security/optee_linuxdriver/armtz/tee_tz_drv.c

   1 /*
   2  * Copyright (c) 2014, STMicroelectronics International N.V.
   3  *
   4  * This program is free software; you can redistribute it and/or modify
   5  * it under the terms of the GNU General Public License Version 2 as
   6  * published by the Free Software Foundation.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  */
  13 /* #define DEBUG */
  14
  15 #include <linux/module.h>
  16 #include <linux/kernel.h>
  17 #include <linux/init.h>
  18 #include <linux/platform_device.h>
  19 #include <linux/io.h>
  20 #include <linux/sched.h>
  21 #include <linux/jiffies.h>
  22
  23 #include <linux/tee_core.h>
  24 #include <linux/tee_ioc.h>
  25
  26 #include <asm/smp_plat.h>
  27 #include <tee_shm.h>
  28 #include <tee_supp_com.h>
  29 #include <tee_mutex_wait.h>
  30 #include <tee_wait_queue.h>
  31
  32 #include <arm_common/teesmc.h>
  33 #include <arm_common/teesmc_st.h>
  34
  35 #include <linux/cpumask.h>
  36
  37 #include "tee_mem.h"
  38 #include "tee_tz_op.h"
  39 #include "tee_tz_priv.h"
  40 #include "handle.h"
  41
  42 #ifdef CONFIG_OUTER_CACHE
  43 #undef CONFIG_OUTER_CACHE
  44 #endif
  45
  46 /* #define SWITCH_CPU0_DEBUG */
  47
  48 #define _TEE_TZ_NAME "armtz"
  49 #define DEV (ptee->tee->dev)
  50
  51 /* #define TEE_STRESS_OUTERCACHE_FLUSH */
  52
  53 /* magic config: bit 1 is set, Secure TEE shall handler NSec IRQs */
  54 #define SEC_ROM_NO_FLAG_MASK    0x0000
  55 #define SEC_ROM_IRQ_ENABLE_MASK 0x0001
  56 #define SEC_ROM_DEFAULT         SEC_ROM_IRQ_ENABLE_MASK
  57 #define TEE_RETURN_BUSY         0x3
  58 #define ALLOC_ALIGN             SZ_4K
  59
  60 #define CAPABLE(tee) !(tee->conf & TEE_CONF_FW_NOT_CAPABLE)
  61
  62 static struct tee_tz *tee_tz;
  63
  64 static struct handle_db shm_handle_db = HANDLE_DB_INITIALIZER;
  65
  66
  67 /* Temporary workaround until we're only using post 3.13 kernels */
  68 #ifdef ioremap_cached
  69 #define ioremap_cache   ioremap_cached
  70 #endif
  71
  72
  73 /*******************************************************************
  74  * Calling TEE
  75  *******************************************************************/
  76 #ifdef SWITCH_CPU0_DEBUG
  77 #ifdef CONFIG_SMP
  78 static long switch_cpumask_to_cpu0(cpumask_t *saved_cpu_mask)
  79 {
  80         long ret;
  81
  82         cpumask_t local_cpu_mask = CPU_MASK_NONE;
  83         cpumask_set_cpu(0, &local_cpu_mask);
  84         cpumask_copy(saved_cpu_mask, tsk_cpus_allowed(current));
  85         ret = sched_setaffinity(0, &local_cpu_mask);
  86         if (ret)
  87                 pr_err("%s:->%ld,cpu:%d\n", __func__, ret, smp_processor_id());
  88         return ret;
  89 }
  90
  91 static long restore_cpumask(cpumask_t *saved_cpu_mask)
  92 {
  93         long ret;
  94
  95         ret = sched_setaffinity(0, saved_cpu_mask);
  96         if (ret)
  97                 pr_err("%s:->%ld,cpu:%d\n", __func__, ret, smp_processor_id());
  98         return ret;
  99 }
 100 #else
 101 static inline long switch_cpumask_to_cpu0(cpumask_t *saved_cpu_mask)
 102 { return 0; }
 103 static inline long restore_cpumask(cpumask_t *saved_cpu_mask)
 104 { return 0; }
 105 #endif
 106 static long tee_smc_call_switchcpu0(struct smc_param *param)
 107 {
 108         long ret;
 109         cpumask_t saved_cpu_mask;
 110
 111         ret = switch_cpumask_to_cpu0(&saved_cpu_mask);
 112         if (ret)
 113                 return ret;
 114         tee_smc_call(param);
 115         ret = restore_cpumask(&saved_cpu_mask);
 116         if (ret)
 117                 return ret;
 118         return ret;
 119 }
 120 #endif /* SWITCH_CPU0_DEBUG */
 121
 122 static void e_lock_teez(struct tee_tz *ptee)
 123 {
 124         mutex_lock(&ptee->mutex);
 125 }
 126
 127 static void e_lock_wait_completion_teez(struct tee_tz *ptee)
 128 {
 129         /*
 130          * Release the lock until "something happens" and then reacquire it
 131          * again.
 132          *
 133          * This is needed when TEE returns "busy" and we need to try again
 134          * later.
 135          */
 136         ptee->c_waiters++;
 137         mutex_unlock(&ptee->mutex);
 138         /*
 139          * Wait at most one second. Secure world is normally never busy
 140          * more than that so we should normally never timeout.
 141          */
 142         wait_for_completion_timeout(&ptee->c, HZ);
 143         mutex_lock(&ptee->mutex);
 144         ptee->c_waiters--;
 145 }
 146
 147 static void e_unlock_teez(struct tee_tz *ptee)
 148 {
 149         /*
 150          * If at least one thread is waiting for "something to happen" let
 151          * one thread know that "something has happened".
 152          */
 153         if (ptee->c_waiters)
 154                 complete(&ptee->c);
 155         mutex_unlock(&ptee->mutex);
 156 }
 157
 158 static void handle_rpc_func_cmd_mutex_wait(struct tee_tz *ptee,
 159                                                 struct teesmc32_arg *arg32)
 160 {
 161         struct teesmc32_param *params;
 162
 163         if (arg32->num_params != 2)
 164                 goto bad;
 165
 166         params = TEESMC32_GET_PARAMS(arg32);
 167
 168         if ((params[0].attr & TEESMC_ATTR_TYPE_MASK) !=
 169                         TEESMC_ATTR_TYPE_VALUE_INPUT)
 170                 goto bad;
 171         if ((params[1].attr & TEESMC_ATTR_TYPE_MASK) !=
 172                         TEESMC_ATTR_TYPE_VALUE_INPUT)
 173                 goto bad;
 174
 175         switch (params[0].u.value.a) {
 176         case TEE_MUTEX_WAIT_SLEEP:
 177                 tee_mutex_wait_sleep(DEV, &ptee->mutex_wait,
 178                                      params[1].u.value.a,
 179                                      params[1].u.value.b);
 180                 break;
 181         case TEE_MUTEX_WAIT_WAKEUP:
 182                 tee_mutex_wait_wakeup(DEV, &ptee->mutex_wait,
 183                                       params[1].u.value.a,
 184                                       params[1].u.value.b);
 185                 break;
 186         case TEE_MUTEX_WAIT_DELETE:
 187                 tee_mutex_wait_delete(DEV, &ptee->mutex_wait,
 188                                       params[1].u.value.a);
 189                 break;
 190         default:
 191                 goto bad;
 192         }
 193
 194         arg32->ret = TEEC_SUCCESS;
 195         return;
 196 bad:
 197         arg32->ret = TEEC_ERROR_BAD_PARAMETERS;
 198 }
 199
 200 static void handle_rpc_func_cmd_wait_queue(struct tee_tz *ptee,
 201                                                 struct teesmc32_arg *arg32)
 202 {
 203         struct teesmc32_param *params;
 204
 205         if (arg32->num_params != 2)
 206                 goto bad;
 207
 208         params = TEESMC32_GET_PARAMS(arg32);
 209
 210         if ((params[0].attr & TEESMC_ATTR_TYPE_MASK) !=
 211                         TEESMC_ATTR_TYPE_VALUE_INPUT)
 212                 goto bad;
 213         if ((params[1].attr & TEESMC_ATTR_TYPE_MASK) !=
 214                         TEESMC_ATTR_TYPE_NONE)
 215                 goto bad;
 216
 217         switch (arg32->cmd) {
 218         case TEE_RPC_WAIT_QUEUE_SLEEP:
 219                 tee_wait_queue_sleep(DEV, &ptee->wait_queue,
 220                                      params[0].u.value.a);
 221                 break;
 222         case TEE_RPC_WAIT_QUEUE_WAKEUP:
 223                 tee_wait_queue_wakeup(DEV, &ptee->wait_queue,
 224                                       params[0].u.value.a);
 225                 break;
 226         default:
 227                 goto bad;
 228         }
 229
 230         arg32->ret = TEEC_SUCCESS;
 231         return;
 232 bad:
 233         arg32->ret = TEEC_ERROR_BAD_PARAMETERS;
 234 }
 235
 236
 237
 238 static void handle_rpc_func_cmd_wait(struct teesmc32_arg *arg32)
 239 {
 240         struct teesmc32_param *params;
 241         u32 msec_to_wait;
 242
 243         if (arg32->num_params != 1)
 244                 goto bad;
 245
 246         params = TEESMC32_GET_PARAMS(arg32);
 247         msec_to_wait = params[0].u.value.a;
 248
 249         /* set task's state to interruptible sleep */
 250         set_current_state(TASK_INTERRUPTIBLE);
 251
 252         /* take a nap */
 253         schedule_timeout(msecs_to_jiffies(msec_to_wait));
 254
 255         arg32->ret = TEEC_SUCCESS;
 256         return;
 257 bad:
 258         arg32->ret = TEEC_ERROR_BAD_PARAMETERS;
 259 }
 260
 261 static void handle_rpc_func_cmd_to_supplicant(struct tee_tz *ptee,
 262                                                 struct teesmc32_arg *arg32)
 263 {
 264         struct teesmc32_param *params;
 265         struct tee_rpc_invoke inv;
 266         size_t n;
 267         uint32_t ret;
 268
 269         if (arg32->num_params > TEE_RPC_BUFFER_NUMBER) {
 270                 arg32->ret = TEEC_ERROR_GENERIC;
 271                 return;
 272         }
 273
 274         params = TEESMC32_GET_PARAMS(arg32);
 275
 276         memset(&inv, 0, sizeof(inv));
 277         inv.cmd = arg32->cmd;
 278         /*
 279          * Set a suitable error code in case tee-supplicant
 280          * ignores the request.
 281          */
 282         inv.res = TEEC_ERROR_NOT_IMPLEMENTED;
 283         inv.nbr_bf = arg32->num_params;
 284         for (n = 0; n < arg32->num_params; n++) {
 285                 switch (params[n].attr & TEESMC_ATTR_TYPE_MASK) {
 286                 case TEESMC_ATTR_TYPE_VALUE_INPUT:
 287                 case TEESMC_ATTR_TYPE_VALUE_INOUT:
 288                         inv.cmds[n].fd = (int)params[n].u.value.a;
 289                         /* Fall through */
 290                 case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
 291                         inv.cmds[n].type = TEE_RPC_VALUE;
 292                         break;
 293                 case TEESMC_ATTR_TYPE_MEMREF_INPUT:
 294                 case TEESMC_ATTR_TYPE_MEMREF_OUTPUT:
 295                 case TEESMC_ATTR_TYPE_MEMREF_INOUT:
 296                         inv.cmds[n].buffer =
 297                                 (void *)(uintptr_t)params[n].u.memref.buf_ptr;
 298                         inv.cmds[n].size = params[n].u.memref.size;
 299                         inv.cmds[n].type = TEE_RPC_BUFFER;
 300                         break;
 301                 default:
 302                         arg32->ret = TEEC_ERROR_GENERIC;
 303                         return;
 304                 }
 305         }
 306
 307         ret = tee_supp_cmd(ptee->tee, TEE_RPC_ICMD_INVOKE,
 308                                   &inv, sizeof(inv));
 309         if (ret == TEEC_RPC_OK)
 310                 arg32->ret = inv.res;
 311
 312         for (n = 0; n < arg32->num_params; n++) {
 313                 switch (params[n].attr & TEESMC_ATTR_TYPE_MASK) {
 314                 case TEESMC_ATTR_TYPE_MEMREF_OUTPUT:
 315                 case TEESMC_ATTR_TYPE_MEMREF_INOUT:
 316                         /*
 317                          * Allow supplicant to assign a new pointer
 318                          * to an out-buffer. Needed when the
 319                          * supplicant allocates a new buffer, for
 320                          * instance when loading a TA.
 321                          */
 322                         params[n].u.memref.buf_ptr =
 323                                         (uint32_t)(uintptr_t)inv.cmds[n].buffer;
 324                         params[n].u.memref.size = inv.cmds[n].size;
 325                         break;
 326                 case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
 327                 case TEESMC_ATTR_TYPE_VALUE_INOUT:
 328                         params[n].u.value.a = inv.cmds[n].fd;
 329                         break;
 330                 default:
 331                         break;
 332                 }
 333         }
 334 }
 335
 336 static void handle_rpc_func_cmd(struct tee_tz *ptee, u32 parg32)
 337 {
 338         struct teesmc32_arg *arg32;
 339
 340         arg32 = tee_shm_pool_p2v(DEV, ptee->shm_pool, parg32);
 341         if (!arg32)
 342                 return;
 343
 344         switch (arg32->cmd) {
 345         case TEE_RPC_MUTEX_WAIT:
 346                 handle_rpc_func_cmd_mutex_wait(ptee, arg32);
 347                 break;
 348         case TEE_RPC_WAIT_QUEUE_SLEEP:
 349         case TEE_RPC_WAIT_QUEUE_WAKEUP:
 350                 handle_rpc_func_cmd_wait_queue(ptee, arg32);
 351                 break;
 352         case TEE_RPC_WAIT:
 353                 handle_rpc_func_cmd_wait(arg32);
 354                 break;
 355         default:
 356                 handle_rpc_func_cmd_to_supplicant(ptee, arg32);
 357         }
 358 }
 359
 360 static struct tee_shm *handle_rpc_alloc(struct tee_tz *ptee, size_t size)
 361 {
 362         struct tee_rpc_alloc rpc_alloc;
 363
 364         rpc_alloc.size = size;
 365         tee_supp_cmd(ptee->tee, TEE_RPC_ICMD_ALLOCATE,
 366                      &rpc_alloc, sizeof(rpc_alloc));
 367         return rpc_alloc.shm;
 368 }
 369
 370 static void handle_rpc_free(struct tee_tz *ptee, struct tee_shm *shm)
 371 {
 372         struct tee_rpc_free rpc_free;
 373
 374         if (!shm)
 375                 return;
 376         rpc_free.shm = shm;
 377         tee_supp_cmd(ptee->tee, TEE_RPC_ICMD_FREE, &rpc_free, sizeof(rpc_free));
 378 }
 379
 380 static u32 handle_rpc(struct tee_tz *ptee, struct smc_param *param)
 381 {
 382         struct tee_shm *shm;
 383         int cookie;
 384
 385         switch (TEESMC_RETURN_GET_RPC_FUNC(param->a0)) {
 386         case TEESMC_RPC_FUNC_ALLOC_ARG:
 387                 param->a1 = tee_shm_pool_alloc(DEV, ptee->shm_pool,
 388                                         param->a1, 4);
 389                 break;
 390         case TEESMC_RPC_FUNC_ALLOC_PAYLOAD:
 391                 /* Can't support payload shared memory with this interface */
 392                 param->a2 = 0;
 393                 break;
 394         case TEESMC_RPC_FUNC_FREE_ARG:
 395                 tee_shm_pool_free(DEV, ptee->shm_pool, param->a1, 0);
 396                 break;
 397         case TEESMC_RPC_FUNC_FREE_PAYLOAD:
 398                 /* Can't support payload shared memory with this interface */
 399                 break;
 400         case TEESMC_ST_RPC_FUNC_ALLOC_PAYLOAD:
 401                 shm = handle_rpc_alloc(ptee, param->a1);
 402                 if (IS_ERR_OR_NULL(shm)) {
 403                         param->a1 = 0;
 404                         break;
 405                 }
 406                 cookie = handle_get(&shm_handle_db, shm);
 407                 if (cookie < 0) {
 408                         handle_rpc_free(ptee, shm);
 409                         param->a1 = 0;
 410                         break;
 411                 }
 412                 param->a1 = shm->paddr;
 413                 param->a2 = cookie;
 414                 break;
 415         case TEESMC_ST_RPC_FUNC_FREE_PAYLOAD:
 416                 shm = handle_put(&shm_handle_db, param->a1);
 417                 handle_rpc_free(ptee, shm);
 418                 break;
 419         case TEESMC_RPC_FUNC_IRQ:
 420                 break;
 421         case TEESMC_RPC_FUNC_CMD:
 422                 handle_rpc_func_cmd(ptee, param->a1);
 423                 break;
 424         default:
 425                 dev_warn(DEV, "Unknown RPC func 0x%x\n",
 426                          (u32)TEESMC_RETURN_GET_RPC_FUNC(param->a0));
 427                 break;
 428         }
 429
 430         if (irqs_disabled())
 431                 return TEESMC32_FASTCALL_RETURN_FROM_RPC;
 432         else
 433                 return TEESMC32_CALL_RETURN_FROM_RPC;
 434 }
 435
 436 static void call_tee(struct tee_tz *ptee,
 437                         uintptr_t parg32, struct teesmc32_arg *arg32)
 438 {
 439         u32 ret;
 440         u32 funcid;
 441         struct smc_param param = { 0 };
 442
 443         if (irqs_disabled())
 444                 funcid = TEESMC32_FASTCALL_WITH_ARG;
 445         else
 446                 funcid = TEESMC32_CALL_WITH_ARG;
 447
 448         /*
 449          * Commented out elements used to visualize the layout dynamic part
 450          * of the struct. Note that these fields are not available at all
 451          * if num_params == 0.
 452          *
 453          * params is accessed through the macro TEESMC32_GET_PARAMS
 454          */
 455
 456         /* struct teesmc32_param params[num_params]; */
 457
 458
 459         param.a1 = parg32;
 460         e_lock_teez(ptee);
 461         while (true) {
 462                 param.a0 = funcid;
 463
 464 #ifdef SWITCH_CPU0_DEBUG
 465                 if (tee_smc_call_switchcpu0(&param))
 466                         break;
 467 #else
 468                 tee_smc_call(&param);
 469 #endif
 470                 ret = param.a0;
 471
 472                 if (ret == TEESMC_RETURN_ETHREAD_LIMIT) {
 473                         /*
 474                          * Since secure world is out of threads, release the
 475                          * lock we had when entering this function and wait
 476                          * for "something to happen" (something else to
 477                          * exit from secure world and needed resources may
 478                          * have become available).
 479                          */
 480                         e_lock_wait_completion_teez(ptee);
 481                 } else if (TEESMC_RETURN_IS_RPC(ret)) {
 482                         /* Process the RPC. */
 483                         e_unlock_teez(ptee);
 484                         funcid = handle_rpc(ptee, &param);
 485                         e_lock_teez(ptee);
 486                 } else {
 487                         break;
 488                 }
 489         }
 490         e_unlock_teez(ptee);
 491
 492         switch (ret) {
 493         case TEESMC_RETURN_UNKNOWN_FUNCTION:
 494                 break;
 495         case TEESMC_RETURN_OK:
 496                 /* arg32->ret set by secure world */
 497                 break;
 498         default:
 499                 /* Should not happen */
 500                 arg32->ret = TEEC_ERROR_COMMUNICATION;
 501                 arg32->ret_origin = TEEC_ORIGIN_COMMS;
 502                 break;
 503         }
 504 }
 505
 506 /*******************************************************************
 507  * TEE service invoke formating
 508  *******************************************************************/
 509
 510 /* allocate tee service argument buffer and return virtual address */
 511 static void *alloc_tee_arg(struct tee_tz *ptee, unsigned long *p, size_t l)
 512 {
 513         void *vaddr;
 514         dev_dbg(DEV, ">\n");
 515         BUG_ON(!CAPABLE(ptee->tee));
 516
 517         if ((p == NULL) || (l == 0))
 518                 return NULL;
 519
 520         /* assume a 4 bytes aligned is sufficient */
 521         *p = tee_shm_pool_alloc(DEV, ptee->shm_pool, l, ALLOC_ALIGN);
 522         if (*p == 0)
 523                 return NULL;
 524
 525         vaddr = tee_shm_pool_p2v(DEV, ptee->shm_pool, *p);
 526
 527         dev_dbg(DEV, "< %p\n", vaddr);
 528
 529         return vaddr;
 530 }
 531
 532 /* free tee service argument buffer (from its physical address) */
 533 static void free_tee_arg(struct tee_tz *ptee, unsigned long p)
 534 {
 535         dev_dbg(DEV, ">\n");
 536         BUG_ON(!CAPABLE(ptee->tee));
 537
 538         if (p)
 539                 tee_shm_pool_free(DEV, ptee->shm_pool, p, 0);
 540
 541         dev_dbg(DEV, "<\n");
 542 }
 543
 544 static uint32_t get_cache_attrs(struct tee_tz *ptee)
 545 {
 546         if (tee_shm_pool_is_cached(ptee->shm_pool))
 547                 return TEESMC_ATTR_CACHE_DEFAULT << TEESMC_ATTR_CACHE_SHIFT;
 548         else
 549                 return TEESMC_ATTR_CACHE_NONCACHE << TEESMC_ATTR_CACHE_SHIFT;
 550 }
 551
 552 static uint32_t param_type_teec2teesmc(uint8_t type)
 553 {
 554         switch (type) {
 555         case TEEC_NONE:
 556                 return TEESMC_ATTR_TYPE_NONE;
 557         case TEEC_VALUE_INPUT:
 558                 return TEESMC_ATTR_TYPE_VALUE_INPUT;
 559         case TEEC_VALUE_OUTPUT:
 560                 return TEESMC_ATTR_TYPE_VALUE_OUTPUT;
 561         case TEEC_VALUE_INOUT:
 562                 return TEESMC_ATTR_TYPE_VALUE_INOUT;
 563         case TEEC_MEMREF_TEMP_INPUT:
 564         case TEEC_MEMREF_PARTIAL_INPUT:
 565                 return TEESMC_ATTR_TYPE_MEMREF_INPUT;
 566         case TEEC_MEMREF_TEMP_OUTPUT:
 567         case TEEC_MEMREF_PARTIAL_OUTPUT:
 568                 return TEESMC_ATTR_TYPE_MEMREF_OUTPUT;
 569         case TEEC_MEMREF_WHOLE:
 570         case TEEC_MEMREF_TEMP_INOUT:
 571         case TEEC_MEMREF_PARTIAL_INOUT:
 572                 return TEESMC_ATTR_TYPE_MEMREF_INOUT;
 573         default:
 574                 WARN_ON(true);
 575                 return 0;
 576         }
 577 }
 578
 579 static void set_params(struct tee_tz *ptee,
 580                 struct teesmc32_param params32[TEEC_CONFIG_PAYLOAD_REF_COUNT],
 581                 uint32_t param_types,
 582                 struct tee_data *data)
 583 {
 584         size_t n;
 585         struct tee_shm *shm;
 586         TEEC_Value *value;
 587
 588         for (n = 0; n < TEEC_CONFIG_PAYLOAD_REF_COUNT; n++) {
 589                 uint32_t type = TEEC_PARAM_TYPE_GET(param_types, n);
 590
 591                 params32[n].attr = param_type_teec2teesmc(type);
 592                 if (params32[n].attr == TEESMC_ATTR_TYPE_NONE)
 593                         continue;
 594                 if (params32[n].attr < TEESMC_ATTR_TYPE_MEMREF_INPUT) {
 595                         value = (TEEC_Value *)&data->params[n];
 596                         params32[n].u.value.a = value->a;
 597                         params32[n].u.value.b = value->b;
 598                         continue;
 599                 }
 600                 shm = data->params[n].shm;
 601                 params32[n].attr |= get_cache_attrs(ptee);
 602                 params32[n].u.memref.buf_ptr = shm->paddr;
 603                 params32[n].u.memref.size = shm->size_req;
 604         }
 605 }
 606
 607 static void get_params(struct tee_data *data,
 608                 struct teesmc32_param params32[TEEC_CONFIG_PAYLOAD_REF_COUNT])
 609 {
 610         size_t n;
 611         struct tee_shm *shm;
 612         TEEC_Value *value;
 613
 614         for (n = 0; n < TEEC_CONFIG_PAYLOAD_REF_COUNT; n++) {
 615                 if (params32[n].attr == TEESMC_ATTR_TYPE_NONE)
 616                         continue;
 617                 if (params32[n].attr < TEESMC_ATTR_TYPE_MEMREF_INPUT) {
 618                         value = &data->params[n].value;
 619                         value->a = params32[n].u.value.a;
 620                         value->b = params32[n].u.value.b;
 621                         continue;
 622                 }
 623                 shm = data->params[n].shm;
 624                 shm->size_req = params32[n].u.memref.size;
 625         }
 626 }
 627
 628
 629 /*
 630  * tee_open_session - invoke TEE to open a GP TEE session
 631  */
 632 static int tz_open(struct tee_session *sess, struct tee_cmd *cmd)
 633 {
 634         struct tee *tee;
 635         struct tee_tz *ptee;
 636         int ret = 0;
 637
 638         struct teesmc32_arg *arg32;
 639         struct teesmc32_param *params32;
 640         struct teesmc_meta_open_session *meta;
 641         uintptr_t parg32;
 642         uintptr_t pmeta;
 643         size_t num_meta = 1;
 644         uint8_t *ta;
 645         TEEC_UUID *uuid;
 646
 647         BUG_ON(!sess->ctx->tee);
 648         BUG_ON(!sess->ctx->tee->priv);
 649         tee = sess->ctx->tee;
 650         ptee = tee->priv;
 651
 652         if (cmd->uuid)
 653                 uuid = cmd->uuid->kaddr;
 654         else
 655                 uuid = NULL;
 656
 657         dev_dbg(tee->dev, "> ta kaddr %p, uuid=%08x-%04x-%04x\n",
 658                 (cmd->ta) ? cmd->ta->kaddr : NULL,
 659                 ((uuid) ? uuid->timeLow : 0xDEAD),
 660                 ((uuid) ? uuid->timeMid : 0xDEAD),
 661                 ((uuid) ? uuid->timeHiAndVersion : 0xDEAD));
 662
 663         if (!CAPABLE(ptee->tee)) {
 664                 dev_dbg(tee->dev, "< not capable\n");
 665                 return -EBUSY;
 666         }
 667
 668         /* case ta binary is inside the open request */
 669         ta = NULL;
 670         if (cmd->ta)
 671                 ta = cmd->ta->kaddr;
 672         if (ta)
 673                 num_meta++;
 674
 675         arg32 = alloc_tee_arg(ptee, &parg32, TEESMC32_GET_ARG_SIZE(
 676                                 TEEC_CONFIG_PAYLOAD_REF_COUNT + num_meta));
 677         meta = alloc_tee_arg(ptee, &pmeta, sizeof(*meta));
 678
 679         if ((arg32 == NULL) || (meta == NULL)) {
 680                 free_tee_arg(ptee, parg32);
 681                 free_tee_arg(ptee, pmeta);
 682                 return TEEC_ERROR_OUT_OF_MEMORY;
 683         }
 684
 685         memset(arg32, 0, sizeof(*arg32));
 686         memset(meta, 0, sizeof(*meta));
 687         arg32->num_params = TEEC_CONFIG_PAYLOAD_REF_COUNT + num_meta;
 688         params32 = TEESMC32_GET_PARAMS(arg32);
 689
 690         arg32->cmd = TEESMC_CMD_OPEN_SESSION;
 691
 692         params32[0].u.memref.buf_ptr = pmeta;
 693         params32[0].u.memref.size = sizeof(*meta);
 694         params32[0].attr = TEESMC_ATTR_TYPE_MEMREF_INPUT |
 695                          TEESMC_ATTR_META | get_cache_attrs(ptee);
 696
 697         if (ta) {
 698                 params32[1].u.memref.buf_ptr =
 699                         tee_shm_pool_v2p(DEV, ptee->shm_pool, cmd->ta->kaddr);
 700                 params32[1].u.memref.size = cmd->ta->size_req;
 701                 params32[1].attr = TEESMC_ATTR_TYPE_MEMREF_INPUT |
 702                                  TEESMC_ATTR_META | get_cache_attrs(ptee);
 703         }
 704
 705         if (uuid != NULL)
 706                 memcpy(meta->uuid, uuid, TEESMC_UUID_LEN);
 707         meta->clnt_login = 0; /* FIXME: is this reliable ? used ? */
 708
 709         params32 += num_meta;
 710         set_params(ptee, params32, cmd->param.type, &cmd->param);
 711
 712         call_tee(ptee, parg32, arg32);
 713
 714         get_params(&cmd->param, params32);
 715
 716         if (arg32->ret != TEEC_ERROR_COMMUNICATION) {
 717                 sess->sessid = arg32->session;
 718                 cmd->err = arg32->ret;
 719                 cmd->origin = arg32->ret_origin;
 720         } else
 721                 ret = -EBUSY;
 722
 723         free_tee_arg(ptee, parg32);
 724         free_tee_arg(ptee, pmeta);
 725
 726         dev_dbg(DEV, "< %x:%d\n", arg32->ret, ret);
 727         return ret;
 728 }
 729
 730 /*
 731  * tee_invoke_command - invoke TEE to invoke a GP TEE command
 732  */
 733 static int tz_invoke(struct tee_session *sess, struct tee_cmd *cmd)
 734 {
 735         struct tee *tee;
 736         struct tee_tz *ptee;
 737         int ret = 0;
 738
 739         struct teesmc32_arg *arg32;
 740         uintptr_t parg32;
 741         struct teesmc32_param *params32;
 742
 743         BUG_ON(!sess->ctx->tee);
 744         BUG_ON(!sess->ctx->tee->priv);
 745         tee = sess->ctx->tee;
 746         ptee = tee->priv;
 747
 748         dev_dbg(DEV, "> sessid %x cmd %x type %x\n",
 749                 sess->sessid, cmd->cmd, cmd->param.type);
 750
 751         if (!CAPABLE(tee)) {
 752                 dev_dbg(tee->dev, "< not capable\n");
 753                 return -EBUSY;
 754         }
 755
 756         arg32 = (typeof(arg32))alloc_tee_arg(ptee, &parg32,
 757                         TEESMC32_GET_ARG_SIZE(TEEC_CONFIG_PAYLOAD_REF_COUNT));
 758         if (!arg32) {
 759                 free_tee_arg(ptee, parg32);
 760                 return TEEC_ERROR_OUT_OF_MEMORY;
 761         }
 762
 763         memset(arg32, 0, sizeof(*arg32));
 764         arg32->num_params = TEEC_CONFIG_PAYLOAD_REF_COUNT;
 765         params32 = TEESMC32_GET_PARAMS(arg32);
 766
 767         arg32->cmd = TEESMC_CMD_INVOKE_COMMAND;
 768         arg32->session = sess->sessid;
 769         arg32->ta_func = cmd->cmd;
 770
 771         set_params(ptee, params32, cmd->param.type, &cmd->param);
 772
 773         call_tee(ptee, parg32, arg32);
 774
 775         get_params(&cmd->param, params32);
 776
 777         if (arg32->ret != TEEC_ERROR_COMMUNICATION) {
 778                 cmd->err = arg32->ret;
 779                 cmd->origin = arg32->ret_origin;
 780         } else
 781                 ret = -EBUSY;
 782
 783         free_tee_arg(ptee, parg32);
 784
 785         dev_dbg(DEV, "< %x:%d\n", arg32->ret, ret);
 786         return ret;
 787 }
 788
 789 /*
 790  * tee_cancel_command - invoke TEE to cancel a GP TEE command
 791  */
 792 static int tz_cancel(struct tee_session *sess, struct tee_cmd *cmd)
 793 {
 794         struct tee *tee;
 795         struct tee_tz *ptee;
 796         int ret = 0;
 797
 798         struct teesmc32_arg *arg32;
 799         uintptr_t parg32;
 800
 801         BUG_ON(!sess->ctx->tee);
 802         BUG_ON(!sess->ctx->tee->priv);
 803         tee = sess->ctx->tee;
 804         ptee = tee->priv;
 805
 806         dev_dbg(DEV, "cancel on sessid=%08x\n", sess->sessid);
 807
 808         arg32 = alloc_tee_arg(ptee, &parg32, TEESMC32_GET_ARG_SIZE(0));
 809         if (arg32 == NULL) {
 810                 free_tee_arg(ptee, parg32);
 811                 return TEEC_ERROR_OUT_OF_MEMORY;
 812         }
 813
 814         memset(arg32, 0, sizeof(*arg32));
 815         arg32->cmd = TEESMC_CMD_CANCEL;
 816         arg32->session = sess->sessid;
 817
 818         call_tee(ptee, parg32, arg32);
 819
 820         if (arg32->ret == TEEC_ERROR_COMMUNICATION)
 821                 ret = -EBUSY;
 822
 823         free_tee_arg(ptee, parg32);
 824
 825         dev_dbg(DEV, "< %x:%d\n", arg32->ret, ret);
 826         return ret;
 827 }
 828
 829 /*
 830  * tee_close_session - invoke TEE to close a GP TEE session
 831  */
 832 static int tz_close(struct tee_session *sess)
 833 {
 834         struct tee *tee;
 835         struct tee_tz *ptee;
 836         int ret = 0;
 837
 838         struct teesmc32_arg *arg32;
 839         uintptr_t parg32;
 840
 841         BUG_ON(!sess->ctx->tee);
 842         BUG_ON(!sess->ctx->tee->priv);
 843         tee = sess->ctx->tee;
 844         ptee = tee->priv;
 845
 846         dev_dbg(DEV, "close on sessid=%08x\n", sess->sessid);
 847
 848         if (!CAPABLE(tee)) {
 849                 dev_dbg(tee->dev, "< not capable\n");
 850                 return -EBUSY;
 851         }
 852
 853         arg32 = alloc_tee_arg(ptee, &parg32, TEESMC32_GET_ARG_SIZE(0));
 854         if (arg32 == NULL) {
 855                 free_tee_arg(ptee, parg32);
 856                 return TEEC_ERROR_OUT_OF_MEMORY;
 857         }
 858
 859         dev_dbg(DEV, "> [%x]\n", sess->sessid);
 860
 861         memset(arg32, 0, sizeof(*arg32));
 862         arg32->cmd = TEESMC_CMD_CLOSE_SESSION;
 863         arg32->session = sess->sessid;
 864
 865         call_tee(ptee, parg32, arg32);
 866
 867         if (arg32->ret == TEEC_ERROR_COMMUNICATION)
 868                 ret = -EBUSY;
 869
 870         free_tee_arg(ptee, parg32);
 871
 872         dev_dbg(DEV, "< %x:%d\n", arg32->ret, ret);
 873         return ret;
 874 }
 875
 876 static struct tee_shm *tz_alloc(struct tee *tee, size_t size, uint32_t flags)
 877 {
 878         struct tee_shm *shm = NULL;
 879         struct tee_tz *ptee;
 880         size_t size_aligned;
 881         BUG_ON(!tee->priv);
 882         ptee = tee->priv;
 883
 884         dev_dbg(DEV, "%s: s=%d,flags=0x%08x\n", __func__, (int)size, flags);
 885
 886 /*      comment due to #6357
 887  *      if ( (flags & ~(tee->shm_flags | TEE_SHM_MAPPED
 888  *      | TEE_SHM_TEMP | TEE_SHM_FROM_RPC)) != 0 ) {
 889                 dev_err(tee->dev, "%s: flag parameter is invalid\n", __func__);
 890                 return ERR_PTR(-EINVAL);
 891         }*/
 892
 893         size_aligned = ((size / SZ_4K) + 1) * SZ_4K;
 894         if (unlikely(size_aligned == 0)) {
 895                 dev_err(DEV, "[%s] requested size too big\n", __func__);
 896                 return NULL;
 897         }
 898
 899         shm = devm_kzalloc(tee->dev, sizeof(struct tee_shm), GFP_KERNEL);
 900         if (!shm) {
 901                 dev_err(tee->dev, "%s: kzalloc failed\n", __func__);
 902                 return ERR_PTR(-ENOMEM);
 903         }
 904
 905         shm->size_alloc = ((size / SZ_4K) + 1) * SZ_4K;
 906         shm->size_req = size;
 907         shm->paddr = tee_shm_pool_alloc(tee->dev, ptee->shm_pool,
 908                                         shm->size_alloc, ALLOC_ALIGN);
 909         if (!shm->paddr) {
 910                 dev_err(tee->dev, "%s: cannot alloc memory, size 0x%lx\n",
 911                         __func__, (unsigned long)shm->size_alloc);
 912                 devm_kfree(tee->dev, shm);
 913                 return ERR_PTR(-ENOMEM);
 914         }
 915         shm->kaddr = tee_shm_pool_p2v(tee->dev, ptee->shm_pool, shm->paddr);
 916         if (!shm->kaddr) {
 917                 dev_err(tee->dev, "%s: p2v(%pad)=0\n", __func__,
 918                         &shm->paddr);
 919                 tee_shm_pool_free(tee->dev, ptee->shm_pool, shm->paddr, NULL);
 920                 devm_kfree(tee->dev, shm);
 921                 return ERR_PTR(-EFAULT);
 922         }
 923         shm->flags = flags;
 924         if (ptee->shm_cached)
 925                 shm->flags |= TEE_SHM_CACHED;
 926
 927         dev_dbg(tee->dev, "%s: kaddr=%p, paddr=%pad, shm=%p, size %x:%x\n",
 928                 __func__, shm->kaddr, &shm->paddr, shm,
 929                 (unsigned int)shm->size_req, (unsigned int)shm->size_alloc);
 930
 931         return shm;
 932 }
 933
 934 static void tz_free(struct tee_shm *shm)
 935 {
 936         size_t size;
 937         int ret;
 938         struct tee *tee;
 939         struct tee_tz *ptee;
 940
 941         BUG_ON(!shm->tee);
 942         BUG_ON(!shm->tee->priv);
 943         tee = shm->tee;
 944         ptee = tee->priv;
 945
 946         dev_dbg(tee->dev, "%s: shm=%p\n", __func__, shm);
 947
 948         ret = tee_shm_pool_free(tee->dev, ptee->shm_pool, shm->paddr, &size);
 949         if (!ret) {
 950                 devm_kfree(tee->dev, shm);
 951                 shm = NULL;
 952         }
 953 }
 954
 955 static int tz_shm_inc_ref(struct tee_shm *shm)
 956 {
 957         struct tee *tee;
 958         struct tee_tz *ptee;
 959
 960         BUG_ON(!shm->tee);
 961         BUG_ON(!shm->tee->priv);
 962         tee = shm->tee;
 963         ptee = tee->priv;
 964
 965         return tee_shm_pool_incref(tee->dev, ptee->shm_pool, shm->paddr);
 966 }
 967
 968 /******************************************************************************/
 969 /*
 970 static void tee_get_status(struct tee_tz *ptee)
 971 {
 972         TEEC_Result ret;
 973         struct tee_msg_send *arg;
 974         struct tee_core_status_out *res;
 975         unsigned long parg, pres;
 976
 977         if (!CAPABLE(ptee->tee))
 978                 return;
 979
 980         arg = (typeof(arg))alloc_tee_arg(ptee, &parg, sizeof(*arg));
 981         res = (typeof(res))alloc_tee_arg(ptee, &pres, sizeof(*res));
 982
 983         if ((arg == NULL) || (res == NULL)) {
 984                 dev_err(DEV, "TZ outercache mutex error: alloc shm failed\n");
 985                 goto out;
 986         }
 987
 988         memset(arg, 0, sizeof(*arg));
 989         memset(res, 0, sizeof(*res));
 990         arg->service = ISSWAPI_TEE_GET_CORE_STATUS;
 991         ret = send_and_wait(ptee, ISSWAPI_TEE_GET_CORE_STATUS, SEC_ROM_DEFAULT,
 992                                 parg, pres);
 993         if (ret != TEEC_SUCCESS) {
 994                 dev_warn(DEV, "get statuc failed\n");
 995                 goto out;
 996         }
 997
 998         pr_info("TEETZ Firmware status:\n");
 999         pr_info("%s", res->raw);
1000
1001 out:
1002         free_tee_arg(ptee, parg);
1003         free_tee_arg(ptee, pres);
1004 }*/
1005
1006 #ifdef CONFIG_OUTER_CACHE
1007 /*
1008  * Synchronised outer cache maintenance support
1009  */
1010 #ifndef CONFIG_ARM_TZ_SUPPORT
1011 /* weak outer_tz_mutex in case not supported by kernel */
1012 bool __weak outer_tz_mutex(unsigned long *p)
1013 {
1014         pr_err("weak outer_tz_mutex");
1015         if (p != NULL)
1016                 return false;
1017         return true;
1018 }
1019 #endif
1020
1021 /* register_outercache_mutex - Negotiate/Disable outer cache shared mutex */
1022 static int register_outercache_mutex(struct tee_tz *ptee, bool reg)
1023 {
1024         unsigned long *vaddr = NULL;
1025         int ret = 0;
1026         struct smc_param param;
1027         uintptr_t paddr = 0;
1028
1029         dev_dbg(ptee->tee->dev, ">\n");
1030         BUG_ON(!CAPABLE(ptee->tee));
1031
1032         if ((reg == true) && (ptee->tz_outer_cache_mutex != NULL)) {
1033                 dev_err(DEV, "outer cache shared mutex already registered\n");
1034                 return -EINVAL;
1035         }
1036         if ((reg == false) && (ptee->tz_outer_cache_mutex == NULL))
1037                 return 0;
1038
1039         mutex_lock(&ptee->mutex);
1040
1041         if (reg == false) {
1042                 vaddr = ptee->tz_outer_cache_mutex;
1043                 ptee->tz_outer_cache_mutex = NULL;
1044                 goto out;
1045         }
1046
1047         memset(&param, 0, sizeof(param));
1048         param.a0 = TEESMC32_ST_FASTCALL_L2CC_MUTEX;
1049         param.a1 = TEESMC_ST_L2CC_MUTEX_GET_ADDR;
1050 #ifdef SWITCH_CPU0_DEBUG
1051         ret = tee_smc_call_switchcpu0(&param);
1052         if (ret)
1053                 goto out;
1054 #else
1055         tee_smc_call(&param);
1056 #endif
1057
1058         if (param.a0 != TEESMC_RETURN_OK) {
1059                 dev_warn(DEV, "no TZ l2cc mutex service supported\n");
1060                 goto out;
1061         }
1062         paddr = param.a2;
1063         dev_dbg(DEV, "outer cache shared mutex paddr 0x%lx\n", paddr);
1064
1065         vaddr = ioremap_cache(paddr, sizeof(u32));
1066         if (vaddr == NULL) {
1067                 dev_warn(DEV, "TZ l2cc mutex disabled: ioremap failed\n");
1068                 ret = -ENOMEM;
1069                 goto out;
1070         }
1071
1072         dev_dbg(DEV, "outer cache shared mutex vaddr %p\n", vaddr);
1073         if (outer_tz_mutex(vaddr) == false) {
1074                 dev_warn(DEV, "TZ l2cc mutex disabled: outer cache refused\n");
1075                 goto out;
1076         }
1077
1078         memset(&param, 0, sizeof(param));
1079         param.a0 = TEESMC32_ST_FASTCALL_L2CC_MUTEX;
1080         param.a1 = TEESMC_ST_L2CC_MUTEX_ENABLE;
1081 #ifdef SWITCH_CPU0_DEBUG
1082         ret = tee_smc_call_switchcpu0(&param);
1083         if (ret)
1084                 goto out;
1085 #else
1086         tee_smc_call(&param);
1087 #endif
1088
1089         if (param.a0 != TEESMC_RETURN_OK) {
1090
1091                 dev_warn(DEV, "TZ l2cc mutex disabled: TZ enable failed\n");
1092                 goto out;
1093         }
1094         ptee->tz_outer_cache_mutex = vaddr;
1095
1096 out:
1097         if (ptee->tz_outer_cache_mutex == NULL) {
1098                 memset(&param, 0, sizeof(param));
1099                 param.a0 = TEESMC32_ST_FASTCALL_L2CC_MUTEX;
1100                 param.a1 = TEESMC_ST_L2CC_MUTEX_DISABLE;
1101 #ifdef SWITCH_CPU0_DEBUG
1102                 ret = tee_smc_call_switchcpu0(&param);
1103                 if (ret) {
1104                         mutex_unlock(&ptee->mutex);
1105                         return ret;
1106                 }
1107 #else
1108                 tee_smc_call(&param);
1109 #endif
1110                 outer_tz_mutex(NULL);
1111                 if (vaddr)
1112                         iounmap(vaddr);
1113                 dev_dbg(DEV, "outer cache shared mutex disabled\n");
1114         }
1115
1116         mutex_unlock(&ptee->mutex);
1117         dev_dbg(DEV, "< teetz outer mutex: ret=%d pa=0x%lX va=0x%p %sabled\n",
1118                 ret, paddr, vaddr, ptee->tz_outer_cache_mutex ? "en" : "dis");
1119         return ret;
1120 }
1121 #endif
1122
1123 /* configure_shm - Negotiate Shared Memory configuration with teetz. */
1124 static int configure_shm(struct tee_tz *ptee)
1125 {
1126         struct smc_param param = { 0 };
1127         size_t shm_size = -1;
1128         int ret = 0;
1129
1130         dev_dbg(DEV, ">\n");
1131         BUG_ON(!CAPABLE(ptee->tee));
1132
1133         mutex_lock(&ptee->mutex);
1134         param.a0 = TEESMC32_ST_FASTCALL_GET_SHM_CONFIG;
1135 #ifdef SWITCH_CPU0_DEBUG
1136         ret = tee_smc_call_switchcpu0(&param);
1137         if (ret) {
1138                 mutex_unlock(&ptee->mutex);
1139                 goto out;
1140         }
1141 #else
1142         tee_smc_call(&param);
1143 #endif
1144         mutex_unlock(&ptee->mutex);
1145
1146         if (param.a0 != TEESMC_RETURN_OK) {
1147                 dev_err(DEV, "shm service not available: %X", (uint)param.a0);
1148                 ret = -EINVAL;
1149                 goto out;
1150         }
1151
1152         ptee->shm_paddr = param.a1;
1153         shm_size = param.a2;
1154         ptee->shm_cached = (bool)param.a3;
1155
1156         if (ptee->shm_cached)
1157                 ptee->shm_vaddr = ioremap_cache(ptee->shm_paddr, shm_size);
1158         else
1159                 ptee->shm_vaddr = ioremap_nocache(ptee->shm_paddr, shm_size);
1160
1161         if (ptee->shm_vaddr == NULL) {
1162                 dev_err(DEV, "shm ioremap failed\n");
1163                 ret = -ENOMEM;
1164                 goto out;
1165         }
1166
1167         ptee->shm_pool = tee_shm_pool_create(DEV, shm_size,
1168                                              ptee->shm_vaddr, ptee->shm_paddr);
1169
1170         if (!ptee->shm_pool) {
1171                 dev_err(DEV, "shm pool creation failed (%zu)", shm_size);
1172                 ret = -EINVAL;
1173                 goto out;
1174         }
1175
1176         if (ptee->shm_cached)
1177                 tee_shm_pool_set_cached(ptee->shm_pool);
1178 out:
1179         dev_dbg(DEV, "< ret=%d pa=0x%lX va=0x%p size=%zu, %scached",
1180                 ret, ptee->shm_paddr, ptee->shm_vaddr, shm_size,
1181                 (ptee->shm_cached == 1) ? "" : "un");
1182         return ret;
1183 }
1184
1185
1186 /******************************************************************************/
1187
1188 static int tz_start(struct tee *tee)
1189 {
1190         struct tee_tz *ptee;
1191         int ret;
1192
1193         BUG_ON(!tee || !tee->priv);
1194         dev_dbg(tee->dev, ">\n");
1195         if (!CAPABLE(tee)) {
1196                 dev_dbg(tee->dev, "< not capable\n");
1197                 return -EBUSY;
1198         }
1199
1200         ptee = tee->priv;
1201         BUG_ON(ptee->started);
1202         ptee->started = true;
1203
1204         ret = configure_shm(ptee);
1205         if (ret)
1206                 goto exit;
1207
1208
1209 #ifdef CONFIG_OUTER_CACHE
1210         ret = register_outercache_mutex(ptee, true);
1211         if (ret)
1212                 goto exit;
1213 #endif
1214
1215 exit:
1216         if (ret)
1217                 ptee->started = false;
1218
1219         dev_dbg(tee->dev, "< ret=%d dev=%s\n", ret, tee->name);
1220         return ret;
1221 }
1222
1223 static int tz_stop(struct tee *tee)
1224 {
1225         struct tee_tz *ptee;
1226
1227         BUG_ON(!tee || !tee->priv);
1228
1229         ptee = tee->priv;
1230
1231         dev_dbg(tee->dev, "> dev=%s\n", tee->name);
1232         if (!CAPABLE(tee)) {
1233                 dev_dbg(tee->dev, "< not capable\n");
1234                 return -EBUSY;
1235         }
1236
1237 #ifdef CONFIG_OUTER_CACHE
1238         register_outercache_mutex(ptee, false);
1239 #endif
1240         tee_shm_pool_destroy(tee->dev, ptee->shm_pool);
1241         iounmap(ptee->shm_vaddr);
1242         ptee->started = false;
1243
1244         dev_dbg(tee->dev, "< ret=0 dev=%s\n", tee->name);
1245         return 0;
1246 }
1247
1248 /******************************************************************************/
1249
1250 static const struct tee_ops tee_fops = {
1251         .type = "tz",
1252         .owner = THIS_MODULE,
1253         .start = tz_start,
1254         .stop = tz_stop,
1255         .invoke = tz_invoke,
1256         .cancel = tz_cancel,
1257         .open = tz_open,
1258         .close = tz_close,
1259         .alloc = tz_alloc,
1260         .free = tz_free,
1261         .shm_inc_ref = tz_shm_inc_ref,
1262 };
1263
1264 static int tz_tee_init(struct platform_device *pdev)
1265 {
1266         int ret = 0;
1267
1268         struct tee *tee = platform_get_drvdata(pdev);
1269         struct tee_tz *ptee = tee->priv;
1270
1271         tee_tz = ptee;
1272
1273 #if 0
1274         /* To replace by a syscall */
1275 #ifndef CONFIG_ARM_TZ_SUPPORT
1276         dev_err(tee->dev,
1277                 "%s: dev=%s, TZ fw is not loaded: TEE TZ is not supported.\n",
1278                 __func__, tee->name);
1279         tee->conf = TEE_CONF_FW_NOT_CAPABLE;
1280         return 0;
1281 #endif
1282 #endif
1283
1284         ptee->started = false;
1285         ptee->sess_id = 0xAB000000;
1286         mutex_init(&ptee->mutex);
1287         init_completion(&ptee->c);
1288         ptee->c_waiters = 0;
1289
1290         tee_wait_queue_init(&ptee->wait_queue);
1291         ret = tee_mutex_wait_init(&ptee->mutex_wait);
1292
1293         if (ret)
1294                 dev_err(tee->dev, "%s: dev=%s, Secure armv7 failed (%d)\n",
1295                                 __func__, tee->name, ret);
1296         else
1297                 dev_dbg(tee->dev, "%s: dev=%s, Secure armv7\n",
1298                                 __func__, tee->name);
1299         return ret;
1300 }
1301
1302 static void tz_tee_deinit(struct platform_device *pdev)
1303 {
1304         struct tee *tee = platform_get_drvdata(pdev);
1305         struct tee_tz *ptee = tee->priv;
1306
1307         if (!CAPABLE(tee))
1308                 return;
1309
1310         tee_mutex_wait_exit(&ptee->mutex_wait);
1311         tee_wait_queue_exit(&ptee->wait_queue);
1312
1313         dev_dbg(tee->dev, "%s: dev=%s, Secure armv7 started=%d\n", __func__,
1314                  tee->name, ptee->started);
1315 }
1316
1317 static int tz_tee_probe(struct platform_device *pdev)
1318 {
1319         int ret = 0;
1320         struct device *dev = &pdev->dev;
1321         struct tee *tee;
1322         struct tee_tz *ptee;
1323
1324         pr_info("%s: name=\"%s\", id=%d, pdev_name=\"%s\"\n", __func__,
1325                 pdev->name, pdev->id, dev_name(dev));
1326 #ifdef _TEE_DEBUG
1327         pr_debug("- dev=%p\n", dev);
1328         pr_debug("- dev->parent=%p\n", dev->ctx);
1329         pr_debug("- dev->driver=%p\n", dev->driver);
1330 #endif
1331
1332         tee = tee_core_alloc(dev, _TEE_TZ_NAME, pdev->id, &tee_fops,
1333                              sizeof(struct tee_tz));
1334         if (!tee)
1335                 return -ENOMEM;
1336
1337         ptee = tee->priv;
1338         ptee->tee = tee;
1339
1340         platform_set_drvdata(pdev, tee);
1341
1342         ret = tz_tee_init(pdev);
1343         if (ret)
1344                 goto bail0;
1345
1346         ret = tee_core_add(tee);
1347         if (ret)
1348                 goto bail1;
1349
1350 #ifdef _TEE_DEBUG
1351         pr_debug("- tee=%p, id=%d, iminor=%d\n", tee, tee->id,
1352                  tee->miscdev.minor);
1353 #endif
1354         return 0;
1355
1356 bail1:
1357         tz_tee_deinit(pdev);
1358 bail0:
1359         tee_core_free(tee);
1360         return ret;
1361 }
1362
1363 static int tz_tee_remove(struct platform_device *pdev)
1364 {
1365         struct tee *tee = platform_get_drvdata(pdev);
1366         struct device *dev = &pdev->dev;
1367         /*struct tee_tz *ptee;*/
1368
1369         pr_info("%s: name=\"%s\", id=%d, pdev_name=\"%s\"\n", __func__,
1370                 pdev->name, pdev->id, dev_name(dev));
1371 #ifdef _TEE_DEBUG
1372         pr_debug("- tee=%p, id=%d, iminor=%d, name=%s\n",
1373                  tee, tee->id, tee->miscdev.minor, tee->name);
1374 #endif
1375
1376 /*      ptee = tee->priv;
1377         tee_get_status(ptee);*/
1378
1379         tz_tee_deinit(pdev);
1380         tee_core_del(tee);
1381         return 0;
1382 }
1383
1384 static struct of_device_id tz_tee_match[] = {
1385         {
1386          .compatible = "stm,armv7sec",
1387          },
1388         {},
1389 };
1390
1391 static struct platform_driver tz_tee_driver = {
1392         .probe = tz_tee_probe,
1393         .remove = tz_tee_remove,
1394         .driver = {
1395                    .name = "armv7sec",
1396                    .owner = THIS_MODULE,
1397                    .of_match_table = tz_tee_match,
1398                    },
1399 };
1400
1401 static struct platform_device tz_0_plt_device = {
1402         .name = "armv7sec",
1403         .id = 0,
1404         .dev = {
1405 /*                              .platform_data = tz_0_tee_data,*/
1406                 },
1407 };
1408
1409 static int __init tee_tz_init(void)
1410 {
1411         int rc;
1412
1413         pr_info("TEE armv7 Driver initialization\n");
1414
1415 #ifdef _TEE_DEBUG
1416         pr_debug("- Register the platform_driver \"%s\" %p\n",
1417                  tz_tee_driver.driver.name, &tz_tee_driver.driver);
1418 #endif
1419
1420         rc = platform_driver_register(&tz_tee_driver);
1421         if (rc != 0) {
1422                 pr_err("failed to register the platform driver (rc=%d)\n", rc);
1423                 goto bail0;
1424         }
1425
1426         rc = platform_device_register(&tz_0_plt_device);
1427         if (rc != 0) {
1428                 pr_err("failed to register the platform devices 0 (rc=%d)\n",
1429                        rc);
1430                 goto bail1;
1431         }
1432
1433         return rc;
1434
1435 bail1:
1436         platform_driver_unregister(&tz_tee_driver);
1437 bail0:
1438         return rc;
1439 }
1440
1441 static void __exit tee_tz_exit(void)
1442 {
1443         pr_info("TEE ARMV7 Driver de-initialization\n");
1444
1445         platform_device_unregister(&tz_0_plt_device);
1446         platform_driver_unregister(&tz_tee_driver);
1447 }
1448
1449 module_init(tee_tz_init);
1450 module_exit(tee_tz_exit);
1451
1452 MODULE_AUTHOR("STMicroelectronics");
1453 MODULE_DESCRIPTION("STM Secure TEE ARMV7 TZ driver");
1454 MODULE_SUPPORTED_DEVICE("");
1455 MODULE_LICENSE("GPL");
1456 MODULE_VERSION("1.0");