LXR linux/drivers/tee/tee

   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * Copyright (c) 2015-2016, Linaro Limited
   4 */
   5
   6#define pr_fmt(fmt) "%s: " fmt, __func__
   7
   8#include <linux/cdev.h>
   9#include <linux/fs.h>
  10#include <linux/idr.h>
  11#include <linux/module.h>
  12#include <linux/slab.h>
  13#include <linux/tee_drv.h>
  14#include <linux/uaccess.h>
  15#include "tee_private.h"
  16
  17#define TEE_NUM_DEVICES 32
  18
  19#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x))
  20
  21/*
  22 * Unprivileged devices in the lower half range and privileged devices in
  23 * the upper half range.
  24 */
  25static DECLARE_BITMAP(dev_mask, TEE_NUM_DEVICES);
  26static DEFINE_SPINLOCK(driver_lock);
  27
  28static struct class *tee_class;
  29static dev_t tee_devt;
  30
  31static struct tee_context *teedev_open(struct tee_device *teedev)
  32{
  33        int rc;
  34        struct tee_context *ctx;
  35
  36        if (!tee_device_get(teedev))
  37                return ERR_PTR(-EINVAL);
  38
  39        ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
  40        if (!ctx) {
  41                rc = -ENOMEM;
  42                goto err;
  43        }
  44
  45        kref_init(&ctx->refcount);
  46        ctx->teedev = teedev;
  47        INIT_LIST_HEAD(&ctx->list_shm);
  48        rc = teedev->desc->ops->open(ctx);
  49        if (rc)
  50                goto err;
  51
  52        return ctx;
  53err:
  54        kfree(ctx);
  55        tee_device_put(teedev);
  56        return ERR_PTR(rc);
  57
  58}
  59
  60void teedev_ctx_get(struct tee_context *ctx)
  61{
  62        if (ctx->releasing)
  63                return;
  64
  65        kref_get(&ctx->refcount);
  66}
  67
  68static void teedev_ctx_release(struct kref *ref)
  69{
  70        struct tee_context *ctx = container_of(ref, struct tee_context,
  71                                               refcount);
  72        ctx->releasing = true;
  73        ctx->teedev->desc->ops->release(ctx);
  74        kfree(ctx);
  75}
  76
  77void teedev_ctx_put(struct tee_context *ctx)
  78{
  79        if (ctx->releasing)
  80                return;
  81
  82        kref_put(&ctx->refcount, teedev_ctx_release);
  83}
  84
  85static void teedev_close_context(struct tee_context *ctx)
  86{
  87        tee_device_put(ctx->teedev);
  88        teedev_ctx_put(ctx);
  89}
  90
  91static int tee_open(struct inode *inode, struct file *filp)
  92{
  93        struct tee_context *ctx;
  94
  95        ctx = teedev_open(container_of(inode->i_cdev, struct tee_device, cdev));
  96        if (IS_ERR(ctx))
  97                return PTR_ERR(ctx);
  98
  99        /*
 100         * Default user-space behaviour is to wait for tee-supplicant
 101         * if not present for any requests in this context.
 102         */
 103        ctx->supp_nowait = false;
 104        filp->private_data = ctx;
 105        return 0;
 106}
 107
 108static int tee_release(struct inode *inode, struct file *filp)
 109{
 110        teedev_close_context(filp->private_data);
 111        return 0;
 112}
 113
 114static int tee_ioctl_version(struct tee_context *ctx,
 115                             struct tee_ioctl_version_data __user *uvers)
 116{
 117        struct tee_ioctl_version_data vers;
 118
 119        ctx->teedev->desc->ops->get_version(ctx->teedev, &vers);
 120
 121        if (ctx->teedev->desc->flags & TEE_DESC_PRIVILEGED)
 122                vers.gen_caps |= TEE_GEN_CAP_PRIVILEGED;
 123
 124        if (copy_to_user(uvers, &vers, sizeof(vers)))
 125                return -EFAULT;
 126
 127        return 0;
 128}
 129
 130static int tee_ioctl_shm_alloc(struct tee_context *ctx,
 131                               struct tee_ioctl_shm_alloc_data __user *udata)
 132{
 133        long ret;
 134        struct tee_ioctl_shm_alloc_data data;
 135        struct tee_shm *shm;
 136
 137        if (copy_from_user(&data, udata, sizeof(data)))
 138                return -EFAULT;
 139
 140        /* Currently no input flags are supported */
 141        if (data.flags)
 142                return -EINVAL;
 143
 144        shm = tee_shm_alloc(ctx, data.size, TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
 145        if (IS_ERR(shm))
 146                return PTR_ERR(shm);
 147
 148        data.id = shm->id;
 149        data.flags = shm->flags;
 150        data.size = shm->size;
 151
 152        if (copy_to_user(udata, &data, sizeof(data)))
 153                ret = -EFAULT;
 154        else
 155                ret = tee_shm_get_fd(shm);
 156
 157        /*
 158         * When user space closes the file descriptor the shared memory
 159         * should be freed or if tee_shm_get_fd() failed then it will
 160         * be freed immediately.
 161         */
 162        tee_shm_put(shm);
 163        return ret;
 164}
 165
 166static int
 167tee_ioctl_shm_register(struct tee_context *ctx,
 168                       struct tee_ioctl_shm_register_data __user *udata)
 169{
 170        long ret;
 171        struct tee_ioctl_shm_register_data data;
 172        struct tee_shm *shm;
 173
 174        if (copy_from_user(&data, udata, sizeof(data)))
 175                return -EFAULT;
 176
 177        /* Currently no input flags are supported */
 178        if (data.flags)
 179                return -EINVAL;
 180
 181        shm = tee_shm_register(ctx, data.addr, data.length,
 182                               TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED);
 183        if (IS_ERR(shm))
 184                return PTR_ERR(shm);
 185
 186        data.id = shm->id;
 187        data.flags = shm->flags;
 188        data.length = shm->size;
 189
 190        if (copy_to_user(udata, &data, sizeof(data)))
 191                ret = -EFAULT;
 192        else
 193                ret = tee_shm_get_fd(shm);
 194        /*
 195         * When user space closes the file descriptor the shared memory
 196         * should be freed or if tee_shm_get_fd() failed then it will
 197         * be freed immediately.
 198         */
 199        tee_shm_put(shm);
 200        return ret;
 201}
 202
 203static int params_from_user(struct tee_context *ctx, struct tee_param *params,
 204                            size_t num_params,
 205                            struct tee_ioctl_param __user *uparams)
 206{
 207        size_t n;
 208
 209        for (n = 0; n < num_params; n++) {
 210                struct tee_shm *shm;
 211                struct tee_ioctl_param ip;
 212
 213                if (copy_from_user(&ip, uparams + n, sizeof(ip)))
 214                        return -EFAULT;
 215
 216                /* All unused attribute bits has to be zero */
 217                if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK)
 218                        return -EINVAL;
 219
 220                params[n].attr = ip.attr;
 221                switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
 222                case TEE_IOCTL_PARAM_ATTR_TYPE_NONE:
 223                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
 224                        break;
 225                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
 226                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 227                        params[n].u.value.a = ip.a;
 228                        params[n].u.value.b = ip.b;
 229                        params[n].u.value.c = ip.c;
 230                        break;
 231                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
 232                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 233                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 234                        /*
 235                         * If we fail to get a pointer to a shared memory
 236                         * object (and increase the ref count) from an
 237                         * identifier we return an error. All pointers that
 238                         * has been added in params have an increased ref
 239                         * count. It's the callers responibility to do
 240                         * tee_shm_put() on all resolved pointers.
 241                         */
 242                        shm = tee_shm_get_from_id(ctx, ip.c);
 243                        if (IS_ERR(shm))
 244                                return PTR_ERR(shm);
 245
 246                        /*
 247                         * Ensure offset + size does not overflow offset
 248                         * and does not overflow the size of the referred
 249                         * shared memory object.
 250                         */
 251                        if ((ip.a + ip.b) < ip.a ||
 252                            (ip.a + ip.b) > shm->size) {
 253                                tee_shm_put(shm);
 254                                return -EINVAL;
 255                        }
 256
 257                        params[n].u.memref.shm_offs = ip.a;
 258                        params[n].u.memref.size = ip.b;
 259                        params[n].u.memref.shm = shm;
 260                        break;
 261                default:
 262                        /* Unknown attribute */
 263                        return -EINVAL;
 264                }
 265        }
 266        return 0;
 267}
 268
 269static int params_to_user(struct tee_ioctl_param __user *uparams,
 270                          size_t num_params, struct tee_param *params)
 271{
 272        size_t n;
 273
 274        for (n = 0; n < num_params; n++) {
 275                struct tee_ioctl_param __user *up = uparams + n;
 276                struct tee_param *p = params + n;
 277
 278                switch (p->attr) {
 279                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
 280                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 281                        if (put_user(p->u.value.a, &up->a) ||
 282                            put_user(p->u.value.b, &up->b) ||
 283                            put_user(p->u.value.c, &up->c))
 284                                return -EFAULT;
 285                        break;
 286                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 287                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 288                        if (put_user((u64)p->u.memref.size, &up->b))
 289                                return -EFAULT;
 290                default:
 291                        break;
 292                }
 293        }
 294        return 0;
 295}
 296
 297static int tee_ioctl_open_session(struct tee_context *ctx,
 298                                  struct tee_ioctl_buf_data __user *ubuf)
 299{
 300        int rc;
 301        size_t n;
 302        struct tee_ioctl_buf_data buf;
 303        struct tee_ioctl_open_session_arg __user *uarg;
 304        struct tee_ioctl_open_session_arg arg;
 305        struct tee_ioctl_param __user *uparams = NULL;
 306        struct tee_param *params = NULL;
 307        bool have_session = false;
 308
 309        if (!ctx->teedev->desc->ops->open_session)
 310                return -EINVAL;
 311
 312        if (copy_from_user(&buf, ubuf, sizeof(buf)))
 313                return -EFAULT;
 314
 315        if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 316            buf.buf_len < sizeof(struct tee_ioctl_open_session_arg))
 317                return -EINVAL;
 318
 319        uarg = u64_to_user_ptr(buf.buf_ptr);
 320        if (copy_from_user(&arg, uarg, sizeof(arg)))
 321                return -EFAULT;
 322
 323        if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
 324                return -EINVAL;
 325
 326        if (arg.num_params) {
 327                params = kcalloc(arg.num_params, sizeof(struct tee_param),
 328                                 GFP_KERNEL);
 329                if (!params)
 330                        return -ENOMEM;
 331                uparams = uarg->params;
 332                rc = params_from_user(ctx, params, arg.num_params, uparams);
 333                if (rc)
 334                        goto out;
 335        }
 336
 337        rc = ctx->teedev->desc->ops->open_session(ctx, &arg, params);
 338        if (rc)
 339                goto out;
 340        have_session = true;
 341
 342        if (put_user(arg.session, &uarg->session) ||
 343            put_user(arg.ret, &uarg->ret) ||
 344            put_user(arg.ret_origin, &uarg->ret_origin)) {
 345                rc = -EFAULT;
 346                goto out;
 347        }
 348        rc = params_to_user(uparams, arg.num_params, params);
 349out:
 350        /*
 351         * If we've succeeded to open the session but failed to communicate
 352         * it back to user space, close the session again to avoid leakage.
 353         */
 354        if (rc && have_session && ctx->teedev->desc->ops->close_session)
 355                ctx->teedev->desc->ops->close_session(ctx, arg.session);
 356
 357        if (params) {
 358                /* Decrease ref count for all valid shared memory pointers */
 359                for (n = 0; n < arg.num_params; n++)
 360                        if (tee_param_is_memref(params + n) &&
 361                            params[n].u.memref.shm)
 362                                tee_shm_put(params[n].u.memref.shm);
 363                kfree(params);
 364        }
 365
 366        return rc;
 367}
 368
 369static int tee_ioctl_invoke(struct tee_context *ctx,
 370                            struct tee_ioctl_buf_data __user *ubuf)
 371{
 372        int rc;
 373        size_t n;
 374        struct tee_ioctl_buf_data buf;
 375        struct tee_ioctl_invoke_arg __user *uarg;
 376        struct tee_ioctl_invoke_arg arg;
 377        struct tee_ioctl_param __user *uparams = NULL;
 378        struct tee_param *params = NULL;
 379
 380        if (!ctx->teedev->desc->ops->invoke_func)
 381                return -EINVAL;
 382
 383        if (copy_from_user(&buf, ubuf, sizeof(buf)))
 384                return -EFAULT;
 385
 386        if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 387            buf.buf_len < sizeof(struct tee_ioctl_invoke_arg))
 388                return -EINVAL;
 389
 390        uarg = u64_to_user_ptr(buf.buf_ptr);
 391        if (copy_from_user(&arg, uarg, sizeof(arg)))
 392                return -EFAULT;
 393
 394        if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
 395                return -EINVAL;
 396
 397        if (arg.num_params) {
 398                params = kcalloc(arg.num_params, sizeof(struct tee_param),
 399                                 GFP_KERNEL);
 400                if (!params)
 401                        return -ENOMEM;
 402                uparams = uarg->params;
 403                rc = params_from_user(ctx, params, arg.num_params, uparams);
 404                if (rc)
 405                        goto out;
 406        }
 407
 408        rc = ctx->teedev->desc->ops->invoke_func(ctx, &arg, params);
 409        if (rc)
 410                goto out;
 411
 412        if (put_user(arg.ret, &uarg->ret) ||
 413            put_user(arg.ret_origin, &uarg->ret_origin)) {
 414                rc = -EFAULT;
 415                goto out;
 416        }
 417        rc = params_to_user(uparams, arg.num_params, params);
 418out:
 419        if (params) {
 420                /* Decrease ref count for all valid shared memory pointers */
 421                for (n = 0; n < arg.num_params; n++)
 422                        if (tee_param_is_memref(params + n) &&
 423                            params[n].u.memref.shm)
 424                                tee_shm_put(params[n].u.memref.shm);
 425                kfree(params);
 426        }
 427        return rc;
 428}
 429
 430static int tee_ioctl_cancel(struct tee_context *ctx,
 431                            struct tee_ioctl_cancel_arg __user *uarg)
 432{
 433        struct tee_ioctl_cancel_arg arg;
 434
 435        if (!ctx->teedev->desc->ops->cancel_req)
 436                return -EINVAL;
 437
 438        if (copy_from_user(&arg, uarg, sizeof(arg)))
 439                return -EFAULT;
 440
 441        return ctx->teedev->desc->ops->cancel_req(ctx, arg.cancel_id,
 442                                                  arg.session);
 443}
 444
 445static int
 446tee_ioctl_close_session(struct tee_context *ctx,
 447                        struct tee_ioctl_close_session_arg __user *uarg)
 448{
 449        struct tee_ioctl_close_session_arg arg;
 450
 451        if (!ctx->teedev->desc->ops->close_session)
 452                return -EINVAL;
 453
 454        if (copy_from_user(&arg, uarg, sizeof(arg)))
 455                return -EFAULT;
 456
 457        return ctx->teedev->desc->ops->close_session(ctx, arg.session);
 458}
 459
 460static int params_to_supp(struct tee_context *ctx,
 461                          struct tee_ioctl_param __user *uparams,
 462                          size_t num_params, struct tee_param *params)
 463{
 464        size_t n;
 465
 466        for (n = 0; n < num_params; n++) {
 467                struct tee_ioctl_param ip;
 468                struct tee_param *p = params + n;
 469
 470                ip.attr = p->attr;
 471                switch (p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
 472                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
 473                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 474                        ip.a = p->u.value.a;
 475                        ip.b = p->u.value.b;
 476                        ip.c = p->u.value.c;
 477                        break;
 478                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
 479                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 480                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 481                        ip.b = p->u.memref.size;
 482                        if (!p->u.memref.shm) {
 483                                ip.a = 0;
 484                                ip.c = (u64)-1; /* invalid shm id */
 485                                break;
 486                        }
 487                        ip.a = p->u.memref.shm_offs;
 488                        ip.c = p->u.memref.shm->id;
 489                        break;
 490                default:
 491                        ip.a = 0;
 492                        ip.b = 0;
 493                        ip.c = 0;
 494                        break;
 495                }
 496
 497                if (copy_to_user(uparams + n, &ip, sizeof(ip)))
 498                        return -EFAULT;
 499        }
 500
 501        return 0;
 502}
 503
 504static int tee_ioctl_supp_recv(struct tee_context *ctx,
 505                               struct tee_ioctl_buf_data __user *ubuf)
 506{
 507        int rc;
 508        struct tee_ioctl_buf_data buf;
 509        struct tee_iocl_supp_recv_arg __user *uarg;
 510        struct tee_param *params;
 511        u32 num_params;
 512        u32 func;
 513
 514        if (!ctx->teedev->desc->ops->supp_recv)
 515                return -EINVAL;
 516
 517        if (copy_from_user(&buf, ubuf, sizeof(buf)))
 518                return -EFAULT;
 519
 520        if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 521            buf.buf_len < sizeof(struct tee_iocl_supp_recv_arg))
 522                return -EINVAL;
 523
 524        uarg = u64_to_user_ptr(buf.buf_ptr);
 525        if (get_user(num_params, &uarg->num_params))
 526                return -EFAULT;
 527
 528        if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len)
 529                return -EINVAL;
 530
 531        params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
 532        if (!params)
 533                return -ENOMEM;
 534
 535        rc = params_from_user(ctx, params, num_params, uarg->params);
 536        if (rc)
 537                goto out;
 538
 539        rc = ctx->teedev->desc->ops->supp_recv(ctx, &func, &num_params, params);
 540        if (rc)
 541                goto out;
 542
 543        if (put_user(func, &uarg->func) ||
 544            put_user(num_params, &uarg->num_params)) {
 545                rc = -EFAULT;
 546                goto out;
 547        }
 548
 549        rc = params_to_supp(ctx, uarg->params, num_params, params);
 550out:
 551        kfree(params);
 552        return rc;
 553}
 554
 555static int params_from_supp(struct tee_param *params, size_t num_params,
 556                            struct tee_ioctl_param __user *uparams)
 557{
 558        size_t n;
 559
 560        for (n = 0; n < num_params; n++) {
 561                struct tee_param *p = params + n;
 562                struct tee_ioctl_param ip;
 563
 564                if (copy_from_user(&ip, uparams + n, sizeof(ip)))
 565                        return -EFAULT;
 566
 567                /* All unused attribute bits has to be zero */
 568                if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK)
 569                        return -EINVAL;
 570
 571                p->attr = ip.attr;
 572                switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
 573                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
 574                case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 575                        /* Only out and in/out values can be updated */
 576                        p->u.value.a = ip.a;
 577                        p->u.value.b = ip.b;
 578                        p->u.value.c = ip.c;
 579                        break;
 580                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 581                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 582                        /*
 583                         * Only the size of the memref can be updated.
 584                         * Since we don't have access to the original
 585                         * parameters here, only store the supplied size.
 586                         * The driver will copy the updated size into the
 587                         * original parameters.
 588                         */
 589                        p->u.memref.shm = NULL;
 590                        p->u.memref.shm_offs = 0;
 591                        p->u.memref.size = ip.b;
 592                        break;
 593                default:
 594                        memset(&p->u, 0, sizeof(p->u));
 595                        break;
 596                }
 597        }
 598        return 0;
 599}
 600
 601static int tee_ioctl_supp_send(struct tee_context *ctx,
 602                               struct tee_ioctl_buf_data __user *ubuf)
 603{
 604        long rc;
 605        struct tee_ioctl_buf_data buf;
 606        struct tee_iocl_supp_send_arg __user *uarg;
 607        struct tee_param *params;
 608        u32 num_params;
 609        u32 ret;
 610
 611        /* Not valid for this driver */
 612        if (!ctx->teedev->desc->ops->supp_send)
 613                return -EINVAL;
 614
 615        if (copy_from_user(&buf, ubuf, sizeof(buf)))
 616                return -EFAULT;
 617
 618        if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 619            buf.buf_len < sizeof(struct tee_iocl_supp_send_arg))
 620                return -EINVAL;
 621
 622        uarg = u64_to_user_ptr(buf.buf_ptr);
 623        if (get_user(ret, &uarg->ret) ||
 624            get_user(num_params, &uarg->num_params))
 625                return -EFAULT;
 626
 627        if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len)
 628                return -EINVAL;
 629
 630        params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
 631        if (!params)
 632                return -ENOMEM;
 633
 634        rc = params_from_supp(params, num_params, uarg->params);
 635        if (rc)
 636                goto out;
 637
 638        rc = ctx->teedev->desc->ops->supp_send(ctx, ret, num_params, params);
 639out:
 640        kfree(params);
 641        return rc;
 642}
 643
 644static long tee_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 645{
 646        struct tee_context *ctx = filp->private_data;
 647        void __user *uarg = (void __user *)arg;
 648
 649        switch (cmd) {
 650        case TEE_IOC_VERSION:
 651                return tee_ioctl_version(ctx, uarg);
 652        case TEE_IOC_SHM_ALLOC:
 653                return tee_ioctl_shm_alloc(ctx, uarg);
 654        case TEE_IOC_SHM_REGISTER:
 655                return tee_ioctl_shm_register(ctx, uarg);
 656        case TEE_IOC_OPEN_SESSION:
 657                return tee_ioctl_open_session(ctx, uarg);
 658        case TEE_IOC_INVOKE:
 659                return tee_ioctl_invoke(ctx, uarg);
 660        case TEE_IOC_CANCEL:
 661                return tee_ioctl_cancel(ctx, uarg);
 662        case TEE_IOC_CLOSE_SESSION:
 663                return tee_ioctl_close_session(ctx, uarg);
 664        case TEE_IOC_SUPPL_RECV:
 665                return tee_ioctl_supp_recv(ctx, uarg);
 666        case TEE_IOC_SUPPL_SEND:
 667                return tee_ioctl_supp_send(ctx, uarg);
 668        default:
 669                return -EINVAL;
 670        }
 671}
 672
 673static const struct file_operations tee_fops = {
 674        .owner = THIS_MODULE,
 675        .open = tee_open,
 676        .release = tee_release,
 677        .unlocked_ioctl = tee_ioctl,
 678        .compat_ioctl = tee_ioctl,
 679};
 680
 681static void tee_release_device(struct device *dev)
 682{
 683        struct tee_device *teedev = container_of(dev, struct tee_device, dev);
 684
 685        spin_lock(&driver_lock);
 686        clear_bit(teedev->id, dev_mask);
 687        spin_unlock(&driver_lock);
 688        mutex_destroy(&teedev->mutex);
 689        idr_destroy(&teedev->idr);
 690        kfree(teedev);
 691}
 692
 693/**
 694 * tee_device_alloc() - Allocate a new struct tee_device instance
 695 * @teedesc:    Descriptor for this driver
 696 * @dev:        Parent device for this device
 697 * @pool:       Shared memory pool, NULL if not used
 698 * @driver_data: Private driver data for this device
 699 *
 700 * Allocates a new struct tee_device instance. The device is
 701 * removed by tee_device_unregister().
 702 *
 703 * @returns a pointer to a 'struct tee_device' or an ERR_PTR on failure
 704 */
 705struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
 706                                    struct device *dev,
 707                                    struct tee_shm_pool *pool,
 708                                    void *driver_data)
 709{
 710        struct tee_device *teedev;
 711        void *ret;
 712        int rc, max_id;
 713        int offs = 0;
 714
 715        if (!teedesc || !teedesc->name || !teedesc->ops ||
 716            !teedesc->ops->get_version || !teedesc->ops->open ||
 717            !teedesc->ops->release || !pool)
 718                return ERR_PTR(-EINVAL);
 719
 720        teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
 721        if (!teedev) {
 722                ret = ERR_PTR(-ENOMEM);
 723                goto err;
 724        }
 725
 726        max_id = TEE_NUM_DEVICES / 2;
 727
 728        if (teedesc->flags & TEE_DESC_PRIVILEGED) {
 729                offs = TEE_NUM_DEVICES / 2;
 730                max_id = TEE_NUM_DEVICES;
 731        }
 732
 733        spin_lock(&driver_lock);
 734        teedev->id = find_next_zero_bit(dev_mask, max_id, offs);
 735        if (teedev->id < max_id)
 736                set_bit(teedev->id, dev_mask);
 737        spin_unlock(&driver_lock);
 738
 739        if (teedev->id >= max_id) {
 740                ret = ERR_PTR(-ENOMEM);
 741                goto err;
 742        }
 743
 744        snprintf(teedev->name, sizeof(teedev->name), "tee%s%d",
 745                 teedesc->flags & TEE_DESC_PRIVILEGED ? "priv" : "",
 746                 teedev->id - offs);
 747
 748        teedev->dev.class = tee_class;
 749        teedev->dev.release = tee_release_device;
 750        teedev->dev.parent = dev;
 751
 752        teedev->dev.devt = MKDEV(MAJOR(tee_devt), teedev->id);
 753
 754        rc = dev_set_name(&teedev->dev, "%s", teedev->name);
 755        if (rc) {
 756                ret = ERR_PTR(rc);
 757                goto err_devt;
 758        }
 759
 760        cdev_init(&teedev->cdev, &tee_fops);
 761        teedev->cdev.owner = teedesc->owner;
 762        teedev->cdev.kobj.parent = &teedev->dev.kobj;
 763
 764        dev_set_drvdata(&teedev->dev, driver_data);
 765        device_initialize(&teedev->dev);
 766
 767        /* 1 as tee_device_unregister() does one final tee_device_put() */
 768        teedev->num_users = 1;
 769        init_completion(&teedev->c_no_users);
 770        mutex_init(&teedev->mutex);
 771        idr_init(&teedev->idr);
 772
 773        teedev->desc = teedesc;
 774        teedev->pool = pool;
 775
 776        return teedev;
 777err_devt:
 778        unregister_chrdev_region(teedev->dev.devt, 1);
 779err:
 780        pr_err("could not register %s driver\n",
 781               teedesc->flags & TEE_DESC_PRIVILEGED ? "privileged" : "client");
 782        if (teedev && teedev->id < TEE_NUM_DEVICES) {
 783                spin_lock(&driver_lock);
 784                clear_bit(teedev->id, dev_mask);
 785                spin_unlock(&driver_lock);
 786        }
 787        kfree(teedev);
 788        return ret;
 789}
 790EXPORT_SYMBOL_GPL(tee_device_alloc);
 791
 792static ssize_t implementation_id_show(struct device *dev,
 793                                      struct device_attribute *attr, char *buf)
 794{
 795        struct tee_device *teedev = container_of(dev, struct tee_device, dev);
 796        struct tee_ioctl_version_data vers;
 797
 798        teedev->desc->ops->get_version(teedev, &vers);
 799        return scnprintf(buf, PAGE_SIZE, "%d\n", vers.impl_id);
 800}
 801static DEVICE_ATTR_RO(implementation_id);
 802
 803static struct attribute *tee_dev_attrs[] = {
 804        &dev_attr_implementation_id.attr,
 805        NULL
 806};
 807
 808static const struct attribute_group tee_dev_group = {
 809        .attrs = tee_dev_attrs,
 810};
 811
 812/**
 813 * tee_device_register() - Registers a TEE device
 814 * @teedev:     Device to register
 815 *
 816 * tee_device_unregister() need to be called to remove the @teedev if
 817 * this function fails.
 818 *
 819 * @returns < 0 on failure
 820 */
 821int tee_device_register(struct tee_device *teedev)
 822{
 823        int rc;
 824
 825        if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) {
 826                dev_err(&teedev->dev, "attempt to register twice\n");
 827                return -EINVAL;
 828        }
 829
 830        rc = cdev_add(&teedev->cdev, teedev->dev.devt, 1);
 831        if (rc) {
 832                dev_err(&teedev->dev,
 833                        "unable to cdev_add() %s, major %d, minor %d, err=%d\n",
 834                        teedev->name, MAJOR(teedev->dev.devt),
 835                        MINOR(teedev->dev.devt), rc);
 836                return rc;
 837        }
 838
 839        rc = device_add(&teedev->dev);
 840        if (rc) {
 841                dev_err(&teedev->dev,
 842                        "unable to device_add() %s, major %d, minor %d, err=%d\n",
 843                        teedev->name, MAJOR(teedev->dev.devt),
 844                        MINOR(teedev->dev.devt), rc);
 845                goto err_device_add;
 846        }
 847
 848        rc = sysfs_create_group(&teedev->dev.kobj, &tee_dev_group);
 849        if (rc) {
 850                dev_err(&teedev->dev,
 851                        "failed to create sysfs attributes, err=%d\n", rc);
 852                goto err_sysfs_create_group;
 853        }
 854
 855        teedev->flags |= TEE_DEVICE_FLAG_REGISTERED;
 856        return 0;
 857
 858err_sysfs_create_group:
 859        device_del(&teedev->dev);
 860err_device_add:
 861        cdev_del(&teedev->cdev);
 862        return rc;
 863}
 864EXPORT_SYMBOL_GPL(tee_device_register);
 865
 866void tee_device_put(struct tee_device *teedev)
 867{
 868        mutex_lock(&teedev->mutex);
 869        /* Shouldn't put in this state */
 870        if (!WARN_ON(!teedev->desc)) {
 871                teedev->num_users--;
 872                if (!teedev->num_users) {
 873                        teedev->desc = NULL;
 874                        complete(&teedev->c_no_users);
 875                }
 876        }
 877        mutex_unlock(&teedev->mutex);
 878}
 879
 880bool tee_device_get(struct tee_device *teedev)
 881{
 882        mutex_lock(&teedev->mutex);
 883        if (!teedev->desc) {
 884                mutex_unlock(&teedev->mutex);
 885                return false;
 886        }
 887        teedev->num_users++;
 888        mutex_unlock(&teedev->mutex);
 889        return true;
 890}
 891
 892/**
 893 * tee_device_unregister() - Removes a TEE device
 894 * @teedev:     Device to unregister
 895 *
 896 * This function should be called to remove the @teedev even if
 897 * tee_device_register() hasn't been called yet. Does nothing if
 898 * @teedev is NULL.
 899 */
 900void tee_device_unregister(struct tee_device *teedev)
 901{
 902        if (!teedev)
 903                return;
 904
 905        if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) {
 906                sysfs_remove_group(&teedev->dev.kobj, &tee_dev_group);
 907                cdev_del(&teedev->cdev);
 908                device_del(&teedev->dev);
 909        }
 910
 911        tee_device_put(teedev);
 912        wait_for_completion(&teedev->c_no_users);
 913
 914        /*
 915         * No need to take a mutex any longer now since teedev->desc was
 916         * set to NULL before teedev->c_no_users was completed.
 917         */
 918
 919        teedev->pool = NULL;
 920
 921        put_device(&teedev->dev);
 922}
 923EXPORT_SYMBOL_GPL(tee_device_unregister);
 924
 925/**
 926 * tee_get_drvdata() - Return driver_data pointer
 927 * @teedev:     Device containing the driver_data pointer
 928 * @returns the driver_data pointer supplied to tee_register().
 929 */
 930void *tee_get_drvdata(struct tee_device *teedev)
 931{
 932        return dev_get_drvdata(&teedev->dev);
 933}
 934EXPORT_SYMBOL_GPL(tee_get_drvdata);
 935
 936struct match_dev_data {
 937        struct tee_ioctl_version_data *vers;
 938        const void *data;
 939        int (*match)(struct tee_ioctl_version_data *, const void *);
 940};
 941
 942static int match_dev(struct device *dev, const void *data)
 943{
 944        const struct match_dev_data *match_data = data;
 945        struct tee_device *teedev = container_of(dev, struct tee_device, dev);
 946
 947        teedev->desc->ops->get_version(teedev, match_data->vers);
 948        return match_data->match(match_data->vers, match_data->data);
 949}
 950
 951struct tee_context *
 952tee_client_open_context(struct tee_context *start,
 953                        int (*match)(struct tee_ioctl_version_data *,
 954                                     const void *),
 955                        const void *data, struct tee_ioctl_version_data *vers)
 956{
 957        struct device *dev = NULL;
 958        struct device *put_dev = NULL;
 959        struct tee_context *ctx = NULL;
 960        struct tee_ioctl_version_data v;
 961        struct match_dev_data match_data = { vers ? vers : &v, data, match };
 962
 963        if (start)
 964                dev = &start->teedev->dev;
 965
 966        do {
 967                dev = class_find_device(tee_class, dev, &match_data, match_dev);
 968                if (!dev) {
 969                        ctx = ERR_PTR(-ENOENT);
 970                        break;
 971                }
 972
 973                put_device(put_dev);
 974                put_dev = dev;
 975
 976                ctx = teedev_open(container_of(dev, struct tee_device, dev));
 977        } while (IS_ERR(ctx) && PTR_ERR(ctx) != -ENOMEM);
 978
 979        put_device(put_dev);
 980        /*
 981         * Default behaviour for in kernel client is to not wait for
 982         * tee-supplicant if not present for any requests in this context.
 983         * Also this flag could be configured again before call to
 984         * tee_client_open_session() if any in kernel client requires
 985         * different behaviour.
 986         */
 987        if (!IS_ERR(ctx))
 988                ctx->supp_nowait = true;
 989
 990        return ctx;
 991}
 992EXPORT_SYMBOL_GPL(tee_client_open_context);
 993
 994void tee_client_close_context(struct tee_context *ctx)
 995{
 996        teedev_close_context(ctx);
 997}
 998EXPORT_SYMBOL_GPL(tee_client_close_context);
 999
1000void tee_client_get_version(struct tee_context *ctx,

1001                            struct tee_ioctl_version_data *vers)
1002{
1003        ctx->teedev->desc->ops->get_version(ctx->teedev, vers);
1004}
1005EXPORT_SYMBOL_GPL(tee_client_get_version);
1006
1007int tee_client_open_session(struct tee_context *ctx,
1008                            struct tee_ioctl_open_session_arg *arg,
1009                            struct tee_param *param)
1010{
1011        if (!ctx->teedev->desc->ops->open_session)
1012                return -EINVAL;
1013        return ctx->teedev->desc->ops->open_session(ctx, arg, param);
1014}
1015EXPORT_SYMBOL_GPL(tee_client_open_session);
1016
1017int tee_client_close_session(struct tee_context *ctx, u32 session)
1018{
1019        if (!ctx->teedev->desc->ops->close_session)
1020                return -EINVAL;
1021        return ctx->teedev->desc->ops->close_session(ctx, session);
1022}
1023EXPORT_SYMBOL_GPL(tee_client_close_session);
1024
1025int tee_client_invoke_func(struct tee_context *ctx,
1026                           struct tee_ioctl_invoke_arg *arg,
1027                           struct tee_param *param)
1028{
1029        if (!ctx->teedev->desc->ops->invoke_func)
1030                return -EINVAL;
1031        return ctx->teedev->desc->ops->invoke_func(ctx, arg, param);
1032}
1033EXPORT_SYMBOL_GPL(tee_client_invoke_func);
1034
1035int tee_client_cancel_req(struct tee_context *ctx,
1036                          struct tee_ioctl_cancel_arg *arg)
1037{
1038        if (!ctx->teedev->desc->ops->cancel_req)
1039                return -EINVAL;
1040        return ctx->teedev->desc->ops->cancel_req(ctx, arg->cancel_id,
1041                                                  arg->session);
1042}
1043
1044static int tee_client_device_match(struct device *dev,
1045                                   struct device_driver *drv)
1046{
1047        const struct tee_client_device_id *id_table;
1048        struct tee_client_device *tee_device;
1049
1050        id_table = to_tee_client_driver(drv)->id_table;
1051        tee_device = to_tee_client_device(dev);
1052
1053        while (!uuid_is_null(&id_table->uuid)) {
1054                if (uuid_equal(&tee_device->id.uuid, &id_table->uuid))
1055                        return 1;
1056                id_table++;
1057        }
1058
1059        return 0;
1060}
1061
1062static int tee_client_device_uevent(struct device *dev,
1063                                    struct kobj_uevent_env *env)
1064{
1065        uuid_t *dev_id = &to_tee_client_device(dev)->id.uuid;
1066
1067        return add_uevent_var(env, "MODALIAS=tee:%pUb", dev_id);
1068}
1069
1070struct bus_type tee_bus_type = {
1071        .name           = "tee",
1072        .match          = tee_client_device_match,
1073        .uevent         = tee_client_device_uevent,
1074};
1075EXPORT_SYMBOL_GPL(tee_bus_type);
1076
1077static int __init tee_init(void)
1078{
1079        int rc;
1080
1081        tee_class = class_create(THIS_MODULE, "tee");
1082        if (IS_ERR(tee_class)) {
1083                pr_err("couldn't create class\n");
1084                return PTR_ERR(tee_class);
1085        }
1086
1087        rc = alloc_chrdev_region(&tee_devt, 0, TEE_NUM_DEVICES, "tee");
1088        if (rc) {
1089                pr_err("failed to allocate char dev region\n");
1090                goto out_unreg_class;
1091        }
1092
1093        rc = bus_register(&tee_bus_type);
1094        if (rc) {
1095                pr_err("failed to register tee bus\n");
1096                goto out_unreg_chrdev;
1097        }
1098
1099        return 0;
1100
1101out_unreg_chrdev:
1102        unregister_chrdev_region(tee_devt, TEE_NUM_DEVICES);
1103out_unreg_class:
1104        class_destroy(tee_class);
1105        tee_class = NULL;
1106
1107        return rc;
1108}
1109
1110static void __exit tee_exit(void)
1111{
1112        bus_unregister(&tee_bus_type);
1113        unregister_chrdev_region(tee_devt, TEE_NUM_DEVICES);
1114        class_destroy(tee_class);
1115        tee_class = NULL;
1116}
1117
1118subsys_initcall(tee_init);
1119module_exit(tee_exit);
1120
1121MODULE_AUTHOR("Linaro");
1122MODULE_DESCRIPTION("TEE Driver");
1123MODULE_VERSION("1.0");
1124MODULE_LICENSE("GPL v2");
1125