1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015-2021, Linaro Limited 4 */ 5 6 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 7 8 #include <linux/delay.h> 9 #include <linux/i2c.h> 10 #include <linux/slab.h> 11 #include <linux/tee_core.h> 12 #include "optee_private.h" 13 #include "optee_rpc_cmd.h" 14 15 static void handle_rpc_func_cmd_get_time(struct optee_msg_arg *arg) 16 { 17 struct timespec64 ts; 18 19 if (arg->num_params != 1) 20 goto bad; 21 if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) != 22 OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT) 23 goto bad; 24 25 ktime_get_real_ts64(&ts); 26 arg->params[0].u.value.a = ts.tv_sec; 27 arg->params[0].u.value.b = ts.tv_nsec; 28 29 arg->ret = TEEC_SUCCESS; 30 return; 31 bad: 32 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 33 } 34 35 #if IS_REACHABLE(CONFIG_I2C) 36 static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx, 37 struct optee_msg_arg *arg) 38 { 39 struct optee *optee = tee_get_drvdata(ctx->teedev); 40 struct tee_param *params; 41 struct i2c_adapter *adapter; 42 struct i2c_msg msg = { }; 43 size_t i; 44 int ret = -EOPNOTSUPP; 45 u8 attr[] = { 46 TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT, 47 TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT, 48 TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT, 49 TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT, 50 }; 51 52 if (arg->num_params != ARRAY_SIZE(attr)) { 53 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 54 return; 55 } 56 57 params = kmalloc_array(arg->num_params, sizeof(struct tee_param), 58 GFP_KERNEL); 59 if (!params) { 60 arg->ret = TEEC_ERROR_OUT_OF_MEMORY; 61 return; 62 } 63 64 if (optee->ops->from_msg_param(optee, params, arg->num_params, 65 arg->params)) 66 goto bad; 67 68 for (i = 0; i < arg->num_params; i++) { 69 if (params[i].attr != attr[i]) 70 goto bad; 71 } 72 73 adapter = i2c_get_adapter(params[0].u.value.b); 74 if (!adapter) 75 goto bad; 76 77 if (params[1].u.value.a & OPTEE_RPC_I2C_FLAGS_TEN_BIT) { 78 if (!i2c_check_functionality(adapter, 79 I2C_FUNC_10BIT_ADDR)) { 80 i2c_put_adapter(adapter); 81 goto bad; 82 } 83 84 msg.flags = I2C_M_TEN; 85 } 86 87 msg.addr = params[0].u.value.c; 88 msg.buf = params[2].u.memref.shm->kaddr; 89 msg.len = params[2].u.memref.size; 90 91 switch (params[0].u.value.a) { 92 case OPTEE_RPC_I2C_TRANSFER_RD: 93 msg.flags |= I2C_M_RD; 94 break; 95 case OPTEE_RPC_I2C_TRANSFER_WR: 96 break; 97 default: 98 i2c_put_adapter(adapter); 99 goto bad; 100 } 101 102 ret = i2c_transfer(adapter, &msg, 1); 103 104 if (ret < 0) { 105 arg->ret = TEEC_ERROR_COMMUNICATION; 106 } else { 107 params[3].u.value.a = msg.len; 108 if (optee->ops->to_msg_param(optee, arg->params, 109 arg->num_params, params)) 110 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 111 else 112 arg->ret = TEEC_SUCCESS; 113 } 114 115 i2c_put_adapter(adapter); 116 kfree(params); 117 return; 118 bad: 119 kfree(params); 120 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 121 } 122 #else 123 static void handle_rpc_func_cmd_i2c_transfer(struct tee_context *ctx, 124 struct optee_msg_arg *arg) 125 { 126 arg->ret = TEEC_ERROR_NOT_SUPPORTED; 127 } 128 #endif 129 130 static void handle_rpc_func_cmd_wq(struct optee *optee, 131 struct optee_msg_arg *arg) 132 { 133 int rc = 0; 134 135 if (arg->num_params != 1) 136 goto bad; 137 138 if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) != 139 OPTEE_MSG_ATTR_TYPE_VALUE_INPUT) 140 goto bad; 141 142 switch (arg->params[0].u.value.a) { 143 case OPTEE_RPC_NOTIFICATION_WAIT: 144 rc = optee_notif_wait(optee, arg->params[0].u.value.b, arg->params[0].u.value.c); 145 if (rc) 146 goto bad; 147 break; 148 case OPTEE_RPC_NOTIFICATION_SEND: 149 if (optee_notif_send(optee, arg->params[0].u.value.b)) 150 goto bad; 151 break; 152 default: 153 goto bad; 154 } 155 156 arg->ret = TEEC_SUCCESS; 157 return; 158 bad: 159 if (rc == -ETIMEDOUT) 160 arg->ret = TEE_ERROR_TIMEOUT; 161 else 162 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 163 } 164 165 static void handle_rpc_func_cmd_wait(struct optee_msg_arg *arg) 166 { 167 u32 msec_to_wait; 168 169 if (arg->num_params != 1) 170 goto bad; 171 172 if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) != 173 OPTEE_MSG_ATTR_TYPE_VALUE_INPUT) 174 goto bad; 175 176 msec_to_wait = arg->params[0].u.value.a; 177 178 /* Go to interruptible sleep */ 179 msleep_interruptible(msec_to_wait); 180 181 arg->ret = TEEC_SUCCESS; 182 return; 183 bad: 184 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 185 } 186 187 static void handle_rpc_supp_cmd(struct tee_context *ctx, struct optee *optee, 188 struct optee_msg_arg *arg) 189 { 190 struct tee_param *params; 191 192 arg->ret_origin = TEEC_ORIGIN_COMMS; 193 194 params = kmalloc_array(arg->num_params, sizeof(struct tee_param), 195 GFP_KERNEL); 196 if (!params) { 197 arg->ret = TEEC_ERROR_OUT_OF_MEMORY; 198 return; 199 } 200 201 if (optee->ops->from_msg_param(optee, params, arg->num_params, 202 arg->params)) { 203 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 204 goto out; 205 } 206 207 arg->ret = optee_supp_thrd_req(ctx, arg->cmd, arg->num_params, params); 208 209 if (optee->ops->to_msg_param(optee, arg->params, arg->num_params, 210 params)) 211 arg->ret = TEEC_ERROR_BAD_PARAMETERS; 212 out: 213 kfree(params); 214 } 215 216 struct tee_shm *optee_rpc_cmd_alloc_suppl(struct tee_context *ctx, size_t sz) 217 { 218 u32 ret; 219 struct tee_param param; 220 struct optee *optee = tee_get_drvdata(ctx->teedev); 221 struct tee_shm *shm; 222 223 param.attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT; 224 param.u.value.a = OPTEE_RPC_SHM_TYPE_APPL; 225 param.u.value.b = sz; 226 param.u.value.c = 0; 227 228 ret = optee_supp_thrd_req(ctx, OPTEE_RPC_CMD_SHM_ALLOC, 1, ¶m); 229 if (ret) 230 return ERR_PTR(-ENOMEM); 231 232 mutex_lock(&optee->supp.mutex); 233 /* Increases count as secure world doesn't have a reference */ 234 shm = tee_shm_get_from_id(optee->supp.ctx, param.u.value.c); 235 mutex_unlock(&optee->supp.mutex); 236 return shm; 237 } 238 239 void optee_rpc_cmd_free_suppl(struct tee_context *ctx, struct tee_shm *shm) 240 { 241 struct tee_param param; 242 243 param.attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT; 244 param.u.value.a = OPTEE_RPC_SHM_TYPE_APPL; 245 param.u.value.b = tee_shm_get_id(shm); 246 param.u.value.c = 0; 247 248 /* 249 * Match the tee_shm_get_from_id() in cmd_alloc_suppl() as secure 250 * world has released its reference. 251 * 252 * It's better to do this before sending the request to supplicant 253 * as we'd like to let the process doing the initial allocation to 254 * do release the last reference too in order to avoid stacking 255 * many pending fput() on the client process. This could otherwise 256 * happen if secure world does many allocate and free in a single 257 * invoke. 258 */ 259 tee_shm_put(shm); 260 261 optee_supp_thrd_req(ctx, OPTEE_RPC_CMD_SHM_FREE, 1, ¶m); 262 } 263 264 void optee_rpc_cmd(struct tee_context *ctx, struct optee *optee, 265 struct optee_msg_arg *arg) 266 { 267 switch (arg->cmd) { 268 case OPTEE_RPC_CMD_GET_TIME: 269 handle_rpc_func_cmd_get_time(arg); 270 break; 271 case OPTEE_RPC_CMD_NOTIFICATION: 272 handle_rpc_func_cmd_wq(optee, arg); 273 break; 274 case OPTEE_RPC_CMD_SUSPEND: 275 handle_rpc_func_cmd_wait(arg); 276 break; 277 case OPTEE_RPC_CMD_I2C_TRANSFER: 278 handle_rpc_func_cmd_i2c_transfer(ctx, arg); 279 break; 280 default: 281 handle_rpc_supp_cmd(ctx, optee, arg); 282 } 283 } 284 285 286