1 // SPDX-License-Identifier: MIT
3 * AMD Trusted Execution Environment (TEE) interface
5 * Author: Rijo Thomas <Rijo-john.Thomas@amd.com>
6 * Author: Devaraj Rangasamy <Devaraj.Rangasamy@amd.com>
8 * Copyright (C) 2019,2021 Advanced Micro Devices, Inc.
11 #include <linux/bitfield.h>
12 #include <linux/types.h>
13 #include <linux/mutex.h>
14 #include <linux/delay.h>
15 #include <linux/slab.h>
16 #include <linux/gfp.h>
17 #include <linux/psp.h>
18 #include <linux/psp-tee.h>
25 static int tee_alloc_ring(struct psp_tee_device *tee, int ring_size)
27 struct ring_buf_manager *rb_mgr = &tee->rb_mgr;
33 /* We need actual physical address instead of DMA address, since
34 * Trusted OS running on AMD Secure Processor will map this region
36 start_addr = (void *)__get_free_pages(GFP_KERNEL, get_order(ring_size));
40 memset(start_addr, 0x0, ring_size);
41 rb_mgr->ring_start = start_addr;
42 rb_mgr->ring_size = ring_size;
43 rb_mgr->ring_pa = __psp_pa(start_addr);
44 mutex_init(&rb_mgr->mutex);
49 static void tee_free_ring(struct psp_tee_device *tee)
51 struct ring_buf_manager *rb_mgr = &tee->rb_mgr;
53 if (!rb_mgr->ring_start)
56 free_pages((unsigned long)rb_mgr->ring_start,
57 get_order(rb_mgr->ring_size));
59 rb_mgr->ring_start = NULL;
60 rb_mgr->ring_size = 0;
62 mutex_destroy(&rb_mgr->mutex);
66 struct tee_init_ring_cmd *tee_alloc_cmd_buffer(struct psp_tee_device *tee)
68 struct tee_init_ring_cmd *cmd;
70 cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
74 cmd->hi_addr = upper_32_bits(tee->rb_mgr.ring_pa);
75 cmd->low_addr = lower_32_bits(tee->rb_mgr.ring_pa);
76 cmd->size = tee->rb_mgr.ring_size;
78 dev_dbg(tee->dev, "tee: ring address: high = 0x%x low = 0x%x size = %u\n",
79 cmd->hi_addr, cmd->low_addr, cmd->size);
84 static inline void tee_free_cmd_buffer(struct tee_init_ring_cmd *cmd)
89 static int tee_init_ring(struct psp_tee_device *tee)
91 int ring_size = MAX_RING_BUFFER_ENTRIES * sizeof(struct tee_ring_cmd);
92 struct tee_init_ring_cmd *cmd;
96 BUILD_BUG_ON(sizeof(struct tee_ring_cmd) != 1024);
98 ret = tee_alloc_ring(tee, ring_size);
100 dev_err(tee->dev, "tee: ring allocation failed %d\n", ret);
104 tee->rb_mgr.wptr = 0;
106 cmd = tee_alloc_cmd_buffer(tee);
112 /* Send command buffer details to Trusted OS by writing to
113 * CPU-PSP message registers
115 ret = psp_mailbox_command(tee->psp, PSP_CMD_TEE_RING_INIT, cmd,
116 TEE_DEFAULT_CMD_TIMEOUT, ®);
118 dev_err(tee->dev, "tee: ring init command timed out, disabling TEE support\n");
124 if (FIELD_GET(PSP_CMDRESP_STS, reg)) {
125 dev_err(tee->dev, "tee: ring init command failed (%#010lx)\n",
126 FIELD_GET(PSP_CMDRESP_STS, reg));
132 tee_free_cmd_buffer(cmd);
137 static void tee_destroy_ring(struct psp_tee_device *tee)
142 if (!tee->rb_mgr.ring_start)
148 ret = psp_mailbox_command(tee->psp, PSP_CMD_TEE_RING_DESTROY, NULL,
149 TEE_DEFAULT_CMD_TIMEOUT, ®);
151 dev_err(tee->dev, "tee: ring destroy command timed out, disabling TEE support\n");
153 } else if (FIELD_GET(PSP_CMDRESP_STS, reg)) {
154 dev_err(tee->dev, "tee: ring destroy command failed (%#010lx)\n",
155 FIELD_GET(PSP_CMDRESP_STS, reg));
162 int tee_dev_init(struct psp_device *psp)
164 struct device *dev = psp->dev;
165 struct psp_tee_device *tee;
169 tee = devm_kzalloc(dev, sizeof(*tee), GFP_KERNEL);
178 tee->io_regs = psp->io_regs;
180 tee->vdata = (struct tee_vdata *)psp->vdata->tee;
183 dev_err(dev, "tee: missing driver data\n");
187 ret = tee_init_ring(tee);
189 dev_err(dev, "tee: failed to init ring buffer\n");
193 dev_notice(dev, "tee enabled\n");
198 psp->tee_data = NULL;
200 dev_notice(dev, "tee initialization failed\n");
205 void tee_dev_destroy(struct psp_device *psp)
207 struct psp_tee_device *tee = psp->tee_data;
212 tee_destroy_ring(tee);
215 static int tee_submit_cmd(struct psp_tee_device *tee, enum tee_cmd_id cmd_id,
216 void *buf, size_t len, struct tee_ring_cmd **resp)
218 struct tee_ring_cmd *cmd;
219 int nloop = 1000, ret = 0;
224 mutex_lock(&tee->rb_mgr.mutex);
226 /* Loop until empty entry found in ring buffer */
228 /* Get pointer to ring buffer command entry */
229 cmd = (struct tee_ring_cmd *)
230 (tee->rb_mgr.ring_start + tee->rb_mgr.wptr);
232 rptr = ioread32(tee->io_regs + tee->vdata->ring_rptr_reg);
234 /* Check if ring buffer is full or command entry is waiting
235 * for response from TEE
237 if (!(tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr ||
238 cmd->flag == CMD_WAITING_FOR_RESPONSE))
241 dev_dbg(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u\n",
242 rptr, tee->rb_mgr.wptr);
244 /* Wait if ring buffer is full or TEE is processing data */
245 mutex_unlock(&tee->rb_mgr.mutex);
246 schedule_timeout_interruptible(msecs_to_jiffies(10));
247 mutex_lock(&tee->rb_mgr.mutex);
252 (tee->rb_mgr.wptr + sizeof(struct tee_ring_cmd) == rptr ||
253 cmd->flag == CMD_WAITING_FOR_RESPONSE)) {
254 dev_err(tee->dev, "tee: ring buffer full. rptr = %u wptr = %u response flag %u\n",
255 rptr, tee->rb_mgr.wptr, cmd->flag);
260 /* Do not submit command if PSP got disabled while processing any
261 * command in another thread
268 /* Write command data into ring buffer */
269 cmd->cmd_id = cmd_id;
270 cmd->cmd_state = TEE_CMD_STATE_INIT;
271 memset(&cmd->buf[0], 0, sizeof(cmd->buf));
272 memcpy(&cmd->buf[0], buf, len);
274 /* Indicate driver is waiting for response */
275 cmd->flag = CMD_WAITING_FOR_RESPONSE;
277 /* Update local copy of write pointer */
278 tee->rb_mgr.wptr += sizeof(struct tee_ring_cmd);
279 if (tee->rb_mgr.wptr >= tee->rb_mgr.ring_size)
280 tee->rb_mgr.wptr = 0;
282 /* Trigger interrupt to Trusted OS */
283 iowrite32(tee->rb_mgr.wptr, tee->io_regs + tee->vdata->ring_wptr_reg);
285 /* The response is provided by Trusted OS in same
286 * location as submitted data entry within ring buffer.
291 mutex_unlock(&tee->rb_mgr.mutex);
296 static int tee_wait_cmd_completion(struct psp_tee_device *tee,
297 struct tee_ring_cmd *resp,
298 unsigned int timeout)
300 /* ~1ms sleep per loop => nloop = timeout * 1000 */
301 int nloop = timeout * 1000;
304 if (resp->cmd_state == TEE_CMD_STATE_COMPLETED)
307 usleep_range(1000, 1100);
310 dev_err(tee->dev, "tee: command 0x%x timed out, disabling PSP\n",
318 int psp_tee_process_cmd(enum tee_cmd_id cmd_id, void *buf, size_t len,
321 struct psp_device *psp = psp_get_master_device();
322 struct psp_tee_device *tee;
323 struct tee_ring_cmd *resp;
326 if (!buf || !status || !len || len > sizeof(resp->buf))
331 if (!psp || !psp->tee_data)
339 ret = tee_submit_cmd(tee, cmd_id, buf, len, &resp);
343 ret = tee_wait_cmd_completion(tee, resp, TEE_DEFAULT_RING_TIMEOUT);
345 resp->flag = CMD_RESPONSE_TIMEDOUT;
349 memcpy(buf, &resp->buf[0], len);
350 *status = resp->status;
352 resp->flag = CMD_RESPONSE_COPIED;
356 EXPORT_SYMBOL(psp_tee_process_cmd);
358 int psp_check_tee_status(void)
360 struct psp_device *psp = psp_get_master_device();
362 if (!psp || !psp->tee_data)
367 EXPORT_SYMBOL(psp_check_tee_status);