From: Jens Wiklander <jens.wiklander@linaro.org>
To: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: "Allen Pais" <apais@linux.microsoft.com>,
"Sumit Garg" <sumit.garg@linaro.org>,
"Peter Huewe" <peterhuewe@gmx.de>,
"Jarkko Sakkinen" <jarkko@kernel.org>,
"Jason Gunthorpe" <jgg@ziepe.ca>,
"Vikas Gupta" <vikas.gupta@broadcom.com>,
"Thirupathaiah Annapureddy" <thiruan@microsoft.com>,
"Pavel Tatashin" <pasha.tatashin@soleen.com>,
"Rafał Miłecki" <zajec5@gmail.com>,
op-tee@lists.trustedfirmware.org,
linux-integrity@vger.kernel.org,
bcm-kernel-feedback-list@broadcom.com,
linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 4/8] optee: Clear stale cache entries during initialization
Date: Mon, 14 Jun 2021 10:27:15 +0200 [thread overview]
Message-ID: <20210614082715.GC1033436@jade> (raw)
In-Reply-To: <20210610210913.536081-5-tyhicks@linux.microsoft.com>
On Thu, Jun 10, 2021 at 04:09:09PM -0500, Tyler Hicks wrote:
> The shm cache could contain invalid addresses if
> optee_disable_shm_cache() was not called from the .shutdown hook of the
> previous kernel before a kexec. These addresses could be unmapped or
> they could point to mapped but unintended locations in memory.
>
> Clear the shared memory cache, while being careful to not translate the
> addresses returned from OPTEE_SMC_DISABLE_SHM_CACHE, during driver
> initialization. Once all pre-cache shm objects are removed, proceed with
> enabling the cache so that we know that we can handle cached shm objects
> with confidence later in the .shutdown hook.
>
> Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
> ---
> drivers/tee/optee/call.c | 11 ++++++++++-
> drivers/tee/optee/core.c | 13 +++++++++++--
> drivers/tee/optee/optee_private.h | 2 +-
> 3 files changed, 22 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
> index 6e6eb836e9b6..5dcba6105ed7 100644
> --- a/drivers/tee/optee/call.c
> +++ b/drivers/tee/optee/call.c
> @@ -419,8 +419,10 @@ void optee_enable_shm_cache(struct optee *optee)
> * optee_disable_shm_cache() - Disables caching of some shared memory allocation
> * in OP-TEE
> * @optee: main service struct
> + * @is_mapped: true if the cached shared memory addresses were mapped by this
> + * kernel, are safe to dereference, and should be freed
> */
> -void optee_disable_shm_cache(struct optee *optee)
> +void optee_disable_shm_cache(struct optee *optee, bool is_mapped)
> {
> struct optee_call_waiter w;
>
> @@ -439,6 +441,13 @@ void optee_disable_shm_cache(struct optee *optee)
> if (res.result.status == OPTEE_SMC_RETURN_OK) {
> struct tee_shm *shm;
>
> + /*
> + * Shared memory references that were not mapped by
> + * this kernel must be ignored to prevent a crash.
> + */
> + if (!is_mapped)
> + continue;
> +
> shm = reg_pair_to_ptr(res.result.shm_upper32,
> res.result.shm_lower32);
> tee_shm_free(shm);
> diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
> index 0987074d7ed0..6974e1104bd4 100644
> --- a/drivers/tee/optee/core.c
> +++ b/drivers/tee/optee/core.c
> @@ -589,7 +589,7 @@ static int optee_remove(struct platform_device *pdev)
> * reference counters and also avoid wild pointers in secure world
> * into the old shared memory range.
> */
> - optee_disable_shm_cache(optee);
> + optee_disable_shm_cache(optee, true);
Naked "true" or "false" parameters are normally not very descriptive.
Would it make sense to write this as:
optee_disable_shm_cache(optee, true /*is_mapped*/);
instead (same for the other call sites in this patch)? That way it would
be easier to see what it is that is true or false.
/Jens
>
> /*
> * The two devices have to be unregistered before we can free the
> @@ -619,7 +619,7 @@ static int optee_remove(struct platform_device *pdev)
> */
> static void optee_shutdown(struct platform_device *pdev)
> {
> - optee_disable_shm_cache(platform_get_drvdata(pdev));
> + optee_disable_shm_cache(platform_get_drvdata(pdev), true);
> }
>
> static int optee_probe(struct platform_device *pdev)
> @@ -716,6 +716,15 @@ static int optee_probe(struct platform_device *pdev)
> optee->memremaped_shm = memremaped_shm;
> optee->pool = pool;
>
> + /*
> + * Ensure that there are no pre-existing shm objects before enabling
> + * the shm cache so that there's no chance of receiving an invalid
> + * address during shutdown. This could occur, for example, if we're
> + * kexec booting from an older kernel that did not properly cleanup the
> + * shm cache.
> + */
> + optee_disable_shm_cache(optee, false);
> +
> optee_enable_shm_cache(optee);
>
> if (optee->sec_caps & OPTEE_SMC_SEC_CAP_DYNAMIC_SHM)
> diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h
> index e25b216a14ef..16d8c82213e7 100644
> --- a/drivers/tee/optee/optee_private.h
> +++ b/drivers/tee/optee/optee_private.h
> @@ -158,7 +158,7 @@ int optee_invoke_func(struct tee_context *ctx, struct tee_ioctl_invoke_arg *arg,
> int optee_cancel_req(struct tee_context *ctx, u32 cancel_id, u32 session);
>
> void optee_enable_shm_cache(struct optee *optee);
> -void optee_disable_shm_cache(struct optee *optee);
> +void optee_disable_shm_cache(struct optee *optee, bool is_mapped);
>
> int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm,
> struct page **pages, size_t num_pages,
> --
> 2.25.1
>
next prev parent reply other threads:[~2021-06-14 8:28 UTC|newest]
Thread overview: 25+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-10 21:09 [PATCH v4 0/8] tee: Improve support for kexec and kdump Tyler Hicks
2021-06-10 21:09 ` [PATCH v4 1/8] optee: Fix memory leak when failing to register shm pages Tyler Hicks
2021-06-11 9:05 ` Jens Wiklander
2021-06-10 21:09 ` [PATCH v4 2/8] optee: Refuse to load the driver under the kdump kernel Tyler Hicks
2021-06-11 9:08 ` Jens Wiklander
2021-06-10 21:09 ` [PATCH v4 3/8] optee: fix tee out of memory failure seen during kexec reboot Tyler Hicks
2021-06-11 9:11 ` Jens Wiklander
2021-06-11 12:53 ` Tyler Hicks
2021-06-14 7:21 ` Jens Wiklander
2021-06-14 7:22 ` Jens Wiklander
2021-06-10 21:09 ` [PATCH v4 4/8] optee: Clear stale cache entries during initialization Tyler Hicks
2021-06-14 8:27 ` Jens Wiklander [this message]
2021-06-14 19:06 ` Tyler Hicks
2021-06-14 19:15 ` Jens Wiklander
2021-06-10 21:09 ` [PATCH v4 5/8] tee: add tee_shm_alloc_kernel_buf() Tyler Hicks
2021-06-10 21:09 ` [PATCH v4 6/8] tee: Support kernel shm registration without dma-buf backing Tyler Hicks
2021-06-11 5:16 ` Sumit Garg
2021-06-11 13:09 ` Tyler Hicks
2021-06-11 13:16 ` Tyler Hicks
2021-06-12 8:19 ` Sumit Garg
2021-06-13 8:16 ` Tyler Hicks
2021-06-14 4:59 ` Sumit Garg
2021-06-10 21:09 ` [PATCH v4 7/8] tpm_ftpm_tee: Free and unregister TEE shared memory during kexec Tyler Hicks
2021-06-15 13:04 ` Jarkko Sakkinen
2021-06-10 21:09 ` [PATCH v4 8/8] firmware: tee_bnxt: Release TEE shm, session, and context " Tyler Hicks
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210614082715.GC1033436@jade \
--to=jens.wiklander@linaro.org \
--cc=apais@linux.microsoft.com \
--cc=bcm-kernel-feedback-list@broadcom.com \
--cc=jarkko@kernel.org \
--cc=jgg@ziepe.ca \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=op-tee@lists.trustedfirmware.org \
--cc=pasha.tatashin@soleen.com \
--cc=peterhuewe@gmx.de \
--cc=sumit.garg@linaro.org \
--cc=thiruan@microsoft.com \
--cc=tyhicks@linux.microsoft.com \
--cc=vikas.gupta@broadcom.com \
--cc=zajec5@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).