xref: /linux/drivers/tee/optee/rpc.c (revision 4fd18fc38757217c746aa063ba9e4729814dc737) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * Copyright (c) 2015-2016, Linaro Limited
4  */
5 
6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
7 
8 #include <linux/delay.h>
9 #include <linux/device.h>
10 #include <linux/i2c.h>
11 #include <linux/slab.h>
12 #include <linux/tee_drv.h>
13 #include "optee_private.h"
14 #include "optee_smc.h"
15 
16 struct wq_entry {
17 	struct list_head link;
18 	struct completion c;
19 	u32 key;
20 };
21 
22 void optee_wait_queue_init(struct optee_wait_queue *priv)
23 {
24 	mutex_init(&priv->mu);
25 	INIT_LIST_HEAD(&priv->db);
26 }
27 
28 void optee_wait_queue_exit(struct optee_wait_queue *priv)
29 {
30 	mutex_destroy(&priv->mu);
31 }
32 
33 static void handle_rpc_func_cmd_get_time(struct optee_msg_arg *arg)
34 {
35 	struct timespec64 ts;
36 
37 	if (arg->num_params != 1)
38 		goto bad;
39 	if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) !=
40 			OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT)
41 		goto bad;
42 
43 	ktime_get_real_ts64(&ts);
44 	arg->params[0].u.value.a = ts.tv_sec;
45 	arg->params[0].u.value.b = ts.tv_nsec;
46 
47 	arg->ret = TEEC_SUCCESS;
48 	return;
49 bad:
50 	arg->ret = TEEC_ERROR_BAD_PARAMETERS;
51 }
52 
53 #if IS_REACHABLE(CONFIG_I2C)
54 static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx,
55 					     struct optee_msg_arg *arg)
56 {
57 	struct i2c_client client = { 0 };
58 	struct tee_param *params;
59 	size_t i;
60 	int ret = -EOPNOTSUPP;
61 	u8 attr[] = {
62 		TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
63 		TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT,
64 		TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT,
65 		TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT,
66 	};
67 
68 	if (arg->num_params != ARRAY_SIZE(attr)) {
69 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
70 		return;
71 	}
72 
73 	params = kmalloc_array(arg->num_params, sizeof(struct tee_param),
74 			       GFP_KERNEL);
75 	if (!params) {
76 		arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
77 		return;
78 	}
79 
80 	if (optee_from_msg_param(params, arg->num_params, arg->params))
81 		goto bad;
82 
83 	for (i = 0; i < arg->num_params; i++) {
84 		if (params[i].attr != attr[i])
85 			goto bad;
86 	}
87 
88 	client.adapter = i2c_get_adapter(params[0].u.value.b);
89 	if (!client.adapter)
90 		goto bad;
91 
92 	if (params[1].u.value.a & OPTEE_MSG_RPC_CMD_I2C_FLAGS_TEN_BIT) {
93 		if (!i2c_check_functionality(client.adapter,
94 					     I2C_FUNC_10BIT_ADDR)) {
95 			i2c_put_adapter(client.adapter);
96 			goto bad;
97 		}
98 
99 		client.flags = I2C_CLIENT_TEN;
100 	}
101 
102 	client.addr = params[0].u.value.c;
103 	snprintf(client.name, I2C_NAME_SIZE, "i2c%d", client.adapter->nr);
104 
105 	switch (params[0].u.value.a) {
106 	case OPTEE_MSG_RPC_CMD_I2C_TRANSFER_RD:
107 		ret = i2c_master_recv(&client, params[2].u.memref.shm->kaddr,
108 				      params[2].u.memref.size);
109 		break;
110 	case OPTEE_MSG_RPC_CMD_I2C_TRANSFER_WR:
111 		ret = i2c_master_send(&client, params[2].u.memref.shm->kaddr,
112 				      params[2].u.memref.size);
113 		break;
114 	default:
115 		i2c_put_adapter(client.adapter);
116 		goto bad;
117 	}
118 
119 	if (ret < 0) {
120 		arg->ret = TEEC_ERROR_COMMUNICATION;
121 	} else {
122 		params[3].u.value.a = ret;
123 		if (optee_to_msg_param(arg->params, arg->num_params, params))
124 			arg->ret = TEEC_ERROR_BAD_PARAMETERS;
125 		else
126 			arg->ret = TEEC_SUCCESS;
127 	}
128 
129 	i2c_put_adapter(client.adapter);
130 	kfree(params);
131 	return;
132 bad:
133 	kfree(params);
134 	arg->ret = TEEC_ERROR_BAD_PARAMETERS;
135 }
136 #else
137 static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx,
138 					     struct optee_msg_arg *arg)
139 {
140 	arg->ret = TEEC_ERROR_NOT_SUPPORTED;
141 }
142 #endif
143 
144 static struct wq_entry *wq_entry_get(struct optee_wait_queue *wq, u32 key)
145 {
146 	struct wq_entry *w;
147 
148 	mutex_lock(&wq->mu);
149 
150 	list_for_each_entry(w, &wq->db, link)
151 		if (w->key == key)
152 			goto out;
153 
154 	w = kmalloc(sizeof(*w), GFP_KERNEL);
155 	if (w) {
156 		init_completion(&w->c);
157 		w->key = key;
158 		list_add_tail(&w->link, &wq->db);
159 	}
160 out:
161 	mutex_unlock(&wq->mu);
162 	return w;
163 }
164 
165 static void wq_sleep(struct optee_wait_queue *wq, u32 key)
166 {
167 	struct wq_entry *w = wq_entry_get(wq, key);
168 
169 	if (w) {
170 		wait_for_completion(&w->c);
171 		mutex_lock(&wq->mu);
172 		list_del(&w->link);
173 		mutex_unlock(&wq->mu);
174 		kfree(w);
175 	}
176 }
177 
178 static void wq_wakeup(struct optee_wait_queue *wq, u32 key)
179 {
180 	struct wq_entry *w = wq_entry_get(wq, key);
181 
182 	if (w)
183 		complete(&w->c);
184 }
185 
186 static void handle_rpc_func_cmd_wq(struct optee *optee,
187 				   struct optee_msg_arg *arg)
188 {
189 	if (arg->num_params != 1)
190 		goto bad;
191 
192 	if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) !=
193 			OPTEE_MSG_ATTR_TYPE_VALUE_INPUT)
194 		goto bad;
195 
196 	switch (arg->params[0].u.value.a) {
197 	case OPTEE_MSG_RPC_WAIT_QUEUE_SLEEP:
198 		wq_sleep(&optee->wait_queue, arg->params[0].u.value.b);
199 		break;
200 	case OPTEE_MSG_RPC_WAIT_QUEUE_WAKEUP:
201 		wq_wakeup(&optee->wait_queue, arg->params[0].u.value.b);
202 		break;
203 	default:
204 		goto bad;
205 	}
206 
207 	arg->ret = TEEC_SUCCESS;
208 	return;
209 bad:
210 	arg->ret = TEEC_ERROR_BAD_PARAMETERS;
211 }
212 
213 static void handle_rpc_func_cmd_wait(struct optee_msg_arg *arg)
214 {
215 	u32 msec_to_wait;
216 
217 	if (arg->num_params != 1)
218 		goto bad;
219 
220 	if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) !=
221 			OPTEE_MSG_ATTR_TYPE_VALUE_INPUT)
222 		goto bad;
223 
224 	msec_to_wait = arg->params[0].u.value.a;
225 
226 	/* Go to interruptible sleep */
227 	msleep_interruptible(msec_to_wait);
228 
229 	arg->ret = TEEC_SUCCESS;
230 	return;
231 bad:
232 	arg->ret = TEEC_ERROR_BAD_PARAMETERS;
233 }
234 
235 static void handle_rpc_supp_cmd(struct tee_context *ctx,
236 				struct optee_msg_arg *arg)
237 {
238 	struct tee_param *params;
239 
240 	arg->ret_origin = TEEC_ORIGIN_COMMS;
241 
242 	params = kmalloc_array(arg->num_params, sizeof(struct tee_param),
243 			       GFP_KERNEL);
244 	if (!params) {
245 		arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
246 		return;
247 	}
248 
249 	if (optee_from_msg_param(params, arg->num_params, arg->params)) {
250 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
251 		goto out;
252 	}
253 
254 	arg->ret = optee_supp_thrd_req(ctx, arg->cmd, arg->num_params, params);
255 
256 	if (optee_to_msg_param(arg->params, arg->num_params, params))
257 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
258 out:
259 	kfree(params);
260 }
261 
262 static struct tee_shm *cmd_alloc_suppl(struct tee_context *ctx, size_t sz)
263 {
264 	u32 ret;
265 	struct tee_param param;
266 	struct optee *optee = tee_get_drvdata(ctx->teedev);
267 	struct tee_shm *shm;
268 
269 	param.attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT;
270 	param.u.value.a = OPTEE_MSG_RPC_SHM_TYPE_APPL;
271 	param.u.value.b = sz;
272 	param.u.value.c = 0;
273 
274 	ret = optee_supp_thrd_req(ctx, OPTEE_MSG_RPC_CMD_SHM_ALLOC, 1, &param);
275 	if (ret)
276 		return ERR_PTR(-ENOMEM);
277 
278 	mutex_lock(&optee->supp.mutex);
279 	/* Increases count as secure world doesn't have a reference */
280 	shm = tee_shm_get_from_id(optee->supp.ctx, param.u.value.c);
281 	mutex_unlock(&optee->supp.mutex);
282 	return shm;
283 }
284 
285 static void handle_rpc_func_cmd_shm_alloc(struct tee_context *ctx,
286 					  struct optee_msg_arg *arg,
287 					  struct optee_call_ctx *call_ctx)
288 {
289 	phys_addr_t pa;
290 	struct tee_shm *shm;
291 	size_t sz;
292 	size_t n;
293 
294 	arg->ret_origin = TEEC_ORIGIN_COMMS;
295 
296 	if (!arg->num_params ||
297 	    arg->params[0].attr != OPTEE_MSG_ATTR_TYPE_VALUE_INPUT) {
298 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
299 		return;
300 	}
301 
302 	for (n = 1; n < arg->num_params; n++) {
303 		if (arg->params[n].attr != OPTEE_MSG_ATTR_TYPE_NONE) {
304 			arg->ret = TEEC_ERROR_BAD_PARAMETERS;
305 			return;
306 		}
307 	}
308 
309 	sz = arg->params[0].u.value.b;
310 	switch (arg->params[0].u.value.a) {
311 	case OPTEE_MSG_RPC_SHM_TYPE_APPL:
312 		shm = cmd_alloc_suppl(ctx, sz);
313 		break;
314 	case OPTEE_MSG_RPC_SHM_TYPE_KERNEL:
315 		shm = tee_shm_alloc(ctx, sz, TEE_SHM_MAPPED);
316 		break;
317 	default:
318 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
319 		return;
320 	}
321 
322 	if (IS_ERR(shm)) {
323 		arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
324 		return;
325 	}
326 
327 	if (tee_shm_get_pa(shm, 0, &pa)) {
328 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
329 		goto bad;
330 	}
331 
332 	sz = tee_shm_get_size(shm);
333 
334 	if (tee_shm_is_registered(shm)) {
335 		struct page **pages;
336 		u64 *pages_list;
337 		size_t page_num;
338 
339 		pages = tee_shm_get_pages(shm, &page_num);
340 		if (!pages || !page_num) {
341 			arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
342 			goto bad;
343 		}
344 
345 		pages_list = optee_allocate_pages_list(page_num);
346 		if (!pages_list) {
347 			arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
348 			goto bad;
349 		}
350 
351 		call_ctx->pages_list = pages_list;
352 		call_ctx->num_entries = page_num;
353 
354 		arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT |
355 				      OPTEE_MSG_ATTR_NONCONTIG;
356 		/*
357 		 * In the least bits of u.tmem.buf_ptr we store buffer offset
358 		 * from 4k page, as described in OP-TEE ABI.
359 		 */
360 		arg->params[0].u.tmem.buf_ptr = virt_to_phys(pages_list) |
361 			(tee_shm_get_page_offset(shm) &
362 			 (OPTEE_MSG_NONCONTIG_PAGE_SIZE - 1));
363 		arg->params[0].u.tmem.size = tee_shm_get_size(shm);
364 		arg->params[0].u.tmem.shm_ref = (unsigned long)shm;
365 
366 		optee_fill_pages_list(pages_list, pages, page_num,
367 				      tee_shm_get_page_offset(shm));
368 	} else {
369 		arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT;
370 		arg->params[0].u.tmem.buf_ptr = pa;
371 		arg->params[0].u.tmem.size = sz;
372 		arg->params[0].u.tmem.shm_ref = (unsigned long)shm;
373 	}
374 
375 	arg->ret = TEEC_SUCCESS;
376 	return;
377 bad:
378 	tee_shm_free(shm);
379 }
380 
381 static void cmd_free_suppl(struct tee_context *ctx, struct tee_shm *shm)
382 {
383 	struct tee_param param;
384 
385 	param.attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT;
386 	param.u.value.a = OPTEE_MSG_RPC_SHM_TYPE_APPL;
387 	param.u.value.b = tee_shm_get_id(shm);
388 	param.u.value.c = 0;
389 
390 	/*
391 	 * Match the tee_shm_get_from_id() in cmd_alloc_suppl() as secure
392 	 * world has released its reference.
393 	 *
394 	 * It's better to do this before sending the request to supplicant
395 	 * as we'd like to let the process doing the initial allocation to
396 	 * do release the last reference too in order to avoid stacking
397 	 * many pending fput() on the client process. This could otherwise
398 	 * happen if secure world does many allocate and free in a single
399 	 * invoke.
400 	 */
401 	tee_shm_put(shm);
402 
403 	optee_supp_thrd_req(ctx, OPTEE_MSG_RPC_CMD_SHM_FREE, 1, &param);
404 }
405 
406 static void handle_rpc_func_cmd_shm_free(struct tee_context *ctx,
407 					 struct optee_msg_arg *arg)
408 {
409 	struct tee_shm *shm;
410 
411 	arg->ret_origin = TEEC_ORIGIN_COMMS;
412 
413 	if (arg->num_params != 1 ||
414 	    arg->params[0].attr != OPTEE_MSG_ATTR_TYPE_VALUE_INPUT) {
415 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
416 		return;
417 	}
418 
419 	shm = (struct tee_shm *)(unsigned long)arg->params[0].u.value.b;
420 	switch (arg->params[0].u.value.a) {
421 	case OPTEE_MSG_RPC_SHM_TYPE_APPL:
422 		cmd_free_suppl(ctx, shm);
423 		break;
424 	case OPTEE_MSG_RPC_SHM_TYPE_KERNEL:
425 		tee_shm_free(shm);
426 		break;
427 	default:
428 		arg->ret = TEEC_ERROR_BAD_PARAMETERS;
429 	}
430 	arg->ret = TEEC_SUCCESS;
431 }
432 
433 static void free_pages_list(struct optee_call_ctx *call_ctx)
434 {
435 	if (call_ctx->pages_list) {
436 		optee_free_pages_list(call_ctx->pages_list,
437 				      call_ctx->num_entries);
438 		call_ctx->pages_list = NULL;
439 		call_ctx->num_entries = 0;
440 	}
441 }
442 
443 void optee_rpc_finalize_call(struct optee_call_ctx *call_ctx)
444 {
445 	free_pages_list(call_ctx);
446 }
447 
448 static void handle_rpc_func_cmd(struct tee_context *ctx, struct optee *optee,
449 				struct tee_shm *shm,
450 				struct optee_call_ctx *call_ctx)
451 {
452 	struct optee_msg_arg *arg;
453 
454 	arg = tee_shm_get_va(shm, 0);
455 	if (IS_ERR(arg)) {
456 		pr_err("%s: tee_shm_get_va %p failed\n", __func__, shm);
457 		return;
458 	}
459 
460 	switch (arg->cmd) {
461 	case OPTEE_MSG_RPC_CMD_GET_TIME:
462 		handle_rpc_func_cmd_get_time(arg);
463 		break;
464 	case OPTEE_MSG_RPC_CMD_WAIT_QUEUE:
465 		handle_rpc_func_cmd_wq(optee, arg);
466 		break;
467 	case OPTEE_MSG_RPC_CMD_SUSPEND:
468 		handle_rpc_func_cmd_wait(arg);
469 		break;
470 	case OPTEE_MSG_RPC_CMD_SHM_ALLOC:
471 		free_pages_list(call_ctx);
472 		handle_rpc_func_cmd_shm_alloc(ctx, arg, call_ctx);
473 		break;
474 	case OPTEE_MSG_RPC_CMD_SHM_FREE:
475 		handle_rpc_func_cmd_shm_free(ctx, arg);
476 		break;
477 	case OPTEE_MSG_RPC_CMD_I2C_TRANSFER:
478 		handle_rpc_func_cmd_i2c_transfer(ctx, arg);
479 		break;
480 	default:
481 		handle_rpc_supp_cmd(ctx, arg);
482 	}
483 }
484 
485 /**
486  * optee_handle_rpc() - handle RPC from secure world
487  * @ctx:	context doing the RPC
488  * @param:	value of registers for the RPC
489  * @call_ctx:	call context. Preserved during one OP-TEE invocation
490  *
491  * Result of RPC is written back into @param.
492  */
493 void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,
494 		      struct optee_call_ctx *call_ctx)
495 {
496 	struct tee_device *teedev = ctx->teedev;
497 	struct optee *optee = tee_get_drvdata(teedev);
498 	struct tee_shm *shm;
499 	phys_addr_t pa;
500 
501 	switch (OPTEE_SMC_RETURN_GET_RPC_FUNC(param->a0)) {
502 	case OPTEE_SMC_RPC_FUNC_ALLOC:
503 		shm = tee_shm_alloc(ctx, param->a1, TEE_SHM_MAPPED);
504 		if (!IS_ERR(shm) && !tee_shm_get_pa(shm, 0, &pa)) {
505 			reg_pair_from_64(&param->a1, &param->a2, pa);
506 			reg_pair_from_64(&param->a4, &param->a5,
507 					 (unsigned long)shm);
508 		} else {
509 			param->a1 = 0;
510 			param->a2 = 0;
511 			param->a4 = 0;
512 			param->a5 = 0;
513 		}
514 		break;
515 	case OPTEE_SMC_RPC_FUNC_FREE:
516 		shm = reg_pair_to_ptr(param->a1, param->a2);
517 		tee_shm_free(shm);
518 		break;
519 	case OPTEE_SMC_RPC_FUNC_FOREIGN_INTR:
520 		/*
521 		 * A foreign interrupt was raised while secure world was
522 		 * executing, since they are handled in Linux a dummy RPC is
523 		 * performed to let Linux take the interrupt through the normal
524 		 * vector.
525 		 */
526 		break;
527 	case OPTEE_SMC_RPC_FUNC_CMD:
528 		shm = reg_pair_to_ptr(param->a1, param->a2);
529 		handle_rpc_func_cmd(ctx, optee, shm, call_ctx);
530 		break;
531 	default:
532 		pr_warn("Unknown RPC func 0x%x\n",
533 			(u32)OPTEE_SMC_RETURN_GET_RPC_FUNC(param->a0));
534 		break;
535 	}
536 
537 	param->a0 = OPTEE_SMC_CALL_RETURN_FROM_RPC;
538 }
539