// SPDX-License-Identifier: GPL-2.0-only/* * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. */ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt #include <linux/firmware/qcom/qcom_scm.h>#include <linux/mm.h> #include "qcomtee.h" /** * DOC: Memory and Mapping Objects * * QTEE uses memory objects for memory sharing with Linux. * A memory object can be a standard dma_buf or a contiguous memory range, * e.g., tee_shm. A memory object should support one operation: map. When * invoked by QTEE, a mapping object is generated. A mapping object supports * one operation: unmap. * *  (1) To map a memory object, QTEE invokes the primordial object with *      %QCOMTEE_OBJECT_OP_MAP_REGION operation; see *      qcomtee_primordial_obj_dispatch(). *  (2) To unmap a memory object, QTEE releases the mapping object which *      calls qcomtee_mem_object_release(). * * The map operation is implemented in the primordial object as a privileged * operation instead of qcomtee_mem_object_dispatch(). Otherwise, on * platforms without shm_bridge, a user can trick QTEE into writing to the * kernel memory by passing a user object as a memory object and returning a * random physical address as the result of the mapping request. */ struct qcomtee_mem_object {	struct qcomtee_object object;	struct tee_shm *shm;	/* QTEE requires these felids to be page aligned. */	phys_addr_t paddr; /* Physical address of range. */	size_t size; /* Size of the range. */}; #define to_qcomtee_mem_object(o) \	container_of((o), struct qcomtee_mem_object, object) static struct qcomtee_object_operations qcomtee_mem_object_ops; /* Is it a memory object using tee_shm? */int is_qcomtee_memobj_object(struct qcomtee_object *object){	return object != NULL_QCOMTEE_OBJECT &&	       typeof_qcomtee_object(object) == QCOMTEE_OBJECT_TYPE_CB &&	       object->ops == &qcomtee_mem_object_ops;} static int qcomtee_mem_object_dispatch(struct qcomtee_object_invoke_ctx *oic,				       struct qcomtee_object *object, u32 op,				       struct qcomtee_arg *args){	return -EINVAL;} static void qcomtee_mem_object_release(struct qcomtee_object *object){	struct qcomtee_mem_object *mem_object = to_qcomtee_mem_object(object); 	/* Matching get is in qcomtee_memobj_param_to_object(). */	tee_shm_put(mem_object->shm);	kfree(mem_object);} static struct qcomtee_object_operations qcomtee_mem_object_ops = {	.release = qcomtee_mem_object_release,	.dispatch = qcomtee_mem_object_dispatch,}; /** * qcomtee_memobj_param_to_object() - OBJREF parameter to &struct qcomtee_object. * @object: object returned. * @param: TEE parameter. * @ctx: context in which the conversion should happen. * * @param is an OBJREF with %QCOMTEE_OBJREF_FLAG_MEM flags. * * Return: On success return 0 or <0 on failure. */int qcomtee_memobj_param_to_object(struct qcomtee_object **object,				   struct tee_param *param,				   struct tee_context *ctx){	struct tee_shm *shm;	int err; 	struct qcomtee_mem_object *mem_object __free(kfree) = kzalloc_obj(*mem_object);	if (!mem_object)		return -ENOMEM; 	shm = tee_shm_get_from_id(ctx, param->u.objref.id);	if (IS_ERR(shm))		return PTR_ERR(shm); 	/* mem-object wrapping the memref. */	err = qcomtee_object_user_init(&mem_object->object,				       QCOMTEE_OBJECT_TYPE_CB,				       &qcomtee_mem_object_ops, "tee-shm-%d",				       shm->id);	if (err) {		tee_shm_put(shm); 		return err;	} 	mem_object->paddr = shm->paddr;	mem_object->size = shm->size;	mem_object->shm = shm; 	*object = &no_free_ptr(mem_object)->object; 	return 0;} /* Reverse what qcomtee_memobj_param_to_object() does. */int qcomtee_memobj_param_from_object(struct tee_param *param,				     struct qcomtee_object *object,				     struct tee_context *ctx){	struct qcomtee_mem_object *mem_object; 	mem_object = to_qcomtee_mem_object(object);	/* Sure if the memobj is in a same context it is originated from. */	if (mem_object->shm->ctx != ctx)		return -EINVAL; 	param->u.objref.id = mem_object->shm->id;	param->u.objref.flags = QCOMTEE_OBJREF_FLAG_MEM; 	/* Passing shm->id to userspace; drop the reference. */	qcomtee_object_put(object); 	return 0;} /** * qcomtee_mem_object_map() - Map a memory object. * @object: memory object. * @map_object: created mapping object. * @mem_paddr: physical address of the memory. * @mem_size: size of the memory. * @perms: QTEE access permissions. * * Return: On success return 0 or <0 on failure. */int qcomtee_mem_object_map(struct qcomtee_object *object,			   struct qcomtee_object **map_object, u64 *mem_paddr,			   u64 *mem_size, u32 *perms){	struct qcomtee_mem_object *mem_object = to_qcomtee_mem_object(object); 	/* Reuses the memory object as a mapping object by re-sharing it. */	qcomtee_object_get(&mem_object->object); 	*map_object = &mem_object->object;	*mem_paddr = mem_object->paddr;	*mem_size = mem_object->size;	*perms = QCOM_SCM_PERM_RW; 	return 0;}