drivers/tee/tee_core.c

   1 /*
   2  * Copyright (c) 2015-2016, Linaro Limited
   3  *
   4  * This software is licensed under the terms of the GNU General Public
   5  * License version 2, as published by the Free Software Foundation, and
   6  * may be copied, distributed, and modified under those terms.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  11  * GNU General Public License for more details.
  12  *
  13  */
  14
  15 #define pr_fmt(fmt) "%s: " fmt, __func__
  16
  17 #include <linux/cdev.h>
  18 #include <linux/device.h>
  19 #include <linux/fs.h>
  20 #include <linux/idr.h>
  21 #include <linux/module.h>
  22 #include <linux/slab.h>
  23 #include <linux/tee_drv.h>
  24 #include <linux/uaccess.h>
  25 #include "tee_private.h"
  26
  27 #define TEE_NUM_DEVICES 32
  28
  29 #define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x))
  30
  31 /*
  32  * Unprivileged devices in the lower half range and privileged devices in
  33  * the upper half range.
  34  */
  35 static DECLARE_BITMAP(dev_mask, TEE_NUM_DEVICES);
  36 static DEFINE_SPINLOCK(driver_lock);
  37
  38 static struct class *tee_class;
  39 static dev_t tee_devt;
  40
  41 static int tee_open(struct inode *inode, struct file *filp)
  42 {
  43         int rc;
  44         struct tee_device *teedev;
  45         struct tee_context *ctx;
  46
  47         teedev = container_of(inode->i_cdev, struct tee_device, cdev);
  48         if (!tee_device_get(teedev))
  49                 return -EINVAL;
  50
  51         ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
  52         if (!ctx) {
  53                 rc = -ENOMEM;
  54                 goto err;
  55         }
  56
  57         ctx->teedev = teedev;
  58         INIT_LIST_HEAD(&ctx->list_shm);
  59         filp->private_data = ctx;
  60         rc = teedev->desc->ops->open(ctx);
  61         if (rc)
  62                 goto err;
  63
  64         return 0;
  65 err:
  66         kfree(ctx);
  67         tee_device_put(teedev);
  68         return rc;
  69 }
  70
  71 static int tee_release(struct inode *inode, struct file *filp)
  72 {
  73         struct tee_context *ctx = filp->private_data;
  74         struct tee_device *teedev = ctx->teedev;
  75         struct tee_shm *shm;
  76
  77         ctx->teedev->desc->ops->release(ctx);
  78         mutex_lock(&ctx->teedev->mutex);
  79         list_for_each_entry(shm, &ctx->list_shm, link)
  80                 shm->ctx = NULL;
  81         mutex_unlock(&ctx->teedev->mutex);
  82         kfree(ctx);
  83         tee_device_put(teedev);
  84         return 0;
  85 }
  86
  87 static int tee_ioctl_version(struct tee_context *ctx,
  88                              struct tee_ioctl_version_data __user *uvers)
  89 {
  90         struct tee_ioctl_version_data vers;
  91
  92         ctx->teedev->desc->ops->get_version(ctx->teedev, &vers);
  93
  94         if (ctx->teedev->desc->flags & TEE_DESC_PRIVILEGED)
  95                 vers.gen_caps |= TEE_GEN_CAP_PRIVILEGED;
  96
  97         if (copy_to_user(uvers, &vers, sizeof(vers)))
  98                 return -EFAULT;
  99
 100         return 0;
 101 }
 102
 103 static int tee_ioctl_shm_alloc(struct tee_context *ctx,
 104                                struct tee_ioctl_shm_alloc_data __user *udata)
 105 {
 106         long ret;
 107         struct tee_ioctl_shm_alloc_data data;
 108         struct tee_shm *shm;
 109
 110         if (copy_from_user(&data, udata, sizeof(data)))
 111                 return -EFAULT;
 112
 113         /* Currently no input flags are supported */
 114         if (data.flags)
 115                 return -EINVAL;
 116
 117         data.id = -1;
 118
 119         shm = tee_shm_alloc(ctx, data.size, TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
 120         if (IS_ERR(shm))
 121                 return PTR_ERR(shm);
 122
 123         data.id = shm->id;
 124         data.flags = shm->flags;
 125         data.size = shm->size;
 126
 127         if (copy_to_user(udata, &data, sizeof(data)))
 128                 ret = -EFAULT;
 129         else
 130                 ret = tee_shm_get_fd(shm);
 131
 132         /*
 133          * When user space closes the file descriptor the shared memory
 134          * should be freed or if tee_shm_get_fd() failed then it will
 135          * be freed immediately.
 136          */
 137         tee_shm_put(shm);
 138         return ret;
 139 }
 140
 141 static int params_from_user(struct tee_context *ctx, struct tee_param *params,
 142                             size_t num_params,
 143                             struct tee_ioctl_param __user *uparams)
 144 {
 145         size_t n;
 146
 147         for (n = 0; n < num_params; n++) {
 148                 struct tee_shm *shm;
 149                 struct tee_ioctl_param ip;
 150
 151                 if (copy_from_user(&ip, uparams + n, sizeof(ip)))
 152                         return -EFAULT;
 153
 154                 /* All unused attribute bits has to be zero */
 155                 if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_TYPE_MASK)
 156                         return -EINVAL;
 157
 158                 params[n].attr = ip.attr;
 159                 switch (ip.attr) {
 160                 case TEE_IOCTL_PARAM_ATTR_TYPE_NONE:
 161                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
 162                         break;
 163                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
 164                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 165                         params[n].u.value.a = ip.a;
 166                         params[n].u.value.b = ip.b;
 167                         params[n].u.value.c = ip.c;
 168                         break;
 169                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
 170                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 171                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 172                         /*
 173                          * If we fail to get a pointer to a shared memory
 174                          * object (and increase the ref count) from an
 175                          * identifier we return an error. All pointers that
 176                          * has been added in params have an increased ref
 177                          * count. It's the callers responibility to do
 178                          * tee_shm_put() on all resolved pointers.
 179                          */
 180                         shm = tee_shm_get_from_id(ctx, ip.c);
 181                         if (IS_ERR(shm))
 182                                 return PTR_ERR(shm);
 183
 184                         params[n].u.memref.shm_offs = ip.a;
 185                         params[n].u.memref.size = ip.b;
 186                         params[n].u.memref.shm = shm;
 187                         break;
 188                 default:
 189                         /* Unknown attribute */
 190                         return -EINVAL;
 191                 }
 192         }
 193         return 0;
 194 }
 195
 196 static int params_to_user(struct tee_ioctl_param __user *uparams,
 197                           size_t num_params, struct tee_param *params)
 198 {
 199         size_t n;
 200
 201         for (n = 0; n < num_params; n++) {
 202                 struct tee_ioctl_param __user *up = uparams + n;
 203                 struct tee_param *p = params + n;
 204
 205                 switch (p->attr) {
 206                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
 207                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 208                         if (put_user(p->u.value.a, &up->a) ||
 209                             put_user(p->u.value.b, &up->b) ||
 210                             put_user(p->u.value.c, &up->c))
 211                                 return -EFAULT;
 212                         break;
 213                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 214                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 215                         if (put_user((u64)p->u.memref.size, &up->b))
 216                                 return -EFAULT;
 217                 default:
 218                         break;
 219                 }
 220         }
 221         return 0;
 222 }
 223
 224 static bool param_is_memref(struct tee_param *param)
 225 {
 226         switch (param->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
 227         case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
 228         case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 229         case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 230                 return true;
 231         default:
 232                 return false;
 233         }
 234 }
 235
 236 static int tee_ioctl_open_session(struct tee_context *ctx,
 237                                   struct tee_ioctl_buf_data __user *ubuf)
 238 {
 239         int rc;
 240         size_t n;
 241         struct tee_ioctl_buf_data buf;
 242         struct tee_ioctl_open_session_arg __user *uarg;
 243         struct tee_ioctl_open_session_arg arg;
 244         struct tee_ioctl_param __user *uparams = NULL;
 245         struct tee_param *params = NULL;
 246         bool have_session = false;
 247
 248         if (!ctx->teedev->desc->ops->open_session)
 249                 return -EINVAL;
 250
 251         if (copy_from_user(&buf, ubuf, sizeof(buf)))
 252                 return -EFAULT;
 253
 254         if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 255             buf.buf_len < sizeof(struct tee_ioctl_open_session_arg))
 256                 return -EINVAL;
 257
 258         uarg = u64_to_user_ptr(buf.buf_ptr);
 259         if (copy_from_user(&arg, uarg, sizeof(arg)))
 260                 return -EFAULT;
 261
 262         if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
 263                 return -EINVAL;
 264
 265         if (arg.num_params) {
 266                 params = kcalloc(arg.num_params, sizeof(struct tee_param),
 267                                  GFP_KERNEL);
 268                 if (!params)
 269                         return -ENOMEM;
 270                 uparams = uarg->params;
 271                 rc = params_from_user(ctx, params, arg.num_params, uparams);
 272                 if (rc)
 273                         goto out;
 274         }
 275
 276         rc = ctx->teedev->desc->ops->open_session(ctx, &arg, params);
 277         if (rc)
 278                 goto out;
 279         have_session = true;
 280
 281         if (put_user(arg.session, &uarg->session) ||
 282             put_user(arg.ret, &uarg->ret) ||
 283             put_user(arg.ret_origin, &uarg->ret_origin)) {
 284                 rc = -EFAULT;
 285                 goto out;
 286         }
 287         rc = params_to_user(uparams, arg.num_params, params);
 288 out:
 289         /*
 290          * If we've succeeded to open the session but failed to communicate
 291          * it back to user space, close the session again to avoid leakage.
 292          */
 293         if (rc && have_session && ctx->teedev->desc->ops->close_session)
 294                 ctx->teedev->desc->ops->close_session(ctx, arg.session);
 295
 296         if (params) {
 297                 /* Decrease ref count for all valid shared memory pointers */
 298                 for (n = 0; n < arg.num_params; n++)
 299                         if (param_is_memref(params + n) &&
 300                             params[n].u.memref.shm)
 301                                 tee_shm_put(params[n].u.memref.shm);
 302                 kfree(params);
 303         }
 304
 305         return rc;
 306 }
 307
 308 static int tee_ioctl_invoke(struct tee_context *ctx,
 309                             struct tee_ioctl_buf_data __user *ubuf)
 310 {
 311         int rc;
 312         size_t n;
 313         struct tee_ioctl_buf_data buf;
 314         struct tee_ioctl_invoke_arg __user *uarg;
 315         struct tee_ioctl_invoke_arg arg;
 316         struct tee_ioctl_param __user *uparams = NULL;
 317         struct tee_param *params = NULL;
 318
 319         if (!ctx->teedev->desc->ops->invoke_func)
 320                 return -EINVAL;
 321
 322         if (copy_from_user(&buf, ubuf, sizeof(buf)))
 323                 return -EFAULT;
 324
 325         if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 326             buf.buf_len < sizeof(struct tee_ioctl_invoke_arg))
 327                 return -EINVAL;
 328
 329         uarg = u64_to_user_ptr(buf.buf_ptr);
 330         if (copy_from_user(&arg, uarg, sizeof(arg)))
 331                 return -EFAULT;
 332
 333         if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
 334                 return -EINVAL;
 335
 336         if (arg.num_params) {
 337                 params = kcalloc(arg.num_params, sizeof(struct tee_param),
 338                                  GFP_KERNEL);
 339                 if (!params)
 340                         return -ENOMEM;
 341                 uparams = uarg->params;
 342                 rc = params_from_user(ctx, params, arg.num_params, uparams);
 343                 if (rc)
 344                         goto out;
 345         }
 346
 347         rc = ctx->teedev->desc->ops->invoke_func(ctx, &arg, params);
 348         if (rc)
 349                 goto out;
 350
 351         if (put_user(arg.ret, &uarg->ret) ||
 352             put_user(arg.ret_origin, &uarg->ret_origin)) {
 353                 rc = -EFAULT;
 354                 goto out;
 355         }
 356         rc = params_to_user(uparams, arg.num_params, params);
 357 out:
 358         if (params) {
 359                 /* Decrease ref count for all valid shared memory pointers */
 360                 for (n = 0; n < arg.num_params; n++)
 361                         if (param_is_memref(params + n) &&
 362                             params[n].u.memref.shm)
 363                                 tee_shm_put(params[n].u.memref.shm);
 364                 kfree(params);
 365         }
 366         return rc;
 367 }
 368
 369 static int tee_ioctl_cancel(struct tee_context *ctx,
 370                             struct tee_ioctl_cancel_arg __user *uarg)
 371 {
 372         struct tee_ioctl_cancel_arg arg;
 373
 374         if (!ctx->teedev->desc->ops->cancel_req)
 375                 return -EINVAL;
 376
 377         if (copy_from_user(&arg, uarg, sizeof(arg)))
 378                 return -EFAULT;
 379
 380         return ctx->teedev->desc->ops->cancel_req(ctx, arg.cancel_id,
 381                                                   arg.session);
 382 }
 383
 384 static int
 385 tee_ioctl_close_session(struct tee_context *ctx,
 386                         struct tee_ioctl_close_session_arg __user *uarg)
 387 {
 388         struct tee_ioctl_close_session_arg arg;
 389
 390         if (!ctx->teedev->desc->ops->close_session)
 391                 return -EINVAL;
 392
 393         if (copy_from_user(&arg, uarg, sizeof(arg)))
 394                 return -EFAULT;
 395
 396         return ctx->teedev->desc->ops->close_session(ctx, arg.session);
 397 }
 398
 399 static int params_to_supp(struct tee_context *ctx,
 400                           struct tee_ioctl_param __user *uparams,
 401                           size_t num_params, struct tee_param *params)
 402 {
 403         size_t n;
 404
 405         for (n = 0; n < num_params; n++) {
 406                 struct tee_ioctl_param ip;
 407                 struct tee_param *p = params + n;
 408
 409                 ip.attr = p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK;
 410                 switch (p->attr) {
 411                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
 412                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 413                         ip.a = p->u.value.a;
 414                         ip.b = p->u.value.b;
 415                         ip.c = p->u.value.c;
 416                         break;
 417                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
 418                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 419                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 420                         ip.b = p->u.memref.size;
 421                         if (!p->u.memref.shm) {
 422                                 ip.a = 0;
 423                                 ip.c = (u64)-1; /* invalid shm id */
 424                                 break;
 425                         }
 426                         ip.a = p->u.memref.shm_offs;
 427                         ip.c = p->u.memref.shm->id;
 428                         break;
 429                 default:
 430                         ip.a = 0;
 431                         ip.b = 0;
 432                         ip.c = 0;
 433                         break;
 434                 }
 435
 436                 if (copy_to_user(uparams + n, &ip, sizeof(ip)))
 437                         return -EFAULT;
 438         }
 439
 440         return 0;
 441 }
 442
 443 static int tee_ioctl_supp_recv(struct tee_context *ctx,
 444                                struct tee_ioctl_buf_data __user *ubuf)
 445 {
 446         int rc;
 447         struct tee_ioctl_buf_data buf;
 448         struct tee_iocl_supp_recv_arg __user *uarg;
 449         struct tee_param *params;
 450         u32 num_params;
 451         u32 func;
 452
 453         if (!ctx->teedev->desc->ops->supp_recv)
 454                 return -EINVAL;
 455
 456         if (copy_from_user(&buf, ubuf, sizeof(buf)))
 457                 return -EFAULT;
 458
 459         if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 460             buf.buf_len < sizeof(struct tee_iocl_supp_recv_arg))
 461                 return -EINVAL;
 462
 463         uarg = u64_to_user_ptr(buf.buf_ptr);
 464         if (get_user(num_params, &uarg->num_params))
 465                 return -EFAULT;
 466
 467         if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len)
 468                 return -EINVAL;
 469
 470         params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
 471         if (!params)
 472                 return -ENOMEM;
 473
 474         rc = ctx->teedev->desc->ops->supp_recv(ctx, &func, &num_params, params);
 475         if (rc)
 476                 goto out;
 477
 478         if (put_user(func, &uarg->func) ||
 479             put_user(num_params, &uarg->num_params)) {
 480                 rc = -EFAULT;
 481                 goto out;
 482         }
 483
 484         rc = params_to_supp(ctx, uarg->params, num_params, params);
 485 out:
 486         kfree(params);
 487         return rc;
 488 }
 489
 490 static int params_from_supp(struct tee_param *params, size_t num_params,
 491                             struct tee_ioctl_param __user *uparams)
 492 {
 493         size_t n;
 494
 495         for (n = 0; n < num_params; n++) {
 496                 struct tee_param *p = params + n;
 497                 struct tee_ioctl_param ip;
 498
 499                 if (copy_from_user(&ip, uparams + n, sizeof(ip)))
 500                         return -EFAULT;
 501
 502                 /* All unused attribute bits has to be zero */
 503                 if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_TYPE_MASK)
 504                         return -EINVAL;
 505
 506                 p->attr = ip.attr;
 507                 switch (ip.attr) {
 508                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
 509                 case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
 510                         /* Only out and in/out values can be updated */
 511                         p->u.value.a = ip.a;
 512                         p->u.value.b = ip.b;
 513                         p->u.value.c = ip.c;
 514                         break;
 515                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
 516                 case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
 517                         /*
 518                          * Only the size of the memref can be updated.
 519                          * Since we don't have access to the original
 520                          * parameters here, only store the supplied size.
 521                          * The driver will copy the updated size into the
 522                          * original parameters.
 523                          */
 524                         p->u.memref.shm = NULL;
 525                         p->u.memref.shm_offs = 0;
 526                         p->u.memref.size = ip.b;
 527                         break;
 528                 default:
 529                         memset(&p->u, 0, sizeof(p->u));
 530                         break;
 531                 }
 532         }
 533         return 0;
 534 }
 535
 536 static int tee_ioctl_supp_send(struct tee_context *ctx,
 537                                struct tee_ioctl_buf_data __user *ubuf)
 538 {
 539         long rc;
 540         struct tee_ioctl_buf_data buf;
 541         struct tee_iocl_supp_send_arg __user *uarg;
 542         struct tee_param *params;
 543         u32 num_params;
 544         u32 ret;
 545
 546         /* Not valid for this driver */
 547         if (!ctx->teedev->desc->ops->supp_send)
 548                 return -EINVAL;
 549
 550         if (copy_from_user(&buf, ubuf, sizeof(buf)))
 551                 return -EFAULT;
 552
 553         if (buf.buf_len > TEE_MAX_ARG_SIZE ||
 554             buf.buf_len < sizeof(struct tee_iocl_supp_send_arg))
 555                 return -EINVAL;
 556
 557         uarg = u64_to_user_ptr(buf.buf_ptr);
 558         if (get_user(ret, &uarg->ret) ||
 559             get_user(num_params, &uarg->num_params))
 560                 return -EFAULT;
 561
 562         if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len)
 563                 return -EINVAL;
 564
 565         params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
 566         if (!params)
 567                 return -ENOMEM;
 568
 569         rc = params_from_supp(params, num_params, uarg->params);
 570         if (rc)
 571                 goto out;
 572
 573         rc = ctx->teedev->desc->ops->supp_send(ctx, ret, num_params, params);
 574 out:
 575         kfree(params);
 576         return rc;
 577 }
 578
 579 static long tee_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 580 {
 581         struct tee_context *ctx = filp->private_data;
 582         void __user *uarg = (void __user *)arg;
 583
 584         switch (cmd) {
 585         case TEE_IOC_VERSION:
 586                 return tee_ioctl_version(ctx, uarg);
 587         case TEE_IOC_SHM_ALLOC:
 588                 return tee_ioctl_shm_alloc(ctx, uarg);
 589         case TEE_IOC_OPEN_SESSION:
 590                 return tee_ioctl_open_session(ctx, uarg);
 591         case TEE_IOC_INVOKE:
 592                 return tee_ioctl_invoke(ctx, uarg);
 593         case TEE_IOC_CANCEL:
 594                 return tee_ioctl_cancel(ctx, uarg);
 595         case TEE_IOC_CLOSE_SESSION:
 596                 return tee_ioctl_close_session(ctx, uarg);
 597         case TEE_IOC_SUPPL_RECV:
 598                 return tee_ioctl_supp_recv(ctx, uarg);
 599         case TEE_IOC_SUPPL_SEND:
 600                 return tee_ioctl_supp_send(ctx, uarg);
 601         default:
 602                 return -EINVAL;
 603         }
 604 }
 605
 606 static const struct file_operations tee_fops = {
 607         .owner = THIS_MODULE,
 608         .open = tee_open,
 609         .release = tee_release,
 610         .unlocked_ioctl = tee_ioctl,
 611         .compat_ioctl = tee_ioctl,
 612 };
 613
 614 static void tee_release_device(struct device *dev)
 615 {
 616         struct tee_device *teedev = container_of(dev, struct tee_device, dev);
 617
 618         spin_lock(&driver_lock);
 619         clear_bit(teedev->id, dev_mask);
 620         spin_unlock(&driver_lock);
 621         mutex_destroy(&teedev->mutex);
 622         idr_destroy(&teedev->idr);
 623         kfree(teedev);
 624 }
 625
 626 /**
 627  * tee_device_alloc() - Allocate a new struct tee_device instance
 628  * @teedesc:    Descriptor for this driver
 629  * @dev:        Parent device for this device
 630  * @pool:       Shared memory pool, NULL if not used
 631  * @driver_data: Private driver data for this device
 632  *
 633  * Allocates a new struct tee_device instance. The device is
 634  * removed by tee_device_unregister().
 635  *
 636  * @returns a pointer to a 'struct tee_device' or an ERR_PTR on failure
 637  */
 638 struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
 639                                     struct device *dev,
 640                                     struct tee_shm_pool *pool,
 641                                     void *driver_data)
 642 {
 643         struct tee_device *teedev;
 644         void *ret;
 645         int rc;
 646         int offs = 0;
 647
 648         if (!teedesc || !teedesc->name || !teedesc->ops ||
 649             !teedesc->ops->get_version || !teedesc->ops->open ||
 650             !teedesc->ops->release || !pool)
 651                 return ERR_PTR(-EINVAL);
 652
 653         teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
 654         if (!teedev) {
 655                 ret = ERR_PTR(-ENOMEM);
 656                 goto err;
 657         }
 658
 659         if (teedesc->flags & TEE_DESC_PRIVILEGED)
 660                 offs = TEE_NUM_DEVICES / 2;
 661
 662         spin_lock(&driver_lock);
 663         teedev->id = find_next_zero_bit(dev_mask, TEE_NUM_DEVICES, offs);
 664         if (teedev->id < TEE_NUM_DEVICES)
 665                 set_bit(teedev->id, dev_mask);
 666         spin_unlock(&driver_lock);
 667
 668         if (teedev->id >= TEE_NUM_DEVICES) {
 669                 ret = ERR_PTR(-ENOMEM);
 670                 goto err;
 671         }
 672
 673         snprintf(teedev->name, sizeof(teedev->name), "tee%s%d",
 674                  teedesc->flags & TEE_DESC_PRIVILEGED ? "priv" : "",
 675                  teedev->id - offs);
 676
 677         teedev->dev.class = tee_class;
 678         teedev->dev.release = tee_release_device;
 679         teedev->dev.parent = dev;
 680
 681         teedev->dev.devt = MKDEV(MAJOR(tee_devt), teedev->id);
 682
 683         rc = dev_set_name(&teedev->dev, "%s", teedev->name);
 684         if (rc) {
 685                 ret = ERR_PTR(rc);
 686                 goto err_devt;
 687         }
 688
 689         cdev_init(&teedev->cdev, &tee_fops);
 690         teedev->cdev.owner = teedesc->owner;
 691         teedev->cdev.kobj.parent = &teedev->dev.kobj;
 692
 693         dev_set_drvdata(&teedev->dev, driver_data);
 694         device_initialize(&teedev->dev);
 695
 696         /* 1 as tee_device_unregister() does one final tee_device_put() */
 697         teedev->num_users = 1;
 698         init_completion(&teedev->c_no_users);
 699         mutex_init(&teedev->mutex);
 700         idr_init(&teedev->idr);
 701
 702         teedev->desc = teedesc;
 703         teedev->pool = pool;
 704
 705         return teedev;
 706 err_devt:
 707         unregister_chrdev_region(teedev->dev.devt, 1);
 708 err:
 709         pr_err("could not register %s driver\n",
 710                teedesc->flags & TEE_DESC_PRIVILEGED ? "privileged" : "client");
 711         if (teedev && teedev->id < TEE_NUM_DEVICES) {
 712                 spin_lock(&driver_lock);
 713                 clear_bit(teedev->id, dev_mask);
 714                 spin_unlock(&driver_lock);
 715         }
 716         kfree(teedev);
 717         return ret;
 718 }
 719 EXPORT_SYMBOL_GPL(tee_device_alloc);
 720
 721 static ssize_t implementation_id_show(struct device *dev,
 722                                       struct device_attribute *attr, char *buf)
 723 {
 724         struct tee_device *teedev = container_of(dev, struct tee_device, dev);
 725         struct tee_ioctl_version_data vers;
 726
 727         teedev->desc->ops->get_version(teedev, &vers);
 728         return scnprintf(buf, PAGE_SIZE, "%d\n", vers.impl_id);
 729 }
 730 static DEVICE_ATTR_RO(implementation_id);
 731
 732 static struct attribute *tee_dev_attrs[] = {
 733         &dev_attr_implementation_id.attr,
 734         NULL
 735 };
 736
 737 static const struct attribute_group tee_dev_group = {
 738         .attrs = tee_dev_attrs,
 739 };
 740
 741 /**
 742  * tee_device_register() - Registers a TEE device
 743  * @teedev:     Device to register
 744  *
 745  * tee_device_unregister() need to be called to remove the @teedev if
 746  * this function fails.
 747  *
 748  * @returns < 0 on failure
 749  */
 750 int tee_device_register(struct tee_device *teedev)
 751 {
 752         int rc;
 753
 754         if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) {
 755                 dev_err(&teedev->dev, "attempt to register twice\n");
 756                 return -EINVAL;
 757         }
 758
 759         rc = cdev_add(&teedev->cdev, teedev->dev.devt, 1);
 760         if (rc) {
 761                 dev_err(&teedev->dev,
 762                         "unable to cdev_add() %s, major %d, minor %d, err=%d\n",
 763                         teedev->name, MAJOR(teedev->dev.devt),
 764                         MINOR(teedev->dev.devt), rc);
 765                 return rc;
 766         }
 767
 768         rc = device_add(&teedev->dev);
 769         if (rc) {
 770                 dev_err(&teedev->dev,
 771                         "unable to device_add() %s, major %d, minor %d, err=%d\n",
 772                         teedev->name, MAJOR(teedev->dev.devt),
 773                         MINOR(teedev->dev.devt), rc);
 774                 goto err_device_add;
 775         }
 776
 777         rc = sysfs_create_group(&teedev->dev.kobj, &tee_dev_group);
 778         if (rc) {
 779                 dev_err(&teedev->dev,
 780                         "failed to create sysfs attributes, err=%d\n", rc);
 781                 goto err_sysfs_create_group;
 782         }
 783
 784         teedev->flags |= TEE_DEVICE_FLAG_REGISTERED;
 785         return 0;
 786
 787 err_sysfs_create_group:
 788         device_del(&teedev->dev);
 789 err_device_add:
 790         cdev_del(&teedev->cdev);
 791         return rc;
 792 }
 793 EXPORT_SYMBOL_GPL(tee_device_register);
 794
 795 void tee_device_put(struct tee_device *teedev)
 796 {
 797         mutex_lock(&teedev->mutex);
 798         /* Shouldn't put in this state */
 799         if (!WARN_ON(!teedev->desc)) {
 800                 teedev->num_users--;
 801                 if (!teedev->num_users) {
 802                         teedev->desc = NULL;
 803                         complete(&teedev->c_no_users);
 804                 }
 805         }
 806         mutex_unlock(&teedev->mutex);
 807 }
 808
 809 bool tee_device_get(struct tee_device *teedev)
 810 {
 811         mutex_lock(&teedev->mutex);
 812         if (!teedev->desc) {
 813                 mutex_unlock(&teedev->mutex);
 814                 return false;
 815         }
 816         teedev->num_users++;
 817         mutex_unlock(&teedev->mutex);
 818         return true;
 819 }
 820
 821 /**
 822  * tee_device_unregister() - Removes a TEE device
 823  * @teedev:     Device to unregister
 824  *
 825  * This function should be called to remove the @teedev even if
 826  * tee_device_register() hasn't been called yet. Does nothing if
 827  * @teedev is NULL.
 828  */
 829 void tee_device_unregister(struct tee_device *teedev)
 830 {
 831         if (!teedev)
 832                 return;
 833
 834         if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) {
 835                 sysfs_remove_group(&teedev->dev.kobj, &tee_dev_group);
 836                 cdev_del(&teedev->cdev);
 837                 device_del(&teedev->dev);
 838         }
 839
 840         tee_device_put(teedev);
 841         wait_for_completion(&teedev->c_no_users);
 842
 843         /*
 844          * No need to take a mutex any longer now since teedev->desc was
 845          * set to NULL before teedev->c_no_users was completed.
 846          */
 847
 848         teedev->pool = NULL;
 849
 850         put_device(&teedev->dev);
 851 }
 852 EXPORT_SYMBOL_GPL(tee_device_unregister);
 853
 854 /**
 855  * tee_get_drvdata() - Return driver_data pointer
 856  * @teedev:     Device containing the driver_data pointer
 857  * @returns the driver_data pointer supplied to tee_register().
 858  */
 859 void *tee_get_drvdata(struct tee_device *teedev)
 860 {
 861         return dev_get_drvdata(&teedev->dev);
 862 }
 863 EXPORT_SYMBOL_GPL(tee_get_drvdata);
 864
 865 static int __init tee_init(void)
 866 {
 867         int rc;
 868
 869         tee_class = class_create(THIS_MODULE, "tee");
 870         if (IS_ERR(tee_class)) {
 871                 pr_err("couldn't create class\n");
 872                 return PTR_ERR(tee_class);
 873         }
 874
 875         rc = alloc_chrdev_region(&tee_devt, 0, TEE_NUM_DEVICES, "tee");
 876         if (rc) {
 877                 pr_err("failed to allocate char dev region\n");
 878                 class_destroy(tee_class);
 879                 tee_class = NULL;
 880         }
 881
 882         return rc;
 883 }
 884
 885 static void __exit tee_exit(void)
 886 {
 887         class_destroy(tee_class);
 888         tee_class = NULL;
 889         unregister_chrdev_region(tee_devt, TEE_NUM_DEVICES);
 890 }
 891
 892 subsys_initcall(tee_init);
 893 module_exit(tee_exit);
 894
 895 MODULE_AUTHOR("Linaro");
 896 MODULE_DESCRIPTION("TEE Driver");
 897 MODULE_VERSION("1.0");
 898 MODULE_LICENSE("GPL v2");