2 * Copyright (c) 2015-2016, Linaro Limited
4 * This software is licensed under the terms of the GNU General Public
5 * License version 2, as published by the Free Software Foundation, and
6 * may be copied, distributed, and modified under those terms.
8 * This program is distributed in the hope that it will be useful,
9 * but WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
11 * GNU General Public License for more details.
14 #include <linux/device.h>
15 #include <linux/dma-buf.h>
16 #include <linux/fdtable.h>
17 #include <linux/idr.h>
18 #include <linux/sched.h>
19 #include <linux/slab.h>
20 #include <linux/tee_drv.h>
21 #include "tee_private.h"
23 static void tee_shm_release(struct tee_shm
*shm
)
25 struct tee_device
*teedev
= shm
->teedev
;
27 mutex_lock(&teedev
->mutex
);
28 idr_remove(&teedev
->idr
, shm
->id
);
31 mutex_unlock(&teedev
->mutex
);
33 if (shm
->flags
& TEE_SHM_POOL
) {
34 struct tee_shm_pool_mgr
*poolm
;
36 if (shm
->flags
& TEE_SHM_DMA_BUF
)
37 poolm
= teedev
->pool
->dma_buf_mgr
;
39 poolm
= teedev
->pool
->private_mgr
;
41 poolm
->ops
->free(poolm
, shm
);
42 } else if (shm
->flags
& TEE_SHM_REGISTER
) {
44 int rc
= teedev
->desc
->ops
->shm_unregister(shm
->ctx
, shm
);
47 dev_err(teedev
->dev
.parent
,
48 "unregister shm %p failed: %d", shm
, rc
);
50 for (n
= 0; n
< shm
->num_pages
; n
++)
51 put_page(shm
->pages
[n
]);
57 teedev_ctx_put(shm
->ctx
);
61 tee_device_put(teedev
);
64 static struct sg_table
*tee_shm_op_map_dma_buf(struct dma_buf_attachment
65 *attach
, enum dma_data_direction dir
)
70 static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment
*attach
,
71 struct sg_table
*table
,
72 enum dma_data_direction dir
)
76 static void tee_shm_op_release(struct dma_buf
*dmabuf
)
78 struct tee_shm
*shm
= dmabuf
->priv
;
83 static void *tee_shm_op_map(struct dma_buf
*dmabuf
, unsigned long pgnum
)
88 static int tee_shm_op_mmap(struct dma_buf
*dmabuf
, struct vm_area_struct
*vma
)
90 struct tee_shm
*shm
= dmabuf
->priv
;
91 size_t size
= vma
->vm_end
- vma
->vm_start
;
93 /* Refuse sharing shared memory provided by application */
94 if (shm
->flags
& TEE_SHM_REGISTER
)
97 return remap_pfn_range(vma
, vma
->vm_start
, shm
->paddr
>> PAGE_SHIFT
,
98 size
, vma
->vm_page_prot
);
101 static const struct dma_buf_ops tee_shm_dma_buf_ops
= {
102 .map_dma_buf
= tee_shm_op_map_dma_buf
,
103 .unmap_dma_buf
= tee_shm_op_unmap_dma_buf
,
104 .release
= tee_shm_op_release
,
105 .map
= tee_shm_op_map
,
106 .mmap
= tee_shm_op_mmap
,
109 static struct tee_shm
*__tee_shm_alloc(struct tee_context
*ctx
,
110 struct tee_device
*teedev
,
111 size_t size
, u32 flags
)
113 struct tee_shm_pool_mgr
*poolm
= NULL
;
118 if (ctx
&& ctx
->teedev
!= teedev
) {
119 dev_err(teedev
->dev
.parent
, "ctx and teedev mismatch\n");
120 return ERR_PTR(-EINVAL
);
123 if (!(flags
& TEE_SHM_MAPPED
)) {
124 dev_err(teedev
->dev
.parent
,
125 "only mapped allocations supported\n");
126 return ERR_PTR(-EINVAL
);
129 if ((flags
& ~(TEE_SHM_MAPPED
| TEE_SHM_DMA_BUF
))) {
130 dev_err(teedev
->dev
.parent
, "invalid shm flags 0x%x", flags
);
131 return ERR_PTR(-EINVAL
);
134 if (!tee_device_get(teedev
))
135 return ERR_PTR(-EINVAL
);
138 /* teedev has been detached from driver */
139 ret
= ERR_PTR(-EINVAL
);
143 shm
= kzalloc(sizeof(*shm
), GFP_KERNEL
);
145 ret
= ERR_PTR(-ENOMEM
);
149 shm
->flags
= flags
| TEE_SHM_POOL
;
150 shm
->teedev
= teedev
;
152 if (flags
& TEE_SHM_DMA_BUF
)
153 poolm
= teedev
->pool
->dma_buf_mgr
;
155 poolm
= teedev
->pool
->private_mgr
;
157 rc
= poolm
->ops
->alloc(poolm
, shm
, size
);
163 mutex_lock(&teedev
->mutex
);
164 shm
->id
= idr_alloc(&teedev
->idr
, shm
, 1, 0, GFP_KERNEL
);
165 mutex_unlock(&teedev
->mutex
);
167 ret
= ERR_PTR(shm
->id
);
171 if (flags
& TEE_SHM_DMA_BUF
) {
172 DEFINE_DMA_BUF_EXPORT_INFO(exp_info
);
174 exp_info
.ops
= &tee_shm_dma_buf_ops
;
175 exp_info
.size
= shm
->size
;
176 exp_info
.flags
= O_RDWR
;
179 shm
->dmabuf
= dma_buf_export(&exp_info
);
180 if (IS_ERR(shm
->dmabuf
)) {
181 ret
= ERR_CAST(shm
->dmabuf
);
188 mutex_lock(&teedev
->mutex
);
189 list_add_tail(&shm
->link
, &ctx
->list_shm
);
190 mutex_unlock(&teedev
->mutex
);
195 mutex_lock(&teedev
->mutex
);
196 idr_remove(&teedev
->idr
, shm
->id
);
197 mutex_unlock(&teedev
->mutex
);
199 poolm
->ops
->free(poolm
, shm
);
203 tee_device_put(teedev
);
208 * tee_shm_alloc() - Allocate shared memory
209 * @ctx: Context that allocates the shared memory
210 * @size: Requested size of shared memory
211 * @flags: Flags setting properties for the requested shared memory.
213 * Memory allocated as global shared memory is automatically freed when the
214 * TEE file pointer is closed. The @flags field uses the bits defined by
215 * TEE_SHM_* in <linux/tee_drv.h>. TEE_SHM_MAPPED must currently always be
216 * set. If TEE_SHM_DMA_BUF global shared memory will be allocated and
217 * associated with a dma-buf handle, else driver private memory.
219 struct tee_shm
*tee_shm_alloc(struct tee_context
*ctx
, size_t size
, u32 flags
)
221 return __tee_shm_alloc(ctx
, ctx
->teedev
, size
, flags
);
223 EXPORT_SYMBOL_GPL(tee_shm_alloc
);
225 struct tee_shm
*tee_shm_priv_alloc(struct tee_device
*teedev
, size_t size
)
227 return __tee_shm_alloc(NULL
, teedev
, size
, TEE_SHM_MAPPED
);
229 EXPORT_SYMBOL_GPL(tee_shm_priv_alloc
);
231 struct tee_shm
*tee_shm_register(struct tee_context
*ctx
, unsigned long addr
,
232 size_t length
, u32 flags
)
234 struct tee_device
*teedev
= ctx
->teedev
;
235 const u32 req_flags
= TEE_SHM_DMA_BUF
| TEE_SHM_USER_MAPPED
;
242 if (flags
!= req_flags
)
243 return ERR_PTR(-ENOTSUPP
);
245 if (!tee_device_get(teedev
))
246 return ERR_PTR(-EINVAL
);
248 if (!teedev
->desc
->ops
->shm_register
||
249 !teedev
->desc
->ops
->shm_unregister
) {
250 tee_device_put(teedev
);
251 return ERR_PTR(-ENOTSUPP
);
256 shm
= kzalloc(sizeof(*shm
), GFP_KERNEL
);
258 ret
= ERR_PTR(-ENOMEM
);
262 shm
->flags
= flags
| TEE_SHM_REGISTER
;
263 shm
->teedev
= teedev
;
266 start
= rounddown(addr
, PAGE_SIZE
);
267 shm
->offset
= addr
- start
;
269 num_pages
= (roundup(addr
+ length
, PAGE_SIZE
) - start
) / PAGE_SIZE
;
270 shm
->pages
= kcalloc(num_pages
, sizeof(*shm
->pages
), GFP_KERNEL
);
272 ret
= ERR_PTR(-ENOMEM
);
276 rc
= get_user_pages_fast(start
, num_pages
, 1, shm
->pages
);
279 if (rc
!= num_pages
) {
286 mutex_lock(&teedev
->mutex
);
287 shm
->id
= idr_alloc(&teedev
->idr
, shm
, 1, 0, GFP_KERNEL
);
288 mutex_unlock(&teedev
->mutex
);
291 ret
= ERR_PTR(shm
->id
);
295 rc
= teedev
->desc
->ops
->shm_register(ctx
, shm
, shm
->pages
,
296 shm
->num_pages
, start
);
302 if (flags
& TEE_SHM_DMA_BUF
) {
303 DEFINE_DMA_BUF_EXPORT_INFO(exp_info
);
305 exp_info
.ops
= &tee_shm_dma_buf_ops
;
306 exp_info
.size
= shm
->size
;
307 exp_info
.flags
= O_RDWR
;
310 shm
->dmabuf
= dma_buf_export(&exp_info
);
311 if (IS_ERR(shm
->dmabuf
)) {
312 ret
= ERR_CAST(shm
->dmabuf
);
313 teedev
->desc
->ops
->shm_unregister(ctx
, shm
);
318 mutex_lock(&teedev
->mutex
);
319 list_add_tail(&shm
->link
, &ctx
->list_shm
);
320 mutex_unlock(&teedev
->mutex
);
328 mutex_lock(&teedev
->mutex
);
329 idr_remove(&teedev
->idr
, shm
->id
);
330 mutex_unlock(&teedev
->mutex
);
333 for (n
= 0; n
< shm
->num_pages
; n
++)
334 put_page(shm
->pages
[n
]);
340 tee_device_put(teedev
);
343 EXPORT_SYMBOL_GPL(tee_shm_register
);
346 * tee_shm_get_fd() - Increase reference count and return file descriptor
347 * @shm: Shared memory handle
348 * @returns user space file descriptor to shared memory
350 int tee_shm_get_fd(struct tee_shm
*shm
)
354 if (!(shm
->flags
& TEE_SHM_DMA_BUF
))
357 get_dma_buf(shm
->dmabuf
);
358 fd
= dma_buf_fd(shm
->dmabuf
, O_CLOEXEC
);
360 dma_buf_put(shm
->dmabuf
);
365 * tee_shm_free() - Free shared memory
366 * @shm: Handle to shared memory to free
368 void tee_shm_free(struct tee_shm
*shm
)
371 * dma_buf_put() decreases the dmabuf reference counter and will
372 * call tee_shm_release() when the last reference is gone.
374 * In the case of driver private memory we call tee_shm_release
375 * directly instead as it doesn't have a reference counter.
377 if (shm
->flags
& TEE_SHM_DMA_BUF
)
378 dma_buf_put(shm
->dmabuf
);
380 tee_shm_release(shm
);
382 EXPORT_SYMBOL_GPL(tee_shm_free
);
385 * tee_shm_va2pa() - Get physical address of a virtual address
386 * @shm: Shared memory handle
387 * @va: Virtual address to tranlsate
388 * @pa: Returned physical address
389 * @returns 0 on success and < 0 on failure
391 int tee_shm_va2pa(struct tee_shm
*shm
, void *va
, phys_addr_t
*pa
)
393 if (!(shm
->flags
& TEE_SHM_MAPPED
))
395 /* Check that we're in the range of the shm */
396 if ((char *)va
< (char *)shm
->kaddr
)
398 if ((char *)va
>= ((char *)shm
->kaddr
+ shm
->size
))
401 return tee_shm_get_pa(
402 shm
, (unsigned long)va
- (unsigned long)shm
->kaddr
, pa
);
404 EXPORT_SYMBOL_GPL(tee_shm_va2pa
);
407 * tee_shm_pa2va() - Get virtual address of a physical address
408 * @shm: Shared memory handle
409 * @pa: Physical address to tranlsate
410 * @va: Returned virtual address
411 * @returns 0 on success and < 0 on failure
413 int tee_shm_pa2va(struct tee_shm
*shm
, phys_addr_t pa
, void **va
)
415 if (!(shm
->flags
& TEE_SHM_MAPPED
))
417 /* Check that we're in the range of the shm */
420 if (pa
>= (shm
->paddr
+ shm
->size
))
424 void *v
= tee_shm_get_va(shm
, pa
- shm
->paddr
);
432 EXPORT_SYMBOL_GPL(tee_shm_pa2va
);
435 * tee_shm_get_va() - Get virtual address of a shared memory plus an offset
436 * @shm: Shared memory handle
437 * @offs: Offset from start of this shared memory
438 * @returns virtual address of the shared memory + offs if offs is within
439 * the bounds of this shared memory, else an ERR_PTR
441 void *tee_shm_get_va(struct tee_shm
*shm
, size_t offs
)
443 if (!(shm
->flags
& TEE_SHM_MAPPED
))
444 return ERR_PTR(-EINVAL
);
445 if (offs
>= shm
->size
)
446 return ERR_PTR(-EINVAL
);
447 return (char *)shm
->kaddr
+ offs
;
449 EXPORT_SYMBOL_GPL(tee_shm_get_va
);
452 * tee_shm_get_pa() - Get physical address of a shared memory plus an offset
453 * @shm: Shared memory handle
454 * @offs: Offset from start of this shared memory
455 * @pa: Physical address to return
456 * @returns 0 if offs is within the bounds of this shared memory, else an
459 int tee_shm_get_pa(struct tee_shm
*shm
, size_t offs
, phys_addr_t
*pa
)
461 if (offs
>= shm
->size
)
464 *pa
= shm
->paddr
+ offs
;
467 EXPORT_SYMBOL_GPL(tee_shm_get_pa
);
470 * tee_shm_get_from_id() - Find shared memory object and increase reference
472 * @ctx: Context owning the shared memory
473 * @id: Id of shared memory object
474 * @returns a pointer to 'struct tee_shm' on success or an ERR_PTR on failure
476 struct tee_shm
*tee_shm_get_from_id(struct tee_context
*ctx
, int id
)
478 struct tee_device
*teedev
;
482 return ERR_PTR(-EINVAL
);
484 teedev
= ctx
->teedev
;
485 mutex_lock(&teedev
->mutex
);
486 shm
= idr_find(&teedev
->idr
, id
);
487 if (!shm
|| shm
->ctx
!= ctx
)
488 shm
= ERR_PTR(-EINVAL
);
489 else if (shm
->flags
& TEE_SHM_DMA_BUF
)
490 get_dma_buf(shm
->dmabuf
);
491 mutex_unlock(&teedev
->mutex
);
494 EXPORT_SYMBOL_GPL(tee_shm_get_from_id
);
497 * tee_shm_put() - Decrease reference count on a shared memory handle
498 * @shm: Shared memory handle
500 void tee_shm_put(struct tee_shm
*shm
)
502 if (shm
->flags
& TEE_SHM_DMA_BUF
)
503 dma_buf_put(shm
->dmabuf
);
505 EXPORT_SYMBOL_GPL(tee_shm_put
);