linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Jens Wiklander <jens.wiklander@linaro.org>
To: Tyler Hicks <tyhicks@linux.microsoft.com>
Cc: "Allen Pais" <apais@linux.microsoft.com>,
	"Sumit Garg" <sumit.garg@linaro.org>,
	"Peter Huewe" <peterhuewe@gmx.de>,
	"Jarkko Sakkinen" <jarkko@kernel.org>,
	"Jason Gunthorpe" <jgg@ziepe.ca>,
	"Vikas Gupta" <vikas.gupta@broadcom.com>,
	"Thirupathaiah Annapureddy" <thiruan@microsoft.com>,
	"Pavel Tatashin" <pasha.tatashin@soleen.com>,
	"Rafał Miłecki" <zajec5@gmail.com>,
	op-tee@lists.trustedfirmware.org,
	linux-integrity@vger.kernel.org,
	bcm-kernel-feedback-list@broadcom.com,
	linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 4/8] optee: Clear stale cache entries during initialization
Date: Mon, 14 Jun 2021 21:15:06 +0200	[thread overview]
Message-ID: <20210614191506.GA1373417@jade> (raw)
In-Reply-To: <20210614190646.GW4910@sequoia>

On Mon, Jun 14, 2021 at 02:06:46PM -0500, Tyler Hicks wrote:
> On 2021-06-14 10:27:15, Jens Wiklander wrote:
> > On Thu, Jun 10, 2021 at 04:09:09PM -0500, Tyler Hicks wrote:
> > > The shm cache could contain invalid addresses if
> > > optee_disable_shm_cache() was not called from the .shutdown hook of the
> > > previous kernel before a kexec. These addresses could be unmapped or
> > > they could point to mapped but unintended locations in memory.
> > > 
> > > Clear the shared memory cache, while being careful to not translate the
> > > addresses returned from OPTEE_SMC_DISABLE_SHM_CACHE, during driver
> > > initialization. Once all pre-cache shm objects are removed, proceed with
> > > enabling the cache so that we know that we can handle cached shm objects
> > > with confidence later in the .shutdown hook.
> > > 
> > > Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
> > > ---
> > >  drivers/tee/optee/call.c          | 11 ++++++++++-
> > >  drivers/tee/optee/core.c          | 13 +++++++++++--
> > >  drivers/tee/optee/optee_private.h |  2 +-
> > >  3 files changed, 22 insertions(+), 4 deletions(-)
> > > 
> > > diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
> > > index 6e6eb836e9b6..5dcba6105ed7 100644
> > > --- a/drivers/tee/optee/call.c
> > > +++ b/drivers/tee/optee/call.c
> > > @@ -419,8 +419,10 @@ void optee_enable_shm_cache(struct optee *optee)
> > >   * optee_disable_shm_cache() - Disables caching of some shared memory allocation
> > >   *			      in OP-TEE
> > >   * @optee:	main service struct
> > > + * @is_mapped:	true if the cached shared memory addresses were mapped by this
> > > + *		kernel, are safe to dereference, and should be freed
> > >   */
> > > -void optee_disable_shm_cache(struct optee *optee)
> > > +void optee_disable_shm_cache(struct optee *optee, bool is_mapped)
> > >  {
> > >  	struct optee_call_waiter w;
> > >  
> > > @@ -439,6 +441,13 @@ void optee_disable_shm_cache(struct optee *optee)
> > >  		if (res.result.status == OPTEE_SMC_RETURN_OK) {
> > >  			struct tee_shm *shm;
> > >  
> > > +			/*
> > > +			 * Shared memory references that were not mapped by
> > > +			 * this kernel must be ignored to prevent a crash.
> > > +			 */
> > > +			if (!is_mapped)
> > > +				continue;
> > > +
> > >  			shm = reg_pair_to_ptr(res.result.shm_upper32,
> > >  					      res.result.shm_lower32);
> > >  			tee_shm_free(shm);
> > > diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
> > > index 0987074d7ed0..6974e1104bd4 100644
> > > --- a/drivers/tee/optee/core.c
> > > +++ b/drivers/tee/optee/core.c
> > > @@ -589,7 +589,7 @@ static int optee_remove(struct platform_device *pdev)
> > >  	 * reference counters and also avoid wild pointers in secure world
> > >  	 * into the old shared memory range.
> > >  	 */
> > > -	optee_disable_shm_cache(optee);
> > > +	optee_disable_shm_cache(optee, true);
> > 
> > Naked "true" or "false" parameters are normally not very descriptive.
> > Would it make sense to write this as:
> > optee_disable_shm_cache(optee, true /*is_mapped*/);
> > instead (same for the other call sites in this patch)? That way it would
> > be easier to see what it is that is true or false.
> 
> Yeah, I understand the issue with the naked bools. What about turning
> 'optee_disable_shm_cache(struct optee *optee, bool is_mapped)' into
> '__optee_disable_shm_cache(struct optee *optee, bool is_mapped)' and
> introducing these two wrappers:
> 
> /**
>  * optee_disable_shm_cache() - Disables caching of mapped shared memory
>  *                             allocations in OP-TEE
>  * @optee:     main service struct
>  */
> void optee_disable_shm_cache(struct optee *optee)
> {
>        return __optee_disable_shm_cache(optee, true);
> }
> 
> /**
>  * optee_disable_unmapped_shm_cache() - Disables caching of shared memory
>  *                                      allocations in OP-TEE which are not
>  *                                      currently mapped
>  * @optee:     main service struct
>  */
> void optee_disable_unmapped_shm_cache(struct optee *optee)
> {
>        return __optee_disable_shm_cache(optee, false);
> }
> 
> Existing callers of optee_disable_shm_cache() remain unchanged and we just add
> one caller of optee_disable_unmapped_shm_cache() with this patch.
> 

Sounds good.

Jens

  reply	other threads:[~2021-06-14 19:15 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-10 21:09 [PATCH v4 0/8] tee: Improve support for kexec and kdump Tyler Hicks
2021-06-10 21:09 ` [PATCH v4 1/8] optee: Fix memory leak when failing to register shm pages Tyler Hicks
2021-06-11  9:05   ` Jens Wiklander
2021-06-10 21:09 ` [PATCH v4 2/8] optee: Refuse to load the driver under the kdump kernel Tyler Hicks
2021-06-11  9:08   ` Jens Wiklander
2021-06-10 21:09 ` [PATCH v4 3/8] optee: fix tee out of memory failure seen during kexec reboot Tyler Hicks
2021-06-11  9:11   ` Jens Wiklander
2021-06-11 12:53     ` Tyler Hicks
2021-06-14  7:21       ` Jens Wiklander
2021-06-14  7:22   ` Jens Wiklander
2021-06-10 21:09 ` [PATCH v4 4/8] optee: Clear stale cache entries during initialization Tyler Hicks
2021-06-14  8:27   ` Jens Wiklander
2021-06-14 19:06     ` Tyler Hicks
2021-06-14 19:15       ` Jens Wiklander [this message]
2021-06-10 21:09 ` [PATCH v4 5/8] tee: add tee_shm_alloc_kernel_buf() Tyler Hicks
2021-06-10 21:09 ` [PATCH v4 6/8] tee: Support kernel shm registration without dma-buf backing Tyler Hicks
2021-06-11  5:16   ` Sumit Garg
2021-06-11 13:09     ` Tyler Hicks
2021-06-11 13:16       ` Tyler Hicks
2021-06-12  8:19         ` Sumit Garg
2021-06-13  8:16           ` Tyler Hicks
2021-06-14  4:59             ` Sumit Garg
2021-06-10 21:09 ` [PATCH v4 7/8] tpm_ftpm_tee: Free and unregister TEE shared memory during kexec Tyler Hicks
2021-06-15 13:04   ` Jarkko Sakkinen
2021-06-10 21:09 ` [PATCH v4 8/8] firmware: tee_bnxt: Release TEE shm, session, and context " Tyler Hicks

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210614191506.GA1373417@jade \
    --to=jens.wiklander@linaro.org \
    --cc=apais@linux.microsoft.com \
    --cc=bcm-kernel-feedback-list@broadcom.com \
    --cc=jarkko@kernel.org \
    --cc=jgg@ziepe.ca \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mips@vger.kernel.org \
    --cc=op-tee@lists.trustedfirmware.org \
    --cc=pasha.tatashin@soleen.com \
    --cc=peterhuewe@gmx.de \
    --cc=sumit.garg@linaro.org \
    --cc=thiruan@microsoft.com \
    --cc=tyhicks@linux.microsoft.com \
    --cc=vikas.gupta@broadcom.com \
    --cc=zajec5@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).