1 /* SPDX-License-Identifier: GPL-2.0-only */
2 /*
3  * Copyright (c) 2015-2016, Linaro Limited
4  */
5 
6 #ifndef __TEE_DRV_H
7 #define __TEE_DRV_H
8 
9 #include <linux/device.h>
10 #include <linux/idr.h>
11 #include <linux/kref.h>
12 #include <linux/list.h>
13 #include <linux/mod_devicetable.h>
14 #include <linux/tee.h>
15 #include <linux/types.h>
16 #include <linux/uuid.h>
17 
18 /*
19  * The file describes the API provided by the generic TEE driver to the
20  * specific TEE driver.
21  */
22 
23 #define TEE_SHM_MAPPED		BIT(0)	/* Memory mapped by the kernel */
24 #define TEE_SHM_DMA_BUF		BIT(1)	/* Memory with dma-buf handle */
25 #define TEE_SHM_EXT_DMA_BUF	BIT(2)	/* Memory with dma-buf handle */
26 #define TEE_SHM_REGISTER	BIT(3)  /* Memory registered in secure world */
27 #define TEE_SHM_USER_MAPPED	BIT(4)  /* Memory mapped in user space */
28 #define TEE_SHM_POOL		BIT(5)  /* Memory allocated from pool */
29 #define TEE_SHM_KERNEL_MAPPED	BIT(6)  /* Memory mapped in kernel space */
30 #define TEE_SHM_PRIV		BIT(7)  /* Memory private to TEE driver */
31 
32 struct device;
33 struct tee_device;
34 struct tee_shm;
35 struct tee_shm_pool;
36 
37 /**
38  * struct tee_context - driver specific context on file pointer data
39  * @teedev:	pointer to this drivers struct tee_device
40  * @list_shm:	List of shared memory object owned by this context
41  * @data:	driver specific context data, managed by the driver
42  * @refcount:	reference counter for this structure
43  * @releasing:  flag that indicates if context is being released right now.
44  *		It is needed to break circular dependency on context during
45  *              shared memory release.
46  * @supp_nowait: flag that indicates that requests in this context should not
47  *              wait for tee-supplicant daemon to be started if not present
48  *              and just return with an error code. It is needed for requests
49  *              that arises from TEE based kernel drivers that should be
50  *              non-blocking in nature.
51  * @cap_memref_null: flag indicating if the TEE Client support shared
52  *                   memory buffer with a NULL pointer.
53  */
54 struct tee_context {
55 	struct tee_device *teedev;
56 	void *data;
57 	struct kref refcount;
58 	bool releasing;
59 	bool supp_nowait;
60 	bool cap_memref_null;
61 };
62 
63 struct tee_param_memref {
64 	size_t shm_offs;
65 	size_t size;
66 	struct tee_shm *shm;
67 };
68 
69 struct tee_param_value {
70 	u64 a;
71 	u64 b;
72 	u64 c;
73 };
74 
75 struct tee_param {
76 	u64 attr;
77 	union {
78 		struct tee_param_memref memref;
79 		struct tee_param_value value;
80 	} u;
81 };
82 
83 /**
84  * struct tee_driver_ops - driver operations vtable
85  * @get_version:	returns version of driver
86  * @open:		called when the device file is opened
87  * @release:		release this open file
88  * @open_session:	open a new session
89  * @close_session:	close a session
90  * @invoke_func:	invoke a trusted function
91  * @cancel_req:		request cancel of an ongoing invoke or open
92  * @supp_recv:		called for supplicant to get a command
93  * @supp_send:		called for supplicant to send a response
94  * @shm_register:	register shared memory buffer in TEE
95  * @shm_unregister:	unregister shared memory buffer in TEE
96  */
97 struct tee_driver_ops {
98 	void (*get_version)(struct tee_device *teedev,
99 			    struct tee_ioctl_version_data *vers);
100 	int (*open)(struct tee_context *ctx);
101 	void (*release)(struct tee_context *ctx);
102 	int (*open_session)(struct tee_context *ctx,
103 			    struct tee_ioctl_open_session_arg *arg,
104 			    struct tee_param *param);
105 	int (*close_session)(struct tee_context *ctx, u32 session);
106 	int (*invoke_func)(struct tee_context *ctx,
107 			   struct tee_ioctl_invoke_arg *arg,
108 			   struct tee_param *param);
109 	int (*cancel_req)(struct tee_context *ctx, u32 cancel_id, u32 session);
110 	int (*supp_recv)(struct tee_context *ctx, u32 *func, u32 *num_params,
111 			 struct tee_param *param);
112 	int (*supp_send)(struct tee_context *ctx, u32 ret, u32 num_params,
113 			 struct tee_param *param);
114 	int (*shm_register)(struct tee_context *ctx, struct tee_shm *shm,
115 			    struct page **pages, size_t num_pages,
116 			    unsigned long start);
117 	int (*shm_unregister)(struct tee_context *ctx, struct tee_shm *shm);
118 };
119 
120 /**
121  * struct tee_desc - Describes the TEE driver to the subsystem
122  * @name:	name of driver
123  * @ops:	driver operations vtable
124  * @owner:	module providing the driver
125  * @flags:	Extra properties of driver, defined by TEE_DESC_* below
126  */
127 #define TEE_DESC_PRIVILEGED	0x1
128 struct tee_desc {
129 	const char *name;
130 	const struct tee_driver_ops *ops;
131 	struct module *owner;
132 	u32 flags;
133 };
134 
135 /**
136  * tee_device_alloc() - Allocate a new struct tee_device instance
137  * @teedesc:	Descriptor for this driver
138  * @dev:	Parent device for this device
139  * @pool:	Shared memory pool, NULL if not used
140  * @driver_data: Private driver data for this device
141  *
142  * Allocates a new struct tee_device instance. The device is
143  * removed by tee_device_unregister().
144  *
145  * @returns a pointer to a 'struct tee_device' or an ERR_PTR on failure
146  */
147 struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
148 				    struct device *dev,
149 				    struct tee_shm_pool *pool,
150 				    void *driver_data);
151 
152 /**
153  * tee_device_register() - Registers a TEE device
154  * @teedev:	Device to register
155  *
156  * tee_device_unregister() need to be called to remove the @teedev if
157  * this function fails.
158  *
159  * @returns < 0 on failure
160  */
161 int tee_device_register(struct tee_device *teedev);
162 
163 /**
164  * tee_device_unregister() - Removes a TEE device
165  * @teedev:	Device to unregister
166  *
167  * This function should be called to remove the @teedev even if
168  * tee_device_register() hasn't been called yet. Does nothing if
169  * @teedev is NULL.
170  */
171 void tee_device_unregister(struct tee_device *teedev);
172 
173 /**
174  * tee_session_calc_client_uuid() - Calculates client UUID for session
175  * @uuid:		Resulting UUID
176  * @connection_method:	Connection method for session (TEE_IOCTL_LOGIN_*)
177  * @connectuon_data:	Connection data for opening session
178  *
179  * Based on connection method calculates UUIDv5 based client UUID.
180  *
181  * For group based logins verifies that calling process has specified
182  * credentials.
183  *
184  * @return < 0 on failure
185  */
186 int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method,
187 				 const u8 connection_data[TEE_IOCTL_UUID_LEN]);
188 
189 /**
190  * struct tee_shm - shared memory object
191  * @ctx:	context using the object
192  * @paddr:	physical address of the shared memory
193  * @kaddr:	virtual address of the shared memory
194  * @size:	size of shared memory
195  * @offset:	offset of buffer in user space
196  * @pages:	locked pages from userspace
197  * @num_pages:	number of locked pages
198  * @refcount:	reference counter
199  * @flags:	defined by TEE_SHM_* in tee_drv.h
200  * @id:		unique id of a shared memory object on this device, shared
201  *		with user space
202  * @sec_world_id:
203  *		secure world assigned id of this shared memory object, not
204  *		used by all drivers
205  *
206  * This pool is only supposed to be accessed directly from the TEE
207  * subsystem and from drivers that implements their own shm pool manager.
208  */
209 struct tee_shm {
210 	struct tee_context *ctx;
211 	phys_addr_t paddr;
212 	void *kaddr;
213 	size_t size;
214 	unsigned int offset;
215 	struct page **pages;
216 	size_t num_pages;
217 	refcount_t refcount;
218 	u32 flags;
219 	int id;
220 	u64 sec_world_id;
221 };
222 
223 /**
224  * struct tee_shm_pool_mgr - shared memory manager
225  * @ops:		operations
226  * @private_data:	private data for the shared memory manager
227  */
228 struct tee_shm_pool_mgr {
229 	const struct tee_shm_pool_mgr_ops *ops;
230 	void *private_data;
231 };
232 
233 /**
234  * struct tee_shm_pool_mgr_ops - shared memory pool manager operations
235  * @alloc:		called when allocating shared memory
236  * @free:		called when freeing shared memory
237  * @destroy_poolmgr:	called when destroying the pool manager
238  */
239 struct tee_shm_pool_mgr_ops {
240 	int (*alloc)(struct tee_shm_pool_mgr *poolmgr, struct tee_shm *shm,
241 		     size_t size);
242 	void (*free)(struct tee_shm_pool_mgr *poolmgr, struct tee_shm *shm);
243 	void (*destroy_poolmgr)(struct tee_shm_pool_mgr *poolmgr);
244 };
245 
246 /**
247  * tee_shm_pool_alloc() - Create a shared memory pool from shm managers
248  * @priv_mgr:	manager for driver private shared memory allocations
249  * @dmabuf_mgr:	manager for dma-buf shared memory allocations
250  *
251  * Allocation with the flag TEE_SHM_DMA_BUF set will use the range supplied
252  * in @dmabuf, others will use the range provided by @priv.
253  *
254  * @returns pointer to a 'struct tee_shm_pool' or an ERR_PTR on failure.
255  */
256 struct tee_shm_pool *tee_shm_pool_alloc(struct tee_shm_pool_mgr *priv_mgr,
257 					struct tee_shm_pool_mgr *dmabuf_mgr);
258 
259 /*
260  * tee_shm_pool_mgr_alloc_res_mem() - Create a shm manager for reserved
261  * memory
262  * @vaddr:	Virtual address of start of pool
263  * @paddr:	Physical address of start of pool
264  * @size:	Size in bytes of the pool
265  *
266  * @returns pointer to a 'struct tee_shm_pool_mgr' or an ERR_PTR on failure.
267  */
268 struct tee_shm_pool_mgr *tee_shm_pool_mgr_alloc_res_mem(unsigned long vaddr,
269 							phys_addr_t paddr,
270 							size_t size,
271 							int min_alloc_order);
272 
273 /**
274  * tee_shm_pool_mgr_destroy() - Free a shared memory manager
275  */
tee_shm_pool_mgr_destroy(struct tee_shm_pool_mgr * poolm)276 static inline void tee_shm_pool_mgr_destroy(struct tee_shm_pool_mgr *poolm)
277 {
278 	poolm->ops->destroy_poolmgr(poolm);
279 }
280 
281 /**
282  * struct tee_shm_pool_mem_info - holds information needed to create a shared
283  * memory pool
284  * @vaddr:	Virtual address of start of pool
285  * @paddr:	Physical address of start of pool
286  * @size:	Size in bytes of the pool
287  */
288 struct tee_shm_pool_mem_info {
289 	unsigned long vaddr;
290 	phys_addr_t paddr;
291 	size_t size;
292 };
293 
294 /**
295  * tee_shm_pool_alloc_res_mem() - Create a shared memory pool from reserved
296  * memory range
297  * @priv_info:	 Information for driver private shared memory pool
298  * @dmabuf_info: Information for dma-buf shared memory pool
299  *
300  * Start and end of pools will must be page aligned.
301  *
302  * Allocation with the flag TEE_SHM_DMA_BUF set will use the range supplied
303  * in @dmabuf, others will use the range provided by @priv.
304  *
305  * @returns pointer to a 'struct tee_shm_pool' or an ERR_PTR on failure.
306  */
307 struct tee_shm_pool *
308 tee_shm_pool_alloc_res_mem(struct tee_shm_pool_mem_info *priv_info,
309 			   struct tee_shm_pool_mem_info *dmabuf_info);
310 
311 /**
312  * tee_shm_pool_free() - Free a shared memory pool
313  * @pool:	The shared memory pool to free
314  *
315  * The must be no remaining shared memory allocated from this pool when
316  * this function is called.
317  */
318 void tee_shm_pool_free(struct tee_shm_pool *pool);
319 
320 /**
321  * tee_get_drvdata() - Return driver_data pointer
322  * @returns the driver_data pointer supplied to tee_register().
323  */
324 void *tee_get_drvdata(struct tee_device *teedev);
325 
326 /**
327  * tee_shm_alloc() - Allocate shared memory
328  * @ctx:	Context that allocates the shared memory
329  * @size:	Requested size of shared memory
330  * @flags:	Flags setting properties for the requested shared memory.
331  *
332  * Memory allocated as global shared memory is automatically freed when the
333  * TEE file pointer is closed. The @flags field uses the bits defined by
334  * TEE_SHM_* above. TEE_SHM_MAPPED must currently always be set. If
335  * TEE_SHM_DMA_BUF global shared memory will be allocated and associated
336  * with a dma-buf handle, else driver private memory.
337  *
338  * @returns a pointer to 'struct tee_shm'
339  */
340 struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags);
341 struct tee_shm *tee_shm_alloc_kernel_buf(struct tee_context *ctx, size_t size);
342 
343 /**
344  * tee_shm_register() - Register shared memory buffer
345  * @ctx:	Context that registers the shared memory
346  * @addr:	Address is userspace of the shared buffer
347  * @length:	Length of the shared buffer
348  * @flags:	Flags setting properties for the requested shared memory.
349  *
350  * @returns a pointer to 'struct tee_shm'
351  */
352 struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
353 				 size_t length, u32 flags);
354 
355 /**
356  * tee_shm_is_registered() - Check if shared memory object in registered in TEE
357  * @shm:	Shared memory handle
358  * @returns true if object is registered in TEE
359  */
tee_shm_is_registered(struct tee_shm * shm)360 static inline bool tee_shm_is_registered(struct tee_shm *shm)
361 {
362 	return shm && (shm->flags & TEE_SHM_REGISTER);
363 }
364 
365 /**
366  * tee_shm_free() - Free shared memory
367  * @shm:	Handle to shared memory to free
368  */
369 void tee_shm_free(struct tee_shm *shm);
370 
371 /**
372  * tee_shm_put() - Decrease reference count on a shared memory handle
373  * @shm:	Shared memory handle
374  */
375 void tee_shm_put(struct tee_shm *shm);
376 
377 /**
378  * tee_shm_va2pa() - Get physical address of a virtual address
379  * @shm:	Shared memory handle
380  * @va:		Virtual address to tranlsate
381  * @pa:		Returned physical address
382  * @returns 0 on success and < 0 on failure
383  */
384 int tee_shm_va2pa(struct tee_shm *shm, void *va, phys_addr_t *pa);
385 
386 /**
387  * tee_shm_pa2va() - Get virtual address of a physical address
388  * @shm:	Shared memory handle
389  * @pa:		Physical address to tranlsate
390  * @va:		Returned virtual address
391  * @returns 0 on success and < 0 on failure
392  */
393 int tee_shm_pa2va(struct tee_shm *shm, phys_addr_t pa, void **va);
394 
395 /**
396  * tee_shm_get_va() - Get virtual address of a shared memory plus an offset
397  * @shm:	Shared memory handle
398  * @offs:	Offset from start of this shared memory
399  * @returns virtual address of the shared memory + offs if offs is within
400  *	the bounds of this shared memory, else an ERR_PTR
401  */
402 void *tee_shm_get_va(struct tee_shm *shm, size_t offs);
403 
404 /**
405  * tee_shm_get_pa() - Get physical address of a shared memory plus an offset
406  * @shm:	Shared memory handle
407  * @offs:	Offset from start of this shared memory
408  * @pa:		Physical address to return
409  * @returns 0 if offs is within the bounds of this shared memory, else an
410  *	error code.
411  */
412 int tee_shm_get_pa(struct tee_shm *shm, size_t offs, phys_addr_t *pa);
413 
414 /**
415  * tee_shm_get_size() - Get size of shared memory buffer
416  * @shm:	Shared memory handle
417  * @returns size of shared memory
418  */
tee_shm_get_size(struct tee_shm * shm)419 static inline size_t tee_shm_get_size(struct tee_shm *shm)
420 {
421 	return shm->size;
422 }
423 
424 /**
425  * tee_shm_get_pages() - Get list of pages that hold shared buffer
426  * @shm:	Shared memory handle
427  * @num_pages:	Number of pages will be stored there
428  * @returns pointer to pages array
429  */
tee_shm_get_pages(struct tee_shm * shm,size_t * num_pages)430 static inline struct page **tee_shm_get_pages(struct tee_shm *shm,
431 					      size_t *num_pages)
432 {
433 	*num_pages = shm->num_pages;
434 	return shm->pages;
435 }
436 
437 /**
438  * tee_shm_get_page_offset() - Get shared buffer offset from page start
439  * @shm:	Shared memory handle
440  * @returns page offset of shared buffer
441  */
tee_shm_get_page_offset(struct tee_shm * shm)442 static inline size_t tee_shm_get_page_offset(struct tee_shm *shm)
443 {
444 	return shm->offset;
445 }
446 
447 /**
448  * tee_shm_get_id() - Get id of a shared memory object
449  * @shm:	Shared memory handle
450  * @returns id
451  */
tee_shm_get_id(struct tee_shm * shm)452 static inline int tee_shm_get_id(struct tee_shm *shm)
453 {
454 	return shm->id;
455 }
456 
457 /**
458  * tee_shm_get_from_id() - Find shared memory object and increase reference
459  * count
460  * @ctx:	Context owning the shared memory
461  * @id:		Id of shared memory object
462  * @returns a pointer to 'struct tee_shm' on success or an ERR_PTR on failure
463  */
464 struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id);
465 
466 /**
467  * tee_client_open_context() - Open a TEE context
468  * @start:	if not NULL, continue search after this context
469  * @match:	function to check TEE device
470  * @data:	data for match function
471  * @vers:	if not NULL, version data of TEE device of the context returned
472  *
473  * This function does an operation similar to open("/dev/teeX") in user space.
474  * A returned context must be released with tee_client_close_context().
475  *
476  * Returns a TEE context of the first TEE device matched by the match()
477  * callback or an ERR_PTR.
478  */
479 struct tee_context *
480 tee_client_open_context(struct tee_context *start,
481 			int (*match)(struct tee_ioctl_version_data *,
482 				     const void *),
483 			const void *data, struct tee_ioctl_version_data *vers);
484 
485 /**
486  * tee_client_close_context() - Close a TEE context
487  * @ctx:	TEE context to close
488  *
489  * Note that all sessions previously opened with this context will be
490  * closed when this function is called.
491  */
492 void tee_client_close_context(struct tee_context *ctx);
493 
494 /**
495  * tee_client_get_version() - Query version of TEE
496  * @ctx:	TEE context to TEE to query
497  * @vers:	Pointer to version data
498  */
499 void tee_client_get_version(struct tee_context *ctx,
500 			    struct tee_ioctl_version_data *vers);
501 
502 /**
503  * tee_client_open_session() - Open a session to a Trusted Application
504  * @ctx:	TEE context
505  * @arg:	Open session arguments, see description of
506  *		struct tee_ioctl_open_session_arg
507  * @param:	Parameters passed to the Trusted Application
508  *
509  * Returns < 0 on error else see @arg->ret for result. If @arg->ret
510  * is TEEC_SUCCESS the session identifier is available in @arg->session.
511  */
512 int tee_client_open_session(struct tee_context *ctx,
513 			    struct tee_ioctl_open_session_arg *arg,
514 			    struct tee_param *param);
515 
516 /**
517  * tee_client_close_session() - Close a session to a Trusted Application
518  * @ctx:	TEE Context
519  * @session:	Session id
520  *
521  * Return < 0 on error else 0, regardless the session will not be
522  * valid after this function has returned.
523  */
524 int tee_client_close_session(struct tee_context *ctx, u32 session);
525 
526 /**
527  * tee_client_invoke_func() - Invoke a function in a Trusted Application
528  * @ctx:	TEE Context
529  * @arg:	Invoke arguments, see description of
530  *		struct tee_ioctl_invoke_arg
531  * @param:	Parameters passed to the Trusted Application
532  *
533  * Returns < 0 on error else see @arg->ret for result.
534  */
535 int tee_client_invoke_func(struct tee_context *ctx,
536 			   struct tee_ioctl_invoke_arg *arg,
537 			   struct tee_param *param);
538 
539 /**
540  * tee_client_cancel_req() - Request cancellation of the previous open-session
541  * or invoke-command operations in a Trusted Application
542  * @ctx:       TEE Context
543  * @arg:       Cancellation arguments, see description of
544  *             struct tee_ioctl_cancel_arg
545  *
546  * Returns < 0 on error else 0 if the cancellation was successfully requested.
547  */
548 int tee_client_cancel_req(struct tee_context *ctx,
549 			  struct tee_ioctl_cancel_arg *arg);
550 
tee_param_is_memref(struct tee_param * param)551 static inline bool tee_param_is_memref(struct tee_param *param)
552 {
553 	switch (param->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
554 	case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
555 	case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
556 	case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
557 		return true;
558 	default:
559 		return false;
560 	}
561 }
562 
563 extern struct bus_type tee_bus_type;
564 
565 /**
566  * struct tee_client_device - tee based device
567  * @id:			device identifier
568  * @dev:		device structure
569  */
570 struct tee_client_device {
571 	struct tee_client_device_id id;
572 	struct device dev;
573 };
574 
575 #define to_tee_client_device(d) container_of(d, struct tee_client_device, dev)
576 
577 /**
578  * struct tee_client_driver - tee client driver
579  * @id_table:		device id table supported by this driver
580  * @driver:		driver structure
581  */
582 struct tee_client_driver {
583 	const struct tee_client_device_id *id_table;
584 	struct device_driver driver;
585 };
586 
587 #define to_tee_client_driver(d) \
588 		container_of(d, struct tee_client_driver, driver)
589 
590 #endif /*__TEE_DRV_H*/
591