| /* |
| * Copyright (c) 2015, Linaro Limited |
| * |
| * This software is licensed under the terms of the GNU General Public |
| * License version 2, as published by the Free Software Foundation, and |
| * may be copied, distributed, and modified under those terms. |
| * |
| * This program is distributed in the hope that it will be useful, |
| * but WITHOUT ANY WARRANTY; without even the implied warranty of |
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
| * GNU General Public License for more details. |
| * |
| */ |
| #include <linux/arm-smccc.h> |
| #include <linux/device.h> |
| #include <linux/err.h> |
| #include <linux/errno.h> |
| #include <linux/slab.h> |
| #include <linux/tee_drv.h> |
| #include <linux/types.h> |
| #include <linux/uaccess.h> |
| #include "optee_private.h" |
| #include "optee_smc.h" |
| |
| struct optee_call_waiter { |
| struct list_head list_node; |
| struct completion c; |
| }; |
| |
| static void optee_cq_wait_init(struct optee_call_queue *cq, |
| struct optee_call_waiter *w) |
| { |
| /* |
| * We're preparing to make a call to secure world. In case we can't |
| * allocate a thread in secure world we'll end up waiting in |
| * optee_cq_wait_for_completion(). |
| * |
| * Normally if there's no contention in secure world the call will |
| * complete and we can cleanup directly with optee_cq_wait_final(). |
| */ |
| mutex_lock(&cq->mutex); |
| |
| /* |
| * We add ourselves to the queue, but we don't wait. This |
| * guarantees that we don't lose a completion if secure world |
| * returns busy and another thread just exited and try to complete |
| * someone. |
| */ |
| init_completion(&w->c); |
| list_add_tail(&w->list_node, &cq->waiters); |
| |
| mutex_unlock(&cq->mutex); |
| } |
| |
| static void optee_cq_wait_for_completion(struct optee_call_queue *cq, |
| struct optee_call_waiter *w) |
| { |
| wait_for_completion(&w->c); |
| |
| mutex_lock(&cq->mutex); |
| |
| /* Move to end of list to get out of the way for other waiters */ |
| list_del(&w->list_node); |
| reinit_completion(&w->c); |
| list_add_tail(&w->list_node, &cq->waiters); |
| |
| mutex_unlock(&cq->mutex); |
| } |
| |
| static void optee_cq_complete_one(struct optee_call_queue *cq) |
| { |
| struct optee_call_waiter *w; |
| |
| list_for_each_entry(w, &cq->waiters, list_node) { |
| if (!completion_done(&w->c)) { |
| complete(&w->c); |
| break; |
| } |
| } |
| } |
| |
| static void optee_cq_wait_final(struct optee_call_queue *cq, |
| struct optee_call_waiter *w) |
| { |
| /* |
| * We're done with the call to secure world. The thread in secure |
| * world that was used for this call is now available for some |
| * other task to use. |
| */ |
| mutex_lock(&cq->mutex); |
| |
| /* Get out of the list */ |
| list_del(&w->list_node); |
| |
| /* Wake up one eventual waiting task */ |
| optee_cq_complete_one(cq); |
| |
| /* |
| * If we're completed we've got a completion from another task that |
| * was just done with its call to secure world. Since yet another |
| * thread now is available in secure world wake up another eventual |
| * waiting task. |
| */ |
| if (completion_done(&w->c)) |
| optee_cq_complete_one(cq); |
| |
| mutex_unlock(&cq->mutex); |
| } |
| |
| /* Requires the filpstate mutex to be held */ |
| static struct optee_session *find_session(struct optee_context_data *ctxdata, |
| u32 session_id) |
| { |
| struct optee_session *sess; |
| |
| list_for_each_entry(sess, &ctxdata->sess_list, list_node) |
| if (sess->session_id == session_id) |
| return sess; |
| |
| return NULL; |
| } |
| |
| /** |
| * optee_do_call_with_arg() - Do an SMC to OP-TEE in secure world |
| * @ctx: calling context |
| * @parg: physical address of message to pass to secure world |
| * |
| * Does and SMC to OP-TEE in secure world and handles eventual resulting |
| * Remote Procedure Calls (RPC) from OP-TEE. |
| * |
| * Returns return code from secure world, 0 is OK |
| */ |
| u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg) |
| { |
| struct optee *optee = tee_get_drvdata(ctx->teedev); |
| struct optee_call_waiter w; |
| struct optee_rpc_param param = { }; |
| u32 ret; |
| |
| param.a0 = OPTEE_SMC_CALL_WITH_ARG; |
| reg_pair_from_64(¶m.a1, ¶m.a2, parg); |
| /* Initialize waiter */ |
| optee_cq_wait_init(&optee->call_queue, &w); |
| while (true) { |
| struct arm_smccc_res res; |
| |
| optee->invoke_fn(param.a0, param.a1, param.a2, param.a3, |
| param.a4, param.a5, param.a6, param.a7, |
| &res); |
| |
| if (res.a0 == OPTEE_SMC_RETURN_ETHREAD_LIMIT) { |
| /* |
| * Out of threads in secure world, wait for a thread |
| * become available. |
| */ |
| optee_cq_wait_for_completion(&optee->call_queue, &w); |
| } else if (OPTEE_SMC_RETURN_IS_RPC(res.a0)) { |
| param.a0 = res.a0; |
| param.a1 = res.a1; |
| param.a2 = res.a2; |
| param.a3 = res.a3; |
| optee_handle_rpc(ctx, ¶m); |
| } else { |
| ret = res.a0; |
| break; |
| } |
| } |
| |
| /* |
| * We're done with our thread in secure world, if there's any |
| * thread waiters wake up one. |
| */ |
| optee_cq_wait_final(&optee->call_queue, &w); |
| |
| return ret; |
| } |
| |
| static struct tee_shm *get_msg_arg(struct tee_context *ctx, size_t num_params, |
| struct optee_msg_arg **msg_arg, |
| phys_addr_t *msg_parg) |
| { |
| int rc; |
| struct tee_shm *shm; |
| struct optee_msg_arg *ma; |
| |
| shm = tee_shm_alloc(ctx, OPTEE_MSG_GET_ARG_SIZE(num_params), |
| TEE_SHM_MAPPED); |
| if (IS_ERR(shm)) |
| return shm; |
| |
| ma = tee_shm_get_va(shm, 0); |
| if (IS_ERR(ma)) { |
| rc = PTR_ERR(ma); |
| goto out; |
| } |
| |
| rc = tee_shm_get_pa(shm, 0, msg_parg); |
| if (rc) |
| goto out; |
| |
| memset(ma, 0, OPTEE_MSG_GET_ARG_SIZE(num_params)); |
| ma->num_params = num_params; |
| *msg_arg = ma; |
| out: |
| if (rc) { |
| tee_shm_free(shm); |
| return ERR_PTR(rc); |
| } |
| |
| return shm; |
| } |
| |
| int optee_open_session(struct tee_context *ctx, |
| struct tee_ioctl_open_session_arg *arg, |
| struct tee_param *param) |
| { |
| struct optee_context_data *ctxdata = ctx->data; |
| int rc; |
| struct tee_shm *shm; |
| struct optee_msg_arg *msg_arg; |
| phys_addr_t msg_parg; |
| struct optee_session *sess = NULL; |
| |
| /* +2 for the meta parameters added below */ |
| shm = get_msg_arg(ctx, arg->num_params + 2, &msg_arg, &msg_parg); |
| if (IS_ERR(shm)) |
| return PTR_ERR(shm); |
| |
| msg_arg->cmd = OPTEE_MSG_CMD_OPEN_SESSION; |
| msg_arg->cancel_id = arg->cancel_id; |
| |
| /* |
| * Initialize and add the meta parameters needed when opening a |
| * session. |
| */ |
| msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT | |
| OPTEE_MSG_ATTR_META; |
| msg_arg->params[1].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT | |
| OPTEE_MSG_ATTR_META; |
| memcpy(&msg_arg->params[0].u.value, arg->uuid, sizeof(arg->uuid)); |
| memcpy(&msg_arg->params[1].u.value, arg->uuid, sizeof(arg->clnt_uuid)); |
| msg_arg->params[1].u.value.c = arg->clnt_login; |
| |
| rc = optee_to_msg_param(msg_arg->params + 2, arg->num_params, param); |
| if (rc) |
| goto out; |
| |
| sess = kzalloc(sizeof(*sess), GFP_KERNEL); |
| if (!sess) { |
| rc = -ENOMEM; |
| goto out; |
| } |
| |
| if (optee_do_call_with_arg(ctx, msg_parg)) { |
| msg_arg->ret = TEEC_ERROR_COMMUNICATION; |
| msg_arg->ret_origin = TEEC_ORIGIN_COMMS; |
| } |
| |
| if (msg_arg->ret == TEEC_SUCCESS) { |
| /* A new session has been created, add it to the list. */ |
| sess->session_id = msg_arg->session; |
| mutex_lock(&ctxdata->mutex); |
| list_add(&sess->list_node, &ctxdata->sess_list); |
| mutex_unlock(&ctxdata->mutex); |
| } else { |
| kfree(sess); |
| } |
| |
| if (optee_from_msg_param(param, arg->num_params, msg_arg->params + 2)) { |
| arg->ret = TEEC_ERROR_COMMUNICATION; |
| arg->ret_origin = TEEC_ORIGIN_COMMS; |
| /* Close session again to avoid leakage */ |
| optee_close_session(ctx, msg_arg->session); |
| } else { |
| arg->session = msg_arg->session; |
| arg->ret = msg_arg->ret; |
| arg->ret_origin = msg_arg->ret_origin; |
| } |
| out: |
| tee_shm_free(shm); |
| |
| return rc; |
| } |
| |
| int optee_close_session(struct tee_context *ctx, u32 session) |
| { |
| struct optee_context_data *ctxdata = ctx->data; |
| struct tee_shm *shm; |
| struct optee_msg_arg *msg_arg; |
| phys_addr_t msg_parg; |
| struct optee_session *sess; |
| |
| /* Check that the session is valid and remove it from the list */ |
| mutex_lock(&ctxdata->mutex); |
| sess = find_session(ctxdata, session); |
| if (sess) |
| list_del(&sess->list_node); |
| mutex_unlock(&ctxdata->mutex); |
| if (!sess) |
| return -EINVAL; |
| kfree(sess); |
| |
| shm = get_msg_arg(ctx, 0, &msg_arg, &msg_parg); |
| if (IS_ERR(shm)) |
| return PTR_ERR(shm); |
| |
| msg_arg->cmd = OPTEE_MSG_CMD_CLOSE_SESSION; |
| msg_arg->session = session; |
| optee_do_call_with_arg(ctx, msg_parg); |
| |
| tee_shm_free(shm); |
| return 0; |
| } |
| |
| int optee_invoke_func(struct tee_context *ctx, struct tee_ioctl_invoke_arg *arg, |
| struct tee_param *param) |
| { |
| struct optee_context_data *ctxdata = ctx->data; |
| struct tee_shm *shm; |
| struct optee_msg_arg *msg_arg; |
| phys_addr_t msg_parg; |
| struct optee_session *sess; |
| int rc; |
| |
| /* Check that the session is valid */ |
| mutex_lock(&ctxdata->mutex); |
| sess = find_session(ctxdata, arg->session); |
| mutex_unlock(&ctxdata->mutex); |
| if (!sess) |
| return -EINVAL; |
| |
| shm = get_msg_arg(ctx, arg->num_params, &msg_arg, &msg_parg); |
| if (IS_ERR(shm)) |
| return PTR_ERR(shm); |
| msg_arg->cmd = OPTEE_MSG_CMD_INVOKE_COMMAND; |
| msg_arg->func = arg->func; |
| msg_arg->session = arg->session; |
| msg_arg->cancel_id = arg->cancel_id; |
| |
| rc = optee_to_msg_param(msg_arg->params, arg->num_params, param); |
| if (rc) |
| goto out; |
| |
| if (optee_do_call_with_arg(ctx, msg_parg)) { |
| msg_arg->ret = TEEC_ERROR_COMMUNICATION; |
| msg_arg->ret_origin = TEEC_ORIGIN_COMMS; |
| } |
| |
| if (optee_from_msg_param(param, arg->num_params, msg_arg->params)) { |
| msg_arg->ret = TEEC_ERROR_COMMUNICATION; |
| msg_arg->ret_origin = TEEC_ORIGIN_COMMS; |
| } |
| |
| arg->ret = msg_arg->ret; |
| arg->ret_origin = msg_arg->ret_origin; |
| out: |
| tee_shm_free(shm); |
| return rc; |
| } |
| |
| int optee_cancel_req(struct tee_context *ctx, u32 cancel_id, u32 session) |
| { |
| struct optee_context_data *ctxdata = ctx->data; |
| struct tee_shm *shm; |
| struct optee_msg_arg *msg_arg; |
| phys_addr_t msg_parg; |
| struct optee_session *sess; |
| |
| /* Check that the session is valid */ |
| mutex_lock(&ctxdata->mutex); |
| sess = find_session(ctxdata, session); |
| mutex_unlock(&ctxdata->mutex); |
| if (!sess) |
| return -EINVAL; |
| |
| shm = get_msg_arg(ctx, 0, &msg_arg, &msg_parg); |
| if (IS_ERR(shm)) |
| return PTR_ERR(shm); |
| |
| msg_arg->cmd = OPTEE_MSG_CMD_CANCEL; |
| msg_arg->session = session; |
| msg_arg->cancel_id = cancel_id; |
| optee_do_call_with_arg(ctx, msg_parg); |
| |
| tee_shm_free(shm); |
| return 0; |
| } |
| |
| /** |
| * optee_enable_shm_cache() - Enables caching of some shared memory allocation |
| * in OP-TEE |
| * @optee: main service struct |
| */ |
| void optee_enable_shm_cache(struct optee *optee) |
| { |
| struct optee_call_waiter w; |
| |
| /* We need to retry until secure world isn't busy. */ |
| optee_cq_wait_init(&optee->call_queue, &w); |
| while (true) { |
| struct arm_smccc_res res; |
| |
| optee->invoke_fn(OPTEE_SMC_ENABLE_SHM_CACHE, 0, 0, 0, 0, 0, 0, |
| 0, &res); |
| if (res.a0 == OPTEE_SMC_RETURN_OK) |
| break; |
| optee_cq_wait_for_completion(&optee->call_queue, &w); |
| } |
| optee_cq_wait_final(&optee->call_queue, &w); |
| } |
| |
| /** |
| * optee_disable_shm_cache() - Disables caching of some shared memory allocation |
| * in OP-TEE |
| * @optee: main service struct |
| */ |
| void optee_disable_shm_cache(struct optee *optee) |
| { |
| struct optee_call_waiter w; |
| |
| /* We need to retry until secure world isn't busy. */ |
| optee_cq_wait_init(&optee->call_queue, &w); |
| while (true) { |
| union { |
| struct arm_smccc_res smccc; |
| struct optee_smc_disable_shm_cache_result result; |
| } res; |
| |
| optee->invoke_fn(OPTEE_SMC_DISABLE_SHM_CACHE, 0, 0, 0, 0, 0, 0, |
| 0, &res.smccc); |
| if (res.result.status == OPTEE_SMC_RETURN_ENOTAVAIL) |
| break; /* All shm's freed */ |
| if (res.result.status == OPTEE_SMC_RETURN_OK) { |
| struct tee_shm *shm; |
| |
| shm = reg_pair_to_ptr(res.result.shm_upper32, |
| res.result.shm_lower32); |
| tee_shm_free(shm); |
| } else { |
| optee_cq_wait_for_completion(&optee->call_queue, &w); |
| } |
| } |
| optee_cq_wait_final(&optee->call_queue, &w); |
| } |