kernel.git/drivers/tee/tee_shm.c, branch linux-5.16.y

tee: handle lookup of shm with reference count 0

2021-12-16T08:30:14Z

Since the tee subsystem does not keep a strong reference to its idle shared memory buffers, it races with other threads that try to destroy a shared memory through a close of its dma-buf fd or by unmapping the memory. In tee_shm_get_from_id() when a lookup in teedev->idr has been successful, it is possible that the tee_shm is in the dma-buf teardown path, but that path is blocked by the teedev mutex. Since we don't have an API to tell if the tee_shm is in the dma-buf teardown path or not we must find another way of detecting this condition. Fix this by doing the reference counting directly on the tee_shm using a new refcount_t refcount field. dma-buf is replaced by using anon_inode_getfd() instead, this separates the life-cycle of the underlying file from the tee_shm. tee_shm_put() is updated to hold the mutex when decreasing the refcount to 0 and then remove the tee_shm from teedev->idr before releasing the mutex. This means that the tee_shm can never be found unless it has a refcount larger than 0. Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Cc: stable@vger.kernel.org Reviewed-by: Greg Kroah-Hartman Reviewed-by: Lars Persson Reviewed-by: Sumit Garg Reported-by: Patrik Lantz Signed-off-by: Jens Wiklander

dma-buf: move dma-buf symbols into the DMA_BUF module namespace

2021-10-25T12:53:08Z

In order to better track where in the kernel the dma-buf code is used, put the symbols in the namespace DMA_BUF and modify all users of the symbols to properly import the namespace to not break the build at the same time. Now the output of modinfo shows the use of these symbols, making it easier to watch for users over time: $ modinfo drivers/misc/fastrpc.ko | grep import import_ns: DMA_BUF Cc: "Pan, Xinhui" Cc: David Airlie Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: Mauro Carvalho Chehab Cc: dri-devel@lists.freedesktop.org Acked-by: Daniel Vetter Acked-by: Christian König Acked-by: Arnd Bergmann Acked-by: Sumit Semwal Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20211010124628.17691-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman

tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag

2021-07-21T05:55:50Z

Currently TEE_SHM_DMA_BUF flag has been inappropriately used to not register shared memory allocated for private usage by underlying TEE driver: OP-TEE in this case. So rather add a new flag as TEE_SHM_PRIV that can be utilized by underlying TEE drivers for private allocation and usage of shared memory. With this corrected, allow tee_shm_alloc_kernel_buf() to allocate a shared memory region without the backing of dma-buf. Cc: stable@vger.kernel.org Signed-off-by: Sumit Garg Co-developed-by: Tyler Hicks Signed-off-by: Tyler Hicks Reviewed-by: Jens Wiklander Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander

tee: add tee_shm_alloc_kernel_buf()

2021-07-21T05:55:44Z

Adds a new function tee_shm_alloc_kernel_buf() to allocate shared memory from a kernel driver. This function can later be made more lightweight by unnecessary dma-buf export. Cc: stable@vger.kernel.org Reviewed-by: Tyler Hicks Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander

tee: convert get_user_pages() --> pin_user_pages()

2020-08-25T09:01:06Z

This code was using get_user_pages*(), in a "Case 2" scenario (DMA/RDMA), using the categorization from [1]. That means that it's time to convert the get_user_pages*() + put_page() calls to pin_user_pages*() + unpin_user_pages() calls. Factor out a new, small release_registered_pages() function, in order to consolidate the logic for discerning between TEE_SHM_USER_MAPPED and TEE_SHM_KERNEL_MAPPED pages. This also absorbs the kfree() call that is also required there. There is some helpful background in [2]: basically, this is a small part of fixing a long-standing disconnect between pinning pages, and file systems' use of those pages. [1] Documentation/core-api/pin_user_pages.rst [2] "Explicit pinning of user-space pages": https://lwn.net/Articles/807108/ Cc: Jens Wiklander Cc: Sumit Semwal Cc: tee-dev@lists.linaro.org Cc: linux-media@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: linaro-mm-sig@lists.linaro.org Signed-off-by: John Hubbard Signed-off-by: Jens Wiklander

Merge tag 'tee-smatch-for-5.8' of git://git.linaro.org/people/jens.wiklander/linux-tee into arm/drivers

2020-05-25T14:56:33Z

tee: remove unnecessary NULL check in tee_shm_alloc() * tag 'tee-smatch-for-5.8' of git://git.linaro.org/people/jens.wiklander/linux-tee: tee: remove unnecessary NULL check in tee_shm_alloc() Link: https://lore.kernel.org/r/20200504181333.GA11018@jade Signed-off-by: Arnd Bergmann

tee: enable support to register kernel memory

2020-04-20T13:49:56Z

Enable support to register kernel memory reference with TEE. This change will allow TEE bus drivers to register memory references. Signed-off-by: Sumit Garg Signed-off-by: Jens Wiklander

tee: remove unnecessary NULL check in tee_shm_alloc()

2020-04-20T11:12:01Z

Smatch complains that "ctx" isn't checked consistently: drivers/tee/tee_shm.c:164 tee_shm_alloc() warn: variable dereferenced before check 'ctx' (see line 95) I audited the callers and "ctx" can't be NULL so the check can be removed. Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: tee_shm_op_mmap(): use TEE_SHM_USER_MAPPED

2020-02-28T12:37:42Z

tee_shm_op_mmap() uses the TEE_SHM_USER_MAPPED flag instead of the TEE_SHM_REGISTER flag to tell if a shared memory object is originating from registered user space memory. Signed-off-by: Jens Wiklander

tee: remove redundant teedev in struct tee_shm

2020-02-28T12:37:42Z

The ctx element in struct tee_shm is always valid. So remove the now redundant teedev element. Signed-off-by: Jens Wiklander