From 81feae395207e4869e9e064b4e6950ef64aa6765 Mon Sep 17 00:00:00 2001 From: Neeraj Soni Date: Sun, 8 Mar 2020 15:44:20 +0530 Subject: [PATCH] qseecom: Invalidate the buffer after listener operation Listener operation switches the context between secure and non-secure world while user requested qseecom operation is put to wait. Between lisetner operation start and finish CPU can do a speculative data fetch before secure world updates the physical memory of user requested response data buffer which was waiting in qseecom for listener operation to complete. This speculative fetch will pull old data from RAM to cache and user will end up reading stale data. Fix this by invalidating the response data dma buffer after listener call completes. Also remove the invalidate call for listener dma after scm call as data will not be accessed in kernel after scm call is completed. Change-Id: I68730a17b515f07a71a040a534f97ce97c65026c Signed-off-by: Neeraj Soni --- drivers/misc/qseecom.c | 25 +++++++++---------------- 1 file changed, 9 insertions(+), 16 deletions(-) diff --git a/drivers/misc/qseecom.c b/drivers/misc/qseecom.c index 76d1526bb6ee..dfb88e5d7fcd 100644 --- a/drivers/misc/qseecom.c +++ b/drivers/misc/qseecom.c @@ -2273,10 +2273,6 @@ err_resp: goto exit; } - ret = qseecom_dmabuf_cache_operations(ptr_svc->dmabuf, - QSEECOM_CACHE_INVALIDATE); - if (ret) - goto exit; } else { ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, cmd_buf, cmd_len, resp, sizeof(*resp)); @@ -2608,10 +2604,6 @@ err_resp: ret, data->client.app_id); goto exit; } - ret = qseecom_dmabuf_cache_operations(ptr_svc->dmabuf, - QSEECOM_CACHE_INVALIDATE); - if (ret) - goto exit; } else { ret = qseecom_scm_call(SCM_SVC_TZSCHEDULER, 1, cmd_buf, cmd_len, resp, sizeof(*resp)); @@ -3772,14 +3764,6 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, ret, data->client.app_id); goto exit; } - if (data->client.dmabuf) { - ret = qseecom_dmabuf_cache_operations(data->client.dmabuf, - QSEECOM_CACHE_INVALIDATE); - if (ret) { - pr_err("cache operation failed %d\n", ret); - goto exit; - } - } if (qseecom.qsee_reentrancy_support) { ret = __qseecom_process_reentrancy(&resp, ptr_app, data); @@ -3802,6 +3786,15 @@ static int __qseecom_send_cmd(struct qseecom_dev_handle *data, } } } + + if (data->client.dmabuf) { + ret = qseecom_dmabuf_cache_operations(data->client.dmabuf, + QSEECOM_CACHE_INVALIDATE); + if (ret) { + pr_err("cache operation failed %d\n", ret); + goto exit; + } + } exit: return ret; }