Commit 0461a1ae authored by Arnd Bergmann's avatar Arnd Bergmann
Browse files

Merge tag 'amdtee-fixes-for-5.10' of...

Merge tag 'amdtee-fixes-for-5.10' of git://git.linaro.org:/people/jens.wiklander/linux-tee into arm/fixes

AMD-TEE driver bug fixes

AMD-TEE driver keeps track of shared memory buffers and their
corresponding buffer id's in a global linked list. These buffers are
used to share data between x86 and AMD Secure Processor. This pull
request fixes issues related to maintaining mapped buffers in a shared
linked list.

* tag 'amdtee-fixes-for-5.10' of git://git.linaro.org:/people/jens.wiklander/linux-tee:
  tee: amdtee: synchronize access to shm list
  tee: amdtee: fix memory leak due to reset of global shm list

Link: https://lore.kernel.org/r/20201109080809.GA3862873@jade


Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
parents 53bf2776 be353be2
Loading
Loading
Loading
Loading
+4 −4
Original line number Diff line number Diff line
@@ -64,9 +64,13 @@ struct amdtee_session {
/**
 * struct amdtee_context_data - AMD-TEE driver context data
 * @sess_list:    Keeps track of sessions opened in current TEE context
 * @shm_list:     Keeps track of buffers allocated and mapped in current TEE
 *                context
 */
struct amdtee_context_data {
	struct list_head sess_list;
	struct list_head shm_list;
	struct mutex shm_mutex;   /* synchronizes access to @shm_list */
};

struct amdtee_driver_data {
@@ -89,10 +93,6 @@ struct amdtee_shm_data {
	u32     buf_id;
};

struct amdtee_shm_context {
	struct list_head shmdata_list;
};

#define LOWER_TWO_BYTE_MASK	0x0000FFFF

/**
+19 −7
Original line number Diff line number Diff line
@@ -20,7 +20,6 @@

static struct amdtee_driver_data *drv_data;
static DEFINE_MUTEX(session_list_mutex);
static struct amdtee_shm_context shmctx;

static void amdtee_get_version(struct tee_device *teedev,
			       struct tee_ioctl_version_data *vers)
@@ -42,7 +41,8 @@ static int amdtee_open(struct tee_context *ctx)
		return -ENOMEM;

	INIT_LIST_HEAD(&ctxdata->sess_list);
	INIT_LIST_HEAD(&shmctx.shmdata_list);
	INIT_LIST_HEAD(&ctxdata->shm_list);
	mutex_init(&ctxdata->shm_mutex);

	ctx->data = ctxdata;
	return 0;
@@ -86,6 +86,7 @@ static void amdtee_release(struct tee_context *ctx)
		list_del(&sess->list_node);
		release_session(sess);
	}
	mutex_destroy(&ctxdata->shm_mutex);
	kfree(ctxdata);

	ctx->data = NULL;
@@ -152,14 +153,17 @@ static struct amdtee_session *find_session(struct amdtee_context_data *ctxdata,

u32 get_buffer_id(struct tee_shm *shm)
{
	u32 buf_id = 0;
	struct amdtee_context_data *ctxdata = shm->ctx->data;
	struct amdtee_shm_data *shmdata;
	u32 buf_id = 0;

	list_for_each_entry(shmdata, &shmctx.shmdata_list, shm_node)
	mutex_lock(&ctxdata->shm_mutex);
	list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node)
		if (shmdata->kaddr == shm->kaddr) {
			buf_id = shmdata->buf_id;
			break;
		}
	mutex_unlock(&ctxdata->shm_mutex);

	return buf_id;
}
@@ -333,8 +337,9 @@ int amdtee_close_session(struct tee_context *ctx, u32 session)

int amdtee_map_shmem(struct tee_shm *shm)
{
	struct shmem_desc shmem;
	struct amdtee_context_data *ctxdata;
	struct amdtee_shm_data *shmnode;
	struct shmem_desc shmem;
	int rc, count;
	u32 buf_id;

@@ -362,7 +367,10 @@ int amdtee_map_shmem(struct tee_shm *shm)

	shmnode->kaddr = shm->kaddr;
	shmnode->buf_id = buf_id;
	list_add(&shmnode->shm_node, &shmctx.shmdata_list);
	ctxdata = shm->ctx->data;
	mutex_lock(&ctxdata->shm_mutex);
	list_add(&shmnode->shm_node, &ctxdata->shm_list);
	mutex_unlock(&ctxdata->shm_mutex);

	pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr);

@@ -371,6 +379,7 @@ int amdtee_map_shmem(struct tee_shm *shm)

void amdtee_unmap_shmem(struct tee_shm *shm)
{
	struct amdtee_context_data *ctxdata;
	struct amdtee_shm_data *shmnode;
	u32 buf_id;

@@ -381,12 +390,15 @@ void amdtee_unmap_shmem(struct tee_shm *shm)
	/* Unmap the shared memory from TEE */
	handle_unmap_shmem(buf_id);

	list_for_each_entry(shmnode, &shmctx.shmdata_list, shm_node)
	ctxdata = shm->ctx->data;
	mutex_lock(&ctxdata->shm_mutex);
	list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node)
		if (buf_id == shmnode->buf_id) {
			list_del(&shmnode->shm_node);
			kfree(shmnode);
			break;
		}
	mutex_unlock(&ctxdata->shm_mutex);
}

int amdtee_invoke_func(struct tee_context *ctx,