1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
4 */
5
6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7
8 #include <linux/firmware/qcom/qcom_scm.h>
9 #include <linux/mm.h>
10
11 #include "qcomtee.h"
12
13 /**
14 * DOC: Memory and Mapping Objects
15 *
16 * QTEE uses memory objects for memory sharing with Linux.
17 * A memory object can be a standard dma_buf or a contiguous memory range,
18 * e.g., tee_shm. A memory object should support one operation: map. When
19 * invoked by QTEE, a mapping object is generated. A mapping object supports
20 * one operation: unmap.
21 *
22 * (1) To map a memory object, QTEE invokes the primordial object with
23 * %QCOMTEE_OBJECT_OP_MAP_REGION operation; see
24 * qcomtee_primordial_obj_dispatch().
25 * (2) To unmap a memory object, QTEE releases the mapping object which
26 * calls qcomtee_mem_object_release().
27 *
28 * The map operation is implemented in the primordial object as a privileged
29 * operation instead of qcomtee_mem_object_dispatch(). Otherwise, on
30 * platforms without shm_bridge, a user can trick QTEE into writing to the
31 * kernel memory by passing a user object as a memory object and returning a
32 * random physical address as the result of the mapping request.
33 */
34
35 struct qcomtee_mem_object {
36 struct qcomtee_object object;
37 struct tee_shm *shm;
38 /* QTEE requires these felids to be page aligned. */
39 phys_addr_t paddr; /* Physical address of range. */
40 size_t size; /* Size of the range. */
41 };
42
43 #define to_qcomtee_mem_object(o) \
44 container_of((o), struct qcomtee_mem_object, object)
45
46 static struct qcomtee_object_operations qcomtee_mem_object_ops;
47
48 /* Is it a memory object using tee_shm? */
is_qcomtee_memobj_object(struct qcomtee_object * object)49 int is_qcomtee_memobj_object(struct qcomtee_object *object)
50 {
51 return object != NULL_QCOMTEE_OBJECT &&
52 typeof_qcomtee_object(object) == QCOMTEE_OBJECT_TYPE_CB &&
53 object->ops == &qcomtee_mem_object_ops;
54 }
55
qcomtee_mem_object_dispatch(struct qcomtee_object_invoke_ctx * oic,struct qcomtee_object * object,u32 op,struct qcomtee_arg * args)56 static int qcomtee_mem_object_dispatch(struct qcomtee_object_invoke_ctx *oic,
57 struct qcomtee_object *object, u32 op,
58 struct qcomtee_arg *args)
59 {
60 return -EINVAL;
61 }
62
qcomtee_mem_object_release(struct qcomtee_object * object)63 static void qcomtee_mem_object_release(struct qcomtee_object *object)
64 {
65 struct qcomtee_mem_object *mem_object = to_qcomtee_mem_object(object);
66
67 /* Matching get is in qcomtee_memobj_param_to_object(). */
68 tee_shm_put(mem_object->shm);
69 kfree(mem_object);
70 }
71
72 static struct qcomtee_object_operations qcomtee_mem_object_ops = {
73 .release = qcomtee_mem_object_release,
74 .dispatch = qcomtee_mem_object_dispatch,
75 };
76
77 /**
78 * qcomtee_memobj_param_to_object() - OBJREF parameter to &struct qcomtee_object.
79 * @object: object returned.
80 * @param: TEE parameter.
81 * @ctx: context in which the conversion should happen.
82 *
83 * @param is an OBJREF with %QCOMTEE_OBJREF_FLAG_MEM flags.
84 *
85 * Return: On success return 0 or <0 on failure.
86 */
qcomtee_memobj_param_to_object(struct qcomtee_object ** object,struct tee_param * param,struct tee_context * ctx)87 int qcomtee_memobj_param_to_object(struct qcomtee_object **object,
88 struct tee_param *param,
89 struct tee_context *ctx)
90 {
91 struct tee_shm *shm;
92 int err;
93
94 struct qcomtee_mem_object *mem_object __free(kfree) = kzalloc_obj(*mem_object);
95 if (!mem_object)
96 return -ENOMEM;
97
98 shm = tee_shm_get_from_id(ctx, param->u.objref.id);
99 if (IS_ERR(shm))
100 return PTR_ERR(shm);
101
102 /* mem-object wrapping the memref. */
103 err = qcomtee_object_user_init(&mem_object->object,
104 QCOMTEE_OBJECT_TYPE_CB,
105 &qcomtee_mem_object_ops, "tee-shm-%d",
106 shm->id);
107 if (err) {
108 tee_shm_put(shm);
109
110 return err;
111 }
112
113 mem_object->paddr = shm->paddr;
114 mem_object->size = shm->size;
115 mem_object->shm = shm;
116
117 *object = &no_free_ptr(mem_object)->object;
118
119 return 0;
120 }
121
122 /* Reverse what qcomtee_memobj_param_to_object() does. */
qcomtee_memobj_param_from_object(struct tee_param * param,struct qcomtee_object * object,struct tee_context * ctx)123 int qcomtee_memobj_param_from_object(struct tee_param *param,
124 struct qcomtee_object *object,
125 struct tee_context *ctx)
126 {
127 struct qcomtee_mem_object *mem_object;
128
129 mem_object = to_qcomtee_mem_object(object);
130 /* Sure if the memobj is in a same context it is originated from. */
131 if (mem_object->shm->ctx != ctx)
132 return -EINVAL;
133
134 param->u.objref.id = mem_object->shm->id;
135 param->u.objref.flags = QCOMTEE_OBJREF_FLAG_MEM;
136
137 /* Passing shm->id to userspace; drop the reference. */
138 qcomtee_object_put(object);
139
140 return 0;
141 }
142
143 /**
144 * qcomtee_mem_object_map() - Map a memory object.
145 * @object: memory object.
146 * @map_object: created mapping object.
147 * @mem_paddr: physical address of the memory.
148 * @mem_size: size of the memory.
149 * @perms: QTEE access permissions.
150 *
151 * Return: On success return 0 or <0 on failure.
152 */
qcomtee_mem_object_map(struct qcomtee_object * object,struct qcomtee_object ** map_object,u64 * mem_paddr,u64 * mem_size,u32 * perms)153 int qcomtee_mem_object_map(struct qcomtee_object *object,
154 struct qcomtee_object **map_object, u64 *mem_paddr,
155 u64 *mem_size, u32 *perms)
156 {
157 struct qcomtee_mem_object *mem_object = to_qcomtee_mem_object(object);
158
159 /* Reuses the memory object as a mapping object by re-sharing it. */
160 qcomtee_object_get(&mem_object->object);
161
162 *map_object = &mem_object->object;
163 *mem_paddr = mem_object->paddr;
164 *mem_size = mem_object->size;
165 *perms = QCOM_SCM_PERM_RW;
166
167 return 0;
168 }
169