19c92ab61SThomas Gleixner // SPDX-License-Identifier: GPL-2.0-only
2967c9ccaSJens Wiklander /*
3dfd0743fSJens Wiklander * Copyright (c) 2015-2017, 2019-2021 Linaro Limited
4967c9ccaSJens Wiklander */
5dfd0743fSJens Wiklander #include <linux/anon_inodes.h>
6967c9ccaSJens Wiklander #include <linux/device.h>
7967c9ccaSJens Wiklander #include <linux/idr.h>
8dfd0743fSJens Wiklander #include <linux/mm.h>
9967c9ccaSJens Wiklander #include <linux/sched.h>
10967c9ccaSJens Wiklander #include <linux/slab.h>
11967c9ccaSJens Wiklander #include <linux/tee_drv.h>
12eccd7439SJens Wiklander #include <linux/uaccess.h>
132a6ba3f7SSumit Garg #include <linux/uio.h>
140249a75bSIra Weiny #include <linux/highmem.h>
15967c9ccaSJens Wiklander #include "tee_private.h"
16967c9ccaSJens Wiklander
shm_put_kernel_pages(struct page ** pages,size_t page_count)1753e16519SJens Wiklander static void shm_put_kernel_pages(struct page **pages, size_t page_count)
1853e16519SJens Wiklander {
1953e16519SJens Wiklander size_t n;
2053e16519SJens Wiklander
2153e16519SJens Wiklander for (n = 0; n < page_count; n++)
2253e16519SJens Wiklander put_page(pages[n]);
2353e16519SJens Wiklander }
2453e16519SJens Wiklander
shm_get_kernel_pages(unsigned long start,size_t page_count,struct page ** pages)2553e16519SJens Wiklander static int shm_get_kernel_pages(unsigned long start, size_t page_count,
2653e16519SJens Wiklander struct page **pages)
2753e16519SJens Wiklander {
280249a75bSIra Weiny struct page *page;
2953e16519SJens Wiklander size_t n;
3053e16519SJens Wiklander
310249a75bSIra Weiny if (WARN_ON_ONCE(is_vmalloc_addr((void *)start) ||
320249a75bSIra Weiny is_kmap_addr((void *)start)))
33c8390039SIra Weiny return -EINVAL;
343e47235eSPhil Chang
35*86711330SLinus Walleij page = virt_to_page((void *)start);
3653e16519SJens Wiklander for (n = 0; n < page_count; n++) {
370249a75bSIra Weiny pages[n] = page + n;
380249a75bSIra Weiny get_page(pages[n]);
3953e16519SJens Wiklander }
4053e16519SJens Wiklander
410249a75bSIra Weiny return page_count;
4253e16519SJens Wiklander }
4353e16519SJens Wiklander
release_registered_pages(struct tee_shm * shm)444300cd63SJohn Hubbard static void release_registered_pages(struct tee_shm *shm)
454300cd63SJohn Hubbard {
464300cd63SJohn Hubbard if (shm->pages) {
4753e16519SJens Wiklander if (shm->flags & TEE_SHM_USER_MAPPED)
484300cd63SJohn Hubbard unpin_user_pages(shm->pages, shm->num_pages);
4953e16519SJens Wiklander else
5053e16519SJens Wiklander shm_put_kernel_pages(shm->pages, shm->num_pages);
514300cd63SJohn Hubbard
524300cd63SJohn Hubbard kfree(shm->pages);
534300cd63SJohn Hubbard }
544300cd63SJohn Hubbard }
554300cd63SJohn Hubbard
tee_shm_release(struct tee_device * teedev,struct tee_shm * shm)56dfd0743fSJens Wiklander static void tee_shm_release(struct tee_device *teedev, struct tee_shm *shm)
57967c9ccaSJens Wiklander {
58033ddf12SJens Wiklander if (shm->flags & TEE_SHM_POOL) {
59d88e0493SJens Wiklander teedev->pool->ops->free(teedev->pool, shm);
60a45ea4efSJens Wiklander } else if (shm->flags & TEE_SHM_DYNAMIC) {
61033ddf12SJens Wiklander int rc = teedev->desc->ops->shm_unregister(shm->ctx, shm);
62033ddf12SJens Wiklander
63033ddf12SJens Wiklander if (rc)
64033ddf12SJens Wiklander dev_err(teedev->dev.parent,
65033ddf12SJens Wiklander "unregister shm %p failed: %d", shm, rc);
66033ddf12SJens Wiklander
674300cd63SJohn Hubbard release_registered_pages(shm);
68033ddf12SJens Wiklander }
69033ddf12SJens Wiklander
70217e0250SVolodymyr Babchuk teedev_ctx_put(shm->ctx);
71217e0250SVolodymyr Babchuk
72967c9ccaSJens Wiklander kfree(shm);
73967c9ccaSJens Wiklander
74967c9ccaSJens Wiklander tee_device_put(teedev);
75967c9ccaSJens Wiklander }
76967c9ccaSJens Wiklander
shm_alloc_helper(struct tee_context * ctx,size_t size,size_t align,u32 flags,int id)775d41f1b3SJens Wiklander static struct tee_shm *shm_alloc_helper(struct tee_context *ctx, size_t size,
785d41f1b3SJens Wiklander size_t align, u32 flags, int id)
79967c9ccaSJens Wiklander {
80c180f9bbSJens Wiklander struct tee_device *teedev = ctx->teedev;
81967c9ccaSJens Wiklander struct tee_shm *shm;
82967c9ccaSJens Wiklander void *ret;
83967c9ccaSJens Wiklander int rc;
84967c9ccaSJens Wiklander
85967c9ccaSJens Wiklander if (!tee_device_get(teedev))
86967c9ccaSJens Wiklander return ERR_PTR(-EINVAL);
87967c9ccaSJens Wiklander
88967c9ccaSJens Wiklander if (!teedev->pool) {
89967c9ccaSJens Wiklander /* teedev has been detached from driver */
90967c9ccaSJens Wiklander ret = ERR_PTR(-EINVAL);
91967c9ccaSJens Wiklander goto err_dev_put;
92967c9ccaSJens Wiklander }
93967c9ccaSJens Wiklander
94967c9ccaSJens Wiklander shm = kzalloc(sizeof(*shm), GFP_KERNEL);
95967c9ccaSJens Wiklander if (!shm) {
96967c9ccaSJens Wiklander ret = ERR_PTR(-ENOMEM);
97967c9ccaSJens Wiklander goto err_dev_put;
98967c9ccaSJens Wiklander }
99967c9ccaSJens Wiklander
100dfd0743fSJens Wiklander refcount_set(&shm->refcount, 1);
1015d41f1b3SJens Wiklander shm->flags = flags;
1025d41f1b3SJens Wiklander shm->id = id;
1035d41f1b3SJens Wiklander
104d88e0493SJens Wiklander /*
1055d41f1b3SJens Wiklander * We're assigning this as it is needed if the shm is to be
1065d41f1b3SJens Wiklander * registered. If this function returns OK then the caller expected
1075d41f1b3SJens Wiklander * to call teedev_ctx_get() or clear shm->ctx in case it's not
1085d41f1b3SJens Wiklander * needed any longer.
109d88e0493SJens Wiklander */
1105d41f1b3SJens Wiklander shm->ctx = ctx;
111967c9ccaSJens Wiklander
112d88e0493SJens Wiklander rc = teedev->pool->ops->alloc(teedev->pool, shm, size, align);
113967c9ccaSJens Wiklander if (rc) {
114967c9ccaSJens Wiklander ret = ERR_PTR(rc);
115967c9ccaSJens Wiklander goto err_kfree;
116967c9ccaSJens Wiklander }
117967c9ccaSJens Wiklander
118217e0250SVolodymyr Babchuk teedev_ctx_get(ctx);
119967c9ccaSJens Wiklander return shm;
120967c9ccaSJens Wiklander err_kfree:
121967c9ccaSJens Wiklander kfree(shm);
122967c9ccaSJens Wiklander err_dev_put:
123967c9ccaSJens Wiklander tee_device_put(teedev);
124967c9ccaSJens Wiklander return ret;
125967c9ccaSJens Wiklander }
126967c9ccaSJens Wiklander
127dc7019b7SJens Wiklander /**
12871cc47d4SJens Wiklander * tee_shm_alloc_user_buf() - Allocate shared memory for user space
12971cc47d4SJens Wiklander * @ctx: Context that allocates the shared memory
13071cc47d4SJens Wiklander * @size: Requested size of shared memory
13171cc47d4SJens Wiklander *
13271cc47d4SJens Wiklander * Memory allocated as user space shared memory is automatically freed when
13371cc47d4SJens Wiklander * the TEE file pointer is closed. The primary usage of this function is
13471cc47d4SJens Wiklander * when the TEE driver doesn't support registering ordinary user space
13571cc47d4SJens Wiklander * memory.
13671cc47d4SJens Wiklander *
13771cc47d4SJens Wiklander * @returns a pointer to 'struct tee_shm'
13871cc47d4SJens Wiklander */
tee_shm_alloc_user_buf(struct tee_context * ctx,size_t size)13971cc47d4SJens Wiklander struct tee_shm *tee_shm_alloc_user_buf(struct tee_context *ctx, size_t size)
14071cc47d4SJens Wiklander {
141a45ea4efSJens Wiklander u32 flags = TEE_SHM_DYNAMIC | TEE_SHM_POOL;
1425d41f1b3SJens Wiklander struct tee_device *teedev = ctx->teedev;
1435d41f1b3SJens Wiklander struct tee_shm *shm;
1445d41f1b3SJens Wiklander void *ret;
1455d41f1b3SJens Wiklander int id;
1465d41f1b3SJens Wiklander
1475d41f1b3SJens Wiklander mutex_lock(&teedev->mutex);
1485d41f1b3SJens Wiklander id = idr_alloc(&teedev->idr, NULL, 1, 0, GFP_KERNEL);
1495d41f1b3SJens Wiklander mutex_unlock(&teedev->mutex);
1505d41f1b3SJens Wiklander if (id < 0)
1515d41f1b3SJens Wiklander return ERR_PTR(id);
1525d41f1b3SJens Wiklander
1535d41f1b3SJens Wiklander shm = shm_alloc_helper(ctx, size, PAGE_SIZE, flags, id);
1545d41f1b3SJens Wiklander if (IS_ERR(shm)) {
1555d41f1b3SJens Wiklander mutex_lock(&teedev->mutex);
1565d41f1b3SJens Wiklander idr_remove(&teedev->idr, id);
1575d41f1b3SJens Wiklander mutex_unlock(&teedev->mutex);
1585d41f1b3SJens Wiklander return shm;
1595d41f1b3SJens Wiklander }
1605d41f1b3SJens Wiklander
1615d41f1b3SJens Wiklander mutex_lock(&teedev->mutex);
1625d41f1b3SJens Wiklander ret = idr_replace(&teedev->idr, shm, id);
1635d41f1b3SJens Wiklander mutex_unlock(&teedev->mutex);
1645d41f1b3SJens Wiklander if (IS_ERR(ret)) {
1655d41f1b3SJens Wiklander tee_shm_free(shm);
1665d41f1b3SJens Wiklander return ret;
1675d41f1b3SJens Wiklander }
1685d41f1b3SJens Wiklander
1695d41f1b3SJens Wiklander return shm;
17071cc47d4SJens Wiklander }
17171cc47d4SJens Wiklander
17271cc47d4SJens Wiklander /**
173dc7019b7SJens Wiklander * tee_shm_alloc_kernel_buf() - Allocate shared memory for kernel buffer
174dc7019b7SJens Wiklander * @ctx: Context that allocates the shared memory
175dc7019b7SJens Wiklander * @size: Requested size of shared memory
176dc7019b7SJens Wiklander *
177dc7019b7SJens Wiklander * The returned memory registered in secure world and is suitable to be
178dc7019b7SJens Wiklander * passed as a memory buffer in parameter argument to
179dc7019b7SJens Wiklander * tee_client_invoke_func(). The memory allocated is later freed with a
180dc7019b7SJens Wiklander * call to tee_shm_free().
181dc7019b7SJens Wiklander *
182dc7019b7SJens Wiklander * @returns a pointer to 'struct tee_shm'
183dc7019b7SJens Wiklander */
tee_shm_alloc_kernel_buf(struct tee_context * ctx,size_t size)184dc7019b7SJens Wiklander struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size)
185dc7019b7SJens Wiklander {
186a45ea4efSJens Wiklander u32 flags = TEE_SHM_DYNAMIC | TEE_SHM_POOL;
1875d41f1b3SJens Wiklander
1885d41f1b3SJens Wiklander return shm_alloc_helper(ctx, size, PAGE_SIZE, flags, -1);
189dc7019b7SJens Wiklander }
190dc7019b7SJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_alloc_kernel_buf);
191dc7019b7SJens Wiklander
1925d41f1b3SJens Wiklander /**
1935d41f1b3SJens Wiklander * tee_shm_alloc_priv_buf() - Allocate shared memory for a privately shared
1945d41f1b3SJens Wiklander * kernel buffer
1955d41f1b3SJens Wiklander * @ctx: Context that allocates the shared memory
1965d41f1b3SJens Wiklander * @size: Requested size of shared memory
1975d41f1b3SJens Wiklander *
1985d41f1b3SJens Wiklander * This function returns similar shared memory as
1995d41f1b3SJens Wiklander * tee_shm_alloc_kernel_buf(), but with the difference that the memory
2005d41f1b3SJens Wiklander * might not be registered in secure world in case the driver supports
2015d41f1b3SJens Wiklander * passing memory not registered in advance.
2025d41f1b3SJens Wiklander *
2035d41f1b3SJens Wiklander * This function should normally only be used internally in the TEE
2045d41f1b3SJens Wiklander * drivers.
2055d41f1b3SJens Wiklander *
2065d41f1b3SJens Wiklander * @returns a pointer to 'struct tee_shm'
2075d41f1b3SJens Wiklander */
tee_shm_alloc_priv_buf(struct tee_context * ctx,size_t size)2085d41f1b3SJens Wiklander struct tee_shm *tee_shm_alloc_priv_buf(struct tee_context *ctx, size_t size)
2095d41f1b3SJens Wiklander {
210a45ea4efSJens Wiklander u32 flags = TEE_SHM_PRIV | TEE_SHM_POOL;
2115d41f1b3SJens Wiklander
2125d41f1b3SJens Wiklander return shm_alloc_helper(ctx, size, sizeof(long) * 2, flags, -1);
2135d41f1b3SJens Wiklander }
2145d41f1b3SJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_alloc_priv_buf);
2155d41f1b3SJens Wiklander
21653e16519SJens Wiklander static struct tee_shm *
register_shm_helper(struct tee_context * ctx,unsigned long addr,size_t length,u32 flags,int id)21753e16519SJens Wiklander register_shm_helper(struct tee_context *ctx, unsigned long addr,
21853e16519SJens Wiklander size_t length, u32 flags, int id)
219033ddf12SJens Wiklander {
220033ddf12SJens Wiklander struct tee_device *teedev = ctx->teedev;
221033ddf12SJens Wiklander struct tee_shm *shm;
22253e16519SJens Wiklander unsigned long start;
22353e16519SJens Wiklander size_t num_pages;
224033ddf12SJens Wiklander void *ret;
225033ddf12SJens Wiklander int rc;
226033ddf12SJens Wiklander
227033ddf12SJens Wiklander if (!tee_device_get(teedev))
228033ddf12SJens Wiklander return ERR_PTR(-EINVAL);
229033ddf12SJens Wiklander
230033ddf12SJens Wiklander if (!teedev->desc->ops->shm_register ||
231033ddf12SJens Wiklander !teedev->desc->ops->shm_unregister) {
23253e16519SJens Wiklander ret = ERR_PTR(-ENOTSUPP);
23353e16519SJens Wiklander goto err_dev_put;
234033ddf12SJens Wiklander }
235033ddf12SJens Wiklander
236217e0250SVolodymyr Babchuk teedev_ctx_get(ctx);
237217e0250SVolodymyr Babchuk
238033ddf12SJens Wiklander shm = kzalloc(sizeof(*shm), GFP_KERNEL);
239033ddf12SJens Wiklander if (!shm) {
240033ddf12SJens Wiklander ret = ERR_PTR(-ENOMEM);
24153e16519SJens Wiklander goto err_ctx_put;
242033ddf12SJens Wiklander }
243033ddf12SJens Wiklander
244dfd0743fSJens Wiklander refcount_set(&shm->refcount, 1);
24553e16519SJens Wiklander shm->flags = flags;
246033ddf12SJens Wiklander shm->ctx = ctx;
24753e16519SJens Wiklander shm->id = id;
24878063a9dSAndrey Konovalov addr = untagged_addr(addr);
249033ddf12SJens Wiklander start = rounddown(addr, PAGE_SIZE);
250033ddf12SJens Wiklander shm->offset = addr - start;
251033ddf12SJens Wiklander shm->size = length;
252033ddf12SJens Wiklander num_pages = (roundup(addr + length, PAGE_SIZE) - start) / PAGE_SIZE;
253033ddf12SJens Wiklander shm->pages = kcalloc(num_pages, sizeof(*shm->pages), GFP_KERNEL);
254033ddf12SJens Wiklander if (!shm->pages) {
255033ddf12SJens Wiklander ret = ERR_PTR(-ENOMEM);
25653e16519SJens Wiklander goto err_free_shm;
257033ddf12SJens Wiklander }
258033ddf12SJens Wiklander
25953e16519SJens Wiklander if (flags & TEE_SHM_USER_MAPPED)
2604300cd63SJohn Hubbard rc = pin_user_pages_fast(start, num_pages, FOLL_WRITE,
2612a6ba3f7SSumit Garg shm->pages);
26253e16519SJens Wiklander else
26353e16519SJens Wiklander rc = shm_get_kernel_pages(start, num_pages, shm->pages);
264033ddf12SJens Wiklander if (rc > 0)
265033ddf12SJens Wiklander shm->num_pages = rc;
266033ddf12SJens Wiklander if (rc != num_pages) {
2672490cdf6SDan Carpenter if (rc >= 0)
268033ddf12SJens Wiklander rc = -ENOMEM;
269033ddf12SJens Wiklander ret = ERR_PTR(rc);
27053e16519SJens Wiklander goto err_put_shm_pages;
271033ddf12SJens Wiklander }
272033ddf12SJens Wiklander
273033ddf12SJens Wiklander rc = teedev->desc->ops->shm_register(ctx, shm, shm->pages,
27495ffe4caSJens Wiklander shm->num_pages, start);
275033ddf12SJens Wiklander if (rc) {
276033ddf12SJens Wiklander ret = ERR_PTR(rc);
27753e16519SJens Wiklander goto err_put_shm_pages;
278033ddf12SJens Wiklander }
279033ddf12SJens Wiklander
280033ddf12SJens Wiklander return shm;
28153e16519SJens Wiklander err_put_shm_pages:
28253e16519SJens Wiklander if (flags & TEE_SHM_USER_MAPPED)
28353e16519SJens Wiklander unpin_user_pages(shm->pages, shm->num_pages);
28453e16519SJens Wiklander else
28553e16519SJens Wiklander shm_put_kernel_pages(shm->pages, shm->num_pages);
28653e16519SJens Wiklander kfree(shm->pages);
28753e16519SJens Wiklander err_free_shm:
288033ddf12SJens Wiklander kfree(shm);
28953e16519SJens Wiklander err_ctx_put:
290217e0250SVolodymyr Babchuk teedev_ctx_put(ctx);
29153e16519SJens Wiklander err_dev_put:
292033ddf12SJens Wiklander tee_device_put(teedev);
293033ddf12SJens Wiklander return ret;
294033ddf12SJens Wiklander }
295033ddf12SJens Wiklander
296056d3fedSJens Wiklander /**
297056d3fedSJens Wiklander * tee_shm_register_user_buf() - Register a userspace shared memory buffer
298056d3fedSJens Wiklander * @ctx: Context that registers the shared memory
299056d3fedSJens Wiklander * @addr: The userspace address of the shared buffer
300056d3fedSJens Wiklander * @length: Length of the shared buffer
301056d3fedSJens Wiklander *
302056d3fedSJens Wiklander * @returns a pointer to 'struct tee_shm'
303056d3fedSJens Wiklander */
tee_shm_register_user_buf(struct tee_context * ctx,unsigned long addr,size_t length)304056d3fedSJens Wiklander struct tee_shm *tee_shm_register_user_buf(struct tee_context *ctx,
305056d3fedSJens Wiklander unsigned long addr, size_t length)
306056d3fedSJens Wiklander {
307a45ea4efSJens Wiklander u32 flags = TEE_SHM_USER_MAPPED | TEE_SHM_DYNAMIC;
30853e16519SJens Wiklander struct tee_device *teedev = ctx->teedev;
30953e16519SJens Wiklander struct tee_shm *shm;
31053e16519SJens Wiklander void *ret;
31153e16519SJens Wiklander int id;
31253e16519SJens Wiklander
313573ae4f1SJens Wiklander if (!access_ok((void __user *)addr, length))
314573ae4f1SJens Wiklander return ERR_PTR(-EFAULT);
315573ae4f1SJens Wiklander
31653e16519SJens Wiklander mutex_lock(&teedev->mutex);
31753e16519SJens Wiklander id = idr_alloc(&teedev->idr, NULL, 1, 0, GFP_KERNEL);
31853e16519SJens Wiklander mutex_unlock(&teedev->mutex);
31953e16519SJens Wiklander if (id < 0)
32053e16519SJens Wiklander return ERR_PTR(id);
32153e16519SJens Wiklander
32253e16519SJens Wiklander shm = register_shm_helper(ctx, addr, length, flags, id);
32353e16519SJens Wiklander if (IS_ERR(shm)) {
32453e16519SJens Wiklander mutex_lock(&teedev->mutex);
32553e16519SJens Wiklander idr_remove(&teedev->idr, id);
32653e16519SJens Wiklander mutex_unlock(&teedev->mutex);
32753e16519SJens Wiklander return shm;
32853e16519SJens Wiklander }
32953e16519SJens Wiklander
33053e16519SJens Wiklander mutex_lock(&teedev->mutex);
33153e16519SJens Wiklander ret = idr_replace(&teedev->idr, shm, id);
33253e16519SJens Wiklander mutex_unlock(&teedev->mutex);
33353e16519SJens Wiklander if (IS_ERR(ret)) {
33453e16519SJens Wiklander tee_shm_free(shm);
33553e16519SJens Wiklander return ret;
33653e16519SJens Wiklander }
33753e16519SJens Wiklander
33853e16519SJens Wiklander return shm;
339056d3fedSJens Wiklander }
340056d3fedSJens Wiklander
341056d3fedSJens Wiklander /**
342056d3fedSJens Wiklander * tee_shm_register_kernel_buf() - Register kernel memory to be shared with
343056d3fedSJens Wiklander * secure world
344056d3fedSJens Wiklander * @ctx: Context that registers the shared memory
345056d3fedSJens Wiklander * @addr: The buffer
346056d3fedSJens Wiklander * @length: Length of the buffer
347056d3fedSJens Wiklander *
348056d3fedSJens Wiklander * @returns a pointer to 'struct tee_shm'
349056d3fedSJens Wiklander */
350056d3fedSJens Wiklander
tee_shm_register_kernel_buf(struct tee_context * ctx,void * addr,size_t length)351056d3fedSJens Wiklander struct tee_shm *tee_shm_register_kernel_buf(struct tee_context *ctx,
352056d3fedSJens Wiklander void *addr, size_t length)
353056d3fedSJens Wiklander {
354a45ea4efSJens Wiklander u32 flags = TEE_SHM_DYNAMIC;
35553e16519SJens Wiklander
35653e16519SJens Wiklander return register_shm_helper(ctx, (unsigned long)addr, length, flags, -1);
357056d3fedSJens Wiklander }
358056d3fedSJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_register_kernel_buf);
359056d3fedSJens Wiklander
tee_shm_fop_release(struct inode * inode,struct file * filp)360dfd0743fSJens Wiklander static int tee_shm_fop_release(struct inode *inode, struct file *filp)
361dfd0743fSJens Wiklander {
362dfd0743fSJens Wiklander tee_shm_put(filp->private_data);
363dfd0743fSJens Wiklander return 0;
364dfd0743fSJens Wiklander }
365dfd0743fSJens Wiklander
tee_shm_fop_mmap(struct file * filp,struct vm_area_struct * vma)366dfd0743fSJens Wiklander static int tee_shm_fop_mmap(struct file *filp, struct vm_area_struct *vma)
367dfd0743fSJens Wiklander {
368dfd0743fSJens Wiklander struct tee_shm *shm = filp->private_data;
369dfd0743fSJens Wiklander size_t size = vma->vm_end - vma->vm_start;
370dfd0743fSJens Wiklander
371dfd0743fSJens Wiklander /* Refuse sharing shared memory provided by application */
372dfd0743fSJens Wiklander if (shm->flags & TEE_SHM_USER_MAPPED)
373dfd0743fSJens Wiklander return -EINVAL;
374dfd0743fSJens Wiklander
375dfd0743fSJens Wiklander /* check for overflowing the buffer's size */
376dfd0743fSJens Wiklander if (vma->vm_pgoff + vma_pages(vma) > shm->size >> PAGE_SHIFT)
377dfd0743fSJens Wiklander return -EINVAL;
378dfd0743fSJens Wiklander
379dfd0743fSJens Wiklander return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
380dfd0743fSJens Wiklander size, vma->vm_page_prot);
381dfd0743fSJens Wiklander }
382dfd0743fSJens Wiklander
383dfd0743fSJens Wiklander static const struct file_operations tee_shm_fops = {
384dfd0743fSJens Wiklander .owner = THIS_MODULE,
385dfd0743fSJens Wiklander .release = tee_shm_fop_release,
386dfd0743fSJens Wiklander .mmap = tee_shm_fop_mmap,
387dfd0743fSJens Wiklander };
388dfd0743fSJens Wiklander
389967c9ccaSJens Wiklander /**
390967c9ccaSJens Wiklander * tee_shm_get_fd() - Increase reference count and return file descriptor
391967c9ccaSJens Wiklander * @shm: Shared memory handle
392967c9ccaSJens Wiklander * @returns user space file descriptor to shared memory
393967c9ccaSJens Wiklander */
tee_shm_get_fd(struct tee_shm * shm)394967c9ccaSJens Wiklander int tee_shm_get_fd(struct tee_shm *shm)
395967c9ccaSJens Wiklander {
396967c9ccaSJens Wiklander int fd;
397967c9ccaSJens Wiklander
398a45ea4efSJens Wiklander if (shm->id < 0)
399967c9ccaSJens Wiklander return -EINVAL;
400967c9ccaSJens Wiklander
401dfd0743fSJens Wiklander /* matched by tee_shm_put() in tee_shm_op_release() */
402dfd0743fSJens Wiklander refcount_inc(&shm->refcount);
403dfd0743fSJens Wiklander fd = anon_inode_getfd("tee_shm", &tee_shm_fops, shm, O_RDWR);
404bb765d1cSJann Horn if (fd < 0)
405dfd0743fSJens Wiklander tee_shm_put(shm);
406967c9ccaSJens Wiklander return fd;
407967c9ccaSJens Wiklander }
408967c9ccaSJens Wiklander
409967c9ccaSJens Wiklander /**
410967c9ccaSJens Wiklander * tee_shm_free() - Free shared memory
411967c9ccaSJens Wiklander * @shm: Handle to shared memory to free
412967c9ccaSJens Wiklander */
tee_shm_free(struct tee_shm * shm)413967c9ccaSJens Wiklander void tee_shm_free(struct tee_shm *shm)
414967c9ccaSJens Wiklander {
415dfd0743fSJens Wiklander tee_shm_put(shm);
416967c9ccaSJens Wiklander }
417967c9ccaSJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_free);
418967c9ccaSJens Wiklander
419967c9ccaSJens Wiklander /**
420967c9ccaSJens Wiklander * tee_shm_get_va() - Get virtual address of a shared memory plus an offset
421967c9ccaSJens Wiklander * @shm: Shared memory handle
422967c9ccaSJens Wiklander * @offs: Offset from start of this shared memory
423967c9ccaSJens Wiklander * @returns virtual address of the shared memory + offs if offs is within
424967c9ccaSJens Wiklander * the bounds of this shared memory, else an ERR_PTR
425967c9ccaSJens Wiklander */
tee_shm_get_va(struct tee_shm * shm,size_t offs)426967c9ccaSJens Wiklander void *tee_shm_get_va(struct tee_shm *shm, size_t offs)
427967c9ccaSJens Wiklander {
428a45ea4efSJens Wiklander if (!shm->kaddr)
429033ddf12SJens Wiklander return ERR_PTR(-EINVAL);
430967c9ccaSJens Wiklander if (offs >= shm->size)
431967c9ccaSJens Wiklander return ERR_PTR(-EINVAL);
432967c9ccaSJens Wiklander return (char *)shm->kaddr + offs;
433967c9ccaSJens Wiklander }
434967c9ccaSJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_get_va);
435967c9ccaSJens Wiklander
436967c9ccaSJens Wiklander /**
437967c9ccaSJens Wiklander * tee_shm_get_pa() - Get physical address of a shared memory plus an offset
438967c9ccaSJens Wiklander * @shm: Shared memory handle
439967c9ccaSJens Wiklander * @offs: Offset from start of this shared memory
440967c9ccaSJens Wiklander * @pa: Physical address to return
441967c9ccaSJens Wiklander * @returns 0 if offs is within the bounds of this shared memory, else an
442967c9ccaSJens Wiklander * error code.
443967c9ccaSJens Wiklander */
tee_shm_get_pa(struct tee_shm * shm,size_t offs,phys_addr_t * pa)444967c9ccaSJens Wiklander int tee_shm_get_pa(struct tee_shm *shm, size_t offs, phys_addr_t *pa)
445967c9ccaSJens Wiklander {
446967c9ccaSJens Wiklander if (offs >= shm->size)
447967c9ccaSJens Wiklander return -EINVAL;
448967c9ccaSJens Wiklander if (pa)
449967c9ccaSJens Wiklander *pa = shm->paddr + offs;
450967c9ccaSJens Wiklander return 0;
451967c9ccaSJens Wiklander }
452967c9ccaSJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_get_pa);
453967c9ccaSJens Wiklander
454967c9ccaSJens Wiklander /**
455967c9ccaSJens Wiklander * tee_shm_get_from_id() - Find shared memory object and increase reference
456967c9ccaSJens Wiklander * count
457967c9ccaSJens Wiklander * @ctx: Context owning the shared memory
458967c9ccaSJens Wiklander * @id: Id of shared memory object
459967c9ccaSJens Wiklander * @returns a pointer to 'struct tee_shm' on success or an ERR_PTR on failure
460967c9ccaSJens Wiklander */
tee_shm_get_from_id(struct tee_context * ctx,int id)461967c9ccaSJens Wiklander struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id)
462967c9ccaSJens Wiklander {
463967c9ccaSJens Wiklander struct tee_device *teedev;
464967c9ccaSJens Wiklander struct tee_shm *shm;
465967c9ccaSJens Wiklander
466967c9ccaSJens Wiklander if (!ctx)
467967c9ccaSJens Wiklander return ERR_PTR(-EINVAL);
468967c9ccaSJens Wiklander
469967c9ccaSJens Wiklander teedev = ctx->teedev;
470967c9ccaSJens Wiklander mutex_lock(&teedev->mutex);
471967c9ccaSJens Wiklander shm = idr_find(&teedev->idr, id);
472dfd0743fSJens Wiklander /*
473dfd0743fSJens Wiklander * If the tee_shm was found in the IDR it must have a refcount
474dfd0743fSJens Wiklander * larger than 0 due to the guarantee in tee_shm_put() below. So
475dfd0743fSJens Wiklander * it's safe to use refcount_inc().
476dfd0743fSJens Wiklander */
477967c9ccaSJens Wiklander if (!shm || shm->ctx != ctx)
478967c9ccaSJens Wiklander shm = ERR_PTR(-EINVAL);
479dfd0743fSJens Wiklander else
480dfd0743fSJens Wiklander refcount_inc(&shm->refcount);
481967c9ccaSJens Wiklander mutex_unlock(&teedev->mutex);
482967c9ccaSJens Wiklander return shm;
483967c9ccaSJens Wiklander }
484967c9ccaSJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
485967c9ccaSJens Wiklander
486967c9ccaSJens Wiklander /**
487967c9ccaSJens Wiklander * tee_shm_put() - Decrease reference count on a shared memory handle
488967c9ccaSJens Wiklander * @shm: Shared memory handle
489967c9ccaSJens Wiklander */
tee_shm_put(struct tee_shm * shm)490967c9ccaSJens Wiklander void tee_shm_put(struct tee_shm *shm)
491967c9ccaSJens Wiklander {
492dfd0743fSJens Wiklander struct tee_device *teedev = shm->ctx->teedev;
493dfd0743fSJens Wiklander bool do_release = false;
494dfd0743fSJens Wiklander
495dfd0743fSJens Wiklander mutex_lock(&teedev->mutex);
496dfd0743fSJens Wiklander if (refcount_dec_and_test(&shm->refcount)) {
497dfd0743fSJens Wiklander /*
498dfd0743fSJens Wiklander * refcount has reached 0, we must now remove it from the
499dfd0743fSJens Wiklander * IDR before releasing the mutex. This will guarantee that
500dfd0743fSJens Wiklander * the refcount_inc() in tee_shm_get_from_id() never starts
501dfd0743fSJens Wiklander * from 0.
502dfd0743fSJens Wiklander */
503a45ea4efSJens Wiklander if (shm->id >= 0)
504dfd0743fSJens Wiklander idr_remove(&teedev->idr, shm->id);
505dfd0743fSJens Wiklander do_release = true;
506dfd0743fSJens Wiklander }
507dfd0743fSJens Wiklander mutex_unlock(&teedev->mutex);
508dfd0743fSJens Wiklander
509dfd0743fSJens Wiklander if (do_release)
510dfd0743fSJens Wiklander tee_shm_release(teedev, shm);
511967c9ccaSJens Wiklander }
512967c9ccaSJens Wiklander EXPORT_SYMBOL_GPL(tee_shm_put);
513