projects/linux·blob master · refs

399 lines · 8.6 KiB

1// SPDX-License-Identifier: MIT
2/*
3 * AMD Trusted Execution Environment (TEE) interface
4 *
5 * Author: Rijo Thomas <[email protected]>
6 * Author: Devaraj Rangasamy <[email protected]>
7 *
8 * Copyright (C) 2019,2021 Advanced Micro Devices, Inc.
9 */
10
11#include <linux/bitfield.h>
12#include <linux/types.h>
13#include <linux/mutex.h>
14#include <linux/delay.h>
15#include <linux/slab.h>
16#include <linux/gfp.h>
17#include <linux/psp.h>
18#include <linux/psp-tee.h>
19
20#include "psp-dev.h"
21#include "tee-dev.h"
22
23static bool psp_dead;
24
25static int tee_alloc_ring(struct psp_tee_device *tee, int ring_size)
26{
27 struct ring_buf_manager *rb_mgr = &tee->rb_mgr;
28 void *start_addr;
29
30 if (!ring_size)
31 return -EINVAL;
32
33 /* We need actual physical address instead of DMA address, since
34 * Trusted OS running on AMD Secure Processor will map this region
35 */
36 start_addr = (void *)__get_free_pages(GFP_KERNEL, get_order(ring_size));
37 if (!start_addr)
38 return -ENOMEM;
39
40 memset(start_addr, 0x0, ring_size);
41 rb_mgr->ring_start = start_addr;
42 rb_mgr->ring_size = ring_size;
43 rb_mgr->ring_pa = __psp_pa(start_addr);
44 mutex_init(&rb_mgr->mutex);
45
46 return 0;
47}
48
49static void tee_free_ring(struct psp_tee_device *tee)
50{
51 struct ring_buf_manager *rb_mgr = &tee->rb_mgr;
52
53 if (!rb_mgr->ring_start)
54 return;
55
56 free_pages((unsigned long)rb_mgr->ring_start,
57 get_order(rb_mgr->ring_size));
58
59 rb_mgr->ring_start = NULL;
60 rb_mgr->ring_size = 0;
61 rb_mgr->ring_pa = 0;
62 mutex_destroy(&rb_mgr->mutex);
63}
64
65static
66struct tee_init_ring_cmd *tee_alloc_cmd_buffer(struct psp_tee_device *tee)
67{
68 struct tee_init_ring_cmd *cmd;
69
70 cmd = kzalloc_obj(*cmd);
71 if (!cmd)
72 return NULL;
73
74 cmd->hi_addr = upper_32_bits(tee->rb_mgr.ring_pa);
75 cmd->low_addr = lower_32_bits(tee->rb_mgr.ring_pa);
76 cmd->size = tee->rb_mgr.ring_size;
77
78 dev_dbg(tee->dev, "tee: ring address: high = 0x%x low = 0x%x size = %u\n",
79 cmd->hi_addr, cmd->low_addr, cmd->size);
80
81 return cmd;
82}
83
84static inline void tee_free_cmd_buffer(struct tee_init_ring_cmd *cmd)
85{
86 kfree(cmd);
87}
88
89static bool tee_send_destroy_cmd(struct psp_tee_device *tee)
90{
91 unsigned int reg;
92 int ret;
93
94 ret = psp_mailbox_command(tee->psp, PSP_CMD_TEE_RING_DESTROY, NULL,
95 TEE_DEFAULT_CMD_TIMEOUT, &reg);
96 if (ret) {
97 dev_err(tee->dev, "tee: ring destroy command timed out, disabling TEE support\n");
98 psp_dead = true;
99 return false;
100 }
101
102 if (FIELD_GET(PSP_CMDRESP_STS, reg)) {
103 dev_err(tee->dev, "tee: ring destroy command failed (%#010lx)\n",
104 FIELD_GET(PSP_CMDRESP_STS, reg));
105 psp_dead = true;
106 return false;
107 }
108
109 return true;
110}
111
112static int tee_init_ring(struct psp_tee_device *tee)
113{
114 int ring_size = MAX_RING_BUFFER_ENTRIES * sizeof(struct tee_ring_cmd);
115 struct tee_init_ring_cmd *cmd;
116 bool retry = false;
117 unsigned int reg;
118 int ret;
119
120 BUILD_BUG_ON(sizeof(struct tee_ring_cmd) != 1024);
121
122 ret = tee_alloc_ring(tee, ring_size);
123 if (ret) {
124 dev_err(tee->dev, "tee: ring allocation failed %d\n", ret);
125 return ret;
126 }
127
128 tee->rb_mgr.wptr = 0;
129
130 cmd = tee_alloc_cmd_buffer(tee);
131 if (!cmd) {
132 tee_free_ring(tee);
133 return -ENOMEM;
134 }
135
136 /* Send command buffer details to Trusted OS by writing to
137 * CPU-PSP message registers
138 */
139retry_init:
140 ret = psp_mailbox_command(tee->psp, PSP_CMD_TEE_RING_INIT, cmd,
141 TEE_DEFAULT_CMD_TIMEOUT, &reg);
142 if (ret) {
143 dev_err(tee->dev, "tee: ring init command timed out, disabling TEE support\n");
144 tee_free_ring(tee);
145 psp_dead = true;
146 goto free_buf;
147 }
148
149 if (FIELD_GET(PSP_CMDRESP_STS, reg)) {
150 /*
151 * During the hibernate resume sequence driver may have gotten loaded
152 * but the ring not properly destroyed. If the ring doesn't work, try
153 * to destroy and re-init once.
154 */
155 if (!retry && FIELD_GET(PSP_CMDRESP_STS, reg) == PSP_TEE_STS_RING_BUSY) {
156 dev_info(tee->dev, "tee: ring init command failed with busy status, retrying\n");
157 if (tee_send_destroy_cmd(tee)) {
158 retry = true;
159 goto retry_init;
160 }
161 }
162 dev_err(tee->dev, "tee: ring init command failed (%#010lx)\n",
163 FIELD_GET(PSP_CMDRESP_STS, reg));
164 tee_free_ring(tee);
165 psp_dead = true;
166 ret = -EIO;
167 }
168
169free_buf:
170 tee_free_cmd_buffer(cmd);
171
172 return ret;
173}
174
175static void tee_destroy_ring(struct psp_tee_device *tee)
176{
177 if (!tee->rb_mgr.ring_start)
178 return;
179
180 if (psp_dead)
181 goto free_ring;
182
183 tee_send_destroy_cmd(tee);
184
185free_ring:
186 tee_free_ring(tee);
187}
188
189int tee_dev_init(struct psp_device *psp)
190{
191 struct device *dev = psp->dev;
192 struct psp_tee_device *tee;
193 int ret;
194
195 ret = -ENOMEM;
196 tee = devm_kzalloc(dev, sizeof(*tee), GFP_KERNEL);
197 if (!tee)
198 goto e_err;
199
200 psp->tee_data = tee;
201
202 tee->dev = dev;
203 tee->psp = psp;
204
205 tee->io_regs = psp->io_regs;
206
207 tee->vdata = (struct tee_vdata *)psp->vdata->tee;
208 if (!tee->vdata) {
209 ret = -ENODEV;
210 dev_err(dev, "tee: missing driver data\n");
211 goto e_err;
212 }
213
214 ret = tee_init_ring(tee);
215 if (ret) {
216 dev_err(dev, "tee: failed to init ring buffer\n");
217 goto e_err;
218 }
219
220 dev_notice(dev, "tee enabled\n");
221
222 return 0;
223
224e_err:
225 psp->tee_data = NULL;
226
227 dev_notice(dev, "tee initialization failed\n");
228
229 return ret;
230}
231
232void tee_dev_destroy(struct psp_device *psp)
233{
234 struct psp_tee_device *tee = psp->tee_data;
235
236 if (!tee)
237 return;
238
239 tee_destroy_ring(tee);
240}
241
242static int tee_submit_cmd(struct psp_tee_device *tee, enum tee_cmd_id cmd_id,
243 void *buf, size_t len, struct tee_ring_cmd **resp)
244{
245 struct tee_ring_cmd *cmd;
246 int nloop = 1000, ret = 0;
247 u32 rptr;
248
249 *resp = NULL;
250
251 mutex_lock(&tee->rb_mgr.mutex);
252
253 /* Loop until empty entry found in ring buffer */
254 do {
255 /* Get pointer to ring buffer command entry */
256 cmd = (struct tee_ring_cmd *)
257 (tee->rb_mgr.ring_start + tee->rb_mgr.wptr);
258
259 rptr = ioread32(tee->io_regs + tee->vdata->ring_rptr_reg);
260
261 /* Check if ring buffer is full or command entry is waiting
262 * for response from TEE
263 */
264 if (!(tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr ||
265 cmd->flag == CMD_WAITING_FOR_RESPONSE))
266 break;
267
268 dev_dbg(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n",
269 rptr, tee->rb_mgr.wptr);
270
271 /* Wait if ring buffer is full or TEE is processing data */
272 mutex_unlock(&tee->rb_mgr.mutex);
273 schedule_timeout_interruptible(msecs_to_jiffies(10));
274 mutex_lock(&tee->rb_mgr.mutex);
275
276 } while (--nloop);
277
278 if (!nloop &&
279 (tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr ||
280 cmd->flag == CMD_WAITING_FOR_RESPONSE)) {
281 dev_err(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u response flag %u\n",
282 rptr, tee->rb_mgr.wptr, cmd->flag);
283 ret = -EBUSY;
284 goto unlock;
285 }
286
287 /* Do not submit command if PSP got disabled while processing any
288 * command in another thread
289 */
290 if (psp_dead) {
291 ret = -EBUSY;
292 goto unlock;
293 }
294
295 /* Write command data into ring buffer */
296 cmd->cmd_id = cmd_id;
297 cmd->cmd_state = TEE_CMD_STATE_INIT;
298 memset(&cmd->buf[0], 0, sizeof(cmd->buf));
299 memcpy(&cmd->buf[0], buf, len);
300
301 /* Indicate driver is waiting for response */
302 cmd->flag = CMD_WAITING_FOR_RESPONSE;
303
304 /* Update local copy of write pointer */
305 tee->rb_mgr.wptr += sizeof(struct tee_ring_cmd);
306 if (tee->rb_mgr.wptr >= tee->rb_mgr.ring_size)
307 tee->rb_mgr.wptr = 0;
308
309 /* Trigger interrupt to Trusted OS */
310 iowrite32(tee->rb_mgr.wptr, tee->io_regs + tee->vdata->ring_wptr_reg);
311
312 /* The response is provided by Trusted OS in same
313 * location as submitted data entry within ring buffer.
314 */
315 *resp = cmd;
316
317unlock:
318 mutex_unlock(&tee->rb_mgr.mutex);
319
320 return ret;
321}
322
323static int tee_wait_cmd_completion(struct psp_tee_device *tee,
324 struct tee_ring_cmd *resp,
325 unsigned int timeout)
326{
327 /* ~1ms sleep per loop => nloop = timeout * 1000 */
328 int nloop = timeout * 1000;
329
330 while (--nloop) {
331 if (resp->cmd_state == TEE_CMD_STATE_COMPLETED)
332 return 0;
333
334 usleep_range(1000, 1100);
335 }
336
337 dev_err(tee->dev, "tee: command 0x%x timed out, disabling PSP\n",
338 resp->cmd_id);
339
340 psp_dead = true;
341
342 return -ETIMEDOUT;
343}
344
345int psp_tee_process_cmd(enum tee_cmd_id cmd_id, void *buf, size_t len,
346 u32 *status)
347{
348 struct psp_device *psp = psp_get_master_device();
349 struct psp_tee_device *tee;
350 struct tee_ring_cmd *resp;
351 int ret;
352
353 if (!buf || !status || !len || len > sizeof(resp->buf))
354 return -EINVAL;
355
356 *status = 0;
357
358 if (!psp || !psp->tee_data)
359 return -ENODEV;
360
361 if (psp_dead)
362 return -EBUSY;
363
364 tee = psp->tee_data;
365
366 ret = tee_submit_cmd(tee, cmd_id, buf, len, &resp);
367 if (ret)
368 return ret;
369
370 ret = tee_wait_cmd_completion(tee, resp, TEE_DEFAULT_RING_TIMEOUT);
371 if (ret) {
372 resp->flag = CMD_RESPONSE_TIMEDOUT;
373 return ret;
374 }
375
376 memcpy(buf, &resp->buf[0], len);
377 *status = resp->status;
378
379 resp->flag = CMD_RESPONSE_COPIED;
380
381 return 0;
382}
383EXPORT_SYMBOL(psp_tee_process_cmd);
384
385int psp_check_tee_status(void)
386{
387 struct psp_device *psp = psp_get_master_device();
388
389 if (!psp || !psp->tee_data)
390 return -ENODEV;
391
392 return 0;
393}
394EXPORT_SYMBOL(psp_check_tee_status);
395
396int tee_restore(struct psp_device *psp)
397{
398 return tee_init_ring(psp->tee_data);
399}