1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3 * Copyright (c) 2015, Linaro Limited
4 */
5 #include <linux/device.h>
6 #include <linux/slab.h>
7 #include <linux/uaccess.h>
8 #include "optee_private.h"
9
10 struct optee_supp_req {
11 struct list_head link;
12
13 bool in_queue;
14 u32 func;
15 u32 ret;
16 size_t num_params;
17 struct tee_param *param;
18
19 struct completion c;
20 };
21
optee_supp_init(struct optee_supp * supp)22 void optee_supp_init(struct optee_supp *supp)
23 {
24 memset(supp, 0, sizeof(*supp));
25 mutex_init(&supp->mutex);
26 init_completion(&supp->reqs_c);
27 idr_init(&supp->idr);
28 INIT_LIST_HEAD(&supp->reqs);
29 supp->req_id = -1;
30 }
31
optee_supp_uninit(struct optee_supp * supp)32 void optee_supp_uninit(struct optee_supp *supp)
33 {
34 mutex_destroy(&supp->mutex);
35 idr_destroy(&supp->idr);
36 }
37
optee_supp_release(struct optee_supp * supp)38 void optee_supp_release(struct optee_supp *supp)
39 {
40 int id;
41 struct optee_supp_req *req;
42 struct optee_supp_req *req_tmp;
43
44 mutex_lock(&supp->mutex);
45
46 /* Abort all request retrieved by supplicant */
47 idr_for_each_entry(&supp->idr, req, id) {
48 idr_remove(&supp->idr, id);
49 req->ret = TEEC_ERROR_COMMUNICATION;
50 complete(&req->c);
51 }
52
53 /* Abort all queued requests */
54 list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) {
55 list_del(&req->link);
56 req->in_queue = false;
57 req->ret = TEEC_ERROR_COMMUNICATION;
58 complete(&req->c);
59 }
60
61 supp->ctx = NULL;
62 supp->req_id = -1;
63
64 mutex_unlock(&supp->mutex);
65 }
66
67 /**
68 * optee_supp_thrd_req() - request service from supplicant
69 * @ctx: context doing the request
70 * @func: function requested
71 * @num_params: number of elements in @param array
72 * @param: parameters for function
73 *
74 * Returns result of operation to be passed to secure world
75 */
optee_supp_thrd_req(struct tee_context * ctx,u32 func,size_t num_params,struct tee_param * param)76 u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
77 struct tee_param *param)
78
79 {
80 struct optee *optee = tee_get_drvdata(ctx->teedev);
81 struct optee_supp *supp = &optee->supp;
82 struct optee_supp_req *req;
83 bool interruptable;
84 u32 ret;
85
86 /*
87 * Return in case there is no supplicant available and
88 * non-blocking request.
89 */
90 if (!supp->ctx && ctx->supp_nowait)
91 return TEEC_ERROR_COMMUNICATION;
92
93 req = kzalloc(sizeof(*req), GFP_KERNEL);
94 if (!req)
95 return TEEC_ERROR_OUT_OF_MEMORY;
96
97 init_completion(&req->c);
98 req->func = func;
99 req->num_params = num_params;
100 req->param = param;
101
102 /* Insert the request in the request list */
103 mutex_lock(&supp->mutex);
104 list_add_tail(&req->link, &supp->reqs);
105 req->in_queue = true;
106 mutex_unlock(&supp->mutex);
107
108 /* Tell an eventual waiter there's a new request */
109 complete(&supp->reqs_c);
110
111 /*
112 * Wait for supplicant to process and return result, once we've
113 * returned from wait_for_completion(&req->c) successfully we have
114 * exclusive access again.
115 */
116 while (wait_for_completion_interruptible(&req->c)) {
117 mutex_lock(&supp->mutex);
118 interruptable = !supp->ctx;
119 if (interruptable) {
120 /*
121 * There's no supplicant available and since the
122 * supp->mutex currently is held none can
123 * become available until the mutex released
124 * again.
125 *
126 * Interrupting an RPC to supplicant is only
127 * allowed as a way of slightly improving the user
128 * experience in case the supplicant hasn't been
129 * started yet. During normal operation the supplicant
130 * will serve all requests in a timely manner and
131 * interrupting then wouldn't make sense.
132 */
133 if (req->in_queue) {
134 list_del(&req->link);
135 req->in_queue = false;
136 }
137 }
138 mutex_unlock(&supp->mutex);
139
140 if (interruptable) {
141 req->ret = TEEC_ERROR_COMMUNICATION;
142 break;
143 }
144 }
145
146 ret = req->ret;
147 kfree(req);
148
149 return ret;
150 }
151
supp_pop_entry(struct optee_supp * supp,int num_params,int * id)152 static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp,
153 int num_params, int *id)
154 {
155 struct optee_supp_req *req;
156
157 if (supp->req_id != -1) {
158 /*
159 * Supplicant should not mix synchronous and asnynchronous
160 * requests.
161 */
162 return ERR_PTR(-EINVAL);
163 }
164
165 if (list_empty(&supp->reqs))
166 return NULL;
167
168 req = list_first_entry(&supp->reqs, struct optee_supp_req, link);
169
170 if (num_params < req->num_params) {
171 /* Not enough room for parameters */
172 return ERR_PTR(-EINVAL);
173 }
174
175 *id = idr_alloc(&supp->idr, req, 1, 0, GFP_KERNEL);
176 if (*id < 0)
177 return ERR_PTR(-ENOMEM);
178
179 list_del(&req->link);
180 req->in_queue = false;
181
182 return req;
183 }
184
supp_check_recv_params(size_t num_params,struct tee_param * params,size_t * num_meta)185 static int supp_check_recv_params(size_t num_params, struct tee_param *params,
186 size_t *num_meta)
187 {
188 size_t n;
189
190 if (!num_params)
191 return -EINVAL;
192
193 /*
194 * If there's memrefs we need to decrease those as they where
195 * increased earlier and we'll even refuse to accept any below.
196 */
197 for (n = 0; n < num_params; n++)
198 if (tee_param_is_memref(params + n) && params[n].u.memref.shm)
199 tee_shm_put(params[n].u.memref.shm);
200
201 /*
202 * We only expect parameters as TEE_IOCTL_PARAM_ATTR_TYPE_NONE with
203 * or without the TEE_IOCTL_PARAM_ATTR_META bit set.
204 */
205 for (n = 0; n < num_params; n++)
206 if (params[n].attr &&
207 params[n].attr != TEE_IOCTL_PARAM_ATTR_META)
208 return -EINVAL;
209
210 /* At most we'll need one meta parameter so no need to check for more */
211 if (params->attr == TEE_IOCTL_PARAM_ATTR_META)
212 *num_meta = 1;
213 else
214 *num_meta = 0;
215
216 return 0;
217 }
218
219 /**
220 * optee_supp_recv() - receive request for supplicant
221 * @ctx: context receiving the request
222 * @func: requested function in supplicant
223 * @num_params: number of elements allocated in @param, updated with number
224 * used elements
225 * @param: space for parameters for @func
226 *
227 * Returns 0 on success or <0 on failure
228 */
optee_supp_recv(struct tee_context * ctx,u32 * func,u32 * num_params,struct tee_param * param)229 int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params,
230 struct tee_param *param)
231 {
232 struct tee_device *teedev = ctx->teedev;
233 struct optee *optee = tee_get_drvdata(teedev);
234 struct optee_supp *supp = &optee->supp;
235 struct optee_supp_req *req = NULL;
236 int id;
237 size_t num_meta;
238 int rc;
239
240 rc = supp_check_recv_params(*num_params, param, &num_meta);
241 if (rc)
242 return rc;
243
244 while (true) {
245 mutex_lock(&supp->mutex);
246 req = supp_pop_entry(supp, *num_params - num_meta, &id);
247 mutex_unlock(&supp->mutex);
248
249 if (req) {
250 if (IS_ERR(req))
251 return PTR_ERR(req);
252 break;
253 }
254
255 /*
256 * If we didn't get a request we'll block in
257 * wait_for_completion() to avoid needless spinning.
258 *
259 * This is where supplicant will be hanging most of
260 * the time, let's make this interruptable so we
261 * can easily restart supplicant if needed.
262 */
263 if (wait_for_completion_interruptible(&supp->reqs_c))
264 return -ERESTARTSYS;
265 }
266
267 if (num_meta) {
268 /*
269 * tee-supplicant support meta parameters -> requsts can be
270 * processed asynchronously.
271 */
272 param->attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT |
273 TEE_IOCTL_PARAM_ATTR_META;
274 param->u.value.a = id;
275 param->u.value.b = 0;
276 param->u.value.c = 0;
277 } else {
278 mutex_lock(&supp->mutex);
279 supp->req_id = id;
280 mutex_unlock(&supp->mutex);
281 }
282
283 *func = req->func;
284 *num_params = req->num_params + num_meta;
285 memcpy(param + num_meta, req->param,
286 sizeof(struct tee_param) * req->num_params);
287
288 return 0;
289 }
290
supp_pop_req(struct optee_supp * supp,size_t num_params,struct tee_param * param,size_t * num_meta)291 static struct optee_supp_req *supp_pop_req(struct optee_supp *supp,
292 size_t num_params,
293 struct tee_param *param,
294 size_t *num_meta)
295 {
296 struct optee_supp_req *req;
297 int id;
298 size_t nm;
299 const u32 attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT |
300 TEE_IOCTL_PARAM_ATTR_META;
301
302 if (!num_params)
303 return ERR_PTR(-EINVAL);
304
305 if (supp->req_id == -1) {
306 if (param->attr != attr)
307 return ERR_PTR(-EINVAL);
308 id = param->u.value.a;
309 nm = 1;
310 } else {
311 id = supp->req_id;
312 nm = 0;
313 }
314
315 req = idr_find(&supp->idr, id);
316 if (!req)
317 return ERR_PTR(-ENOENT);
318
319 if ((num_params - nm) != req->num_params)
320 return ERR_PTR(-EINVAL);
321
322 idr_remove(&supp->idr, id);
323 supp->req_id = -1;
324 *num_meta = nm;
325
326 return req;
327 }
328
329 /**
330 * optee_supp_send() - send result of request from supplicant
331 * @ctx: context sending result
332 * @ret: return value of request
333 * @num_params: number of parameters returned
334 * @param: returned parameters
335 *
336 * Returns 0 on success or <0 on failure.
337 */
optee_supp_send(struct tee_context * ctx,u32 ret,u32 num_params,struct tee_param * param)338 int optee_supp_send(struct tee_context *ctx, u32 ret, u32 num_params,
339 struct tee_param *param)
340 {
341 struct tee_device *teedev = ctx->teedev;
342 struct optee *optee = tee_get_drvdata(teedev);
343 struct optee_supp *supp = &optee->supp;
344 struct optee_supp_req *req;
345 size_t n;
346 size_t num_meta;
347
348 mutex_lock(&supp->mutex);
349 req = supp_pop_req(supp, num_params, param, &num_meta);
350 mutex_unlock(&supp->mutex);
351
352 if (IS_ERR(req)) {
353 /* Something is wrong, let supplicant restart. */
354 return PTR_ERR(req);
355 }
356
357 /* Update out and in/out parameters */
358 for (n = 0; n < req->num_params; n++) {
359 struct tee_param *p = req->param + n;
360
361 switch (p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
362 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
363 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
364 p->u.value.a = param[n + num_meta].u.value.a;
365 p->u.value.b = param[n + num_meta].u.value.b;
366 p->u.value.c = param[n + num_meta].u.value.c;
367 break;
368 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
369 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
370 p->u.memref.size = param[n + num_meta].u.memref.size;
371 break;
372 default:
373 break;
374 }
375 }
376 req->ret = ret;
377
378 /* Let the requesting thread continue */
379 complete(&req->c);
380
381 return 0;
382 }
383