1// SPDX-License-Identifier: MIT
  2/*
  3 * AMD Trusted Execution Environment (TEE) interface
  4 *
  5 * Author: Rijo Thomas <Rijo-john.Thomas@amd.com>
  6 * Author: Devaraj Rangasamy <Devaraj.Rangasamy@amd.com>
  7 *
  8 * Copyright 2019 Advanced Micro Devices, Inc.
  9 */
 10
 11#include <linux/types.h>
 12#include <linux/mutex.h>
 13#include <linux/delay.h>
 14#include <linux/slab.h>
 15#include <linux/gfp.h>
 16#include <linux/psp-sev.h>
 17#include <linux/psp-tee.h>
 18
 19#include "psp-dev.h"
 20#include "tee-dev.h"
 21
 22static bool psp_dead;
 23
 24static int tee_alloc_ring(struct psp_tee_device *tee, int ring_size)
 25{
 26	struct ring_buf_manager *rb_mgr = &tee->rb_mgr;
 27	void *start_addr;
 28
 29	if (!ring_size)
 30		return -EINVAL;
 31
 32	/* We need actual physical address instead of DMA address, since
 33	 * Trusted OS running on AMD Secure Processor will map this region
 34	 */
 35	start_addr = (void *)__get_free_pages(GFP_KERNEL, get_order(ring_size));
 36	if (!start_addr)
 37		return -ENOMEM;
 38
 39	rb_mgr->ring_start = start_addr;
 40	rb_mgr->ring_size = ring_size;
 41	rb_mgr->ring_pa = __psp_pa(start_addr);
 42	mutex_init(&rb_mgr->mutex);
 43
 44	return 0;
 45}
 46
 47static void tee_free_ring(struct psp_tee_device *tee)
 48{
 49	struct ring_buf_manager *rb_mgr = &tee->rb_mgr;
 50
 51	if (!rb_mgr->ring_start)
 52		return;
 53
 54	free_pages((unsigned long)rb_mgr->ring_start,
 55		   get_order(rb_mgr->ring_size));
 56
 57	rb_mgr->ring_start = NULL;
 58	rb_mgr->ring_size = 0;
 59	rb_mgr->ring_pa = 0;
 60	mutex_destroy(&rb_mgr->mutex);
 61}
 62
 63static int tee_wait_cmd_poll(struct psp_tee_device *tee, unsigned int timeout,
 64			     unsigned int *reg)
 65{
 66	/* ~10ms sleep per loop => nloop = timeout * 100 */
 67	int nloop = timeout * 100;
 68
 69	while (--nloop) {
 70		*reg = ioread32(tee->io_regs + tee->vdata->cmdresp_reg);
 71		if (*reg & PSP_CMDRESP_RESP)
 72			return 0;
 73
 74		usleep_range(10000, 10100);
 75	}
 76
 77	dev_err(tee->dev, "tee: command timed out, disabling PSP\n");
 78	psp_dead = true;
 79
 80	return -ETIMEDOUT;
 81}
 82
 83static
 84struct tee_init_ring_cmd *tee_alloc_cmd_buffer(struct psp_tee_device *tee)
 85{
 86	struct tee_init_ring_cmd *cmd;
 87
 88	cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
 89	if (!cmd)
 90		return NULL;
 91
 92	cmd->hi_addr = upper_32_bits(tee->rb_mgr.ring_pa);
 93	cmd->low_addr = lower_32_bits(tee->rb_mgr.ring_pa);
 94	cmd->size = tee->rb_mgr.ring_size;
 95
 96	dev_dbg(tee->dev, "tee: ring address: high = 0x%x low = 0x%x size = %u\n",
 97		cmd->hi_addr, cmd->low_addr, cmd->size);
 98
 99	return cmd;
100}
101
102static inline void tee_free_cmd_buffer(struct tee_init_ring_cmd *cmd)
103{
104	kfree(cmd);
105}
106
107static int tee_init_ring(struct psp_tee_device *tee)
108{
109	int ring_size = MAX_RING_BUFFER_ENTRIES * sizeof(struct tee_ring_cmd);
110	struct tee_init_ring_cmd *cmd;
111	phys_addr_t cmd_buffer;
112	unsigned int reg;
113	int ret;
114
115	BUILD_BUG_ON(sizeof(struct tee_ring_cmd) != 1024);
116
117	ret = tee_alloc_ring(tee, ring_size);
118	if (ret) {
119		dev_err(tee->dev, "tee: ring allocation failed %d\n", ret);
120		return ret;
121	}
122
123	tee->rb_mgr.wptr = 0;
124
125	cmd = tee_alloc_cmd_buffer(tee);
126	if (!cmd) {
127		tee_free_ring(tee);
128		return -ENOMEM;
129	}
130
131	cmd_buffer = __psp_pa((void *)cmd);
132
133	/* Send command buffer details to Trusted OS by writing to
134	 * CPU-PSP message registers
135	 */
136
137	iowrite32(lower_32_bits(cmd_buffer),
138		  tee->io_regs + tee->vdata->cmdbuff_addr_lo_reg);
139	iowrite32(upper_32_bits(cmd_buffer),
140		  tee->io_regs + tee->vdata->cmdbuff_addr_hi_reg);
141	iowrite32(TEE_RING_INIT_CMD,
142		  tee->io_regs + tee->vdata->cmdresp_reg);
143
144	ret = tee_wait_cmd_poll(tee, TEE_DEFAULT_TIMEOUT, &reg);
145	if (ret) {
146		dev_err(tee->dev, "tee: ring init command timed out\n");
147		tee_free_ring(tee);
148		goto free_buf;
149	}
150
151	if (reg & PSP_CMDRESP_ERR_MASK) {
152		dev_err(tee->dev, "tee: ring init command failed (%#010x)\n",
153			reg & PSP_CMDRESP_ERR_MASK);
154		tee_free_ring(tee);
155		ret = -EIO;
156	}
157
158free_buf:
159	tee_free_cmd_buffer(cmd);
160
161	return ret;
162}
163
164static void tee_destroy_ring(struct psp_tee_device *tee)
165{
166	unsigned int reg;
167	int ret;
168
169	if (!tee->rb_mgr.ring_start)
170		return;
171
172	if (psp_dead)
173		goto free_ring;
174
175	iowrite32(TEE_RING_DESTROY_CMD,
176		  tee->io_regs + tee->vdata->cmdresp_reg);
177
178	ret = tee_wait_cmd_poll(tee, TEE_DEFAULT_TIMEOUT, &reg);
179	if (ret) {
180		dev_err(tee->dev, "tee: ring destroy command timed out\n");
181	} else if (reg & PSP_CMDRESP_ERR_MASK) {
182		dev_err(tee->dev, "tee: ring destroy command failed (%#010x)\n",
183			reg & PSP_CMDRESP_ERR_MASK);
184	}
185
186free_ring:
187	tee_free_ring(tee);
188}
189
190int tee_dev_init(struct psp_device *psp)
191{
192	struct device *dev = psp->dev;
193	struct psp_tee_device *tee;
194	int ret;
195
196	ret = -ENOMEM;
197	tee = devm_kzalloc(dev, sizeof(*tee), GFP_KERNEL);
198	if (!tee)
199		goto e_err;
200
201	psp->tee_data = tee;
202
203	tee->dev = dev;
204	tee->psp = psp;
205
206	tee->io_regs = psp->io_regs;
207
208	tee->vdata = (struct tee_vdata *)psp->vdata->tee;
209	if (!tee->vdata) {
210		ret = -ENODEV;
211		dev_err(dev, "tee: missing driver data\n");
212		goto e_err;
213	}
214
215	ret = tee_init_ring(tee);
216	if (ret) {
217		dev_err(dev, "tee: failed to init ring buffer\n");
218		goto e_err;
219	}
220
221	dev_notice(dev, "tee enabled\n");
222
223	return 0;
224
225e_err:
226	psp->tee_data = NULL;
227
228	dev_notice(dev, "tee initialization failed\n");
229
230	return ret;
231}
232
233void tee_dev_destroy(struct psp_device *psp)
234{
235	struct psp_tee_device *tee = psp->tee_data;
236
237	if (!tee)
238		return;
239
240	tee_destroy_ring(tee);
241}
242
243static int tee_submit_cmd(struct psp_tee_device *tee, enum tee_cmd_id cmd_id,
244			  void *buf, size_t len, struct tee_ring_cmd **resp)
245{
246	struct tee_ring_cmd *cmd;
247	u32 rptr, wptr;
248	int nloop = 1000, ret = 0;
249
250	*resp = NULL;
251
252	mutex_lock(&tee->rb_mgr.mutex);
253
254	wptr = tee->rb_mgr.wptr;
255
256	/* Check if ring buffer is full */
257	do {
258		rptr = ioread32(tee->io_regs + tee->vdata->ring_rptr_reg);
259
260		if (!(wptr + sizeof(struct tee_ring_cmd) == rptr))
261			break;
262
263		dev_info(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n",
264			 rptr, wptr);
265
266		/* Wait if ring buffer is full */
267		mutex_unlock(&tee->rb_mgr.mutex);
268		schedule_timeout_interruptible(msecs_to_jiffies(10));
269		mutex_lock(&tee->rb_mgr.mutex);
270
271	} while (--nloop);
272
273	if (!nloop && (wptr + sizeof(struct tee_ring_cmd) == rptr)) {
274		dev_err(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n",
275			rptr, wptr);
276		ret = -EBUSY;
277		goto unlock;
278	}
279
280	/* Pointer to empty data entry in ring buffer */
281	cmd = (struct tee_ring_cmd *)(tee->rb_mgr.ring_start + wptr);
282
283	/* Write command data into ring buffer */
284	cmd->cmd_id = cmd_id;
285	cmd->cmd_state = TEE_CMD_STATE_INIT;
286	memset(&cmd->buf[0], 0, sizeof(cmd->buf));
287	memcpy(&cmd->buf[0], buf, len);
288
289	/* Update local copy of write pointer */
290	tee->rb_mgr.wptr += sizeof(struct tee_ring_cmd);
291	if (tee->rb_mgr.wptr >= tee->rb_mgr.ring_size)
292		tee->rb_mgr.wptr = 0;
293
294	/* Trigger interrupt to Trusted OS */
295	iowrite32(tee->rb_mgr.wptr, tee->io_regs + tee->vdata->ring_wptr_reg);
296
297	/* The response is provided by Trusted OS in same
298	 * location as submitted data entry within ring buffer.
299	 */
300	*resp = cmd;
301
302unlock:
303	mutex_unlock(&tee->rb_mgr.mutex);
304
305	return ret;
306}
307
308static int tee_wait_cmd_completion(struct psp_tee_device *tee,
309				   struct tee_ring_cmd *resp,
310				   unsigned int timeout)
311{
312	/* ~5ms sleep per loop => nloop = timeout * 200 */
313	int nloop = timeout * 200;
314
315	while (--nloop) {
316		if (resp->cmd_state == TEE_CMD_STATE_COMPLETED)
317			return 0;
318
319		usleep_range(5000, 5100);
320	}
321
322	dev_err(tee->dev, "tee: command 0x%x timed out, disabling PSP\n",
323		resp->cmd_id);
324
325	psp_dead = true;
326
327	return -ETIMEDOUT;
328}
329
330int psp_tee_process_cmd(enum tee_cmd_id cmd_id, void *buf, size_t len,
331			u32 *status)
332{
333	struct psp_device *psp = psp_get_master_device();
334	struct psp_tee_device *tee;
335	struct tee_ring_cmd *resp;
336	int ret;
337
338	if (!buf || !status || !len || len > sizeof(resp->buf))
339		return -EINVAL;
340
341	*status = 0;
342
343	if (!psp || !psp->tee_data)
344		return -ENODEV;
345
346	if (psp_dead)
347		return -EBUSY;
348
349	tee = psp->tee_data;
350
351	ret = tee_submit_cmd(tee, cmd_id, buf, len, &resp);
352	if (ret)
353		return ret;
354
355	ret = tee_wait_cmd_completion(tee, resp, TEE_DEFAULT_TIMEOUT);
356	if (ret)
357		return ret;
358
359	memcpy(buf, &resp->buf[0], len);
360	*status = resp->status;
361
362	return 0;
363}
364EXPORT_SYMBOL(psp_tee_process_cmd);
365
366int psp_check_tee_status(void)
367{
368	struct psp_device *psp = psp_get_master_device();
369
370	if (!psp || !psp->tee_data)
371		return -ENODEV;
372
373	return 0;
374}
375EXPORT_SYMBOL(psp_check_tee_status);