| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20220316092705.GB2535470@jade>
Date: Wed, 16 Mar 2022 10:27:05 +0100
From: Jens Wiklander <jens.wiklander@...aro.org>
To: Sumit Garg <sumit.garg@...aro.org>
Cc: linux-kernel@...r.kernel.org, op-tee@...ts.trustedfirmware.org
Subject: Re: [PATCH 2/3] optee: add FF-A capability
OPTEE_FFA_SEC_CAP_ARG_OFFSET
On Mon, Mar 14, 2022 at 02:33:26PM +0530, Sumit Garg wrote:
> On Wed, 2 Mar 2022 at 01:18, Jens Wiklander <jens.wiklander@...aro.org> wrote:
> >
> > Adds the secure capability OPTEE_FFA_SEC_CAP_ARG_OFFSET to indicate that
> > OP-TEE with FF-A can support an argument struct at a non-zero offset into
> > a passed shared memory object.
> >
>
> It isn't clear to me why FF-A ABI requires this capability.
> shm->offset should be honoured by default, if it isn't then it's a
> bug.
Yes, there was a bug in secure world when using a non-zero offset. So
far the driver has always used a zero offset that's why it hasn't been
caught earlier.
It's not a serious bug, but it might be quite hard to track down. This
is of course fixed now, but there is a window where it can be triggered.
So in order to spare FF-A developers this problem I'm making a non-zero
offset an extension guarded by a capability bit. Even though this is an
ABI change it's in practice not since it has been unused and not working
as expected.
The next commit will start using non-zero offsets if supported, so this
will change to become a problem (if left unchecked) in the window
mentioned above.
> AFAIK, FF-A is currently still in its early stages so it
> shouldn't be that hard to fix bugs in the ABI.
Starting from the kernel release (v5.16) where FF-A support in this
driver was merged the ABI is supposed to be stable.
Thanks,
Jens
>
> -Sumit
>
> > Signed-off-by: Jens Wiklander <jens.wiklander@...aro.org>
> > ---
> > drivers/tee/optee/ffa_abi.c | 17 +++++++++++++++--
> > drivers/tee/optee/optee_ffa.h | 12 +++++++++++-
> > 2 files changed, 26 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c
> > index 7686f7020616..cc863aaefcd9 100644
> > --- a/drivers/tee/optee/ffa_abi.c
> > +++ b/drivers/tee/optee/ffa_abi.c
> > @@ -615,12 +615,21 @@ static int optee_ffa_do_call_with_arg(struct tee_context *ctx,
> > .data0 = OPTEE_FFA_YIELDING_CALL_WITH_ARG,
> > .data1 = (u32)shm->sec_world_id,
> > .data2 = (u32)(shm->sec_world_id >> 32),
> > - .data3 = shm->offset,
> > + .data3 = 0,
> > };
> > struct optee_msg_arg *arg;
> > unsigned int rpc_arg_offs;
> > struct optee_msg_arg *rpc_arg;
> >
> > + /*
> > + * The shared memory object has to start on a page when passed as
> > + * an argument struct. This is also what the shm pool allocator
> > + * returns, but check this before calling secure world to catch
> > + * eventual errors early in case something changes.
> > + */
> > + if (shm->offset)
> > + return -EINVAL;
> > +
> > arg = tee_shm_get_va(shm, 0);
> > if (IS_ERR(arg))
> > return PTR_ERR(arg);
> > @@ -678,6 +687,7 @@ static bool optee_ffa_api_is_compatbile(struct ffa_device *ffa_dev,
> >
> > static bool optee_ffa_exchange_caps(struct ffa_device *ffa_dev,
> > const struct ffa_dev_ops *ops,
> > + u32 *sec_caps,
> > unsigned int *rpc_param_count)
> > {
> > struct ffa_send_direct_data data = { OPTEE_FFA_EXCHANGE_CAPABILITIES };
> > @@ -694,6 +704,7 @@ static bool optee_ffa_exchange_caps(struct ffa_device *ffa_dev,
> > }
> >
> > *rpc_param_count = (u8)data.data1;
> > + *sec_caps = data.data2;
> >
> > return true;
> > }
> > @@ -777,6 +788,7 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev)
> > struct tee_device *teedev;
> > struct tee_context *ctx;
> > struct optee *optee;
> > + u32 sec_caps;
> > int rc;
> >
> > ffa_ops = ffa_dev_ops_get(ffa_dev);
> > @@ -788,7 +800,8 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev)
> > if (!optee_ffa_api_is_compatbile(ffa_dev, ffa_ops))
> > return -EINVAL;
> >
> > - if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &rpc_param_count))
> > + if (!optee_ffa_exchange_caps(ffa_dev, ffa_ops, &sec_caps,
> > + &rpc_param_count))
> > return -EINVAL;
> >
> > optee = kzalloc(sizeof(*optee), GFP_KERNEL);
> > diff --git a/drivers/tee/optee/optee_ffa.h b/drivers/tee/optee/optee_ffa.h
> > index ee3a03fc392c..97266243deaa 100644
> > --- a/drivers/tee/optee/optee_ffa.h
> > +++ b/drivers/tee/optee/optee_ffa.h
> > @@ -81,8 +81,16 @@
> > * as the second MSG arg struct for
> > * OPTEE_FFA_YIELDING_CALL_WITH_ARG.
> > * Bit[31:8]: Reserved (MBZ)
> > - * w5-w7: Note used (MBZ)
> > + * w5: Bitfield of secure world capabilities OPTEE_FFA_SEC_CAP_* below,
> > + * unused bits MBZ.
> > + * w6-w7: Not used (MBZ)
> > + */
> > +/*
> > + * Secure world supports giving an offset into the argument shared memory
> > + * object, see also OPTEE_FFA_YIELDING_CALL_WITH_ARG
> > */
> > +#define OPTEE_FFA_SEC_CAP_ARG_OFFSET BIT(0)
> > +
> > #define OPTEE_FFA_EXCHANGE_CAPABILITIES OPTEE_FFA_BLOCKING_CALL(2)
> >
> > /*
> > @@ -112,6 +120,8 @@
> > * OPTEE_MSG_GET_ARG_SIZE(num_params) follows a struct optee_msg_arg
> > * for RPC, this struct has reserved space for the number of RPC
> > * parameters as returned by OPTEE_FFA_EXCHANGE_CAPABILITIES.
> > + * MBZ unless the bit OPTEE_FFA_SEC_CAP_ARG_OFFSET is received with
> > + * OPTEE_FFA_EXCHANGE_CAPABILITIES.
> > * w7: Not used (MBZ)
> > * Resume from RPC. Register usage:
> > * w3: Service ID, OPTEE_FFA_YIELDING_CALL_RESUME
> > --
> > 2.31.1
> >
Powered by blists - more mailing lists