Merge tag 'armsoc-tee' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull TEE driver infrastructure and OP-TEE drivers from Arnd Bergmann:
 "This introduces a generic TEE framework in the kernel, to handle
  trusted environemtns (security coprocessor or software implementations
  such as OP-TEE/TrustZone). I'm sending it separately from the other
  arm-soc driver changes to give it a little more visibility, once the
  subsystem is merged, we will likely keep this in the arm₋soc drivers
  branch or have the maintainers submit pull requests directly,
  depending on the patch volume.

  I have reviewed earlier versions in the past, and have reviewed the
  latest version in person during Linaro Connect BUD17.

  Here is my overall assessment of the subsystem:

   - There is clearly demand for this, both for the generic
     infrastructure and the specific OP-TEE implementation.

   - The code has gone through a large number of reviews, and the review
     comments have all been addressed, but the reviews were not coming
     up with serious issues any more and nobody volunteered to vouch for
     the quality.

   - The user space ioctl interface is sufficient to work with the
     OP-TEE driver, and it should in principle work with other TEE
     implementations that follow the GlobalPlatform[1] standards, but it
     might need to be extended in minor ways depending on specific
     requirements of future TEE implementations

   - The main downside of the API to me is how the user space is tied to
     the TEE implementation in hardware or firmware, but uses a generic
     way to communicate with it. This seems to be an inherent problem
     with what it is trying to do, and I could not come up with any
     better solution than what is implemented here.

  For a detailed history of the patch series, see

    https://lkml.org/lkml/2017/3/10/1277"

* tag 'armsoc-tee' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  arm64: dt: hikey: Add optee node
  Documentation: tee subsystem and op-tee driver
  tee: add OP-TEE driver
  tee: generic TEE subsystem
  dt/bindings: add bindings for optee

1 files changed, 346 insertions, 0 deletions

diff --git a/include/uapi/linux/tee.h b/include/uapi/linux/tee.h
new file mode 100644
index 000000000000..370d8845ab21
--- /dev/null
+++ b/include/uapi/linux/tee.h
@@ -0,0 +1,346 @@
+/*
+ * Copyright (c) 2015-2016, Linaro Limited
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef __TEE_H
+#define __TEE_H
+
+#include <linux/ioctl.h>
+#include <linux/types.h>
+
+/*
+ * This file describes the API provided by a TEE driver to user space.
+ *
+ * Each TEE driver defines a TEE specific protocol which is used for the
+ * data passed back and forth using TEE_IOC_CMD.
+ */
+
+/* Helpers to make the ioctl defines */
+#define TEE_IOC_MAGIC   0xa4
+#define TEE_IOC_BASE    0
+
+/* Flags relating to shared memory */
+#define TEE_IOCTL_SHM_MAPPED    0x1     /* memory mapped in normal world */
+#define TEE_IOCTL_SHM_DMA_BUF   0x2     /* dma-buf handle on shared memory */
+
+#define TEE_MAX_ARG_SIZE        1024
+
+#define TEE_GEN_CAP_GP          (1 << 0)/* GlobalPlatform compliant TEE */
+
+/*
+ * TEE Implementation ID
+ */
+#define TEE_IMPL_ID_OPTEE       1
+
+/*
+ * OP-TEE specific capabilities
+ */
+#define TEE_OPTEE_CAP_TZ        (1 << 0)
+
+/**
+ * struct tee_ioctl_version_data - TEE version
+ * @impl_id:    [out] TEE implementation id
+ * @impl_caps:  [out] Implementation specific capabilities
+ * @gen_caps:   [out] Generic capabilities, defined by TEE_GEN_CAPS_* above
+ *
+ * Identifies the TEE implementation, @impl_id is one of TEE_IMPL_ID_* above.
+ * @impl_caps is implementation specific, for example TEE_OPTEE_CAP_*
+ * is valid when @impl_id == TEE_IMPL_ID_OPTEE.
+ */
+struct tee_ioctl_version_data {
+        __u32 impl_id;
+        __u32 impl_caps;
+        __u32 gen_caps;
+};
+
+/**
+ * TEE_IOC_VERSION - query version of TEE
+ *
+ * Takes a tee_ioctl_version_data struct and returns with the TEE version
+ * data filled in.
+ */
+#define TEE_IOC_VERSION         _IOR(TEE_IOC_MAGIC, TEE_IOC_BASE + 0, \
+                                     struct tee_ioctl_version_data)
+
+/**
+ * struct tee_ioctl_shm_alloc_data - Shared memory allocate argument
+ * @size:       [in/out] Size of shared memory to allocate
+ * @flags:      [in/out] Flags to/from allocation.
+ * @id:         [out] Identifier of the shared memory
+ *
+ * The flags field should currently be zero as input. Updated by the call
+ * with actual flags as defined by TEE_IOCTL_SHM_* above.
+ * This structure is used as argument for TEE_IOC_SHM_ALLOC below.
+ */
+struct tee_ioctl_shm_alloc_data {
+        __u64 size;
+        __u32 flags;
+        __s32 id;
+};
+
+/**
+ * TEE_IOC_SHM_ALLOC - allocate shared memory
+ *
+ * Allocates shared memory between the user space process and secure OS.
+ *
+ * Returns a file descriptor on success or < 0 on failure
+ *
+ * The returned file descriptor is used to map the shared memory into user
+ * space. The shared memory is freed when the descriptor is closed and the
+ * memory is unmapped.
+ */
+#define TEE_IOC_SHM_ALLOC       _IOWR(TEE_IOC_MAGIC, TEE_IOC_BASE + 1, \
+                                     struct tee_ioctl_shm_alloc_data)
+
+/**
+ * struct tee_ioctl_buf_data - Variable sized buffer
+ * @buf_ptr:    [in] A __user pointer to a buffer
+ * @buf_len:    [in] Length of the buffer above
+ *
+ * Used as argument for TEE_IOC_OPEN_SESSION, TEE_IOC_INVOKE,
+ * TEE_IOC_SUPPL_RECV, and TEE_IOC_SUPPL_SEND below.
+ */
+struct tee_ioctl_buf_data {
+        __u64 buf_ptr;
+        __u64 buf_len;
+};
+
+/*
+ * Attributes for struct tee_ioctl_param, selects field in the union
+ */
+#define TEE_IOCTL_PARAM_ATTR_TYPE_NONE          0       /* parameter not used */
+
+/*
+ * These defines value parameters (struct tee_ioctl_param_value)
+ */
+#define TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT   1
+#define TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT  2
+#define TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT   3       /* input and output */
+
+/*
+ * These defines shared memory reference parameters (struct
+ * tee_ioctl_param_memref)
+ */
+#define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT  5
+#define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT 6
+#define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT  7       /* input and output */
+
+/*
+ * Mask for the type part of the attribute, leaves room for more types
+ */
+#define TEE_IOCTL_PARAM_ATTR_TYPE_MASK          0xff
+
+/*
+ * Matches TEEC_LOGIN_* in GP TEE Client API
+ * Are only defined for GP compliant TEEs
+ */
+#define TEE_IOCTL_LOGIN_PUBLIC                  0
+#define TEE_IOCTL_LOGIN_USER                    1
+#define TEE_IOCTL_LOGIN_GROUP                   2
+#define TEE_IOCTL_LOGIN_APPLICATION             4
+#define TEE_IOCTL_LOGIN_USER_APPLICATION        5
+#define TEE_IOCTL_LOGIN_GROUP_APPLICATION       6
+
+/**
+ * struct tee_ioctl_param - parameter
+ * @attr: attributes
+ * @a: if a memref, offset into the shared memory object, else a value parameter
+ * @b: if a memref, size of the buffer, else a value parameter
+ * @c: if a memref, shared memory identifier, else a value parameter
+ *
+ * @attr & TEE_PARAM_ATTR_TYPE_MASK indicates if memref or value is used in
+ * the union. TEE_PARAM_ATTR_TYPE_VALUE_* indicates value and
+ * TEE_PARAM_ATTR_TYPE_MEMREF_* indicates memref. TEE_PARAM_ATTR_TYPE_NONE
+ * indicates that none of the members are used.
+ *
+ * Shared memory is allocated with TEE_IOC_SHM_ALLOC which returns an
+ * identifier representing the shared memory object. A memref can reference
+ * a part of a shared memory by specifying an offset (@a) and size (@b) of
+ * the object. To supply the entire shared memory object set the offset
+ * (@a) to 0 and size (@b) to the previously returned size of the object.
+ */
+struct tee_ioctl_param {
+        __u64 attr;
+        __u64 a;
+        __u64 b;
+        __u64 c;
+};
+
+#define TEE_IOCTL_UUID_LEN              16
+
+/**
+ * struct tee_ioctl_open_session_arg - Open session argument
+ * @uuid:       [in] UUID of the Trusted Application
+ * @clnt_uuid:  [in] UUID of client
+ * @clnt_login: [in] Login class of client, TEE_IOCTL_LOGIN_* above
+ * @cancel_id:  [in] Cancellation id, a unique value to identify this request
+ * @session:    [out] Session id
+ * @ret:        [out] return value
+ * @ret_origin  [out] origin of the return value