diff --git a/drivers/soc/qcom/smcinvoke.c b/drivers/soc/qcom/smcinvoke.c index a546a753bb8f..f55794564558 100644 --- a/drivers/soc/qcom/smcinvoke.c +++ b/drivers/soc/qcom/smcinvoke.c @@ -3,6 +3,8 @@ * Copyright (c) 2016-2020, The Linux Foundation. All rights reserved. */ +#define pr_fmt(fmt) "smcinvoke: %s: " fmt, __func__ + #include #include #include @@ -17,6 +19,7 @@ #include #include #include +#include #include #include @@ -138,11 +141,12 @@ static LIST_HEAD(g_mem_objs); static uint16_t g_last_cb_server_id = CBOBJ_SERVER_ID_START; static uint16_t g_last_mem_rgn_id, g_last_mem_map_obj_id; static size_t g_max_cb_buf_size = SMCINVOKE_TZ_MIN_BUF_SIZE; +static unsigned int cb_reqs_inflight; static long smcinvoke_ioctl(struct file *, unsigned int, unsigned long); static int smcinvoke_open(struct inode *, struct file *); static int smcinvoke_release(struct inode *, struct file *); -static int destroy_cb_server(uint16_t); +static int release_cb_server(uint16_t); static const struct file_operations g_smcinvoke_fops = { .owner = THIS_MODULE, @@ -211,6 +215,7 @@ struct smcinvoke_server_info { uint16_t server_id; uint16_t state; uint32_t txn_id; + struct kref ref_cnt; wait_queue_head_t req_wait_q; wait_queue_head_t rsp_wait_q; size_t cb_buf_size; @@ -246,6 +251,23 @@ struct smcinvoke_mem_obj { struct list_head list; }; +static void destroy_cb_server(struct kref *kref) +{ + struct smcinvoke_server_info *server = container_of(kref, + struct smcinvoke_server_info, ref_cnt); + if (server) { + hash_del(&server->hash); + kfree(server); + } +} + +/* + * A separate find func is reqd mainly for couple of cases: + * next_cb_server_id_locked which checks if server id had been utilized or not. + * - It would be overhead if we do ref_cnt for this case + * smcinvoke_release: which is called when server is closed from userspace. + * - During server creation we init ref count, now put it back + */ static struct smcinvoke_server_info *find_cb_server_locked(uint16_t server_id) { struct smcinvoke_server_info *data = NULL; @@ -257,6 +279,16 @@ static struct smcinvoke_server_info *find_cb_server_locked(uint16_t server_id) return NULL; } +static struct smcinvoke_server_info *get_cb_server_locked(uint16_t server_id) +{ + struct smcinvoke_server_info *server = find_cb_server_locked(server_id); + + if (server) + kref_get(&server->ref_cnt); + + return server; +} + static uint16_t next_cb_server_id_locked(void) { if (g_last_cb_server_id == CBOBJ_SERVER_ID_END) @@ -370,8 +402,10 @@ static int release_mem_obj_locked(int32_t tzhandle) struct smcinvoke_mem_obj *mem_obj = find_mem_obj_locked( TZHANDLE_GET_OBJID(tzhandle), is_mem_regn_obj); - if (!mem_obj) + if (!mem_obj) { + pr_err("memory object not found\n"); return OBJECT_ERROR_BADOBJ; + } if (is_mem_regn_obj) kref_put(&mem_obj->mem_regn_ref_cnt, del_mem_regn_obj_locked); @@ -389,59 +423,74 @@ static void free_pending_cbobj_locked(struct kref *kref) list_del(&obj->list); server = obj->server; kfree(obj); - if ((server->state == SMCINVOKE_SERVER_STATE_DEFUNCT) && - list_empty(&server->pending_cbobjs)) { - hash_del(&server->hash); - kfree(server); - } + if (server) + kref_put(&server->ref_cnt, destroy_cb_server); } static int get_pending_cbobj_locked(uint16_t srvr_id, int16_t obj_id) { + int ret = 0; + bool release_server = true; struct list_head *head = NULL; struct smcinvoke_cbobj *cbobj = NULL; struct smcinvoke_cbobj *obj = NULL; - struct smcinvoke_server_info *server = find_cb_server_locked(srvr_id); + struct smcinvoke_server_info *server = get_cb_server_locked(srvr_id); - if (!server) + if (!server) { + pr_err("%s, server id : %u not found\n", __func__, srvr_id); return OBJECT_ERROR_BADOBJ; + } head = &server->pending_cbobjs; list_for_each_entry(cbobj, head, list) if (cbobj->cbobj_id == obj_id) { kref_get(&cbobj->ref_cnt); - return 0; + goto out; } obj = kzalloc(sizeof(*obj), GFP_KERNEL); - if (!obj) - return OBJECT_ERROR_KMEM; + if (!obj) { + ret = OBJECT_ERROR_KMEM; + goto out; + } obj->cbobj_id = obj_id; kref_init(&obj->ref_cnt); obj->server = server; + /* + * we are holding server ref in cbobj; we will + * release server ref when cbobj is destroyed + */ + release_server = false; list_add_tail(&obj->list, head); - - return 0; +out: + if (release_server) + kref_put(&server->ref_cnt, destroy_cb_server); + return ret; } static int put_pending_cbobj_locked(uint16_t srvr_id, int16_t obj_id) { + int ret = -EINVAL; struct smcinvoke_server_info *srvr_info = - find_cb_server_locked(srvr_id); + get_cb_server_locked(srvr_id); struct list_head *head = NULL; struct smcinvoke_cbobj *cbobj = NULL; - if (!srvr_info) - return -EINVAL; + if (!srvr_info) { + pr_err("%s, server id : %u not found\n", __func__, srvr_id); + return ret; + } head = &srvr_info->pending_cbobjs; list_for_each_entry(cbobj, head, list) if (cbobj->cbobj_id == obj_id) { kref_put(&cbobj->ref_cnt, free_pending_cbobj_locked); - return 0; + ret = 0; + break; } - return -EINVAL; + kref_put(&srvr_info->ref_cnt, destroy_cb_server); + return ret; } static int release_tzhandle_locked(int32_t tzhandle) @@ -743,8 +792,10 @@ static int32_t smcinvoke_release_mem_obj_locked(void *buf, size_t buf_len) { struct smcinvoke_tzcb_req *msg = buf; - if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 0, 0, 0)) + if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 0, 0, 0)) { + pr_err("Invalid object count in %s\n", __func__); return OBJECT_ERROR_INVALID; + } return release_tzhandle_locked(msg->hdr.tzhandle); } @@ -764,9 +815,10 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len) struct sg_table *sgt = NULL; if (msg->hdr.counts != OBJECT_COUNTS_PACK(0, 1, 1, 1) || - (buf_len - msg->args[0].b.offset < msg->args[0].b.size)) + (buf_len - msg->args[0].b.offset < msg->args[0].b.size)) { + pr_err("Invalid counts received for mapping mem obj\n"); return OBJECT_ERROR_INVALID; - + } /* args[0] = BO, args[1] = OI, args[2] = OO */ ob = buf + msg->args[0].b.offset; oo = &msg->args[2].handle; @@ -776,6 +828,7 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len) SMCINVOKE_MEM_RGN_OBJ); if (!mem_obj) { mutex_unlock(&g_smcinvoke_lock); + pr_err("Memory object not found\n"); return OBJECT_ERROR_BADOBJ; } @@ -785,6 +838,7 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len) &smcinvoke_pdev->dev); if (IS_ERR(buf_attach)) { ret = OBJECT_ERROR_KMEM; + pr_err("dma buf attach failed, ret: %d\n", ret); goto out; } mem_obj->buf_attach = buf_attach; @@ -792,6 +846,7 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len) sgt = dma_buf_map_attachment(buf_attach, DMA_BIDIRECTIONAL); if (IS_ERR(sgt)) { ret = OBJECT_ERROR_KMEM; + pr_err("mapping dma buffers failed, ret: %d\n", ret); goto out; } mem_obj->sgt = sgt; @@ -799,12 +854,14 @@ static int32_t smcinvoke_map_mem_region(void *buf, size_t buf_len) /* contiguous only => nents=1 */ if (sgt->nents != 1) { ret = OBJECT_ERROR_INVALID; + pr_err("sg enries are not contigous, ret: %d\n", ret); goto out; } mem_obj->p_addr = sg_dma_address(sgt->sgl); mem_obj->p_addr_len = sgt->sgl->length; if (!mem_obj->p_addr) { ret = OBJECT_ERROR_INVALID; + pr_err("invalid physical address, ret: %d\n", ret); goto out; } mem_obj->mem_map_obj_id = next_mem_map_obj_id_locked(); @@ -826,9 +883,18 @@ static void process_kernel_obj(void *buf, size_t buf_len) { struct smcinvoke_tzcb_req *cb_req = buf; - cb_req->result = (cb_req->hdr.op == OBJECT_OP_MAP_REGION) ? - smcinvoke_map_mem_region(buf, buf_len) : - OBJECT_ERROR_INVALID; + switch (cb_req->hdr.op) { + case OBJECT_OP_MAP_REGION: + cb_req->result = smcinvoke_map_mem_region(buf, buf_len); + break; + case OBJECT_OP_YIELD: + cb_req->result = OBJECT_OK; + break; + default: + pr_err(" invalid operation for tz kernel object\n"); + cb_req->result = OBJECT_ERROR_INVALID; + break; + } } static void process_mem_obj(void *buf, size_t buf_len) @@ -853,8 +919,10 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp) struct smcinvoke_tzcb_req *cb_req = NULL, *tmp_cb_req = NULL; struct smcinvoke_server_info *srvr_info = NULL; - if (buf_len < sizeof(struct smcinvoke_tzcb_req)) + if (buf_len < sizeof(struct smcinvoke_tzcb_req)) { + pr_err("smaller buffer length : %u\n", buf_len); return; + } cb_req = buf; @@ -864,6 +932,7 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp) } else if (TZHANDLE_IS_MEM_OBJ(cb_req->hdr.tzhandle)) { return process_mem_obj(buf, buf_len); } else if (!TZHANDLE_IS_CB_OBJ(cb_req->hdr.tzhandle)) { + pr_err("Request object is not a callback object\n"); cb_req->result = OBJECT_ERROR_INVALID; return; } @@ -877,12 +946,16 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp) if (!tmp_cb_req) { /* we need to return error to caller so fill up result */ cb_req->result = OBJECT_ERROR_KMEM; + pr_err("failed to create copy of request, set result: %d\n", + cb_req->result); return; } cb_txn = kzalloc(sizeof(*cb_txn), GFP_KERNEL); if (!cb_txn) { cb_req->result = OBJECT_ERROR_KMEM; + pr_err("failed to allocate memory for request, result: %d\n", + cb_req->result); kfree(tmp_cb_req); return; } @@ -896,10 +969,12 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp) kref_init(&cb_txn->ref_cnt); mutex_lock(&g_smcinvoke_lock); - srvr_info = find_cb_server_locked( + ++cb_reqs_inflight; + srvr_info = get_cb_server_locked( TZHANDLE_GET_SERVER(cb_req->hdr.tzhandle)); if (!srvr_info || srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT) { /* ret equals Object_ERROR_DEFUNCT, at this point go to out */ + pr_err("sever is either invalid or defunct\n"); mutex_unlock(&g_smcinvoke_lock); goto out; } @@ -911,10 +986,11 @@ static void process_tzcb_req(void *buf, size_t buf_len, struct file **arr_filp) * we need not worry that server_info will be deleted because as long * as this CBObj is served by this server, srvr_info will be valid. */ - wake_up_interruptible(&srvr_info->req_wait_q); + wake_up_interruptible_all(&srvr_info->req_wait_q); ret = wait_event_interruptible(srvr_info->rsp_wait_q, - (cb_txn->state == SMCINVOKE_REQ_PROCESSED) || - (srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT)); + (cb_txn->state == SMCINVOKE_REQ_PROCESSED) || + (srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT)); + out: /* * we could be here because of either: a. Req is PROCESSED @@ -931,12 +1007,16 @@ out: } else if (!srvr_info || srvr_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT) { cb_req->result = OBJECT_ERROR_DEFUNCT; + pr_err("server invalid, res: %d\n", cb_req->result); } else { pr_debug("%s wait_event interrupted ret = %d\n", __func__, ret); cb_req->result = OBJECT_ERROR_ABORT; } + --cb_reqs_inflight; memcpy(buf, cb_req, buf_len); kref_put(&cb_txn->ref_cnt, delete_cb_txn); + if (srvr_info) + kref_put(&srvr_info->ref_cnt, destroy_cb_server); mutex_unlock(&g_smcinvoke_lock); } @@ -1383,18 +1463,21 @@ static long process_server_req(struct file *filp, unsigned int cmd, struct smcinvoke_server server_req = {0}; struct smcinvoke_server_info *server_info = NULL; - if (_IOC_SIZE(cmd) != sizeof(server_req)) + if (_IOC_SIZE(cmd) != sizeof(server_req)) { + pr_err("invalid command size received for server request\n"); return -EINVAL; - + } ret = copy_from_user(&server_req, (void __user *)(uintptr_t)arg, sizeof(server_req)); - if (ret) + if (ret) { + pr_err("copying server request from user failed\n"); return -EFAULT; - + } server_info = kzalloc(sizeof(*server_info), GFP_KERNEL); if (!server_info) return -ENOMEM; + kref_init(&server_info->ref_cnt); init_waitqueue_head(&server_info->req_wait_q); init_waitqueue_head(&server_info->rsp_wait_q); server_info->cb_buf_size = server_req.cb_buf_size; @@ -1415,7 +1498,7 @@ static long process_server_req(struct file *filp, unsigned int cmd, server_info->server_id, &server_fd); if (ret) - destroy_cb_server(server_info->server_id); + release_cb_server(server_info->server_id); return server_fd; } @@ -1429,25 +1512,42 @@ static long process_accept_req(struct file *filp, unsigned int cmd, struct smcinvoke_cb_txn *cb_txn = NULL; struct smcinvoke_server_info *server_info = NULL; - if (_IOC_SIZE(cmd) != sizeof(struct smcinvoke_accept)) + if (_IOC_SIZE(cmd) != sizeof(struct smcinvoke_accept)) { + pr_err("command size invalid for accept request\n"); return -EINVAL; + } if (copy_from_user(&user_args, (void __user *)arg, - sizeof(struct smcinvoke_accept))) + sizeof(struct smcinvoke_accept))) { + pr_err("copying accept request from user failed\n"); return -EFAULT; + } - if (user_args.argsize != sizeof(union smcinvoke_arg)) + if (user_args.argsize != sizeof(union smcinvoke_arg)) { + pr_err("arguments size is invalid for accept thread\n"); return -EINVAL; + } /* ACCEPT is available only on server obj */ - if (server_obj->context_type != SMCINVOKE_OBJ_TYPE_SERVER) + if (server_obj->context_type != SMCINVOKE_OBJ_TYPE_SERVER) { + pr_err("invalid object type received for accept req\n"); return -EPERM; + } mutex_lock(&g_smcinvoke_lock); - server_info = find_cb_server_locked(server_obj->server_id); - mutex_unlock(&g_smcinvoke_lock); - if (!server_info) + server_info = get_cb_server_locked(server_obj->server_id); + + if (!server_info) { + pr_err("No matching server with server id : %u found\n", + server_obj->server_id); + mutex_unlock(&g_smcinvoke_lock); return -EINVAL; + } + + if (server_info->state == SMCINVOKE_SERVER_STATE_DEFUNCT) + server_info->state = 0; + + mutex_unlock(&g_smcinvoke_lock); /* First check if it has response otherwise wait for req */ if (user_args.has_resp) { @@ -1498,9 +1598,19 @@ static long process_accept_req(struct file *filp, unsigned int cmd, if (ret) { pr_debug("%s wait_event interrupted: ret = %d\n", __func__, ret); + /* + * Ideally, we should destroy server if accept threads + * are returning due to client being killed or device + * going down (Shutdown/Reboot) but that would make + * server_info invalid. Other accept/invoke threads are + * using server_info and would crash. So dont do that. + */ + mutex_lock(&g_smcinvoke_lock); + server_info->state = SMCINVOKE_SERVER_STATE_DEFUNCT; + mutex_unlock(&g_smcinvoke_lock); + wake_up_interruptible(&server_info->rsp_wait_q); goto out; } - mutex_lock(&g_smcinvoke_lock); cb_txn = find_cbtxn_locked(server_info, SMCINVOKE_NEXT_AVAILABLE_TXN, @@ -1511,6 +1621,7 @@ static long process_accept_req(struct file *filp, unsigned int cmd, ret = marshal_in_tzcb_req(cb_txn, &user_args, server_obj->server_id); if (ret) { + pr_err("failed to marshal in the callback request\n"); cb_txn->cb_req->result = OBJECT_ERROR_UNAVAIL; cb_txn->state = SMCINVOKE_REQ_PROCESSED; kref_put(&cb_txn->ref_cnt, delete_cb_txn); @@ -1527,6 +1638,12 @@ static long process_accept_req(struct file *filp, unsigned int cmd, } } while (!cb_txn); out: + if (server_info) + kref_put(&server_info->ref_cnt, destroy_cb_server); + + if (ret && ret != -ERESTARTSYS) + pr_err("accept thread returning with ret: %d\n", ret); + return ret; } @@ -1553,18 +1670,26 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, int32_t tzhandles_to_release[OBJECT_COUNTS_MAX_OO] = {0}; bool tz_acked = false; - if (_IOC_SIZE(cmd) != sizeof(req)) + if (_IOC_SIZE(cmd) != sizeof(req)) { + pr_err("command size for invoke req is invalid\n"); return -EINVAL; + } - if (tzobj->context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ) + if (tzobj->context_type != SMCINVOKE_OBJ_TYPE_TZ_OBJ) { + pr_err("object type for invoke req is invalid\n"); return -EPERM; + } ret = copy_from_user(&req, (void __user *)arg, sizeof(req)); - if (ret) + if (ret) { + pr_err("copying invoke req failed\n"); return -EFAULT; + } - if (req.argsize != sizeof(union smcinvoke_arg)) + if (req.argsize != sizeof(union smcinvoke_arg)) { + pr_err("arguments size for invoke req is invalid\n"); return -EINVAL; + } nr_args = OBJECT_COUNTS_NUM_buffers(req.counts) + OBJECT_COUNTS_NUM_objects(req.counts); @@ -1587,6 +1712,7 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, ret = qtee_shmbridge_allocate_shm(inmsg_size, &in_shm); if (ret) { ret = -ENOMEM; + pr_err("shmbridge alloc failed for in msg in invoke req\n"); goto out; } in_msg = in_shm.vaddr; @@ -1597,14 +1723,17 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, ret = qtee_shmbridge_allocate_shm(outmsg_size, &out_shm); if (ret) { ret = -ENOMEM; + pr_err("shmbridge alloc failed for out msg in invoke req\n"); goto out; } out_msg = out_shm.vaddr; ret = marshal_in_invoke_req(&req, args_buf, tzobj->tzhandle, in_msg, inmsg_size, filp_to_release, tzhandles_to_release); - if (ret) + if (ret) { + pr_err("failed to marshal in invoke req, ret :%d\n", ret); goto out; + } ret = prepare_send_scm_msg(in_msg, in_shm.paddr, inmsg_size, out_msg, out_shm.paddr, outmsg_size, @@ -1614,8 +1743,10 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, * If scm_call is success, TZ owns responsibility to release * refs for local objs. */ - if (!tz_acked) + if (!tz_acked) { + pr_debug("scm call successful\n"); goto out; + } memset(tzhandles_to_release, 0, sizeof(tzhandles_to_release)); /* @@ -1646,6 +1777,10 @@ out: qtee_shmbridge_free_shm(&in_shm); qtee_shmbridge_free_shm(&out_shm); kfree(args_buf); + + if (ret) + pr_err("invoke thread returning with ret = %d\n", ret); + return ret; } @@ -1689,26 +1824,14 @@ static int smcinvoke_open(struct inode *nodp, struct file *filp) return 0; } -static int destroy_cb_server(uint16_t server_id) +static int release_cb_server(uint16_t server_id) { struct smcinvoke_server_info *server = NULL; mutex_lock(&g_smcinvoke_lock); server = find_cb_server_locked(server_id); - if (server) { - if (!list_empty(&server->pending_cbobjs)) { - server->state = SMCINVOKE_SERVER_STATE_DEFUNCT; - wake_up_interruptible(&server->rsp_wait_q); - /* - * we dont worry about threads waiting on req_wait_q - * because server can't be closed as long as there is - * atleast one accept thread active - */ - } else { - hash_del(&server->hash); - kfree(server); - } - } + if (server) + kref_put(&server->ref_cnt, destroy_cb_server); mutex_unlock(&g_smcinvoke_lock); return 0; } @@ -1726,7 +1849,7 @@ static int smcinvoke_release(struct inode *nodp, struct file *filp) struct qtee_shm in_shm = {0}, out_shm = {0}; if (file_data->context_type == SMCINVOKE_OBJ_TYPE_SERVER) { - ret = destroy_cb_server(file_data->server_id); + ret = release_cb_server(file_data->server_id); goto out; } @@ -1738,12 +1861,14 @@ static int smcinvoke_release(struct inode *nodp, struct file *filp) ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &in_shm); if (ret) { ret = -ENOMEM; + pr_err("shmbridge alloc failed for in msg in release\n"); goto out; } ret = qtee_shmbridge_allocate_shm(SMCINVOKE_TZ_MIN_BUF_SIZE, &out_shm); if (ret) { ret = -ENOMEM; + pr_err("shmbridge alloc failed for out msg in release\n"); goto out; } @@ -1826,6 +1951,25 @@ static int smcinvoke_remove(struct platform_device *pdev) return 0; } +static int __maybe_unused smcinvoke_suspend(struct platform_device *pdev, + pm_message_t state) +{ + int ret = 0; + + mutex_lock(&g_smcinvoke_lock); + if (cb_reqs_inflight) { + pr_err("Failed to suspend smcinvoke driver\n"); + ret = -EIO; + } + mutex_unlock(&g_smcinvoke_lock); + return ret; +} + +static int __maybe_unused smcinvoke_resume(struct platform_device *pdev) +{ + return 0; +} + static const struct of_device_id smcinvoke_match[] = { { .compatible = "qcom,smcinvoke", @@ -1836,6 +1980,8 @@ static const struct of_device_id smcinvoke_match[] = { static struct platform_driver smcinvoke_plat_driver = { .probe = smcinvoke_probe, .remove = smcinvoke_remove, + .suspend = smcinvoke_suspend, + .resume = smcinvoke_resume, .driver = { .name = "smcinvoke", .of_match_table = smcinvoke_match, diff --git a/drivers/soc/qcom/smcinvoke_object.h b/drivers/soc/qcom/smcinvoke_object.h index 8661bd428e99..09972e43067c 100644 --- a/drivers/soc/qcom/smcinvoke_object.h +++ b/drivers/soc/qcom/smcinvoke_object.h @@ -16,6 +16,7 @@ #define OBJECT_OP_RELEASE (OBJECT_OP_METHOD_MASK - 0) #define OBJECT_OP_RETAIN (OBJECT_OP_METHOD_MASK - 1) #define OBJECT_OP_MAP_REGION 0 +#define OBJECT_OP_YIELD 1 #define OBJECT_COUNTS_MAX_BI 0xF #define OBJECT_COUNTS_MAX_BO 0xF