1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Copyright (c) 2015-2016, Linaro Limited 4 */ 5 6 #define pr_fmt(fmt) "%s: " fmt, __func__ 7 8 #include <linux/cdev.h> 9 #include <linux/cred.h> 10 #include <linux/fs.h> 11 #include <linux/idr.h> 12 #include <linux/module.h> 13 #include <linux/slab.h> 14 #include <linux/tee_drv.h> 15 #include <linux/uaccess.h> 16 #include <crypto/hash.h> 17 #include <crypto/sha1.h> 18 #include "tee_private.h" 19 20 #define TEE_NUM_DEVICES 32 21 22 #define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x)) 23 24 #define TEE_UUID_NS_NAME_SIZE 128 25 26 /* 27 * TEE Client UUID name space identifier (UUIDv4) 28 * 29 * Value here is random UUID that is allocated as name space identifier for 30 * forming Client UUID's for TEE environment using UUIDv5 scheme. 31 */ 32 static const uuid_t tee_client_uuid_ns = UUID_INIT(0x58ac9ca0, 0x2086, 0x4683, 33 0xa1, 0xb8, 0xec, 0x4b, 34 0xc0, 0x8e, 0x01, 0xb6); 35 36 /* 37 * Unprivileged devices in the lower half range and privileged devices in 38 * the upper half range. 39 */ 40 static DECLARE_BITMAP(dev_mask, TEE_NUM_DEVICES); 41 static DEFINE_SPINLOCK(driver_lock); 42 43 static struct class *tee_class; 44 static dev_t tee_devt; 45 46 struct tee_context *teedev_open(struct tee_device *teedev) 47 { 48 int rc; 49 struct tee_context *ctx; 50 51 if (!tee_device_get(teedev)) 52 return ERR_PTR(-EINVAL); 53 54 ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); 55 if (!ctx) { 56 rc = -ENOMEM; 57 goto err; 58 } 59 60 kref_init(&ctx->refcount); 61 ctx->teedev = teedev; 62 rc = teedev->desc->ops->open(ctx); 63 if (rc) 64 goto err; 65 66 return ctx; 67 err: 68 kfree(ctx); 69 tee_device_put(teedev); 70 return ERR_PTR(rc); 71 72 } 73 EXPORT_SYMBOL_GPL(teedev_open); 74 75 void teedev_ctx_get(struct tee_context *ctx) 76 { 77 if (ctx->releasing) 78 return; 79 80 kref_get(&ctx->refcount); 81 } 82 83 static void teedev_ctx_release(struct kref *ref) 84 { 85 struct tee_context *ctx = container_of(ref, struct tee_context, 86 refcount); 87 ctx->releasing = true; 88 ctx->teedev->desc->ops->release(ctx); 89 kfree(ctx); 90 } 91 92 void teedev_ctx_put(struct tee_context *ctx) 93 { 94 if (ctx->releasing) 95 return; 96 97 kref_put(&ctx->refcount, teedev_ctx_release); 98 } 99 100 void teedev_close_context(struct tee_context *ctx) 101 { 102 struct tee_device *teedev = ctx->teedev; 103 104 teedev_ctx_put(ctx); 105 tee_device_put(teedev); 106 } 107 EXPORT_SYMBOL_GPL(teedev_close_context); 108 109 static int tee_open(struct inode *inode, struct file *filp) 110 { 111 struct tee_context *ctx; 112 113 ctx = teedev_open(container_of(inode->i_cdev, struct tee_device, cdev)); 114 if (IS_ERR(ctx)) 115 return PTR_ERR(ctx); 116 117 /* 118 * Default user-space behaviour is to wait for tee-supplicant 119 * if not present for any requests in this context. 120 */ 121 ctx->supp_nowait = false; 122 filp->private_data = ctx; 123 return 0; 124 } 125 126 static int tee_release(struct inode *inode, struct file *filp) 127 { 128 teedev_close_context(filp->private_data); 129 return 0; 130 } 131 132 /** 133 * uuid_v5() - Calculate UUIDv5 134 * @uuid: Resulting UUID 135 * @ns: Name space ID for UUIDv5 function 136 * @name: Name for UUIDv5 function 137 * @size: Size of name 138 * 139 * UUIDv5 is specific in RFC 4122. 140 * 141 * This implements section (for SHA-1): 142 * 4.3. Algorithm for Creating a Name-Based UUID 143 */ 144 static int uuid_v5(uuid_t *uuid, const uuid_t *ns, const void *name, 145 size_t size) 146 { 147 unsigned char hash[SHA1_DIGEST_SIZE]; 148 struct crypto_shash *shash = NULL; 149 struct shash_desc *desc = NULL; 150 int rc; 151 152 shash = crypto_alloc_shash("sha1", 0, 0); 153 if (IS_ERR(shash)) { 154 rc = PTR_ERR(shash); 155 pr_err("shash(sha1) allocation failed\n"); 156 return rc; 157 } 158 159 desc = kzalloc(sizeof(*desc) + crypto_shash_descsize(shash), 160 GFP_KERNEL); 161 if (!desc) { 162 rc = -ENOMEM; 163 goto out_free_shash; 164 } 165 166 desc->tfm = shash; 167 168 rc = crypto_shash_init(desc); 169 if (rc < 0) 170 goto out_free_desc; 171 172 rc = crypto_shash_update(desc, (const u8 *)ns, sizeof(*ns)); 173 if (rc < 0) 174 goto out_free_desc; 175 176 rc = crypto_shash_update(desc, (const u8 *)name, size); 177 if (rc < 0) 178 goto out_free_desc; 179 180 rc = crypto_shash_final(desc, hash); 181 if (rc < 0) 182 goto out_free_desc; 183 184 memcpy(uuid->b, hash, UUID_SIZE); 185 186 /* Tag for version 5 */ 187 uuid->b[6] = (hash[6] & 0x0F) | 0x50; 188 uuid->b[8] = (hash[8] & 0x3F) | 0x80; 189 190 out_free_desc: 191 kfree(desc); 192 193 out_free_shash: 194 crypto_free_shash(shash); 195 return rc; 196 } 197 198 int tee_session_calc_client_uuid(uuid_t *uuid, u32 connection_method, 199 const u8 connection_data[TEE_IOCTL_UUID_LEN]) 200 { 201 gid_t ns_grp = (gid_t)-1; 202 kgid_t grp = INVALID_GID; 203 char *name = NULL; 204 int name_len; 205 int rc; 206 207 if (connection_method == TEE_IOCTL_LOGIN_PUBLIC || 208 connection_method == TEE_IOCTL_LOGIN_REE_KERNEL) { 209 /* Nil UUID to be passed to TEE environment */ 210 uuid_copy(uuid, &uuid_null); 211 return 0; 212 } 213 214 /* 215 * In Linux environment client UUID is based on UUIDv5. 216 * 217 * Determine client UUID with following semantics for 'name': 218 * 219 * For TEEC_LOGIN_USER: 220 * uid=<uid> 221 * 222 * For TEEC_LOGIN_GROUP: 223 * gid=<gid> 224 * 225 */ 226 227 name = kzalloc(TEE_UUID_NS_NAME_SIZE, GFP_KERNEL); 228 if (!name) 229 return -ENOMEM; 230 231 switch (connection_method) { 232 case TEE_IOCTL_LOGIN_USER: 233 name_len = snprintf(name, TEE_UUID_NS_NAME_SIZE, "uid=%x", 234 current_euid().val); 235 if (name_len >= TEE_UUID_NS_NAME_SIZE) { 236 rc = -E2BIG; 237 goto out_free_name; 238 } 239 break; 240 241 case TEE_IOCTL_LOGIN_GROUP: 242 memcpy(&ns_grp, connection_data, sizeof(gid_t)); 243 grp = make_kgid(current_user_ns(), ns_grp); 244 if (!gid_valid(grp) || !in_egroup_p(grp)) { 245 rc = -EPERM; 246 goto out_free_name; 247 } 248 249 name_len = snprintf(name, TEE_UUID_NS_NAME_SIZE, "gid=%x", 250 grp.val); 251 if (name_len >= TEE_UUID_NS_NAME_SIZE) { 252 rc = -E2BIG; 253 goto out_free_name; 254 } 255 break; 256 257 default: 258 rc = -EINVAL; 259 goto out_free_name; 260 } 261 262 rc = uuid_v5(uuid, &tee_client_uuid_ns, name, name_len); 263 out_free_name: 264 kfree(name); 265 266 return rc; 267 } 268 EXPORT_SYMBOL_GPL(tee_session_calc_client_uuid); 269 270 static int tee_ioctl_version(struct tee_context *ctx, 271 struct tee_ioctl_version_data __user *uvers) 272 { 273 struct tee_ioctl_version_data vers; 274 275 ctx->teedev->desc->ops->get_version(ctx->teedev, &vers); 276 277 if (ctx->teedev->desc->flags & TEE_DESC_PRIVILEGED) 278 vers.gen_caps |= TEE_GEN_CAP_PRIVILEGED; 279 280 if (copy_to_user(uvers, &vers, sizeof(vers))) 281 return -EFAULT; 282 283 return 0; 284 } 285 286 static int tee_ioctl_shm_alloc(struct tee_context *ctx, 287 struct tee_ioctl_shm_alloc_data __user *udata) 288 { 289 long ret; 290 struct tee_ioctl_shm_alloc_data data; 291 struct tee_shm *shm; 292 293 if (copy_from_user(&data, udata, sizeof(data))) 294 return -EFAULT; 295 296 /* Currently no input flags are supported */ 297 if (data.flags) 298 return -EINVAL; 299 300 shm = tee_shm_alloc_user_buf(ctx, data.size); 301 if (IS_ERR(shm)) 302 return PTR_ERR(shm); 303 304 data.id = shm->id; 305 data.flags = shm->flags; 306 data.size = shm->size; 307 308 if (copy_to_user(udata, &data, sizeof(data))) 309 ret = -EFAULT; 310 else 311 ret = tee_shm_get_fd(shm); 312 313 /* 314 * When user space closes the file descriptor the shared memory 315 * should be freed or if tee_shm_get_fd() failed then it will 316 * be freed immediately. 317 */ 318 tee_shm_put(shm); 319 return ret; 320 } 321 322 static int 323 tee_ioctl_shm_register(struct tee_context *ctx, 324 struct tee_ioctl_shm_register_data __user *udata) 325 { 326 long ret; 327 struct tee_ioctl_shm_register_data data; 328 struct tee_shm *shm; 329 330 if (copy_from_user(&data, udata, sizeof(data))) 331 return -EFAULT; 332 333 /* Currently no input flags are supported */ 334 if (data.flags) 335 return -EINVAL; 336 337 shm = tee_shm_register_user_buf(ctx, data.addr, data.length); 338 if (IS_ERR(shm)) 339 return PTR_ERR(shm); 340 341 data.id = shm->id; 342 data.flags = shm->flags; 343 data.length = shm->size; 344 345 if (copy_to_user(udata, &data, sizeof(data))) 346 ret = -EFAULT; 347 else 348 ret = tee_shm_get_fd(shm); 349 /* 350 * When user space closes the file descriptor the shared memory 351 * should be freed or if tee_shm_get_fd() failed then it will 352 * be freed immediately. 353 */ 354 tee_shm_put(shm); 355 return ret; 356 } 357 358 static int params_from_user(struct tee_context *ctx, struct tee_param *params, 359 size_t num_params, 360 struct tee_ioctl_param __user *uparams) 361 { 362 size_t n; 363 364 for (n = 0; n < num_params; n++) { 365 struct tee_shm *shm; 366 struct tee_ioctl_param ip; 367 368 if (copy_from_user(&ip, uparams + n, sizeof(ip))) 369 return -EFAULT; 370 371 /* All unused attribute bits has to be zero */ 372 if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK) 373 return -EINVAL; 374 375 params[n].attr = ip.attr; 376 switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) { 377 case TEE_IOCTL_PARAM_ATTR_TYPE_NONE: 378 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT: 379 break; 380 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT: 381 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT: 382 params[n].u.value.a = ip.a; 383 params[n].u.value.b = ip.b; 384 params[n].u.value.c = ip.c; 385 break; 386 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT: 387 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: 388 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: 389 /* 390 * If a NULL pointer is passed to a TA in the TEE, 391 * the ip.c IOCTL parameters is set to TEE_MEMREF_NULL 392 * indicating a NULL memory reference. 393 */ 394 if (ip.c != TEE_MEMREF_NULL) { 395 /* 396 * If we fail to get a pointer to a shared 397 * memory object (and increase the ref count) 398 * from an identifier we return an error. All 399 * pointers that has been added in params have 400 * an increased ref count. It's the callers 401 * responibility to do tee_shm_put() on all 402 * resolved pointers. 403 */ 404 shm = tee_shm_get_from_id(ctx, ip.c); 405 if (IS_ERR(shm)) 406 return PTR_ERR(shm); 407 408 /* 409 * Ensure offset + size does not overflow 410 * offset and does not overflow the size of 411 * the referred shared memory object. 412 */ 413 if ((ip.a + ip.b) < ip.a || 414 (ip.a + ip.b) > shm->size) { 415 tee_shm_put(shm); 416 return -EINVAL; 417 } 418 } else if (ctx->cap_memref_null) { 419 /* Pass NULL pointer to OP-TEE */ 420 shm = NULL; 421 } else { 422 return -EINVAL; 423 } 424 425 params[n].u.memref.shm_offs = ip.a; 426 params[n].u.memref.size = ip.b; 427 params[n].u.memref.shm = shm; 428 break; 429 default: 430 /* Unknown attribute */ 431 return -EINVAL; 432 } 433 } 434 return 0; 435 } 436 437 static int params_to_user(struct tee_ioctl_param __user *uparams, 438 size_t num_params, struct tee_param *params) 439 { 440 size_t n; 441 442 for (n = 0; n < num_params; n++) { 443 struct tee_ioctl_param __user *up = uparams + n; 444 struct tee_param *p = params + n; 445 446 switch (p->attr) { 447 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT: 448 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT: 449 if (put_user(p->u.value.a, &up->a) || 450 put_user(p->u.value.b, &up->b) || 451 put_user(p->u.value.c, &up->c)) 452 return -EFAULT; 453 break; 454 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: 455 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: 456 if (put_user((u64)p->u.memref.size, &up->b)) 457 return -EFAULT; 458 break; 459 default: 460 break; 461 } 462 } 463 return 0; 464 } 465 466 static int tee_ioctl_open_session(struct tee_context *ctx, 467 struct tee_ioctl_buf_data __user *ubuf) 468 { 469 int rc; 470 size_t n; 471 struct tee_ioctl_buf_data buf; 472 struct tee_ioctl_open_session_arg __user *uarg; 473 struct tee_ioctl_open_session_arg arg; 474 struct tee_ioctl_param __user *uparams = NULL; 475 struct tee_param *params = NULL; 476 bool have_session = false; 477 478 if (!ctx->teedev->desc->ops->open_session) 479 return -EINVAL; 480 481 if (copy_from_user(&buf, ubuf, sizeof(buf))) 482 return -EFAULT; 483 484 if (buf.buf_len > TEE_MAX_ARG_SIZE || 485 buf.buf_len < sizeof(struct tee_ioctl_open_session_arg)) 486 return -EINVAL; 487 488 uarg = u64_to_user_ptr(buf.buf_ptr); 489 if (copy_from_user(&arg, uarg, sizeof(arg))) 490 return -EFAULT; 491 492 if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) 493 return -EINVAL; 494 495 if (arg.num_params) { 496 params = kcalloc(arg.num_params, sizeof(struct tee_param), 497 GFP_KERNEL); 498 if (!params) 499 return -ENOMEM; 500 uparams = uarg->params; 501 rc = params_from_user(ctx, params, arg.num_params, uparams); 502 if (rc) 503 goto out; 504 } 505 506 if (arg.clnt_login >= TEE_IOCTL_LOGIN_REE_KERNEL_MIN && 507 arg.clnt_login <= TEE_IOCTL_LOGIN_REE_KERNEL_MAX) { 508 pr_debug("login method not allowed for user-space client\n"); 509 rc = -EPERM; 510 goto out; 511 } 512 513 rc = ctx->teedev->desc->ops->open_session(ctx, &arg, params); 514 if (rc) 515 goto out; 516 have_session = true; 517 518 if (put_user(arg.session, &uarg->session) || 519 put_user(arg.ret, &uarg->ret) || 520 put_user(arg.ret_origin, &uarg->ret_origin)) { 521 rc = -EFAULT; 522 goto out; 523 } 524 rc = params_to_user(uparams, arg.num_params, params); 525 out: 526 /* 527 * If we've succeeded to open the session but failed to communicate 528 * it back to user space, close the session again to avoid leakage. 529 */ 530 if (rc && have_session && ctx->teedev->desc->ops->close_session) 531 ctx->teedev->desc->ops->close_session(ctx, arg.session); 532 533 if (params) { 534 /* Decrease ref count for all valid shared memory pointers */ 535 for (n = 0; n < arg.num_params; n++) 536 if (tee_param_is_memref(params + n) && 537 params[n].u.memref.shm) 538 tee_shm_put(params[n].u.memref.shm); 539 kfree(params); 540 } 541 542 return rc; 543 } 544 545 static int tee_ioctl_invoke(struct tee_context *ctx, 546 struct tee_ioctl_buf_data __user *ubuf) 547 { 548 int rc; 549 size_t n; 550 struct tee_ioctl_buf_data buf; 551 struct tee_ioctl_invoke_arg __user *uarg; 552 struct tee_ioctl_invoke_arg arg; 553 struct tee_ioctl_param __user *uparams = NULL; 554 struct tee_param *params = NULL; 555 556 if (!ctx->teedev->desc->ops->invoke_func) 557 return -EINVAL; 558 559 if (copy_from_user(&buf, ubuf, sizeof(buf))) 560 return -EFAULT; 561 562 if (buf.buf_len > TEE_MAX_ARG_SIZE || 563 buf.buf_len < sizeof(struct tee_ioctl_invoke_arg)) 564 return -EINVAL; 565 566 uarg = u64_to_user_ptr(buf.buf_ptr); 567 if (copy_from_user(&arg, uarg, sizeof(arg))) 568 return -EFAULT; 569 570 if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len) 571 return -EINVAL; 572 573 if (arg.num_params) { 574 params = kcalloc(arg.num_params, sizeof(struct tee_param), 575 GFP_KERNEL); 576 if (!params) 577 return -ENOMEM; 578 uparams = uarg->params; 579 rc = params_from_user(ctx, params, arg.num_params, uparams); 580 if (rc) 581 goto out; 582 } 583 584 rc = ctx->teedev->desc->ops->invoke_func(ctx, &arg, params); 585 if (rc) 586 goto out; 587 588 if (put_user(arg.ret, &uarg->ret) || 589 put_user(arg.ret_origin, &uarg->ret_origin)) { 590 rc = -EFAULT; 591 goto out; 592 } 593 rc = params_to_user(uparams, arg.num_params, params); 594 out: 595 if (params) { 596 /* Decrease ref count for all valid shared memory pointers */ 597 for (n = 0; n < arg.num_params; n++) 598 if (tee_param_is_memref(params + n) && 599 params[n].u.memref.shm) 600 tee_shm_put(params[n].u.memref.shm); 601 kfree(params); 602 } 603 return rc; 604 } 605 606 static int tee_ioctl_cancel(struct tee_context *ctx, 607 struct tee_ioctl_cancel_arg __user *uarg) 608 { 609 struct tee_ioctl_cancel_arg arg; 610 611 if (!ctx->teedev->desc->ops->cancel_req) 612 return -EINVAL; 613 614 if (copy_from_user(&arg, uarg, sizeof(arg))) 615 return -EFAULT; 616 617 return ctx->teedev->desc->ops->cancel_req(ctx, arg.cancel_id, 618 arg.session); 619 } 620 621 static int 622 tee_ioctl_close_session(struct tee_context *ctx, 623 struct tee_ioctl_close_session_arg __user *uarg) 624 { 625 struct tee_ioctl_close_session_arg arg; 626 627 if (!ctx->teedev->desc->ops->close_session) 628 return -EINVAL; 629 630 if (copy_from_user(&arg, uarg, sizeof(arg))) 631 return -EFAULT; 632 633 return ctx->teedev->desc->ops->close_session(ctx, arg.session); 634 } 635 636 static int params_to_supp(struct tee_context *ctx, 637 struct tee_ioctl_param __user *uparams, 638 size_t num_params, struct tee_param *params) 639 { 640 size_t n; 641 642 for (n = 0; n < num_params; n++) { 643 struct tee_ioctl_param ip; 644 struct tee_param *p = params + n; 645 646 ip.attr = p->attr; 647 switch (p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) { 648 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT: 649 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT: 650 ip.a = p->u.value.a; 651 ip.b = p->u.value.b; 652 ip.c = p->u.value.c; 653 break; 654 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT: 655 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: 656 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: 657 ip.b = p->u.memref.size; 658 if (!p->u.memref.shm) { 659 ip.a = 0; 660 ip.c = (u64)-1; /* invalid shm id */ 661 break; 662 } 663 ip.a = p->u.memref.shm_offs; 664 ip.c = p->u.memref.shm->id; 665 break; 666 default: 667 ip.a = 0; 668 ip.b = 0; 669 ip.c = 0; 670 break; 671 } 672 673 if (copy_to_user(uparams + n, &ip, sizeof(ip))) 674 return -EFAULT; 675 } 676 677 return 0; 678 } 679 680 static int tee_ioctl_supp_recv(struct tee_context *ctx, 681 struct tee_ioctl_buf_data __user *ubuf) 682 { 683 int rc; 684 struct tee_ioctl_buf_data buf; 685 struct tee_iocl_supp_recv_arg __user *uarg; 686 struct tee_param *params; 687 u32 num_params; 688 u32 func; 689 690 if (!ctx->teedev->desc->ops->supp_recv) 691 return -EINVAL; 692 693 if (copy_from_user(&buf, ubuf, sizeof(buf))) 694 return -EFAULT; 695 696 if (buf.buf_len > TEE_MAX_ARG_SIZE || 697 buf.buf_len < sizeof(struct tee_iocl_supp_recv_arg)) 698 return -EINVAL; 699 700 uarg = u64_to_user_ptr(buf.buf_ptr); 701 if (get_user(num_params, &uarg->num_params)) 702 return -EFAULT; 703 704 if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len) 705 return -EINVAL; 706 707 params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); 708 if (!params) 709 return -ENOMEM; 710 711 rc = params_from_user(ctx, params, num_params, uarg->params); 712 if (rc) 713 goto out; 714 715 rc = ctx->teedev->desc->ops->supp_recv(ctx, &func, &num_params, params); 716 if (rc) 717 goto out; 718 719 if (put_user(func, &uarg->func) || 720 put_user(num_params, &uarg->num_params)) { 721 rc = -EFAULT; 722 goto out; 723 } 724 725 rc = params_to_supp(ctx, uarg->params, num_params, params); 726 out: 727 kfree(params); 728 return rc; 729 } 730 731 static int params_from_supp(struct tee_param *params, size_t num_params, 732 struct tee_ioctl_param __user *uparams) 733 { 734 size_t n; 735 736 for (n = 0; n < num_params; n++) { 737 struct tee_param *p = params + n; 738 struct tee_ioctl_param ip; 739 740 if (copy_from_user(&ip, uparams + n, sizeof(ip))) 741 return -EFAULT; 742 743 /* All unused attribute bits has to be zero */ 744 if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK) 745 return -EINVAL; 746 747 p->attr = ip.attr; 748 switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) { 749 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT: 750 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT: 751 /* Only out and in/out values can be updated */ 752 p->u.value.a = ip.a; 753 p->u.value.b = ip.b; 754 p->u.value.c = ip.c; 755 break; 756 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT: 757 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT: 758 /* 759 * Only the size of the memref can be updated. 760 * Since we don't have access to the original 761 * parameters here, only store the supplied size. 762 * The driver will copy the updated size into the 763 * original parameters. 764 */ 765 p->u.memref.shm = NULL; 766 p->u.memref.shm_offs = 0; 767 p->u.memref.size = ip.b; 768 break; 769 default: 770 memset(&p->u, 0, sizeof(p->u)); 771 break; 772 } 773 } 774 return 0; 775 } 776 777 static int tee_ioctl_supp_send(struct tee_context *ctx, 778 struct tee_ioctl_buf_data __user *ubuf) 779 { 780 long rc; 781 struct tee_ioctl_buf_data buf; 782 struct tee_iocl_supp_send_arg __user *uarg; 783 struct tee_param *params; 784 u32 num_params; 785 u32 ret; 786 787 /* Not valid for this driver */ 788 if (!ctx->teedev->desc->ops->supp_send) 789 return -EINVAL; 790 791 if (copy_from_user(&buf, ubuf, sizeof(buf))) 792 return -EFAULT; 793 794 if (buf.buf_len > TEE_MAX_ARG_SIZE || 795 buf.buf_len < sizeof(struct tee_iocl_supp_send_arg)) 796 return -EINVAL; 797 798 uarg = u64_to_user_ptr(buf.buf_ptr); 799 if (get_user(ret, &uarg->ret) || 800 get_user(num_params, &uarg->num_params)) 801 return -EFAULT; 802 803 if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len) 804 return -EINVAL; 805 806 params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL); 807 if (!params) 808 return -ENOMEM; 809 810 rc = params_from_supp(params, num_params, uarg->params); 811 if (rc) 812 goto out; 813 814 rc = ctx->teedev->desc->ops->supp_send(ctx, ret, num_params, params); 815 out: 816 kfree(params); 817 return rc; 818 } 819 820 static long tee_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 821 { 822 struct tee_context *ctx = filp->private_data; 823 void __user *uarg = (void __user *)arg; 824 825 switch (cmd) { 826 case TEE_IOC_VERSION: 827 return tee_ioctl_version(ctx, uarg); 828 case TEE_IOC_SHM_ALLOC: 829 return tee_ioctl_shm_alloc(ctx, uarg); 830 case TEE_IOC_SHM_REGISTER: 831 return tee_ioctl_shm_register(ctx, uarg); 832 case TEE_IOC_OPEN_SESSION: 833 return tee_ioctl_open_session(ctx, uarg); 834 case TEE_IOC_INVOKE: 835 return tee_ioctl_invoke(ctx, uarg); 836 case TEE_IOC_CANCEL: 837 return tee_ioctl_cancel(ctx, uarg); 838 case TEE_IOC_CLOSE_SESSION: 839 return tee_ioctl_close_session(ctx, uarg); 840 case TEE_IOC_SUPPL_RECV: 841 return tee_ioctl_supp_recv(ctx, uarg); 842 case TEE_IOC_SUPPL_SEND: 843 return tee_ioctl_supp_send(ctx, uarg); 844 default: 845 return -EINVAL; 846 } 847 } 848 849 static const struct file_operations tee_fops = { 850 .owner = THIS_MODULE, 851 .open = tee_open, 852 .release = tee_release, 853 .unlocked_ioctl = tee_ioctl, 854 .compat_ioctl = compat_ptr_ioctl, 855 }; 856 857 static void tee_release_device(struct device *dev) 858 { 859 struct tee_device *teedev = container_of(dev, struct tee_device, dev); 860 861 spin_lock(&driver_lock); 862 clear_bit(teedev->id, dev_mask); 863 spin_unlock(&driver_lock); 864 mutex_destroy(&teedev->mutex); 865 idr_destroy(&teedev->idr); 866 kfree(teedev); 867 } 868 869 /** 870 * tee_device_alloc() - Allocate a new struct tee_device instance 871 * @teedesc: Descriptor for this driver 872 * @dev: Parent device for this device 873 * @pool: Shared memory pool, NULL if not used 874 * @driver_data: Private driver data for this device 875 * 876 * Allocates a new struct tee_device instance. The device is 877 * removed by tee_device_unregister(). 878 * 879 * @returns a pointer to a 'struct tee_device' or an ERR_PTR on failure 880 */ 881 struct tee_device *tee_device_alloc(const struct tee_desc *teedesc, 882 struct device *dev, 883 struct tee_shm_pool *pool, 884 void *driver_data) 885 { 886 struct tee_device *teedev; 887 void *ret; 888 int rc, max_id; 889 int offs = 0; 890 891 if (!teedesc || !teedesc->name || !teedesc->ops || 892 !teedesc->ops->get_version || !teedesc->ops->open || 893 !teedesc->ops->release || !pool) 894 return ERR_PTR(-EINVAL); 895 896 teedev = kzalloc(sizeof(*teedev), GFP_KERNEL); 897 if (!teedev) { 898 ret = ERR_PTR(-ENOMEM); 899 goto err; 900 } 901 902 max_id = TEE_NUM_DEVICES / 2; 903 904 if (teedesc->flags & TEE_DESC_PRIVILEGED) { 905 offs = TEE_NUM_DEVICES / 2; 906 max_id = TEE_NUM_DEVICES; 907 } 908 909 spin_lock(&driver_lock); 910 teedev->id = find_next_zero_bit(dev_mask, max_id, offs); 911 if (teedev->id < max_id) 912 set_bit(teedev->id, dev_mask); 913 spin_unlock(&driver_lock); 914 915 if (teedev->id >= max_id) { 916 ret = ERR_PTR(-ENOMEM); 917 goto err; 918 } 919 920 snprintf(teedev->name, sizeof(teedev->name), "tee%s%d", 921 teedesc->flags & TEE_DESC_PRIVILEGED ? "priv" : "", 922 teedev->id - offs); 923 924 teedev->dev.class = tee_class; 925 teedev->dev.release = tee_release_device; 926 teedev->dev.parent = dev; 927 928 teedev->dev.devt = MKDEV(MAJOR(tee_devt), teedev->id); 929 930 rc = dev_set_name(&teedev->dev, "%s", teedev->name); 931 if (rc) { 932 ret = ERR_PTR(rc); 933 goto err_devt; 934 } 935 936 cdev_init(&teedev->cdev, &tee_fops); 937 teedev->cdev.owner = teedesc->owner; 938 939 dev_set_drvdata(&teedev->dev, driver_data); 940 device_initialize(&teedev->dev); 941 942 /* 1 as tee_device_unregister() does one final tee_device_put() */ 943 teedev->num_users = 1; 944 init_completion(&teedev->c_no_users); 945 mutex_init(&teedev->mutex); 946 idr_init(&teedev->idr); 947 948 teedev->desc = teedesc; 949 teedev->pool = pool; 950 951 return teedev; 952 err_devt: 953 unregister_chrdev_region(teedev->dev.devt, 1); 954 err: 955 pr_err("could not register %s driver\n", 956 teedesc->flags & TEE_DESC_PRIVILEGED ? "privileged" : "client"); 957 if (teedev && teedev->id < TEE_NUM_DEVICES) { 958 spin_lock(&driver_lock); 959 clear_bit(teedev->id, dev_mask); 960 spin_unlock(&driver_lock); 961 } 962 kfree(teedev); 963 return ret; 964 } 965 EXPORT_SYMBOL_GPL(tee_device_alloc); 966 967 static ssize_t implementation_id_show(struct device *dev, 968 struct device_attribute *attr, char *buf) 969 { 970 struct tee_device *teedev = container_of(dev, struct tee_device, dev); 971 struct tee_ioctl_version_data vers; 972 973 teedev->desc->ops->get_version(teedev, &vers); 974 return scnprintf(buf, PAGE_SIZE, "%d\n", vers.impl_id); 975 } 976 static DEVICE_ATTR_RO(implementation_id); 977 978 static struct attribute *tee_dev_attrs[] = { 979 &dev_attr_implementation_id.attr, 980 NULL 981 }; 982 983 ATTRIBUTE_GROUPS(tee_dev); 984 985 /** 986 * tee_device_register() - Registers a TEE device 987 * @teedev: Device to register 988 * 989 * tee_device_unregister() need to be called to remove the @teedev if 990 * this function fails. 991 * 992 * @returns < 0 on failure 993 */ 994 int tee_device_register(struct tee_device *teedev) 995 { 996 int rc; 997 998 if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) { 999 dev_err(&teedev->dev, "attempt to register twice\n"); 1000 return -EINVAL; 1001 } 1002 1003 teedev->dev.groups = tee_dev_groups; 1004 1005 rc = cdev_device_add(&teedev->cdev, &teedev->dev); 1006 if (rc) { 1007 dev_err(&teedev->dev, 1008 "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", 1009 teedev->name, MAJOR(teedev->dev.devt), 1010 MINOR(teedev->dev.devt), rc); 1011 return rc; 1012 } 1013 1014 teedev->flags |= TEE_DEVICE_FLAG_REGISTERED; 1015 return 0; 1016 } 1017 EXPORT_SYMBOL_GPL(tee_device_register); 1018 1019 void tee_device_put(struct tee_device *teedev) 1020 { 1021 mutex_lock(&teedev->mutex); 1022 /* Shouldn't put in this state */ 1023 if (!WARN_ON(!teedev->desc)) { 1024 teedev->num_users--; 1025 if (!teedev->num_users) { 1026 teedev->desc = NULL; 1027 complete(&teedev->c_no_users); 1028 } 1029 } 1030 mutex_unlock(&teedev->mutex); 1031 } 1032 1033 bool tee_device_get(struct tee_device *teedev) 1034 { 1035 mutex_lock(&teedev->mutex); 1036 if (!teedev->desc) { 1037 mutex_unlock(&teedev->mutex); 1038 return false; 1039 } 1040 teedev->num_users++; 1041 mutex_unlock(&teedev->mutex); 1042 return true; 1043 } 1044 1045 /** 1046 * tee_device_unregister() - Removes a TEE device 1047 * @teedev: Device to unregister 1048 * 1049 * This function should be called to remove the @teedev even if 1050 * tee_device_register() hasn't been called yet. Does nothing if 1051 * @teedev is NULL. 1052 */ 1053 void tee_device_unregister(struct tee_device *teedev) 1054 { 1055 if (!teedev) 1056 return; 1057 1058 if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) 1059 cdev_device_del(&teedev->cdev, &teedev->dev); 1060 1061 tee_device_put(teedev); 1062 wait_for_completion(&teedev->c_no_users); 1063 1064 /* 1065 * No need to take a mutex any longer now since teedev->desc was 1066 * set to NULL before teedev->c_no_users was completed. 1067 */ 1068 1069 teedev->pool = NULL; 1070 1071 put_device(&teedev->dev); 1072 } 1073 EXPORT_SYMBOL_GPL(tee_device_unregister); 1074 1075 /** 1076 * tee_get_drvdata() - Return driver_data pointer 1077 * @teedev: Device containing the driver_data pointer 1078 * @returns the driver_data pointer supplied to tee_register(). 1079 */ 1080 void *tee_get_drvdata(struct tee_device *teedev) 1081 { 1082 return dev_get_drvdata(&teedev->dev); 1083 } 1084 EXPORT_SYMBOL_GPL(tee_get_drvdata); 1085 1086 struct match_dev_data { 1087 struct tee_ioctl_version_data *vers; 1088 const void *data; 1089 int (*match)(struct tee_ioctl_version_data *, const void *); 1090 }; 1091 1092 static int match_dev(struct device *dev, const void *data) 1093 { 1094 const struct match_dev_data *match_data = data; 1095 struct tee_device *teedev = container_of(dev, struct tee_device, dev); 1096 1097 teedev->desc->ops->get_version(teedev, match_data->vers); 1098 return match_data->match(match_data->vers, match_data->data); 1099 } 1100 1101 struct tee_context * 1102 tee_client_open_context(struct tee_context *start, 1103 int (*match)(struct tee_ioctl_version_data *, 1104 const void *), 1105 const void *data, struct tee_ioctl_version_data *vers) 1106 { 1107 struct device *dev = NULL; 1108 struct device *put_dev = NULL; 1109 struct tee_context *ctx = NULL; 1110 struct tee_ioctl_version_data v; 1111 struct match_dev_data match_data = { vers ? vers : &v, data, match }; 1112 1113 if (start) 1114 dev = &start->teedev->dev; 1115 1116 do { 1117 dev = class_find_device(tee_class, dev, &match_data, match_dev); 1118 if (!dev) { 1119 ctx = ERR_PTR(-ENOENT); 1120 break; 1121 } 1122 1123 put_device(put_dev); 1124 put_dev = dev; 1125 1126 ctx = teedev_open(container_of(dev, struct tee_device, dev)); 1127 } while (IS_ERR(ctx) && PTR_ERR(ctx) != -ENOMEM); 1128 1129 put_device(put_dev); 1130 /* 1131 * Default behaviour for in kernel client is to not wait for 1132 * tee-supplicant if not present for any requests in this context. 1133 * Also this flag could be configured again before call to 1134 * tee_client_open_session() if any in kernel client requires 1135 * different behaviour. 1136 */ 1137 if (!IS_ERR(ctx)) 1138 ctx->supp_nowait = true; 1139 1140 return ctx; 1141 } 1142 EXPORT_SYMBOL_GPL(tee_client_open_context); 1143 1144 void tee_client_close_context(struct tee_context *ctx) 1145 { 1146 teedev_close_context(ctx); 1147 } 1148 EXPORT_SYMBOL_GPL(tee_client_close_context); 1149 1150 void tee_client_get_version(struct tee_context *ctx, 1151 struct tee_ioctl_version_data *vers) 1152 { 1153 ctx->teedev->desc->ops->get_version(ctx->teedev, vers); 1154 } 1155 EXPORT_SYMBOL_GPL(tee_client_get_version); 1156 1157 int tee_client_open_session(struct tee_context *ctx, 1158 struct tee_ioctl_open_session_arg *arg, 1159 struct tee_param *param) 1160 { 1161 if (!ctx->teedev->desc->ops->open_session) 1162 return -EINVAL; 1163 return ctx->teedev->desc->ops->open_session(ctx, arg, param); 1164 } 1165 EXPORT_SYMBOL_GPL(tee_client_open_session); 1166 1167 int tee_client_close_session(struct tee_context *ctx, u32 session) 1168 { 1169 if (!ctx->teedev->desc->ops->close_session) 1170 return -EINVAL; 1171 return ctx->teedev->desc->ops->close_session(ctx, session); 1172 } 1173 EXPORT_SYMBOL_GPL(tee_client_close_session); 1174 1175 int tee_client_invoke_func(struct tee_context *ctx, 1176 struct tee_ioctl_invoke_arg *arg, 1177 struct tee_param *param) 1178 { 1179 if (!ctx->teedev->desc->ops->invoke_func) 1180 return -EINVAL; 1181 return ctx->teedev->desc->ops->invoke_func(ctx, arg, param); 1182 } 1183 EXPORT_SYMBOL_GPL(tee_client_invoke_func); 1184 1185 int tee_client_cancel_req(struct tee_context *ctx, 1186 struct tee_ioctl_cancel_arg *arg) 1187 { 1188 if (!ctx->teedev->desc->ops->cancel_req) 1189 return -EINVAL; 1190 return ctx->teedev->desc->ops->cancel_req(ctx, arg->cancel_id, 1191 arg->session); 1192 } 1193 1194 static int tee_client_device_match(struct device *dev, 1195 struct device_driver *drv) 1196 { 1197 const struct tee_client_device_id *id_table; 1198 struct tee_client_device *tee_device; 1199 1200 id_table = to_tee_client_driver(drv)->id_table; 1201 tee_device = to_tee_client_device(dev); 1202 1203 while (!uuid_is_null(&id_table->uuid)) { 1204 if (uuid_equal(&tee_device->id.uuid, &id_table->uuid)) 1205 return 1; 1206 id_table++; 1207 } 1208 1209 return 0; 1210 } 1211 1212 static int tee_client_device_uevent(struct device *dev, 1213 struct kobj_uevent_env *env) 1214 { 1215 uuid_t *dev_id = &to_tee_client_device(dev)->id.uuid; 1216 1217 return add_uevent_var(env, "MODALIAS=tee:%pUb", dev_id); 1218 } 1219 1220 struct bus_type tee_bus_type = { 1221 .name = "tee", 1222 .match = tee_client_device_match, 1223 .uevent = tee_client_device_uevent, 1224 }; 1225 EXPORT_SYMBOL_GPL(tee_bus_type); 1226 1227 static int __init tee_init(void) 1228 { 1229 int rc; 1230 1231 tee_class = class_create(THIS_MODULE, "tee"); 1232 if (IS_ERR(tee_class)) { 1233 pr_err("couldn't create class\n"); 1234 return PTR_ERR(tee_class); 1235 } 1236 1237 rc = alloc_chrdev_region(&tee_devt, 0, TEE_NUM_DEVICES, "tee"); 1238 if (rc) { 1239 pr_err("failed to allocate char dev region\n"); 1240 goto out_unreg_class; 1241 } 1242 1243 rc = bus_register(&tee_bus_type); 1244 if (rc) { 1245 pr_err("failed to register tee bus\n"); 1246 goto out_unreg_chrdev; 1247 } 1248 1249 return 0; 1250 1251 out_unreg_chrdev: 1252 unregister_chrdev_region(tee_devt, TEE_NUM_DEVICES); 1253 out_unreg_class: 1254 class_destroy(tee_class); 1255 tee_class = NULL; 1256 1257 return rc; 1258 } 1259 1260 static void __exit tee_exit(void) 1261 { 1262 bus_unregister(&tee_bus_type); 1263 unregister_chrdev_region(tee_devt, TEE_NUM_DEVICES); 1264 class_destroy(tee_class); 1265 tee_class = NULL; 1266 } 1267 1268 subsys_initcall(tee_init); 1269 module_exit(tee_exit); 1270 1271 MODULE_AUTHOR("Linaro"); 1272 MODULE_DESCRIPTION("TEE Driver"); 1273 MODULE_VERSION("1.0"); 1274 MODULE_LICENSE("GPL v2"); 1275