The FF-A backend maintains a hash table translating secure-world memory handles to TEE shared-memory objects. This bookkeeping does not depend on FF-A and is also needed by the RPMI backend.

Move the mapping and its locking into common helpers and convert the FF-A backend to use them.

This prepares the OP-TEE driver for RPMI transport support on RISC-V.

Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com --- drivers/tee/optee/Makefile | 1 + drivers/tee/optee/ffa_abi.c | 133 +++++++---------------------------- drivers/tee/optee/optee_private.h | 30 ++++++-- drivers/tee/optee/shm_handle_map.c | 138 +++++++++++++++++++++++++++++++++++++ 4 files changed, 188 insertions(+), 114 deletions(-)

diff --git a/drivers/tee/optee/Makefile b/drivers/tee/optee/Makefile index 183cdde1ac04..ec2efc27ef05 100644 --- a/drivers/tee/optee/Makefile +++ b/drivers/tee/optee/Makefile @@ -7,6 +7,7 @@ optee-objs += rpc.o optee-objs += protmem.o optee-objs += supp.o optee-objs += device.o +optee-objs += shm_handle_map.o optee-$(CONFIG_HAVE_ARM_SMCCC) += smc_abi.o optee-$(CONFIG_ARM_FFA_TRANSPORT) += ffa_abi.o

diff --git a/drivers/tee/optee/ffa_abi.c b/drivers/tee/optee/ffa_abi.c index 702da7d98fbc..5a926353c653 100644 --- a/drivers/tee/optee/ffa_abi.c +++ b/drivers/tee/optee/ffa_abi.c @@ -22,100 +22,15 @@ * This file implement the FF-A ABI used when communicating with secure world * OP-TEE OS via FF-A. * This file is divided into the following sections: - * 1. Maintain a hash table for lookup of a global FF-A memory handle - * 2. Convert between struct tee_param and struct optee_msg_param - * 3. Low level support functions to register shared memory in secure world - * 4. Dynamic shared memory pool based on alloc_pages() - * 5. Do a normal scheduled call into secure world - * 6. Driver initialization. + * 1. Convert between struct tee_param and struct optee_msg_param + * 2. Low level support functions to register shared memory in secure world + * 3. Dynamic shared memory pool based on alloc_pages() + * 4. Do a normal scheduled call into secure world + * 5. Driver initialization. */

/* - * 1. Maintain a hash table for lookup of a global FF-A memory handle - * - * FF-A assigns a global memory handle for each piece shared memory. - * This handle is then used when communicating with secure world. - * - * Main functions are optee_shm_add_ffa_handle() and optee_shm_rem_ffa_handle() - */ -struct shm_rhash { - struct tee_shm *shm; - u64 global_id; - struct rhash_head linkage; -}; - -static void rh_free_fn(void *ptr, void *arg) -{ - kfree(ptr); -} - -static const struct rhashtable_params shm_rhash_params = { - .head_offset = offsetof(struct shm_rhash, linkage), - .key_len = sizeof(u64), - .key_offset = offsetof(struct shm_rhash, global_id), - .automatic_shrinking = true, -}; - -static struct tee_shm *optee_shm_from_ffa_handle(struct optee *optee, - u64 global_id) -{ - struct tee_shm *shm = NULL; - struct shm_rhash *r; - - mutex_lock(&optee->ffa.mutex); - r = rhashtable_lookup_fast(&optee->ffa.global_ids, &global_id, - shm_rhash_params); - if (r) - shm = r->shm; - mutex_unlock(&optee->ffa.mutex); - - return shm; -} - -static int optee_shm_add_ffa_handle(struct optee *optee, struct tee_shm *shm, - u64 global_id) -{ - struct shm_rhash *r; - int rc; - - r = kmalloc_obj(*r); - if (!r) - return -ENOMEM; - r->shm = shm; - r->global_id = global_id; - - mutex_lock(&optee->ffa.mutex); - rc = rhashtable_lookup_insert_fast(&optee->ffa.global_ids, &r->linkage, - shm_rhash_params); - mutex_unlock(&optee->ffa.mutex); - - if (rc) - kfree(r); - - return rc; -} - -static int optee_shm_rem_ffa_handle(struct optee *optee, u64 global_id) -{ - struct shm_rhash *r; - int rc = -ENOENT; - - mutex_lock(&optee->ffa.mutex); - r = rhashtable_lookup_fast(&optee->ffa.global_ids, &global_id, - shm_rhash_params); - if (r) - rc = rhashtable_remove_fast(&optee->ffa.global_ids, - &r->linkage, shm_rhash_params); - mutex_unlock(&optee->ffa.mutex); - - if (!rc) - kfree(r); - - return rc; -} - -/* - * 2. Convert between struct tee_param and struct optee_msg_param + * 1. Convert between struct tee_param and struct optee_msg_param * * optee_ffa_from_msg_param() and optee_ffa_to_msg_param() are the main * functions. @@ -133,7 +48,8 @@ static void from_msg_param_ffa_mem(struct optee *optee, struct tee_param *p, p->u.memref.size = mp->u.fmem.size;

if (mp->u.fmem.global_id != OPTEE_MSG_FMEM_INVALID_GLOBAL_ID) - shm = optee_shm_from_ffa_handle(optee, mp->u.fmem.global_id); + shm = optee_shm_handle_map_lookup(&optee->ffa.shm_map, + mp->u.fmem.global_id); p->u.memref.shm = shm;

if (shm) { @@ -262,7 +178,7 @@ static int optee_ffa_to_msg_param(struct optee *optee, }

/* - * 3. Low level support functions to register shared memory in secure world + * 2. Low level support functions to register shared memory in secure world * * Functions to register and unregister shared memory both for normal * clients and for tee-supplicant. @@ -313,7 +229,7 @@ static int optee_ffa_shm_register(struct tee_context *ctx, struct tee_shm *shm, if (rc) return rc;

- rc = optee_shm_add_ffa_handle(optee, shm, args.g_handle); + rc = optee_shm_handle_map_add(&optee->ffa.shm_map, shm, args.g_handle); if (rc) { mem_ops->memory_reclaim(args.g_handle, 0); return rc; @@ -339,7 +255,7 @@ static int optee_ffa_shm_unregister(struct tee_context *ctx, }; int rc;

- optee_shm_rem_ffa_handle(optee, global_handle); + optee_shm_handle_map_remove(&optee->ffa.shm_map, global_handle); shm->sec_world_id = 0;

rc = msg_ops->sync_send_receive(ffa_dev, &data); @@ -367,7 +283,7 @@ static int optee_ffa_shm_unregister_supp(struct tee_context *ctx, * this ID. */

- optee_shm_rem_ffa_handle(optee, global_handle); + optee_shm_handle_map_remove(&optee->ffa.shm_map, global_handle); mem_ops = optee->ffa.ffa_dev->ops->mem_ops; rc = mem_ops->memory_reclaim(global_handle, 0); if (rc) @@ -379,7 +295,7 @@ static int optee_ffa_shm_unregister_supp(struct tee_context *ctx, }

/* - * 4. Dynamic shared memory pool based on alloc_pages() + * 3. Dynamic shared memory pool based on alloc_pages() * * Implements an OP-TEE specific shared memory pool. * The main function is optee_ffa_shm_pool_alloc_pages(). @@ -428,7 +344,7 @@ static struct tee_shm_pool *optee_ffa_shm_pool_alloc_pages(void) }

/* - * 5. Do a normal scheduled call into secure world + * 4. Do a normal scheduled call into secure world * * The function optee_ffa_do_call_with_arg() performs a normal scheduled * call into secure world. During this call may normal world request help @@ -488,7 +404,8 @@ static void handle_ffa_rpc_func_cmd_shm_free(struct tee_context *ctx, arg->params[0].attr != OPTEE_MSG_ATTR_TYPE_VALUE_INPUT) goto err_bad_param;

- shm = optee_shm_from_ffa_handle(optee, arg->params[0].u.value.b); + shm = optee_shm_handle_map_lookup(&optee->ffa.shm_map, + arg->params[0].u.value.b); if (!shm) goto err_bad_param; switch (arg->params[0].u.value.a) { @@ -736,7 +653,8 @@ static int optee_ffa_lend_protmem(struct optee *optee, struct tee_shm *protmem, if (rc) goto err_reclaim;

- rc = optee_shm_add_ffa_handle(optee, protmem, args.g_handle); + rc = optee_shm_handle_map_add(&optee->ffa.shm_map, protmem, + args.g_handle); if (rc) goto err_unreg;

@@ -770,7 +688,7 @@ static int optee_ffa_reclaim_protmem(struct optee *optee, }; int rc;

- optee_shm_rem_ffa_handle(optee, global_handle); + optee_shm_handle_map_remove(&optee->ffa.shm_map, global_handle); protmem->sec_world_id = 0;

rc = msg_ops->sync_send_receive(ffa_dev, &data); @@ -785,9 +703,9 @@ static int optee_ffa_reclaim_protmem(struct optee *optee, }

/* - * 6. Driver initialization + * 5. Driver initialization * - * During driver inititialization is the OP-TEE Secure Partition is probed + * During driver initialization is the OP-TEE Secure Partition is probed * to find out which features it supports so the driver can be initialized * with a matching configuration. */ @@ -991,8 +909,7 @@ static void optee_ffa_remove(struct ffa_device *ffa_dev) } optee_remove_common(optee);

- mutex_destroy(&optee->ffa.mutex); - rhashtable_free_and_destroy(&optee->ffa.global_ids, rh_free_fn, NULL); + optee_shm_handle_map_uninit(&optee->ffa.shm_map);

kfree(optee); } @@ -1137,10 +1054,9 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev)

optee_set_dev_group(optee);

- rc = rhashtable_init(&optee->ffa.global_ids, &shm_rhash_params); + rc = optee_shm_handle_map_init(&optee->ffa.shm_map); if (rc) goto err_unreg_supp_teedev; - mutex_init(&optee->ffa.mutex); optee_cq_init(&optee->call_queue, 0); optee_supp_init(&optee->supp); optee_shm_arg_cache_init(optee, arg_cache_flags); @@ -1193,12 +1109,11 @@ static int optee_ffa_probe(struct ffa_device *ffa_dev) err_close_ctx: teedev_close_context(ctx); err_rhashtable_free: - rhashtable_free_and_destroy(&optee->ffa.global_ids, rh_free_fn, NULL); + optee_shm_handle_map_uninit(&optee->ffa.shm_map); rpmb_dev_put(optee->rpmb_dev); mutex_destroy(&optee->rpmb_dev_mutex); optee_supp_uninit(&optee->supp); mutex_destroy(&optee->call_queue.mutex); - mutex_destroy(&optee->ffa.mutex); err_unreg_supp_teedev: tee_device_unregister(optee->supp_teedev); err_unreg_teedev: diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h index 02d6f79df407..92428945ee33 100644 --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -157,6 +157,29 @@ struct optee_smc { }; #endif

+/** + * struct optee_shm_handle_map - Shared-memory lookup by secure-world identity + * @mutex: Serializes lookup, insertion and removal + * @rht: Maps opaque 64-bit identities to shared-memory objects + * + * Owners keep SHM objects alive while their registrations are in use. + * Never hold @mutex across transport calls, RPC or thread-availability waits. + */ +struct optee_shm_handle_map { + /* Protects lookup, insertion and removal. */ + struct mutex mutex; + struct rhashtable rht; +}; + +int optee_shm_handle_map_init(struct optee_shm_handle_map *map); +void optee_shm_handle_map_uninit(struct optee_shm_handle_map *map); +int optee_shm_handle_map_add(struct optee_shm_handle_map *map, + struct tee_shm *shm, u64 global_id); +int optee_shm_handle_map_remove(struct optee_shm_handle_map *map, + u64 global_id); +struct tee_shm * +optee_shm_handle_map_lookup(struct optee_shm_handle_map *map, u64 global_id); + #if IS_REACHABLE(CONFIG_ARM_FFA_TRANSPORT) /** * struct optee_ffa - FFA communication struct @@ -164,17 +187,14 @@ struct optee_smc { * OP-TEE in secure world * @bottom_half_value: notification ID used for bottom half signalling or * U32_MAX if unused - * @mutex: serializes access to @global_ids - * @global_ids: FF-A shared memory global handle translation + * @shm_map: FF-A shared memory global handle translation * @notif_wq: workqueue for FF-A asynchronous notification * @notif_work: work for FF-A asynchronous notification */ struct optee_ffa { struct ffa_device *ffa_dev; u32 bottom_half_value; - /* Serializes access to @global_ids */ - struct mutex mutex; - struct rhashtable global_ids; + struct optee_shm_handle_map shm_map; struct workqueue_struct *notif_wq; struct work_struct notif_work; }; diff --git a/drivers/tee/optee/shm_handle_map.c b/drivers/tee/optee/shm_handle_map.c new file mode 100644 index 000000000000..54324c9c3644 --- /dev/null +++ b/drivers/tee/optee/shm_handle_map.c @@ -0,0 +1,138 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (c) 2021, 2023 Linaro Limited + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ + +#include <linux/errno.h> +#include <linux/slab.h> +#include "optee_private.h" + +struct optee_shm_handle_map_entry { + struct tee_shm *shm; + u64 global_id; + struct rhash_head node; +}; + +static const struct rhashtable_params shm_handle_map_params = { + .head_offset = offsetof(struct optee_shm_handle_map_entry, node), + .key_offset = offsetof(struct optee_shm_handle_map_entry, global_id), + .key_len = sizeof(u64), + .automatic_shrinking = true, +}; + +static void shm_handle_map_free(void *ptr, void *arg) +{ + kfree(ptr); +} + +/** + * optee_shm_handle_map_init() - Initialize a shared-memory identity map + * @map: Map to initialize + * + * Return: 0 on success or a negative error. + */ +int optee_shm_handle_map_init(struct optee_shm_handle_map *map) +{ + int rc; + + mutex_init(&map->mutex); + rc = rhashtable_init(&map->rht, &shm_handle_map_params); + if (rc) + mutex_destroy(&map->mutex); + + return rc; +} + +/** + * optee_shm_handle_map_uninit() - Free a shared-memory identity map + * @map: Initialized map with no concurrent users + * + * Free tracking entries, not SHM objects or their secure-world registrations. + */ +void optee_shm_handle_map_uninit(struct optee_shm_handle_map *map) +{ + rhashtable_free_and_destroy(&map->rht, shm_handle_map_free, NULL); + mutex_destroy(&map->mutex); +} + +/** + * optee_shm_handle_map_add() - Track a registered shared-memory object + * @map: Initialized map + * @shm: Shared-memory object kept alive by its owner + * @global_id: Opaque secure-world identity + * + * Return: 0 on success or a negative error. + */ +int optee_shm_handle_map_add(struct optee_shm_handle_map *map, + struct tee_shm *shm, u64 global_id) +{ + struct optee_shm_handle_map_entry *entry; + int rc; + + entry = kmalloc_obj(*entry); + if (!entry) + return -ENOMEM; + + entry->shm = shm; + entry->global_id = global_id; + + mutex_lock(&map->mutex); + rc = rhashtable_lookup_insert_fast(&map->rht, &entry->node, + shm_handle_map_params); + mutex_unlock(&map->mutex); + if (rc) + kfree(entry); + + return rc; +} + +/** + * optee_shm_handle_map_remove() - Remove a shared-memory tracking entry + * @map: Initialized map + * @global_id: Opaque secure-world identity + * + * Return: 0 on success, -ENOENT if absent, or a negative removal error. + */ +int optee_shm_handle_map_remove(struct optee_shm_handle_map *map, u64 global_id) +{ + struct optee_shm_handle_map_entry *entry; + int rc = -ENOENT; + + mutex_lock(&map->mutex); + entry = rhashtable_lookup_fast(&map->rht, &global_id, + shm_handle_map_params); + if (entry) + rc = rhashtable_remove_fast(&map->rht, &entry->node, + shm_handle_map_params); + mutex_unlock(&map->mutex); + if (!rc) + kfree(entry); + + return rc; +} + +/** + * optee_shm_handle_map_lookup() - Look up a registered shared-memory object + * @map: Initialized map + * @global_id: Opaque secure-world identity + * + * The caller must keep the SHM object alive; no reference is acquired here. + * + * Return: The shared-memory object or NULL if the identity is absent. + */ +struct tee_shm * +optee_shm_handle_map_lookup(struct optee_shm_handle_map *map, u64 global_id) +{ + struct optee_shm_handle_map_entry *entry; + struct tee_shm *shm = NULL; + + mutex_lock(&map->mutex); + entry = rhashtable_lookup_fast(&map->rht, &global_id, + shm_handle_map_params); + if (entry) + shm = entry->shm; + mutex_unlock(&map->mutex); + + return shm; +}

Define the OP-TEE service protocol carried by RPMI TEE_CALL payloads. Add operations for version and capability queries, shared-memory unregistration, asynchronous notification enablement, and yielding-call start and resume. Use fixed-width little-endian control fields and TEE result codes for control responses.

Add a parcel memory-reference layout with a full-width 64-bit offset to the common message parameter union. Encode the RPMI parcel ID and nonce as an opaque 64-bit global ID. A zero nonce denotes NULL, leaving parcel ID zero usable with a nonzero nonce.

Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com --- drivers/tee/optee/optee_msg.h | 23 +++- drivers/tee/optee/optee_rpmi.h | 263 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 283 insertions(+), 3 deletions(-)

diff --git a/drivers/tee/optee/optee_msg.h b/drivers/tee/optee/optee_msg.h index 6c3043f8da33..dc331cb0dace 100644 --- a/drivers/tee/optee/optee_msg.h +++ b/drivers/tee/optee/optee_msg.h @@ -31,6 +31,9 @@ #define OPTEE_MSG_ATTR_TYPE_FMEM_INPUT OPTEE_MSG_ATTR_TYPE_RMEM_INPUT #define OPTEE_MSG_ATTR_TYPE_FMEM_OUTPUT OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT #define OPTEE_MSG_ATTR_TYPE_FMEM_INOUT OPTEE_MSG_ATTR_TYPE_RMEM_INOUT +#define OPTEE_MSG_ATTR_TYPE_PMEM_INPUT OPTEE_MSG_ATTR_TYPE_RMEM_INPUT +#define OPTEE_MSG_ATTR_TYPE_PMEM_OUTPUT OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT +#define OPTEE_MSG_ATTR_TYPE_PMEM_INOUT OPTEE_MSG_ATTR_TYPE_RMEM_INOUT #define OPTEE_MSG_ATTR_TYPE_TMEM_INPUT 0x9 #define OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT 0xa #define OPTEE_MSG_ATTR_TYPE_TMEM_INOUT 0xb @@ -149,6 +152,18 @@ struct optee_msg_param_fmem { u64 global_id; };

+/** + * struct optee_msg_param_pmem - RPMI parcel memory reference + * @offs: Byte offset from the start of the shared parcel + * @size: Reference size, or required size for a short-buffer response + * @global_id: Parcel ID in bits 31:0 and nonce in bits 63:32 + */ +struct optee_msg_param_pmem { + u64 offs; + u64 size; + u64 global_id; +}; + /** * struct optee_msg_param_value - opaque value parameter * @a: first opaque value @@ -169,15 +184,16 @@ struct optee_msg_param_value { * @tmem: parameter by temporary memory reference * @rmem: parameter by registered memory reference * @fmem: parameter by FF-A registered memory reference + * @pmem: parameter by RPMI parcel memory reference * @value: parameter by opaque value * @octets: parameter by octet string * @u: union holding OP-TEE msg parameter * * @attr & OPTEE_MSG_ATTR_TYPE_MASK indicates if tmem, rmem or value is used in * the union. OPTEE_MSG_ATTR_TYPE_VALUE_* indicates value or octets, - * OPTEE_MSG_ATTR_TYPE_TMEM_* indicates @tmem and - * OPTEE_MSG_ATTR_TYPE_RMEM_* or the alias PTEE_MSG_ATTR_TYPE_FMEM_* indicates - * @rmem or @fmem depending on the conduit. + * OPTEE_MSG_ATTR_TYPE_TMEM_* indicates @u.tmem. OPTEE_MSG_ATTR_TYPE_RMEM_* + * and its FMEM/PMEM aliases indicate @u.rmem, @u.fmem or @u.pmem depending + * on the conduit. * OPTEE_MSG_ATTR_TYPE_NONE indicates that none of the members are used. */ struct optee_msg_param { @@ -186,6 +202,7 @@ struct optee_msg_param { struct optee_msg_param_tmem tmem; struct optee_msg_param_rmem rmem; struct optee_msg_param_fmem fmem; + struct optee_msg_param_pmem pmem; struct optee_msg_param_value value; u8 octets[24]; } u; diff --git a/drivers/tee/optee/optee_rpmi.h b/drivers/tee/optee/optee_rpmi.h new file mode 100644 index 000000000000..d4cf2d927a7f --- /dev/null +++ b/drivers/tee/optee/optee_rpmi.h @@ -0,0 +1,263 @@ +/* SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause) */ +/* + * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries. + */ +#ifndef OPTEE_RPMI_H +#define OPTEE_RPMI_H + +#include <linux/bitops.h> +#include <linux/types.h> +#include <linux/uuid.h> +#include <linux/wordpart.h> + +/* + * OP-TEE service ABI over RPMI TEE_CALL. + * + * Requests and responses are carried in the TEE_CALL service payload. + * Control fields are little-endian. Response status fields contain unsigned + * 32-bit TEE result codes: TEE_SUCCESS or TEE_ERROR_*. These are distinct + * from the outer TEE_CALL status, which uses signed RPMI error codes, and + * the GP command result in optee_msg_arg.ret. + * + * Memory references use a global_id combining the parcel ID and nonce. + * A zero nonce denotes NULL regardless of the parcel ID. A NULL reference + * must specify a zero buffer offset; its requested size is preserved. + */ + +#define OPTEE_RPMI_SERVICE_UUID \ + UUID_INIT(0x486178e0, 0xe7f8, 0x11e3, \ + 0xbc, 0x5e, 0x00, 0x02, 0xa5, 0xd5, 0xc5, 0x1b) + +#define OPTEE_RPMI_VERSION_MAJOR 1 +#define OPTEE_RPMI_VERSION_MINOR 0 + +/** + * optee_rpmi_global_id() - encode an opaque parcel memory identity + * @parcel_id: firmware-assigned parcel identifier + * @nonce: REE nonce supplied when sharing the parcel + * + * Return: A 64-bit identity for memory parcel. + */ +static inline u64 optee_rpmi_global_id(u32 parcel_id, u32 nonce) +{ + return ((u64)nonce << 32) | parcel_id; +} + +/* Extract the firmware-assigned parcel ID from a memory identity. */ +static inline u32 optee_rpmi_parcel_id(u64 global_id) +{ + return lower_32_bits(global_id); +} + +/* Extract the nonce; zero denotes a NULL memory reference. */ +static inline u32 optee_rpmi_nonce(u64 global_id) +{ + return upper_32_bits(global_id); +} + +/** + * struct optee_rpmi_probe_req - request without operation-specific arguments + * @op: GET_API_VERSION, GET_OS_VERSION or EXCHANGE_CAPABILITIES + */ +struct optee_rpmi_probe_req { + __le32 op; +}; + +/** + * struct optee_rpmi_status_resp - response carrying only a TEE result + * @status: TEE result code; TEE_SUCCESS on success + */ +struct optee_rpmi_status_resp { + __le32 status; +}; + +/* + * Return the service API version. + * + * Request: struct optee_rpmi_probe_req + * Response: struct optee_rpmi_api_resp + */ +#define OPTEE_RPMI_GET_API_VERSION 0 + +/** + * struct optee_rpmi_api_resp - GET_API_VERSION response + * @status: TEE result code; TEE_SUCCESS on success + * @major: incompatible protocol revision + * @minor: compatible protocol revision + */ +struct optee_rpmi_api_resp { + __le32 status; + __le32 major; + __le32 minor; +}; + +/* + * Return the trusted OS revision, not the service API revision. + * + * Request: struct optee_rpmi_probe_req + * Response: struct optee_rpmi_os_resp + */ +#define OPTEE_RPMI_GET_OS_VERSION 1 + +/** + * struct optee_rpmi_os_resp - GET_OS_VERSION response + * @status: TEE result code; TEE_SUCCESS on success + * @major: trusted OS major revision + * @minor: trusted OS minor revision + * @reserved: must be zero + * @build_id: trusted OS build identifier, zero if unspecified + */ +struct optee_rpmi_os_resp { + __le32 status; + __le32 major; + __le32 minor; + __le32 reserved; + __le64 build_id; +}; + +/* + * Query secure-world capabilities and limits. + * + * Request: struct optee_rpmi_probe_req + * Response: struct optee_rpmi_caps_resp + */ +#define OPTEE_RPMI_EXCHANGE_CAPABILITIES 2 + +/** + * struct optee_rpmi_caps_resp - EXCHANGE_CAPABILITIES response + * @status: TEE result code; TEE_SUCCESS on success + * @secure_caps: reserved for future optional features; zero in version 1 + * @rpc_param_count: nonzero parameter capacity of each RPC argument buffer + * @max_notification_key: inclusive maximum logical key, including synchronous + * keys; zero selects the default maximum of 255 + * + * Version 1 defines no capability bits. Unknown bits are ignored by Linux + * for compatibility with future extensions. + */ +struct optee_rpmi_caps_resp { + __le32 status; + __le32 secure_caps; + __le32 rpc_param_count; + __le32 max_notification_key; +}; + +/* + * Unregister a shared parcel from OP-TEE. + * + * Request: struct optee_rpmi_unregister_req + * Response: struct optee_rpmi_status_resp + */ +#define OPTEE_RPMI_UNREGISTER_SHM 3 + +/** + * struct optee_rpmi_unregister_req - retire a shared parcel in OP-TEE + * @op: OPTEE_RPMI_UNREGISTER_SHM + * @reserved: must be zero + * @global_id: identity of the parcel to retire; nonce must be nonzero + * + * Success means OP-TEE stopped using the mapping and released its receiver + * interest. + */ +struct optee_rpmi_unregister_req { + __le32 op; + __le32 reserved; + __le64 global_id; +}; + +/* + * Enable asynchronous notification delivery. + * + * Request: struct optee_rpmi_enable_notif_req + * Response: struct optee_rpmi_status_resp + */ +#define OPTEE_RPMI_ENABLE_ASYNC_NOTIF 4 + +/** + * struct optee_rpmi_enable_notif_req - bind an incoming RPMI doorbell + * @op: OPTEE_RPMI_ENABLE_ASYNC_NOTIF + * @signal_id: allocated TEE-to-REE signal, not a logical notification key + * + * Success activates delivery and raises the doorbell for pending work. + * Raising the signal requests OPTEE_MSG_CMD_DO_BOTTOM_HALF. + * OPTEE_MSG_CMD_STOP_ASYNC_NOTIF stops future doorbell generation, but does + * not drain already-raised signals or release the signal ID. + */ +struct optee_rpmi_enable_notif_req { + __le32 op; + __le32 signal_id; +}; + +/* + * Start a yielding command using shared command and RPC arguments. + * + * Request: struct optee_rpmi_call_req + * Response: struct optee_rpmi_call_resp + */ +#define OPTEE_RPMI_YIELDING_CALL_WITH_ARG 5 + +#define OPTEE_RPMI_YIELDING_CALL_RETURN_DONE 0 +#define OPTEE_RPMI_YIELDING_CALL_RETURN_RPC_CMD 1 +#define OPTEE_RPMI_YIELDING_CALL_RETURN_INTERRUPT 2 + +/** + * struct optee_rpmi_call_req - start a yielding command + * @op: OPTEE_RPMI_YIELDING_CALL_WITH_ARG + * @flags: zero in version 1 + * @global_id: argument parcel identity; nonce must be nonzero + * @arg_offset: command argument byte offset from the parcel's first byte + * @rpc_offset: RPC argument byte offset from the parcel's first byte + * @arg_size: command argument extent in bytes + * @rpc_size: RPC argument capacity in bytes + * + * Firmware validates ownership, RW access, alignment and disjoint ranges. + * TEE_ERROR_BUSY rejects an initial request without acquiring call ownership. + */ +struct optee_rpmi_call_req { + __le32 op; + __le32 flags; + __le64 global_id; + __le64 arg_offset; + __le64 rpc_offset; + __le32 arg_size; + __le32 rpc_size; +}; + +/** + * struct optee_rpmi_call_resp - yielding command response + * @status: TEE result code, distinct from the command's GP result + * @result: OPTEE_RPMI_YIELDING_CALL_RETURN_* value when status is success + * @resume_token: opaque token for a suspended command; ignored for DONE + * + * DONE releases all access to the call's argument and RPC ranges. RPC_CMD + * requests RPC command handling; INTERRUPT requests resumption without an + * RPC command. Tokens belong to one accepted call, service and caller. + */ +struct optee_rpmi_call_resp { + __le32 status; + __le32 result; + __le32 resume_token; +}; + +/* + * Resume a suspended yielding command. + * + * Request: struct optee_rpmi_resume_req + * Response: struct optee_rpmi_call_resp + */ +#define OPTEE_RPMI_YIELDING_CALL_RESUME 6 + +/** + * struct optee_rpmi_resume_req - resume a suspended command + * @op: OPTEE_RPMI_YIELDING_CALL_RESUME + * @reserved: must be zero + * @resume_token: opaque token copied unchanged from the preceding response + * + * Resume must not return TEE_ERROR_BUSY. + */ +struct optee_rpmi_resume_req { + __le32 op; + __le32 reserved; + __le32 resume_token; +}; + +#endif /* OPTEE_RPMI_H */

Add a page-based dynamic shared-memory pool for the RPMI backend using the common TEE allocation and free helpers.

Register allocated pages as RPMI parcels so OP-TEE can access them. Unregister the parcels before freeing their backing pages.

Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com --- drivers/tee/optee/rpmi_abi.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+)

diff --git a/drivers/tee/optee/rpmi_abi.c b/drivers/tee/optee/rpmi_abi.c index 940676794280..bbb219ddab38 100644 --- a/drivers/tee/optee/rpmi_abi.c +++ b/drivers/tee/optee/rpmi_abi.c @@ -183,6 +183,42 @@ static int optee_rpmi_shm_unregister_supp(struct tee_context *ctx, return rc; }

+static int optee_rpmi_pool_alloc(struct tee_shm_pool *pool, struct tee_shm *shm, + size_t size, size_t align) +{ + return tee_dyn_shm_alloc_helper(shm, size, align, + optee_rpmi_shm_register); +} + +static void optee_rpmi_pool_free(struct tee_shm_pool *pool, struct tee_shm *shm) +{ + tee_dyn_shm_free_helper(shm, optee_rpmi_shm_unregister); +} + +static void optee_rpmi_pool_destroy(struct tee_shm_pool *pool) +{ + kfree(pool); +} + +static const struct tee_shm_pool_ops optee_rpmi_pool_ops = { + .alloc = optee_rpmi_pool_alloc, + .free = optee_rpmi_pool_free, + .destroy_pool = optee_rpmi_pool_destroy, +}; + +static struct tee_shm_pool *optee_rpmi_shm_pool_alloc(void) +{ + struct tee_shm_pool *pool; + + pool = kzalloc_obj(*pool); + if (!pool) + return ERR_PTR(-ENOMEM); + + pool->ops = &optee_rpmi_pool_ops; + + return pool; +} + /* Convert a memory reference to an OP-TEE RPMI parcel reference. */ static int to_msg_param_rpmi_mem(struct optee_msg_param *mp, const struct tee_param *p)

OP-TEE commands can span multiple exchanges with normal world. A call may yield to request an RPC service or allow interrupt processing before continuing execution in secure world.

Add the RPMI yielding-call path used by the common OP-TEE session operations. Submit the command and RPC argument buffers as ranges within a shared memory parcel.

Handle RPC requests while the call is suspended and resume execution using the token returned by OP-TEE until the command completes.

Use the common OP-TEE call queue to wait when an initial request is rejected with TEE_ERROR_BUSY, allowing another active call to complete before retrying.

Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com --- drivers/tee/optee/rpmi_abi.c | 122 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 122 insertions(+)

diff --git a/drivers/tee/optee/rpmi_abi.c b/drivers/tee/optee/rpmi_abi.c index 8b90c3653e80..9a6439e15a33 100644 --- a/drivers/tee/optee/rpmi_abi.c +++ b/drivers/tee/optee/rpmi_abi.c @@ -8,6 +8,7 @@ #include <linux/mailbox/riscv-rpmi-message.h> #include <linux/overflow.h> #include <linux/rpmi_tee.h> +#include <linux/sched.h> #include <linux/slab.h> #include <linux/unaligned.h> #include "optee_private.h" @@ -457,3 +458,124 @@ static void optee_rpmi_handle_rpc_cmd(struct tee_context *ctx, optee_rpc_cmd(ctx, optee, arg); } } + +/* Handle RPC command or interrupt returns from a yielding call. */ +static void optee_rpmi_handle_rpc(struct tee_context *ctx, struct optee *optee, + u32 result, struct optee_msg_arg *arg) +{ + switch (result) { + case OPTEE_RPMI_YIELDING_CALL_RETURN_RPC_CMD: + optee_rpmi_handle_rpc_cmd(ctx, optee, arg); + break; + case OPTEE_RPMI_YIELDING_CALL_RETURN_INTERRUPT: + break; + default: + pr_warn("Unknown RPC func 0x%x\n", result); + break; + } +} + +/** + * optee_rpmi_yielding_call() - submit and resume a yielding RPMI command + * @ctx: calling context + * @req: initial command request + * @rpc_arg: shared RPC argument buffer + * @system_thread: caller requests TEE system thread support + * + * Only TEE_ERROR_BUSY rejection of the initial command permits retry. + * + * Return: zero on completion, or a negative error. + */ +static int optee_rpmi_yielding_call(struct tee_context *ctx, + const struct optee_rpmi_call_req *req, + struct optee_msg_arg *rpc_arg, + bool system_thread) +{ + struct optee *optee = tee_get_drvdata(ctx->teedev); + struct optee_rpmi_resume_req resume = { + .op = cpu_to_le32(OPTEE_RPMI_YIELDING_CALL_RESUME), + }; + struct optee_rpmi_call_resp resp; + struct optee_call_waiter waiter; + bool resuming = false; + u32 result, status; + int rc; + + optee_cq_wait_init(&optee->call_queue, &waiter, system_thread); + while (true) { + if (resuming) + rc = optee_rpmi_call_with_status(optee, &resume, + sizeof(resume), + &resp, sizeof(resp), + &status); + else + rc = optee_rpmi_call_with_status(optee, req, + sizeof(*req), + &resp, sizeof(resp), + &status); + if (rc) + goto done; + + switch (status) { + case TEEC_SUCCESS: + break; + case TEEC_ERROR_BUSY: + if (!resuming) { + optee_cq_wait_for_completion(&optee->call_queue, + &waiter); + continue; + } + + fallthrough; + default: + rc = -EIO; + goto done; + } + + result = le32_to_cpu(resp.result); + if (result == OPTEE_RPMI_YIELDING_CALL_RETURN_DONE) + goto done; + + cond_resched(); + optee_rpmi_handle_rpc(ctx, optee, result, rpc_arg); + + resume.resume_token = resp.resume_token; + resuming = true; + } +done: + optee_cq_wait_final(&optee->call_queue, &waiter); + + return rc; +} + +/* The caller supplies SHM with room for command and RPC args. */ +static int optee_rpmi_do_call_with_arg(struct tee_context *ctx, + struct tee_shm *shm, u_int offs, + bool system_thread) +{ + struct optee *optee = tee_get_drvdata(ctx->teedev); + struct optee_msg_arg *arg, *rpc_arg; + struct optee_rpmi_call_req req = { + .op = cpu_to_le32(OPTEE_RPMI_YIELDING_CALL_WITH_ARG), + .global_id = cpu_to_le64(shm->sec_world_id), + }; + size_t arg_size, rpc_size, rpc_offset; + + arg = tee_shm_get_va(shm, offs); + if (IS_ERR(arg)) + return PTR_ERR(arg); + + arg_size = OPTEE_MSG_GET_ARG_SIZE(arg->num_params); + rpc_size = OPTEE_MSG_GET_ARG_SIZE(optee->rpc_param_count); + rpc_offset = offs + arg_size; + rpc_arg = tee_shm_get_va(shm, rpc_offset); + if (IS_ERR(rpc_arg)) + return PTR_ERR(rpc_arg); + + req.arg_offset = cpu_to_le64((u64)shm->offset + offs); + req.rpc_offset = cpu_to_le64((u64)shm->offset + rpc_offset); + req.arg_size = cpu_to_le32(arg_size); + req.rpc_size = cpu_to_le32(rpc_size); + + return optee_rpmi_yielding_call(ctx, &req, rpc_arg, system_thread); +}

OP-TEE uses asynchronous notifications to request bottom-half processing in normal world without waiting for a client call.

Allocate a TEE-to-REE RPMI signal and pass its ID to OP-TEE when enabling asynchronous notifications. Queue bottom-half processing on a private workqueue.

Initialize notification delivery before publishing the TEE devices. Allow probe to continue if setup fails, keeping synchronous RPC notifications available.

On cleanup, request that OP-TEE stop asynchronous notifications, relinquish the signal and drain the bottom-half workqueue. Transport relinquishment does not synchronize an already-selected callback.

Signed-off-by: Amirreza Zarrabi amirreza.zarrabi@oss.qualcomm.com --- drivers/tee/optee/optee_private.h | 6 +++ drivers/tee/optee/rpmi_abi.c | 92 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 98 insertions(+)

diff --git a/drivers/tee/optee/optee_private.h b/drivers/tee/optee/optee_private.h index fcb291a43b7b..3bc65ffb6f99 100644 --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -207,11 +207,17 @@ struct optee_ffa { * @rdev: owning RPMI service device * @shm_map: lookup by the host-endian parcel ID and nonce pair * @nonce_ida: nonzero SHM nonces, reusable after successful parcel reclamation + * @signal: allocated TEE-to-REE doorbell, independent of logical keys + * @notif_wq: private bottom-half workqueue, NULL when inactive + * @notif_work: processes bottom halves requested by the RPMI signal */ struct optee_rpmi { struct rpmi_tee_device *rdev; struct optee_shm_handle_map shm_map; struct ida nonce_ida; + u32 signal; + struct workqueue_struct *notif_wq; + struct work_struct notif_work; }; #endif

diff --git a/drivers/tee/optee/rpmi_abi.c b/drivers/tee/optee/rpmi_abi.c index 0ed2de96758e..6434767a2249 100644 --- a/drivers/tee/optee/rpmi_abi.c +++ b/drivers/tee/optee/rpmi_abi.c @@ -580,6 +580,92 @@ static int optee_rpmi_do_call_with_arg(struct tee_context *ctx, return optee_rpmi_yielding_call(ctx, &req, rpc_arg, system_thread); }

+/* Yielding bottom halves run here, not in the transport retrieval worker. */ +static void optee_rpmi_notif_work(struct work_struct *work) +{ + struct optee_rpmi *rpmi = container_of(work, struct optee_rpmi, + notif_work); + struct optee *optee = container_of(rpmi, struct optee, rpmi); + + optee_do_bottom_half(optee->ctx); +} + +static void optee_rpmi_notif_callback(struct rpmi_tee_device *rdev, u32 signal, + void *cb_data) +{ + struct optee *optee = cb_data; + + queue_work(optee->rpmi.notif_wq, &optee->rpmi.notif_work); +} + +/* Relinquish is not a barrier for an already-selected transport callback. */ +static void optee_rpmi_async_notif_uninit(struct optee *optee) +{ + struct optee_rpmi *rpmi = &optee->rpmi; + struct rpmi_tee_device *rdev = rpmi->rdev; + int rc; + + if (!rpmi->notif_wq) + return; + + rc = optee_stop_async_notif(optee->ctx); + if (rc) + dev_warn(&rdev->dev, "stop notifications failed: %d\n", rc); + + rc = rdev->ops->notifier_ops->notify_relinquish(rdev, rpmi->signal); + if (rc && rc != -EOPNOTSUPP) + dev_warn(&rdev->dev, + "relinquish notification failed: %d\n", rc); + + destroy_workqueue(rpmi->notif_wq); + + rpmi->notif_wq = NULL; +} + +/* Enable OP-TEE's bottom-half doorbell using the reserved RPMI signal. */ +static int optee_rpmi_enable_async_notif(struct optee *optee) +{ + struct optee_rpmi_enable_notif_req req = { + .op = cpu_to_le32(OPTEE_RPMI_ENABLE_ASYNC_NOTIF), + .signal_id = cpu_to_le32(optee->rpmi.signal), + }; + struct optee_rpmi_status_resp resp; + + return optee_rpmi_call(optee, &req, sizeof(req), &resp, sizeof(resp)); +} + +static int optee_rpmi_async_notif_init(struct optee *optee) +{ + struct optee_rpmi *rpmi = &optee->rpmi; + struct rpmi_tee_device *rdev = rpmi->rdev; + struct workqueue_struct *wq; + int rc; + + INIT_WORK(&rpmi->notif_work, optee_rpmi_notif_work); + wq = alloc_workqueue("optee_rpmi_notif", WQ_UNBOUND, 1); + if (!wq) + return -ENOMEM; + + rpmi->notif_wq = wq; + + rc = rdev->ops->notifier_ops->notify_request(rdev, + optee_rpmi_notif_callback, + optee, &rpmi->signal); + if (rc) { + destroy_workqueue(rpmi->notif_wq); + /* Checked in optee_rpmi_async_notif_uninit(). */ + rpmi->notif_wq = NULL; + + return rc; + } + + rc = optee_rpmi_enable_async_notif(optee); + if (rc) + optee_rpmi_async_notif_uninit(optee); + + return rc; +} + /* Query and store the trusted OS revision. */ static int optee_rpmi_get_os_version(struct optee *optee) { @@ -720,6 +806,7 @@ static void optee_rpmi_remove(struct rpmi_tee_device *rdev) { struct optee *optee = rpmi_tee_dev_get_drvdata(rdev);

+ optee_rpmi_async_notif_uninit(optee); optee_remove_common(optee); optee_shm_handle_map_uninit(&optee->rpmi.shm_map); ida_destroy(&optee->rpmi.nonce_ida); @@ -807,6 +894,11 @@ static int optee_rpmi_probe(struct rpmi_tee_device *rdev)

rpmi_tee_dev_set_drvdata(rdev, optee);

+ rc = optee_rpmi_async_notif_init(optee); + if (rc) + dev_warn(&rdev->dev, "async notifications unavailable: %d\n", + rc); + if (optee->in_kernel_rpmb_routing) blocking_notifier_chain_register(&optee_rpmb_intf_added, &optee->rpmb_intf);