1 // SPDX-License-Identifier: GPL-2.0-only
3 * Copyright (c) 2015-2016, Linaro Limited
6 #define pr_fmt(fmt) "%s: " fmt, __func__
8 #include <linux/cdev.h>
9 #include <linux/cred.h>
11 #include <linux/idr.h>
12 #include <linux/module.h>
13 #include <linux/slab.h>
14 #include <linux/tee_drv.h>
15 #include <linux/uaccess.h>
16 #include <crypto/hash.h>
17 #include <crypto/sha1.h>
18 #include "tee_private.h"
20 #define TEE_NUM_DEVICES 32
22 #define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x))
24 #define TEE_UUID_NS_NAME_SIZE 128
27 * TEE Client UUID name space identifier (UUIDv4)
29 * Value here is random UUID that is allocated as name space identifier for
30 * forming Client UUID's for TEE environment using UUIDv5 scheme.
32 static const uuid_t tee_client_uuid_ns
= UUID_INIT(0x58ac9ca0, 0x2086, 0x4683,
33 0xa1, 0xb8, 0xec, 0x4b,
34 0xc0, 0x8e, 0x01, 0xb6);
37 * Unprivileged devices in the lower half range and privileged devices in
38 * the upper half range.
40 static DECLARE_BITMAP(dev_mask
, TEE_NUM_DEVICES
);
41 static DEFINE_SPINLOCK(driver_lock
);
43 static struct class *tee_class
;
44 static dev_t tee_devt
;
46 static struct tee_context
*teedev_open(struct tee_device
*teedev
)
49 struct tee_context
*ctx
;
51 if (!tee_device_get(teedev
))
52 return ERR_PTR(-EINVAL
);
54 ctx
= kzalloc(sizeof(*ctx
), GFP_KERNEL
);
60 kref_init(&ctx
->refcount
);
62 rc
= teedev
->desc
->ops
->open(ctx
);
69 tee_device_put(teedev
);
74 void teedev_ctx_get(struct tee_context
*ctx
)
79 kref_get(&ctx
->refcount
);
82 static void teedev_ctx_release(struct kref
*ref
)
84 struct tee_context
*ctx
= container_of(ref
, struct tee_context
,
86 ctx
->releasing
= true;
87 ctx
->teedev
->desc
->ops
->release(ctx
);
91 void teedev_ctx_put(struct tee_context
*ctx
)
96 kref_put(&ctx
->refcount
, teedev_ctx_release
);
99 static void teedev_close_context(struct tee_context
*ctx
)
101 tee_device_put(ctx
->teedev
);
105 static int tee_open(struct inode
*inode
, struct file
*filp
)
107 struct tee_context
*ctx
;
109 ctx
= teedev_open(container_of(inode
->i_cdev
, struct tee_device
, cdev
));
114 * Default user-space behaviour is to wait for tee-supplicant
115 * if not present for any requests in this context.
117 ctx
->supp_nowait
= false;
118 filp
->private_data
= ctx
;
122 static int tee_release(struct inode
*inode
, struct file
*filp
)
124 teedev_close_context(filp
->private_data
);
129 * uuid_v5() - Calculate UUIDv5
130 * @uuid: Resulting UUID
131 * @ns: Name space ID for UUIDv5 function
132 * @name: Name for UUIDv5 function
133 * @size: Size of name
135 * UUIDv5 is specific in RFC 4122.
137 * This implements section (for SHA-1):
138 * 4.3. Algorithm for Creating a Name-Based UUID
140 static int uuid_v5(uuid_t
*uuid
, const uuid_t
*ns
, const void *name
,
143 unsigned char hash
[SHA1_DIGEST_SIZE
];
144 struct crypto_shash
*shash
= NULL
;
145 struct shash_desc
*desc
= NULL
;
148 shash
= crypto_alloc_shash("sha1", 0, 0);
151 pr_err("shash(sha1) allocation failed\n");
155 desc
= kzalloc(sizeof(*desc
) + crypto_shash_descsize(shash
),
164 rc
= crypto_shash_init(desc
);
168 rc
= crypto_shash_update(desc
, (const u8
*)ns
, sizeof(*ns
));
172 rc
= crypto_shash_update(desc
, (const u8
*)name
, size
);
176 rc
= crypto_shash_final(desc
, hash
);
180 memcpy(uuid
->b
, hash
, UUID_SIZE
);
182 /* Tag for version 5 */
183 uuid
->b
[6] = (hash
[6] & 0x0F) | 0x50;
184 uuid
->b
[8] = (hash
[8] & 0x3F) | 0x80;
190 crypto_free_shash(shash
);
194 int tee_session_calc_client_uuid(uuid_t
*uuid
, u32 connection_method
,
195 const u8 connection_data
[TEE_IOCTL_UUID_LEN
])
197 gid_t ns_grp
= (gid_t
)-1;
198 kgid_t grp
= INVALID_GID
;
203 if (connection_method
== TEE_IOCTL_LOGIN_PUBLIC
||
204 connection_method
== TEE_IOCTL_LOGIN_REE_KERNEL
) {
205 /* Nil UUID to be passed to TEE environment */
206 uuid_copy(uuid
, &uuid_null
);
211 * In Linux environment client UUID is based on UUIDv5.
213 * Determine client UUID with following semantics for 'name':
215 * For TEEC_LOGIN_USER:
218 * For TEEC_LOGIN_GROUP:
223 name
= kzalloc(TEE_UUID_NS_NAME_SIZE
, GFP_KERNEL
);
227 switch (connection_method
) {
228 case TEE_IOCTL_LOGIN_USER
:
229 name_len
= snprintf(name
, TEE_UUID_NS_NAME_SIZE
, "uid=%x",
231 if (name_len
>= TEE_UUID_NS_NAME_SIZE
) {
237 case TEE_IOCTL_LOGIN_GROUP
:
238 memcpy(&ns_grp
, connection_data
, sizeof(gid_t
));
239 grp
= make_kgid(current_user_ns(), ns_grp
);
240 if (!gid_valid(grp
) || !in_egroup_p(grp
)) {
245 name_len
= snprintf(name
, TEE_UUID_NS_NAME_SIZE
, "gid=%x",
247 if (name_len
>= TEE_UUID_NS_NAME_SIZE
) {
258 rc
= uuid_v5(uuid
, &tee_client_uuid_ns
, name
, name_len
);
264 EXPORT_SYMBOL_GPL(tee_session_calc_client_uuid
);
266 static int tee_ioctl_version(struct tee_context
*ctx
,
267 struct tee_ioctl_version_data __user
*uvers
)
269 struct tee_ioctl_version_data vers
;
271 ctx
->teedev
->desc
->ops
->get_version(ctx
->teedev
, &vers
);
273 if (ctx
->teedev
->desc
->flags
& TEE_DESC_PRIVILEGED
)
274 vers
.gen_caps
|= TEE_GEN_CAP_PRIVILEGED
;
276 if (copy_to_user(uvers
, &vers
, sizeof(vers
)))
282 static int tee_ioctl_shm_alloc(struct tee_context
*ctx
,
283 struct tee_ioctl_shm_alloc_data __user
*udata
)
286 struct tee_ioctl_shm_alloc_data data
;
289 if (copy_from_user(&data
, udata
, sizeof(data
)))
292 /* Currently no input flags are supported */
296 shm
= tee_shm_alloc(ctx
, data
.size
, TEE_SHM_MAPPED
| TEE_SHM_DMA_BUF
);
301 data
.flags
= shm
->flags
;
302 data
.size
= shm
->size
;
304 if (copy_to_user(udata
, &data
, sizeof(data
)))
307 ret
= tee_shm_get_fd(shm
);
310 * When user space closes the file descriptor the shared memory
311 * should be freed or if tee_shm_get_fd() failed then it will
312 * be freed immediately.
319 tee_ioctl_shm_register(struct tee_context
*ctx
,
320 struct tee_ioctl_shm_register_data __user
*udata
)
323 struct tee_ioctl_shm_register_data data
;
326 if (copy_from_user(&data
, udata
, sizeof(data
)))
329 /* Currently no input flags are supported */
333 shm
= tee_shm_register(ctx
, data
.addr
, data
.length
,
334 TEE_SHM_DMA_BUF
| TEE_SHM_USER_MAPPED
);
339 data
.flags
= shm
->flags
;
340 data
.length
= shm
->size
;
342 if (copy_to_user(udata
, &data
, sizeof(data
)))
345 ret
= tee_shm_get_fd(shm
);
347 * When user space closes the file descriptor the shared memory
348 * should be freed or if tee_shm_get_fd() failed then it will
349 * be freed immediately.
355 static int params_from_user(struct tee_context
*ctx
, struct tee_param
*params
,
357 struct tee_ioctl_param __user
*uparams
)
361 for (n
= 0; n
< num_params
; n
++) {
363 struct tee_ioctl_param ip
;
365 if (copy_from_user(&ip
, uparams
+ n
, sizeof(ip
)))
368 /* All unused attribute bits has to be zero */
369 if (ip
.attr
& ~TEE_IOCTL_PARAM_ATTR_MASK
)
372 params
[n
].attr
= ip
.attr
;
373 switch (ip
.attr
& TEE_IOCTL_PARAM_ATTR_TYPE_MASK
) {
374 case TEE_IOCTL_PARAM_ATTR_TYPE_NONE
:
375 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT
:
377 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT
:
378 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT
:
379 params
[n
].u
.value
.a
= ip
.a
;
380 params
[n
].u
.value
.b
= ip
.b
;
381 params
[n
].u
.value
.c
= ip
.c
;
383 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT
:
384 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT
:
385 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT
:
387 * If a NULL pointer is passed to a TA in the TEE,
388 * the ip.c IOCTL parameters is set to TEE_MEMREF_NULL
389 * indicating a NULL memory reference.
391 if (ip
.c
!= TEE_MEMREF_NULL
) {
393 * If we fail to get a pointer to a shared
394 * memory object (and increase the ref count)
395 * from an identifier we return an error. All
396 * pointers that has been added in params have
397 * an increased ref count. It's the callers
398 * responibility to do tee_shm_put() on all
401 shm
= tee_shm_get_from_id(ctx
, ip
.c
);
406 * Ensure offset + size does not overflow
407 * offset and does not overflow the size of
408 * the referred shared memory object.
410 if ((ip
.a
+ ip
.b
) < ip
.a
||
411 (ip
.a
+ ip
.b
) > shm
->size
) {
415 } else if (ctx
->cap_memref_null
) {
416 /* Pass NULL pointer to OP-TEE */
422 params
[n
].u
.memref
.shm_offs
= ip
.a
;
423 params
[n
].u
.memref
.size
= ip
.b
;
424 params
[n
].u
.memref
.shm
= shm
;
427 /* Unknown attribute */
434 static int params_to_user(struct tee_ioctl_param __user
*uparams
,
435 size_t num_params
, struct tee_param
*params
)
439 for (n
= 0; n
< num_params
; n
++) {
440 struct tee_ioctl_param __user
*up
= uparams
+ n
;
441 struct tee_param
*p
= params
+ n
;
444 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT
:
445 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT
:
446 if (put_user(p
->u
.value
.a
, &up
->a
) ||
447 put_user(p
->u
.value
.b
, &up
->b
) ||
448 put_user(p
->u
.value
.c
, &up
->c
))
451 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT
:
452 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT
:
453 if (put_user((u64
)p
->u
.memref
.size
, &up
->b
))
463 static int tee_ioctl_open_session(struct tee_context
*ctx
,
464 struct tee_ioctl_buf_data __user
*ubuf
)
468 struct tee_ioctl_buf_data buf
;
469 struct tee_ioctl_open_session_arg __user
*uarg
;
470 struct tee_ioctl_open_session_arg arg
;
471 struct tee_ioctl_param __user
*uparams
= NULL
;
472 struct tee_param
*params
= NULL
;
473 bool have_session
= false;
475 if (!ctx
->teedev
->desc
->ops
->open_session
)
478 if (copy_from_user(&buf
, ubuf
, sizeof(buf
)))
481 if (buf
.buf_len
> TEE_MAX_ARG_SIZE
||
482 buf
.buf_len
< sizeof(struct tee_ioctl_open_session_arg
))
485 uarg
= u64_to_user_ptr(buf
.buf_ptr
);
486 if (copy_from_user(&arg
, uarg
, sizeof(arg
)))
489 if (sizeof(arg
) + TEE_IOCTL_PARAM_SIZE(arg
.num_params
) != buf
.buf_len
)
492 if (arg
.num_params
) {
493 params
= kcalloc(arg
.num_params
, sizeof(struct tee_param
),
497 uparams
= uarg
->params
;
498 rc
= params_from_user(ctx
, params
, arg
.num_params
, uparams
);
503 if (arg
.clnt_login
>= TEE_IOCTL_LOGIN_REE_KERNEL_MIN
&&
504 arg
.clnt_login
<= TEE_IOCTL_LOGIN_REE_KERNEL_MAX
) {
505 pr_debug("login method not allowed for user-space client\n");
510 rc
= ctx
->teedev
->desc
->ops
->open_session(ctx
, &arg
, params
);
515 if (put_user(arg
.session
, &uarg
->session
) ||
516 put_user(arg
.ret
, &uarg
->ret
) ||
517 put_user(arg
.ret_origin
, &uarg
->ret_origin
)) {
521 rc
= params_to_user(uparams
, arg
.num_params
, params
);
524 * If we've succeeded to open the session but failed to communicate
525 * it back to user space, close the session again to avoid leakage.
527 if (rc
&& have_session
&& ctx
->teedev
->desc
->ops
->close_session
)
528 ctx
->teedev
->desc
->ops
->close_session(ctx
, arg
.session
);
531 /* Decrease ref count for all valid shared memory pointers */
532 for (n
= 0; n
< arg
.num_params
; n
++)
533 if (tee_param_is_memref(params
+ n
) &&
534 params
[n
].u
.memref
.shm
)
535 tee_shm_put(params
[n
].u
.memref
.shm
);
542 static int tee_ioctl_invoke(struct tee_context
*ctx
,
543 struct tee_ioctl_buf_data __user
*ubuf
)
547 struct tee_ioctl_buf_data buf
;
548 struct tee_ioctl_invoke_arg __user
*uarg
;
549 struct tee_ioctl_invoke_arg arg
;
550 struct tee_ioctl_param __user
*uparams
= NULL
;
551 struct tee_param
*params
= NULL
;
553 if (!ctx
->teedev
->desc
->ops
->invoke_func
)
556 if (copy_from_user(&buf
, ubuf
, sizeof(buf
)))
559 if (buf
.buf_len
> TEE_MAX_ARG_SIZE
||
560 buf
.buf_len
< sizeof(struct tee_ioctl_invoke_arg
))
563 uarg
= u64_to_user_ptr(buf
.buf_ptr
);
564 if (copy_from_user(&arg
, uarg
, sizeof(arg
)))
567 if (sizeof(arg
) + TEE_IOCTL_PARAM_SIZE(arg
.num_params
) != buf
.buf_len
)
570 if (arg
.num_params
) {
571 params
= kcalloc(arg
.num_params
, sizeof(struct tee_param
),
575 uparams
= uarg
->params
;
576 rc
= params_from_user(ctx
, params
, arg
.num_params
, uparams
);
581 rc
= ctx
->teedev
->desc
->ops
->invoke_func(ctx
, &arg
, params
);
585 if (put_user(arg
.ret
, &uarg
->ret
) ||
586 put_user(arg
.ret_origin
, &uarg
->ret_origin
)) {
590 rc
= params_to_user(uparams
, arg
.num_params
, params
);
593 /* Decrease ref count for all valid shared memory pointers */
594 for (n
= 0; n
< arg
.num_params
; n
++)
595 if (tee_param_is_memref(params
+ n
) &&
596 params
[n
].u
.memref
.shm
)
597 tee_shm_put(params
[n
].u
.memref
.shm
);
603 static int tee_ioctl_cancel(struct tee_context
*ctx
,
604 struct tee_ioctl_cancel_arg __user
*uarg
)
606 struct tee_ioctl_cancel_arg arg
;
608 if (!ctx
->teedev
->desc
->ops
->cancel_req
)
611 if (copy_from_user(&arg
, uarg
, sizeof(arg
)))
614 return ctx
->teedev
->desc
->ops
->cancel_req(ctx
, arg
.cancel_id
,
619 tee_ioctl_close_session(struct tee_context
*ctx
,
620 struct tee_ioctl_close_session_arg __user
*uarg
)
622 struct tee_ioctl_close_session_arg arg
;
624 if (!ctx
->teedev
->desc
->ops
->close_session
)
627 if (copy_from_user(&arg
, uarg
, sizeof(arg
)))
630 return ctx
->teedev
->desc
->ops
->close_session(ctx
, arg
.session
);
633 static int params_to_supp(struct tee_context
*ctx
,
634 struct tee_ioctl_param __user
*uparams
,
635 size_t num_params
, struct tee_param
*params
)
639 for (n
= 0; n
< num_params
; n
++) {
640 struct tee_ioctl_param ip
;
641 struct tee_param
*p
= params
+ n
;
644 switch (p
->attr
& TEE_IOCTL_PARAM_ATTR_TYPE_MASK
) {
645 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT
:
646 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT
:
651 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT
:
652 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT
:
653 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT
:
654 ip
.b
= p
->u
.memref
.size
;
655 if (!p
->u
.memref
.shm
) {
657 ip
.c
= (u64
)-1; /* invalid shm id */
660 ip
.a
= p
->u
.memref
.shm_offs
;
661 ip
.c
= p
->u
.memref
.shm
->id
;
670 if (copy_to_user(uparams
+ n
, &ip
, sizeof(ip
)))
677 static int tee_ioctl_supp_recv(struct tee_context
*ctx
,
678 struct tee_ioctl_buf_data __user
*ubuf
)
681 struct tee_ioctl_buf_data buf
;
682 struct tee_iocl_supp_recv_arg __user
*uarg
;
683 struct tee_param
*params
;
687 if (!ctx
->teedev
->desc
->ops
->supp_recv
)
690 if (copy_from_user(&buf
, ubuf
, sizeof(buf
)))
693 if (buf
.buf_len
> TEE_MAX_ARG_SIZE
||
694 buf
.buf_len
< sizeof(struct tee_iocl_supp_recv_arg
))
697 uarg
= u64_to_user_ptr(buf
.buf_ptr
);
698 if (get_user(num_params
, &uarg
->num_params
))
701 if (sizeof(*uarg
) + TEE_IOCTL_PARAM_SIZE(num_params
) != buf
.buf_len
)
704 params
= kcalloc(num_params
, sizeof(struct tee_param
), GFP_KERNEL
);
708 rc
= params_from_user(ctx
, params
, num_params
, uarg
->params
);
712 rc
= ctx
->teedev
->desc
->ops
->supp_recv(ctx
, &func
, &num_params
, params
);
716 if (put_user(func
, &uarg
->func
) ||
717 put_user(num_params
, &uarg
->num_params
)) {
722 rc
= params_to_supp(ctx
, uarg
->params
, num_params
, params
);
728 static int params_from_supp(struct tee_param
*params
, size_t num_params
,
729 struct tee_ioctl_param __user
*uparams
)
733 for (n
= 0; n
< num_params
; n
++) {
734 struct tee_param
*p
= params
+ n
;
735 struct tee_ioctl_param ip
;
737 if (copy_from_user(&ip
, uparams
+ n
, sizeof(ip
)))
740 /* All unused attribute bits has to be zero */
741 if (ip
.attr
& ~TEE_IOCTL_PARAM_ATTR_MASK
)
745 switch (ip
.attr
& TEE_IOCTL_PARAM_ATTR_TYPE_MASK
) {
746 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT
:
747 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT
:
748 /* Only out and in/out values can be updated */
753 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT
:
754 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT
:
756 * Only the size of the memref can be updated.
757 * Since we don't have access to the original
758 * parameters here, only store the supplied size.
759 * The driver will copy the updated size into the
760 * original parameters.
762 p
->u
.memref
.shm
= NULL
;
763 p
->u
.memref
.shm_offs
= 0;
764 p
->u
.memref
.size
= ip
.b
;
767 memset(&p
->u
, 0, sizeof(p
->u
));
774 static int tee_ioctl_supp_send(struct tee_context
*ctx
,
775 struct tee_ioctl_buf_data __user
*ubuf
)
778 struct tee_ioctl_buf_data buf
;
779 struct tee_iocl_supp_send_arg __user
*uarg
;
780 struct tee_param
*params
;
784 /* Not valid for this driver */
785 if (!ctx
->teedev
->desc
->ops
->supp_send
)
788 if (copy_from_user(&buf
, ubuf
, sizeof(buf
)))
791 if (buf
.buf_len
> TEE_MAX_ARG_SIZE
||
792 buf
.buf_len
< sizeof(struct tee_iocl_supp_send_arg
))
795 uarg
= u64_to_user_ptr(buf
.buf_ptr
);
796 if (get_user(ret
, &uarg
->ret
) ||
797 get_user(num_params
, &uarg
->num_params
))
800 if (sizeof(*uarg
) + TEE_IOCTL_PARAM_SIZE(num_params
) > buf
.buf_len
)
803 params
= kcalloc(num_params
, sizeof(struct tee_param
), GFP_KERNEL
);
807 rc
= params_from_supp(params
, num_params
, uarg
->params
);
811 rc
= ctx
->teedev
->desc
->ops
->supp_send(ctx
, ret
, num_params
, params
);
817 static long tee_ioctl(struct file
*filp
, unsigned int cmd
, unsigned long arg
)
819 struct tee_context
*ctx
= filp
->private_data
;
820 void __user
*uarg
= (void __user
*)arg
;
823 case TEE_IOC_VERSION
:
824 return tee_ioctl_version(ctx
, uarg
);
825 case TEE_IOC_SHM_ALLOC
:
826 return tee_ioctl_shm_alloc(ctx
, uarg
);
827 case TEE_IOC_SHM_REGISTER
:
828 return tee_ioctl_shm_register(ctx
, uarg
);
829 case TEE_IOC_OPEN_SESSION
:
830 return tee_ioctl_open_session(ctx
, uarg
);
832 return tee_ioctl_invoke(ctx
, uarg
);
834 return tee_ioctl_cancel(ctx
, uarg
);
835 case TEE_IOC_CLOSE_SESSION
:
836 return tee_ioctl_close_session(ctx
, uarg
);
837 case TEE_IOC_SUPPL_RECV
:
838 return tee_ioctl_supp_recv(ctx
, uarg
);
839 case TEE_IOC_SUPPL_SEND
:
840 return tee_ioctl_supp_send(ctx
, uarg
);
846 static const struct file_operations tee_fops
= {
847 .owner
= THIS_MODULE
,
849 .release
= tee_release
,
850 .unlocked_ioctl
= tee_ioctl
,
851 .compat_ioctl
= compat_ptr_ioctl
,
854 static void tee_release_device(struct device
*dev
)
856 struct tee_device
*teedev
= container_of(dev
, struct tee_device
, dev
);
858 spin_lock(&driver_lock
);
859 clear_bit(teedev
->id
, dev_mask
);
860 spin_unlock(&driver_lock
);
861 mutex_destroy(&teedev
->mutex
);
862 idr_destroy(&teedev
->idr
);
867 * tee_device_alloc() - Allocate a new struct tee_device instance
868 * @teedesc: Descriptor for this driver
869 * @dev: Parent device for this device
870 * @pool: Shared memory pool, NULL if not used
871 * @driver_data: Private driver data for this device
873 * Allocates a new struct tee_device instance. The device is
874 * removed by tee_device_unregister().
876 * @returns a pointer to a 'struct tee_device' or an ERR_PTR on failure
878 struct tee_device
*tee_device_alloc(const struct tee_desc
*teedesc
,
880 struct tee_shm_pool
*pool
,
883 struct tee_device
*teedev
;
888 if (!teedesc
|| !teedesc
->name
|| !teedesc
->ops
||
889 !teedesc
->ops
->get_version
|| !teedesc
->ops
->open
||
890 !teedesc
->ops
->release
|| !pool
)
891 return ERR_PTR(-EINVAL
);
893 teedev
= kzalloc(sizeof(*teedev
), GFP_KERNEL
);
895 ret
= ERR_PTR(-ENOMEM
);
899 max_id
= TEE_NUM_DEVICES
/ 2;
901 if (teedesc
->flags
& TEE_DESC_PRIVILEGED
) {
902 offs
= TEE_NUM_DEVICES
/ 2;
903 max_id
= TEE_NUM_DEVICES
;
906 spin_lock(&driver_lock
);
907 teedev
->id
= find_next_zero_bit(dev_mask
, max_id
, offs
);
908 if (teedev
->id
< max_id
)
909 set_bit(teedev
->id
, dev_mask
);
910 spin_unlock(&driver_lock
);
912 if (teedev
->id
>= max_id
) {
913 ret
= ERR_PTR(-ENOMEM
);
917 snprintf(teedev
->name
, sizeof(teedev
->name
), "tee%s%d",
918 teedesc
->flags
& TEE_DESC_PRIVILEGED
? "priv" : "",
921 teedev
->dev
.class = tee_class
;
922 teedev
->dev
.release
= tee_release_device
;
923 teedev
->dev
.parent
= dev
;
925 teedev
->dev
.devt
= MKDEV(MAJOR(tee_devt
), teedev
->id
);
927 rc
= dev_set_name(&teedev
->dev
, "%s", teedev
->name
);
933 cdev_init(&teedev
->cdev
, &tee_fops
);
934 teedev
->cdev
.owner
= teedesc
->owner
;
936 dev_set_drvdata(&teedev
->dev
, driver_data
);
937 device_initialize(&teedev
->dev
);
939 /* 1 as tee_device_unregister() does one final tee_device_put() */
940 teedev
->num_users
= 1;
941 init_completion(&teedev
->c_no_users
);
942 mutex_init(&teedev
->mutex
);
943 idr_init(&teedev
->idr
);
945 teedev
->desc
= teedesc
;
950 unregister_chrdev_region(teedev
->dev
.devt
, 1);
952 pr_err("could not register %s driver\n",
953 teedesc
->flags
& TEE_DESC_PRIVILEGED
? "privileged" : "client");
954 if (teedev
&& teedev
->id
< TEE_NUM_DEVICES
) {
955 spin_lock(&driver_lock
);
956 clear_bit(teedev
->id
, dev_mask
);
957 spin_unlock(&driver_lock
);
962 EXPORT_SYMBOL_GPL(tee_device_alloc
);
964 static ssize_t
implementation_id_show(struct device
*dev
,
965 struct device_attribute
*attr
, char *buf
)
967 struct tee_device
*teedev
= container_of(dev
, struct tee_device
, dev
);
968 struct tee_ioctl_version_data vers
;
970 teedev
->desc
->ops
->get_version(teedev
, &vers
);
971 return scnprintf(buf
, PAGE_SIZE
, "%d\n", vers
.impl_id
);
973 static DEVICE_ATTR_RO(implementation_id
);
975 static struct attribute
*tee_dev_attrs
[] = {
976 &dev_attr_implementation_id
.attr
,
980 ATTRIBUTE_GROUPS(tee_dev
);
983 * tee_device_register() - Registers a TEE device
984 * @teedev: Device to register
986 * tee_device_unregister() need to be called to remove the @teedev if
987 * this function fails.
989 * @returns < 0 on failure
991 int tee_device_register(struct tee_device
*teedev
)
995 if (teedev
->flags
& TEE_DEVICE_FLAG_REGISTERED
) {
996 dev_err(&teedev
->dev
, "attempt to register twice\n");
1000 teedev
->dev
.groups
= tee_dev_groups
;
1002 rc
= cdev_device_add(&teedev
->cdev
, &teedev
->dev
);
1004 dev_err(&teedev
->dev
,
1005 "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n",
1006 teedev
->name
, MAJOR(teedev
->dev
.devt
),
1007 MINOR(teedev
->dev
.devt
), rc
);
1011 teedev
->flags
|= TEE_DEVICE_FLAG_REGISTERED
;
1014 EXPORT_SYMBOL_GPL(tee_device_register
);
1016 void tee_device_put(struct tee_device
*teedev
)
1018 mutex_lock(&teedev
->mutex
);
1019 /* Shouldn't put in this state */
1020 if (!WARN_ON(!teedev
->desc
)) {
1021 teedev
->num_users
--;
1022 if (!teedev
->num_users
) {
1023 teedev
->desc
= NULL
;
1024 complete(&teedev
->c_no_users
);
1027 mutex_unlock(&teedev
->mutex
);
1030 bool tee_device_get(struct tee_device
*teedev
)
1032 mutex_lock(&teedev
->mutex
);
1033 if (!teedev
->desc
) {
1034 mutex_unlock(&teedev
->mutex
);
1037 teedev
->num_users
++;
1038 mutex_unlock(&teedev
->mutex
);
1043 * tee_device_unregister() - Removes a TEE device
1044 * @teedev: Device to unregister
1046 * This function should be called to remove the @teedev even if
1047 * tee_device_register() hasn't been called yet. Does nothing if
1050 void tee_device_unregister(struct tee_device
*teedev
)
1055 if (teedev
->flags
& TEE_DEVICE_FLAG_REGISTERED
)
1056 cdev_device_del(&teedev
->cdev
, &teedev
->dev
);
1058 tee_device_put(teedev
);
1059 wait_for_completion(&teedev
->c_no_users
);
1062 * No need to take a mutex any longer now since teedev->desc was
1063 * set to NULL before teedev->c_no_users was completed.
1066 teedev
->pool
= NULL
;
1068 put_device(&teedev
->dev
);
1070 EXPORT_SYMBOL_GPL(tee_device_unregister
);
1073 * tee_get_drvdata() - Return driver_data pointer
1074 * @teedev: Device containing the driver_data pointer
1075 * @returns the driver_data pointer supplied to tee_register().
1077 void *tee_get_drvdata(struct tee_device
*teedev
)
1079 return dev_get_drvdata(&teedev
->dev
);
1081 EXPORT_SYMBOL_GPL(tee_get_drvdata
);
1083 struct match_dev_data
{
1084 struct tee_ioctl_version_data
*vers
;
1086 int (*match
)(struct tee_ioctl_version_data
*, const void *);
1089 static int match_dev(struct device
*dev
, const void *data
)
1091 const struct match_dev_data
*match_data
= data
;
1092 struct tee_device
*teedev
= container_of(dev
, struct tee_device
, dev
);
1094 teedev
->desc
->ops
->get_version(teedev
, match_data
->vers
);
1095 return match_data
->match(match_data
->vers
, match_data
->data
);
1098 struct tee_context
*
1099 tee_client_open_context(struct tee_context
*start
,
1100 int (*match
)(struct tee_ioctl_version_data
*,
1102 const void *data
, struct tee_ioctl_version_data
*vers
)
1104 struct device
*dev
= NULL
;
1105 struct device
*put_dev
= NULL
;
1106 struct tee_context
*ctx
= NULL
;
1107 struct tee_ioctl_version_data v
;
1108 struct match_dev_data match_data
= { vers
? vers
: &v
, data
, match
};
1111 dev
= &start
->teedev
->dev
;
1114 dev
= class_find_device(tee_class
, dev
, &match_data
, match_dev
);
1116 ctx
= ERR_PTR(-ENOENT
);
1120 put_device(put_dev
);
1123 ctx
= teedev_open(container_of(dev
, struct tee_device
, dev
));
1124 } while (IS_ERR(ctx
) && PTR_ERR(ctx
) != -ENOMEM
);
1126 put_device(put_dev
);
1128 * Default behaviour for in kernel client is to not wait for
1129 * tee-supplicant if not present for any requests in this context.
1130 * Also this flag could be configured again before call to
1131 * tee_client_open_session() if any in kernel client requires
1132 * different behaviour.
1135 ctx
->supp_nowait
= true;
1139 EXPORT_SYMBOL_GPL(tee_client_open_context
);
1141 void tee_client_close_context(struct tee_context
*ctx
)
1143 teedev_close_context(ctx
);
1145 EXPORT_SYMBOL_GPL(tee_client_close_context
);
1147 void tee_client_get_version(struct tee_context
*ctx
,
1148 struct tee_ioctl_version_data
*vers
)
1150 ctx
->teedev
->desc
->ops
->get_version(ctx
->teedev
, vers
);
1152 EXPORT_SYMBOL_GPL(tee_client_get_version
);
1154 int tee_client_open_session(struct tee_context
*ctx
,
1155 struct tee_ioctl_open_session_arg
*arg
,
1156 struct tee_param
*param
)
1158 if (!ctx
->teedev
->desc
->ops
->open_session
)
1160 return ctx
->teedev
->desc
->ops
->open_session(ctx
, arg
, param
);
1162 EXPORT_SYMBOL_GPL(tee_client_open_session
);
1164 int tee_client_close_session(struct tee_context
*ctx
, u32 session
)
1166 if (!ctx
->teedev
->desc
->ops
->close_session
)
1168 return ctx
->teedev
->desc
->ops
->close_session(ctx
, session
);
1170 EXPORT_SYMBOL_GPL(tee_client_close_session
);
1172 int tee_client_invoke_func(struct tee_context
*ctx
,
1173 struct tee_ioctl_invoke_arg
*arg
,
1174 struct tee_param
*param
)
1176 if (!ctx
->teedev
->desc
->ops
->invoke_func
)
1178 return ctx
->teedev
->desc
->ops
->invoke_func(ctx
, arg
, param
);
1180 EXPORT_SYMBOL_GPL(tee_client_invoke_func
);
1182 int tee_client_cancel_req(struct tee_context
*ctx
,
1183 struct tee_ioctl_cancel_arg
*arg
)
1185 if (!ctx
->teedev
->desc
->ops
->cancel_req
)
1187 return ctx
->teedev
->desc
->ops
->cancel_req(ctx
, arg
->cancel_id
,
1191 static int tee_client_device_match(struct device
*dev
,
1192 struct device_driver
*drv
)
1194 const struct tee_client_device_id
*id_table
;
1195 struct tee_client_device
*tee_device
;
1197 id_table
= to_tee_client_driver(drv
)->id_table
;
1198 tee_device
= to_tee_client_device(dev
);
1200 while (!uuid_is_null(&id_table
->uuid
)) {
1201 if (uuid_equal(&tee_device
->id
.uuid
, &id_table
->uuid
))
1209 static int tee_client_device_uevent(struct device
*dev
,
1210 struct kobj_uevent_env
*env
)
1212 uuid_t
*dev_id
= &to_tee_client_device(dev
)->id
.uuid
;
1214 return add_uevent_var(env
, "MODALIAS=tee:%pUb", dev_id
);
1217 struct bus_type tee_bus_type
= {
1219 .match
= tee_client_device_match
,
1220 .uevent
= tee_client_device_uevent
,
1222 EXPORT_SYMBOL_GPL(tee_bus_type
);
1224 static int __init
tee_init(void)
1228 tee_class
= class_create(THIS_MODULE
, "tee");
1229 if (IS_ERR(tee_class
)) {
1230 pr_err("couldn't create class\n");
1231 return PTR_ERR(tee_class
);
1234 rc
= alloc_chrdev_region(&tee_devt
, 0, TEE_NUM_DEVICES
, "tee");
1236 pr_err("failed to allocate char dev region\n");
1237 goto out_unreg_class
;
1240 rc
= bus_register(&tee_bus_type
);
1242 pr_err("failed to register tee bus\n");
1243 goto out_unreg_chrdev
;
1249 unregister_chrdev_region(tee_devt
, TEE_NUM_DEVICES
);
1251 class_destroy(tee_class
);
1257 static void __exit
tee_exit(void)
1259 bus_unregister(&tee_bus_type
);
1260 unregister_chrdev_region(tee_devt
, TEE_NUM_DEVICES
);
1261 class_destroy(tee_class
);
1265 subsys_initcall(tee_init
);
1266 module_exit(tee_exit
);
1268 MODULE_AUTHOR("Linaro");
1269 MODULE_DESCRIPTION("TEE Driver");
1270 MODULE_VERSION("1.0");
1271 MODULE_LICENSE("GPL v2");