Public bug reported: [Impact]
OP-TEE FF-A memory objects use 4 KiB pages, while the kernel page size may be larger. On a 64 KiB-page kernel, a shared-memory offset can be at least 4 KiB. Encoding that offset incorrectly can either exceed the FF-A internal offset limit, map an RPC allocation at the wrong base, or corrupt the logical memref offset when a parameter is reused. [Fix] Start the FF-A descriptor at the 4 KiB page containing the shared buffer. Store only the remaining in-page offset in internal_offs, and preserve the logical shared-memory offset in offs_low/offs_high. Upstream submission: https://lore.kernel.org/r/[email protected] NV-Kernels PRs: https://github.com/NVIDIA/NV-Kernels/pull/576 https://github.com/NVIDIA/NV-Kernels/pull/553 ** Affects: linux-nvidia-7.0 (Ubuntu) Importance: Undecided Status: New ** Description changed: [Impact] OP-TEE FF-A memory objects use 4 KiB pages, while the kernel page size may be larger. On a 64 KiB-page kernel, a shared-memory offset can be at least 4 KiB. Encoding that offset incorrectly can either exceed the FF-A internal offset limit, map an RPC allocation at the wrong base, or corrupt the logical memref offset when a parameter is reused. [Fix] Start the FF-A descriptor at the 4 KiB page containing the shared buffer. Store only the remaining in-page offset in internal_offs, and preserve the logical shared-memory offset in offs_low/offs_high. - [Test Case] - - Tested on ARMv8-A with 64 KiB PAGE_SIZE and OP-TEE OS running as a - secure partition under Hafnium over FF-A. Registered shared memory with - offsets at least 4 KiB, memref reuse on the same TEEC_Operation, and RPC - OPTEE_RPC_CMD_SHM_ALLOC were verified. optee_hello_world, optee_aes, and - xtest regressions 1005, 1007, 1008, 4001-4003, and 6001-6009 passed. - - [Regression Potential] - - The change is confined to OP-TEE FF-A shared-memory descriptor and - offset handling. A regression could map the wrong shared-memory range or - return an incorrect memref offset. Upstream submission: https://lore.kernel.org/r/[email protected] NV-Kernels PRs: https://github.com/NVIDIA/NV-Kernels/pull/576 https://github.com/NVIDIA/NV-Kernels/pull/553 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2166792 Title: tee: optee: support shared memory offsets on large-page kernels To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux-nvidia-7.0/+bug/2166792/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
