Merge tag 'fixes-for-v5.16' of... (a6a47687) · Commits · EulixOS / Software / Kernel

drivers/tee/optee/core.c

+2 −4

Original line number	Original line	Diff line number	Diff line
	@@ -48,10 +48,8 @@ int optee_pool_op_alloc_helper(struct tee_shm_pool_mgr *poolm,
	goto err;		goto err;
	}		}

	for (i = 0; i < nr_pages; i++) {		for (i = 0; i < nr_pages; i++)
	pages[i] = page;		pages[i] = page + i;
	page++;
	}

	shm->flags \|= TEE_SHM_REGISTER;		shm->flags \|= TEE_SHM_REGISTER;
	rc = shm_register(shm->ctx, shm, pages, nr_pages,		rc = shm_register(shm->ctx, shm, pages, nr_pages,

drivers/tee/optee/smc_abi.c

+2 −0

Original line number	Original line	Diff line number	Diff line
	@@ -23,6 +23,7 @@
	#include "optee_private.h"		#include "optee_private.h"
	#include "optee_smc.h"		#include "optee_smc.h"
	#include "optee_rpc_cmd.h"		#include "optee_rpc_cmd.h"
			#include <linux/kmemleak.h>
	#define CREATE_TRACE_POINTS		#define CREATE_TRACE_POINTS
	#include "optee_trace.h"		#include "optee_trace.h"

	@@ -783,6 +784,7 @@ static void optee_handle_rpc(struct tee_context *ctx,
	param->a4 = 0;		param->a4 = 0;
	param->a5 = 0;		param->a5 = 0;
	}		}
			kmemleak_not_leak(shm);
	break;		break;
	case OPTEE_SMC_RPC_FUNC_FREE:		case OPTEE_SMC_RPC_FUNC_FREE:
	shm = reg_pair_to_ptr(param->a1, param->a2);		shm = reg_pair_to_ptr(param->a1, param->a2);

drivers/tee/tee_shm.c

+66 −108

Original line number	Original line	Diff line number	Diff line
	// SPDX-License-Identifier: GPL-2.0-only		// SPDX-License-Identifier: GPL-2.0-only
	/*		/*
	* Copyright (c) 2015-2016, Linaro Limited		* Copyright (c) 2015-2017, 2019-2021 Linaro Limited
	*/		*/
			#include <linux/anon_inodes.h>
	#include <linux/device.h>		#include <linux/device.h>
	#include <linux/dma-buf.h>
	#include <linux/fdtable.h>
	#include <linux/idr.h>		#include <linux/idr.h>
			#include <linux/mm.h>
	#include <linux/sched.h>		#include <linux/sched.h>
	#include <linux/slab.h>		#include <linux/slab.h>
	#include <linux/tee_drv.h>		#include <linux/tee_drv.h>
	#include <linux/uio.h>		#include <linux/uio.h>
	#include <linux/module.h>
	#include "tee_private.h"		#include "tee_private.h"

	MODULE_IMPORT_NS(DMA_BUF);

	static void release_registered_pages(struct tee_shm *shm)		static void release_registered_pages(struct tee_shm *shm)
	{		{
	if (shm->pages) {		if (shm->pages) {
	@@ -31,16 +28,8 @@ static void release_registered_pages(struct tee_shm *shm)
	}		}
	}		}

	static void tee_shm_release(struct tee_shm *shm)		static void tee_shm_release(struct tee_device teedev, struct tee_shm shm)
	{		{
	struct tee_device *teedev = shm->ctx->teedev;

	if (shm->flags & TEE_SHM_DMA_BUF) {
	mutex_lock(&teedev->mutex);
	idr_remove(&teedev->idr, shm->id);
	mutex_unlock(&teedev->mutex);
	}

	if (shm->flags & TEE_SHM_POOL) {		if (shm->flags & TEE_SHM_POOL) {
	struct tee_shm_pool_mgr *poolm;		struct tee_shm_pool_mgr *poolm;

	@@ -67,45 +56,6 @@ static void tee_shm_release(struct tee_shm *shm)
	tee_device_put(teedev);		tee_device_put(teedev);
	}		}

	static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment
	*attach, enum dma_data_direction dir)
	{
	return NULL;
	}

	static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach,
	struct sg_table *table,
	enum dma_data_direction dir)
	{
	}

	static void tee_shm_op_release(struct dma_buf *dmabuf)
	{
	struct tee_shm *shm = dmabuf->priv;

	tee_shm_release(shm);
	}

	static int tee_shm_op_mmap(struct dma_buf dmabuf, struct vm_area_struct vma)
	{
	struct tee_shm *shm = dmabuf->priv;
	size_t size = vma->vm_end - vma->vm_start;

	/* Refuse sharing shared memory provided by application */
	if (shm->flags & TEE_SHM_USER_MAPPED)
	return -EINVAL;

	return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
	size, vma->vm_page_prot);
	}

	static const struct dma_buf_ops tee_shm_dma_buf_ops = {
	.map_dma_buf = tee_shm_op_map_dma_buf,
	.unmap_dma_buf = tee_shm_op_unmap_dma_buf,
	.release = tee_shm_op_release,
	.mmap = tee_shm_op_mmap,
	};

	struct tee_shm tee_shm_alloc(struct tee_context ctx, size_t size, u32 flags)		struct tee_shm tee_shm_alloc(struct tee_context ctx, size_t size, u32 flags)
	{		{
	struct tee_device *teedev = ctx->teedev;		struct tee_device *teedev = ctx->teedev;
	@@ -140,6 +90,7 @@ struct tee_shm tee_shm_alloc(struct tee_context ctx, size_t size, u32 flags)
	goto err_dev_put;		goto err_dev_put;
	}		}

			refcount_set(&shm->refcount, 1);
	shm->flags = flags \| TEE_SHM_POOL;		shm->flags = flags \| TEE_SHM_POOL;
	shm->ctx = ctx;		shm->ctx = ctx;
	if (flags & TEE_SHM_DMA_BUF)		if (flags & TEE_SHM_DMA_BUF)
	@@ -153,10 +104,7 @@ struct tee_shm tee_shm_alloc(struct tee_context ctx, size_t size, u32 flags)
	goto err_kfree;		goto err_kfree;
	}		}


	if (flags & TEE_SHM_DMA_BUF) {		if (flags & TEE_SHM_DMA_BUF) {
	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);

	mutex_lock(&teedev->mutex);		mutex_lock(&teedev->mutex);
	shm->id = idr_alloc(&teedev->idr, shm, 1, 0, GFP_KERNEL);		shm->id = idr_alloc(&teedev->idr, shm, 1, 0, GFP_KERNEL);
	mutex_unlock(&teedev->mutex);		mutex_unlock(&teedev->mutex);
	@@ -164,28 +112,11 @@ struct tee_shm tee_shm_alloc(struct tee_context ctx, size_t size, u32 flags)
	ret = ERR_PTR(shm->id);		ret = ERR_PTR(shm->id);
	goto err_pool_free;		goto err_pool_free;
	}		}

	exp_info.ops = &tee_shm_dma_buf_ops;
	exp_info.size = shm->size;
	exp_info.flags = O_RDWR;
	exp_info.priv = shm;

	shm->dmabuf = dma_buf_export(&exp_info);
	if (IS_ERR(shm->dmabuf)) {
	ret = ERR_CAST(shm->dmabuf);
	goto err_rem;
	}
	}		}

	teedev_ctx_get(ctx);		teedev_ctx_get(ctx);

	return shm;		return shm;
	err_rem:
	if (flags & TEE_SHM_DMA_BUF) {
	mutex_lock(&teedev->mutex);
	idr_remove(&teedev->idr, shm->id);
	mutex_unlock(&teedev->mutex);
	}
	err_pool_free:		err_pool_free:
	poolm->ops->free(poolm, shm);		poolm->ops->free(poolm, shm);
	err_kfree:		err_kfree:
	@@ -246,6 +177,7 @@ struct tee_shm tee_shm_register(struct tee_context ctx, unsigned long addr,
	goto err;		goto err;
	}		}

			refcount_set(&shm->refcount, 1);
	shm->flags = flags \| TEE_SHM_REGISTER;		shm->flags = flags \| TEE_SHM_REGISTER;
	shm->ctx = ctx;		shm->ctx = ctx;
	shm->id = -1;		shm->id = -1;
	@@ -306,22 +238,6 @@ struct tee_shm tee_shm_register(struct tee_context ctx, unsigned long addr,
	goto err;		goto err;
	}		}

	if (flags & TEE_SHM_DMA_BUF) {
	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);

	exp_info.ops = &tee_shm_dma_buf_ops;
	exp_info.size = shm->size;
	exp_info.flags = O_RDWR;
	exp_info.priv = shm;

	shm->dmabuf = dma_buf_export(&exp_info);
	if (IS_ERR(shm->dmabuf)) {
	ret = ERR_CAST(shm->dmabuf);
	teedev->desc->ops->shm_unregister(ctx, shm);
	goto err;
	}
	}

	return shm;		return shm;
	err:		err:
	if (shm) {		if (shm) {
	@@ -339,6 +255,35 @@ struct tee_shm tee_shm_register(struct tee_context ctx, unsigned long addr,
	}		}
	EXPORT_SYMBOL_GPL(tee_shm_register);		EXPORT_SYMBOL_GPL(tee_shm_register);

			static int tee_shm_fop_release(struct inode inode, struct file filp)
			{
			tee_shm_put(filp->private_data);
			return 0;
			}

			static int tee_shm_fop_mmap(struct file filp, struct vm_area_struct vma)
			{
			struct tee_shm *shm = filp->private_data;
			size_t size = vma->vm_end - vma->vm_start;

			/* Refuse sharing shared memory provided by application */
			if (shm->flags & TEE_SHM_USER_MAPPED)
			return -EINVAL;

			/* check for overflowing the buffer's size */
			if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT)
			return -EINVAL;

			return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
			size, vma->vm_page_prot);
			}

			static const struct file_operations tee_shm_fops = {
			.owner = THIS_MODULE,
			.release = tee_shm_fop_release,
			.mmap = tee_shm_fop_mmap,
			};

	/**		/**
	* tee_shm_get_fd() - Increase reference count and return file descriptor		* tee_shm_get_fd() - Increase reference count and return file descriptor
	* @shm: Shared memory handle		* @shm: Shared memory handle
	@@ -351,10 +296,11 @@ int tee_shm_get_fd(struct tee_shm *shm)
	if (!(shm->flags & TEE_SHM_DMA_BUF))		if (!(shm->flags & TEE_SHM_DMA_BUF))
	return -EINVAL;		return -EINVAL;

	get_dma_buf(shm->dmabuf);		/* matched by tee_shm_put() in tee_shm_op_release() */
	fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);		refcount_inc(&shm->refcount);
			fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR);
	if (fd < 0)		if (fd < 0)
	dma_buf_put(shm->dmabuf);		tee_shm_put(shm);
	return fd;		return fd;
	}		}

	@@ -364,17 +310,7 @@ int tee_shm_get_fd(struct tee_shm *shm)
	*/		*/
	void tee_shm_free(struct tee_shm *shm)		void tee_shm_free(struct tee_shm *shm)
	{		{
	/*		tee_shm_put(shm);
	* dma_buf_put() decreases the dmabuf reference counter and will
	* call tee_shm_release() when the last reference is gone.
	*
	* In the case of driver private memory we call tee_shm_release
	* directly instead as it doesn't have a reference counter.
	*/
	if (shm->flags & TEE_SHM_DMA_BUF)
	dma_buf_put(shm->dmabuf);
	else
	tee_shm_release(shm);
	}		}
	EXPORT_SYMBOL_GPL(tee_shm_free);		EXPORT_SYMBOL_GPL(tee_shm_free);

	@@ -481,10 +417,15 @@ struct tee_shm tee_shm_get_from_id(struct tee_context ctx, int id)
	teedev = ctx->teedev;		teedev = ctx->teedev;
	mutex_lock(&teedev->mutex);		mutex_lock(&teedev->mutex);
	shm = idr_find(&teedev->idr, id);		shm = idr_find(&teedev->idr, id);
			/*
			* If the tee_shm was found in the IDR it must have a refcount
			* larger than 0 due to the guarantee in tee_shm_put() below. So
			* it's safe to use refcount_inc().
			*/
	if (!shm \|\| shm->ctx != ctx)		if (!shm \|\| shm->ctx != ctx)
	shm = ERR_PTR(-EINVAL);		shm = ERR_PTR(-EINVAL);
	else if (shm->flags & TEE_SHM_DMA_BUF)		else
	get_dma_buf(shm->dmabuf);		refcount_inc(&shm->refcount);
	mutex_unlock(&teedev->mutex);		mutex_unlock(&teedev->mutex);
	return shm;		return shm;
	}		}
	@@ -496,7 +437,24 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
	*/		*/
	void tee_shm_put(struct tee_shm *shm)		void tee_shm_put(struct tee_shm *shm)
	{		{
			struct tee_device *teedev = shm->ctx->teedev;
			bool do_release = false;

			mutex_lock(&teedev->mutex);
			if (refcount_dec_and_test(&shm->refcount)) {
			/*
			* refcount has reached 0, we must now remove it from the
			* IDR before releasing the mutex. This will guarantee that
			* the refcount_inc() in tee_shm_get_from_id() never starts
			* from 0.
			*/
	if (shm->flags & TEE_SHM_DMA_BUF)		if (shm->flags & TEE_SHM_DMA_BUF)
	dma_buf_put(shm->dmabuf);		idr_remove(&teedev->idr, shm->id);
			do_release = true;
			}
			mutex_unlock(&teedev->mutex);

			if (do_release)
			tee_shm_release(teedev, shm);
	}		}
	EXPORT_SYMBOL_GPL(tee_shm_put);		EXPORT_SYMBOL_GPL(tee_shm_put);

include/linux/tee_drv.h

+2 −2

Original line number	Original line	Diff line number	Diff line
	@@ -195,7 +195,7 @@ int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method,
	* @offset: offset of buffer in user space		* @offset: offset of buffer in user space
	* @pages: locked pages from userspace		* @pages: locked pages from userspace
	* @num_pages: number of locked pages		* @num_pages: number of locked pages
	* @dmabuf: dmabuf used to for exporting to user space		* @refcount: reference counter
	* @flags: defined by TEE_SHM_* in tee_drv.h		* @flags: defined by TEE_SHM_* in tee_drv.h
	* @id: unique id of a shared memory object on this device, shared		* @id: unique id of a shared memory object on this device, shared
	* with user space		* with user space
	@@ -214,7 +214,7 @@ struct tee_shm {
	unsigned int offset;		unsigned int offset;
	struct page **pages;		struct page **pages;
	size_t num_pages;		size_t num_pages;
	struct dma_buf *dmabuf;		refcount_t refcount;
	u32 flags;		u32 flags;
	int id;		int id;
	u64 sec_world_id;		u64 sec_world_id;