1 /* SPDX-License-Identifier: GPL-2.0-only */ 2 /* 3 * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. 4 */ 5 6 #ifndef QCOMTEE_OBJECT_H 7 #define QCOMTEE_OBJECT_H 8 9 #include <linux/completion.h> 10 #include <linux/kref.h> 11 #include <linux/slab.h> 12 #include <linux/workqueue.h> 13 14 struct qcomtee_object; 15 16 /** 17 * DOC: Overview 18 * 19 * qcomtee_object provides object refcounting, ID allocation for objects hosted 20 * in the kernel, and necessary message marshaling for Qualcomm TEE (QTEE). 21 * 22 * To invoke an object in QTEE, the user calls qcomtee_object_do_invoke() 23 * while passing an instance of &struct qcomtee_object and the requested 24 * operation + arguments. 25 * 26 * After boot, QTEE provides a static object %ROOT_QCOMTEE_OBJECT (type of 27 * %QCOMTEE_OBJECT_TYPE_ROOT). The root object is invoked to pass the user's 28 * credentials and obtain other instances of &struct qcomtee_object (type of 29 * %QCOMTEE_OBJECT_TYPE_TEE) that represent services and TAs in QTEE; 30 * see &enum qcomtee_object_type. 31 * 32 * The objects received from QTEE are refcounted. So the owner of these objects 33 * can issue qcomtee_object_get() to increase the refcount and pass objects 34 * to other clients, or issue qcomtee_object_put() to decrease the refcount 35 * and release the resources in QTEE. 36 * 37 * The kernel can host services accessible to QTEE. A driver should embed 38 * an instance of &struct qcomtee_object in the struct it wants to export to 39 * QTEE (this is called a callback object). It issues qcomtee_object_user_init() 40 * to set the dispatch() operation for the callback object and set its type 41 * to %QCOMTEE_OBJECT_TYPE_CB. 42 * 43 * core.c holds an object table for callback objects. An object ID is assigned 44 * to each callback object, which is an index to the object table. QTEE uses 45 * these IDs to reference or invoke callback objects. 46 * 47 * If QTEE invokes a callback object in the kernel, the dispatch() operation is 48 * called in the context of the thread that originally called 49 * qcomtee_object_do_invoke(). 50 */ 51 52 /** 53 * enum qcomtee_object_type - Object types. 54 * @QCOMTEE_OBJECT_TYPE_TEE: object hosted on QTEE. 55 * @QCOMTEE_OBJECT_TYPE_CB: object hosted on kernel. 56 * @QCOMTEE_OBJECT_TYPE_ROOT: 'primordial' object. 57 * @QCOMTEE_OBJECT_TYPE_NULL: NULL object. 58 * 59 * The primordial object is used for bootstrapping the IPC connection between 60 * the kernel and QTEE. It is invoked by the kernel when it wants to get a 61 * 'client env'. 62 */ 63 enum qcomtee_object_type { 64 QCOMTEE_OBJECT_TYPE_TEE, 65 QCOMTEE_OBJECT_TYPE_CB, 66 QCOMTEE_OBJECT_TYPE_ROOT, 67 QCOMTEE_OBJECT_TYPE_NULL, 68 }; 69 70 /** 71 * enum qcomtee_arg_type - Type of QTEE argument. 72 * @QCOMTEE_ARG_TYPE_INV: invalid type. 73 * @QCOMTEE_ARG_TYPE_OB: output buffer (OB). 74 * @QCOMTEE_ARG_TYPE_OO: output object (OO). 75 * @QCOMTEE_ARG_TYPE_IB: input buffer (IB). 76 * @QCOMTEE_ARG_TYPE_IO: input object (IO). 77 * @QCOMTEE_ARG_TYPE_NR: number of argument types. 78 * 79 * Use the invalid type to specify the end of the argument array. 80 */ 81 enum qcomtee_arg_type { 82 QCOMTEE_ARG_TYPE_INV = 0, 83 QCOMTEE_ARG_TYPE_OB, 84 QCOMTEE_ARG_TYPE_OO, 85 QCOMTEE_ARG_TYPE_IB, 86 QCOMTEE_ARG_TYPE_IO, 87 QCOMTEE_ARG_TYPE_NR, 88 }; 89 90 /** 91 * define QCOMTEE_ARGS_PER_TYPE - Maximum arguments of a specific type. 92 * 93 * The QTEE transport protocol limits the maximum number of arguments of 94 * a specific type (i.e., IB, OB, IO, and OO). 95 */ 96 #define QCOMTEE_ARGS_PER_TYPE 16 97 98 /* Maximum arguments that can fit in a QTEE message, ignoring the type. */ 99 #define QCOMTEE_ARGS_MAX (QCOMTEE_ARGS_PER_TYPE * (QCOMTEE_ARG_TYPE_NR - 1)) 100 101 struct qcomtee_buffer { 102 union { 103 void *addr; 104 void __user *uaddr; 105 }; 106 size_t size; 107 }; 108 109 /** 110 * struct qcomtee_arg - Argument for QTEE object invocation. 111 * @type: type of argument as &enum qcomtee_arg_type. 112 * @flags: extra flags. 113 * @b: address and size if the type of argument is a buffer. 114 * @o: object instance if the type of argument is an object. 115 * 116 * &qcomtee_arg.flags only accepts %QCOMTEE_ARG_FLAGS_UADDR for now, which 117 * states that &qcomtee_arg.b contains a userspace address in uaddr. 118 */ 119 struct qcomtee_arg { 120 enum qcomtee_arg_type type; 121 /* 'b.uaddr' holds a __user address. */ 122 #define QCOMTEE_ARG_FLAGS_UADDR BIT(0) 123 unsigned int flags; 124 union { 125 struct qcomtee_buffer b; 126 struct qcomtee_object *o; 127 }; 128 }; 129 130 static inline int qcomtee_args_len(struct qcomtee_arg *args) 131 { 132 int i = 0; 133 134 while (args[i].type != QCOMTEE_ARG_TYPE_INV) 135 i++; 136 return i; 137 } 138 139 /* Context is busy (callback is in progress). */ 140 #define QCOMTEE_OIC_FLAG_BUSY BIT(1) 141 /* Context needs to notify the current object. */ 142 #define QCOMTEE_OIC_FLAG_NOTIFY BIT(2) 143 /* Context has shared state with QTEE. */ 144 #define QCOMTEE_OIC_FLAG_SHARED BIT(3) 145 146 /** 147 * struct qcomtee_object_invoke_ctx - QTEE context for object invocation. 148 * @ctx: TEE context for this invocation. 149 * @flags: flags for the invocation context. 150 * @errno: error code for the invocation. 151 * @object: current object invoked in this callback context. 152 * @u: array of arguments for the current invocation (+1 for ending arg). 153 * @in_msg: inbound buffer shared with QTEE. 154 * @out_msg: outbound buffer shared with QTEE. 155 * @in_shm: TEE shm allocated for inbound buffer. 156 * @out_shm: TEE shm allocated for outbound buffer. 157 * @data: extra data attached to this context. 158 */ 159 struct qcomtee_object_invoke_ctx { 160 struct tee_context *ctx; 161 unsigned long flags; 162 int errno; 163 164 struct qcomtee_object *object; 165 struct qcomtee_arg u[QCOMTEE_ARGS_MAX + 1]; 166 167 struct qcomtee_buffer in_msg; 168 struct qcomtee_buffer out_msg; 169 struct tee_shm *in_shm; 170 struct tee_shm *out_shm; 171 172 void *data; 173 }; 174 175 static inline struct qcomtee_object_invoke_ctx * 176 qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx) 177 { 178 struct qcomtee_object_invoke_ctx *oic; 179 180 oic = kzalloc_obj(*oic); 181 if (oic) 182 oic->ctx = ctx; 183 return oic; 184 } 185 186 /** 187 * qcomtee_object_do_invoke() - Submit an invocation for an object. 188 * @oic: context to use for the current invocation. 189 * @object: object being invoked. 190 * @op: requested operation on the object. 191 * @u: array of arguments for the current invocation. 192 * @result: result returned from QTEE. 193 * 194 * The caller is responsible for keeping track of the refcount for each object, 195 * including @object. On return, the caller loses ownership of all input 196 * objects of type %QCOMTEE_OBJECT_TYPE_CB. 197 * 198 * @object can be of %QCOMTEE_OBJECT_TYPE_ROOT or %QCOMTEE_OBJECT_TYPE_TEE. 199 * 200 * Return: On success, returns 0; on failure, returns < 0. 201 */ 202 int qcomtee_object_do_invoke(struct qcomtee_object_invoke_ctx *oic, 203 struct qcomtee_object *object, u32 op, 204 struct qcomtee_arg *u, int *result); 205 206 /** 207 * struct qcomtee_object_operations - Callback object operations. 208 * @release: release the object if QTEE is not using it. 209 * @dispatch: dispatch the operation requested by QTEE. 210 * @notify: report the status of any pending response submitted by @dispatch. 211 */ 212 struct qcomtee_object_operations { 213 void (*release)(struct qcomtee_object *object); 214 int (*dispatch)(struct qcomtee_object_invoke_ctx *oic, 215 struct qcomtee_object *object, u32 op, 216 struct qcomtee_arg *args); 217 void (*notify)(struct qcomtee_object_invoke_ctx *oic, 218 struct qcomtee_object *object, int err); 219 }; 220 221 /** 222 * struct qcomtee_object - QTEE or kernel object. 223 * @name: object name. 224 * @refcount: reference counter. 225 * @object_type: object type as &enum qcomtee_object_type. 226 * @info: extra information for the object. 227 * @ops: callback operations for objects of type %QCOMTEE_OBJECT_TYPE_CB. 228 * @work: work for async operations on the object. 229 * 230 * @work is used for releasing objects of %QCOMTEE_OBJECT_TYPE_TEE type. 231 */ 232 struct qcomtee_object { 233 const char *name; 234 struct kref refcount; 235 236 enum qcomtee_object_type object_type; 237 struct object_info { 238 unsigned long qtee_id; 239 /* TEE context for QTEE object async requests. */ 240 struct tee_context *qcomtee_async_ctx; 241 } info; 242 243 struct qcomtee_object_operations *ops; 244 struct work_struct work; 245 }; 246 247 /* Static instances of qcomtee_object objects. */ 248 #define NULL_QCOMTEE_OBJECT ((struct qcomtee_object *)(0)) 249 extern struct qcomtee_object qcomtee_object_root; 250 #define ROOT_QCOMTEE_OBJECT (&qcomtee_object_root) 251 252 static inline enum qcomtee_object_type 253 typeof_qcomtee_object(struct qcomtee_object *object) 254 { 255 if (object == NULL_QCOMTEE_OBJECT) 256 return QCOMTEE_OBJECT_TYPE_NULL; 257 return object->object_type; 258 } 259 260 static inline const char *qcomtee_object_name(struct qcomtee_object *object) 261 { 262 if (object == NULL_QCOMTEE_OBJECT) 263 return "null"; 264 265 if (!object->name) 266 return "no-name"; 267 return object->name; 268 } 269 270 /** 271 * qcomtee_object_user_init() - Initialize an object for the user. 272 * @object: object to initialize. 273 * @ot: type of object as &enum qcomtee_object_type. 274 * @ops: instance of callbacks. 275 * @fmt: name assigned to the object. 276 * 277 * Return: On success, returns 0; on failure, returns < 0. 278 */ 279 int qcomtee_object_user_init(struct qcomtee_object *object, 280 enum qcomtee_object_type ot, 281 struct qcomtee_object_operations *ops, 282 const char *fmt, ...) __printf(4, 5); 283 284 /* Object release is RCU protected. */ 285 int qcomtee_object_get(struct qcomtee_object *object); 286 void qcomtee_object_put(struct qcomtee_object *object); 287 288 #define qcomtee_arg_for_each(i, args) \ 289 for (i = 0; args[i].type != QCOMTEE_ARG_TYPE_INV; i++) 290 291 /* Next argument of type @type after index @i. */ 292 int qcomtee_next_arg_type(struct qcomtee_arg *u, int i, 293 enum qcomtee_arg_type type); 294 295 /* Iterate over argument of given type. */ 296 #define qcomtee_arg_for_each_type(i, args, at) \ 297 for (i = qcomtee_next_arg_type(args, 0, at); \ 298 args[i].type != QCOMTEE_ARG_TYPE_INV; \ 299 i = qcomtee_next_arg_type(args, i + 1, at)) 300 301 #define qcomtee_arg_for_each_input_buffer(i, args) \ 302 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_IB) 303 #define qcomtee_arg_for_each_output_buffer(i, args) \ 304 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_OB) 305 #define qcomtee_arg_for_each_input_object(i, args) \ 306 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_IO) 307 #define qcomtee_arg_for_each_output_object(i, args) \ 308 qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_OO) 309 310 struct qcomtee_object * 311 qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic); 312 313 struct qcomtee_object * 314 qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic, 315 struct qcomtee_object *client_env, u32 uid); 316 317 #endif /* QCOMTEE_OBJECT_H */ 318