From 99b6997be99a81a8018510952011cd932d068c7e Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 12 Aug 2021 07:51:31 -0400 Subject: [PATCH] Fixes for 5.13 Signed-off-by: Sasha Levin --- ...t-release-tee-shm-session-and-contex.patch | 85 +++++++++++++++++++ queue-5.13/series | 1 + 2 files changed, 86 insertions(+) create mode 100644 queue-5.13/firmware-tee_bnxt-release-tee-shm-session-and-contex.patch create mode 100644 queue-5.13/series diff --git a/queue-5.13/firmware-tee_bnxt-release-tee-shm-session-and-contex.patch b/queue-5.13/firmware-tee_bnxt-release-tee-shm-session-and-contex.patch new file mode 100644 index 00000000000..f0d02ac36c0 --- /dev/null +++ b/queue-5.13/firmware-tee_bnxt-release-tee-shm-session-and-contex.patch @@ -0,0 +1,85 @@ +From a1caf7b8d58d5ef944a50e45b8e2af8737f53393 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 17:33:17 -0500 +Subject: firmware: tee_bnxt: Release TEE shm, session, and context during + kexec + +From: Allen Pais + +[ Upstream commit 914ab19e471d8fb535ed50dff108b0a615f3c2d8 ] + +Implement a .shutdown hook that will be called during a kexec operation +so that the TEE shared memory, session, and context that were set up +during .probe can be properly freed/closed. + +Additionally, don't use dma-buf backed shared memory for the +fw_shm_pool. dma-buf backed shared memory cannot be reliably freed and +unregistered during a kexec operation even when tee_shm_free() is called +on the shm from a .shutdown hook. The problem occurs because +dma_buf_put() calls fput() which then uses task_work_add(), with the +TWA_RESUME parameter, to queue tee_shm_release() to be called before the +current task returns to user mode. However, the current task never +returns to user mode before the kexec completes so the memory is never +freed nor unregistered. + +Use tee_shm_alloc_kernel_buf() to avoid dma-buf backed shared memory +allocation so that tee_shm_free() can directly call tee_shm_release(). +This will ensure that the shm can be freed and unregistered during a +kexec operation. + +Fixes: 246880958ac9 ("firmware: broadcom: add OP-TEE based BNXT f/w manager") +Cc: stable@vger.kernel.org +Signed-off-by: Allen Pais +Co-developed-by: Tyler Hicks +Signed-off-by: Tyler Hicks +Reviewed-by: Sumit Garg +Acked-by: Florian Fainelli +Signed-off-by: Jens Wiklander +Signed-off-by: Sasha Levin +--- + drivers/firmware/broadcom/tee_bnxt_fw.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/firmware/broadcom/tee_bnxt_fw.c b/drivers/firmware/broadcom/tee_bnxt_fw.c +index ed10da5313e8..a5bf4c3f6dc7 100644 +--- a/drivers/firmware/broadcom/tee_bnxt_fw.c ++++ b/drivers/firmware/broadcom/tee_bnxt_fw.c +@@ -212,10 +212,9 @@ static int tee_bnxt_fw_probe(struct device *dev) + + pvt_data.dev = dev; + +- fw_shm_pool = tee_shm_alloc(pvt_data.ctx, MAX_SHM_MEM_SZ, +- TEE_SHM_MAPPED | TEE_SHM_DMA_BUF); ++ fw_shm_pool = tee_shm_alloc_kernel_buf(pvt_data.ctx, MAX_SHM_MEM_SZ); + if (IS_ERR(fw_shm_pool)) { +- dev_err(pvt_data.dev, "tee_shm_alloc failed\n"); ++ dev_err(pvt_data.dev, "tee_shm_alloc_kernel_buf failed\n"); + err = PTR_ERR(fw_shm_pool); + goto out_sess; + } +@@ -242,6 +241,14 @@ static int tee_bnxt_fw_remove(struct device *dev) + return 0; + } + ++static void tee_bnxt_fw_shutdown(struct device *dev) ++{ ++ tee_shm_free(pvt_data.fw_shm_pool); ++ tee_client_close_session(pvt_data.ctx, pvt_data.session_id); ++ tee_client_close_context(pvt_data.ctx); ++ pvt_data.ctx = NULL; ++} ++ + static const struct tee_client_device_id tee_bnxt_fw_id_table[] = { + {UUID_INIT(0x6272636D, 0x2019, 0x0716, + 0x42, 0x43, 0x4D, 0x5F, 0x53, 0x43, 0x48, 0x49)}, +@@ -257,6 +264,7 @@ static struct tee_client_driver tee_bnxt_fw_driver = { + .bus = &tee_bus_type, + .probe = tee_bnxt_fw_probe, + .remove = tee_bnxt_fw_remove, ++ .shutdown = tee_bnxt_fw_shutdown, + }, + }; + +-- +2.30.2 + diff --git a/queue-5.13/series b/queue-5.13/series new file mode 100644 index 00000000000..8a593ad4711 --- /dev/null +++ b/queue-5.13/series @@ -0,0 +1 @@ +firmware-tee_bnxt-release-tee-shm-session-and-contex.patch -- 2.47.3