tee_shm_alloc_dma_mem() returns dma_alloc_pages() memory without the dma_sync_single_for_device() that the DMA API requires before a device uses it. dma_alloc_pages() zeroes the pages through the cacheable linear map, so the zeroes can still be dirty in the cache when the optee protected memory pool lends the pages and a Secure Data Path TA writes them through its secure mapping. A later eviction of those lines overwrites the TA's data.
On an Eliza EVK with OP-TEE as the FF-A SPMC, a TA decrypts into a protected buffer, a read of all RAM through /proc/kcore evicts the lines, and the TA's digest of the buffer no longer matches:
frame 0: 0e534d8c..., reference d98ddba1...
Sync the allocation for the device before returning it.
Fixes: ab09dd6d9201 ("tee: add tee_shm_alloc_dma_mem()") Cc: stable@vger.kernel.org Signed-off-by: Tyler Baker tyler.baker@oss.qualcomm.com --- Vincent's direct-map series [1] cleans the range in dma_zap_direct_map() before the lend, which also covers this when it can unmap. It returns -ENODEV without any cache maintenance when there is no lendable pool and the direct map cannot change (arm64 with rodata=noalias or rodata=off), and it is not a stable candidate.
On a dma-coherent TEE device the sync does nothing. teedev->dev is not configured from firmware, so it is not coherent today.
Without the fix the TA's data is lost: https://lava.infra.foundries.io/scheduler/job/554467#L2262 With it, the data is intact after the scan and 50 lend rounds: https://lava.infra.foundries.io/scheduler/job/563840#L1979 https://lava.infra.foundries.io/scheduler/job/563840#L2008
[1] https://lore.kernel.org/all/20261111110738.872947-1-vdonnefort@google.com/ --- drivers/tee/tee_shm.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 5c47a36916c45..70a273a425f88 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -297,6 +297,9 @@ struct tee_shm *tee_shm_alloc_dma_mem(struct tee_context *ctx, if (!page) goto err_put_teedev;
+ dma_sync_single_for_device(&teedev->dev, dma_addr, + page_count * PAGE_SIZE, DMA_BIDIRECTIONAL); + dma_mem = kzalloc_obj(*dma_mem); if (!dma_mem) goto err_free_pages;
--- base-commit: e21989d08e0d6abacfff71387d0cb36dd96a4079 change-id: 20261113-tee-shm-dma-sync-12f58435b81e
Best regards, -- Tyler Baker tyler.baker@oss.qualcomm.com