Skip to content

Commit

Permalink
tee: new ioctl to a register tee_shm from a dmabuf file descriptor
Browse files Browse the repository at this point in the history
This change allows userland to create a tee_shm object that refers
to a dmabuf reference.

Userland provides a dmabuf file descriptor as buffer reference.
The created tee_shm object exported as a brand new dmabuf reference
used to provide a clean fd to userland. Userland shall closed this new
fd to release the tee_shm object resources. The initial dmabuf resources
are tracked independently through original dmabuf file descriptor.

Once the buffer is registered and until it is released, TEE driver
keeps a refcount on the registered dmabuf structure.

This change only support dmabuf references that relates to physically
contiguous memory buffers.

New tee_shm flag to identify tee_shm objects built from a registered
dmabuf: TEE_SHM_EXT_DMA_BUF. Such tee_shm structures are flagged both
TEE_SHM_DMA_BUF and TEE_SHM_EXT_DMA_BUF.

Signed-off-by: Etienne Carriere <[email protected]>
From: https://github.com/linaro-swg/linux.git
(cherry picked from commit 41e21e5)
  • Loading branch information
etienne-lms authored and omasse-linaro committed Jun 20, 2022
1 parent 70c7cdc commit 9217cd1
Show file tree
Hide file tree
Showing 4 changed files with 193 additions and 4 deletions.
38 changes: 38 additions & 0 deletions drivers/tee/tee_core.c
Original file line number Diff line number Diff line change
Expand Up @@ -356,6 +356,42 @@ tee_ioctl_shm_register(struct tee_context *ctx,
return ret;
}

static int tee_ioctl_shm_register_fd(struct tee_context *ctx,
struct tee_ioctl_shm_register_fd_data __user *udata)
{
struct tee_ioctl_shm_register_fd_data data;
struct tee_shm *shm;
long ret;

if (copy_from_user(&data, udata, sizeof(data)))
return -EFAULT;

/* Currently no input flags are supported */
if (data.flags)
return -EINVAL;

shm = tee_shm_register_fd(ctx, data.fd);
if (IS_ERR_OR_NULL(shm))
return -EINVAL;

data.id = shm->id;
data.flags = shm->flags;
data.size = shm->size;

if (copy_to_user(udata, &data, sizeof(data)))
ret = -EFAULT;
else
ret = tee_shm_get_fd(shm);

/*
* When user space closes the file descriptor the shared memory
* should be freed or if tee_shm_get_fd() failed then it will
* be freed immediately.
*/
tee_shm_put(shm);
return ret;
}

static int params_from_user(struct tee_context *ctx, struct tee_param *params,
size_t num_params,
struct tee_ioctl_param __user *uparams)
Expand Down Expand Up @@ -830,6 +866,8 @@ static long tee_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
return tee_ioctl_shm_alloc(ctx, uarg);
case TEE_IOC_SHM_REGISTER:
return tee_ioctl_shm_register(ctx, uarg);
case TEE_IOC_SHM_REGISTER_FD:
return tee_ioctl_shm_register_fd(ctx, uarg);
case TEE_IOC_OPEN_SESSION:
return tee_ioctl_open_session(ctx, uarg);
case TEE_IOC_INVOKE:
Expand Down
108 changes: 104 additions & 4 deletions drivers/tee/tee_shm.c
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,7 @@
*/
#include <linux/anon_inodes.h>
#include <linux/device.h>
#include <linux/dma-buf.h>
#include <linux/idr.h>
#include <linux/mm.h>
#include <linux/sched.h>
Expand All @@ -12,6 +13,14 @@
#include <linux/uio.h>
#include "tee_private.h"

/* extra references appended to shm object for registered shared memory */
struct tee_shm_dmabuf_ref {
struct tee_shm shm;
struct dma_buf *dmabuf;
struct dma_buf_attachment *attach;
struct sg_table *sgt;
};

static void release_registered_pages(struct tee_shm *shm)
{
if (shm->pages) {
Expand All @@ -30,7 +39,16 @@ static void release_registered_pages(struct tee_shm *shm)

static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm)
{
if (shm->flags & TEE_SHM_POOL) {
if (shm->flags & TEE_SHM_EXT_DMA_BUF) {
struct tee_shm_dmabuf_ref *ref;

ref = container_of(shm, struct tee_shm_dmabuf_ref, shm);
dma_buf_unmap_attachment(ref->attach, ref->sgt,
DMA_BIDIRECTIONAL);

dma_buf_detach(ref->dmabuf, ref->attach);
dma_buf_put(ref->dmabuf);
} else if (shm->flags & TEE_SHM_POOL) {
struct tee_shm_pool_mgr *poolm;

if (shm->flags & TEE_SHM_DMA_BUF)
Expand All @@ -48,11 +66,10 @@ static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm)

release_registered_pages(shm);
}

teedev_ctx_put(shm->ctx);
if (shm->ctx)
teedev_ctx_put(shm->ctx);

kfree(shm);

tee_device_put(teedev);
}

Expand Down Expand Up @@ -145,6 +162,89 @@ struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size)
}
EXPORT_SYMBOL_GPL(tee_shm_alloc_kernel_buf);

struct tee_shm *tee_shm_register_fd(struct tee_context *ctx, int fd)
{
struct tee_shm_dmabuf_ref *ref;
void *rc;

if (!tee_device_get(ctx->teedev))
return ERR_PTR(-EINVAL);

ref = kzalloc(sizeof(*ref), GFP_KERNEL);
if (!ref) {
rc = ERR_PTR(-ENOMEM);
goto err;
}

refcount_set(&ref->shm.refcount, 1);
ref->shm.ctx = ctx;
ref->shm.id = -1;

ref->dmabuf = dma_buf_get(fd);
if (!ref->dmabuf) {
rc = ERR_PTR(-EINVAL);
goto err;
}

ref->attach = dma_buf_attach(ref->dmabuf, &ref->shm.ctx->teedev->dev);
if (IS_ERR_OR_NULL(ref->attach)) {
rc = ERR_PTR(-EINVAL);
goto err;
}

ref->sgt = dma_buf_map_attachment(ref->attach, DMA_BIDIRECTIONAL);
if (IS_ERR_OR_NULL(ref->sgt)) {
rc = ERR_PTR(-EINVAL);
goto err;
}

if (sg_nents(ref->sgt->sgl) != 1) {
rc = ERR_PTR(-EINVAL);
goto err;
}

ref->shm.paddr = sg_dma_address(ref->sgt->sgl);
ref->shm.size = sg_dma_len(ref->sgt->sgl);
ref->shm.flags = TEE_SHM_DMA_BUF | TEE_SHM_EXT_DMA_BUF;

mutex_lock(&ref->shm.ctx->teedev->mutex);
ref->shm.id = idr_alloc(&ref->shm.ctx->teedev->idr, &ref->shm,
1, 0, GFP_KERNEL);
mutex_unlock(&ref->shm.ctx->teedev->mutex);
if (ref->shm.id < 0) {
rc = ERR_PTR(ref->shm.id);
goto err;
}

if (ctx) {
teedev_ctx_get(ctx);
mutex_lock(&ref->shm.ctx->teedev->mutex);
mutex_unlock(&ref->shm.ctx->teedev->mutex);
}

return &ref->shm;

err:
if (ref) {
if (ref->shm.id >= 0) {
mutex_lock(&ctx->teedev->mutex);
idr_remove(&ctx->teedev->idr, ref->shm.id);
mutex_unlock(&ctx->teedev->mutex);
}
if (ref->sgt)
dma_buf_unmap_attachment(ref->attach, ref->sgt,
DMA_BIDIRECTIONAL);
if (ref->attach)
dma_buf_detach(ref->dmabuf, ref->attach);
if (ref->dmabuf)
dma_buf_put(ref->dmabuf);
}
kfree(ref);
tee_device_put(ctx->teedev);
return rc;
}
EXPORT_SYMBOL_GPL(tee_shm_register_fd);

struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
size_t length, u32 flags)
{
Expand Down
22 changes: 22 additions & 0 deletions include/linux/tee_drv.h
Original file line number Diff line number Diff line change
Expand Up @@ -340,6 +340,28 @@ void *tee_get_drvdata(struct tee_device *teedev);
struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags);
struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size);

/**
* tee_shm_register_fd() - Register shared memory from file descriptor
*
* @ctx: Context that allocates the shared memory
* @fd: Shared memory file descriptor reference
*
* @returns a pointer to 'struct tee_shm'
*/
struct tee_shm *tee_shm_register_fd(struct tee_context *ctx, int fd);

/**
* tee_shm_priv_alloc() - Allocate shared memory privately
* @teedev: Device that allocates the shared memory
* @size: Requested size of shared memory
*
* Allocates shared memory buffer that is not associated with any client
* context. Such buffers are owned by TEE driver and used for internal calls.
*
* @returns a pointer to 'struct tee_shm'
*/
struct tee_shm *tee_shm_priv_alloc(struct tee_device *teedev, size_t size);

/**
* tee_shm_register() - Register shared memory buffer
* @ctx: Context that registers the shared memory
Expand Down
29 changes: 29 additions & 0 deletions include/uapi/linux/tee.h
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,35 @@ struct tee_ioctl_shm_alloc_data {
#define TEE_IOC_SHM_ALLOC _IOWR(TEE_IOC_MAGIC, TEE_IOC_BASE + 1, \
struct tee_ioctl_shm_alloc_data)

/**
* struct tee_ioctl_shm_register_fd_data - Shared memory registering argument
* @fd: [in] File descriptor identifying the shared memory
* @size: [out] Size of shared memory to allocate
* @flags: [in] Flags to/from allocation.
* @id: [out] Identifier of the shared memory
*
* The flags field should currently be zero as input. Updated by the call
* with actual flags as defined by TEE_IOCTL_SHM_* above.
* This structure is used as argument for TEE_IOC_SHM_ALLOC below.
*/
struct tee_ioctl_shm_register_fd_data {
__s64 fd;
__u64 size;
__u32 flags;
__s32 id;
} __aligned(8);

/**
* TEE_IOC_SHM_REGISTER_FD - register a shared memory from a file descriptor
*
* Returns a file descriptor on success or < 0 on failure
*
* The returned file descriptor refers to the shared memory object in kernel
* land. The shared memory is freed when the descriptor is closed.
*/
#define TEE_IOC_SHM_REGISTER_FD _IOWR(TEE_IOC_MAGIC, TEE_IOC_BASE + 8, \
struct tee_ioctl_shm_register_fd_data)

/**
* struct tee_ioctl_buf_data - Variable sized buffer
* @buf_ptr: [in] A __user pointer to a buffer
Expand Down

0 comments on commit 9217cd1

Please sign in to comment.