1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * Copyright (C) 2019-2021 Linaro Ltd. 4 */ 5 6 #include <linux/io.h> 7 #include <linux/of.h> 8 #include <linux/of_address.h> 9 #include <linux/kernel.h> 10 #include <linux/module.h> 11 #include <linux/mutex.h> 12 #include <linux/slab.h> 13 #include <linux/tee_drv.h> 14 #include <linux/uuid.h> 15 #include <uapi/linux/tee.h> 16 17 #include "common.h" 18 19 #define SCMI_OPTEE_MAX_MSG_SIZE 128 20 21 enum scmi_optee_pta_cmd { 22 /* 23 * PTA_SCMI_CMD_CAPABILITIES - Get channel capabilities 24 * 25 * [out] value[0].a: Capability bit mask (enum pta_scmi_caps) 26 * [out] value[0].b: Extended capabilities or 0 27 */ 28 PTA_SCMI_CMD_CAPABILITIES = 0, 29 30 /* 31 * PTA_SCMI_CMD_PROCESS_SMT_CHANNEL - Process SCMI message in SMT buffer 32 * 33 * [in] value[0].a: Channel handle 34 * 35 * Shared memory used for SCMI message/response exhange is expected 36 * already identified and bound to channel handle in both SCMI agent 37 * and SCMI server (OP-TEE) parts. 38 * The memory uses SMT header to carry SCMI meta-data (protocol ID and 39 * protocol message ID). 40 */ 41 PTA_SCMI_CMD_PROCESS_SMT_CHANNEL = 1, 42 43 /* 44 * PTA_SCMI_CMD_PROCESS_SMT_CHANNEL_MESSAGE - Process SMT/SCMI message 45 * 46 * [in] value[0].a: Channel handle 47 * [in/out] memref[1]: Message/response buffer (SMT and SCMI payload) 48 * 49 * Shared memory used for SCMI message/response is a SMT buffer 50 * referenced by param[1]. It shall be 128 bytes large to fit response 51 * payload whatever message playload size. 52 * The memory uses SMT header to carry SCMI meta-data (protocol ID and 53 * protocol message ID). 54 */ 55 PTA_SCMI_CMD_PROCESS_SMT_CHANNEL_MESSAGE = 2, 56 57 /* 58 * PTA_SCMI_CMD_GET_CHANNEL - Get channel handle 59 * 60 * SCMI shm information are 0 if agent expects to use OP-TEE regular SHM 61 * 62 * [in] value[0].a: Channel identifier 63 * [out] value[0].a: Returned channel handle 64 * [in] value[0].b: Requested capabilities mask (enum pta_scmi_caps) 65 */ 66 PTA_SCMI_CMD_GET_CHANNEL = 3, 67 68 /* 69 * PTA_SCMI_CMD_PROCESS_MSG_CHANNEL - Process SCMI message in a MSG 70 * buffer pointed by memref parameters 71 * 72 * [in] value[0].a: Channel handle 73 * [in] memref[1]: Message buffer (MSG and SCMI payload) 74 * [out] memref[2]: Response buffer (MSG and SCMI payload) 75 * 76 * Shared memories used for SCMI message/response are MSG buffers 77 * referenced by param[1] and param[2]. MSG transport protocol 78 * uses a 32bit header to carry SCMI meta-data (protocol ID and 79 * protocol message ID) followed by the effective SCMI message 80 * payload. 81 */ 82 PTA_SCMI_CMD_PROCESS_MSG_CHANNEL = 4, 83 }; 84 85 /* 86 * OP-TEE SCMI service capabilities bit flags (32bit) 87 * 88 * PTA_SCMI_CAPS_SMT_HEADER 89 * When set, OP-TEE supports command using SMT header protocol (SCMI shmem) in 90 * shared memory buffers to carry SCMI protocol synchronisation information. 91 * 92 * PTA_SCMI_CAPS_MSG_HEADER 93 * When set, OP-TEE supports command using MSG header protocol in an OP-TEE 94 * shared memory to carry SCMI protocol synchronisation information and SCMI 95 * message payload. 96 */ 97 #define PTA_SCMI_CAPS_NONE 0 98 #define PTA_SCMI_CAPS_SMT_HEADER BIT(0) 99 #define PTA_SCMI_CAPS_MSG_HEADER BIT(1) 100 #define PTA_SCMI_CAPS_MASK (PTA_SCMI_CAPS_SMT_HEADER | \ 101 PTA_SCMI_CAPS_MSG_HEADER) 102 103 /** 104 * struct scmi_optee_channel - Description of an OP-TEE SCMI channel 105 * 106 * @channel_id: OP-TEE channel ID used for this transport 107 * @tee_session: TEE session identifier 108 * @caps: OP-TEE SCMI channel capabilities 109 * @rx_len: Response size 110 * @mu: Mutex protection on channel access 111 * @cinfo: SCMI channel information 112 * @shmem: Virtual base address of the shared memory 113 * @req: Shared memory protocol handle for SCMI request and synchronous response 114 * @tee_shm: TEE shared memory handle @req or NULL if using IOMEM shmem 115 * @link: Reference in agent's channel list 116 */ 117 struct scmi_optee_channel { 118 u32 channel_id; 119 u32 tee_session; 120 u32 caps; 121 u32 rx_len; 122 struct mutex mu; 123 struct scmi_chan_info *cinfo; 124 union { 125 struct scmi_shared_mem __iomem *shmem; 126 struct scmi_msg_payld *msg; 127 } req; 128 struct tee_shm *tee_shm; 129 struct list_head link; 130 }; 131 132 /** 133 * struct scmi_optee_agent - OP-TEE transport private data 134 * 135 * @dev: Device used for communication with TEE 136 * @tee_ctx: TEE context used for communication 137 * @caps: Supported channel capabilities 138 * @mu: Mutex for protection of @channel_list 139 * @channel_list: List of all created channels for the agent 140 */ 141 struct scmi_optee_agent { 142 struct device *dev; 143 struct tee_context *tee_ctx; 144 u32 caps; 145 struct mutex mu; 146 struct list_head channel_list; 147 }; 148 149 /* There can be only 1 SCMI service in OP-TEE we connect to */ 150 static struct scmi_optee_agent *scmi_optee_private; 151 152 /* Forward reference to scmi_optee transport initialization */ 153 static int scmi_optee_init(void); 154 155 /* Open a session toward SCMI OP-TEE service with REE_KERNEL identity */ 156 static int open_session(struct scmi_optee_agent *agent, u32 *tee_session) 157 { 158 struct device *dev = agent->dev; 159 struct tee_client_device *scmi_pta = to_tee_client_device(dev); 160 struct tee_ioctl_open_session_arg arg = { }; 161 int ret; 162 163 memcpy(arg.uuid, scmi_pta->id.uuid.b, TEE_IOCTL_UUID_LEN); 164 arg.clnt_login = TEE_IOCTL_LOGIN_REE_KERNEL; 165 166 ret = tee_client_open_session(agent->tee_ctx, &arg, NULL); 167 if (ret < 0 || arg.ret) { 168 dev_err(dev, "Can't open tee session: %d / %#x\n", ret, arg.ret); 169 return -EOPNOTSUPP; 170 } 171 172 *tee_session = arg.session; 173 174 return 0; 175 } 176 177 static void close_session(struct scmi_optee_agent *agent, u32 tee_session) 178 { 179 tee_client_close_session(agent->tee_ctx, tee_session); 180 } 181 182 static int get_capabilities(struct scmi_optee_agent *agent) 183 { 184 struct tee_ioctl_invoke_arg arg = { }; 185 struct tee_param param[1] = { }; 186 u32 caps; 187 u32 tee_session; 188 int ret; 189 190 ret = open_session(agent, &tee_session); 191 if (ret) 192 return ret; 193 194 arg.func = PTA_SCMI_CMD_CAPABILITIES; 195 arg.session = tee_session; 196 arg.num_params = 1; 197 198 param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT; 199 200 ret = tee_client_invoke_func(agent->tee_ctx, &arg, param); 201 202 close_session(agent, tee_session); 203 204 if (ret < 0 || arg.ret) { 205 dev_err(agent->dev, "Can't get capabilities: %d / %#x\n", ret, arg.ret); 206 return -EOPNOTSUPP; 207 } 208 209 caps = param[0].u.value.a; 210 211 if (!(caps & (PTA_SCMI_CAPS_SMT_HEADER | PTA_SCMI_CAPS_MSG_HEADER))) { 212 dev_err(agent->dev, "OP-TEE SCMI PTA doesn't support SMT and MSG\n"); 213 return -EOPNOTSUPP; 214 } 215 216 agent->caps = caps; 217 218 return 0; 219 } 220 221 static int get_channel(struct scmi_optee_channel *channel) 222 { 223 struct device *dev = scmi_optee_private->dev; 224 struct tee_ioctl_invoke_arg arg = { }; 225 struct tee_param param[1] = { }; 226 unsigned int caps = 0; 227 int ret; 228 229 if (channel->tee_shm) 230 caps = PTA_SCMI_CAPS_MSG_HEADER; 231 else 232 caps = PTA_SCMI_CAPS_SMT_HEADER; 233 234 arg.func = PTA_SCMI_CMD_GET_CHANNEL; 235 arg.session = channel->tee_session; 236 arg.num_params = 1; 237 238 param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT; 239 param[0].u.value.a = channel->channel_id; 240 param[0].u.value.b = caps; 241 242 ret = tee_client_invoke_func(scmi_optee_private->tee_ctx, &arg, param); 243 244 if (ret || arg.ret) { 245 dev_err(dev, "Can't get channel with caps %#x: %d / %#x\n", caps, ret, arg.ret); 246 return -EOPNOTSUPP; 247 } 248 249 /* From now on use channel identifer provided by OP-TEE SCMI service */ 250 channel->channel_id = param[0].u.value.a; 251 channel->caps = caps; 252 253 return 0; 254 } 255 256 static int invoke_process_smt_channel(struct scmi_optee_channel *channel) 257 { 258 struct tee_ioctl_invoke_arg arg = { 259 .func = PTA_SCMI_CMD_PROCESS_SMT_CHANNEL, 260 .session = channel->tee_session, 261 .num_params = 1, 262 }; 263 struct tee_param param[1] = { }; 264 int ret; 265 266 param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT; 267 param[0].u.value.a = channel->channel_id; 268 269 ret = tee_client_invoke_func(scmi_optee_private->tee_ctx, &arg, param); 270 if (ret < 0 || arg.ret) { 271 dev_err(scmi_optee_private->dev, "Can't invoke channel %u: %d / %#x\n", 272 channel->channel_id, ret, arg.ret); 273 return -EIO; 274 } 275 276 return 0; 277 } 278 279 static int invoke_process_msg_channel(struct scmi_optee_channel *channel, size_t msg_size) 280 { 281 struct tee_ioctl_invoke_arg arg = { 282 .func = PTA_SCMI_CMD_PROCESS_MSG_CHANNEL, 283 .session = channel->tee_session, 284 .num_params = 3, 285 }; 286 struct tee_param param[3] = { }; 287 int ret; 288 289 param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT; 290 param[0].u.value.a = channel->channel_id; 291 292 param[1].attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT; 293 param[1].u.memref.shm = channel->tee_shm; 294 param[1].u.memref.size = msg_size; 295 296 param[2].attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT; 297 param[2].u.memref.shm = channel->tee_shm; 298 param[2].u.memref.size = SCMI_OPTEE_MAX_MSG_SIZE; 299 300 ret = tee_client_invoke_func(scmi_optee_private->tee_ctx, &arg, param); 301 if (ret < 0 || arg.ret) { 302 dev_err(scmi_optee_private->dev, "Can't invoke channel %u: %d / %#x\n", 303 channel->channel_id, ret, arg.ret); 304 return -EIO; 305 } 306 307 /* Save response size */ 308 channel->rx_len = param[2].u.memref.size; 309 310 return 0; 311 } 312 313 static int scmi_optee_link_supplier(struct device *dev) 314 { 315 if (!scmi_optee_private) { 316 if (scmi_optee_init()) 317 dev_dbg(dev, "Optee bus not yet ready\n"); 318 319 /* Wait for optee bus */ 320 return -EPROBE_DEFER; 321 } 322 323 if (!device_link_add(dev, scmi_optee_private->dev, DL_FLAG_AUTOREMOVE_CONSUMER)) { 324 dev_err(dev, "Adding link to supplier optee device failed\n"); 325 return -ECANCELED; 326 } 327 328 return 0; 329 } 330 331 static bool scmi_optee_chan_available(struct device_node *of_node, int idx) 332 { 333 u32 channel_id; 334 335 return !of_property_read_u32_index(of_node, "linaro,optee-channel-id", 336 idx, &channel_id); 337 } 338 339 static void scmi_optee_clear_channel(struct scmi_chan_info *cinfo) 340 { 341 struct scmi_optee_channel *channel = cinfo->transport_info; 342 343 if (!channel->tee_shm) 344 shmem_clear_channel(channel->req.shmem); 345 } 346 347 static int setup_dynamic_shmem(struct device *dev, struct scmi_optee_channel *channel) 348 { 349 const size_t msg_size = SCMI_OPTEE_MAX_MSG_SIZE; 350 void *shbuf; 351 352 channel->tee_shm = tee_shm_alloc_kernel_buf(scmi_optee_private->tee_ctx, msg_size); 353 if (IS_ERR(channel->tee_shm)) { 354 dev_err(channel->cinfo->dev, "shmem allocation failed\n"); 355 return -ENOMEM; 356 } 357 358 shbuf = tee_shm_get_va(channel->tee_shm, 0); 359 memset(shbuf, 0, msg_size); 360 channel->req.msg = shbuf; 361 channel->rx_len = msg_size; 362 363 return 0; 364 } 365 366 static int setup_static_shmem(struct device *dev, struct scmi_chan_info *cinfo, 367 struct scmi_optee_channel *channel) 368 { 369 struct device_node *np; 370 resource_size_t size; 371 struct resource res; 372 int ret; 373 374 np = of_parse_phandle(cinfo->dev->of_node, "shmem", 0); 375 if (!of_device_is_compatible(np, "arm,scmi-shmem")) { 376 ret = -ENXIO; 377 goto out; 378 } 379 380 ret = of_address_to_resource(np, 0, &res); 381 if (ret) { 382 dev_err(dev, "Failed to get SCMI Tx shared memory\n"); 383 goto out; 384 } 385 386 size = resource_size(&res); 387 388 channel->req.shmem = devm_ioremap(dev, res.start, size); 389 if (!channel->req.shmem) { 390 dev_err(dev, "Failed to ioremap SCMI Tx shared memory\n"); 391 ret = -EADDRNOTAVAIL; 392 goto out; 393 } 394 395 ret = 0; 396 397 out: 398 of_node_put(np); 399 400 return ret; 401 } 402 403 static int setup_shmem(struct device *dev, struct scmi_chan_info *cinfo, 404 struct scmi_optee_channel *channel) 405 { 406 if (of_property_present(cinfo->dev->of_node, "shmem")) 407 return setup_static_shmem(dev, cinfo, channel); 408 else 409 return setup_dynamic_shmem(dev, channel); 410 } 411 412 static int scmi_optee_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, bool tx) 413 { 414 struct scmi_optee_channel *channel; 415 uint32_t channel_id; 416 int ret; 417 418 if (!tx) 419 return -ENODEV; 420 421 channel = devm_kzalloc(dev, sizeof(*channel), GFP_KERNEL); 422 if (!channel) 423 return -ENOMEM; 424 425 ret = of_property_read_u32_index(cinfo->dev->of_node, "linaro,optee-channel-id", 426 0, &channel_id); 427 if (ret) 428 return ret; 429 430 cinfo->transport_info = channel; 431 channel->cinfo = cinfo; 432 channel->channel_id = channel_id; 433 mutex_init(&channel->mu); 434 435 ret = setup_shmem(dev, cinfo, channel); 436 if (ret) 437 return ret; 438 439 ret = open_session(scmi_optee_private, &channel->tee_session); 440 if (ret) 441 goto err_free_shm; 442 443 ret = get_channel(channel); 444 if (ret) 445 goto err_close_sess; 446 447 /* Enable polling */ 448 cinfo->no_completion_irq = true; 449 450 mutex_lock(&scmi_optee_private->mu); 451 list_add(&channel->link, &scmi_optee_private->channel_list); 452 mutex_unlock(&scmi_optee_private->mu); 453 454 return 0; 455 456 err_close_sess: 457 close_session(scmi_optee_private, channel->tee_session); 458 err_free_shm: 459 if (channel->tee_shm) 460 tee_shm_free(channel->tee_shm); 461 462 return ret; 463 } 464 465 static int scmi_optee_chan_free(int id, void *p, void *data) 466 { 467 struct scmi_chan_info *cinfo = p; 468 struct scmi_optee_channel *channel = cinfo->transport_info; 469 470 mutex_lock(&scmi_optee_private->mu); 471 list_del(&channel->link); 472 mutex_unlock(&scmi_optee_private->mu); 473 474 close_session(scmi_optee_private, channel->tee_session); 475 476 if (channel->tee_shm) { 477 tee_shm_free(channel->tee_shm); 478 channel->tee_shm = NULL; 479 } 480 481 cinfo->transport_info = NULL; 482 channel->cinfo = NULL; 483 484 return 0; 485 } 486 487 static int scmi_optee_send_message(struct scmi_chan_info *cinfo, 488 struct scmi_xfer *xfer) 489 { 490 struct scmi_optee_channel *channel = cinfo->transport_info; 491 int ret; 492 493 mutex_lock(&channel->mu); 494 495 if (channel->tee_shm) { 496 msg_tx_prepare(channel->req.msg, xfer); 497 ret = invoke_process_msg_channel(channel, msg_command_size(xfer)); 498 } else { 499 shmem_tx_prepare(channel->req.shmem, xfer, cinfo); 500 ret = invoke_process_smt_channel(channel); 501 } 502 503 if (ret) 504 mutex_unlock(&channel->mu); 505 506 return ret; 507 } 508 509 static void scmi_optee_fetch_response(struct scmi_chan_info *cinfo, 510 struct scmi_xfer *xfer) 511 { 512 struct scmi_optee_channel *channel = cinfo->transport_info; 513 514 if (channel->tee_shm) 515 msg_fetch_response(channel->req.msg, channel->rx_len, xfer); 516 else 517 shmem_fetch_response(channel->req.shmem, xfer); 518 } 519 520 static void scmi_optee_mark_txdone(struct scmi_chan_info *cinfo, int ret, 521 struct scmi_xfer *__unused) 522 { 523 struct scmi_optee_channel *channel = cinfo->transport_info; 524 525 mutex_unlock(&channel->mu); 526 } 527 528 static struct scmi_transport_ops scmi_optee_ops = { 529 .link_supplier = scmi_optee_link_supplier, 530 .chan_available = scmi_optee_chan_available, 531 .chan_setup = scmi_optee_chan_setup, 532 .chan_free = scmi_optee_chan_free, 533 .send_message = scmi_optee_send_message, 534 .mark_txdone = scmi_optee_mark_txdone, 535 .fetch_response = scmi_optee_fetch_response, 536 .clear_channel = scmi_optee_clear_channel, 537 }; 538 539 static int scmi_optee_ctx_match(struct tee_ioctl_version_data *ver, const void *data) 540 { 541 return ver->impl_id == TEE_IMPL_ID_OPTEE; 542 } 543 544 static int scmi_optee_service_probe(struct device *dev) 545 { 546 struct scmi_optee_agent *agent; 547 struct tee_context *tee_ctx; 548 int ret; 549 550 /* Only one SCMI OP-TEE device allowed */ 551 if (scmi_optee_private) { 552 dev_err(dev, "An SCMI OP-TEE device was already initialized: only one allowed\n"); 553 return -EBUSY; 554 } 555 556 tee_ctx = tee_client_open_context(NULL, scmi_optee_ctx_match, NULL, NULL); 557 if (IS_ERR(tee_ctx)) 558 return -ENODEV; 559 560 agent = devm_kzalloc(dev, sizeof(*agent), GFP_KERNEL); 561 if (!agent) { 562 ret = -ENOMEM; 563 goto err; 564 } 565 566 agent->dev = dev; 567 agent->tee_ctx = tee_ctx; 568 INIT_LIST_HEAD(&agent->channel_list); 569 mutex_init(&agent->mu); 570 571 ret = get_capabilities(agent); 572 if (ret) 573 goto err; 574 575 /* Ensure agent resources are all visible before scmi_optee_private is */ 576 smp_mb(); 577 scmi_optee_private = agent; 578 579 return 0; 580 581 err: 582 tee_client_close_context(tee_ctx); 583 584 return ret; 585 } 586 587 static int scmi_optee_service_remove(struct device *dev) 588 { 589 struct scmi_optee_agent *agent = scmi_optee_private; 590 591 if (!scmi_optee_private) 592 return -EINVAL; 593 594 if (!list_empty(&scmi_optee_private->channel_list)) 595 return -EBUSY; 596 597 /* Ensure cleared reference is visible before resources are released */ 598 smp_store_mb(scmi_optee_private, NULL); 599 600 tee_client_close_context(agent->tee_ctx); 601 602 return 0; 603 } 604 605 static const struct tee_client_device_id scmi_optee_service_id[] = { 606 { 607 UUID_INIT(0xa8cfe406, 0xd4f5, 0x4a2e, 608 0x9f, 0x8d, 0xa2, 0x5d, 0xc7, 0x54, 0xc0, 0x99) 609 }, 610 { } 611 }; 612 613 MODULE_DEVICE_TABLE(tee, scmi_optee_service_id); 614 615 static struct tee_client_driver scmi_optee_driver = { 616 .id_table = scmi_optee_service_id, 617 .driver = { 618 .name = "scmi-optee", 619 .bus = &tee_bus_type, 620 .probe = scmi_optee_service_probe, 621 .remove = scmi_optee_service_remove, 622 }, 623 }; 624 625 static int scmi_optee_init(void) 626 { 627 return driver_register(&scmi_optee_driver.driver); 628 } 629 630 static void scmi_optee_exit(void) 631 { 632 if (scmi_optee_private) 633 driver_unregister(&scmi_optee_driver.driver); 634 } 635 636 const struct scmi_desc scmi_optee_desc = { 637 .transport_exit = scmi_optee_exit, 638 .ops = &scmi_optee_ops, 639 .max_rx_timeout_ms = 30, 640 .max_msg = 20, 641 .max_msg_size = SCMI_OPTEE_MAX_MSG_SIZE, 642 .sync_cmds_completed_on_ret = true, 643 }; 644