xref: /linux/drivers/tee/qcomtee/qcomtee_object.h (revision 38057e323657695ec8f814aff0cdd1c7e00d3e9b)
1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
4  */
5 
6 #ifndef QCOMTEE_OBJECT_H
7 #define QCOMTEE_OBJECT_H
8 
9 #include <linux/completion.h>
10 #include <linux/kref.h>
11 #include <linux/slab.h>
12 #include <linux/workqueue.h>
13 
14 struct qcomtee_object;
15 
16 /**
17  * DOC: Overview
18  *
19  * qcomtee_object provides object refcounting, ID allocation for objects hosted
20  * in the kernel, and necessary message marshaling for Qualcomm TEE (QTEE).
21  *
22  * To invoke an object in QTEE, the user calls qcomtee_object_do_invoke()
23  * while passing an instance of &struct qcomtee_object and the requested
24  * operation + arguments.
25  *
26  * After boot, QTEE provides a static object %ROOT_QCOMTEE_OBJECT (type of
27  * %QCOMTEE_OBJECT_TYPE_ROOT). The root object is invoked to pass the user's
28  * credentials and obtain other instances of &struct qcomtee_object (type of
29  * %QCOMTEE_OBJECT_TYPE_TEE) that represent services and TAs in QTEE;
30  * see &enum qcomtee_object_type.
31  *
32  * The objects received from QTEE are refcounted. So the owner of these objects
33  * can issue qcomtee_object_get() to increase the refcount and pass objects
34  * to other clients, or issue qcomtee_object_put() to decrease the refcount
35  * and release the resources in QTEE.
36  *
37  * The kernel can host services accessible to QTEE. A driver should embed
38  * an instance of &struct qcomtee_object in the struct it wants to export to
39  * QTEE (this is called a callback object). It issues qcomtee_object_user_init()
40  * to set the dispatch() operation for the callback object and set its type
41  * to %QCOMTEE_OBJECT_TYPE_CB.
42  *
43  * core.c holds an object table for callback objects. An object ID is assigned
44  * to each callback object, which is an index to the object table. QTEE uses
45  * these IDs to reference or invoke callback objects.
46  *
47  * If QTEE invokes a callback object in the kernel, the dispatch() operation is
48  * called in the context of the thread that originally called
49  * qcomtee_object_do_invoke().
50  */
51 
52 /**
53  * enum qcomtee_object_type - Object types.
54  * @QCOMTEE_OBJECT_TYPE_TEE: object hosted on QTEE.
55  * @QCOMTEE_OBJECT_TYPE_CB: object hosted on kernel.
56  * @QCOMTEE_OBJECT_TYPE_ROOT: 'primordial' object.
57  * @QCOMTEE_OBJECT_TYPE_NULL: NULL object.
58  *
59  * The primordial object is used for bootstrapping the IPC connection between
60  * the kernel and QTEE. It is invoked by the kernel when it wants to get a
61  * 'client env'.
62  */
63 enum qcomtee_object_type {
64 	QCOMTEE_OBJECT_TYPE_TEE,
65 	QCOMTEE_OBJECT_TYPE_CB,
66 	QCOMTEE_OBJECT_TYPE_ROOT,
67 	QCOMTEE_OBJECT_TYPE_NULL,
68 };
69 
70 /**
71  * enum qcomtee_arg_type - Type of QTEE argument.
72  * @QCOMTEE_ARG_TYPE_INV: invalid type.
73  * @QCOMTEE_ARG_TYPE_OB: output buffer (OB).
74  * @QCOMTEE_ARG_TYPE_OO: output object (OO).
75  * @QCOMTEE_ARG_TYPE_IB: input buffer (IB).
76  * @QCOMTEE_ARG_TYPE_IO: input object (IO).
77  *
78  * Use the invalid type to specify the end of the argument array.
79  */
80 enum qcomtee_arg_type {
81 	QCOMTEE_ARG_TYPE_INV = 0,
82 	QCOMTEE_ARG_TYPE_OB,
83 	QCOMTEE_ARG_TYPE_OO,
84 	QCOMTEE_ARG_TYPE_IB,
85 	QCOMTEE_ARG_TYPE_IO,
86 	QCOMTEE_ARG_TYPE_NR,
87 };
88 
89 /**
90  * define QCOMTEE_ARGS_PER_TYPE - Maximum arguments of a specific type.
91  *
92  * The QTEE transport protocol limits the maximum number of arguments of
93  * a specific type (i.e., IB, OB, IO, and OO).
94  */
95 #define QCOMTEE_ARGS_PER_TYPE 16
96 
97 /* Maximum arguments that can fit in a QTEE message, ignoring the type. */
98 #define QCOMTEE_ARGS_MAX (QCOMTEE_ARGS_PER_TYPE * (QCOMTEE_ARG_TYPE_NR - 1))
99 
100 struct qcomtee_buffer {
101 	union {
102 		void *addr;
103 		void __user *uaddr;
104 	};
105 	size_t size;
106 };
107 
108 /**
109  * struct qcomtee_arg - Argument for QTEE object invocation.
110  * @type: type of argument as &enum qcomtee_arg_type.
111  * @flags: extra flags.
112  * @b: address and size if the type of argument is a buffer.
113  * @o: object instance if the type of argument is an object.
114  *
115  * &qcomtee_arg.flags only accepts %QCOMTEE_ARG_FLAGS_UADDR for now, which
116  * states that &qcomtee_arg.b contains a userspace address in uaddr.
117  */
118 struct qcomtee_arg {
119 	enum qcomtee_arg_type type;
120 /* 'b.uaddr' holds a __user address. */
121 #define QCOMTEE_ARG_FLAGS_UADDR BIT(0)
122 	unsigned int flags;
123 	union {
124 		struct qcomtee_buffer b;
125 		struct qcomtee_object *o;
126 	};
127 };
128 
129 static inline int qcomtee_args_len(struct qcomtee_arg *args)
130 {
131 	int i = 0;
132 
133 	while (args[i].type != QCOMTEE_ARG_TYPE_INV)
134 		i++;
135 	return i;
136 }
137 
138 /* Context is busy (callback is in progress). */
139 #define QCOMTEE_OIC_FLAG_BUSY BIT(1)
140 /* Context needs to notify the current object. */
141 #define QCOMTEE_OIC_FLAG_NOTIFY BIT(2)
142 /* Context has shared state with QTEE. */
143 #define QCOMTEE_OIC_FLAG_SHARED BIT(3)
144 
145 /**
146  * struct qcomtee_object_invoke_ctx - QTEE context for object invocation.
147  * @ctx: TEE context for this invocation.
148  * @flags: flags for the invocation context.
149  * @errno: error code for the invocation.
150  * @object: current object invoked in this callback context.
151  * @u: array of arguments for the current invocation (+1 for ending arg).
152  * @in_msg: inbound buffer shared with QTEE.
153  * @out_msg: outbound buffer shared with QTEE.
154  * @in_shm: TEE shm allocated for inbound buffer.
155  * @out_shm: TEE shm allocated for outbound buffer.
156  * @data: extra data attached to this context.
157  */
158 struct qcomtee_object_invoke_ctx {
159 	struct tee_context *ctx;
160 	unsigned long flags;
161 	int errno;
162 
163 	struct qcomtee_object *object;
164 	struct qcomtee_arg u[QCOMTEE_ARGS_MAX + 1];
165 
166 	struct qcomtee_buffer in_msg;
167 	struct qcomtee_buffer out_msg;
168 	struct tee_shm *in_shm;
169 	struct tee_shm *out_shm;
170 
171 	void *data;
172 };
173 
174 static inline struct qcomtee_object_invoke_ctx *
175 qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx)
176 {
177 	struct qcomtee_object_invoke_ctx *oic;
178 
179 	oic = kzalloc(sizeof(*oic), GFP_KERNEL);
180 	if (oic)
181 		oic->ctx = ctx;
182 	return oic;
183 }
184 
185 /**
186  * qcomtee_object_do_invoke() - Submit an invocation for an object.
187  * @oic: context to use for the current invocation.
188  * @object: object being invoked.
189  * @op: requested operation on the object.
190  * @u: array of arguments for the current invocation.
191  * @result: result returned from QTEE.
192  *
193  * The caller is responsible for keeping track of the refcount for each object,
194  * including @object. On return, the caller loses ownership of all input
195  * objects of type %QCOMTEE_OBJECT_TYPE_CB.
196  *
197  * @object can be of %QCOMTEE_OBJECT_TYPE_ROOT or %QCOMTEE_OBJECT_TYPE_TEE.
198  *
199  * Return: On success, returns 0; on failure, returns < 0.
200  */
201 int qcomtee_object_do_invoke(struct qcomtee_object_invoke_ctx *oic,
202 			     struct qcomtee_object *object, u32 op,
203 			     struct qcomtee_arg *u, int *result);
204 
205 /**
206  * struct qcomtee_object_operations - Callback object operations.
207  * @release: release the object if QTEE is not using it.
208  * @dispatch: dispatch the operation requested by QTEE.
209  * @notify: report the status of any pending response submitted by @dispatch.
210  */
211 struct qcomtee_object_operations {
212 	void (*release)(struct qcomtee_object *object);
213 	int (*dispatch)(struct qcomtee_object_invoke_ctx *oic,
214 			struct qcomtee_object *object, u32 op,
215 			struct qcomtee_arg *args);
216 	void (*notify)(struct qcomtee_object_invoke_ctx *oic,
217 		       struct qcomtee_object *object, int err);
218 };
219 
220 /**
221  * struct qcomtee_object - QTEE or kernel object.
222  * @name: object name.
223  * @refcount: reference counter.
224  * @object_type: object type as &enum qcomtee_object_type.
225  * @info: extra information for the object.
226  * @ops: callback operations for objects of type %QCOMTEE_OBJECT_TYPE_CB.
227  * @work: work for async operations on the object.
228  *
229  * @work is used for releasing objects of %QCOMTEE_OBJECT_TYPE_TEE type.
230  */
231 struct qcomtee_object {
232 	const char *name;
233 	struct kref refcount;
234 
235 	enum qcomtee_object_type object_type;
236 	struct object_info {
237 		unsigned long qtee_id;
238 		/* TEE context for QTEE object async requests. */
239 		struct tee_context *qcomtee_async_ctx;
240 	} info;
241 
242 	struct qcomtee_object_operations *ops;
243 	struct work_struct work;
244 };
245 
246 /* Static instances of qcomtee_object objects. */
247 #define NULL_QCOMTEE_OBJECT ((struct qcomtee_object *)(0))
248 extern struct qcomtee_object qcomtee_object_root;
249 #define ROOT_QCOMTEE_OBJECT (&qcomtee_object_root)
250 
251 static inline enum qcomtee_object_type
252 typeof_qcomtee_object(struct qcomtee_object *object)
253 {
254 	if (object == NULL_QCOMTEE_OBJECT)
255 		return QCOMTEE_OBJECT_TYPE_NULL;
256 	return object->object_type;
257 }
258 
259 static inline const char *qcomtee_object_name(struct qcomtee_object *object)
260 {
261 	if (object == NULL_QCOMTEE_OBJECT)
262 		return "null";
263 
264 	if (!object->name)
265 		return "no-name";
266 	return object->name;
267 }
268 
269 /**
270  * qcomtee_object_user_init() - Initialize an object for the user.
271  * @object: object to initialize.
272  * @ot: type of object as &enum qcomtee_object_type.
273  * @ops: instance of callbacks.
274  * @fmt: name assigned to the object.
275  *
276  * Return: On success, returns 0; on failure, returns < 0.
277  */
278 int qcomtee_object_user_init(struct qcomtee_object *object,
279 			     enum qcomtee_object_type ot,
280 			     struct qcomtee_object_operations *ops,
281 			     const char *fmt, ...) __printf(4, 5);
282 
283 /* Object release is RCU protected. */
284 int qcomtee_object_get(struct qcomtee_object *object);
285 void qcomtee_object_put(struct qcomtee_object *object);
286 
287 #define qcomtee_arg_for_each(i, args) \
288 	for (i = 0; args[i].type != QCOMTEE_ARG_TYPE_INV; i++)
289 
290 /* Next argument of type @type after index @i. */
291 int qcomtee_next_arg_type(struct qcomtee_arg *u, int i,
292 			  enum qcomtee_arg_type type);
293 
294 /* Iterate over argument of given type. */
295 #define qcomtee_arg_for_each_type(i, args, at)       \
296 	for (i = qcomtee_next_arg_type(args, 0, at); \
297 	     args[i].type != QCOMTEE_ARG_TYPE_INV;   \
298 	     i = qcomtee_next_arg_type(args, i + 1, at))
299 
300 #define qcomtee_arg_for_each_input_buffer(i, args) \
301 	qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_IB)
302 #define qcomtee_arg_for_each_output_buffer(i, args) \
303 	qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_OB)
304 #define qcomtee_arg_for_each_input_object(i, args) \
305 	qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_IO)
306 #define qcomtee_arg_for_each_output_object(i, args) \
307 	qcomtee_arg_for_each_type(i, args, QCOMTEE_ARG_TYPE_OO)
308 
309 struct qcomtee_object *
310 qcomtee_object_get_client_env(struct qcomtee_object_invoke_ctx *oic);
311 
312 struct qcomtee_object *
313 qcomtee_object_get_service(struct qcomtee_object_invoke_ctx *oic,
314 			   struct qcomtee_object *client_env, u32 uid);
315 
316 #endif /* QCOMTEE_OBJECT_H */
317