernel/dma/swiotlb.c | 16 + virt/kvm/kvm_main.c | 4 + 37 files changed, 2437 insertions(+), 58 deletions(-) create mode 100644 arch/arm64/include/asm/kvm_tmi.h create mode 100644 arch/arm64/include/asm/virtcca_cvm_guest.h create mode 100644 arch/arm64/kernel/virtcca_cvm_guest.c create mode 100644 arch/arm64/kvm/tmi.c create mode 100644 arch/arm64/kvm/virtcca_cvm.c create mode 100644 arch/arm64/kvm/virtcca_cvm_exit.c -- 2.27.0

2 6

[PATCH OLK-5.10] cvm: delete dead code and resolve macro definition holes
by Ju Fu 31 Jul '24

31 Jul '24

virtcca inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I9TM0T -------------------------------- delete dead code and resolve macro definition holes Signed-off-by: Ju Fu <fuju1(a)huawei.com> --- diff -uprN itrustee_tzdriver/auth/auth_base_impl.c itrustee_tzdriver_new/auth/auth_base_impl.c --- itrustee_tzdriver/auth/auth_base_impl.c 2024-07-12 11:08:59.353629380 +0800 +++ itrustee_tzdriver_new/auth/auth_base_impl.c 2024-07-12 10:51:32.889629380 +0800 @@ -336,11 +336,25 @@ int check_teecd_auth(void) return CHECK_ACCESS_SUCC; } +int check_proxy_auth(void) +{ + int ret = check_proc_uid_path(PROXY_PATH_UID_AUTH_CTX); + if (ret != 0) { + return ret; + } + + return CHECK_ACCESS_SUCC; +} #else int check_teecd_auth(void) { return 0; } + +int check_proxy_auth(void) +{ + return 0; +} #endif #ifdef CONFIG_TEE_TELEPORT_AUTH diff -uprN itrustee_tzdriver/auth/auth_base_impl.h itrustee_tzdriver_new/auth/auth_base_impl.h --- itrustee_tzdriver/auth/auth_base_impl.h 2024-07-12 11:08:59.353629380 +0800 +++ itrustee_tzdriver_new/auth/auth_base_impl.h 2024-07-12 10:51:32.885629380 +0800 @@ -84,6 +84,7 @@ void mutex_crypto_hash_lock(void); void mutex_crypto_hash_unlock(void); int check_hidl_auth(void); int check_teecd_auth(void); +int check_proxy_auth(void); #else static inline void free_shash_handle(void) @@ -100,6 +101,11 @@ int check_teecd_auth(void) { return 0; } + +int check_proxy_auth(void) +{ + return 0; +} #endif /* CLIENT_AUTH || TEECD_AUTH */ diff -uprN itrustee_tzdriver/core/agent.c itrustee_tzdriver_new/core/agent.c --- itrustee_tzdriver/core/agent.c 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/agent.c 2024-07-12 10:51:32.865629380 +0800 @@ -298,7 +298,8 @@ int tc_ns_set_native_hash(unsigned long return ret; } -int tc_ns_late_init(unsigned long arg) +int tc_ns_late_init(const struct tc_ns_dev_file *dev_file, + unsigned long arg) { int ret = 0; struct tc_ns_smc_cmd smc_cmd = { {0}, 0 }; @@ -320,6 +321,8 @@ int tc_ns_late_init(unsigned long arg) smc_cmd.operation_h_phys = (uint64_t)mailbox_virt_to_phys((uintptr_t)&mb_pack->operation) >> ADDR_TRANS_NUM; + if (dev_file->isVM) + smc_cmd.nsid = dev_file->nsid; if (tc_ns_smc(&smc_cmd)) { ret = -EPERM; tloge("late int failed\n"); @@ -597,7 +600,8 @@ int tc_ns_wait_event(unsigned int agent_ return ret; } -int tc_ns_sync_sys_time(const struct tc_ns_client_time *tc_ns_time) +int tc_ns_sync_sys_time(const struct tc_ns_dev_file *dev_file, + const struct tc_ns_client_time *tc_ns_time) { struct tc_ns_smc_cmd smc_cmd = { {0}, 0 }; int ret = 0; @@ -623,6 +627,8 @@ int tc_ns_sync_sys_time(const struct tc_ smc_cmd.operation_phys = mailbox_virt_to_phys((uintptr_t)&mb_pack->operation); smc_cmd.operation_h_phys = (uint64_t)mailbox_virt_to_phys((uintptr_t)&mb_pack->operation) >> ADDR_TRANS_NUM; + if (dev_file && dev_file->isVM) + smc_cmd.nsid = dev_file->nsid; if (tc_ns_smc(&smc_cmd)) { tloge("tee adjust time failed, return error\n"); ret = -EPERM; @@ -632,7 +638,8 @@ int tc_ns_sync_sys_time(const struct tc_ return ret; } -int sync_system_time_from_user(const struct tc_ns_client_time *user_time) +int sync_system_time_from_user(const struct tc_ns_dev_file *dev_file, + const struct tc_ns_client_time *user_time) { int ret = 0; struct tc_ns_client_time time = { 0 }; @@ -647,7 +654,7 @@ int sync_system_time_from_user(const str return -EFAULT; } - ret = tc_ns_sync_sys_time(&time); + ret = tc_ns_sync_sys_time(dev_file, &time); if (ret != 0) tloge("sync system time from user failed, ret = 0x%x\n", ret); @@ -665,7 +672,7 @@ void sync_system_time_from_kernel(void) time.seconds = (uint32_t)kernel_time.ts.tv_sec; time.millis = (uint32_t)(kernel_time.ts.tv_nsec / MS_TO_NS); - ret = tc_ns_sync_sys_time(&time); + ret = tc_ns_sync_sys_time(NULL, &time); if (ret != 0) tloge("sync system time from kernel failed, ret = 0x%x\n", ret); @@ -949,6 +956,8 @@ int tc_ns_register_agent(struct tc_ns_de nsid = task_active_pid_ns(current)->ns.inum; if (dev_file != NULL && dev_file->nsid == 0) dev_file->nsid = nsid; + if (dev_file->isVM) + nsid = dev_file->nsid; #endif if (is_agent_already_exist(agent_id, nsid, &event_data, dev_file, &find_flag)) diff -uprN itrustee_tzdriver/core/agent.h itrustee_tzdriver_new/core/agent.h --- itrustee_tzdriver/core/agent.h 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/agent.h 2024-07-12 10:51:32.861629380 +0800 @@ -118,7 +118,8 @@ int agent_process_work(const struct tc_n unsigned int agent_id, unsigned int nsid); int is_agent_alive(unsigned int agent_id, unsigned int nsid); int tc_ns_set_native_hash(unsigned long arg, unsigned int cmd_id); -int tc_ns_late_init(unsigned long arg); +int tc_ns_late_init(const struct tc_ns_dev_file *dev_file, + unsigned long arg); int tc_ns_register_agent(struct tc_ns_dev_file *dev_file, unsigned int agent_id, unsigned int buffer_size, void **buffer, bool user_agent); int tc_ns_unregister_agent(unsigned int agent_id, unsigned int nsid); @@ -126,7 +127,8 @@ void send_crashed_event_response_all(con int tc_ns_wait_event(unsigned int agent_id, unsigned int nsid); int tc_ns_send_event_response(unsigned int agent_id, unsigned int nsid); void send_crashed_event_response_single(const struct tc_ns_dev_file *dev_file); -int sync_system_time_from_user(const struct tc_ns_client_time *user_time); +int sync_system_time_from_user(const struct tc_ns_dev_file *dev_file, + const struct tc_ns_client_time *user_time); void sync_system_time_from_kernel(void); int tee_agent_clear_work(struct tc_ns_client_context *context, unsigned int dev_file_id); diff -uprN itrustee_tzdriver/core/gp_ops.c itrustee_tzdriver_new/core/gp_ops.c --- itrustee_tzdriver/core/gp_ops.c 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/gp_ops.c 2024-07-12 10:51:32.845629380 +0800 @@ -231,6 +231,84 @@ int write_to_client(void __user *dest, s return 0; } +int read_from_VMclient(void *dest, size_t dest_size, + const void __user *src, size_t size, pid_t vm_pid) +{ + struct task_struct *vmp_task; + int i_rdlen; + int i_index; + int ret; + + if (!dest || !src) { + tloge("src or dest is NULL input buffer\n"); + return -EINVAL; + } + + if (size > dest_size) { + tloge("size is larger than dest_size or size is 0\n"); + return -EINVAL; + } + if (!size) + return 0; + + tlogv("django verbose, execute access_process_vm"); + vmp_task = get_pid_task(find_get_pid(vm_pid), PIDTYPE_PID); + if (vmp_task == NULL) { + tloge("no task for pid %d \n", vm_pid); + return -EFAULT; + } + tlogv("django verbose, task_struct * for pid %d is 0x%px", vm_pid, vmp_task); + + i_rdlen = access_process_vm(vmp_task, (unsigned long)(src), dest, size, FOLL_FORCE); + if (i_rdlen != size) { + tloge("only read %d of %ld bytes by access_process_vm \n", i_rdlen, size); + return -EFAULT; + } + tlogv("django verbose, read %d byes by access_process_vm succeed", + i_rdlen); + for (i_index = 0; i_index < 32 && i_index < size; i_index ++) { + tlogv("django verbose, *(dest + i_index) + %d) = %2.2x", + i_index, *((char*)dest + i_index)); + } + return 0; +} + +int write_to_VMclient(void __user *dest, size_t dest_size, + const void *src, size_t size, pid_t vm_pid) +{ + struct task_struct *vmp_task; + int i_wtlen; + int i_index; + int ret; + + if (!dest || !src) { + tloge("src or dest is NULL input buffer\n"); + return -EINVAL; + } + + if (size > dest_size) { + tloge("size is larger than dest_size or size is 0\n"); + return -EINVAL; + } + if (!size) + return 0; + + vmp_task = get_pid_task(find_get_pid(vm_pid), PIDTYPE_PID); + if (vmp_task == NULL) { + tloge("no task for pid %d \n", vm_pid); + return -EFAULT; + } + + i_wtlen = access_process_vm(vmp_task, (unsigned long)(dest), src, size, FOLL_FORCE | FOLL_WRITE); + if (i_wtlen != size) { + tloge("only write %d of %ld bytes by access_process_vm \n", i_wtlen, size); + return -EFAULT; + } + tlogv("django verbose, write %d byes by access_process_vm succeed", + i_wtlen); + return 0; +} + static bool is_input_tempmem(unsigned int param_type) { if (param_type == TEEC_MEMREF_TEMP_INPUT || @@ -240,7 +318,8 @@ static bool is_input_tempmem(unsigned in return false; } -static int update_input_data(const union tc_ns_client_param *client_param, +static int update_input_data(const struct tc_call_params *call_params, + const union tc_ns_client_param *client_param, uint32_t buffer_size, void *temp_buf, unsigned int param_type, uint8_t kernel_params) { @@ -250,11 +329,22 @@ static int update_input_data(const union buffer_addr = client_param->memref.buffer | ((uint64_t)client_param->memref.buffer_h_addr << ADDR_TRANS_NUM); - if (read_from_client(temp_buf, buffer_size, - (void *)(uintptr_t)buffer_addr, - buffer_size, kernel_params) != 0) { - tloge("copy memref buffer failed\n"); - return -EFAULT; + if (call_params->dev->isVM && !kernel_params) { + tlogd("is VM\n"); + if (read_from_VMclient(temp_buf, buffer_size, + (void *)(uintptr_t)buffer_addr, + buffer_size, call_params->dev->vmpid) != 0) { + tloge("copy memref buffer failed\n"); + return -EFAULT; + } + } else { + tlogd("is not VM\n"); + if (read_from_client(temp_buf, buffer_size, + (void *)(uintptr_t)buffer_addr, + buffer_size, kernel_params) != 0) { + tloge("copy memref buffer failed\n"); + return -EFAULT; + } } return 0; } @@ -312,7 +402,7 @@ static int alloc_for_tmp_mem(const struc op_params->local_tmpbuf[index].temp_buffer = temp_buf; op_params->local_tmpbuf[index].size = buffer_size; - if (update_input_data(client_param, buffer_size, temp_buf, + if (update_input_data(call_params, client_param, buffer_size, temp_buf, param_type, kernel_params) != 0) return -EFAULT; @@ -324,8 +414,9 @@ static int alloc_for_tmp_mem(const struc return 0; } -static int check_buffer_for_ref(uint32_t *buffer_size, - const union tc_ns_client_param *client_param, uint8_t kernel_params) +static int check_buffer_for_ref(const struct tc_call_params *call_params, + uint32_t *buffer_size, const union tc_ns_client_param *client_param, + uint8_t kernel_params) { uint64_t size_addr = client_param->memref.size_addr | ((uint64_t)client_param->memref.size_h_addr << ADDR_TRANS_NUM); @@ -416,7 +507,7 @@ static int alloc_for_ref_mem(const struc return -EINVAL; client_param = &(call_params->context->params[index]); - if (check_buffer_for_ref(&buffer_size, client_param, kernel_params) != 0) + if (check_buffer_for_ref(call_params, &buffer_size, client_param, kernel_params) != 0) return -EINVAL; op_params->mb_pack->operation.params[index].memref.buffer = 0; @@ -491,6 +582,134 @@ static int check_buffer_for_sharedmem(ui return 0; } +typedef union { + struct{ + uint64_t user_addr; + uint64_t page_num; + }block; + struct{ + uint64_t vm_page_size; + uint64_t shared_mem_size; + }share; +}struct_page_block; + +int fill_vm_shared_mem_info_block(uint64_t block_buf, uint32_t block_nums, + uint32_t offset, uint32_t buffer_size, uint64_t info_addr, uint32_t vm_page_size,pid_t vm_pid) +{ + struct pagelist_info *page_info = NULL; + struct page **host_pages = NULL; + uint64_t *phys_addr = NULL; + uint32_t host_page_num; + uint32_t i; + uint32_t j; + uint32_t k; + uint32_t block_page_total_no = 0; + struct task_struct *vmp_task; + uint32_t vm_pages_no = 0; + uint32_t host_pages_no = 0; + uint32_t host_offset = 0; + uint64_t vm_start_vaddr; + void *host_start_vaddr; + uint32_t page_total_no = 0; + uint32_t vm_pages_total_size = 0; + vmp_task = get_pid_task(find_get_pid(vm_pid), PIDTYPE_PID); + if (vmp_task == NULL) { + tloge("no task for pid %d", vm_pid); + return -EFAULT; + } + uint32_t expect_page_num = PAGE_ALIGN(buffer_size + (offset & (~PAGE_MASK))) / PAGE_SIZE; + struct_page_block *page_block = (struct_page_block *)(uintptr_t)block_buf; + for (i = 0; i < block_nums; i++){ + vm_start_vaddr = page_block[i].block.user_addr; + vm_pages_no = page_block[i].block.page_num; + + if (i==0 && vm_page_size > PAGE_SIZE) { + vm_start_vaddr += (offset & PAGE_MASK); + vm_pages_total_size = vm_pages_no * vm_page_size - (offset & PAGE_MASK); + } else { + vm_pages_total_size = vm_pages_no * vm_page_size; + } + + host_offset = ((uint32_t)(uintptr_t)vm_start_vaddr) & (~PAGE_MASK); + host_start_vaddr = (void *)(((uint64_t)vm_start_vaddr) & PAGE_MASK); + host_pages_no = PAGE_ALIGN(host_offset + vm_pages_total_size) / PAGE_SIZE; + if (i== block_nums -1 && vm_page_size > PAGE_SIZE) + host_pages_no = expect_page_num - page_total_no; + + host_pages = (struct page **)vmalloc(host_pages_no * sizeof(uint64_t)); + if (host_pages == NULL) + return -EFAULT; + tlogd("page_block[%u].block.user_addr = %llx, page_block[%u].block.page_num = %llx\n", i, vm_start_vaddr, i, vm_pages_no); + + #if (KERNEL_VERSION(6, 5, 0) <= LINUX_VERSION_CODE) + host_page_num = get_user_pages_remote(vmp_task->mm, host_start_vaddr, + (unsigned long)host_pages_no, + FOLL_FORCE, host_pages, NULL); + #elif (KERNEL_VERSION(5, 9, 0) <= LINUX_VERSION_CODE) + host_page_num = get_user_pages_remote(vmp_task->mm, host_start_vaddr, + (unsigned long)host_pages_no, + FOLL_FORCE, host_pages, + NULL, NULL); + #elif (KERNEL_VERSION(4, 10, 0) <= LINUX_VERSION_CODE) + host_page_num = get_user_pages_remote(vmp_task, vmp_task->mm, + host_start_vaddr, (unsigned long)host_pages_no, FOLL_FORCE, + host_pages, NULL, NULL); + #elif (KERNEL_VERSION(4, 9, 0) <= LINUX_VERSION_CODE) + host_page_num = get_user_pages_remote(vmp_task, vmp_task->mm, + host_start_vaddr, (unsigned long)host_pages_no, + FOLL_FORCE, host_pages, NULL); + #else + host_page_num = get_user_pages_remote(vmp_task, vmp_task->mm, + host_start_vaddr, (unsigned long)host_pages_no, + 1, 1, host_pages, NULL); + #endif + if (host_page_num != host_pages_no) { + tloge("get pages failed, page_num = %u, expect %u\n", host_page_num, host_pages_no); + if (host_page_num > 0) { + release_pages(host_pages, host_page_num); + } + vfree(host_pages); + return -EFAULT; + } + + phys_addr = (uint64_t *)(uintptr_t)info_addr + (sizeof(*page_info) / sizeof(uint64_t)); + phys_addr = (uint64_t *)((char *)phys_addr + page_total_no * sizeof(uint64_t)); + block_page_total_no = 0; + for (j = 0; j < host_pages_no; j++) { + struct page *page = NULL; + page = host_pages[j]; + if (page == NULL) { + release_pages(host_pages, host_page_num); + vfree(host_pages); + tloge("page == NULL \n"); + return -EFAULT; + } + void *host_page_phy = (uintptr_t)page_to_phys(page); + if (vm_page_size < PAGE_SIZE) { + if (j !=0) + host_offset = 0; + uint32_t litil_page_num = (PAGE_SIZE - host_offset) / vm_page_size; + uint64_t host_page_start_addr = (uint64_t)host_page_phy + host_offset; + for (k = 0; k < litil_page_num && block_page_total_no < vm_pages_no;k++) { + phys_addr[block_page_total_no++] = host_page_start_addr + k * vm_page_size; + } + } else if (vm_page_size >= PAGE_SIZE){ + phys_addr[j] = (uintptr_t)page_to_phys(page); + } + } + page_total_no += (vm_page_size >= PAGE_SIZE ? host_pages_no : vm_pages_no); + vfree(host_pages); + } + + page_info = (struct pagelist_info *)(uintptr_t)info_addr; + page_info->page_num = page_total_no; + page_info->page_size = (vm_page_size > PAGE_SIZE ? PAGE_SIZE : vm_page_size); + page_info->sharedmem_offset = offset & (~PAGE_MASK); + page_info->sharedmem_size = buffer_size; + + return 0; +} + static int transfer_shared_mem(const struct tc_call_params *call_params, struct tc_op_params *op_params, uint8_t kernel_params, uint32_t param_type, unsigned int index) @@ -499,10 +718,11 @@ static int transfer_shared_mem(const str void *start_vaddr = NULL; union tc_ns_client_param *client_param = NULL; uint32_t buffer_size; - uint32_t pages_no; + uint32_t pages_no = 0; uint32_t offset; uint32_t buff_len; uint64_t buffer_addr; + uint32_t i; if (index >= TEE_PARAM_NUM) return -EINVAL; @@ -513,19 +733,57 @@ static int transfer_shared_mem(const str buffer_addr = client_param->memref.buffer | ((uint64_t)client_param->memref.buffer_h_addr << ADDR_TRANS_NUM); - buff = (void *)(uint64_t)(buffer_addr + client_param->memref.offset); - start_vaddr = (void *)(((uint64_t)buff) & PAGE_MASK); - offset = ((uint32_t)(uintptr_t)buff) & (~PAGE_MASK); - pages_no = PAGE_ALIGN(offset + buffer_size) / PAGE_SIZE; - - buff_len = sizeof(struct pagelist_info) + (sizeof(uint64_t) * pages_no); - buff = mailbox_alloc(buff_len, MB_FLAG_ZERO); - if (buff == NULL) - return -EFAULT; - if (fill_shared_mem_info((uint64_t)start_vaddr, pages_no, offset, buffer_size, (uint64_t)buff)) { - mailbox_free(buff); - return -EFAULT; + if (call_params->dev->isVM) { + uint32_t block_buf_size = buffer_size - sizeof(struct_page_block); + void *tmp_buf = kzalloc(buffer_size, GFP_KERNEL); + if (read_from_client(tmp_buf, buffer_size, buffer_addr, buffer_size, 0)) { + tloge("copy blocks failed\n"); + return -EFAULT; + } + struct_page_block *block_buf = (struct_page_block *)((char *)tmp_buf + sizeof(struct_page_block)); + uint32_t block_nums = block_buf_size / sizeof(struct_page_block); + uint32_t share_mem_size = ((struct_page_block *)tmp_buf)->share.shared_mem_size; + uint32_t vm_page_size = ((struct_page_block *)tmp_buf)->share.vm_page_size; + + call_params->dev->vm_page_size = vm_page_size; + offset = (uint64_t)(client_param->memref.h_offset + client_param->memref.offset); + for(i = 0;i < block_nums; i++){ + pages_no += block_buf[i].block.page_num; + } + if (vm_page_size > PAGE_SIZE){ + buff = (void *)(uint64_t)(client_param->memref.h_offset + client_param->memref.offset); + pages_no = PAGE_ALIGN((((uint32_t)(uintptr_t)buff) & (~PAGE_MASK)) + share_mem_size) / PAGE_SIZE; + tlogd("page_no = %u \n", pages_no); + } + + buff_len = sizeof(struct pagelist_info) + (sizeof(uint64_t) * pages_no); + buff = mailbox_alloc(buff_len, MB_FLAG_ZERO); + if (buff == NULL) { + kfree(tmp_buf); + return -EFAULT; + } + if (fill_vm_shared_mem_info_block((uint64_t)block_buf, block_nums, offset, + share_mem_size, (uint64_t)buff, vm_page_size, call_params->dev->vmpid)) { + kfree(tmp_buf); + mailbox_free(buff); + return -EFAULT; + } + kfree(tmp_buf); + } else { + buff = (void *)(uint64_t)(buffer_addr + client_param->memref.offset); + start_vaddr = (void *)(((uint64_t)buff) & PAGE_MASK); + offset = ((uint32_t)(uintptr_t)buff) & (~PAGE_MASK); + pages_no = PAGE_ALIGN(offset + buffer_size) / PAGE_SIZE; + + buff_len = sizeof(struct pagelist_info) + (sizeof(uint64_t) * pages_no); + buff = mailbox_alloc(buff_len, MB_FLAG_ZERO); + if (buff == NULL) + return -EFAULT; + if (fill_shared_mem_info((uint64_t)start_vaddr, pages_no, offset, buffer_size, (uint64_t)buff)) { + mailbox_free(buff); + return -EFAULT; + } } op_params->local_tmpbuf[index].temp_buffer = buff; @@ -695,13 +953,24 @@ static int update_tmp_mem(const struct t if (buffer_size == 0) return 0; /* Only update the buffer when the buffer size is valid in complete case */ - if (write_to_client((void *)(uintptr_t)buffer_addr, - operation->params[index].memref.size, - op_params->local_tmpbuf[index].temp_buffer, - operation->params[index].memref.size, - call_params->dev->kernel_api) != 0) { - tloge("copy tempbuf failed\n"); - return -ENOMEM; + if (call_params->dev->isVM && !call_params->dev->kernel_api) { + if (write_to_VMclient((void *)(uintptr_t)buffer_addr, + operation->params[index].memref.size, + op_params->local_tmpbuf[index].temp_buffer, + operation->params[index].memref.size, + call_params->dev->vmpid) != 0) { + tloge("copy tempbuf failed\n"); + return -ENOMEM; + } + } else { + if (write_to_client((void *)(uintptr_t)buffer_addr, + operation->params[index].memref.size, + op_params->local_tmpbuf[index].temp_buffer, + operation->params[index].memref.size, + call_params->dev->kernel_api) != 0) { + tloge("copy tempbuf failed\n"); + return -ENOMEM; + } } return 0; } @@ -871,7 +1140,10 @@ static void free_operation_params(const #ifdef CONFIG_NOCOPY_SHAREDMEM tlogd("free_operation_params release nocopy or register shm\n"); temp_buf = local_tmpbuf[index].temp_buffer; - if (temp_buf != NULL) { + if (temp_buf != NULL && call_params->dev->isVM) { + release_vm_shared_mem_page(temp_buf, local_tmpbuf[index].size, call_params->dev->vm_page_size); + mailbox_free(temp_buf); + } else if (temp_buf != NULL && !call_params->dev->isVM) { release_shared_mem_page(temp_buf, local_tmpbuf[index].size); mailbox_free(temp_buf); } diff -uprN itrustee_tzdriver/core/gp_ops.h itrustee_tzdriver_new/core/gp_ops.h --- itrustee_tzdriver/core/gp_ops.h 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/gp_ops.h 2024-07-12 10:51:32.841629380 +0800 @@ -28,5 +28,9 @@ int tc_client_call(const struct tc_call_ bool is_tmp_mem(uint32_t param_type); bool is_ref_mem(uint32_t param_type); bool is_val_param(uint32_t param_type); +int write_to_VMclient(void __user *dest, size_t dest_size, + const void *src, size_t size, pid_t vm_pid); +int read_from_VMclient(void *dest, size_t dest_size, + const void __user *src, size_t size, pid_t vm_pid); #endif diff -uprN itrustee_tzdriver/core/session_manager.c itrustee_tzdriver_new/core/session_manager.c --- itrustee_tzdriver/core/session_manager.c 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/session_manager.c 2024-07-12 10:51:32.801629380 +0800 @@ -589,7 +589,7 @@ static struct tc_ns_service *tc_ref_serv } static int tc_ns_service_init(const unsigned char *uuid, uint32_t uuid_len, - struct tc_ns_service **new_service) + struct tc_ns_service **new_service, uint32_t nsid) { int ret = 0; struct tc_ns_service *service = NULL; @@ -610,7 +610,7 @@ static int tc_ns_service_init(const unsi } #ifdef CONFIG_CONFIDENTIAL_CONTAINER - service->nsid = task_active_pid_ns(current)->ns.inum; + service->nsid = nsid; #else service->nsid = PROC_PID_INIT_INO; #endif @@ -648,7 +648,11 @@ static struct tc_ns_service *find_servic struct tc_ns_service *service = NULL; bool is_full = false; #ifdef CONFIG_CONFIDENTIAL_CONTAINER - unsigned int nsid = task_active_pid_ns(current)->ns.inum; + unsigned int nsid; + if (dev_file->isVM) + nsid = dev_file->nsid; + else + nsid = task_active_pid_ns(current)->ns.inum; #else unsigned int nsid = PROC_PID_INIT_INO; #endif @@ -677,7 +681,7 @@ static struct tc_ns_service *find_servic goto add_service; } /* Create a new service if we couldn't find it in list */ - ret = tc_ns_service_init(context->uuid, UUID_LEN, &service); + ret = tc_ns_service_init(context->uuid, UUID_LEN, &service, nsid); /* unlock after init to make sure find service from all is correct */ mutex_unlock(&g_service_list_lock); if (ret != 0) { @@ -791,10 +795,19 @@ static int32_t load_image_copy_file(stru } return 0; } - if (copy_from_user(params->mb_load_mem + sizeof(load_flag), - (const void __user *)params->file_buffer + loaded_size, load_size)) { - tloge("file buf get fail\n"); - return -EFAULT; + if (params->dev_file->isVM) { + if (read_from_VMclient(params->mb_load_mem + sizeof(load_flag), + load_size, (const void __user *)(params->file_buffer + loaded_size), + load_size, (pid_t)params->dev_file->vmpid)) { + tloge("file buf get failed \n"); + return -EFAULT; + } + } else { + if (copy_from_user(params->mb_load_mem + sizeof(load_flag), + (const void __user *)(params->file_buffer + loaded_size), load_size)) { + tloge("file buf get failed \n"); + return -EFAULT; + } } return 0; } @@ -1387,10 +1400,109 @@ find_session: return ret; } +static int process_vm_ref(struct tc_ns_dev_file *dev_file, + struct tc_ns_client_context *context, unsigned long long *vm_buffers) +{ + struct tc_ns_shared_mem *shared_mem = NULL; + int index = 0; + uint32_t buffer_size; + unsigned int offset = 0; + void *buffer_addr = NULL; + void *size_addr = NULL; + unsigned long long vm_hvas[TEE_PARAM_NUM]={0}; + + if (!dev_file->isVM || !context->file_buffer) + return 0; + + if (copy_from_user(vm_hvas, context->file_buffer, context->file_size) != 0) { + tloge("copy from user failed\n"); + return -EFAULT; + } + + mutex_lock(&dev_file->shared_mem_lock); + list_for_each_entry(shared_mem, &dev_file->shared_mem_list, head) { + for (index = 0; index < TEE_PARAM_NUM; index++) { + buffer_addr = (void *)(uintptr_t)(context->params[index].memref.buffer | + ((uint64_t)context->params[index].memref.buffer_h_addr << ADDR_TRANS_NUM)); + if (shared_mem->user_addr == buffer_addr) { + buffer_addr = (void *)(uintptr_t)(shared_mem->kernel_addr); + size_addr = (void *)(uintptr_t)(context->params[index].memref.size_addr | + ((uint64_t)context->params[index].memref.size_h_addr << ADDR_TRANS_NUM)); + offset = context->params[index].memref.offset; + + if (copy_from_user(&buffer_size, size_addr, sizeof(uint32_t))) { + tloge("copy memref.size_addr failed\n"); + return -EFAULT; + } + + if (read_from_VMclient(buffer_addr + offset, buffer_size, + (uint32_t __user *)(uintptr_t)(vm_hvas[index] + offset), + buffer_size, dev_file->vmpid)) { + tloge("copy memref.buffer failed\n"); + return -EFAULT; + } + vm_buffers[index] = vm_hvas[index]; + } + } + } + mutex_unlock(&dev_file->shared_mem_lock); + return 0; +} + +static int process_vm_ref_end(struct tc_ns_dev_file *dev_file, + struct tc_ns_client_context *context, unsigned long long *vm_buffers) +{ + int ret = 0; + struct tc_ns_shared_mem *shared_mem = NULL; + int index = 0; + uint32_t buffer_size; + unsigned int offset = 0; + void *buffer_addr = NULL; + void *size_addr = NULL; + + if (!dev_file->isVM) + return 0; + + mutex_lock(&dev_file->shared_mem_lock); + list_for_each_entry(shared_mem, &dev_file->shared_mem_list, head) { + for (index = 0; index < TEE_PARAM_NUM; index++) { + buffer_addr = (void *)(uintptr_t)(context->params[index].memref.buffer | + ((uint64_t)context->params[index].memref.buffer_h_addr << ADDR_TRANS_NUM)); + if (shared_mem->user_addr == buffer_addr) { + buffer_addr = (void *)(uintptr_t)(shared_mem->kernel_addr); + size_addr = (void *)(uintptr_t)(context->params[index].memref.size_addr | + ((uint64_t)context->params[index].memref.size_h_addr << ADDR_TRANS_NUM)); + offset = context->params[index].memref.offset; + + if (copy_from_user(&buffer_size, size_addr, sizeof(uint32_t))) { + tloge("copy memref.size_addr failed\n"); + return -EFAULT; + } + + if (write_to_VMclient((void *)(uintptr_t)(vm_buffers[index] + offset), + buffer_size, (void *)(uintptr_t)(buffer_addr + offset), + buffer_size, dev_file->vmpid)) { + tloge("copy buf size failed\n"); + return -EFAULT; + } + } + } + } + mutex_unlock(&dev_file->shared_mem_lock); + return ret; +} + static int ioctl_session_send_cmd(struct tc_ns_dev_file *dev_file, struct tc_ns_client_context *context, void *argp) { int ret; + unsigned long long vm_buffers[TEE_PARAM_NUM]={0}; + + if (dev_file->isVM && + process_vm_ref(dev_file, context, vm_buffers)) { + tloge("copy from VM memref failed\n"); + return -EFAULT; + } ret = tc_ns_send_cmd(dev_file, context); if (ret != 0) @@ -1399,6 +1511,11 @@ static int ioctl_session_send_cmd(struct if (ret == 0) ret = -EFAULT; } + if (ret ==0 && dev_file->isVM && + process_vm_ref_end(dev_file, context, vm_buffers)) { + tloge("copy to VM memref failed\n"); + return -EFAULT; + } return ret; } diff -uprN itrustee_tzdriver/core/shared_mem.c itrustee_tzdriver_new/core/shared_mem.c --- itrustee_tzdriver/core/shared_mem.c 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/shared_mem.c 2024-07-12 10:51:32.793629380 +0800 @@ -120,6 +120,36 @@ void release_shared_mem_page(uint64_t bu put_page(page); } } + + +void release_vm_shared_mem_page(uint64_t buf, uint32_t buf_size, uint32_t vm_page_size) +{ + uint32_t i; + uint64_t *phys_addr = NULL; + struct pagelist_info *page_info = NULL; + struct page *page = NULL; + struct page *last_page = NULL; + + page_info = (struct pagelist_info *)(uintptr_t)buf; + phys_addr = (uint64_t *)(uintptr_t)buf + (sizeof(*page_info) / sizeof(uint64_t)); + + if (buf_size != sizeof(*page_info) + sizeof(uint64_t) * page_info->page_num) { + tloge("bad size, cannot release page\n"); + return; + } + + for (i = 0; i < page_info->page_num; i++) { + page = (struct page *)(uintptr_t)phys_to_page(phys_addr[i]); + if (page == NULL) + continue; + if (last_page != page) { + set_bit(PG_dirty, &page->flags); + put_page(page); + } + last_page = page; + } +} + #else int fill_shared_mem_info(uint64_t start_vaddr, uint32_t pages_no, diff -uprN itrustee_tzdriver/core/shared_mem.h itrustee_tzdriver_new/core/shared_mem.h --- itrustee_tzdriver/core/shared_mem.h 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/shared_mem.h 2024-07-12 10:51:32.789629380 +0800 @@ -64,5 +64,5 @@ void free_spi_mem(uint64_t spi_vaddr); int fill_shared_mem_info(uint64_t start_vaddr, uint32_t pages_no, uint32_t offset, uint32_t buffer_size, uint64_t info_addr); void release_shared_mem_page(uint64_t buf, uint32_t buf_size); - +void release_vm_shared_mem_page(uint64_t buf, uint32_t buf_size, uint32_t vm_page_size); #endif diff -uprN itrustee_tzdriver/core/tc_client_driver.c itrustee_tzdriver_new/core/tc_client_driver.c --- itrustee_tzdriver/core/tc_client_driver.c 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/tc_client_driver.c 2024-07-12 10:51:32.749629380 +0800 @@ -186,6 +186,8 @@ static int tc_ns_get_tee_version(const s smc_cmd.operation_h_phys = (uint64_t)mailbox_virt_to_phys((uintptr_t)&mb_pack->operation) >> ADDR_TRANS_NUM; + if (dev_file->isVM) + smc_cmd.nsid = dev_file->nsid; if (tc_ns_smc(&smc_cmd) != 0) { ret = -EPERM; tloge("smc call returns error ret 0x%x\n", smc_cmd.ret_val); @@ -312,10 +314,14 @@ static int client_login_prepare(uint8_t static int tc_login_check(const struct tc_ns_dev_file *dev_file) { - int ret = check_teecd_auth(); - if (ret != 0) { - tloge("teec auth failed, ret %d\n", ret); - return -EACCES; + int ret; + ret = check_proxy_auth(); + if (ret) { + ret = check_teecd_auth(); + if (ret != 0) { + tloge("teec auth failed, ret %d\n", ret); + return -EACCES; + } } if (!dev_file) @@ -718,12 +724,55 @@ static int ioctl_check_is_ccos(void __us return ret; } +static int copy_buf_to_VM(unsigned int agent_id, unsigned int nsid, + unsigned long buffer_addr, unsigned int vmpid) +{ + int ret = 0; + struct smc_event_data *event_data = NULL; + + event_data = find_event_control(agent_id, nsid); + if (!event_data) + return -EINVAL; + + if (write_to_VMclient((void *)(uintptr_t)buffer_addr, + event_data->agent_buff_size, + event_data->agent_buff_kernel, + event_data->agent_buff_size, + vmpid) != 0) { + tloge("copy agent buffer failed\n"); + return -ENOMEM; + } + return ret; +} + +static int copy_buf_from_VM(unsigned int agent_id, unsigned int nsid, + unsigned long buffer_addr, unsigned int vmpid) +{ + int ret = 0; + struct smc_event_data *event_data = NULL; + + event_data = find_event_control(agent_id, nsid); + if (!event_data) + return -EINVAL; + + if (read_from_VMclient(event_data->agent_buff_kernel, + event_data->agent_buff_size, + (void *)(uintptr_t)buffer_addr, + event_data->agent_buff_size, + vmpid) != 0) { + tloge("copy agent buffer failed\n"); + return -EFAULT; + } + return ret; +} + /* ioctls for the secure storage daemon */ int public_ioctl(const struct file *file, unsigned int cmd, unsigned long arg, bool is_from_client_node) { int ret = -EINVAL; struct tc_ns_dev_file *dev_file = NULL; uint32_t nsid = get_nsid(); + unsigned long tmp[2]; void *argp = (void __user *)(uintptr_t)arg; if (file == NULL || file->private_data == NULL) { tloge("invalid params\n"); @@ -731,18 +780,34 @@ int public_ioctl(const struct file *file } dev_file = file->private_data; #ifdef CONFIG_CONFIDENTIAL_CONTAINER - dev_file->nsid = nsid; + if (dev_file != NULL && dev_file->nsid == 0) + dev_file->nsid = nsid; + if (dev_file->isVM) + nsid = dev_file->nsid; #endif + if (dev_file->isVM) { + if (copy_from_user(tmp, (void *)(uintptr_t)arg, sizeof(tmp)) != 0) { + tloge("copy agent args failed\n"); + return -EFAULT; + } + arg = tmp[0]; + } switch (cmd) { case TC_NS_CLIENT_IOCTL_WAIT_EVENT: if (ioctl_check_agent_owner(dev_file, (unsigned int)arg, nsid) != 0) return -EINVAL; ret = tc_ns_wait_event((unsigned int)arg, nsid); + if (!ret && dev_file->isVM) { + ret = copy_buf_to_VM(tmp[0], nsid, tmp[1], dev_file->vmpid); + } break; case TC_NS_CLIENT_IOCTL_SEND_EVENT_RESPONSE: if (ioctl_check_agent_owner(dev_file, (unsigned int)arg, nsid) != 0) return -EINVAL; + if (dev_file->isVM) { + ret = copy_buf_from_VM(tmp[0], nsid, tmp[1], dev_file->vmpid); + } ret = tc_ns_send_event_response((unsigned int)arg, nsid); break; case TC_NS_CLIENT_IOCTL_REGISTER_AGENT: @@ -839,6 +904,14 @@ static int tc_client_agent_ioctl(const s return ret; } +int set_vm_flag(struct tc_ns_dev_file *dev_file, int vmid) +{ + dev_file->nsid = vmid; + dev_file->vmpid = vmid; + tlogd(" dev_file->vmpid %d\n", (int)dev_file->vmpid); + return 0; +} + void handle_cmd_prepare(unsigned int cmd) { if (cmd != TC_NS_CLIENT_IOCTL_WAIT_EVENT && @@ -858,6 +931,10 @@ static long tc_private_ioctl(struct file { int ret = -EFAULT; void *argp = (void __user *)(uintptr_t)arg; + if (cmd == TC_NS_CLIENT_IOCTL_SET_VM_FLAG) { + tlogd(" before set_vm_flag \n"); + return set_vm_flag(file->private_data, (int)arg); + } handle_cmd_prepare(cmd); switch (cmd) { case TC_NS_CLIENT_IOCTL_GET_TEE_VERSION: @@ -872,10 +949,10 @@ static long tc_private_ioctl(struct file mutex_unlock(&g_set_ca_hash_lock); break; case TC_NS_CLIENT_IOCTL_LATEINIT: - ret = tc_ns_late_init(arg); + ret = tc_ns_late_init(file->private_data, arg); break; case TC_NS_CLIENT_IOCTL_SYC_SYS_TIME: - ret = sync_system_time_from_user( + ret = sync_system_time_from_user(file->private_data, (struct tc_ns_client_time *)(uintptr_t)arg); break; default: @@ -894,6 +971,10 @@ static long tc_client_ioctl(struct file int ret = -EFAULT; void *argp = (void __user *)(uintptr_t)arg; + if (cmd == TC_NS_CLIENT_IOCTL_SET_VM_FLAG) { + tlogd(" before set_vm_flag \n"); + return set_vm_flag(file->private_data, (int)arg); + } handle_cmd_prepare(cmd); switch (cmd) { case TC_NS_CLIENT_IOCTL_SES_OPEN_REQ: @@ -925,20 +1006,30 @@ static int tc_client_open(struct inode * { int ret; struct tc_ns_dev_file *dev = NULL; + int vm = 0; (void)inode; - ret = check_teecd_auth(); - if (ret != 0) { - tloge("teec auth failed, ret %d\n", ret); - return -EACCES; + ret =check_proxy_auth(); + if (ret) { + ret = check_teecd_auth(); + if (ret != 0) { + tloge("teec auth failed, ret %d\n", ret); + return -EACCES; + } + } else { + vm = 1; } file->private_data = NULL; ret = tc_ns_client_open(&dev, TEE_REQ_FROM_USER_MODE); - if (ret == 0) + if (ret == 0) { file->private_data = dev; + if (vm) + dev->isVM = true; + } #ifdef CONFIG_TEE_REBOOT - get_teecd_pid(); + if (!vm && check_teecd_auth() == 0) + get_teecd_pid(); #endif return ret; } diff -uprN itrustee_tzdriver/core/tc_client_driver.h itrustee_tzdriver_new/core/tc_client_driver.h --- itrustee_tzdriver/core/tc_client_driver.h 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/tc_client_driver.h 2024-07-12 10:51:32.741629380 +0800 @@ -47,6 +47,7 @@ int tc_ns_client_open(struct tc_ns_dev_f int tc_ns_client_close(struct tc_ns_dev_file *dev); int is_agent_alive(unsigned int agent_id, unsigned int nsid); int tc_ns_register_host_nsid(void); +int set_vm_flag(struct tc_ns_dev_file *dev_file, int vmid); int init_dev_node(struct dev_node *node, const char *node_name, struct class *driver_class, const struct file_operations *fops); void destory_dev_node(struct dev_node *node, struct class *driver_class); diff -uprN itrustee_tzdriver/core/tc_cvm_driver.c itrustee_tzdriver_new/core/tc_cvm_driver.c --- itrustee_tzdriver/core/tc_cvm_driver.c 2024-07-12 11:08:59.357629380 +0800 +++ itrustee_tzdriver_new/core/tc_cvm_driver.c 2024-07-12 10:51:32.737629380 +0800 @@ -104,6 +104,10 @@ static long tc_cvm_ioctl(struct file *fi { int ret = -EFAULT; void *argp = (void __user *)(uintptr_t)arg; + if (cmd == TC_NS_CLIENT_IOCTL_SET_VM_FLAG) { + tlogd(" before set_vm_flag \n"); + return set_vm_flag(file->private_data, (int)arg); + } handle_cmd_prepare(cmd); switch (cmd) { diff -uprN itrustee_tzdriver/Makefile itrustee_tzdriver_new/Makefile --- itrustee_tzdriver/Makefile 2024-07-12 11:08:59.353629380 +0800 +++ itrustee_tzdriver_new/Makefile 2024-07-12 10:51:32.641629380 +0800 @@ -54,6 +54,7 @@ EXTRA_CFLAGS += -DCONFIG_CPU_AFF_NR=0 -D EXTRA_CFLAGS += -DCONFIG_TEE_LOG_ACHIVE_PATH=\"/var/log/tee/last_teemsg\" EXTRA_CFLAGS += -DNOT_TRIGGER_AP_RESET -DLAST_TEE_MSG_ROOT_GID -DCONFIG_NOCOPY_SHAREDMEM -DCONFIG_REGISTER_SHAREDMEM -DCONFIG_TA_AFFINITY=y -DCONFIG_TA_AFFINITY_CPU_NUMS=128 EXTRA_CFLAGS += -DTEECD_PATH_UID_AUTH_CTX=\"/usr/bin/teecd:0\" +EXTRA_CFLAGS += -DPROXY_PATH_UID_AUTH_CTX=\"/usr/bin/vtz_proxy:0\" EXTRA_CFLAGS += -DCONFIG_AUTH_SUPPORT_UNAME -DCONFIG_AUTH_HASH -std=gnu99 EXTRA_CFLAGS += -DCONFIG_TEE_UPGRADE -DCONFIG_TEE_REBOOT -DCONFIG_CONFIDENTIAL_TEE EXTRA_CFLAGS += -I$(PWD)/tzdriver_internal/tee_reboot diff -uprN itrustee_tzdriver/modules.order itrustee_tzdriver_new/modules.order --- itrustee_tzdriver/modules.order 1970-01-01 08:00:00.000000000 +0800 +++ itrustee_tzdriver_new/modules.order 2024-07-12 10:54:21.957629380 +0800 @@ -0,0 +1 @@ +kernel//home/z50040113/target/itrustee_tzdriver/tzdriver.ko diff -uprN itrustee_tzdriver/tc_ns_client.h itrustee_tzdriver_new/tc_ns_client.h --- itrustee_tzdriver/tc_ns_client.h 2024-07-12 11:08:59.361629380 +0800 +++ itrustee_tzdriver_new/tc_ns_client.h 2024-07-12 10:51:32.625629380 +0800 @@ -230,6 +230,8 @@ struct tc_ns_log_pool { #define TC_NS_CLIENT_IOCTL_GET_TEE_INFO \ _IOWR(TC_NS_CLIENT_IOC_MAGIC, 26, struct tc_ns_tee_info) +#define TC_NS_CLIENT_IOCTL_SET_VM_FLAG \ + _IOWR(TC_NS_CLIENT_IOC_MAGIC, 27, int) #define TC_NS_CLIENT_IOCTL_CHECK_CCOS \ _IOWR(TC_NS_CLIENT_IOC_MAGIC, 32, unsigned int) diff -uprN itrustee_tzdriver/teek_ns_client.h itrustee_tzdriver_new/teek_ns_client.h --- itrustee_tzdriver/teek_ns_client.h 2024-07-12 11:08:59.361629380 +0800 +++ itrustee_tzdriver_new/teek_ns_client.h 2024-07-12 10:51:32.597629380 +0800 @@ -129,6 +129,9 @@ struct tc_ns_dev_file { int load_app_flag; #ifdef CONFIG_CONFIDENTIAL_CONTAINER uint32_t nsid; + uint32_t vmpid; + bool isVM; + uint32_t vm_page_size; #endif struct completion close_comp; /* for kthread close unclosed session */ #ifdef CONFIG_TEE_TELEPORT_SUPPORT diff -uprN itrustee_tzdriver/tlogger/tlogger.c itrustee_tzdriver_new/tlogger/tlogger.c --- itrustee_tzdriver/tlogger/tlogger.c 2024-07-12 11:08:59.361629380 +0800 +++ itrustee_tzdriver_new/tlogger/tlogger.c 2024-07-12 10:51:32.581629380 +0800 @@ -61,6 +61,7 @@ #define SET_TLOGCAT_STAT_BASE 7 #define GET_TLOGCAT_STAT_BASE 8 #define GET_TEE_INFO_BASE 9 +#define SET_VM_FLAG 10 /* get tee verison */ #define MAX_TEE_VERSION_LEN 256 @@ -75,6 +76,8 @@ _IO(LOGGERIOCTL, GET_TLOGCAT_STAT_BASE) #define TEELOGGER_GET_TEE_INFO \ _IOR(LOGGERIOCTL, GET_TEE_INFO_BASE, struct tc_ns_tee_info) +#define TEELOGGER_SET_VM_FLAG \ + _IOR(LOGGERIOCTL, SET_VM_FLAG, int) int g_tlogcat_f = 0; @@ -515,7 +518,7 @@ void recycle_tlogcat_processes(void) } #endif -static struct tlogger_group *get_tlogger_group(void) +static struct tlogger_group *get_tlogger_group(uint32_t vmpid) { struct tlogger_group *group = NULL; #ifdef CONFIG_CONFIDENTIAL_CONTAINER @@ -524,6 +527,9 @@ static struct tlogger_group *get_tlogger uint32_t nsid = PROC_PID_INIT_INO; #endif + if (vmpid) + nsid = vmpid; + list_for_each_entry(group, &g_reader_group_list, node) { if (group->nsid == nsid) return group; @@ -596,7 +602,7 @@ static int process_tlogger_open(struct i return -ENODEV; mutex_lock(&g_reader_group_mutex); - group = get_tlogger_group(); + group = get_tlogger_group(0); if (group == NULL) { group = kzalloc(sizeof(*group), GFP_KERNEL); if (ZERO_OR_NULL_PTR((unsigned long)(uintptr_t)group)) { @@ -808,6 +814,35 @@ static int get_teeos_version(uint32_t cm return 0; } +int set_tlog_vm_flag(struct file *file, uint32_t vmpid) +{ + struct tlogger_reader *reader = NULL; + struct tlogger_group *group = NULL; + + if (!file || !file->private_data) { + return -1; + } + + reader = file->private_data; + mutex_lock(&g_reader_group_mutex); + group = get_tlogger_group(vmpid); + if (group == NULL) { + group = kzalloc(sizeof(*group), GFP_KERNEL); + if (ZERO_OR_NULL_PTR((unsigned long)(uintptr_t)group)) { + mutex_unlock(&g_reader_group_mutex); + return -ENOMEM; + } + init_tlogger_group(group); + group->nsid = vmpid; + list_add_tail(&group->node, &g_reader_group_list); + } else { + group->reader_cnt++; + } + mutex_unlock(&g_reader_group_mutex); + reader->group = group; + return 0; +} + static long process_tlogger_ioctl(struct file *file, unsigned int cmd, unsigned long arg) { @@ -845,6 +880,9 @@ static long process_tlogger_ioctl(struct case TEELOGGER_GET_TEE_INFO: ret = tc_ns_get_tee_info(file, (void *)(uintptr_t)arg); break; + case TEELOGGER_SET_VM_FLAG: + ret = set_tlog_vm_flag(file, (int)arg); + break; default: tloge("ioctl error default\n"); break; @@ -1023,11 +1061,13 @@ static int write_part_log_to_msg(struct while (next_item && read_off <= read_off_end) { item_len = next_item->buffer_len + sizeof(*next_item); - write_len = kernel_write(filep, next_item->log_buffer, - next_item->real_len, pos); - if (write_len < 0) { - tloge("Failed to write last teemsg %zd\n", write_len); - return -1; + if (next_item->nsid == 0) { + write_len = kernel_write(filep, next_item->log_buffer, + next_item->real_len, pos); + if (write_len < 0) { + tloge("Failed to write last teemsg %zd\n", write_len); + return -1; + } } tlogd("Succeed to Write last teemsg, len=%zd\n", write_len);

2 3

[PATCH OLK-6.6] PCI/MSI: Fix UAF in msi_capability_init
by liwei 31 Jul '24

31 Jul '24

From: Mostafa Saleh <smostafa(a)google.com> mainline inclusion from mainline-v6.10-rc6 commit 9eee5330656bf92f51cb1f09b2dc9f8cf975b3d1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGENJ CVE: CVE-2024-41096 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in kfence-#12): __pci_enable_msi_range+0x2c0/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 kfence-#12: 0x0000000008614900-0x00000000e06c228d, size=104, cache=kmalloc-128 allocated by task 81 on cpu 7 at 10.808142s: __kmem_cache_alloc_node+0x1f0/0x2bc kmalloc_trace+0x44/0x138 msi_alloc_desc+0x3c/0x9c msi_domain_insert_msi_desc+0x30/0x78 msi_setup_msi_desc+0x13c/0x184 __pci_enable_msi_range+0x258/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 freed by task 81 on cpu 7 at 10.811436s: msi_domain_free_descs+0xd4/0x10c msi_domain_free_locked.part.0+0xc0/0x1d8 msi_domain_alloc_irqs_all_locked+0xb4/0xbc pci_msi_setup_msi_irqs+0x30/0x4c __pci_enable_msi_range+0x2a8/0x488 pci_alloc_irq_vectors_affinity+0xec/0x14c pci_alloc_irq_vectors+0x18/0x28 Descriptor allocation done in: __pci_enable_msi_range msi_capability_init msi_setup_msi_desc msi_insert_msi_desc msi_domain_insert_msi_desc msi_alloc_desc ... Freed in case of failure in __msi_domain_alloc_locked() __pci_enable_msi_range msi_capability_init pci_msi_setup_msi_irqs msi_domain_alloc_irqs_all_locked msi_domain_alloc_locked __msi_domain_alloc_locked => fails msi_domain_free_locked ... That failure propagates back to pci_msi_setup_msi_irqs() in msi_capability_init() which accesses the descriptor for unmasking in the error exit path. Cure it by copying the descriptor and using the copy for the error exit path unmask operation. [ tglx: Massaged change log ] Fixes: bf6e054e0e3f ("genirq/msi: Provide msi_device_populate/destroy_sysfs()") Suggested-by: Thomas Gleixner <tglx(a)linutronix.de> Signed-off-by: Mostafa Saleh <smostafa(a)google.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Cc: Bjorn Heelgas <bhelgaas(a)google.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240624203729.1094506-1-smostafa@google.com Signed-off-by: dengquan <dengquan9(a)huawei.com> --- drivers/pci/msi/msi.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c index 7078200be11f..161c3ac171a3 100644 --- a/drivers/pci/msi/msi.c +++ b/drivers/pci/msi/msi.c @@ -348,7 +348,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, struct irq_affinity *affd) { struct irq_affinity_desc *masks = NULL; - struct msi_desc *entry; + struct msi_desc *entry, desc; int ret; /* Reject multi-MSI early on irq domain enabled architectures */ @@ -373,6 +373,12 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, /* All MSIs are unmasked by default; mask them all */ entry = msi_first_desc(&dev->dev, MSI_DESC_ALL); pci_msi_mask(entry, msi_multi_mask(entry)); + /* + * Copy the MSI descriptor for the error path because + * pci_msi_setup_msi_irqs() will free it for the hierarchical + * interrupt domain case. + */ + memcpy(&desc, entry, sizeof(desc)); /* Configure MSI capability structure */ ret = pci_msi_setup_msi_irqs(dev, nvec, PCI_CAP_ID_MSI); @@ -392,7 +398,7 @@ static int msi_capability_init(struct pci_dev *dev, int nvec, goto unlock; err: - pci_msi_unmask(entry, msi_multi_mask(entry)); + pci_msi_unmask(&desc, msi_multi_mask(&desc)); pci_free_msi_irqs(dev); fail: dev->msi_enabled = 0; -- 2.25.1

2 1

[PATCH OLK-6.6] drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
by Liu Chuang 31 Jul '24

31 Jul '24

From: Jesse Zhang <jesse.zhang(a)amd.com> stable inclusion from stable-v6.6.39 commit 855ae72c20310e5402b2317fc537d911e87537ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSW7 CVE: CVE-2024-42228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 ] Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Suggested-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c index 1904edf68407..88a3aa36b41d 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c @@ -742,7 +742,8 @@ int amdgpu_vce_ring_parse_cs(struct amdgpu_cs_parser *p, uint32_t created = 0; uint32_t allocated = 0; uint32_t tmp, handle = 0; - uint32_t *size = &tmp; + uint32_t dummy = 0xffffffff; + uint32_t *size = &dummy; unsigned int idx; int i, r = 0; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS-SP1] drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
by Liu Chuang 31 Jul '24

31 Jul '24

From: Jesse Zhang <jesse.zhang(a)amd.com> mainline inclusion from mainline-v6.10-rc1 commit 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSW7 CVE: CVE-2024-42228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Suggested-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c [adjust context conflicts] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c index ecaa2d7483b2..0a28daa14fb1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c @@ -725,7 +725,8 @@ int amdgpu_vce_ring_parse_cs(struct amdgpu_cs_parser *p, uint32_t ib_idx) uint32_t created = 0; uint32_t allocated = 0; uint32_t tmp, handle = 0; - uint32_t *size = &tmp; + uint32_t dummy = 0xffffffff; + uint32_t *size = &dummy; unsigned idx; int i, r = 0; -- 2.34.1

2 1

[PATCH OLK-5.10] drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
by Liu Chuang 31 Jul '24

31 Jul '24

From: Jesse Zhang <jesse.zhang(a)amd.com> mainline inclusion from mainline-v6.10-rc1 commit 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSW7 CVE: CVE-2024-42228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Suggested-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c [adjust context conflicts] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c index ecaa2d7483b2..0a28daa14fb1 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c @@ -725,7 +725,8 @@ int amdgpu_vce_ring_parse_cs(struct amdgpu_cs_parser *p, uint32_t ib_idx) uint32_t created = 0; uint32_t allocated = 0; uint32_t tmp, handle = 0; - uint32_t *size = &tmp; + uint32_t dummy = 0xffffffff; + uint32_t *size = &dummy; unsigned idx; int i, r = 0; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc
by Liu Chuang 31 Jul '24

31 Jul '24

From: Jesse Zhang <jesse.zhang(a)amd.com> mainline inclusion from mainline-v6.10-rc1 commit 88a9a467c548d0b3c7761b4fd54a68e70f9c0944 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGSW7 CVE: CVE-2024-42228 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… ------------------------------- Initialize the size before calling amdgpu_vce_cs_reloc, such as case 0x03000001. V2: To really improve the handling we would actually need to have a separate value of 0xffffffff.(Christian) Signed-off-by: Jesse Zhang <jesse.zhang(a)amd.com> Suggested-by: Christian König <christian.koenig(a)amd.com> Reviewed-by: Christian König <christian.koenig(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Conflicts: drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c [adjust context conflicts] Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c index 17862b9ecccd..9c8ce75c760a 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c @@ -714,7 +714,8 @@ int amdgpu_vce_ring_parse_cs(struct amdgpu_cs_parser *p, uint32_t ib_idx) uint32_t created = 0; uint32_t allocated = 0; uint32_t tmp, handle = 0; - uint32_t *size = &tmp; + uint32_t dummy = 0xffffffff; + uint32_t *size = &dummy; unsigned idx; int i, r = 0; -- 2.34.1

2 1

[PATCH OLK-6.6] Bluetooth: ISO: Check socket flag instead of hcon
by Liu Chuang 31 Jul '24

31 Jul '24

From: Iulia Tanasescu <iulia.tanasescu(a)nxp.com> stable inclusion from stable-v6.6.39 commit 045669710464a21c67e690ef14698fd71857cb11 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGRSM CVE: CVE-2024-42141 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... ------------------------------- [ Upstream commit 596b6f081336e77764ca35cfeab66d0fcdbe544e ] This fixes the following Smatch static checker warning: net/bluetooth/iso.c:1364 iso_sock_recvmsg() error: we previously assumed 'pi->conn->hcon' could be null (line 1359) net/bluetooth/iso.c 1347 static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg, 1348 size_t len, int flags) 1349 { 1350 struct sock *sk = sock->sk; 1351 struct iso_pinfo *pi = iso_pi(sk); 1352 1353 BT_DBG("sk %p", sk); 1354 1355 if (test_and_clear_bit(BT_SK_DEFER_SETUP, &bt_sk(sk)->flags)) { 1356 lock_sock(sk); 1357 switch (sk->sk_state) { 1358 case BT_CONNECT2: 1359 if (pi->conn->hcon && ^^^^^^^^^^^^^^ If ->hcon is NULL 1360 test_bit(HCI_CONN_PA_SYNC, &pi->conn->hcon->flags)) { 1361 iso_conn_big_sync(sk); 1362 sk->sk_state = BT_LISTEN; 1363 } else { --> 1364 iso_conn_defer_accept(pi->conn->hcon); ^^^^^^^^^^^^^^ then we're toast 1365 sk->sk_state = BT_CONFIG; 1366 } 1367 release_sock(sk); 1368 return 0; 1369 case BT_CONNECTED: 1370 if (test_bit(BT_SK_PA_SYNC, Fixes: fbdc4bc47268 ("Bluetooth: ISO: Use defer setup to separate PA sync and BIG sync") Signed-off-by: Iulia Tanasescu <iulia.tanasescu(a)nxp.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- net/bluetooth/iso.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/net/bluetooth/iso.c b/net/bluetooth/iso.c index 05b9edb480f0..3ccba592f734 100644 --- a/net/bluetooth/iso.c +++ b/net/bluetooth/iso.c @@ -1233,8 +1233,7 @@ static int iso_sock_recvmsg(struct socket *sock, struct msghdr *msg, lock_sock(sk); switch (sk->sk_state) { case BT_CONNECT2: - if (pi->conn->hcon && - test_bit(HCI_CONN_PA_SYNC, &pi->conn->hcon->flags)) { + if (test_bit(BT_SK_PA_SYNC, &pi->flags)) { iso_conn_big_sync(sk); sk->sk_state = BT_LISTEN; } else { -- 2.34.1

2 1

2024

2023

2022

2021

2020

2019

Kernel