Linux kernel stable tree https://git.rulkc.org/pub/scm/linux/kernel/git/stable/linux.git/atom?h=linux-5.16.y 2022-02-23T11:05:54+00:00 2022-02-23T11:05:54+00:00 Jens Wiklander jens.wiklander@linaro.org 2022-01-27T14:29:39+00:00 urn:sha1:f333857e0f857d69aea6c1fb49fbfb7cfdb69b1b commit aceeafefff736057e8f93f19bbfbef26abd94604 upstream. Adds a driver private tee_context by moving the tee_context in struct optee_notif to struct optee. This tee_context was previously used when doing internal calls to secure world to deliver notification. The new driver internal tee_context is now also when allocating driver private shared memory. This decouples the shared memory object from its original tee_context. This is needed when the life time of such a memory allocation outlives the client tee_context. This patch fixes the problem described below: The addition of a shutdown hook by commit f25889f93184 ("optee: fix tee out of memory failure seen during kexec reboot") introduced a kernel shutdown regression that can be triggered after running the OP-TEE xtest suites. Once the shutdown hook is called it is not possible to communicate any more with the supplicant process because the system is not scheduling task any longer. Thus if the optee driver shutdown path receives a supplicant RPC request from the OP-TEE we will deadlock the kernel's shutdown. Fixes: f25889f93184 ("optee: fix tee out of memory failure seen during kexec reboot") Fixes: 217e0250cccb ("tee: use reference counting for tee_context") Reported-by: Lars Persson <larper@axis.com> Cc: stable@vger.kernel.org Reviewed-by: Sumit Garg <sumit.garg@linaro.org> [JW: backport to 5.16-stable + update commit message] Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 2022-02-16T11:58:27+00:00 Jens Wiklander jens.wiklander@linaro.org 2021-12-28T20:25:57+00:00 urn:sha1:7e246eb9c1519666e1330bb1b58c23b6a721498a [ Upstream commit 4064c461148ab129dfe5eaeea129b4af6cf4b9b7 ] Adds error checking in optee_ffa_do_call_with_arg() for correctness. Fixes: 4615e5a34b95 ("optee: add FF-A support") Reviewed-by: Sumit Garg <sumit.garg@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 2022-02-16T11:58:27+00:00 Jerome Forissier jerome@forissier.org 2022-01-13T15:27:13+00:00 urn:sha1:306eb7325a386f8b37d6b477a2a11290c0359cd1 [ Upstream commit abc8dc34d1f6e34ed346c6e3fc554127e421b769 ] Commit c650b8dc7a79 ("tee: optee: do not check memref size on return from Secure World") was mistakenly lost in commit 4602c5842f64 ("optee: refactor driver with internal callbacks"). Remove the unwanted code again. Fixes: 4602c5842f64 ("optee: refactor driver with internal callbacks") Signed-off-by: Jerome Forissier <jerome@forissier.org> Reviewed-by: Sumit Garg <sumit.garg@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org> 2021-12-16T14:32:48+00:00 Xiaolei Wang xiaolei.wang@windriver.com 2021-12-06T12:05:33+00:00 urn:sha1:6add87fdae9bcb1d20b4503df5bd02ce5246cc8b We observed the following kmemleak report: unreferenced object 0xffff000007904500 (size 128): comm "swapper/0", pid 1, jiffies 4294892671 (age 44.036s) hex dump (first 32 bytes): 00 47 90 07 00 00 ff ff 60 00 c0 ff 00 00 00 00 .G......`....... 60 00 80 13 00 80 ff ff a0 00 00 00 00 00 00 00 `............... backtrace: [<000000004c12b1c7>] kmem_cache_alloc+0x1ac/0x2f4 [<000000005d23eb4f>] tee_shm_alloc+0x78/0x230 [<00000000794dd22c>] optee_handle_rpc+0x60/0x6f0 [<00000000d9f7c52d>] optee_do_call_with_arg+0x17c/0x1dc [<00000000c35884da>] optee_open_session+0x128/0x1ec [<000000001748f2ff>] tee_client_open_session+0x28/0x40 [<00000000aecb5389>] optee_enumerate_devices+0x84/0x2a0 [<000000003df18bf1>] optee_probe+0x674/0x6cc [<000000003a4a534a>] platform_drv_probe+0x54/0xb0 [<000000000c51ce7d>] really_probe+0xe4/0x4d0 [<000000002f04c865>] driver_probe_device+0x58/0xc0 [<00000000b485397d>] device_driver_attach+0xc0/0xd0 [<00000000c835f0df>] __driver_attach+0x84/0x124 [<000000008e5a429c>] bus_for_each_dev+0x70/0xc0 [<000000001735e8a8>] driver_attach+0x24/0x30 [<000000006d94b04f>] bus_add_driver+0x104/0x1ec This is not a memory leak because we pass the share memory pointer to secure world and would get it from secure world before releasing it. Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> 2021-12-16T14:32:37+00:00 Sumit Garg sumit.garg@linaro.org 2021-12-16T05:47:25+00:00 urn:sha1:18549bf4b21c739a9def39f27dcac53e27286ab5 Pointer to the allocated pages (struct page *page) has already progressed towards the end of allocation. It is incorrect to perform __free_pages(page, order) using this pointer as we would free any arbitrary pages. Fix this by stop modifying the page pointer. Fixes: ec185dd3ab25 ("optee: Fix memory leak when failing to register shm pages") Cc: stable@vger.kernel.org Reported-by: Patrik Lantz <patrik.lantz@axis.com> Signed-off-by: Sumit Garg <sumit.garg@linaro.org> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> 2021-11-16T13:41:23+00:00 Lv Ruyi lv.ruyi@zte.com.cn 2021-11-04T11:30:47+00:00 urn:sha1:c23ca66a4dadb6f050dc57358bc8d57a747c35bf This patch fixes the following Coccinelle error: drivers/tee/optee/ffa_abi.c: 877: ERROR optee is NULL but dereferenced. If memory allocation fails, optee is null pointer. the code will goto err and release optee. Fixes: 4615e5a34b95 ("optee: add FF-A support") Reported-by: Zeal Robot <zealci@zte.com.cn> Signed-off-by: Lv Ruyi <lv.ruyi@zte.com.cn> Reviewed-by: Sumit Garg <sumit.garg@linaro.org> [jw: removed the redundant braces] Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> 2021-11-02T08:22:48+00:00 Arnd Bergmann arnd@arndb.de 2021-11-02T08:22:46+00:00 urn:sha1:6a03568932b2711c91e1572f08867690b52a18df Fix spell errors in OP-TEE FF-A driver log messages * tag 'optee-ffa-fix-for-v5.16' of git://git.linaro.org/people/jens.wiklander/linux-tee: optee: Fix spelling mistake "reclain" -> "reclaim" Link: https://lore.kernel.org/r/20211028185142.GA2489375@jade Signed-off-by: Arnd Bergmann <arnd@arndb.de> 2021-10-28T09:41:39+00:00 Colin Ian King colin.i.king@googlemail.com 2021-10-23T11:52:09+00:00 urn:sha1:1b73a9e4986a4e9065bacf1e5ab2dfda17b54161 There are spelling mistakes in pr_err error messages. Fix them. Fixes: 4615e5a34b95 ("optee: add FF-A support") Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Reviewed-by: Sumit Garg <sumit.garg@linaro.org> [jw: added a fixes] Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> 2021-10-21T19:35:49+00:00 Jens Wiklander jens.wiklander@linaro.org 2021-10-21T12:55:39+00:00 urn:sha1:34f3c67b817852625ba839ed4bc28381773d0f58 Adds missing #include <linux/mm.h> drivers/tee/optee/smc_abi.c to fix compile errors like: drivers/tee/optee/smc_abi.c:405:15: error: implicit declaration of function 'page_to_section' [-Werror,-Wimplicit-function-declaration] optee_page = page_to_phys(*pages) + ^ arch/arm/include/asm/memory.h:148:43: note: expanded from macro 'page_to_phys' ^ include/asm-generic/memory_model.h:52:21: note: expanded from macro 'page_to_pfn' ^ include/asm-generic/memory_model.h:35:14: note: expanded from macro '__page_to_pfn' int __sec = page_to_section(__pg); \ ^ drivers/tee/optee/smc_abi.c:405:15: note: did you mean '__nr_to_section'? arch/arm/include/asm/memory.h:148:43: note: expanded from macro 'page_to_phys' ^ include/asm-generic/memory_model.h:52:21: note: expanded from macro 'page_to_pfn' ^ include/asm-generic/memory_model.h:35:14: note: expanded from macro '__page_to_pfn' int __sec = page_to_section(__pg); \ ^ include/linux/mmzone.h:1365:35: note: '__nr_to_section' declared here static inline struct mem_section *__nr_to_section(unsigned long nr) Fixes: c51a564a5b48 ("optee: isolate smc abi") Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Link: https://lore.kernel.org/r/20211021125539.3858495-1-jens.wiklander@linaro.org' Signed-off-by: Arnd Bergmann <arnd@arndb.de> 2021-10-18T09:44:23+00:00 Jens Wiklander jens.wiklander@linaro.org 2021-07-21T15:45:21+00:00 urn:sha1:4615e5a34b95e0d81467f6d2176f19a5d184cb5d Adds support for using FF-A [1] as transport to the OP-TEE driver. Introduces struct optee_msg_param_fmem which carries all information needed when OP-TEE is calling FFA_MEM_RETRIEVE_REQ to get the shared memory reference mapped by the hypervisor in S-EL2. Register usage is also updated to include the information needed. The FF-A part of this driver is enabled if CONFIG_ARM_FFA_TRANSPORT is enabled. [1] https://developer.arm.com/documentation/den0077/latest Acked-by: Sumit Garg <sumit.garg@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>