When memory is lent to secure world, fatal CPU speculative reads can still occur while it retains a cacheable mapping. Use the lendable-dma-pool API to unmap pages before lending and restore them upon reclaim.
Signed-off-by: Vincent Donnefort vdonnefort@google.com --- drivers/tee/optee/protmem.c | 48 ++++++++++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 9 deletions(-)
diff --git a/drivers/tee/optee/protmem.c b/drivers/tee/optee/protmem.c index be3abf6e8aa6..10e8f1540e5e 100644 --- a/drivers/tee/optee/protmem.c +++ b/drivers/tee/optee/protmem.c @@ -4,6 +4,7 @@ */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/dma-mapping.h> #include <linux/errno.h> #include <linux/genalloc.h> #include <linux/slab.h> @@ -21,6 +22,7 @@ struct optee_protmem_dyn_pool { u_int mem_attr_count; refcount_t refcount; u32 use_case; + bool unmapped; struct tee_shm *protmem; /* Protects when initializing and tearing down this struct */ struct mutex mutex; @@ -32,6 +34,35 @@ to_protmem_dyn_pool(struct tee_protmem_pool *pool) return container_of(pool, struct optee_protmem_dyn_pool, pool); }
+static int zap_direct_map_dyn_protmem(struct optee_protmem_dyn_pool *rp) +{ + int ret; + + ret = dma_zap_direct_map(&rp->optee->teedev->dev, + phys_to_page(rp->protmem->paddr), + rp->protmem->size); + if (ret && ret != -ENODEV) + return ret; + + rp->unmapped = !ret; + + return 0; +} + +static void restore_direct_map_dyn_protmem(struct optee_protmem_dyn_pool *rp) +{ + if (WARN_ON(!rp->protmem)) + return; + + if (!rp->unmapped) + return; + + dma_restore_direct_map(&rp->optee->teedev->dev, + phys_to_page(rp->protmem->paddr), + rp->protmem->size); + rp->unmapped = false; +} + static int init_dyn_protmem(struct optee_protmem_dyn_pool *rp) { int rc; @@ -42,19 +73,15 @@ static int init_dyn_protmem(struct optee_protmem_dyn_pool *rp) goto err_null_protmem; }
- /* - * TODO unmap the memory range since the physical memory will - * become inaccesible after the lend_protmem() call. - * - * If the platform supports a hypervisor at EL2, it will unmap the - * intermediate physical memory for us and stop cache pre-fetch of - * the memory. - */ + rc = zap_direct_map_dyn_protmem(rp); + if (rc) + goto err_put_shm; + rc = rp->optee->ops->lend_protmem(rp->optee, rp->protmem, rp->mem_attrs, rp->mem_attr_count, rp->use_case); if (rc) - goto err_put_shm; + goto err_restore_direct_map; rp->protmem->flags |= TEE_SHM_DYNAMIC;
rp->gen_pool = gen_pool_create(PAGE_SHIFT, -1); @@ -76,6 +103,8 @@ static int init_dyn_protmem(struct optee_protmem_dyn_pool *rp) rp->gen_pool = NULL; err_reclaim: rp->optee->ops->reclaim_protmem(rp->optee, rp->protmem); +err_restore_direct_map: + restore_direct_map_dyn_protmem(rp); err_put_shm: tee_shm_put(rp->protmem); err_null_protmem: @@ -112,6 +141,7 @@ static void release_dyn_protmem(struct optee_protmem_dyn_pool *rp) rp->gen_pool = NULL;
rp->optee->ops->reclaim_protmem(rp->optee, rp->protmem); + restore_direct_map_dyn_protmem(rp); rp->protmem->flags &= ~TEE_SHM_DYNAMIC;
WARN(refcount_read(&rp->protmem->refcount) != 1, "Unexpected refcount");