Hi,
This patch set allocates the restricted DMA-bufs via the TEE subsystem.
This a complete rewrite compared to the previous patch set [1], and other
earlier proposals [2] and [3] with a separate restricted heap.
The TEE subsystem handles the DMA-buf allocations since it is the TEE
(OP-TEE, AMD-TEE, TS-TEE, or a future QTEE) which sets up the restrictions
for the memory used for the DMA-bufs.
I've added a new IOCTL, TEE_IOC_RSTMEM_ALLOC, to allocate the restricted
DMA-bufs. This new IOCTL reaches the backend TEE driver, allowing it to
choose how to allocate the restricted physical memory.
TEE_IOC_RSTMEM_ALLOC is quite similar to TEE_IOC_SHM_ALLOC so it's tempting
to extend TEE_IOC_SHM_ALLOC with two new flags
TEE_IOC_SHM_FLAG_SECURE_VIDEO and TEE_IOC_SHM_FLAG_SECURE_TRUSTED_UI for
the same feature. However, it might be a bit confusing since
TEE_IOC_SHM_ALLOC only returns an anonymous file descriptor, but
TEE_IOC_SHM_FLAG_SECURE_VIDEO and TEE_IOC_SHM_FLAG_SECURE_TRUSTED_UI would
return a DMA-buf file descriptor instead. What do others think?
This can be tested on QEMU with the following steps:
repo init -u https://github.com/jenswi-linaro/manifest.git -m qemu_v8.xml \
-b prototype/sdp-v2
repo sync -j8
cd build
make toolchains -j4
make all -j$(nproc)
make run-only
# login and at the prompt:
xtest --sdp-basic
https://optee.readthedocs.io/en/latest/building/prerequisites.html
list dependencies needed to build the above.
The tests are pretty basic, mostly checking that a Trusted Application in
the secure world can access and manipulate the memory. There are also some
negative tests for out of bounds buffers etc.
Thanks,
Jens
[1] https://lore.kernel.org/lkml/20240830070351.2855919-1-jens.wiklander@linaro…
[2] https://lore.kernel.org/dri-devel/20240515112308.10171-1-yong.wu@mediatek.c…
[3] https://lore.kernel.org/lkml/20220805135330.970-1-olivier.masse@nxp.com/
Changes since the V1 RFC:
* Based on v6.11
* Complete rewrite, replacing the restricted heap with TEE_IOC_RSTMEM_ALLOC
Changes since Olivier's post [2]:
* Based on Yong Wu's post [1] where much of dma-buf handling is done in
the generic restricted heap
* Simplifications and cleanup
* New commit message for "dma-buf: heaps: add Linaro restricted dmabuf heap
support"
* Replaced the word "secure" with "restricted" where applicable
Jens Wiklander (2):
tee: add restricted memory allocation
optee: support restricted memory allocation
drivers/tee/Makefile | 1 +
drivers/tee/optee/core.c | 21 ++++
drivers/tee/optee/optee_private.h | 6 +
drivers/tee/optee/optee_smc.h | 35 ++++++
drivers/tee/optee/smc_abi.c | 45 ++++++-
drivers/tee/tee_core.c | 33 ++++-
drivers/tee/tee_private.h | 2 +
drivers/tee/tee_rstmem.c | 200 ++++++++++++++++++++++++++++++
drivers/tee/tee_shm.c | 2 +
drivers/tee/tee_shm_pool.c | 69 ++++++++++-
include/linux/tee_core.h | 6 +
include/linux/tee_drv.h | 9 ++
include/uapi/linux/tee.h | 33 ++++-
13 files changed, 455 insertions(+), 7 deletions(-)
create mode 100644 drivers/tee/tee_rstmem.c
--
2.43.0
Reports indicates that some userspace applications try to merge more than
80k of fences into a single dma_fence_array leading to a warning from
kzalloc() that the requested size becomes to big.
While that is clearly an userspace bug we should probably handle that case
gracefully in the kernel.
So we can either reject requests to merge more than a reasonable amount of
fences (64k maybe?) or we can start to use kvzalloc() instead of kzalloc().
This patch here does the later.
Signed-off-by: Christian König <christian.koenig(a)amd.com>
CC: stable(a)vger.kernel.org
---
drivers/dma-buf/dma-fence-array.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c
index 8a08ffde31e7..46ac42bcfac0 100644
--- a/drivers/dma-buf/dma-fence-array.c
+++ b/drivers/dma-buf/dma-fence-array.c
@@ -119,8 +119,8 @@ static void dma_fence_array_release(struct dma_fence *fence)
for (i = 0; i < array->num_fences; ++i)
dma_fence_put(array->fences[i]);
- kfree(array->fences);
- dma_fence_free(fence);
+ kvfree(array->fences);
+ kvfree_rcu(fence, rcu);
}
static void dma_fence_array_set_deadline(struct dma_fence *fence,
@@ -153,7 +153,7 @@ struct dma_fence_array *dma_fence_array_alloc(int num_fences)
{
struct dma_fence_array *array;
- return kzalloc(struct_size(array, callbacks, num_fences), GFP_KERNEL);
+ return kvzalloc(struct_size(array, callbacks, num_fences), GFP_KERNEL);
}
EXPORT_SYMBOL(dma_fence_array_alloc);
--
2.34.1
Am 16.10.24 um 18:43 schrieb Adrián Larumbe:
> On 16.10.2024 15:12, Christian König wrote:
>> Am 15.10.24 um 01:31 schrieb Adrián Larumbe:
>>> Doesn't make any functional difference because generic dma_fence is the
>>> first panfrost_fence structure member, but I guess it doesn't hurt either.
>> As discussed with Sima we want to push into the exactly opposite direction
>> because that requires that the panfrost module stays loaded as long as fences
>> are around.
> Does that mean in future commits the struct dma_fence_ops' .release pointer will be
> done with altogether?
Yes, exactly that's the idea.
As a first step I'm preparing patches right now to enforce using kmalloc
instead of driver brewed approaches for dma_fence handling.
Regards,
Christian.
>
>> So clearly a NAK to this one here. Rather document on the structure that the
>> dma_fence structure must be the first member.
>>
>> Regards,
>> Christian.
>>
>>> Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com>
>>> ---
>>> drivers/gpu/drm/panfrost/panfrost_job.c | 6 ++++++
>>> 1 file changed, 6 insertions(+)
>>>
>>> diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
>>> index 5d83c6a148ec..fa219f719bdc 100644
>>> --- a/drivers/gpu/drm/panfrost/panfrost_job.c
>>> +++ b/drivers/gpu/drm/panfrost/panfrost_job.c
>>> @@ -85,9 +85,15 @@ static const char *panfrost_fence_get_timeline_name(struct dma_fence *fence)
>>> }
>>> }
>>> +static void panfrost_fence_release(struct dma_fence *fence)
>>> +{
>>> + kfree(to_panfrost_fence(fence));
>>> +}
>>> +
>>> static const struct dma_fence_ops panfrost_fence_ops = {
>>> .get_driver_name = panfrost_fence_get_driver_name,
>>> .get_timeline_name = panfrost_fence_get_timeline_name,
>>> + .release = panfrost_fence_release,
>>> };
>>> static struct dma_fence *panfrost_fence_create(struct panfrost_device *pfdev, int js_num)
On 15/10/2024 14:07, Jyothi Kumar Seerapu wrote:
> When high performance with multiple i2c messages in a single transfer
> is required, employ Block Event Interrupt (BEI) to trigger interrupts
> after specific messages transfer and the last message transfer,
> thereby reducing interrupts.
> For each i2c message transfer, a series of Transfer Request Elements(TREs)
> must be programmed, including config tre for frequency configuration,
> go tre for holding i2c address and dma tre for holding dma buffer address,
> length as per the hardware programming guide. For transfer using BEI,
> multiple I2C messages may necessitate the preparation of config, go,
> and tx DMA TREs. However, a channel TRE size of 64 is often insufficient,
> potentially leading to failures due to inadequate memory space.
>
> Adjust the channel TRE size through the device tree.
> The default size is 64, but clients can modify this value based on
> their heigher channel TRE size requirements.
>
> Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu(a)quicinc.com>
> ---
> arch/arm64/boot/dts/qcom/sc7280.dtsi | 132 +++++++++++++--------------
> 1 file changed, 66 insertions(+), 66 deletions(-)
>
> diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
> index 3d8410683402..c7c0e15ff9d3 100644
> --- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
> +++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
> @@ -1064,7 +1064,7 @@
> };
>
> gpi_dma0: dma-controller@900000 {
> - #dma-cells = <3>;
> + #dma-cells = <4>;
> compatible = "qcom,sc7280-gpi-dma", "qcom,sm6350-gpi-dma";
> reg = <0 0x00900000 0 0x60000>;
> interrupts = <GIC_SPI 244 IRQ_TYPE_LEVEL_HIGH>,
> @@ -1114,8 +1114,8 @@
> "qup-memory";
> power-domains = <&rpmhpd SC7280_CX>;
> required-opps = <&rpmhpd_opp_low_svs>;
> - dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C>,
> - <&gpi_dma0 1 0 QCOM_GPI_I2C>;
> + dmas = <&gpi_dma0 0 0 QCOM_GPI_I2C 64>,
> + <&gpi_dma0 1 0 QCOM_GPI_I2C 64>;
So everywhere is 64, thus this is fixed. Deduce it from the compatible
Best regards,
Krzysztof
Am 15.10.24 um 01:31 schrieb Adrián Larumbe:
> Doesn't make any functional difference because generic dma_fence is the
> first panfrost_fence structure member, but I guess it doesn't hurt either.
As discussed with Sima we want to push into the exactly opposite
direction because that requires that the panfrost module stays loaded as
long as fences are around.
So clearly a NAK to this one here. Rather document on the structure that
the dma_fence structure must be the first member.
Regards,
Christian.
> Signed-off-by: Adrián Larumbe <adrian.larumbe(a)collabora.com>
> ---
> drivers/gpu/drm/panfrost/panfrost_job.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/gpu/drm/panfrost/panfrost_job.c b/drivers/gpu/drm/panfrost/panfrost_job.c
> index 5d83c6a148ec..fa219f719bdc 100644
> --- a/drivers/gpu/drm/panfrost/panfrost_job.c
> +++ b/drivers/gpu/drm/panfrost/panfrost_job.c
> @@ -85,9 +85,15 @@ static const char *panfrost_fence_get_timeline_name(struct dma_fence *fence)
> }
> }
>
> +static void panfrost_fence_release(struct dma_fence *fence)
> +{
> + kfree(to_panfrost_fence(fence));
> +}
> +
> static const struct dma_fence_ops panfrost_fence_ops = {
> .get_driver_name = panfrost_fence_get_driver_name,
> .get_timeline_name = panfrost_fence_get_timeline_name,
> + .release = panfrost_fence_release,
> };
>
> static struct dma_fence *panfrost_fence_create(struct panfrost_device *pfdev, int js_num)
On 15-10-24, 17:37, Jyothi Kumar Seerapu wrote:
> When high performance with multiple i2c messages in a single transfer
> is required, employ Block Event Interrupt (BEI) to trigger interrupts
> after specific messages transfer and the last message transfer,
> thereby reducing interrupts.
>
> For each i2c message transfer, a series of Transfer Request Elements(TREs)
> must be programmed, including config tre for frequency configuration,
> go tre for holding i2c address and dma tre for holding dma buffer address,
> length as per the hardware programming guide. For transfer using BEI,
> multiple I2C messages may necessitate the preparation of config, go,
> and tx DMA TREs. However, a channel TRE size of 64 is often insufficient,
> potentially leading to failures due to inadequate memory space.
>
> Add additional argument to dma-cell property for channel TRE size.
> With this, adjust the channel TRE size via the device tree.
> The default size is 64, but clients can modify this value based on
> their specific requirements.
>
> Signed-off-by: Jyothi Kumar Seerapu <quic_jseerapu(a)quicinc.com>
> ---
> Documentation/devicetree/bindings/dma/qcom,gpi.yaml | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/devicetree/bindings/dma/qcom,gpi.yaml b/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> index 4df4e61895d2..002495921643 100644
> --- a/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> +++ b/Documentation/devicetree/bindings/dma/qcom,gpi.yaml
> @@ -54,14 +54,16 @@ properties:
> maxItems: 13
>
> "#dma-cells":
> - const: 3
> + minItems: 3
> + maxItems: 4
> description: >
> DMA clients must use the format described in dma.txt, giving a phandle
> - to the DMA controller plus the following 3 integer cells:
> + to the DMA controller plus the following 4 integer cells:
> - channel: if set to 0xffffffff, any available channel will be allocated
> for the client. Otherwise, the exact channel specified will be used.
> - seid: serial id of the client as defined in the SoC documentation.
> - client: type of the client as defined in dt-bindings/dma/qcom-gpi.h
> + - channel-tre-size: size of the channel TRE (transfer ring element)
This is a firmware /software property, why should this be in hardware
description?
--
~Vinod