optee: remove registered shm argument size checkandroid-tv-deadpool-4.9-android11

commit d66326e07a77f4ca708a57a1e53c4facaa287c6a
Author: Pengguang Zhu <pengguang.zhu@amlogic.com>
Date:   Tue Apr 27 18:14:53 2021 +0800

RSP-1789

We don't need to return error if output shm size is larger than
allocated buffer. This is pefrectly fine. In this way TEE or TA
reports that it needs larger buffer (as described in
TEE Client API Specification v1.0, section 3.2.5.).

Change-Id: I41627f02f94a76a6e4fb70f7f6a96111297bba8f
Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey)
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Pengguang Zhu <pengguang.zhu@amlogic.com>

Data Pipe: writing/reading Data Pipe return error after Data Pipe is closed [1/1]
commit 9259845f31109e1af2940841a392c1dadc98389a
Author: Liqiang Jin <liqiang.jin@amlogic.com>
Date:   Fri Mar 12 12:41:36 2021 +0800

PD#RSP-1598

Problem:
writing/reading Data Pipe return error after Data Pipe is closed

Solution:
writing/reading Data Pipe should not return error after Data Pipe is closed
according to standard Socket

Verify:
Android Q + AH212(SC2)

Change-Id: I1e472d0c6de121a91cc96c6a31350e44fe4ba92a
Signed-off-by: Liqiang Jin <liqiang.jin@amlogic.com>

Watermark: support Watermark for S4 [1/1]
commit 0f370c359eba876889873eb33e833da9cdf39321
Author: Liqiang Jin <liqiang.jin@amlogic.com>
Date:   Wed Mar 31 16:18:27 2021 +0800

PD#RSP-1597

Problem:
need to support Watermark for S4

Solution:
modify code

Verify:
Android R + AP229(S4)

Change-Id: I739e909afd9faebe07f0ef931ae34fdb6dfa1e82
Signed-off-by: Liqiang Jin <liqiang.jin@amlogic.com>

5 files changed, 63 insertions, 48 deletions

diff --git a/build.sh b/build.sh
index 5bc4b81..5bc4b81 100755..100644
--- a/build.sh
+++ b/build.sh
diff --git a/include/linux/tee.h b/include/linux/tee.h
index aca1001..99a5345 100644
--- a/include/linux/tee.h
+++ b/include/linux/tee.h
@@ -376,7 +376,7 @@ struct tee_iocl_data_pipe_context {
 	__u32 cache_size;
 	__u32 mode;
 	__u32 type;
-	__u32 data_ptr;
+	__u64 data_ptr;
 	__u32 data_size;
 };
 #define TEE_IOC_OPEN_DATA_PIPE	_IOR(TEE_IOC_MAGIC, TEE_IOC_BASE + 8, \
diff --git a/optee/core.c b/optee/core.c
index 8cbfc3d..c33b586 100644
--- a/optee/core.c
+++ b/optee/core.c
@@ -90,16 +90,6 @@ int optee_from_msg_param(struct tee_param *params, size_t num_params,
 				return rc;
 			p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa;
 			p->u.memref.shm = shm;
-
-			/* Check that the memref is covered by the shm object */
-			if (p->u.memref.size) {
-				size_t o = p->u.memref.shm_offs +
-					   p->u.memref.size - 1;
-
-				rc = tee_shm_get_pa(shm, o, NULL);
-				if (rc)
-					return rc;
-			}
 			break;
 		default:
 			return -EINVAL;
diff --git a/optee/watermark.c b/optee/watermark.c
index 36577dc..b7d6d3d 100644
--- a/optee/watermark.c
+++ b/optee/watermark.c
@@ -20,8 +20,6 @@
 #include "optee_smc.h"
 #include "optee_private.h"
 
-#define OPTEE_WM_DEBUG      0
-
 #define SRC_IRQ_NAME        "viu-vsync"
 #define DST_IRQ_NAME        "wm-vsync"
 
@@ -58,24 +56,34 @@ static int get_wm_irq_id(void)
 	struct device_node *root_node = of_find_node_by_path("/");
 	struct property *root_prop = NULL;
 	char *soc = NULL;
-	char compatible_val[32] = {"amlogic, meson-"};
-	struct device_node *compatible_node = NULL;
+	char com_val_meson[32] = {"amlogic, meson-"};
+	char com_val_fb[32] = {"amlogic, fb-"};
+	struct device_node *com_node = NULL;
 
 	for (root_prop = root_node->properties; root_prop; root_prop = root_prop->next) {
 		if (of_prop_cmp(root_prop->name, "compatible") == 0) {
 			soc = ((char *)root_prop->value) + strlen("amlogic, ");
-			strcat(compatible_val, soc);
-			compatible_node = of_find_compatible_node(NULL, NULL, compatible_val);
-			if (compatible_node)
-				irq_id = of_irq_get_byname(compatible_node, SRC_IRQ_NAME);
-			goto exit;
+
+			strcat(com_val_meson, soc);
+			com_node = of_find_compatible_node(NULL, NULL, com_val_meson);
+			if (com_node) {
+				irq_id = of_irq_get_byname(com_node, SRC_IRQ_NAME);
+				goto exit;
+			}
+
+			strcat(com_val_fb, soc);
+			com_node = of_find_compatible_node(NULL, NULL, com_val_fb);
+			if (com_node) {
+				irq_id = of_irq_get_byname(com_node, SRC_IRQ_NAME);
+				goto exit;
+			}
 		}
 	}
 
 exit:
 	if (irq_id <= 0) {
-		pr_err("SOC: %s; node: %p; node compatible value: %s; interrupt name: %s; interrupt id: %d;\n",
-				soc, compatible_node, compatible_val,
+		pr_err("SOC: %s; node: %p; node compatible value: %s/%s; interrupt name: %s; interrupt id: %d;\n",
+				soc, com_node, com_val_meson, com_val_fb,
 				SRC_IRQ_NAME, irq_id);
 		pr_err("not found %s interrupt\n", SRC_IRQ_NAME);
 	}
@@ -90,16 +98,12 @@ int optee_wm_irq_register(void)
 
 	wm_sts = check_wm_status();
 	if (wm_sts) {
-#ifdef OPTEE_WM_DEBUG
 		pr_info("checking watermark status return 0x%08X\n", wm_sts);
-#endif
 		return -1;
 	}
 
 	g_irq_id = get_wm_irq_id();
-#ifdef OPTEE_WM_DEBUG
 	pr_info("%s interrupt id: %d\n", DST_IRQ_NAME, g_irq_id);
-#endif
 
 	err_num = request_irq(g_irq_id, &vsync_isr, IRQF_SHARED, DST_IRQ_NAME, (void *)&g_irq_id);
 	if (err_num)
diff --git a/tee_data_pipe.c b/tee_data_pipe.c
index 625bd0a..fa2fbc6 100644
--- a/tee_data_pipe.c
+++ b/tee_data_pipe.c
@@ -32,6 +32,7 @@
 #include <tee_data_pipe.h>
 
 #define DATA_PIPE_DEBUG                   (0)
+#define PIPE_INFO_DEBUG                   (0)
 
 #define SIZE_1K                           (1024)
 #define SIZE_1M                           (SIZE_1K * SIZE_1K)
@@ -146,6 +147,7 @@ static void dump_pipe_info(const data_pipe_t *pipe)
 {
 	(void)pipe;
 
+#if PIPE_INFO_DEBUG
 	DEBUG("pipe->id = %d\n", pipe->id);
 	DEBUG("pipe->status = %d\n", pipe->status);
 	DEBUG("pipe->mode = %d\n", pipe->mode);
@@ -162,6 +164,7 @@ static void dump_pipe_info(const data_pipe_t *pipe)
 	DEBUG("pipe->cache_from_svr.data_start = 0x%016lx\n", (long)pipe->cache_from_svr.data_start);
 	DEBUG("pipe->cache_from_svr.data_end = 0x%016lx\n", (long)pipe->cache_from_svr.data_end);
 	DEBUG("pipe->cache_from_svr.cache = 0x%016lx\n", (long)pipe->cache_from_svr.cache);
+#endif
 }
 
 static data_pipe_t* get_opening_pipe(void)
@@ -287,7 +290,6 @@ static uint32_t write_cache(data_pipe_t *pipe, cyclic_cache_t *cache,
 	uint32_t empty_size = 0;
 	char *cache_end = NULL;
 	uint32_t tmp_id = pipe->id;
-	uint32_t mode = pipe->mode;
 	int wait_status = 0;
 
 	while (pipe->status == STATUS_OPENED && *to_write_size > 0 && pipe->id == tmp_id && wait_status == 0) {
@@ -352,10 +354,7 @@ static uint32_t write_cache(data_pipe_t *pipe, cyclic_cache_t *cache,
 
 	*to_write_size = finished_size;
 
-	if (mode == MODE_BLOCKING)
-		return *to_write_size ? TEEC_SUCCESS : TEEC_ERROR_COMMUNICATION;
-	else
-		return TEEC_SUCCESS;
+	return TEEC_SUCCESS;
 }
 
 #define ONCE_COPY_TO_USER(to, from, size) \
@@ -373,7 +372,6 @@ static uint32_t read_cache(data_pipe_t *pipe, cyclic_cache_t *cache,
 	uint32_t readable_size = 0;
 	char *cache_end = NULL;
 	uint32_t tmp_id = pipe->id;
-	uint32_t mode = pipe->mode;
 	int wait_status = 0;
 
 	while (pipe->status == STATUS_OPENED && *buf_size > 0 && pipe->id == tmp_id && wait_status == 0) {
@@ -429,10 +427,7 @@ static uint32_t read_cache(data_pipe_t *pipe, cyclic_cache_t *cache,
 
 	*buf_size = finished_size;
 
-	if (mode == MODE_BLOCKING)
-		return *buf_size ? TEEC_SUCCESS : TEEC_ERROR_COMMUNICATION;
-	else
-		return TEEC_SUCCESS;
+	return TEEC_SUCCESS;
 }
 
 static uint32_t close_pipe_by_id(uint32_t pipe_id)
@@ -442,14 +437,17 @@ static uint32_t close_pipe_by_id(uint32_t pipe_id)
 	cyclic_cache_t *cache_from_svr = NULL;
 
 	pipe_ptr = get_pipe_by_id(pipe_id);
+
 	if (!pipe_ptr) {
 		INFO("data pipe had been closed\n");
 		return TEEC_SUCCESS;
 	}
 
+	mutex_lock(&pipe_ptr->pipe_lock);
+
 	if (pipe_ptr->status == STATUS_CLOSED) {
 		INFO("data pipe had been closed\n");
-		return TEEC_SUCCESS;
+		goto exit;
 	}
 
 	if (pipe_ptr->status == STATUS_OPENED) {
@@ -458,7 +456,6 @@ static uint32_t close_pipe_by_id(uint32_t pipe_id)
 		mutex_unlock(&g_pipe_cnt_lock);
 	}
 
-	mutex_lock(&pipe_ptr->pipe_lock);
 	pipe_ptr->status = STATUS_CLOSED;
 	pipe_ptr->mode = 0;
 
@@ -522,6 +519,8 @@ void init_data_pipe_set(void)
 	init_waitqueue_head(&g_wait_queue_for_accept);
 	init_waitqueue_head(&g_wait_queue_for_open);
 	init_waitqueue_head(&g_wait_queue_for_data);
+
+	DEBUG("leave function %s\n", __func__);
 }
 
 void destroy_data_pipe_set(void)
@@ -551,6 +550,8 @@ void destroy_data_pipe_set(void)
 			cache->cache = NULL;
 		}
 	}
+
+	DEBUG("leave function %s\n", __func__);
 }
 
 uint32_t tee_ioctl_open_data_pipe(struct tee_context *tee_ctx,
@@ -561,8 +562,14 @@ uint32_t tee_ioctl_open_data_pipe(struct tee_context *tee_ctx,
 
 	DEBUG("enter function %s\n", __func__);
 
+	if (g_backlog == 0) {
+		ERROR("data pipe server isn't running\n");
+		return TEE_ERROR_ACCESS_DENIED;
+	}
+
 	if (g_cur_pipe_cnt >= g_backlog) {
-		ERROR("there are too many opened data pipes\n");
+		ERROR("there are too many opened data pipes, max pipe count: %d, current pipe count: %d\n",
+				g_backlog, g_cur_pipe_cnt);
 		return TEE_ERROR_ACCESS_DENIED;
 	}
 
@@ -604,6 +611,8 @@ uint32_t tee_ioctl_open_data_pipe(struct tee_context *tee_ctx,
 		g_cur_pipe_cnt++;
 		mutex_unlock(&g_pipe_cnt_lock);
 
+		DEBUG("leave function %s\n", __func__);
+
 		return TEEC_SUCCESS;
 	} else
 		return TEEC_ERROR_OUT_OF_MEMORY;
@@ -612,6 +621,7 @@ uint32_t tee_ioctl_open_data_pipe(struct tee_context *tee_ctx,
 uint32_t tee_ioctl_close_data_pipe(struct tee_context *tee_ctx,
 		struct tee_iocl_data_pipe_context __user *user_pipe_ctx)
 {
+	uint32_t res = TEEC_SUCCESS;
 	struct tee_iocl_data_pipe_context pipe_ctx;
 
 	DEBUG("enter function %s\n", __func__);
@@ -621,7 +631,11 @@ uint32_t tee_ioctl_close_data_pipe(struct tee_context *tee_ctx,
 		return TEEC_ERROR_SECURITY;
 	}
 
-	return close_pipe_by_id(pipe_ctx.id);
+	res = close_pipe_by_id(pipe_ctx.id);
+
+	DEBUG("leave function %s\n", __func__);
+
+	return res;
 }
 
 uint32_t tee_ioctl_write_pipe_data(struct tee_context *tee_ctx,
@@ -663,9 +677,10 @@ uint32_t tee_ioctl_write_pipe_data(struct tee_context *tee_ctx,
 	}
 
 	to_write_size = pipe_ctx.data_size;
-	res = write_cache(pipe_ptr, cache, (void *)(long)pipe_ctx.data_ptr, &pipe_ctx.data_size);
-	if (res != TEEC_SUCCESS || ((pipe_ptr->mode == MODE_BLOCKING) && (to_write_size != pipe_ctx.data_size))) {
+	res = write_cache(pipe_ptr, cache, (void *)(unsigned long)pipe_ctx.data_ptr, &pipe_ctx.data_size);
+	if (res != TEEC_SUCCESS || ((pipe_ptr->mode == MODE_BLOCKING) && (to_write_size != pipe_ctx.data_size)))
 		close_pipe_by_id(pipe_ptr->id);
+	if (res != TEEC_SUCCESS) {
 		ERROR("write_cache failed\n");
 		return res;
 	}
@@ -675,6 +690,8 @@ uint32_t tee_ioctl_write_pipe_data(struct tee_context *tee_ctx,
 		return TEEC_ERROR_SECURITY;
 	}
 
+	DEBUG("leave function %s\n", __func__);
+
 	return TEEC_SUCCESS;
 }
 
@@ -717,9 +734,10 @@ uint32_t tee_ioctl_read_pipe_data(struct tee_context *tee_ctx,
 	}
 
 	to_read_size = pipe_ctx.data_size;
-	res = read_cache(pipe_ptr, cache, (void *)(long)pipe_ctx.data_ptr, &pipe_ctx.data_size);
-	if (res != TEEC_SUCCESS || ((pipe_ptr->mode == MODE_BLOCKING) && (to_read_size != pipe_ctx.data_size))) {
+	res = read_cache(pipe_ptr, cache, (void *)(unsigned long)pipe_ctx.data_ptr, &pipe_ctx.data_size);
+	if (res != TEEC_SUCCESS || ((pipe_ptr->mode == MODE_BLOCKING) && (to_read_size != pipe_ctx.data_size)))
 		close_pipe_by_id(pipe_ptr->id);
+	if (res != TEEC_SUCCESS) {
 		ERROR("read_cache failed\n");
 		return res;
 	}
@@ -729,6 +747,8 @@ uint32_t tee_ioctl_read_pipe_data(struct tee_context *tee_ctx,
 		return TEEC_ERROR_SECURITY;
 	}
 
+	DEBUG("leave function %s\n", __func__);
+
 	return TEEC_SUCCESS;
 }
 
@@ -742,9 +762,11 @@ uint32_t tee_ioctl_listen_data_pipe(struct tee_context *tee_ctx,
 		return TEEC_ERROR_SECURITY;
 	}
 
-	if (g_backlog > MAX_NUM_DATA_PIPE)
+	if (g_backlog > MAX_NUM_DATA_PIPE || g_backlog == 0)
 		g_backlog = MAX_NUM_DATA_PIPE;
 
+	DEBUG("leave function %s\n", __func__);
+
 	return TEEC_SUCCESS;
 }
 
@@ -769,9 +791,6 @@ uint32_t tee_ioctl_accept_data_pipe(struct tee_context *tee_ctx,
 
 	if (pipe) {
 		if (copy_to_user(user_pipe_id, &pipe->id, sizeof(uint32_t))) {
-			mutex_lock(&pipe->pipe_lock);
-			pipe->status = STATUS_CLOSED;
-			mutex_unlock(&pipe->pipe_lock);
 			ERROR("copy_to_user failed\n");
 			res = TEEC_ERROR_SECURITY;
 		} else {
@@ -787,5 +806,7 @@ uint32_t tee_ioctl_accept_data_pipe(struct tee_context *tee_ctx,
 exit:
 	wake_up_interruptible(&g_wait_queue_for_open);
 
+	DEBUG("leave function %s\n", __func__);
+
 	return res;
 }