1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3 * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
4 */
5
6 #ifndef QCOMTEE_OBJECT_H
7 #define QCOMTEE_OBJECT_H
8
9 #include <linux/completion.h>
10 #include <linux/kref.h>
11 #include <linux/slab.h>
12 #include <linux/workqueue.h>
13
14 struct qcomtee_object;
15
16 /**
17 * DOC: Overview
18 *
19 * qcomtee_object provides object refcounting, ID allocation for objects hosted
20 * in the kernel, and necessary message marshaling for Qualcomm TEE (QTEE).
21 *
22 * To invoke an object in QTEE, the user calls qcomtee_object_do_invoke()
23 * while passing an instance of &struct qcomtee_object and the requested
24 * operation + arguments.
25 *
26 * After boot, QTEE provides a static object %ROOT_QCOMTEE_OBJECT (type of
27 * %QCOMTEE_OBJECT_TYPE_ROOT). The root object is invoked to pass the user's
28 * credentials and obtain other instances of &struct qcomtee_object (type of
29 * %QCOMTEE_OBJECT_TYPE_TEE) that represent services and TAs in QTEE;
30 * see &enum qcomtee_object_type.
31 *
32 * The objects received from QTEE are refcounted. So the owner of these objects
33 * can issue qcomtee_object_get() to increase the refcount and pass objects
34 * to other clients, or issue qcomtee_object_put() to decrease the refcount
35 * and release the resources in QTEE.
36 *
37 * The kernel can host services accessible to QTEE. A driver should embed
38 * an instance of &struct qcomtee_object in the struct it wants to export to
39 * QTEE (this is called a callback object). It issues qcomtee_object_user_init()
40 * to set the dispatch() operation for the callback object and set its type
41 * to %QCOMTEE_OBJECT_TYPE_CB.
42 *
43 * core.c holds an object table for callback objects. An object ID is assigned
44 * to each callback object, which is an index to the object table. QTEE uses
45 * these IDs to reference or invoke callback objects.
46 *
47 * If QTEE invokes a callback object in the kernel, the dispatch() operation is
48 * called in the context of the thread that originally called
49 * qcomtee_object_do_invoke().
50 */
51
52 /**
53 * enum qcomtee_object_type - Object types.
54 * @QCOMTEE_OBJECT_TYPE_TEE: object hosted on QTEE.
55 * @QCOMTEE_OBJECT_TYPE_CB: object hosted on kernel.
56 * @QCOMTEE_OBJECT_TYPE_ROOT: 'primordial' object.
57 * @QCOMTEE_OBJECT_TYPE_NULL: NULL object.
58 *
59 * The primordial object is used for bootstrapping the IPC connection between
60 * the kernel and QTEE. It is invoked by the kernel when it wants to get a
61 * 'client env'.
62 */
63 enum qcomtee_object_type {
64 QCOMTEE_OBJECT_TYPE_TEE,
65 QCOMTEE_OBJECT_TYPE_CB,
66 QCOMTEE_OBJECT_TYPE_ROOT,
67 QCOMTEE_OBJECT_TYPE_NULL,
68 };
69
70 /**
71 * enum qcomtee_arg_type - Type of QTEE argument.
72 * @QCOMTEE_ARG_TYPE_INV: invalid type.
73 * @QCOMTEE_ARG_TYPE_OB: output buffer (OB).
74 * @QCOMTEE_ARG_TYPE_OO: output object (OO).
75 * @QCOMTEE_ARG_TYPE_IB: input buffer (IB).
76 * @QCOMTEE_ARG_TYPE_IO: input object (IO).
77 * @QCOMTEE_ARG_TYPE_NR: number of argument types.
78 *
79 * Use the invalid type to specify the end of the argument array.
80 */
81 enum qcomtee_arg_type {
82 QCOMTEE_ARG_TYPE_INV = 0,
83 QCOMTEE_ARG_TYPE_OB,
84 QCOMTEE_ARG_TYPE_OO,
85 QCOMTEE_ARG_TYPE_IB,
86 QCOMTEE_ARG_TYPE_IO,
87 QCOMTEE_ARG_TYPE_NR,
88 };
89
90 /**
91 * define QCOMTEE_ARGS_PER_TYPE - Maximum arguments of a specific type.
92 *
93 * The QTEE transport protocol limits the maximum number of arguments of
94 * a specific type (i.e., IB, OB, IO, and OO).
95 */
96 #define QCOMTEE_ARGS_PER_TYPE 16
97
98 /* Maximum arguments that can fit in a QTEE message, ignoring the type. */
99 #define QCOMTEE_ARGS_MAX (QCOMTEE_ARGS_PER_TYPE * (QCOMTEE_ARG_TYPE_NR - 1))
100
101 struct qcomtee_buffer {
102 union {
103 void *addr;
104 void __user *uaddr;
105 };
106 size_t size;
107 };
108
109 /**
110 * struct qcomtee_arg - Argument for QTEE object invocation.
111 * @type: type of argument as &enum qcomtee_arg_type.
112 * @flags: extra flags.
113 * @b: address and size if the type of argument is a buffer.
114 * @o: object instance if the type of argument is an object.
115 *
116 * &qcomtee_arg.flags only accepts %QCOMTEE_ARG_FLAGS_UADDR for now, which
117 * states that &qcomtee_arg.b contains a userspace address in uaddr.
118 */
119 struct qcomtee_arg {
120 enum qcomtee_arg_type type;
121 /* 'b.uaddr' holds a __user address. */
122 #define QCOMTEE_ARG_FLAGS_UADDR BIT(0)
123 unsigned int flags;
124 union {
125 struct qcomtee_buffer b;
126 struct qcomtee_object *o;
127 };
128 };
129
qcomtee_args_len(struct qcomtee_arg * args)130 static inline int qcomtee_args_len(struct qcomtee_arg *args)
131 {
132 int i = 0;
133
134 while (args[i].type != QCOMTEE_ARG_TYPE_INV)
135 i++;
136 return i;
137 }
138
139 /* Context is busy (callback is in progress). */
140 #define QCOMTEE_OIC_FLAG_BUSY BIT(1)
141 /* Context needs to notify the current object. */
142 #define QCOMTEE_OIC_FLAG_NOTIFY BIT(2)
143 /* Context has shared state with QTEE. */
144 #define QCOMTEE_OIC_FLAG_SHARED BIT(3)
145
146 /**
147 * struct qcomtee_object_invoke_ctx - QTEE context for object invocation.
148 * @ctx: TEE context for this invocation.
149 * @flags: flags for the invocation context.
150 * @errno: error code for the invocation.
151 * @object: current object invoked in this callback context.
152 * @u: array of arguments for the current invocation (+1 for ending arg).
153 * @in_msg: inbound buffer shared with QTEE.
154 * @out_msg: outbound buffer shared with QTEE.
155 * @in_shm: TEE shm allocated for inbound buffer.
156 * @out_shm: TEE shm allocated for outbound buffer.
157 * @data: extra data attached to this context.
158 */
159 struct qcomtee_object_invoke_ctx {
160 struct tee_context *ctx;
161 unsigned long flags;
162 int errno;
163
164 struct qcomtee_object *object;
165 struct qcomtee_arg u[QCOMTEE_ARGS_MAX + 1];
166
167 struct qcomtee_buffer in_msg;
168 struct qcomtee_buffer out_msg;
169 struct tee_shm *in_shm;
170 struct tee_shm *out_shm;
171
172 void *data;
173 };
174
175 static inline struct qcomtee_object_invoke_ctx *
qcomtee_object_invoke_ctx_alloc(struct tee_context * ctx)176 qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx)
177 {
178 struct qcomtee_object_invoke_ctx *oic;
179
180 oic = kzalloc_obj(*oic);
181 if (oic)
182 oic->ctx = ctx;
183 return oic;
184 }
185
186 /**
187 * qcomtee_object_do_invoke() - Submit an invocation for an object.
188 * @oic: context to use for the current invocation.
189 * @object: object being invoked.
190 * @op: requested operation on the object.
191 * @u: array of arguments for the current invocation.
192 * @result: result returned from QTEE.
193 *
194 * The caller is responsible for keeping track of the refcount for each object,
195 * including @object. On return, the caller loses ownership of all input
196 * objects of type %QCOMTEE_OBJECT_TYPE_CB.
197 *
198 * @object can be of %QCOMTEE_OBJECT_TYPE_ROOT or %QCOMTEE_OBJECT_TYPE_TEE.
199 *
200 * Return: On success, returns 0; on failure, returns < 0.
201 */
202 int qcomtee_object_do_invoke(struct qcomtee_object_invoke_ctx *oic,
203 struct qcomtee_object *object, u32 op,
204 struct qcomtee_arg *u, int *result);
205
206 /**
207 * struct qcomtee_object_operations - Callback object operations.
208 * @release: release the object if QTEE is not using it.
209 * @dispatch: dispatch the operation requested by QTEE.
210 * @notify: report the status of any pending response submitted by @dispatch.
211 */
212 struct qcomtee_object_operations {
213 void (*release)(struct qcomtee_object *object);
214 int (*dispatch)(struct qcomtee_object_invoke_ctx *oic,
215 struct qcomtee_object *object, u32 op,
216 struct qcomtee_arg *args);
217 void (*notify)(struct qcomtee_object_invoke_ctx *oic,
218 struct qcomtee_object *object, int err);
219 };
220
221 /**
222 * struct qcomtee_object - QTEE or kernel object.
223 * @name: object name.
224 * @refcount: reference counter.
225 * @object_type: object type as &enum qcomtee_object_type.
226 * @info: extra information for the object.
227 * @ops: callback operations for objects of type %QCOMTEE_OBJECT_TYPE_CB.
228 * @work: work for async operations on the object.
229 *
230 * @work is used for releasing objects of %QCOMTEE_OBJECT_TYPE_TEE type.
231 */
232 struct qcomtee_object {
233 const char *name;
234 struct kref refcount;
235
236 enum qcomtee_object_type object_type;
237 struct object_info {
238 unsigned long qtee_id;
239 /* TEE context for QTEE object async requests. */
240 struct tee_context *qcomtee_async_ctx;
241 } info;
242
243 struct qcomtee_object_operations *ops;
244 struct work_struct work;
245 };
246
247 /* Static instances of qcomtee_object objects. */
248 #define NULL_QCOMTEE_OBJECT ((struct qcomtee_object *)(0))
249 extern struct qcomtee_object qcomtee_object_root;
250 #define ROOT_QCOMTEE_OBJECT (&qcomtee_object_root)
251
252 static inline enum qcomtee_object_type
typeof_qcomtee_object(struct qcomtee_object * object)253 typeof_qcomtee_object(struct qcomtee_object *object)
254 {
255 if (object == NULL_QCOMTEE_OBJECT)
256 return QCOMTEE_OBJECT_TYPE_NULL;
257 return object->object_type;
258 }
259
qcomtee_object_name(struct qcomtee_object * object)260 static inline const char *qcomtee_object_name(struct qcomtee_object *object)
261 {
262 if (object == NULL_QCOMTEE_OBJECT)
263 return "null";
264
265 if (!object->name)
266 return "no-name";
267 return object->name;
268 }
269
270 /**
271 * qcomtee_object_user_init() - Initialize an object for the user.
272 * @object: object to initialize.
273 * @ot: type of object as &enum qcomtee_object_type.
274 * @ops: instance of callbacks.
275 * @fmt: name assigned to the object.
276 *
277 * Return: On success, returns 0; on failure, returns < 0.
278 */
279 int qcomtee_object_user_init(struct qcomtee_object *object,
280 enum qcomtee_object_type ot,
281 struct qcomtee_object_operations *ops,
282 const char *fmt, ...) __printf(4, 5);
283
284 /* Object release is RCU protected. */
285 int qcomtee_object_get(struct qcomtee_object *object);
286 void qcomtee_object_put(struct qcomtee_object *object);
287
288 #define qcomtee_arg_for_each(i, args) \
289 for (i = 0; args[i].type != QCOMTEE_ARG_TYPE_INV; i++)
290
291 /* Next argument of type @type after index @i. */
292 int qcomtee_next_arg_type(struct qcomtee_arg *u, int i,
293 enum qcomtee_arg_type type);
294
295 /* Iterate over argument of given type. */
296 #define qcomtee_arg_for_each_type(i, args, at) \
297 for (i = qcomtee_next_arg_type(args, 0, at); \
298 args[i].type != QCOMTEE_ARG_TYPE_INV; \
299 i = qcomtee_next_arg_type(args, i + 1, at))
300
301 #define qcomtee_arg_for_each_input_buffer(i, args) \
302 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_IB)
303 #define qcomtee_arg_for_each_output_buffer(i, args) \
304 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_OB)
305 #define qcomtee_arg_for_each_input_object(i, args) \
306 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_IO)
307 #define qcomtee_arg_for_each_output_object(i, args) \
308 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_OO)
309
310 struct qcomtee_object *
311 qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic);
312
313 struct qcomtee_object *
314 qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic,
315 struct qcomtee_object *client_env, u32 uid);
316
317 #endif /* QCOMTEE_OBJECT_H */
318