[Feature] add GA346 baseline version
Change-Id: Ic62933698569507dcf98240cdf5d9931ae34348f
diff --git a/src/kernel/linux/v4.19/drivers/tee/Kconfig b/src/kernel/linux/v4.19/drivers/tee/Kconfig
new file mode 100644
index 0000000..3b54f6b
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/Kconfig
@@ -0,0 +1,21 @@
+# Generic Trusted Execution Environment Configuration
+config TEE
+ tristate "Trusted Execution Environment support"
+ depends on HAVE_ARM_SMCCC || COMPILE_TEST
+ select DMA_SHARED_BUFFER
+ select GENERIC_ALLOCATOR
+ help
+ This implements a generic interface towards a Trusted Execution
+ Environment (TEE).
+
+if TEE
+
+menu "TEE drivers"
+
+source "drivers/tee/optee/Kconfig"
+source "drivers/tee/gud/Kconfig"
+source "drivers/tee/tkcore/Kconfig"
+
+endmenu
+
+endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/Makefile b/src/kernel/linux/v4.19/drivers/tee/Makefile
new file mode 100644
index 0000000..d732359
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/Makefile
@@ -0,0 +1,8 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_TEE) += tee.o
+tee-objs += tee_core.o
+tee-objs += tee_shm.o
+tee-objs += tee_shm_pool.o
+obj-$(CONFIG_OPTEE) += optee/
+obj-$(CONFIG_TRUSTONIC_TEE_SUPPORT) += gud/
+obj-$(CONFIG_TRUSTKERNEL_TEE_SUPPORT) += tkcore/
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/Kconfig b/src/kernel/linux/v4.19/drivers/tee/gud/410/Kconfig
new file mode 100644
index 0000000..d247f05
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/Kconfig
@@ -0,0 +1,49 @@
+#
+# Trustonic drivers configuration
+#
+config TRUSTONIC_TEE
+ tristate "Trustonic TEE Driver"
+ depends on ARM || ARM64
+ default y
+ help
+ Enable Trustonic TEE Support.
+ This option enables MobiCore Driver which is used to communicate with
+ TEE OS, for things like, setting up log buffers, interrupt pins,
+ and IPC channels.
+
+config TRUSTONIC_TEE_LPAE
+ bool "Trustonic TEE uses LPAE"
+ depends on TRUSTONIC_TEE
+ default y if ARM64
+ default n if ARM
+ help
+ Enable Trustonic TEE 64-bit physical addresses support.
+ This allows 32-bit trusted driver has capabilities of map/unmap
+ 64-bit physical addresses, which is useful in device equipped with
+ RAM size more than 4GB.
+
+config TRUSTONIC_TEE_DEBUG
+ bool "Trustonic TEE driver debug mode"
+ depends on TRUSTONIC_TEE
+ default n
+ help
+ Enable the debug mode in the Trustonic TEE Driver.
+ Enable Debug mode in the MobiCore Driver.
+ MobiCore Driver has loglevel control thru DEBUG and VERBOSE
+ This option enables MCDRV_DBG() macros to print useful debugging
+ information about mobicore operations.
+
+config TRUSTONIC_TRUSTED_UI
+ tristate "Trustonic Trusted UI"
+ depends on TRUSTONIC_TEE
+ help
+ Enable Trustonic Trusted User Interface
+ Trustonic TUI features was based on Trustonic TEE mechanism to protect
+ Touch/Display inside TEE, to prevent malicious access of sensitive
+ data used by APPs like Banking.
+
+config TRUSTONIC_TRUSTED_UI_FB_BLANK
+ bool "Trustonic Trusted UI with fb_blank"
+ depends on TRUSTONIC_TRUSTED_UI
+ help
+ Blank the framebuffer before starting a TUI session
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/Makefile b/src/kernel/linux/v4.19/drivers/tee/gud/410/Makefile
new file mode 100644
index 0000000..63aec37
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/Makefile
@@ -0,0 +1,18 @@
+# Copyright (c) 2013-2018 TRUSTONIC LIMITED
+# All Rights Reserved.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# version 2 as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+#
+# Makefile for the Kinibi core and trusted UI drivers
+#
+export GUD_ROOT_FOLDER := $(dir $(lastword $(MAKEFILE_LIST)))
+obj-$(CONFIG_TRUSTONIC_TEE_SUPPORT) := MobiCoreDriver/
+obj-$(CONFIG_TRUSTONIC_TRUSTED_UI) += TlcTui/
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/Makefile b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/Makefile
new file mode 100644
index 0000000..23bc4c6
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/Makefile
@@ -0,0 +1,49 @@
+# Copyright (c) 2013-2018 TRUSTONIC LIMITED
+# All Rights Reserved.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# version 2 as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+#
+# Makefile for the Kinibi core driver
+#
+
+GUD_ROOT_FOLDER := drivers/gud/
+
+# add our modules to kernel.
+obj-$(CONFIG_TRUSTONIC_TEE_SUPPORT) += mcDrvModule.o
+
+mcDrvModule-y := \
+ admin.o \
+ client.o \
+ clientlib.o \
+ clock.o \
+ fastcall.o \
+ iwp.o \
+ logging.o \
+ main.o \
+ mcp.o \
+ mmu.o \
+ nq.o \
+ session.o \
+ teeclientapi.o \
+ user.o \
+ xen_be.o \
+ xen_common.o \
+ xen_fe.o
+
+# Release mode by default
+ccflags-y += -DNDEBUG
+ccflags-y += -Wno-declaration-after-statement
+
+ccflags-$(CONFIG_TRUSTONIC_TEE_DEBUG) += -DDEBUG
+
+# MobiCore Driver includes
+ccflags-y += -I$(GUD_ROOT_FOLDER)/MobiCoreDriver
+ccflags-y += -I$(srctree)/drivers/staging/android/ion
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/admin.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/admin.c
new file mode 100644
index 0000000..2e6adff
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/admin.c
@@ -0,0 +1,1166 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/mutex.h>
+#include <linux/cdev.h>
+#include <linux/fs.h>
+#include <linux/ioctl.h>
+#include <linux/uaccess.h>
+#include <linux/sched.h>
+#include <linux/completion.h>
+#include <linux/vmalloc.h>
+#include <linux/module.h>
+#include <linux/random.h>
+#include <linux/delay.h>
+#include <linux/version.h>
+#include <linux/sched/signal.h>
+#include <linux/freezer.h>
+
+#include "public/mc_user.h"
+#include "public/mc_admin.h"
+
+#include "main.h"
+#include "mmu.h" /* For load_check and load_token */
+#include "mcp.h"
+#include "nq.h"
+#include "client.h"
+#include "admin.h"
+
+static struct {
+ struct mutex admin_tgid_mutex; /* Lock for admin_tgid below */
+ pid_t admin_tgid;
+ int (*tee_start_cb)(void);
+ void (*tee_stop_cb)(void);
+ int last_tee_ret;
+ struct notifier_block tee_stop_notifier;
+} l_ctx;
+
+static struct mc_admin_driver_request {
+ /* Global */
+ struct mutex mutex; /* Protects access to this struct */
+ struct mutex states_mutex; /* Protect access to the states */
+ enum client_state {
+ IDLE,
+ REQUEST_SENT,
+ BUFFERS_READY,
+ } client_state;
+ enum server_state {
+ NOT_CONNECTED, /* Device not open */
+ READY, /* Waiting for requests */
+ REQUEST_RECEIVED, /* Got a request, is working */
+ RESPONSE_SENT, /* Has sent a response header */
+ DATA_SENT, /* Blocked until data is consumed */
+ } server_state;
+ /* Request */
+ u32 request_id;
+ struct mc_admin_request request;
+ struct completion client_complete;
+ /* Response */
+ struct mc_admin_response response;
+ struct completion server_complete;
+ void *buffer; /* Reception buffer (pre-allocated) */
+ size_t size; /* Size of the reception buffer */
+ bool lock_channel_during_freeze;/* Is freezing ongoing ? */
+} g_request;
+
+/* The mutex around the channel communication has to be wrapped in order
+ * to handle this use case :
+ * client 1 calls request_send()
+ * wait on wait_for_completion_interruptible (with channel mutex taken)
+ * client 2 calls request_send()
+ * waits on mutex_lock(channel mutex)
+ * kernel starts freezing tasks (suspend or reboot ongoing)
+ * if we do nothing, then the freezing will be aborted because client 1
+ * and 2 have to enter the refrigerator by themselves.
+ * Note : mutex cannot be held during freezing, so client 1 has release it
+ * => step 1 : client 1 sets a bool that says that the channel is still in use
+ * => step 2 : client 1 release the lock and enter the refrigerator
+ * => now any client trying to use the channel will face the bool preventing
+ * to use the channel. They also have to enter the refrigerator.
+ *
+ * These 3 functions handle this
+ */
+static void check_freezing_ongoing(void)
+{
+ /* We don't want to let the channel be used. Let everyone know
+ * that we're using it
+ */
+ g_request.lock_channel_during_freeze = 1;
+ /* Now we can safely release the lock */
+ mutex_unlock(&g_request.mutex);
+ /* Let's try to freeze */
+ try_to_freeze();
+ /* Either freezing happened or was canceled.
+ * In both cases, reclaim the lock
+ */
+ mutex_lock(&g_request.mutex);
+ g_request.lock_channel_during_freeze = 0;
+}
+
+static void channel_lock(void)
+{
+ while (1) {
+ mutex_lock(&g_request.mutex);
+ /* We took the lock, but is there any freezing ongoing? */
+ if (g_request.lock_channel_during_freeze == 0)
+ break;
+
+ /* yes, so let's freeze */
+ mutex_unlock(&g_request.mutex);
+ try_to_freeze();
+ /* Either freezing succeeded or was canceled.
+ * In both case, try again to get the lock.
+ * Give some CPU time to let the contender
+ * finish his channel operation
+ */
+ msleep(500);
+ };
+}
+
+static void channel_unlock(void)
+{
+ mutex_unlock(&g_request.mutex);
+}
+
+static inline void reinit_completion_local(struct completion *x)
+{
+ reinit_completion(x);
+}
+
+static struct tee_object *tee_object_alloc(bool is_sp_trustlet, size_t length)
+{
+ struct tee_object *obj;
+ size_t size = sizeof(*obj) + length;
+ size_t header_length = 0;
+
+ /* Determine required size */
+ if (is_sp_trustlet) {
+ /* Need space for lengths info and containers */
+ header_length = sizeof(struct mc_blob_len_info);
+ size += header_length + 3 * MAX_SO_CONT_SIZE;
+ }
+
+ /* Check size for overflow */
+ if (size < length || size > OBJECT_LENGTH_MAX) {
+ mc_dev_err(-ENOMEM, "cannot allocate object of size %zu",
+ length);
+ return NULL;
+ }
+
+ /* Allocate memory */
+ obj = vzalloc(size);
+ if (!obj)
+ return NULL;
+
+ /* A non-zero header_length indicates that we have a SP trustlet */
+ obj->header_length = (u32)header_length;
+ obj->length = (u32)length;
+ return obj;
+}
+
+void tee_object_free(struct tee_object *obj)
+{
+ vfree(obj);
+}
+
+static inline void client_state_change(enum client_state state)
+{
+ mutex_lock(&g_request.states_mutex);
+ mc_dev_devel("client state changes from %d to %d",
+ g_request.client_state, state);
+ g_request.client_state = state;
+ mutex_unlock(&g_request.states_mutex);
+}
+
+static inline bool client_state_is(enum client_state state)
+{
+ bool is;
+
+ mutex_lock(&g_request.states_mutex);
+ is = g_request.client_state == state;
+ mutex_unlock(&g_request.states_mutex);
+ return is;
+}
+
+static inline void server_state_change(enum server_state state)
+{
+ mutex_lock(&g_request.states_mutex);
+ mc_dev_devel("server state changes from %d to %d",
+ g_request.server_state, state);
+ g_request.server_state = state;
+ mutex_unlock(&g_request.states_mutex);
+}
+
+static inline bool server_state_is(enum server_state state)
+{
+ bool is;
+
+ mutex_lock(&g_request.states_mutex);
+ is = g_request.server_state == state;
+ mutex_unlock(&g_request.states_mutex);
+ return is;
+}
+
+static void request_cancel(void);
+
+static int request_send(u32 command, const struct mc_uuid_t *uuid, bool is_gp,
+ u32 spid)
+{
+ int counter = 0;
+ int wait_tens = 0;
+ int ret = 0;
+
+ /* Prepare request */
+ mutex_lock(&g_request.states_mutex);
+ /* Wait a little for daemon to connect */
+ while (g_request.server_state == NOT_CONNECTED) {
+ mutex_unlock(&g_request.states_mutex);
+ if (signal_pending(current))
+ return -ERESTARTSYS;
+
+ if (counter++ == 10) {
+ wait_tens++;
+ mc_dev_info("daemon not connected after %d0s, waiting",
+ wait_tens);
+ counter = 0;
+ }
+
+ ssleep(1);
+ mutex_lock(&g_request.states_mutex);
+ }
+
+ WARN_ON(g_request.client_state != IDLE);
+ if (g_request.server_state != READY) {
+ mutex_unlock(&g_request.states_mutex);
+ if (g_request.server_state != NOT_CONNECTED) {
+ ret = -EPROTO;
+ mc_dev_err(ret, "invalid daemon state %d",
+ g_request.server_state);
+ goto end;
+ } else {
+ ret = -EHOSTUNREACH;
+ mc_dev_err(ret, "daemon not connected");
+ goto end;
+ }
+ }
+
+ memset(&g_request.request, 0, sizeof(g_request.request));
+ memset(&g_request.response, 0, sizeof(g_request.response));
+ /*
+ * Do not update the request ID until it is dealt with, in case the
+ * daemon arrives later.
+ */
+ g_request.request.request_id = g_request.request_id;
+ g_request.request.command = command;
+ if (uuid)
+ memcpy(&g_request.request.uuid, uuid, sizeof(*uuid));
+ else
+ memset(&g_request.request.uuid, 0, sizeof(*uuid));
+
+ g_request.request.is_gp = is_gp;
+ g_request.request.spid = spid;
+ g_request.client_state = REQUEST_SENT;
+ mutex_unlock(&g_request.states_mutex);
+
+ /* Send request */
+ complete(&g_request.client_complete);
+ mc_dev_devel("request sent");
+
+ /* Wait for header */
+ do {
+ ret = wait_for_completion_interruptible(
+ &g_request.server_complete);
+ if (!ret)
+ break;
+ /* we may have to freeze now */
+ check_freezing_ongoing();
+ /* freezing happened or was canceled,
+ * let's sleep and try again
+ */
+ msleep(500);
+ } while (1);
+ mc_dev_devel("response received");
+
+ /* Server should be waiting with some data for us */
+ mutex_lock(&g_request.states_mutex);
+ switch (g_request.server_state) {
+ case NOT_CONNECTED:
+ /* Daemon gone */
+ ret = -EPIPE;
+ mc_dev_devel("daemon disconnected");
+ break;
+ case READY:
+ /* No data to come, likely an error */
+ ret = -g_request.response.error_no;
+ mc_dev_devel("daemon ret=%d", ret);
+ break;
+ case RESPONSE_SENT:
+ case DATA_SENT:
+ /* Normal case, data to come */
+ ret = 0;
+ break;
+ case REQUEST_RECEIVED:
+ /* Should not happen as complete means the state changed */
+ ret = -EPIPE;
+ mc_dev_err(ret, "daemon is in a bad state: %d",
+ g_request.server_state);
+ break;
+ }
+
+ mutex_unlock(&g_request.states_mutex);
+
+end:
+ if (ret)
+ request_cancel();
+
+ mc_dev_devel("ret=%d", ret);
+ return ret;
+}
+
+static int request_receive(void *address, u32 size)
+{
+ /*
+ * At this point we have received the header and prepared some buffers
+ * to receive data that we know are coming from the server.
+ */
+
+ /* Check server state */
+ bool server_ok;
+
+ mutex_lock(&g_request.states_mutex);
+ server_ok = (g_request.server_state == RESPONSE_SENT) ||
+ (g_request.server_state == DATA_SENT);
+ mutex_unlock(&g_request.states_mutex);
+ if (!server_ok) {
+ int ret = -EPIPE;
+
+ mc_dev_err(ret, "expected server state %d or %d, not %d",
+ RESPONSE_SENT, DATA_SENT, g_request.server_state);
+ request_cancel();
+ return ret;
+ }
+
+ /* Setup reception buffer */
+ g_request.buffer = address;
+ g_request.size = size;
+ client_state_change(BUFFERS_READY);
+
+ /* Unlock write of data */
+ complete(&g_request.client_complete);
+
+ /* Wait for data */
+ do {
+ int ret = 0;
+
+ ret = wait_for_completion_interruptible(
+ &g_request.server_complete);
+ if (!ret)
+ break;
+ /* We may have to freeze now */
+ check_freezing_ongoing();
+ /* freezing happened or was canceled,
+ * let's sleep and try again
+ */
+ msleep(500);
+ } while (1);
+
+ /* Reset reception buffer */
+ g_request.buffer = NULL;
+ g_request.size = 0;
+
+ /* Return to idle state */
+ client_state_change(IDLE);
+ return 0;
+}
+
+/* Must be called instead of request_receive() to cancel a pending request */
+static void request_cancel(void)
+{
+ /* Unlock write of data */
+ mutex_lock(&g_request.states_mutex);
+ if (g_request.server_state == DATA_SENT)
+ complete(&g_request.client_complete);
+
+ /* Return to idle state */
+ g_request.client_state = IDLE;
+ mutex_unlock(&g_request.states_mutex);
+}
+
+static int admin_get_root_container(void *address)
+{
+ int ret = 0;
+
+ /* Lock communication channel */
+ channel_lock();
+
+ /* Send request and wait for header */
+ ret = request_send(MC_DRV_GET_ROOT_CONTAINER, NULL, 0, 0);
+ if (ret)
+ goto end;
+
+ /* Check length against max */
+ if (g_request.response.length >= MAX_SO_CONT_SIZE) {
+ request_cancel();
+ ret = EREMOTEIO;
+ mc_dev_err(ret, "response length exceeds maximum");
+ goto end;
+ }
+
+ /* Get data */
+ ret = request_receive(address, g_request.response.length);
+ if (!ret)
+ ret = g_request.response.length;
+
+end:
+ channel_unlock();
+ return ret;
+}
+
+static int admin_get_sp_container(void *address, u32 spid)
+{
+ int ret = 0;
+
+ /* Lock communication channel */
+ channel_lock();
+
+ /* Send request and wait for header */
+ ret = request_send(MC_DRV_GET_SP_CONTAINER, NULL, 0, spid);
+ if (ret)
+ goto end;
+
+ /* Check length against max */
+ if (g_request.response.length >= MAX_SO_CONT_SIZE) {
+ request_cancel();
+ ret = EREMOTEIO;
+ mc_dev_err(ret, "response length exceeds maximum");
+ goto end;
+ }
+
+ /* Get data */
+ ret = request_receive(address, g_request.response.length);
+ if (!ret)
+ ret = g_request.response.length;
+
+end:
+ channel_unlock();
+ return ret;
+}
+
+static int admin_get_trustlet_container(void *address,
+ const struct mc_uuid_t *uuid, u32 spid)
+{
+ int ret = 0;
+
+ /* Lock communication channel */
+ channel_lock();
+
+ /* Send request and wait for header */
+ ret = request_send(MC_DRV_GET_TRUSTLET_CONTAINER, uuid, 0, spid);
+ if (ret)
+ goto end;
+
+ /* Check length against max */
+ if (g_request.response.length >= MAX_SO_CONT_SIZE) {
+ request_cancel();
+ ret = EREMOTEIO;
+ mc_dev_err(ret, "response length exceeds maximum");
+ goto end;
+ }
+
+ /* Get data */
+ ret = request_receive(address, g_request.response.length);
+ if (!ret)
+ ret = g_request.response.length;
+
+end:
+ channel_unlock();
+ return ret;
+}
+
+static struct tee_object *admin_get_trustlet(const struct mc_uuid_t *uuid,
+ bool is_gp, u32 *spid)
+{
+ struct tee_object *obj = NULL;
+ bool is_sp_tl;
+ int ret = 0;
+
+ /* Lock communication channel */
+ channel_lock();
+
+ /* Send request and wait for header */
+ ret = request_send(MC_DRV_GET_TRUSTLET, uuid, is_gp, 0);
+ if (ret)
+ goto end;
+
+ /* Allocate memory */
+ is_sp_tl = g_request.response.service_type == SERVICE_TYPE_SP_TRUSTLET;
+ obj = tee_object_alloc(is_sp_tl, g_request.response.length);
+ if (!obj) {
+ request_cancel();
+ ret = -ENOMEM;
+ goto end;
+ }
+
+ /* Get data */
+ ret = request_receive(&obj->data[obj->header_length], obj->length);
+ *spid = g_request.response.spid;
+
+end:
+ channel_unlock();
+ if (ret)
+ return ERR_PTR(ret);
+
+ return obj;
+}
+
+static void mc_admin_sendcrashdump(void)
+{
+ int ret = 0;
+
+ /* Lock communication channel */
+ channel_lock();
+
+ /* Send request and wait for header */
+ ret = request_send(MC_DRV_SIGNAL_CRASH, NULL, false, 0);
+ if (ret)
+ goto end;
+
+ /* Done */
+ request_cancel();
+
+end:
+ channel_unlock();
+}
+
+static int tee_stop_notifier_fn(struct notifier_block *nb, unsigned long event,
+ void *data)
+{
+ mc_admin_sendcrashdump();
+ l_ctx.last_tee_ret = -EHOSTUNREACH;
+ return 0;
+}
+
+static int tee_object_make(u32 spid, struct tee_object *obj)
+{
+ struct mc_blob_len_info *l_info = (struct mc_blob_len_info *)obj->data;
+ u8 *address = &obj->data[obj->header_length + obj->length];
+ struct mclf_header_v2 *thdr;
+ int ret;
+
+ /* Get root container */
+ ret = admin_get_root_container(address);
+ if (ret < 0)
+ goto err;
+
+ l_info->root_size = ret;
+ address += ret;
+
+ /* Get SP container */
+ ret = admin_get_sp_container(address, spid);
+ if (ret < 0)
+ goto err;
+
+ l_info->sp_size = ret;
+ address += ret;
+
+ /* Get trustlet container */
+ thdr = (struct mclf_header_v2 *)&obj->data[obj->header_length];
+ ret = admin_get_trustlet_container(address, &thdr->uuid, spid);
+ if (ret < 0)
+ goto err;
+
+ l_info->ta_size = ret;
+ address += ret;
+
+ /* Setup lengths information */
+ l_info->magic = MC_TLBLOBLEN_MAGIC;
+ obj->length += sizeof(*l_info);
+ obj->length += l_info->root_size + l_info->sp_size + l_info->ta_size;
+ ret = 0;
+
+err:
+ return ret;
+}
+
+struct tee_object *tee_object_copy(uintptr_t address, size_t length)
+{
+ struct tee_object *obj;
+
+ /* Allocate memory */
+ obj = tee_object_alloc(false, length);
+ if (!obj)
+ return ERR_PTR(-ENOMEM);
+
+ /* Copy trustlet */
+ memcpy(obj->data, (void *)address, length);
+ return obj;
+}
+
+struct tee_object *tee_object_read(u32 spid, uintptr_t address, size_t length)
+{
+ char __user *addr = (char __user *)address;
+ struct tee_object *obj;
+ u8 *data;
+ struct mclf_header_v2 thdr;
+ int ret;
+
+ /* Check length */
+ if (length < sizeof(thdr)) {
+ ret = -EFAULT;
+ mc_dev_err(ret, "buffer shorter than header size");
+ return ERR_PTR(ret);
+ }
+
+ /* Read header */
+ if (copy_from_user(&thdr, addr, sizeof(thdr))) {
+ ret = -EFAULT;
+ mc_dev_err(ret, "header: copy_from_user failed");
+ return ERR_PTR(ret);
+ }
+
+ /* Check header */
+ if ((thdr.intro.magic != MC_SERVICE_HEADER_MAGIC_BE) &&
+ (thdr.intro.magic != MC_SERVICE_HEADER_MAGIC_LE)) {
+ ret = -EINVAL;
+ mc_dev_err(ret, "header: invalid magic");
+ return ERR_PTR(ret);
+ }
+
+ /* Allocate memory */
+ obj = tee_object_alloc(thdr.service_type == SERVICE_TYPE_SP_TRUSTLET,
+ length);
+ if (!obj)
+ return ERR_PTR(-ENOMEM);
+
+ /* Copy header */
+ data = &obj->data[obj->header_length];
+ memcpy(data, &thdr, sizeof(thdr));
+ /* Copy the rest of the data */
+ data += sizeof(thdr);
+ if (copy_from_user(data, &addr[sizeof(thdr)], length - sizeof(thdr))) {
+ ret = -EFAULT;
+ mc_dev_err(ret, "data: copy_from_user failed");
+ vfree(obj);
+ return ERR_PTR(ret);
+ }
+
+ if (obj->header_length) {
+ ret = tee_object_make(spid, obj);
+ if (ret) {
+ vfree(obj);
+ return ERR_PTR(ret);
+ }
+ }
+
+ return obj;
+}
+
+struct tee_object *tee_object_select(const struct mc_uuid_t *uuid)
+{
+ struct tee_object *obj;
+ struct mclf_header_v2 *thdr;
+
+ obj = tee_object_alloc(false, sizeof(*thdr));
+ if (!obj)
+ return ERR_PTR(-ENOMEM);
+
+ thdr = (struct mclf_header_v2 *)&obj->data[obj->header_length];
+ memcpy(&thdr->uuid, uuid, sizeof(thdr->uuid));
+ return obj;
+}
+
+struct tee_object *tee_object_get(const struct mc_uuid_t *uuid, bool is_gp)
+{
+ struct tee_object *obj;
+ u32 spid = 0;
+
+ /* admin_get_trustlet creates the right object based on service type */
+ obj = admin_get_trustlet(uuid, is_gp, &spid);
+ if (IS_ERR(obj))
+ return obj;
+
+ /* SP trustlet: create full secure object with all containers */
+ if (obj->header_length) {
+ int ret;
+
+ /* Do not return EINVAL in this case as SPID was not found */
+ if (!spid) {
+ vfree(obj);
+ return ERR_PTR(-ENOENT);
+ }
+
+ ret = tee_object_make(spid, obj);
+ if (ret) {
+ vfree(obj);
+ return ERR_PTR(ret);
+ }
+ }
+
+ return obj;
+}
+
+static inline int load_driver(struct tee_client *client,
+ struct mc_admin_load_info *load_info)
+{
+ struct mcp_open_info info = {
+ .spid = load_info->spid,
+ .va = load_info->address,
+ .len = load_info->length,
+ .uuid = &load_info->uuid,
+ .tci_len = PAGE_SIZE,
+ .user = true,
+ };
+
+ u32 session_id = 0;
+ int ret;
+
+ if (info.va)
+ info.type = TEE_MC_DRIVER;
+ else
+ info.type = TEE_MC_DRIVER_UUID;
+
+ /* Create DCI in case it's needed */
+ ret = client_cbuf_create(client, info.tci_len, &info.tci_va, NULL);
+ if (ret)
+ return ret;
+
+ /* Open session */
+ ret = client_mc_open_common(client, &info, &session_id);
+ if (!ret)
+ mc_dev_devel("driver loaded with session id %x", session_id);
+
+ /*
+ * Always 'free' the buffer (will remain as long as used), never freed
+ * otherwise
+ */
+ client_cbuf_free(client, info.tci_va);
+
+ return ret;
+}
+
+static inline int load_token(struct mc_admin_load_info *token)
+{
+ struct tee_mmu *mmu;
+ struct mcp_buffer_map map;
+ struct mc_ioctl_buffer buf;
+ int ret;
+
+ buf.va = (uintptr_t)token->address;
+ buf.len = token->length;
+ buf.flags = MC_IO_MAP_INPUT;
+ mmu = tee_mmu_create(current->mm, &buf);
+ if (IS_ERR(mmu))
+ return PTR_ERR(mmu);
+
+ tee_mmu_buffer(mmu, &map);
+ ret = mcp_load_token(token->address, &map);
+ tee_mmu_put(mmu);
+ return ret;
+}
+
+static inline int load_check(struct mc_admin_load_info *info)
+{
+ struct tee_object *obj;
+ struct tee_mmu *mmu;
+ struct mcp_buffer_map map;
+ struct mc_ioctl_buffer buf;
+ int ret;
+
+ obj = tee_object_read(info->spid, info->address, info->length);
+ if (IS_ERR(obj))
+ return PTR_ERR(obj);
+
+ buf.va = (uintptr_t)obj->data;
+ buf.len = obj->length;
+ buf.flags = MC_IO_MAP_INPUT;
+ mmu = tee_mmu_create(NULL, &buf);
+ if (IS_ERR(mmu))
+ return PTR_ERR(mmu);
+
+ tee_mmu_buffer(mmu, &map);
+ ret = mcp_load_check(obj, &map);
+ tee_mmu_put(mmu);
+ return ret;
+}
+
+static inline int load_key_so(struct mc_admin_load_info *key_so)
+{
+ struct tee_mmu *mmu;
+ struct mcp_buffer_map map;
+ struct mc_ioctl_buffer buf;
+ int ret;
+
+ buf.va = (uintptr_t)key_so->address;
+ buf.len = key_so->length;
+ buf.flags = MC_IO_MAP_INPUT;
+ mmu = tee_mmu_create(current->mm, &buf);
+ if (IS_ERR(mmu))
+ return PTR_ERR(mmu);
+
+ tee_mmu_buffer(mmu, &map);
+ ret = mcp_load_key_so(key_so->address, &map);
+ tee_mmu_put(mmu);
+ return ret;
+}
+
+static ssize_t admin_write(struct file *file, const char __user *user,
+ size_t len, loff_t *off)
+{
+ int ret;
+
+ /* No offset allowed */
+ if (*off) {
+ ret = -ECOMM;
+ mc_dev_err(ret, "offset not supported");
+ g_request.response.error_no = EPIPE;
+ goto err;
+ }
+
+ if (server_state_is(REQUEST_RECEIVED)) {
+ /* Check client state */
+ if (!client_state_is(REQUEST_SENT)) {
+ ret = -EPIPE;
+ mc_dev_err(ret, "expected client state %d, not %d",
+ REQUEST_SENT, g_request.client_state);
+ g_request.response.error_no = EPIPE;
+ goto err;
+ }
+
+ /* Receive response header */
+ if (copy_from_user(&g_request.response, user,
+ sizeof(g_request.response))) {
+ ret = -ECOMM;
+ mc_dev_err(ret, "failed to get response from daemon");
+ g_request.response.error_no = EPIPE;
+ goto err;
+ }
+
+ /* Check request ID */
+ if (g_request.request.request_id !=
+ g_request.response.request_id) {
+ ret = -EBADE;
+ mc_dev_err(ret, "expected id %d, not %d",
+ g_request.request.request_id,
+ g_request.response.request_id);
+ g_request.response.error_no = EPIPE;
+ goto err;
+ }
+
+ /* Response header is acceptable */
+ ret = sizeof(g_request.response);
+ if (g_request.response.length)
+ server_state_change(RESPONSE_SENT);
+ else
+ server_state_change(READY);
+
+ goto end;
+ } else if (server_state_is(RESPONSE_SENT)) {
+ /* Server is waiting */
+ server_state_change(DATA_SENT);
+
+ /* Get data */
+ ret = wait_for_completion_interruptible(
+ &g_request.client_complete);
+
+ /* Server received a signal, let see if it tries again */
+ if (ret) {
+ server_state_change(RESPONSE_SENT);
+ return ret;
+ }
+
+ /* Check client state */
+ if (!client_state_is(BUFFERS_READY)) {
+ ret = -EPIPE;
+ mc_dev_err(ret, "expected client state %d, not %d",
+ BUFFERS_READY, g_request.client_state);
+ g_request.response.error_no = EPIPE;
+ goto err;
+ }
+
+ /* We do not deal with several writes */
+ if (len != g_request.size)
+ len = g_request.size;
+
+ ret = copy_from_user(g_request.buffer, user, len);
+ if (ret) {
+ ret = -ECOMM;
+ mc_dev_err(ret, "failed to get data from daemon");
+ g_request.response.error_no = EPIPE;
+ goto err;
+ }
+
+ ret = len;
+ server_state_change(READY);
+ goto end;
+ } else {
+ ret = -ECOMM;
+ goto err;
+ }
+
+err:
+ server_state_change(READY);
+end:
+ complete(&g_request.server_complete);
+ return ret;
+}
+
+static ssize_t admin_read(struct file *file, char __user *user, size_t len,
+ loff_t *off)
+{
+ /* No offset allowed */
+ if (*off) {
+ int ret = -ECOMM;
+
+ mc_dev_err(ret, "offset not supported");
+ return ret;
+ }
+
+ return nq_get_stop_message(user, len);
+}
+
+static long admin_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ void __user *uarg = (void __user *)arg;
+ int ret = -EINVAL;
+
+ mc_dev_devel("%u from %s", _IOC_NR(cmd), current->comm);
+
+ switch (cmd) {
+ case MC_ADMIN_IO_GET_DRIVER_REQUEST: {
+ /* Update TGID as it may change (when becoming a daemon) */
+ if (l_ctx.admin_tgid != current->tgid) {
+ l_ctx.admin_tgid = current->tgid;
+ mc_dev_info("daemon PID changed to %d",
+ l_ctx.admin_tgid);
+ }
+
+ /* Block until a request is available */
+ server_state_change(READY);
+ ret = wait_for_completion_interruptible(
+ &g_request.client_complete);
+ if (ret)
+ /* Interrupted by signal */
+ break;
+
+ /* Check client state */
+ if (!client_state_is(REQUEST_SENT)) {
+ ret = -EPIPE;
+ mc_dev_err(ret, "expected client state %d, not %d",
+ REQUEST_SENT, g_request.client_state);
+ g_request.response.error_no = EPIPE;
+ complete(&g_request.server_complete);
+ break;
+ }
+
+ /* Send request (the driver request mutex is held) */
+ ret = copy_to_user(uarg, &g_request.request,
+ sizeof(g_request.request));
+ if (ret) {
+ server_state_change(READY);
+ complete(&g_request.server_complete);
+ ret = -EPROTO;
+ break;
+ }
+
+ /* Now that the daemon got it, update the request ID */
+ g_request.request_id++;
+
+ server_state_change(REQUEST_RECEIVED);
+ break;
+ }
+ case MC_ADMIN_IO_GET_INFO: {
+ struct mc_admin_driver_info info;
+
+ info.drv_version = MC_VERSION(MCDRVMODULEAPI_VERSION_MAJOR,
+ MCDRVMODULEAPI_VERSION_MINOR);
+ info.initial_cmd_id = g_request.request_id;
+ ret = copy_to_user(uarg, &info, sizeof(info));
+ break;
+ }
+ case MC_ADMIN_IO_LOAD_DRIVER: {
+ struct tee_client *client = file->private_data;
+ struct mc_admin_load_info info;
+
+ if (copy_from_user(&info, uarg, sizeof(info))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ /* Make sure we have a local client */
+ if (!client) {
+ client = client_create(true);
+ /* Store client for future use/close */
+ file->private_data = client;
+ }
+
+ if (!client) {
+ ret = -ENOMEM;
+ break;
+ }
+
+ ret = load_driver(client, &info);
+ break;
+ }
+ case MC_ADMIN_IO_LOAD_TOKEN: {
+ struct mc_admin_load_info info;
+
+ if (copy_from_user(&info, uarg, sizeof(info))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = load_token(&info);
+ break;
+ }
+ case MC_ADMIN_IO_LOAD_CHECK: {
+ struct mc_admin_load_info info;
+
+ if (copy_from_user(&info, uarg, sizeof(info))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = load_check(&info);
+ break;
+ }
+ case MC_ADMIN_IO_LOAD_KEY_SO: {
+ struct mc_admin_load_info info;
+
+ if (copy_from_user(&info, uarg, sizeof(info))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = load_key_so(&info);
+ break;
+ }
+ default:
+ ret = -ENOIOCTLCMD;
+ }
+
+ return ret;
+}
+
+/*
+ * mc_fd_release() - This function will be called from user space as close(...)
+ * The client data are freed and the associated memory pages are unreserved.
+ *
+ * @inode
+ * @file
+ *
+ * Returns 0
+ */
+static int admin_release(struct inode *inode, struct file *file)
+{
+ /* Close client if any */
+ if (file->private_data)
+ client_close((struct tee_client *)file->private_data);
+
+ /* Requests from driver to daemon */
+ mutex_lock(&g_request.states_mutex);
+ mc_dev_devel("server state changes from %d to %d",
+ g_request.server_state, NOT_CONNECTED);
+ g_request.server_state = NOT_CONNECTED;
+ /* A non-zero command indicates that a thread is waiting */
+ if (g_request.client_state != IDLE) {
+ g_request.response.error_no = ESHUTDOWN;
+ complete(&g_request.server_complete);
+ }
+ mutex_unlock(&g_request.states_mutex);
+ mc_dev_info("daemon connection closed, TGID %d", l_ctx.admin_tgid);
+ l_ctx.admin_tgid = 0;
+
+ /*
+ * ret is quite irrelevant here as most apps don't care about the
+ * return value from close() and it's quite difficult to recover
+ */
+ return 0;
+}
+
+static int admin_open(struct inode *inode, struct file *file)
+{
+ int ret = 0;
+
+ /* Only one connection allowed to admin interface */
+ mutex_lock(&l_ctx.admin_tgid_mutex);
+ if (l_ctx.admin_tgid) {
+ ret = -EBUSY;
+ mc_dev_err(ret, "daemon connection already open, PID %d",
+ l_ctx.admin_tgid);
+ } else {
+ l_ctx.admin_tgid = current->tgid;
+ }
+ mutex_unlock(&l_ctx.admin_tgid_mutex);
+ if (ret)
+ return ret;
+
+ /* Setup the usual variables */
+ mc_dev_devel("accept %s as daemon", current->comm);
+
+ /*
+ * daemon is connected so now we can safely suppose
+ * the secure world is loaded too
+ */
+ if (l_ctx.last_tee_ret == TEE_START_NOT_TRIGGERED)
+ l_ctx.last_tee_ret = l_ctx.tee_start_cb();
+
+ /* Failed to start the TEE, either now or before */
+ if (l_ctx.last_tee_ret) {
+ mutex_lock(&l_ctx.admin_tgid_mutex);
+ l_ctx.admin_tgid = 0;
+ mutex_unlock(&l_ctx.admin_tgid_mutex);
+ return l_ctx.last_tee_ret;
+ }
+
+ reinit_completion_local(&g_request.client_complete);
+ reinit_completion_local(&g_request.server_complete);
+ /* Requests from driver to daemon */
+ mc_dev_info("daemon connection open, TGID %d", l_ctx.admin_tgid);
+ return 0;
+}
+
+/* function table structure of this device driver. */
+static const struct file_operations mc_admin_fops = {
+ .owner = THIS_MODULE,
+ .open = admin_open,
+ .release = admin_release,
+ .unlocked_ioctl = admin_ioctl,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = admin_ioctl,
+#endif
+ .write = admin_write,
+ .read = admin_read,
+};
+
+int mc_admin_init(struct cdev *cdev, int (*tee_start_cb)(void),
+ void (*tee_stop_cb)(void))
+{
+ mutex_init(&l_ctx.admin_tgid_mutex);
+ /* Requests from driver to daemon */
+ mutex_init(&g_request.mutex);
+ mutex_init(&g_request.states_mutex);
+ g_request.request_id = 42;
+ init_completion(&g_request.client_complete);
+ init_completion(&g_request.server_complete);
+ l_ctx.tee_stop_notifier.notifier_call = tee_stop_notifier_fn;
+ nq_register_tee_stop_notifier(&l_ctx.tee_stop_notifier);
+ /* Create char device */
+ cdev_init(cdev, &mc_admin_fops);
+ /* Register the call back for starting the secure world */
+ l_ctx.tee_start_cb = tee_start_cb;
+ l_ctx.tee_stop_cb = tee_stop_cb;
+ l_ctx.last_tee_ret = TEE_START_NOT_TRIGGERED;
+ return 0;
+}
+
+void mc_admin_exit(void)
+{
+ nq_unregister_tee_stop_notifier(&l_ctx.tee_stop_notifier);
+ if (!l_ctx.last_tee_ret)
+ l_ctx.tee_stop_cb();
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/admin.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/admin.h
new file mode 100644
index 0000000..05eb2c3
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/admin.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_ADMIN_H_
+#define _MC_ADMIN_H_
+
+struct cdev;
+struct mc_uuid_t;
+struct tee_object;
+
+int mc_admin_init(struct cdev *cdev, int (*tee_start_cb)(void),
+ void (*tee_stop_cb)(void));
+void mc_admin_exit(void);
+
+struct tee_object *tee_object_select(const struct mc_uuid_t *uuid);
+struct tee_object *tee_object_get(const struct mc_uuid_t *uuid, bool is_gp);
+struct tee_object *tee_object_copy(uintptr_t address, size_t length);
+struct tee_object *tee_object_read(u32 spid, uintptr_t address, size_t length);
+void tee_object_free(struct tee_object *object);
+
+#endif /* _MC_ADMIN_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/arm.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/arm.h
new file mode 100644
index 0000000..9325d8f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/arm.h
@@ -0,0 +1,79 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef _MC_ARM_H_
+#define _MC_ARM_H_
+
+#include "main.h"
+
+#ifdef CONFIG_ARM64
+static inline bool has_security_extensions(void)
+{
+ return true;
+}
+
+static inline bool is_secure_mode(void)
+{
+ return false;
+}
+#else
+/*
+ * ARM Trustzone specific masks and modes
+ * Vanilla Linux is unaware of TrustZone extension.
+ * I.e. arch/arm/include/asm/ptrace.h does not define monitor mode.
+ * Also TZ bits in cpuid are not defined, ARM port uses magic numbers,
+ * see arch/arm/kernel/setup.c
+ */
+#define ARM_MONITOR_MODE (0x16) /*(0b10110)*/
+#define ARM_SECURITY_EXTENSION_MASK (0x30)
+
+/* check if CPU supports the ARM TrustZone Security Extensions */
+static inline bool has_security_extensions(void)
+{
+ u32 fea = 0;
+
+ asm volatile(
+ "mrc p15, 0, %[fea], cr0, cr1, 0" :
+ [fea]"=r" (fea));
+
+ mc_dev_devel("CPU Features: 0x%X", fea);
+
+ /*
+ * If the CPU features ID has 0 for security features then the CPU
+ * doesn't support TrustZone at all!
+ */
+ if ((fea & ARM_SECURITY_EXTENSION_MASK) == 0)
+ return false;
+
+ return true;
+}
+
+/* check if running in secure mode */
+static inline bool is_secure_mode(void)
+{
+ u32 cpsr = 0;
+ u32 nsacr = 0;
+
+ asm volatile(
+ "mrc p15, 0, %[nsacr], cr1, cr1, 2\n"
+ "mrs %[cpsr], cpsr\n" :
+ [nsacr]"=r" (nsacr),
+ [cpsr]"=r"(cpsr));
+
+ mc_dev_devel("CPRS.M = set to 0x%X", cpsr & MODE_MASK);
+ mc_dev_devel("SCR.NS = set to 0x%X", nsacr);
+
+ /*
+ * If the NSACR contains the reset value(=0) then most likely we are
+ * running in Secure MODE.
+ * If the cpsr mode is set to monitor mode then we cannot load!
+ */
+ if (nsacr == 0 || ((cpsr & MODE_MASK) == ARM_MONITOR_MODE))
+ return true;
+
+ return false;
+}
+#endif
+
+#endif /* _MC_ARM_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/build_tag.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/build_tag.h
new file mode 100644
index 0000000..db7db6f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/build_tag.h
@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef MOBICORE_COMPONENT_BUILD_TAG
+#define MOBICORE_COMPONENT_BUILD_TAG \
+ "t-base-MTK-A64-Android-410a-V002-20190318_110437_65733_93363"
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/client.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/client.c
new file mode 100644
index 0000000..93fac7d
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/client.c
@@ -0,0 +1,1474 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/mm.h>
+#include <linux/err.h>
+#include <linux/sched.h> /* struct task_struct */
+#include <linux/version.h>
+#include <linux/sched/mm.h> /* get_task_mm */
+#include <linux/sched/task.h> /* put_task_struct */
+#include <net/sock.h> /* sockfd_lookup */
+#include <linux/file.h> /* fput */
+
+#include "public/mc_user.h"
+#include "public/mc_admin.h"
+
+#include "main.h"
+#include "mmu.h"
+#include "session.h"
+#include "client.h"
+
+/* Client/context */
+struct tee_client {
+ /* PID of task that opened the device, 0 if kernel */
+ pid_t pid;
+ /* Command for task*/
+ char comm[TASK_COMM_LEN];
+ /* Number of references kept to this object */
+ struct kref kref;
+ /* List of contiguous buffers allocated by mcMallocWsm for the client */
+ struct list_head cbufs;
+ struct mutex cbufs_lock; /* lock for the cbufs list */
+ /* List of TA sessions opened by this client */
+ struct list_head sessions;
+ struct list_head closing_sessions;
+ struct mutex sessions_lock; /* sessions list + closing */
+ /* Client lock for quick WSMs and operations changes */
+ struct mutex quick_lock;
+ /* Client lock for CWSMs release functions */
+ struct mutex cwsm_release_lock;
+ /* List of WSMs for a client */
+ struct list_head cwsms;
+ /* List of GP operation for a client */
+ struct list_head operations;
+ /* The list entry to attach to "ctx.clients" list */
+ struct list_head list;
+ /* task_struct for the client application, if going through a proxy */
+ struct task_struct *task;
+};
+
+/* Context */
+static struct client_ctx {
+ /* Clients list */
+ struct mutex clients_lock;
+ struct list_head clients;
+ /* Clients waiting for their last cbuf to be released */
+ struct mutex closing_clients_lock;
+ struct list_head closing_clients;
+} client_ctx;
+
+/* Buffer shared with SWd at client level */
+struct cwsm {
+ /* Client this cbuf belongs to */
+ struct tee_client *client;
+ /* Buffer info */
+ struct gp_shared_memory memref;
+ /* MMU L2 table */
+ struct tee_mmu *mmu;
+ /* Buffer SWd addr */
+ u32 sva;
+ /* Number of references kept to this object */
+ struct kref kref;
+ /* The list entry for the client to list its WSMs */
+ struct list_head list;
+};
+
+/*
+ * Contiguous buffer allocated to TLCs.
+ * These buffers are used as world shared memory (wsm) to share with
+ * secure world.
+ */
+struct cbuf {
+ /* Client this cbuf belongs to */
+ struct tee_client *client;
+ /* List element for client's list of cbuf's */
+ struct list_head list;
+ /* Number of references kept to this buffer */
+ struct kref kref;
+ /* virtual Kernel start address */
+ uintptr_t addr;
+ /* virtual Userspace start address */
+ uintptr_t uaddr;
+ /* physical start address */
+ phys_addr_t phys;
+ /* 2^order = number of pages allocated */
+ unsigned int order;
+ /* Length of memory mapped to user */
+ u32 len;
+ /* Has been freed via the API */
+ bool api_freed;
+};
+
+static inline void cbuf_get(struct cbuf *cbuf)
+{
+ kref_get(&cbuf->kref);
+}
+
+/* Must only be called by tee_cbuf_put */
+static void cbuf_release(struct kref *kref)
+{
+ struct cbuf *cbuf = container_of(kref, struct cbuf, kref);
+ struct tee_client *client = cbuf->client;
+
+ /* Unlist from client */
+ list_del_init(&cbuf->list);
+ /* Release client token */
+ client_put(client);
+ /* Free */
+ free_pages(cbuf->addr, cbuf->order);
+ mc_dev_devel("freed cbuf %p: client %p addr %lx uaddr %lx len %u",
+ cbuf, client, cbuf->addr, cbuf->uaddr, cbuf->len);
+ kfree(cbuf);
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_cbufs);
+}
+
+void tee_cbuf_put(struct cbuf *cbuf)
+{
+ struct tee_client *client = cbuf->client;
+
+ mutex_lock(&client->cbufs_lock);
+ kref_put(&cbuf->kref, cbuf_release);
+ mutex_unlock(&client->cbufs_lock);
+}
+
+/*
+ * Map a kernel contiguous buffer to user space
+ */
+static int cbuf_map(struct vm_area_struct *vmarea, uintptr_t addr, u32 len,
+ uintptr_t *uaddr)
+{
+ int ret;
+
+ if (!uaddr)
+ return -EINVAL;
+
+ if (!vmarea)
+ return -EINVAL;
+
+ if (!addr)
+ return -EINVAL;
+
+ if (len != (u32)(vmarea->vm_end - vmarea->vm_start)) {
+ ret = -EINVAL;
+ mc_dev_err(ret, "cbuf incompatible with vma");
+ return ret;
+ }
+
+ vmarea->vm_flags |= VM_IO;
+ ret = remap_pfn_range(vmarea, vmarea->vm_start,
+ page_to_pfn(virt_to_page(addr)),
+ vmarea->vm_end - vmarea->vm_start,
+ vmarea->vm_page_prot);
+ if (ret) {
+ *uaddr = 0;
+ mc_dev_err(ret, "User mapping failed");
+ return ret;
+ }
+
+ *uaddr = vmarea->vm_start;
+ return 0;
+}
+
+/*
+ * Returns true if client is a kernel object.
+ */
+static inline bool client_is_kernel(struct tee_client *client)
+{
+ return !client->pid;
+}
+
+static struct cwsm *cwsm_create(struct tee_client *client,
+ struct tee_mmu *mmu,
+ const struct gp_shared_memory *memref,
+ struct gp_return *gp_ret)
+{
+ struct cwsm *cwsm;
+ u32 sva;
+ int ret;
+
+ cwsm = kzalloc(sizeof(*cwsm), GFP_KERNEL);
+ if (!cwsm)
+ return ERR_PTR(iwp_set_ret(-ENOMEM, gp_ret));
+
+ if (mmu) {
+ cwsm->mmu = mmu;
+ tee_mmu_get(cwsm->mmu);
+ } else {
+ struct mc_ioctl_buffer buf = {
+ .va = (uintptr_t)memref->buffer,
+ .len = memref->size,
+ .flags = memref->flags,
+ };
+
+ if (client_is_kernel(client)) {
+ cwsm->mmu = tee_mmu_create(NULL, &buf);
+ } else {
+ struct mm_struct *mm = get_task_mm(current);
+
+ if (!mm) {
+ ret = -EPERM;
+ mc_dev_err(ret, "can't get mm");
+ goto err_cwsm;
+ }
+
+ /* Build MMU table for buffer */
+ cwsm->mmu = tee_mmu_create(mm, &buf);
+ mmput(mm);
+ }
+
+ if (IS_ERR(cwsm->mmu)) {
+ ret = iwp_set_ret(PTR_ERR(cwsm->mmu), gp_ret);
+ goto err_cwsm;
+ }
+ }
+
+ ret = iwp_register_shared_mem(cwsm->mmu, &sva, gp_ret);
+ if (ret)
+ goto err_mmu;
+
+ /* Get a token on the client */
+ client_get(client);
+ cwsm->client = client;
+ memcpy(&cwsm->memref, memref, sizeof(cwsm->memref));
+ cwsm->sva = sva;
+ kref_init(&cwsm->kref);
+ INIT_LIST_HEAD(&cwsm->list);
+ /* Add buffer to list */
+ mutex_lock(&client->quick_lock);
+ list_add_tail(&cwsm->list, &client->cwsms);
+ mutex_unlock(&client->quick_lock);
+ mc_dev_devel("created cwsm %p: client %p sva %x", cwsm, client, sva);
+ /* Increment debug counter */
+ atomic_inc(&g_ctx.c_cwsms);
+ return cwsm;
+
+err_mmu:
+ tee_mmu_put(cwsm->mmu);
+err_cwsm:
+ kfree(cwsm);
+ return ERR_PTR(ret);
+}
+
+static inline void cwsm_get(struct cwsm *cwsm)
+{
+ kref_get(&cwsm->kref);
+}
+
+/* Must only be called by cwsm_put */
+static void cwsm_release(struct kref *kref)
+{
+ struct cwsm *cwsm = container_of(kref, struct cwsm, kref);
+ struct tee_client *client = cwsm->client;
+ struct mcp_buffer_map map;
+
+ /* Unlist from client */
+ list_del_init(&cwsm->list);
+ /* Unmap buffer from SWd (errors ignored) */
+ tee_mmu_buffer(cwsm->mmu, &map);
+ map.secure_va = cwsm->sva;
+ iwp_release_shared_mem(&map);
+ /* Release MMU */
+ tee_mmu_put(cwsm->mmu);
+ /* Release client token */
+ client_put(client);
+ /* Free */
+ mc_dev_devel("freed cwsm %p: client %p", cwsm, client);
+ kfree(cwsm);
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_cwsms);
+}
+
+static inline void cwsm_put(struct cwsm *cwsm)
+{
+ struct tee_client *client = cwsm->client;
+
+ mutex_lock(&client->quick_lock);
+ kref_put(&cwsm->kref, cwsm_release);
+ mutex_unlock(&client->quick_lock);
+}
+
+static inline struct cwsm *cwsm_find(struct tee_client *client,
+ const struct gp_shared_memory *memref)
+{
+ struct cwsm *cwsm = NULL, *candidate;
+
+ mc_dev_devel("find shared mem for buf %llx size %llu flags %x",
+ memref->buffer, memref->size, memref->flags);
+ mutex_lock(&client->quick_lock);
+ list_for_each_entry(candidate, &client->cwsms, list) {
+ mc_dev_devel("candidate buf %llx size %llu flags %x",
+ candidate->memref.buffer, candidate->memref.size,
+ candidate->memref.flags);
+ if (candidate->memref.buffer == memref->buffer &&
+ candidate->memref.size == memref->size &&
+ candidate->memref.flags == memref->flags) {
+ cwsm = candidate;
+ cwsm_get(cwsm);
+ mc_dev_devel("match");
+ break;
+ }
+ }
+ mutex_unlock(&client->quick_lock);
+ return cwsm;
+}
+
+static inline struct cwsm *cwsm_find_by_sva(struct tee_client *client, u32 sva)
+{
+ struct cwsm *cwsm = NULL, *candidate;
+
+ mutex_lock(&client->quick_lock);
+ list_for_each_entry(candidate, &client->cwsms, list)
+ if (candidate->sva == sva) {
+ cwsm = candidate;
+ cwsm_get(cwsm);
+ break;
+ }
+ mutex_unlock(&client->quick_lock);
+ return cwsm;
+}
+
+/*
+ * Returns the secure virtual address from a registered mem
+ */
+u32 client_get_cwsm_sva(struct tee_client *client,
+ const struct gp_shared_memory *memref)
+{
+ struct cwsm *cwsm = cwsm_find(client, memref);
+
+ if (!cwsm)
+ return 0;
+
+ mc_dev_devel("found sva %x", cwsm->sva);
+ return cwsm->sva;
+}
+
+void client_get(struct tee_client *client)
+{
+ kref_get(&client->kref);
+}
+
+void client_put_cwsm_sva(struct tee_client *client, u32 sva)
+{
+ struct cwsm *cwsm;
+
+ mutex_lock(&client->cwsm_release_lock);
+ cwsm = cwsm_find_by_sva(client, sva);
+ if (!cwsm)
+ goto end;
+
+ /* Release reference taken by cwsm_find_by_sva */
+ cwsm_put(cwsm);
+ cwsm_put(cwsm);
+end:
+ mutex_unlock(&client->cwsm_release_lock);
+}
+
+/*
+ * Allocate and initialize a client object
+ */
+struct tee_client *client_create(bool is_from_kernel)
+{
+ struct tee_client *client;
+
+ /* Allocate client structure */
+ client = kzalloc(sizeof(*client), GFP_KERNEL);
+ if (!client)
+ return NULL;
+
+ /* Increment debug counter */
+ atomic_inc(&g_ctx.c_clients);
+ /* initialize members */
+ client->pid = is_from_kernel ? 0 : current->pid;
+ memcpy(client->comm, current->comm, sizeof(client->comm));
+ kref_init(&client->kref);
+ INIT_LIST_HEAD(&client->cbufs);
+ mutex_init(&client->cbufs_lock);
+ INIT_LIST_HEAD(&client->sessions);
+ INIT_LIST_HEAD(&client->closing_sessions);
+ mutex_init(&client->sessions_lock);
+ INIT_LIST_HEAD(&client->list);
+ mutex_init(&client->quick_lock);
+ mutex_init(&client->cwsm_release_lock);
+ INIT_LIST_HEAD(&client->cwsms);
+ INIT_LIST_HEAD(&client->operations);
+ /* Add client to list of clients */
+ mutex_lock(&client_ctx.clients_lock);
+ list_add_tail(&client->list, &client_ctx.clients);
+ mutex_unlock(&client_ctx.clients_lock);
+ mc_dev_devel("created client %p", client);
+ return client;
+}
+
+/* Must only be called by client_put */
+static void client_release(struct kref *kref)
+{
+ struct tee_client *client;
+
+ client = container_of(kref, struct tee_client, kref);
+ /* Client is closed, remove from closing list */
+ list_del(&client->list);
+ mc_dev_devel("freed client %p", client);
+ if (client->task)
+ put_task_struct(client->task);
+
+ kfree(client);
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_clients);
+}
+
+int client_put(struct tee_client *client)
+{
+ int ret;
+
+ mutex_lock(&client_ctx.closing_clients_lock);
+ ret = kref_put(&client->kref, client_release);
+ mutex_unlock(&client_ctx.closing_clients_lock);
+ return ret;
+}
+
+/*
+ * Set client "closing" state, only if it contains no session.
+ * Once in "closing" state, system "close" can be called.
+ * Return: 0 if this state could be set.
+ */
+bool client_has_sessions(struct tee_client *client)
+{
+ bool ret;
+
+ /* Check for sessions */
+ mutex_lock(&client->sessions_lock);
+ ret = !list_empty(&client->sessions);
+ mutex_unlock(&client->sessions_lock);
+ mc_dev_devel("client %p, exit with %d", client, ret);
+ return ret;
+}
+
+static inline void client_put_session(struct tee_client *client,
+ struct tee_session *session)
+{
+ /* Remove session from client's closing list */
+ mutex_lock(&client->sessions_lock);
+ list_del(&session->list);
+ mutex_unlock(&client->sessions_lock);
+ /* Release the ref we took on creation */
+ session_put(session);
+}
+
+/*
+ * At this point, nobody has access to the client anymore, so no new sessions
+ * are being created.
+ */
+static void client_close_sessions(struct tee_client *client)
+{
+ struct tee_session *session;
+
+ mutex_lock(&client->sessions_lock);
+ while (!list_empty(&client->sessions)) {
+ session = list_first_entry(&client->sessions,
+ struct tee_session, list);
+
+ /* Move session to closing sessions list */
+ list_move(&session->list, &client->closing_sessions);
+ /* Call session_close without lock */
+ mutex_unlock(&client->sessions_lock);
+ if (!session_close(session))
+ client_put_session(client, session);
+ mutex_lock(&client->sessions_lock);
+ }
+
+ mutex_unlock(&client->sessions_lock);
+}
+
+/*
+ * At this point, nobody has access to the client anymore, so no new contiguous
+ * buffers are being created.
+ */
+static void client_close_kernel_cbufs(struct tee_client *client)
+{
+ /* Put buffers allocated and not freed via the kernel API */
+ if (!client_is_kernel(client))
+ return;
+
+ /* Look for cbufs that the client has not freed and put them */
+ while (true) {
+ struct cbuf *cbuf = NULL, *candidate;
+
+ mutex_lock(&client->cbufs_lock);
+ list_for_each_entry(candidate, &client->cbufs, list) {
+ if (!candidate->api_freed) {
+ candidate->api_freed = true;
+ cbuf = candidate;
+ break;
+ }
+ }
+ mutex_unlock(&client->cbufs_lock);
+
+ if (!cbuf)
+ break;
+
+ tee_cbuf_put(cbuf);
+ }
+}
+
+/* Client is closing: make sure all CSMs are gone */
+static void client_release_cwsms(struct tee_client *client)
+{
+ /* Look for cbufs that the client has not freed and put them */
+ while (!list_empty(&client->cwsms)) {
+ struct cwsm *cwsm;
+
+ cwsm = list_first_entry(&client->cwsms, struct cwsm, list);
+ cwsm_put(cwsm);
+ }
+}
+
+/* Client is closing: make sure all cancelled operations are gone */
+static void client_release_gp_operations(struct tee_client *client)
+{
+ struct client_gp_operation *op, *nop;
+
+ mutex_lock(&client->quick_lock);
+ list_for_each_entry_safe(op, nop, &client->operations, list) {
+ /* Only cancelled operations are kzalloc'd */
+ mc_dev_devel("flush cancelled operation %p for started %llu",
+ op, op->started);
+ if (op->cancelled)
+ kfree(op);
+ }
+ mutex_unlock(&client->quick_lock);
+}
+
+/*
+ * Release a client and the session+cbuf objects it contains.
+ * @param client_t client
+ * @return driver error code
+ */
+void client_close(struct tee_client *client)
+{
+ /* Move client from active clients to closing clients for debug */
+ mutex_lock(&client_ctx.clients_lock);
+ mutex_lock(&client_ctx.closing_clients_lock);
+ list_move(&client->list, &client_ctx.closing_clients);
+ mutex_unlock(&client_ctx.closing_clients_lock);
+ mutex_unlock(&client_ctx.clients_lock);
+ client_close_kernel_cbufs(client);
+ /* Close all remaining sessions */
+ client_close_sessions(client);
+ /* Release all cwsms, no need to lock as sessions are closed */
+ client_release_cwsms(client);
+ client_release_gp_operations(client);
+ client_put(client);
+ mc_dev_devel("client %p closed", client);
+}
+
+/*
+ * Clean all structures shared with the SWd (note: incomplete but unused)
+ */
+void client_cleanup(void)
+{
+ struct tee_client *client;
+
+ mutex_lock(&client_ctx.clients_lock);
+ list_for_each_entry(client, &client_ctx.clients, list) {
+ mutex_lock(&client->sessions_lock);
+ while (!list_empty(&client->sessions)) {
+ struct tee_session *session;
+
+ session = list_first_entry(&client->sessions,
+ struct tee_session, list);
+ list_del(&session->list);
+ session_mc_cleanup_session(session);
+ }
+ mutex_unlock(&client->sessions_lock);
+ }
+ mutex_unlock(&client_ctx.clients_lock);
+}
+
+/*
+ * Open TA for given client. TA binary is provided by the daemon.
+ * @param
+ * @return driver error code
+ */
+int client_mc_open_session(struct tee_client *client,
+ const struct mc_uuid_t *uuid,
+ uintptr_t tci_va, size_t tci_len, u32 *session_id)
+{
+ struct mcp_open_info info = {
+ .type = TEE_MC_UUID,
+ .uuid = uuid,
+ .tci_va = tci_va,
+ .tci_len = tci_len,
+ .user = !client_is_kernel(client),
+ };
+ int ret;
+
+ ret = client_mc_open_common(client, &info, session_id);
+ mc_dev_devel("session %x, exit with %d", *session_id, ret);
+ return ret;
+}
+
+/*
+ * Open TA for given client. TA binary is provided by the client.
+ * @param
+ * @return driver error code
+ */
+int client_mc_open_trustlet(struct tee_client *client,
+ u32 spid, uintptr_t ta_va, size_t ta_len,
+ uintptr_t tci_va, size_t tci_len, u32 *session_id)
+{
+ struct mcp_open_info info = {
+ .type = TEE_MC_TA,
+ .spid = spid,
+ .va = ta_va,
+ .len = ta_len,
+ .tci_va = tci_va,
+ .tci_len = tci_len,
+ .user = !client_is_kernel(client),
+ };
+ int ret;
+
+ ret = client_mc_open_common(client, &info, session_id);
+ mc_dev_devel("session %x, exit with %d", *session_id, ret);
+ return ret;
+}
+
+/*
+ * Opens a TA and add corresponding session object to given client
+ * return: driver error code
+ */
+int client_mc_open_common(struct tee_client *client, struct mcp_open_info *info,
+ u32 *session_id)
+{
+ struct tee_session *session = NULL;
+ int ret = 0;
+
+ /*
+ * Create session object with temp sid=0 BEFORE session is started,
+ * otherwise if a GP TA is started and NWd session object allocation
+ * fails, we cannot handle the potentially delayed GP closing.
+ * Adding session to list must be done AFTER it is started (once we have
+ * sid), therefore it cannot be done within session_create().
+ */
+ session = session_create(client, NULL);
+ if (IS_ERR(session))
+ return PTR_ERR(session);
+
+ ret = session_mc_open_session(session, info);
+ if (ret)
+ goto err;
+
+ mutex_lock(&client->sessions_lock);
+ /* Add session to client */
+ list_add_tail(&session->list, &client->sessions);
+ /* Set session ID returned by SWd */
+ *session_id = session->mcp_session.sid;
+ mutex_unlock(&client->sessions_lock);
+
+err:
+ /* Close or free session on error */
+ if (ret == -ENODEV) {
+ /* The session must enter the closing process... */
+ list_add_tail(&session->list, &client->closing_sessions);
+ if (!session_close(session))
+ client_put_session(client, session);
+ } else if (ret) {
+ session_put(session);
+ }
+
+ return ret;
+}
+
+/*
+ * Remove a session object from client and close corresponding TA
+ * Return: true if session was found and closed
+ */
+int client_remove_session(struct tee_client *client, u32 session_id)
+{
+ struct tee_session *session = NULL, *candidate;
+ int ret;
+
+ /* Move session from main list to closing list */
+ mutex_lock(&client->sessions_lock);
+ list_for_each_entry(candidate, &client->sessions, list) {
+ if (candidate->mcp_session.sid == session_id) {
+ session = candidate;
+ list_move(&session->list, &client->closing_sessions);
+ break;
+ }
+ }
+
+ mutex_unlock(&client->sessions_lock);
+ if (!session)
+ return -ENXIO;
+
+ /* Close session */
+ ret = session_close(session);
+ if (!ret)
+ client_put_session(client, session);
+
+ return ret;
+}
+
+/*
+ * Find a session object and increment its reference counter.
+ * Object cannot be freed until its counter reaches 0.
+ * return: pointer to the object, NULL if not found.
+ */
+static struct tee_session *client_get_session(struct tee_client *client,
+ u32 session_id)
+{
+ struct tee_session *session = NULL, *candidate;
+
+ mutex_lock(&client->sessions_lock);
+ list_for_each_entry(candidate, &client->sessions, list) {
+ if (candidate->mcp_session.sid == session_id) {
+ session = candidate;
+ session_get(session);
+ break;
+ }
+ }
+
+ mutex_unlock(&client->sessions_lock);
+ if (!session)
+ mc_dev_err(-ENXIO, "session %x not found", session_id);
+
+ return session;
+}
+
+/*
+ * Send a notification to TA
+ * @return driver error code
+ */
+int client_notify_session(struct tee_client *client, u32 session_id)
+{
+ struct tee_session *session;
+ int ret;
+
+ /* Find/get session */
+ session = client_get_session(client, session_id);
+ if (!session)
+ return -ENXIO;
+
+ /* Send command to SWd */
+ ret = session_mc_notify(session);
+ /* Put session */
+ session_put(session);
+ mc_dev_devel("session %x, exit with %d", session_id, ret);
+ return ret;
+}
+
+/*
+ * Wait for a notification from TA
+ * @return driver error code
+ */
+int client_waitnotif_session(struct tee_client *client, u32 session_id,
+ s32 timeout, bool silent_expiry)
+{
+ struct tee_session *session;
+ int ret;
+
+ /* Find/get session */
+ session = client_get_session(client, session_id);
+ if (!session)
+ return -ENXIO;
+
+ ret = session_mc_wait(session, timeout, silent_expiry);
+ /* Put session */
+ session_put(session);
+ mc_dev_devel("session %x, exit with %d", session_id, ret);
+ return ret;
+}
+
+/*
+ * Read session exit/termination code
+ */
+int client_get_session_exitcode(struct tee_client *client, u32 session_id,
+ s32 *err)
+{
+ struct tee_session *session;
+ int ret;
+
+ /* Find/get session */
+ session = client_get_session(client, session_id);
+ if (!session)
+ return -ENXIO;
+
+ /* Retrieve error */
+ ret = session_mc_get_err(session, err);
+ /* Put session */
+ session_put(session);
+ mc_dev_devel("session %x, exit code %d", session_id, *err);
+ return ret;
+}
+
+/* Share a buffer with given TA in SWd */
+int client_mc_map(struct tee_client *client, u32 session_id,
+ struct tee_mmu *mmu, struct mc_ioctl_buffer *buf)
+{
+ struct tee_session *session;
+ int ret;
+
+ /* Find/get session */
+ session = client_get_session(client, session_id);
+ if (!session)
+ return -ENXIO;
+
+ /* Add buffer to the session */
+ ret = session_mc_map(session, mmu, buf);
+ /* Put session */
+ session_put(session);
+ mc_dev_devel("session %x, exit with %d", session_id, ret);
+ return ret;
+}
+
+/* Stop sharing a buffer with SWd */
+int client_mc_unmap(struct tee_client *client, u32 session_id,
+ const struct mc_ioctl_buffer *buf)
+{
+ struct tee_session *session;
+ int ret;
+
+ /* Find/get session */
+ session = client_get_session(client, session_id);
+ if (!session)
+ return -ENXIO;
+
+ /* Remove buffer from session */
+ ret = session_mc_unmap(session, buf);
+ /* Put session */
+ session_put(session);
+ mc_dev_devel("session %x, exit with %d", session_id, ret);
+ return ret;
+}
+
+int client_gp_initialize_context(struct tee_client *client,
+ struct gp_return *gp_ret)
+{
+ return iwp_set_ret(0, gp_ret);
+}
+
+int client_gp_register_shared_mem(struct tee_client *client,
+ struct tee_mmu *mmu, u32 *sva,
+ const struct gp_shared_memory *memref,
+ struct gp_return *gp_ret)
+{
+ struct cwsm *cwsm = NULL;
+
+ if (memref->size > BUFFER_LENGTH_MAX) {
+ mc_dev_err(-EINVAL, "buffer size %llu too big", memref->size);
+ return -EINVAL;
+ }
+
+ if (!mmu)
+ /* cwsm_find automatically takes a reference */
+ cwsm = cwsm_find(client, memref);
+
+ if (!cwsm)
+ cwsm = cwsm_create(client, mmu, memref, gp_ret);
+
+ /* gp_ret set by callee */
+ if (IS_ERR(cwsm))
+ return PTR_ERR(cwsm);
+
+ if (sva)
+ *sva = cwsm->sva;
+
+ return iwp_set_ret(0, gp_ret);
+}
+
+int client_gp_release_shared_mem(struct tee_client *client,
+ const struct gp_shared_memory *memref)
+{
+ struct cwsm *cwsm;
+ int ret = 0;
+
+ mutex_lock(&client->cwsm_release_lock);
+ cwsm = cwsm_find(client, memref);
+ if (!cwsm) {
+ ret = -ENOENT;
+ goto end;
+ }
+
+ /* Release reference taken by cwsm_find */
+ cwsm_put(cwsm);
+ cwsm_put(cwsm);
+end:
+ mutex_unlock(&client->cwsm_release_lock);
+ return ret;
+}
+
+/*
+ * Opens a TA and add corresponding session object to given client
+ * return: driver error code
+ */
+int client_gp_open_session(struct tee_client *client,
+ const struct mc_uuid_t *uuid,
+ struct gp_operation *operation,
+ const struct mc_identity *identity,
+ struct gp_return *gp_ret,
+ u32 *session_id)
+{
+ struct tee_session *session = NULL;
+ int ret = 0;
+
+ /*
+ * Create session object with temp sid=0 BEFORE session is started,
+ * otherwise if a GP TA is started and NWd session object allocation
+ * fails, we cannot handle the potentially delayed GP closing.
+ * Adding session to list must be done AFTER it is started (once we have
+ * sid), therefore it cannot be done within session_create().
+ */
+ session = session_create(client, identity);
+ if (IS_ERR(session))
+ return iwp_set_ret(PTR_ERR(session), gp_ret);
+
+ /* Open session */
+ ret = session_gp_open_session(session, uuid, operation, gp_ret);
+ if (ret)
+ goto end;
+
+ mutex_lock(&client->sessions_lock);
+ /* Add session to client */
+ list_add_tail(&session->list, &client->sessions);
+ mutex_unlock(&client->sessions_lock);
+ /* Set sid returned by SWd */
+ *session_id = session->iwp_session.sid;
+
+end:
+ if (ret)
+ session_put(session);
+
+ mc_dev_devel("gp session %x, exit with %d", *session_id, ret);
+ return ret;
+}
+
+int client_gp_open_session_domu(struct tee_client *client,
+ const struct mc_uuid_t *uuid, u64 started,
+ struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret)
+{
+ struct tee_session *session = NULL;
+ int ret = 0;
+
+ /* Don't pass NULL for identity as it would make a MC session */
+ session = session_create(client, ERR_PTR(-ENOENT));
+ if (IS_ERR(session))
+ return iwp_set_ret(PTR_ERR(session), gp_ret);
+
+ /* Open session */
+ ret = session_gp_open_session_domu(session, uuid, started, iws,
+ mmus, gp_ret);
+ if (ret)
+ goto end;
+
+ mutex_lock(&client->sessions_lock);
+ /* Add session to client */
+ list_add_tail(&session->list, &client->sessions);
+ mutex_unlock(&client->sessions_lock);
+
+end:
+ if (ret)
+ session_put(session);
+
+ mc_dev_devel("gp session %x, exit with %d",
+ session->iwp_session.sid, ret);
+ return ret;
+}
+
+int client_gp_close_session(struct tee_client *client, u32 session_id)
+{
+ struct tee_session *session = NULL, *candidate;
+ int ret = 0;
+
+ /* Move session from main list to closing list */
+ mutex_lock(&client->sessions_lock);
+ list_for_each_entry(candidate, &client->sessions, list) {
+ if (candidate->iwp_session.sid == session_id) {
+ session = candidate;
+ list_move(&session->list, &client->closing_sessions);
+ break;
+ }
+ }
+
+ mutex_unlock(&client->sessions_lock);
+ if (!session)
+ return -ENXIO;
+
+ ret = session_close(session);
+ if (!ret)
+ client_put_session(client, session);
+
+ return ret;
+}
+
+/*
+ * Send a command to the TA
+ * @param
+ * @return driver error code
+ */
+int client_gp_invoke_command(struct tee_client *client, u32 session_id,
+ u32 command_id,
+ struct gp_operation *operation,
+ struct gp_return *gp_ret)
+{
+ struct tee_session *session;
+ int ret = 0;
+
+ session = client_get_session(client, session_id);
+ if (!session)
+ return iwp_set_ret(-ENXIO, gp_ret);
+
+ ret = session_gp_invoke_command(session, command_id, operation, gp_ret);
+
+ /* Put session */
+ session_put(session);
+ return ret;
+}
+
+int client_gp_invoke_command_domu(struct tee_client *client, u32 session_id,
+ u64 started, struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret)
+{
+ struct tee_session *session;
+ int ret = 0;
+
+ session = client_get_session(client, session_id);
+ if (!session)
+ return iwp_set_ret(-ENXIO, gp_ret);
+
+ ret = session_gp_invoke_command_domu(session, started, iws, mmus,
+ gp_ret);
+
+ /* Put session */
+ session_put(session);
+ return ret;
+}
+
+void client_gp_request_cancellation(struct tee_client *client, u64 started)
+{
+ struct client_gp_operation *op;
+ u64 slot;
+ bool found = false;
+
+ /* Look for operation */
+ mutex_lock(&client->quick_lock);
+ list_for_each_entry(op, &client->operations, list)
+ if (op->started == started) {
+ slot = op->slot;
+ found = true;
+ mc_dev_devel(
+ "found no operation cancel for started %llu",
+ started);
+ break;
+ }
+
+ /* Operation not found: assume it is coming */
+ if (!found) {
+ op = kzalloc(sizeof(*op), GFP_KERNEL);
+ if (op) {
+ op->started = started;
+ op->cancelled = true;
+ list_add_tail(&op->list, &client->operations);
+ mc_dev_devel(
+ "add cancelled operation %p for started %llu",
+ op, op->started);
+ }
+ }
+ mutex_unlock(&client->quick_lock);
+
+ if (found)
+ session_gp_request_cancellation(slot);
+}
+
+/*
+ * This callback is called on remap
+ */
+static void cbuf_vm_open(struct vm_area_struct *vmarea)
+{
+ struct cbuf *cbuf = vmarea->vm_private_data;
+
+ cbuf_get(cbuf);
+}
+
+/*
+ * This callback is called on unmap
+ */
+static void cbuf_vm_close(struct vm_area_struct *vmarea)
+{
+ struct cbuf *cbuf = vmarea->vm_private_data;
+
+ tee_cbuf_put(cbuf);
+}
+
+static const struct vm_operations_struct cbuf_vm_ops = {
+ .open = cbuf_vm_open,
+ .close = cbuf_vm_close,
+};
+
+/*
+ * Create a cbuf object and add it to client
+ */
+int client_cbuf_create(struct tee_client *client, u32 len, uintptr_t *addr,
+ struct vm_area_struct *vmarea)
+{
+ struct cbuf *cbuf = NULL;
+ unsigned int order;
+ int ret = 0;
+
+ if (!client)
+ return -EINVAL;
+
+ if (!len) {
+ mc_dev_err(-EINVAL, "buffer size 0 not supported");
+ return -EINVAL;
+ }
+
+ if (len > BUFFER_LENGTH_MAX) {
+ mc_dev_err(-EINVAL, "buffer size %u too big", len);
+ return -EINVAL;
+ }
+
+ order = get_order(len);
+ if (order > MAX_ORDER) {
+ ret = -ENOMEM;
+ mc_dev_err(ret, "Buffer size too large");
+ return ret;
+ }
+
+ /* Allocate buffer descriptor structure */
+ cbuf = kzalloc(sizeof(*cbuf), GFP_KERNEL);
+ if (!cbuf)
+ return -ENOMEM;
+
+ /* Increment debug counter */
+ atomic_inc(&g_ctx.c_cbufs);
+ /* Allocate buffer */
+ cbuf->addr = __get_free_pages(GFP_USER | __GFP_ZERO, order);
+ if (!cbuf->addr) {
+ kfree(cbuf);
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_cbufs);
+ return -ENOMEM;
+ }
+
+ /* Map to user space if applicable */
+ if (!client_is_kernel(client)) {
+ ret = cbuf_map(vmarea, cbuf->addr, len, &cbuf->uaddr);
+ if (ret) {
+ free_pages(cbuf->addr, order);
+ kfree(cbuf);
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_cbufs);
+ return ret;
+ }
+ }
+
+ /* Init descriptor members */
+ cbuf->client = client;
+ cbuf->phys = virt_to_phys((void *)cbuf->addr);
+ cbuf->len = len;
+ cbuf->order = order;
+ kref_init(&cbuf->kref);
+ INIT_LIST_HEAD(&cbuf->list);
+
+ /* Keep cbuf in VMA private data for refcounting (user-space clients) */
+ if (vmarea) {
+ vmarea->vm_private_data = cbuf;
+ vmarea->vm_ops = &cbuf_vm_ops;
+ }
+
+ /* Fill return parameter for k-api */
+ if (addr)
+ *addr = cbuf->addr;
+
+ /* Get a token on the client */
+ client_get(client);
+
+ /* Add buffer to list */
+ mutex_lock(&client->cbufs_lock);
+ list_add_tail(&cbuf->list, &client->cbufs);
+ mutex_unlock(&client->cbufs_lock);
+ mc_dev_devel("created cbuf %p: client %p addr %lx uaddr %lx len %u",
+ cbuf, client, cbuf->addr, cbuf->uaddr, cbuf->len);
+ return ret;
+}
+
+/*
+ * Find a contiguous buffer (cbuf) in the cbuf list of given client that
+ * contains given address and take a reference on it.
+ * Return pointer to the object, or NULL if not found.
+ */
+static struct cbuf *cbuf_get_by_addr(struct tee_client *client, uintptr_t addr)
+{
+ struct cbuf *cbuf = NULL, *candidate;
+ bool is_kernel = client_is_kernel(client);
+
+ mutex_lock(&client->cbufs_lock);
+ list_for_each_entry(candidate, &client->cbufs, list) {
+ /* Compare to kernel VA or user VA depending on client type */
+ uintptr_t start = is_kernel ?
+ candidate->addr : candidate->uaddr;
+ uintptr_t end = start + candidate->len;
+
+ /* Check that (user) cbuf has not been unmapped */
+ if (!start)
+ break;
+
+ if (addr >= start && addr < end) {
+ cbuf = candidate;
+ break;
+ }
+ }
+
+ if (cbuf)
+ cbuf_get(cbuf);
+
+ mutex_unlock(&client->cbufs_lock);
+ return cbuf;
+}
+
+/*
+ * Remove a cbuf object from client, and mark it for freeing.
+ * Freeing will happen once all current references are released.
+ *
+ * Note: this function could be subject to the same race condition as
+ * client_gp_release_shared_mem() and client_put_cwsm_sva(), but it is trusted
+ * as it can only be called by kernel drivers. So no lock around
+ * cbuf_get_by_addr() and the two tee_cbuf_put().
+ */
+int client_cbuf_free(struct tee_client *client, uintptr_t addr)
+{
+ struct cbuf *cbuf = cbuf_get_by_addr(client, addr);
+
+ if (!cbuf) {
+ mc_dev_err(-EINVAL, "cbuf %lu not found", addr);
+ return -EINVAL;
+ }
+
+ /* Release reference taken by cbuf_get_by_addr */
+ tee_cbuf_put(cbuf);
+ mutex_lock(&client->cbufs_lock);
+ cbuf->api_freed = true;
+ mutex_unlock(&client->cbufs_lock);
+ tee_cbuf_put(cbuf);
+ return 0;
+}
+
+bool client_gp_operation_add(struct tee_client *client,
+ struct client_gp_operation *operation)
+{
+ struct client_gp_operation *op;
+ bool found = false;
+
+ mutex_lock(&client->quick_lock);
+ list_for_each_entry(op, &client->operations, list)
+ if (op->started == operation->started && op->cancelled) {
+ found = true;
+ break;
+ }
+
+ if (found) {
+ list_del(&op->list);
+ mc_dev_devel("found cancelled operation %p for started %llu",
+ op, op->started);
+ kfree(op);
+ } else {
+ list_add_tail(&operation->list, &client->operations);
+ mc_dev_devel("add operation for started %llu",
+ operation->started);
+ }
+ mutex_unlock(&client->quick_lock);
+ return !found;
+}
+
+void client_gp_operation_remove(struct tee_client *client,
+ struct client_gp_operation *operation)
+{
+ mutex_lock(&client->quick_lock);
+ list_del(&operation->list);
+ mutex_unlock(&client->quick_lock);
+}
+
+struct tee_mmu *client_mmu_create(struct tee_client *client,
+ const struct mc_ioctl_buffer *buf_in,
+ struct cbuf **cbuf_p)
+{
+ /* Check if buffer is contained in a cbuf */
+ struct mc_ioctl_buffer buf = *buf_in;
+ struct cbuf *cbuf = cbuf_get_by_addr(client, buf.va);
+ struct mm_struct *mm = NULL;
+ struct tee_mmu *mmu;
+
+ *cbuf_p = cbuf;
+ if (cbuf) {
+ uintptr_t offset;
+
+ if (client_is_kernel(client)) {
+ offset = buf.va - cbuf->addr;
+ } else {
+ offset = buf.va - cbuf->uaddr;
+ /* Update va to point to kernel address */
+ buf.va = cbuf->addr + offset;
+ }
+
+ if ((offset + buf.len) > cbuf->len) {
+ mc_dev_err(-EINVAL, "crosses cbuf boundary");
+ tee_cbuf_put(cbuf);
+ return ERR_PTR(-EINVAL);
+ }
+ } else if (!client_is_kernel(client)) {
+ mm = get_task_mm(current);
+ if (!mm) {
+ mc_dev_err(-EPERM, "can't get mm");
+ return ERR_PTR(-EPERM);
+ }
+ }
+
+ /* Build MMU table for buffer */
+ mmu = tee_mmu_create(mm, &buf);
+ if (mm)
+ mmput(mm);
+
+ if (IS_ERR_OR_NULL(mmu) && cbuf)
+ tee_cbuf_put(cbuf);
+
+ return mmu;
+}
+
+void client_init(void)
+{
+ INIT_LIST_HEAD(&client_ctx.clients);
+ mutex_init(&client_ctx.clients_lock);
+
+ INIT_LIST_HEAD(&client_ctx.closing_clients);
+ mutex_init(&client_ctx.closing_clients_lock);
+}
+
+static inline int cbuf_debug_structs(struct kasnprintf_buf *buf,
+ struct cbuf *cbuf)
+{
+ return kasnprintf(buf,
+ "\tcbuf %pK [%d]: addr %pK uaddr %pK len %u\n",
+ cbuf, kref_read(&cbuf->kref), (void *)cbuf->addr,
+ (void *)cbuf->uaddr, cbuf->len);
+}
+
+static inline int cwsm_debug_structs(struct kasnprintf_buf *buf,
+ struct cwsm *cwsm)
+{
+ return kasnprintf(buf,
+ "\tcwsm %pK [%d]: buf %pK len %llu flags 0x%x\n",
+ cwsm, kref_read(&cwsm->kref),
+ (void *)(uintptr_t)cwsm->memref.buffer,
+ cwsm->memref.size, cwsm->memref.flags);
+}
+
+static int client_debug_structs(struct kasnprintf_buf *buf,
+ struct tee_client *client, bool is_closing)
+{
+ struct cbuf *cbuf;
+ struct cwsm *cwsm;
+ struct tee_session *session;
+ int ret;
+
+ if (client->pid)
+ ret = kasnprintf(buf, "client %pK [%d]: %s (%d)%s\n",
+ client, kref_read(&client->kref),
+ client->comm, client->pid,
+ is_closing ? " <closing>" : "");
+ else
+ ret = kasnprintf(buf, "client %pK [%d]: [kernel]%s\n",
+ client, kref_read(&client->kref),
+ is_closing ? " <closing>" : "");
+
+ if (ret < 0)
+ return ret;
+
+ /* Buffers */
+ mutex_lock(&client->cbufs_lock);
+ if (list_empty(&client->cbufs))
+ goto done_cbufs;
+
+ list_for_each_entry(cbuf, &client->cbufs, list) {
+ ret = cbuf_debug_structs(buf, cbuf);
+ if (ret < 0)
+ goto done_cbufs;
+ }
+
+done_cbufs:
+ mutex_unlock(&client->cbufs_lock);
+ if (ret < 0)
+ return ret;
+
+ /* WMSs */
+ mutex_lock(&client->quick_lock);
+ if (list_empty(&client->cwsms))
+ goto done_cwsms;
+
+ list_for_each_entry(cwsm, &client->cwsms, list) {
+ ret = cwsm_debug_structs(buf, cwsm);
+ if (ret < 0)
+ goto done_cwsms;
+ }
+
+done_cwsms:
+ mutex_unlock(&client->quick_lock);
+ if (ret < 0)
+ return ret;
+
+ /* Sessions */
+ mutex_lock(&client->sessions_lock);
+ list_for_each_entry(session, &client->sessions, list) {
+ ret = session_debug_structs(buf, session, false);
+ if (ret < 0)
+ goto done_sessions;
+ }
+
+ list_for_each_entry(session, &client->closing_sessions, list) {
+ ret = session_debug_structs(buf, session, true);
+ if (ret < 0)
+ goto done_sessions;
+ }
+
+done_sessions:
+ mutex_unlock(&client->sessions_lock);
+
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
+
+int clients_debug_structs(struct kasnprintf_buf *buf)
+{
+ struct tee_client *client;
+ ssize_t ret = 0;
+
+ mutex_lock(&client_ctx.clients_lock);
+ list_for_each_entry(client, &client_ctx.clients, list) {
+ ret = client_debug_structs(buf, client, false);
+ if (ret < 0)
+ break;
+ }
+ mutex_unlock(&client_ctx.clients_lock);
+
+ if (ret < 0)
+ return ret;
+
+ mutex_lock(&client_ctx.closing_clients_lock);
+ list_for_each_entry(client, &client_ctx.closing_clients, list) {
+ ret = client_debug_structs(buf, client, true);
+ if (ret < 0)
+ break;
+ }
+ mutex_unlock(&client_ctx.closing_clients_lock);
+
+ return ret;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/client.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/client.h
new file mode 100644
index 0000000..43867fd
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/client.h
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _CLIENT_H_
+#define _CLIENT_H_
+
+#include <linux/list.h>
+#include <linux/sched.h> /* TASK_COMM_LEN */
+
+#include "public/mc_user.h" /* many types */
+
+struct tee_client;
+struct mcp_open_info;
+struct tee_mmu;
+struct interworld_session;
+
+/* Client */
+struct tee_client *client_create(bool is_from_kernel);
+void client_get(struct tee_client *client);
+int client_put(struct tee_client *client);
+bool client_has_sessions(struct tee_client *client);
+void client_close(struct tee_client *client);
+void client_cleanup(void);
+
+/* MC */
+int client_mc_open_session(struct tee_client *client,
+ const struct mc_uuid_t *uuid,
+ uintptr_t tci_va, size_t tci_len, u32 *session_id);
+int client_mc_open_trustlet(struct tee_client *client,
+ u32 spid, uintptr_t ta_va, size_t ta_len,
+ uintptr_t tci_va, size_t tci_len, u32 *session_id);
+int client_mc_open_common(struct tee_client *client, struct mcp_open_info *info,
+ u32 *session_id);
+int client_remove_session(struct tee_client *client, u32 session_id);
+int client_notify_session(struct tee_client *client, u32 session_id);
+int client_waitnotif_session(struct tee_client *client, u32 session_id,
+ s32 timeout, bool silent_expiry);
+int client_get_session_exitcode(struct tee_client *client, u32 session_id,
+ s32 *exit_code);
+int client_mc_map(struct tee_client *client, u32 session_id,
+ struct tee_mmu *mmu, struct mc_ioctl_buffer *buf);
+int client_mc_unmap(struct tee_client *client, u32 session_id,
+ const struct mc_ioctl_buffer *buf);
+
+/* GP */
+int client_gp_initialize_context(struct tee_client *client,
+ struct gp_return *gp_ret);
+int client_gp_register_shared_mem(struct tee_client *client,
+ struct tee_mmu *mmu, u32 *sva,
+ const struct gp_shared_memory *memref,
+ struct gp_return *gp_ret);
+int client_gp_release_shared_mem(struct tee_client *client,
+ const struct gp_shared_memory *memref);
+int client_gp_open_session(struct tee_client *client,
+ const struct mc_uuid_t *uuid,
+ struct gp_operation *operation,
+ const struct mc_identity *identity,
+ struct gp_return *gp_ret,
+ u32 *session_id);
+int client_gp_open_session_domu(struct tee_client *client,
+ const struct mc_uuid_t *uuid, u64 started,
+ struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret);
+int client_gp_close_session(struct tee_client *client, u32 session_id);
+int client_gp_invoke_command(struct tee_client *client, u32 session_id,
+ u32 command_id,
+ struct gp_operation *operation,
+ struct gp_return *gp_ret);
+int client_gp_invoke_command_domu(struct tee_client *client, u32 session_id,
+ u64 started, struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret);
+void client_gp_request_cancellation(struct tee_client *client, u64 started);
+
+/* Contiguous buffer */
+int client_cbuf_create(struct tee_client *client, u32 len, uintptr_t *addr,
+ struct vm_area_struct *vmarea);
+int client_cbuf_free(struct tee_client *client, uintptr_t addr);
+
+/* GP internal */
+struct client_gp_operation {
+ struct list_head list;
+ u64 started;
+ u64 slot;
+ int cancelled;
+};
+
+/* Called from session when a new operation starts/ends */
+bool client_gp_operation_add(struct tee_client *client,
+ struct client_gp_operation *operation);
+void client_gp_operation_remove(struct tee_client *client,
+ struct client_gp_operation *operation);
+
+/* MMU */
+struct cbuf;
+
+struct tee_mmu *client_mmu_create(struct tee_client *client,
+ const struct mc_ioctl_buffer *buf_in,
+ struct cbuf **cbuf_p);
+void tee_cbuf_put(struct cbuf *cbuf);
+
+/* Buffer shared with SWd at client level */
+u32 client_get_cwsm_sva(struct tee_client *client,
+ const struct gp_shared_memory *memref);
+void client_put_cwsm_sva(struct tee_client *client, u32 sva);
+
+/* Global */
+void client_init(void);
+
+/* Debug */
+int clients_debug_structs(struct kasnprintf_buf *buf);
+
+#endif /* _CLIENT_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clientlib.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clientlib.c
new file mode 100644
index 0000000..29a79a9
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clientlib.c
@@ -0,0 +1,429 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/sched.h>
+#include <linux/list.h>
+
+#include "public/mc_user.h"
+#include "public/mc_admin.h"
+#include "public/mobicore_driver_api.h"
+
+#include "main.h"
+#include "client.h"
+
+static enum mc_result convert(int err)
+{
+ switch (-err) {
+ case 0:
+ return MC_DRV_OK;
+ case ENOMSG:
+ return MC_DRV_NO_NOTIFICATION;
+ case EBADMSG:
+ return MC_DRV_ERR_NOTIFICATION;
+ case EAGAIN:
+ return MC_DRV_ERR_OUT_OF_RESOURCES;
+ case EHOSTDOWN:
+ return MC_DRV_ERR_INIT;
+ case ENODEV:
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+ case ENXIO:
+ return MC_DRV_ERR_UNKNOWN_SESSION;
+ case EPERM:
+ return MC_DRV_ERR_INVALID_OPERATION;
+ case EBADE:
+ return MC_DRV_ERR_INVALID_RESPONSE;
+ case ETIME:
+ return MC_DRV_ERR_TIMEOUT;
+ case ENOMEM:
+ return MC_DRV_ERR_NO_FREE_MEMORY;
+ case EUCLEAN:
+ return MC_DRV_ERR_FREE_MEMORY_FAILED;
+ case ENOTEMPTY:
+ return MC_DRV_ERR_SESSION_PENDING;
+ case EHOSTUNREACH:
+ return MC_DRV_ERR_DAEMON_UNREACHABLE;
+ case ENOENT:
+ return MC_DRV_ERR_INVALID_DEVICE_FILE;
+ case EINVAL:
+ return MC_DRV_ERR_INVALID_PARAMETER;
+ case EPROTO:
+ return MC_DRV_ERR_KERNEL_MODULE;
+ case ECOMM:
+ return MC_DRV_INFO_NOTIFICATION;
+ case EUNATCH:
+ return MC_DRV_ERR_NQ_FAILED;
+ case ERESTARTSYS:
+ return MC_DRV_ERR_INTERRUPTED_BY_SIGNAL;
+ default:
+ mc_dev_devel("error is %d", err);
+ return MC_DRV_ERR_UNKNOWN;
+ }
+}
+
+static inline bool is_valid_device(u32 device_id)
+{
+ return device_id == MC_DEVICE_ID_DEFAULT;
+}
+
+static struct tee_client *client;
+static int open_count;
+static DEFINE_MUTEX(dev_mutex); /* Lock for the device */
+
+static bool clientlib_client_get(void)
+{
+ int ret = true;
+
+ mutex_lock(&dev_mutex);
+ if (!client)
+ ret = false;
+ else
+ client_get(client);
+
+ mutex_unlock(&dev_mutex);
+ return ret;
+}
+
+static void clientlib_client_put(void)
+{
+ mutex_lock(&dev_mutex);
+ if (client_put(client))
+ client = NULL;
+
+ mutex_unlock(&dev_mutex);
+}
+
+enum mc_result mc_open_device(u32 device_id)
+{
+ enum mc_result mc_result = MC_DRV_OK;
+ int ret;
+
+ /* Check parameters */
+ if (!is_valid_device(device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ mutex_lock(&dev_mutex);
+ /* Make sure TEE was started */
+ ret = mc_wait_tee_start();
+ if (ret) {
+ mc_dev_err(ret, "TEE failed to start, now or in the past");
+ mc_result = MC_DRV_ERR_INVALID_DEVICE_FILE;
+ goto end;
+ }
+
+ if (!open_count)
+ client = client_create(true);
+
+ if (client) {
+ open_count++;
+ mc_dev_devel("successfully opened the device");
+ } else {
+ mc_result = MC_DRV_ERR_INVALID_DEVICE_FILE;
+ mc_dev_err(-ENOMEM, "could not open device");
+ }
+
+end:
+ mutex_unlock(&dev_mutex);
+ return mc_result;
+}
+EXPORT_SYMBOL(mc_open_device);
+
+enum mc_result mc_close_device(u32 device_id)
+{
+ enum mc_result mc_result = MC_DRV_OK;
+
+ /* Check parameters */
+ if (!is_valid_device(device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ mutex_lock(&dev_mutex);
+ if (open_count > 1) {
+ open_count--;
+ goto end;
+ }
+
+ /* Check sessions and freeze client */
+ if (client_has_sessions(client)) {
+ mc_result = MC_DRV_ERR_SESSION_PENDING;
+ goto end;
+ }
+
+ /* Close the device */
+ client_close(client);
+ open_count = 0;
+
+end:
+ mutex_unlock(&dev_mutex);
+ clientlib_client_put();
+ return mc_result;
+}
+EXPORT_SYMBOL(mc_close_device);
+
+enum mc_result mc_open_session(struct mc_session_handle *session,
+ const struct mc_uuid_t *uuid,
+ u8 *tci_va, u32 tci_len)
+{
+ enum mc_result ret;
+
+ /* Check parameters */
+ if (!session || !uuid)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(
+ client_mc_open_session(client, uuid, (uintptr_t)tci_va, tci_len,
+ &session->session_id));
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_open_session);
+
+enum mc_result mc_open_trustlet(struct mc_session_handle *session, u32 spid,
+ u8 *ta_va, u32 ta_len, u8 *tci_va, u32 tci_len)
+{
+ enum mc_result ret;
+
+ /* Check parameters */
+ if (!session || !ta_va || !ta_len)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(
+ client_mc_open_trustlet(client, spid, (uintptr_t)ta_va, ta_len,
+ (uintptr_t)tci_va, tci_len,
+ &session->session_id));
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_open_trustlet);
+
+enum mc_result mc_close_session(struct mc_session_handle *session)
+{
+ enum mc_result ret;
+
+ /* Check parameters */
+ if (!session)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(client_remove_session(client, session->session_id));
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_close_session);
+
+enum mc_result mc_notify(struct mc_session_handle *session)
+{
+ enum mc_result ret;
+
+ /* Check parameters */
+ if (!session)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(client_notify_session(client, session->session_id));
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_notify);
+
+enum mc_result mc_wait_notification(struct mc_session_handle *session,
+ s32 timeout)
+{
+ enum mc_result ret;
+
+ /* Check parameters */
+ if (!session)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ do {
+ ret = convert(client_waitnotif_session(client,
+ session->session_id,
+ timeout, false));
+ } while ((timeout == MC_INFINITE_TIMEOUT) &&
+ (ret == MC_DRV_ERR_INTERRUPTED_BY_SIGNAL));
+
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_wait_notification);
+
+enum mc_result mc_malloc_wsm(u32 device_id, u32 align, u32 len, u8 **wsm,
+ u32 wsm_flags)
+{
+ enum mc_result ret;
+ uintptr_t va;
+
+ /* Check parameters */
+ if (!is_valid_device(device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!len)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!wsm)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(client_cbuf_create(client, len, &va, NULL));
+ if (ret == MC_DRV_OK)
+ *wsm = (u8 *)va;
+
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_malloc_wsm);
+
+enum mc_result mc_free_wsm(u32 device_id, u8 *wsm)
+{
+ enum mc_result ret;
+ uintptr_t va = (uintptr_t)wsm;
+
+ /* Check parameters */
+ if (!is_valid_device(device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(client_cbuf_free(client, va));
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_free_wsm);
+
+enum mc_result mc_map(struct mc_session_handle *session, void *address,
+ u32 length, struct mc_bulk_map *map_info)
+{
+ enum mc_result ret;
+ struct mc_ioctl_buffer buf = {
+ .va = (uintptr_t)address,
+ .len = length,
+ .flags = MC_IO_MAP_INPUT_OUTPUT,
+ };
+
+ /* Check parameters */
+ if (!session)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!map_info)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(client_mc_map(client, session->session_id, NULL, &buf));
+ if (ret == MC_DRV_OK) {
+ map_info->secure_virt_addr = buf.sva;
+ map_info->secure_virt_len = buf.len;
+ }
+
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_map);
+
+enum mc_result mc_unmap(struct mc_session_handle *session, void *address,
+ struct mc_bulk_map *map_info)
+{
+ enum mc_result ret;
+ struct mc_ioctl_buffer buf = {
+ .va = (uintptr_t)address,
+ .flags = MC_IO_MAP_INPUT_OUTPUT,
+ };
+
+ /* Check parameters */
+ if (!session)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!map_info)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ buf.len = map_info->secure_virt_len;
+ buf.sva = map_info->secure_virt_addr;
+
+ ret = convert(client_mc_unmap(client, session->session_id, &buf));
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_unmap);
+
+enum mc_result mc_get_session_error_code(struct mc_session_handle *session,
+ s32 *exit_code)
+{
+ enum mc_result ret;
+
+ /* Check parameters */
+ if (!session)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!is_valid_device(session->device_id))
+ return MC_DRV_ERR_UNKNOWN_DEVICE;
+
+ if (!exit_code)
+ return MC_DRV_ERR_INVALID_PARAMETER;
+
+ if (!clientlib_client_get())
+ return MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN;
+
+ /* Call core api */
+ ret = convert(client_get_session_exitcode(client, session->session_id,
+ exit_code));
+ clientlib_client_put();
+ return ret;
+}
+EXPORT_SYMBOL(mc_get_session_error_code);
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clock.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clock.c
new file mode 100644
index 0000000..8c06428
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clock.c
@@ -0,0 +1,192 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include "platform.h"
+
+#ifdef MC_CRYPTO_CLOCK_MANAGEMENT
+
+#include <linux/device.h>
+#include <linux/clk.h>
+#include <linux/err.h>
+#include <linux/of.h>
+
+#include "main.h"
+#include "clock.h"
+
+static struct clk_context {
+ struct clk *mc_ce_iface_clk;
+ struct clk *mc_ce_core_clk;
+ struct clk *mc_ce_bus_clk;
+ struct clk *mc_ce_core_src_clk;
+ /* Clocks are managed by Linux Kernel. No need to do anything */
+ bool no_clock_support;
+} clk_ctx;
+
+int mc_clock_init(void)
+{
+ int ret;
+#ifdef MC_CLOCK_CORESRC_DEFAULTRATE
+ int core_src_rate = MC_CLOCK_CORESRC_DEFAULTRATE;
+#ifdef MC_CRYPTO_CLOCK_CORESRC_PROPNAME
+ u32 of_core_src_rate = MC_CLOCK_CORESRC_DEFAULTRATE;
+#endif
+#endif
+#ifdef TT_CRYPTO_NO_CLOCK_SUPPORT_FEATURE
+ struct device_node *np;
+
+ np = of_find_node_by_name(NULL, TT_CLOCK_DEVICE_NAME);
+ if (!np) {
+ ret = -ENOENT;
+ mc_dev_err(ret, "cannot get clock device from DT");
+ goto error;
+ }
+
+ clk_ctx.no_clock_support =
+ of_property_read_bool(np, TT_CRYPTO_NO_CLOCK_SUPPORT_FEATURE);
+ if (clk_ctx.no_clock_support)
+ return 0;
+#endif /* TT_CRYPTO_NO_CLOCK_SUPPORT_FEATURE */
+
+#ifdef MC_CLOCK_CORESRC_DEFAULTRATE
+#ifdef MC_CRYPTO_CLOCK_CORESRC_PROPNAME
+ /* Get core clk src */
+ clk_ctx.mc_ce_core_src_clk = clk_get(g_ctx.mcd, "core_clk_src");
+ if (IS_ERR(clk_ctx.mc_ce_core_src_clk)) {
+ ret = PTR_ERR(clk_ctx.mc_ce_core_src_clk);
+ mc_dev_err(ret, "cannot get core src clock");
+ goto error;
+ }
+#endif
+
+#ifdef MC_CRYPTO_CLOCK_CORESRC_PROPNAME
+ ret = of_property_read_u32(g_ctx.mcd->of_node,
+ MC_CRYPTO_CLOCK_CORESRC_PROPNAME,
+ &of_core_src_rate);
+ if (ret) {
+ core_src_rate = MC_CLOCK_CORESRC_DEFAULTRATE;
+ mc_dev_info("cannot get clock frequency from DT, use %d",
+ core_src_rate);
+ } else {
+ core_src_rate = of_core_src_rate;
+ }
+
+#endif /* MC_CRYPTO_CLOCK_CORESRC_PROPNAME */
+
+ ret = clk_set_rate(clk_ctx.mc_ce_core_src_clk, core_src_rate);
+ if (ret) {
+ clk_put(clk_ctx.mc_ce_core_src_clk);
+ clk_ctx.mc_ce_core_src_clk = NULL;
+ mc_dev_err(ret, "cannot set core clock src rate");
+ ret = -EIO;
+ goto error;
+ }
+#endif /* MC_CLOCK_CORESRC_DEFAULTRATE */
+
+ /* Get core clk */
+ clk_ctx.mc_ce_core_clk = clk_get(g_ctx.mcd, "core_clk");
+ if (IS_ERR(clk_ctx.mc_ce_core_clk)) {
+ ret = PTR_ERR(clk_ctx.mc_ce_core_clk);
+ mc_dev_err(ret, "cannot get core clock");
+ goto error;
+ }
+
+ /* Get Interface clk */
+ clk_ctx.mc_ce_iface_clk = clk_get(g_ctx.mcd, "iface_clk");
+ if (IS_ERR(clk_ctx.mc_ce_iface_clk)) {
+ clk_put(clk_ctx.mc_ce_core_clk);
+ ret = PTR_ERR(clk_ctx.mc_ce_iface_clk);
+ mc_dev_err(ret, "cannot get iface clock");
+ goto error;
+ }
+
+ /* Get AXI clk */
+ clk_ctx.mc_ce_bus_clk = clk_get(g_ctx.mcd, "bus_clk");
+ if (IS_ERR(clk_ctx.mc_ce_bus_clk)) {
+ clk_put(clk_ctx.mc_ce_iface_clk);
+ clk_put(clk_ctx.mc_ce_core_clk);
+ ret = PTR_ERR(clk_ctx.mc_ce_bus_clk);
+ mc_dev_err(ret, "cannot get AXI bus clock");
+ goto error;
+ }
+
+ return 0;
+
+error:
+ clk_ctx.mc_ce_core_clk = NULL;
+ clk_ctx.mc_ce_iface_clk = NULL;
+ clk_ctx.mc_ce_bus_clk = NULL;
+ clk_ctx.mc_ce_core_src_clk = NULL;
+ return ret;
+}
+
+void mc_clock_exit(void)
+{
+ if (clk_ctx.no_clock_support)
+ return;
+
+ if (clk_ctx.mc_ce_iface_clk)
+ clk_put(clk_ctx.mc_ce_iface_clk);
+
+ if (clk_ctx.mc_ce_core_clk)
+ clk_put(clk_ctx.mc_ce_core_clk);
+
+ if (clk_ctx.mc_ce_bus_clk)
+ clk_put(clk_ctx.mc_ce_bus_clk);
+
+ if (clk_ctx.mc_ce_core_src_clk)
+ clk_put(clk_ctx.mc_ce_core_src_clk);
+}
+
+int mc_clock_enable(void)
+{
+ int ret;
+
+ if (clk_ctx.no_clock_support)
+ return 0;
+
+ ret = clk_prepare_enable(clk_ctx.mc_ce_core_clk);
+ if (ret) {
+ mc_dev_err(ret, "cannot enable core clock");
+ goto err_core;
+ }
+
+ ret = clk_prepare_enable(clk_ctx.mc_ce_iface_clk);
+ if (ret) {
+ mc_dev_err(ret, "cannot enable interface clock");
+ goto err_iface;
+ }
+
+ ret = clk_prepare_enable(clk_ctx.mc_ce_bus_clk);
+ if (ret) {
+ mc_dev_err(ret, "cannot enable bus clock");
+ goto err_bus;
+ }
+
+ return 0;
+
+err_bus:
+ clk_disable_unprepare(clk_ctx.mc_ce_iface_clk);
+err_iface:
+ clk_disable_unprepare(clk_ctx.mc_ce_core_clk);
+err_core:
+ return ret;
+}
+
+void mc_clock_disable(void)
+{
+ if (clk_ctx.no_clock_support)
+ return;
+
+ if (clk_ctx.mc_ce_iface_clk)
+ clk_disable_unprepare(clk_ctx.mc_ce_iface_clk);
+
+ if (clk_ctx.mc_ce_core_clk)
+ clk_disable_unprepare(clk_ctx.mc_ce_core_clk);
+
+ if (clk_ctx.mc_ce_bus_clk)
+ clk_disable_unprepare(clk_ctx.mc_ce_bus_clk);
+}
+
+#endif /* MC_CRYPTO_CLOCK_MANAGEMENT */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clock.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clock.h
new file mode 100644
index 0000000..09b4884
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/clock.h
@@ -0,0 +1,44 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_CLOCK_H_
+#define _MC_CLOCK_H_
+
+#include "platform.h" /* MC_CRYPTO_CLOCK_MANAGEMENT */
+
+#ifdef MC_CRYPTO_CLOCK_MANAGEMENT
+
+/* Initialize secure crypto clocks */
+int mc_clock_init(void);
+/* Free secure crypto clocks */
+void mc_clock_exit(void);
+/* Enable secure crypto clocks */
+int mc_clock_enable(void);
+/* Disable secure crypto clocks */
+void mc_clock_disable(void);
+
+#else /* MC_CRYPTO_CLOCK_MANAGEMENT */
+
+static inline int mc_clock_init(void)
+{
+ return 0;
+}
+
+static inline void mc_clock_exit(void)
+{
+}
+
+static inline int mc_clock_enable(void)
+{
+ return 0;
+}
+
+static inline void mc_clock_disable(void)
+{
+}
+
+#endif /* !MC_CRYPTO_CLOCK_MANAGEMENT */
+
+#endif /* _MC_CLOCK_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/fastcall.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/fastcall.c
new file mode 100644
index 0000000..895a245
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/fastcall.c
@@ -0,0 +1,367 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/sched.h> /* local_clock */
+#include <linux/version.h>
+#include <linux/sched/clock.h> /* local_clock */
+
+#include "mci/mcifc.h"
+
+#include "platform.h" /* MC_SMC_FASTCALL */
+#include "main.h"
+#include "fastcall.h"
+
+/* Use the arch_extension sec pseudo op before switching to secure world */
+#if defined(__GNUC__) && \
+ defined(__GNUC_MINOR__) && \
+ defined(__GNUC_PATCHLEVEL__) && \
+ ((__GNUC__ * 10000 + __GNUC_MINOR__ * 100 + __GNUC_PATCHLEVEL__)) \
+ >= 40502
+#ifndef CONFIG_ARM64
+#define MC_ARCH_EXTENSION_SEC
+#endif
+#endif
+
+/* Base for all fastcalls, do not use outside of other structs */
+union fc_common {
+ struct {
+ u32 cmd;
+ u32 param[3];
+ } in;
+
+ struct {
+ u32 resp;
+ u32 ret;
+ u32 param[2];
+ } out;
+};
+
+union fc_init {
+ union fc_common common;
+
+ struct {
+ u32 cmd;
+ u32 base;
+ u32 nq_info;
+ u32 mcp_info;
+ } in;
+
+ struct {
+ u32 resp;
+ u32 ret;
+ u32 flags;
+ u32 rfu;
+ } out;
+};
+
+union fc_info {
+ union fc_common common;
+
+ struct {
+ u32 cmd;
+ u32 ext_info_id;
+ } in;
+
+ struct {
+ u32 resp;
+ u32 ret;
+ u32 state;
+ u32 ext_info;
+ } out;
+};
+
+union fc_trace {
+ union fc_common common;
+
+ struct {
+ u32 cmd;
+ u32 buffer_low;
+ u32 buffer_high;
+ u32 size;
+ } in;
+
+ struct {
+ u32 resp;
+ u32 ret;
+ } out;
+};
+
+union fc_nsiq {
+ union fc_common common;
+
+ struct {
+ u32 cmd;
+ u32 debug_ret;
+ u32 debug_session_id;
+ u32 debug_payload;
+ } in;
+
+ struct {
+ u32 resp;
+ u32 ret;
+ } out;
+};
+
+union fc_yield {
+ union fc_common common;
+
+ struct {
+ u32 cmd;
+ u32 debug_ret;
+ u32 debug_timeslice;
+ } in;
+
+ struct {
+ u32 resp;
+ u32 ret;
+ } out;
+};
+
+/* Structure to log SMC calls */
+struct smc_log_entry {
+ u64 cpu_clk;
+ int cpu_id;
+ union fc_common fc;
+};
+
+#define SMC_LOG_SIZE 1024
+static struct smc_log_entry smc_log[SMC_LOG_SIZE];
+static int smc_log_index;
+
+/*
+ * convert fast call return code to linux driver module error code
+ */
+static int convert_fc_ret(u32 ret)
+{
+ switch (ret) {
+ case MC_FC_RET_OK:
+ return 0;
+ case MC_FC_RET_ERR_INVALID:
+ return -EINVAL;
+ case MC_FC_RET_ERR_ALREADY_INITIALIZED:
+ return -EBUSY;
+ default:
+ return -EFAULT;
+ }
+}
+
+/*
+ * __smc() - fast call to MobiCore
+ *
+ * @data: pointer to fast call data
+ */
+static inline int __smc(union fc_common *fc, const char *func)
+{
+ int ret = 0;
+
+ /* Log SMC call */
+ smc_log[smc_log_index].cpu_clk = local_clock();
+ smc_log[smc_log_index].cpu_id = raw_smp_processor_id();
+ smc_log[smc_log_index].fc = *fc;
+ if (++smc_log_index >= SMC_LOG_SIZE)
+ smc_log_index = 0;
+
+#ifdef MC_SMC_FASTCALL
+ ret = smc_fastcall(fc, sizeof(*fc));
+#else /* MC_SMC_FASTCALL */
+ {
+#ifdef CONFIG_ARM64
+ /* SMC expect values in x0-x3 */
+ register u64 reg0 __asm__("x0") = fc->in.cmd;
+ register u64 reg1 __asm__("x1") = fc->in.param[0];
+ register u64 reg2 __asm__("x2") = fc->in.param[1];
+ register u64 reg3 __asm__("x3") = fc->in.param[2];
+
+ /*
+ * According to AARCH64 SMC Calling Convention (ARM DEN 0028A),
+ * section 3.1: registers x4-x17 are unpredictable/scratch
+ * registers. So we have to make sure that the compiler does
+ * not allocate any of those registers by letting him know that
+ * the asm code might clobber them.
+ */
+ __asm__ volatile (
+ "smc #0\n"
+ : "+r"(reg0), "+r"(reg1), "+r"(reg2), "+r"(reg3)
+ :
+ : "x4", "x5", "x6", "x7", "x8", "x9", "x10", "x11",
+ "x12", "x13", "x14", "x15", "x16", "x17"
+ );
+#else /* CONFIG_ARM64 */
+ /* SMC expect values in r0-r3 */
+ register u32 reg0 __asm__("r0") = fc->in.cmd;
+ register u32 reg1 __asm__("r1") = fc->in.param[0];
+ register u32 reg2 __asm__("r2") = fc->in.param[1];
+ register u32 reg3 __asm__("r3") = fc->in.param[2];
+
+ __asm__ volatile (
+#ifdef MC_ARCH_EXTENSION_SEC
+ /*
+ * This pseudo op is supported and required from
+ * binutils 2.21 on
+ */
+ ".arch_extension sec\n"
+#endif /* MC_ARCH_EXTENSION_SEC */
+ "smc #0\n"
+ : "+r"(reg0), "+r"(reg1), "+r"(reg2), "+r"(reg3)
+ );
+
+#endif /* !CONFIG_ARM64 */
+
+ /* set response */
+ fc->out.resp = reg0;
+ fc->out.ret = reg1;
+ fc->out.param[0] = reg2;
+ fc->out.param[1] = reg3;
+ }
+#endif /* !MC_SMC_FASTCALL */
+
+ if (ret) {
+ mc_dev_err(ret, "failed for %s", func);
+ } else {
+ ret = convert_fc_ret(fc->out.ret);
+ if (ret)
+ mc_dev_err(ret, "%s failed (%x)", func, fc->out.ret);
+ }
+
+ return ret;
+}
+
+#define smc(__fc__) __smc(__fc__.common, __func__)
+
+int fc_init(uintptr_t addr, ptrdiff_t off, size_t q_len, size_t buf_len)
+{
+ union fc_init fc;
+#ifdef CONFIG_ARM64
+ u32 addr_high = (u32)(addr >> 32);
+#else
+ u32 addr_high = 0;
+#endif
+
+ /* Call the INIT fastcall to setup MobiCore initialization */
+ memset(&fc, 0, sizeof(fc));
+ fc.in.cmd = MC_FC_INIT;
+ /* base address of mci buffer PAGE_SIZE (default is 4KB) aligned */
+ fc.in.base = (u32)addr;
+ /* notification buffer start/length [16:16] [start, length] */
+ fc.in.nq_info = (u32)(((addr_high & 0xFFFF) << 16) | (q_len & 0xFFFF));
+ /* mcp buffer start/length [16:16] [start, length] */
+ fc.in.mcp_info = (u32)((off << 16) | (buf_len & 0xFFFF));
+ mc_dev_devel("cmd=0x%08x, base=0x%08x, nq_info=0x%08x, mcp_info=0x%08x",
+ fc.in.cmd, fc.in.base, fc.in.nq_info,
+ fc.in.mcp_info);
+ return smc(&fc);
+}
+
+int fc_info(u32 ext_info_id, u32 *state, u32 *ext_info)
+{
+ union fc_info fc;
+ int ret = 0;
+
+ memset(&fc, 0, sizeof(fc));
+ fc.in.cmd = MC_FC_INFO;
+ fc.in.ext_info_id = ext_info_id;
+ ret = smc(&fc);
+ if (ret) {
+ if (state)
+ *state = MC_STATUS_NOT_INITIALIZED;
+
+ if (ext_info)
+ *ext_info = 0;
+
+ mc_dev_err(ret, "failed for index %d", ext_info_id);
+ } else {
+ if (state)
+ *state = fc.out.state;
+
+ if (ext_info)
+ *ext_info = fc.out.ext_info;
+ }
+
+ return ret;
+}
+
+int fc_trace_init(phys_addr_t buffer, u32 size)
+{
+ union fc_trace fc;
+
+ memset(&fc, 0, sizeof(fc));
+ fc.in.cmd = MC_FC_MEM_TRACE;
+ fc.in.buffer_low = (u32)buffer;
+#ifdef CONFIG_ARM64
+ fc.in.buffer_high = (u32)(buffer >> 32);
+#endif
+ fc.in.size = size;
+ return smc(&fc);
+}
+
+int fc_trace_deinit(void)
+{
+ return fc_trace_init(0, 0);
+}
+
+/* sid, payload only used for debug purpose */
+int fc_nsiq(u32 session_id, u32 payload)
+{
+ union fc_nsiq fc;
+
+ memset(&fc, 0, sizeof(fc));
+ fc.in.cmd = MC_SMC_N_SIQ;
+ fc.in.debug_session_id = session_id;
+ fc.in.debug_payload = payload;
+ return smc(&fc);
+}
+
+/* timeslice only used for debug purpose */
+int fc_yield(u32 timeslice)
+{
+ union fc_yield fc;
+
+ memset(&fc, 0, sizeof(fc));
+ fc.in.cmd = MC_SMC_N_YIELD;
+ fc.in.debug_timeslice = timeslice;
+ return smc(&fc);
+}
+
+static int show_smc_log_entry(struct kasnprintf_buf *buf,
+ struct smc_log_entry *entry)
+{
+ return kasnprintf(buf, "%20llu %10d 0x%08x 0x%08x 0x%08x 0x%08x\n",
+ entry->cpu_clk, entry->cpu_id, entry->fc.in.cmd,
+ entry->fc.in.param[0], entry->fc.in.param[1],
+ entry->fc.in.param[2]);
+}
+
+/*
+ * Dump SMC log circular buffer, starting from oldest command. It is assumed
+ * nothing goes in any more at this point.
+ */
+int mc_fastcall_debug_smclog(struct kasnprintf_buf *buf)
+{
+ int i, ret = 0;
+
+ ret = kasnprintf(buf, "%10s %20s %10s %-10s %-10s %-10s\n", "CPU id",
+ "CPU clock", "command", "param1", "param2", "param3");
+ if (ret < 0)
+ return ret;
+
+ if (smc_log[smc_log_index].cpu_clk)
+ /* Buffer has wrapped around, dump end (oldest records) */
+ for (i = smc_log_index; i < SMC_LOG_SIZE; i++) {
+ ret = show_smc_log_entry(buf, &smc_log[i]);
+ if (ret < 0)
+ return ret;
+ }
+
+ /* Dump first records */
+ for (i = 0; i < smc_log_index; i++) {
+ ret = show_smc_log_entry(buf, &smc_log[i]);
+ if (ret < 0)
+ return ret;
+ }
+
+ return ret;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/fastcall.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/fastcall.h
new file mode 100644
index 0000000..c3adbda
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/fastcall.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _TBASE_FASTCALL_H_
+#define _TBASE_FASTCALL_H_
+
+int fc_init(uintptr_t base_pa, ptrdiff_t off, size_t q_len, size_t buf_len);
+int fc_info(u32 ext_info_id, u32 *state, u32 *ext_info);
+int fc_trace_init(phys_addr_t buffer, u32 size);
+int fc_trace_deinit(void);
+int fc_nsiq(u32 session_id, u32 payload);
+int fc_yield(u32 timeslice);
+
+int mc_fastcall_debug_smclog(struct kasnprintf_buf *buf);
+
+#endif /* _TBASE_FASTCALL_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/iwp.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/iwp.c
new file mode 100644
index 0000000..76f43fe
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/iwp.c
@@ -0,0 +1,1206 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/device.h>
+#include <linux/sched.h>
+#include <linux/kthread.h>
+#include <linux/completion.h>
+#include <linux/circ_buf.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/debugfs.h>
+#include <linux/of_irq.h>
+#include <linux/freezer.h>
+#include <asm/barrier.h>
+#include <linux/irq.h>
+#include <linux/version.h>
+#include <linux/sched/clock.h> /* local_clock */
+
+#include "public/GP/tee_client_api.h" /* GP error codes/origins FIXME move */
+#include "public/mc_user.h"
+#include "public/mc_admin.h"
+
+#include "mci/mcimcp.h"
+#include "mci/mcifc.h"
+#include "mci/mcinq.h" /* SID_MCP */
+#include "mci/mcitime.h" /* struct mcp_time */
+#include "mci/mciiwp.h"
+
+#include "main.h"
+#include "admin.h" /* tee_object* for 'blob' */
+#include "mmu.h" /* MMU for 'blob' */
+#include "nq.h"
+#include "xen_fe.h"
+#include "iwp.h"
+
+#define IWP_RETRIES 5
+#define IWP_TIMEOUT 10
+#define INVALID_IWS_SLOT 0xFFFFFFFF
+
+/* Macros */
+#define _TEEC_GET_PARAM_TYPE(t, i) (((t) >> (4 * (i))) & 0xF)
+
+/* Parameter number */
+#define _TEEC_PARAMETER_NUMBER 4
+
+struct iws {
+ struct list_head list;
+ u64 slot;
+};
+
+static struct {
+ bool iwp_dead;
+ struct interworld_session *iws;
+ /* Interworld lists lock */
+ struct mutex iws_list_lock;
+ /* InterWorld lists */
+ struct iws *iws_list_pool;
+ struct list_head free_iws;
+ struct list_head allocd_iws;
+ /* Sessions */
+ struct mutex sessions_lock;
+ struct list_head sessions;
+ /* TEE bad state detection */
+ struct notifier_block tee_stop_notifier;
+ /* Log of last commands */
+#define LAST_CMDS_SIZE 256
+ struct mutex last_cmds_mutex; /* Log protection */
+ struct command_info {
+ u64 cpu_clk; /* Kernel time */
+ pid_t pid; /* Caller PID */
+ u32 id; /* IWP command ID */
+ u32 session_id;
+ char uuid_str[34];
+ enum state {
+ UNUSED, /* Unused slot */
+ PENDING, /* Previous command in progress */
+ SENT, /* Waiting for response */
+ COMPLETE, /* Got result */
+ FAILED, /* Something went wrong */
+ } state; /* Command processing state */
+ struct gp_return result; /* Command result */
+ int errno; /* Return code */
+ } last_cmds[LAST_CMDS_SIZE];
+ int last_cmds_index;
+} l_ctx;
+
+static void iwp_notif_handler(u32 id, u32 payload)
+{
+ struct iwp_session *iwp_session = NULL, *candidate;
+
+ mutex_lock(&l_ctx.sessions_lock);
+ list_for_each_entry(candidate, &l_ctx.sessions, list) {
+ mc_dev_devel("candidate->slot [%08llx]", candidate->slot);
+ /* If id is SID_CANCEL_OPERATION, there is pseudo session */
+ if (candidate->slot == payload &&
+ (id != SID_CANCEL_OPERATION || candidate->sid == id)) {
+ iwp_session = candidate;
+ break;
+ }
+ }
+ mutex_unlock(&l_ctx.sessions_lock);
+
+ if (!iwp_session) {
+ mc_dev_err(-ENXIO, "IWP no session found for id=0x%x slot=0x%x",
+ id, payload);
+ return;
+ }
+
+ mc_dev_devel("IWP: iwp_session [%p] id [%08x] slot [%08x]",
+ iwp_session, id, payload);
+ nq_session_state_update(&iwp_session->nq_session, NQ_NOTIF_RECEIVED);
+ complete(&iwp_session->completion);
+}
+
+void iwp_session_init(struct iwp_session *iwp_session,
+ const struct identity *identity)
+{
+ nq_session_init(&iwp_session->nq_session, true);
+ iwp_session->sid = SID_INVALID;
+ iwp_session->slot = INVALID_IWS_SLOT;
+ INIT_LIST_HEAD(&iwp_session->list);
+ mutex_init(&iwp_session->notif_wait_lock);
+ init_completion(&iwp_session->completion);
+ mutex_init(&iwp_session->iws_lock);
+ iwp_session->state = IWP_SESSION_RUNNING;
+ if (identity)
+ iwp_session->client_identity = *identity;
+}
+
+static u64 iws_slot_get(void)
+{
+ struct iws *iws;
+ u64 slot = INVALID_IWS_SLOT;
+
+ if (is_xen_domu())
+ return (uintptr_t)kzalloc(sizeof(*iws), GFP_KERNEL);
+
+ mutex_lock(&l_ctx.iws_list_lock);
+ if (!list_empty(&l_ctx.free_iws)) {
+ iws = list_first_entry(&l_ctx.free_iws, struct iws, list);
+ slot = iws->slot;
+ list_move(&iws->list, &l_ctx.allocd_iws);
+ atomic_inc(&g_ctx.c_slots);
+ mc_dev_devel("got slot %llu", slot);
+ }
+ mutex_unlock(&l_ctx.iws_list_lock);
+ return slot;
+}
+
+/* Passing INVALID_IWS_SLOT is supported */
+static void iws_slot_put(u64 slot)
+{
+ struct iws *iws;
+ bool found = false;
+
+ if (is_xen_domu()) {
+ kfree((void *)(uintptr_t)slot);
+ return;
+ }
+
+ mutex_lock(&l_ctx.iws_list_lock);
+ list_for_each_entry(iws, &l_ctx.allocd_iws, list) {
+ if (slot == iws->slot) {
+ list_move(&iws->list, &l_ctx.free_iws);
+ atomic_dec(&g_ctx.c_slots);
+ found = true;
+ mc_dev_devel("put slot %llu", slot);
+ break;
+ }
+ }
+ mutex_unlock(&l_ctx.iws_list_lock);
+
+ if (!found)
+ mc_dev_err(-EINVAL, "slot %llu not found", slot);
+}
+
+static inline struct interworld_session *slot_to_iws(u64 slot)
+{
+ if (is_xen_domu())
+ return (struct interworld_session *)(uintptr_t)slot;
+
+ return (struct interworld_session *)((uintptr_t)l_ctx.iws + (u32)slot);
+}
+
+/*
+ * IWP command functions
+ */
+static int iwp_cmd(struct iwp_session *iwp_session, u32 id,
+ struct teec_uuid *uuid, bool killable)
+{
+ struct command_info *cmd_info;
+ int ret;
+
+ /* Initialize MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ cmd_info = &l_ctx.last_cmds[l_ctx.last_cmds_index];
+ memset(cmd_info, 0, sizeof(*cmd_info));
+ cmd_info->cpu_clk = local_clock();
+ cmd_info->pid = current->pid;
+ cmd_info->id = id;
+ if (id == SID_OPEN_SESSION || id == SID_OPEN_TA) {
+ /* Keep UUID because it's an 'open session' cmd */
+ const char *cuuid = (const char *)uuid;
+ size_t i;
+
+ cmd_info->uuid_str[0] = ' ';
+ for (i = 0; i < sizeof(*uuid); i++) {
+ snprintf(&cmd_info->uuid_str[1 + i * 2], 3, "%02x",
+ cuuid[i]);
+ }
+ } else if (id == SID_CANCEL_OPERATION) {
+ struct interworld_session *iws = slot_to_iws(iwp_session->slot);
+
+ if (iws)
+ cmd_info->session_id = iws->session_handle;
+ else
+ cmd_info->session_id = 0;
+ } else {
+ cmd_info->session_id = iwp_session->sid;
+ }
+
+ cmd_info->state = PENDING;
+ iwp_set_ret(0, &cmd_info->result);
+ if (++l_ctx.last_cmds_index >= LAST_CMDS_SIZE)
+ l_ctx.last_cmds_index = 0;
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+
+ if (l_ctx.iwp_dead)
+ return -EHOSTUNREACH;
+
+ mc_dev_devel("psid [%08x], sid [%08x]", id, iwp_session->sid);
+ ret = nq_session_notify(&iwp_session->nq_session, id,
+ iwp_session->slot);
+ if (ret) {
+ mc_dev_err(ret, "sid [%08x]: sending failed", iwp_session->sid);
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ cmd_info->errno = ret;
+ cmd_info->state = FAILED;
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+ return ret;
+ }
+
+ /* Update MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ cmd_info->state = SENT;
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+
+ /*
+ * NB: Wait cannot be interruptible as we need an answer from SWd. It's
+ * up to the user-space to request a cancellation (for open session and
+ * command invocation operations.)
+ *
+ * We do provide a way out to make applications killable in some cases
+ * though.
+ */
+ if (killable) {
+ ret = wait_for_completion_killable(&iwp_session->completion);
+ if (ret) {
+ iwp_request_cancellation(iwp_session->slot);
+ /* Make sure the SWd did not die in the meantime */
+ if (l_ctx.iwp_dead)
+ return -EHOSTUNREACH;
+
+ wait_for_completion(&iwp_session->completion);
+ }
+ } else {
+ wait_for_completion(&iwp_session->completion);
+ }
+
+ if (l_ctx.iwp_dead)
+ return -EHOSTUNREACH;
+
+ /* Update MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ {
+ struct interworld_session *iws = slot_to_iws(iwp_session->slot);
+
+ cmd_info->result.origin = iws->return_origin;
+ cmd_info->result.value = iws->status;
+ if (id == SID_OPEN_SESSION || id == SID_OPEN_TA)
+ cmd_info->session_id = iws->session_handle;
+ }
+ cmd_info->state = COMPLETE;
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+ nq_session_state_update(&iwp_session->nq_session, NQ_NOTIF_CONSUMED);
+ return 0;
+}
+
+/*
+ * Convert errno into GP error and set origin to COMMS.
+ * Note: -ECHILD is used to tell the caller that we have a GP error in value, so
+ * we return 0 on success and -ECHILD on error. If -ECHILD is given, we assume
+ * that value is already correctly set.
+ */
+int iwp_set_ret(int ret, struct gp_return *gp_ret)
+{
+ if (ret == -ECHILD) {
+ /* Already set */
+ return ret;
+ }
+
+ gp_ret->origin = TEEC_ORIGIN_COMMS;
+ switch (ret) {
+ case 0:
+ gp_ret->origin = TEEC_ORIGIN_TRUSTED_APP;
+ gp_ret->value = TEEC_SUCCESS;
+ return 0;
+ case -EACCES:
+ gp_ret->value = TEEC_ERROR_ACCESS_DENIED;
+ break;
+ case -EBUSY:
+ gp_ret->value = TEEC_ERROR_BUSY;
+ break;
+ case -ECANCELED:
+ gp_ret->value = TEEC_ERROR_CANCEL;
+ break;
+ case -EINVAL:
+ case -EFAULT:
+ gp_ret->value = TEEC_ERROR_BAD_PARAMETERS;
+ break;
+ case -EKEYREJECTED:
+ gp_ret->value = TEEC_ERROR_SECURITY;
+ break;
+ case -ENOENT:
+ gp_ret->value = TEEC_ERROR_ITEM_NOT_FOUND;
+ break;
+ case -ENOMEM:
+ gp_ret->value = TEEC_ERROR_OUT_OF_MEMORY;
+ break;
+ case -EHOSTUNREACH:
+ /* Tee crashed */
+ gp_ret->value = TEEC_ERROR_TARGET_DEAD;
+ break;
+ case -ENXIO:
+ /* Session not found or not running */
+ gp_ret->value = TEEC_ERROR_BAD_STATE;
+ break;
+ default:
+ gp_ret->value = TEEC_ERROR_GENERIC;
+ }
+ return -ECHILD;
+}
+
+int iwp_register_shared_mem(struct tee_mmu *mmu, u32 *sva,
+ struct gp_return *gp_ret)
+{
+ int ret;
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_gp_register_shared_mem(mmu, sva, gp_ret);
+#endif
+
+ ret = mcp_map(SID_MEMORY_REFERENCE, mmu, sva);
+ /* iwp_set_ret would override the origin if called after */
+ ret = iwp_set_ret(ret, gp_ret);
+ if (ret)
+ gp_ret->origin = TEEC_ORIGIN_TEE;
+
+ return ret;
+}
+
+int iwp_release_shared_mem(struct mcp_buffer_map *map)
+{
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_gp_release_shared_mem(map);
+#endif
+
+ return mcp_unmap(SID_MEMORY_REFERENCE, map);
+}
+
+static int iwp_operation_to_iws(struct gp_operation *operation,
+ struct interworld_session *iws,
+ struct mc_ioctl_buffer *bufs,
+ struct gp_shared_memory **parents)
+{
+ int param_type, i;
+
+ iws->param_types = 0;
+ for (i = 0; i < _TEEC_PARAMETER_NUMBER; i++) {
+ /* Reset reference for temporary memory */
+ bufs[i].va = 0;
+ /* Reset reference for registered memory */
+ parents[i] = NULL;
+ param_type = _TEEC_GET_PARAM_TYPE(operation->param_types, i);
+
+ switch (param_type) {
+ case TEEC_NONE:
+ case TEEC_VALUE_OUTPUT:
+ break;
+ case TEEC_VALUE_INPUT:
+ case TEEC_VALUE_INOUT:
+ iws->params[i].value.a = operation->params[i].value.a;
+ iws->params[i].value.b = operation->params[i].value.b;
+ break;
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ if (operation->params[i].tmpref.buffer) {
+ struct gp_temp_memref *tmpref;
+
+ tmpref = &operation->params[i].tmpref;
+ /* Prepare buffer to map */
+ bufs[i].va = tmpref->buffer;
+ if (tmpref->size > BUFFER_LENGTH_MAX) {
+ mc_dev_err(-EINVAL,
+ "buffer size %llu too big",
+ tmpref->size);
+ return -EINVAL;
+ }
+
+ bufs[i].len = tmpref->size;
+ if (param_type == TEEC_MEMREF_TEMP_INPUT)
+ bufs[i].flags = MC_IO_MAP_INPUT;
+ else if (param_type == TEEC_MEMREF_TEMP_OUTPUT)
+ bufs[i].flags = MC_IO_MAP_OUTPUT;
+ else
+ bufs[i].flags = MC_IO_MAP_INPUT_OUTPUT;
+ } else {
+ if (operation->params[i].tmpref.size)
+ return -EINVAL;
+
+ /* Null buffer, won't get mapped */
+ iws->params[i].tmpref.physical_address = 0;
+ iws->params[i].tmpref.size = 0;
+ iws->params[i].tmpref.offset = 0;
+ iws->params[i].tmpref.wsm_type = WSM_INVALID;
+ }
+ break;
+ case TEEC_MEMREF_WHOLE:
+ parents[i] = &operation->params[i].memref.parent;
+ iws->params[i].memref.offset = 0;
+ iws->params[i].memref.size =
+ operation->params[i].memref.parent.size;
+ break;
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ parents[i] = &operation->params[i].memref.parent;
+ iws->params[i].memref.offset =
+ operation->params[i].memref.offset;
+ iws->params[i].memref.size =
+ operation->params[i].memref.size;
+ break;
+ default:
+ return -EINVAL;
+ }
+
+ iws->param_types |= (u32)(param_type << (i * 4));
+ }
+
+ return 0;
+}
+
+static inline void iwp_iws_set_tmpref(struct interworld_session *iws, int i,
+ const struct mcp_buffer_map *map)
+{
+ iws->params[i].tmpref.physical_address = map->addr;
+ iws->params[i].tmpref.size = map->length;
+ iws->params[i].tmpref.offset = map->offset;
+ iws->params[i].tmpref.wsm_type = map->type;
+}
+
+static inline void iwp_iws_set_memref(struct interworld_session *iws, int i,
+ u32 sva)
+{
+ iws->params[i].memref.memref_handle = sva;
+}
+
+static inline void iwp_iws_set_refs(struct interworld_session *iws,
+ const struct iwp_buffer_map *maps)
+{
+ int i;
+
+ for (i = 0; i < _TEEC_PARAMETER_NUMBER; i++)
+ if (maps[i].sva)
+ iwp_iws_set_memref(iws, i, maps[i].sva);
+ else if (maps[i].map.addr)
+ iwp_iws_set_tmpref(iws, i, &maps[i].map);
+}
+
+static void iwp_iws_to_operation(const struct interworld_session *iws,
+ struct gp_operation *operation)
+{
+ int i;
+
+ for (i = 0; i < _TEEC_PARAMETER_NUMBER; i++) {
+ switch (_TEEC_GET_PARAM_TYPE(operation->param_types, i)) {
+ case TEEC_VALUE_OUTPUT:
+ case TEEC_VALUE_INOUT:
+ operation->params[i].value.a = iws->params[i].value.a;
+ operation->params[i].value.b = iws->params[i].value.b;
+ break;
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ operation->params[i].tmpref.size =
+ iws->params[i].tmpref.size;
+ break;
+ case TEEC_MEMREF_WHOLE:
+ if (operation->params[i].memref.parent.flags !=
+ TEEC_MEM_INPUT)
+ operation->params[i].memref.size =
+ iws->params[i].tmpref.size;
+ break;
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ operation->params[i].memref.size =
+ iws->params[i].tmpref.size;
+ break;
+ case TEEC_NONE:
+ case TEEC_VALUE_INPUT:
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ break;
+ default:
+ /* Error caught by iwp_operation_to_iws() */
+ break;
+ }
+ }
+}
+
+static inline void mcuuid_to_tee_uuid(const struct mc_uuid_t *in,
+ struct teec_uuid *out)
+{
+ /*
+ * Warning: this code works only on little-endian platforms.
+ */
+ out->time_low = in->value[3] +
+ (in->value[2] << 8) +
+ (in->value[1] << 16) +
+ (in->value[0] << 24);
+ out->time_mid = in->value[5] +
+ (in->value[4] << 8);
+ out->time_hi_and_version = in->value[7] +
+ (in->value[6] << 8);
+ memcpy(out->clock_seq_and_node, in->value + 8, 8);
+}
+
+static const char *origin_to_string(u32 origin)
+{
+ switch (origin) {
+ case TEEC_ORIGIN_API:
+ return "API";
+ case TEEC_ORIGIN_COMMS:
+ return "COMMS";
+ case TEEC_ORIGIN_TEE:
+ return "TEE";
+ case TEEC_ORIGIN_TRUSTED_APP:
+ return "TRUSTED_APP";
+ }
+ return "UNKNOWN";
+}
+
+static const char *value_to_string(u32 value)
+{
+ switch (value) {
+ case TEEC_SUCCESS:
+ return "SUCCESS";
+ case TEEC_ERROR_GENERIC:
+ return "GENERIC";
+ case TEEC_ERROR_ACCESS_DENIED:
+ return "ACCESS_DENIED";
+ case TEEC_ERROR_CANCEL:
+ return "CANCEL";
+ case TEEC_ERROR_ACCESS_CONFLICT:
+ return "ACCESS_CONFLICT";
+ case TEEC_ERROR_EXCESS_DATA:
+ return "EXCESS_DATA";
+ case TEEC_ERROR_BAD_FORMAT:
+ return "BAD_FORMAT";
+ case TEEC_ERROR_BAD_PARAMETERS:
+ return "BAD_PARAMETERS";
+ case TEEC_ERROR_BAD_STATE:
+ return "BAD_STATE";
+ case TEEC_ERROR_ITEM_NOT_FOUND:
+ return "ITEM_NOT_FOUND";
+ case TEEC_ERROR_NOT_IMPLEMENTED:
+ return "NOT_IMPLEMENTED";
+ case TEEC_ERROR_NOT_SUPPORTED:
+ return "NOT_SUPPORTED";
+ case TEEC_ERROR_NO_DATA:
+ return "NO_DATA";
+ case TEEC_ERROR_OUT_OF_MEMORY:
+ return "OUT_OF_MEMORY";
+ case TEEC_ERROR_BUSY:
+ return "BUSY";
+ case TEEC_ERROR_COMMUNICATION:
+ return "COMMUNICATION";
+ case TEEC_ERROR_SECURITY:
+ return "SECURITY";
+ case TEEC_ERROR_SHORT_BUFFER:
+ return "SHORT_BUFFER";
+ case TEEC_ERROR_TARGET_DEAD:
+ return "TARGET_DEAD";
+ case TEEC_ERROR_STORAGE_NO_SPACE:
+ return "STORAGE_NO_SPACE";
+ }
+ return NULL;
+}
+
+static const char *cmd_to_string(u32 id)
+{
+ switch (id) {
+ case SID_OPEN_SESSION:
+ return "open session";
+ case SID_INVOKE_COMMAND:
+ return "invoke command";
+ case SID_CLOSE_SESSION:
+ return "close session";
+ case SID_CANCEL_OPERATION:
+ return "cancel operation";
+ case SID_MEMORY_REFERENCE:
+ return "memory reference";
+ case SID_OPEN_TA:
+ return "open TA";
+ case SID_REQ_TA:
+ return "request TA";
+ }
+ return "unknown";
+}
+
+static const char *state_to_string(enum iwp_session_state state)
+{
+ switch (state) {
+ case IWP_SESSION_RUNNING:
+ return "running";
+ case IWP_SESSION_CLOSE_REQUESTED:
+ return "close requested";
+ case IWP_SESSION_CLOSED:
+ return "closed";
+ }
+ return "error";
+}
+
+int iwp_open_session_prepare(
+ struct iwp_session *iwp_session,
+ struct gp_operation *operation,
+ struct mc_ioctl_buffer *bufs,
+ struct gp_shared_memory **parents,
+ struct gp_return *gp_ret)
+{
+ struct interworld_session *iws;
+ u64 slot, op_slot;
+ int ret = 0;
+
+ /* Get session final slot */
+ slot = iws_slot_get();
+ mc_dev_devel("slot [%08llx]", slot);
+ if (slot == INVALID_IWS_SLOT) {
+ ret = -ENOMEM;
+ mc_dev_err(ret, "can't get slot");
+ return iwp_set_ret(ret, gp_ret);
+ }
+
+ /* Get session temporary slot */
+ op_slot = iws_slot_get();
+ mc_dev_devel("op_slot [%08llx]", op_slot);
+ if (op_slot == INVALID_IWS_SLOT) {
+ ret = -ENOMEM;
+ mc_dev_err(ret, "can't get op_slot");
+ iws_slot_put(slot);
+ return iwp_set_ret(ret, gp_ret);
+ }
+
+ mutex_lock(&iwp_session->iws_lock);
+
+ /* Prepare final session: refer to temporary slot in final one */
+ iwp_session->slot = slot;
+ iws = slot_to_iws(slot);
+ memset(iws, 0, sizeof(*iws));
+
+ /* Prepare temporary session */
+ iwp_session->op_slot = op_slot;
+ iws = slot_to_iws(op_slot);
+ memset(iws, 0, sizeof(*iws));
+
+ if (operation) {
+ ret = iwp_operation_to_iws(operation, iws, bufs, parents);
+ if (ret)
+ iwp_open_session_abort(iwp_session);
+ }
+
+ return iwp_set_ret(ret, gp_ret);
+}
+
+void iwp_open_session_abort(struct iwp_session *iwp_session)
+{
+ iws_slot_put(iwp_session->slot);
+ iws_slot_put(iwp_session->op_slot);
+ mutex_unlock(&iwp_session->iws_lock);
+}
+
+/*
+ * Like open session except we pass the TA blob from NWd to SWd
+ */
+int iwp_open_session(
+ struct iwp_session *iwp_session,
+ const struct mc_uuid_t *uuid,
+ struct gp_operation *operation,
+ const struct iwp_buffer_map *maps,
+ struct interworld_session *iws_in,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret)
+{
+ struct interworld_session *iws = slot_to_iws(iwp_session->slot);
+ struct interworld_session *op_iws = slot_to_iws(iwp_session->op_slot);
+ struct tee_object *obj = NULL;
+ struct tee_mmu *obj_mmu = NULL;
+ struct mcp_buffer_map obj_map;
+ int ret;
+
+ /* Operation is NULL when called from Xen BE */
+ if (operation) {
+ /* Login info */
+ op_iws->login = iwp_session->client_identity.login_type;
+ mc_dev_devel("iws->login [%08x]", op_iws->login);
+ memcpy(&op_iws->client_uuid,
+ iwp_session->client_identity.login_data,
+ sizeof(op_iws->client_uuid));
+
+ /* Put ingoing operation in temporary IWS */
+ iwp_iws_set_refs(op_iws, maps);
+ } else {
+ struct mcp_buffer_map map;
+ int i;
+
+ *op_iws = *iws_in;
+
+ /* Insert correct mapping in operation */
+ for (i = 0; i < 4; i++) {
+ if (!mmus[i])
+ continue;
+
+ tee_mmu_buffer(mmus[i], &map);
+ iwp_iws_set_tmpref(op_iws, i, &map);
+ }
+ }
+
+ /* For the SWd to find the TA slot from the main one */
+ iws->command_id = (u32)iwp_session->op_slot;
+
+ /* TA blob handling */
+ if (!is_xen_domu()) {
+ union mclf_header *header;
+
+ obj = tee_object_get(uuid, true);
+ if (IS_ERR(obj)) {
+ /* Tell SWd to load TA from SFS as not in registry */
+ if (PTR_ERR(obj) == -ENOENT)
+ obj = tee_object_select(uuid);
+
+ if (IS_ERR(obj))
+ return PTR_ERR(obj);
+ }
+
+ /* Convert UUID */
+ header = (union mclf_header *)(&obj->data[obj->header_length]);
+ mcuuid_to_tee_uuid(&header->mclf_header_v2.uuid,
+ &op_iws->target_uuid);
+
+ /* Create mapping for blob (alloc'd by driver => task = NULL) */
+ {
+ struct mc_ioctl_buffer buf = {
+ .va = (uintptr_t)obj->data,
+ .len = obj->length,
+ .flags = MC_IO_MAP_INPUT,
+ };
+
+ obj_mmu = tee_mmu_create(NULL, &buf);
+ if (IS_ERR(obj_mmu)) {
+ ret = PTR_ERR(obj_mmu);
+ goto err_mmu;
+ }
+
+ iws->param_types = TEEC_MEMREF_TEMP_INPUT;
+ tee_mmu_buffer(obj_mmu, &obj_map);
+ iwp_iws_set_tmpref(iws, 0, &obj_map);
+ mc_dev_devel("wsm_type [%04x], offset [%04x]",
+ obj_map.type, obj_map.offset);
+ mc_dev_devel("size [%08x], physical_address [%08llx]",
+ obj_map.length, obj_map.addr);
+ }
+ }
+
+ /* Add to local list of sessions so we can receive the notification */
+ mutex_lock(&l_ctx.sessions_lock);
+ list_add_tail(&iwp_session->list, &l_ctx.sessions);
+ mutex_unlock(&l_ctx.sessions_lock);
+
+ /* Send IWP open command */
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ ret = xen_gp_open_session(iwp_session, uuid, maps, iws, op_iws,
+ gp_ret);
+ else
+#endif
+ ret = iwp_cmd(iwp_session, SID_OPEN_TA, &op_iws->target_uuid,
+ true);
+
+ /* Temporary slot is not needed any more */
+ iws_slot_put(iwp_session->op_slot);
+ /* Treat remote errors as errors, just use a specific errno */
+ if (!ret && iws->status != TEEC_SUCCESS) {
+ gp_ret->origin = iws->return_origin;
+ gp_ret->value = iws->status;
+ ret = -ECHILD;
+ }
+
+ if (!ret) {
+ /* set unique identifier for list search */
+ iwp_session->sid = iws->session_handle;
+ /* Get outgoing operation from main IWS */
+ if (operation)
+ iwp_iws_to_operation(iws, operation);
+ else
+ *iws_in = *iws;
+
+ } else {
+ /* Remove from list of sessions */
+ mutex_lock(&l_ctx.sessions_lock);
+ list_del(&iwp_session->list);
+ mutex_unlock(&l_ctx.sessions_lock);
+ iws_slot_put(iwp_session->slot);
+ mc_dev_devel("failed: %s from %s, ret %d",
+ value_to_string(gp_ret->value),
+ origin_to_string(gp_ret->origin), ret);
+ }
+
+ mutex_unlock(&iwp_session->iws_lock);
+
+ /* Blob not needed as re-mapped by the SWd */
+ if (obj_mmu)
+ tee_mmu_put(obj_mmu);
+
+err_mmu:
+ /* Delete secure object */
+ if (obj)
+ tee_object_free(obj);
+
+ return iwp_set_ret(ret, gp_ret);
+}
+
+static void iwp_session_release(
+ struct iwp_session *iwp_session)
+{
+ iwp_session->state = IWP_SESSION_CLOSED;
+
+ /* Remove from list of sessions */
+ mutex_lock(&l_ctx.sessions_lock);
+ list_del(&iwp_session->list);
+ mutex_unlock(&l_ctx.sessions_lock);
+
+ nq_session_exit(&iwp_session->nq_session);
+ iws_slot_put(iwp_session->slot);
+}
+
+/*
+ * Legacy and GP TAs close differently:
+ * - GP TAs always send a notification with payload, whether on close or crash
+ * - GP TAs may take time to close
+ */
+int iwp_close_session(
+ struct iwp_session *iwp_session)
+{
+ int ret = 0;
+
+ if (is_xen_domu()) {
+#ifdef TRUSTONIC_XEN_DOMU
+ ret = xen_gp_close_session(iwp_session);
+#endif
+ } else {
+ mutex_lock(&iwp_session->iws_lock);
+ iwp_session->state = IWP_SESSION_CLOSE_REQUESTED;
+
+ /* Send IWP open command */
+ ret = iwp_cmd(iwp_session, SID_CLOSE_SESSION, NULL, false);
+ mutex_unlock(&iwp_session->iws_lock);
+ }
+
+ iwp_session_release(iwp_session);
+ mc_dev_devel("close session %x ret %d state %s", iwp_session->sid,
+ ret, state_to_string(iwp_session->state));
+ return ret;
+}
+
+int iwp_invoke_command_prepare(
+ struct iwp_session *iwp_session,
+ u32 command_id,
+ struct gp_operation *operation,
+ struct mc_ioctl_buffer *bufs,
+ struct gp_shared_memory **parents,
+ struct gp_return *gp_ret)
+{
+ struct interworld_session *iws;
+ int ret = 0;
+
+ if (iwp_session->state != IWP_SESSION_RUNNING)
+ return iwp_set_ret(-EBADFD, gp_ret);
+
+ mutex_lock(&iwp_session->iws_lock);
+ iws = slot_to_iws(iwp_session->slot);
+ memset(iws, 0, sizeof(*iws));
+ iws->session_handle = iwp_session->sid;
+ if (operation) {
+ iws->command_id = command_id;
+ ret = iwp_operation_to_iws(operation, iws, bufs, parents);
+ if (ret)
+ iwp_invoke_command_abort(iwp_session);
+ }
+
+ return iwp_set_ret(ret, gp_ret);
+}
+
+void iwp_invoke_command_abort(
+ struct iwp_session *iwp_session)
+{
+ mutex_unlock(&iwp_session->iws_lock);
+}
+
+int iwp_invoke_command(
+ struct iwp_session *iwp_session,
+ struct gp_operation *operation,
+ const struct iwp_buffer_map *maps,
+ struct interworld_session *iws_in,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret)
+{
+ struct interworld_session *iws = slot_to_iws(iwp_session->slot);
+ int ret = 0;
+
+ /* Operation is NULL when called from Xen BE */
+ if (operation) {
+ /* Update IWS with operation maps */
+ iwp_iws_set_refs(iws, maps);
+ } else {
+ struct mcp_buffer_map map;
+ int i;
+
+ *iws = *iws_in;
+
+ /* Insert correct mapping in operation */
+ for (i = 0; i < 4; i++) {
+ if (!mmus[i])
+ continue;
+
+ tee_mmu_buffer(mmus[i], &map);
+ iwp_iws_set_tmpref(iws, i, &map);
+ }
+ }
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ ret = xen_gp_invoke_command(iwp_session, maps, iws, gp_ret);
+ else
+#endif
+ ret = iwp_cmd(iwp_session, SID_INVOKE_COMMAND, NULL, true);
+
+ /* Treat remote errors as errors, just use a specific errno */
+ if (!ret && iws->status != TEEC_SUCCESS)
+ ret = -ECHILD;
+
+ if (operation)
+ iwp_iws_to_operation(iws, operation);
+ else
+ *iws_in = *iws;
+
+ if (ret && (ret != -ECHILD)) {
+ ret = iwp_set_ret(ret, gp_ret);
+ mc_dev_devel("failed with ret [%08x]", ret);
+ } else {
+ gp_ret->origin = iws->return_origin;
+ gp_ret->value = iws->status;
+ }
+
+ mutex_unlock(&iwp_session->iws_lock);
+ return ret;
+}
+
+int iwp_request_cancellation(
+ u64 slot)
+{
+ /* Pseudo IWP session for cancellation */
+ struct iwp_session iwp_session;
+ int ret;
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_gp_request_cancellation(
+ (uintptr_t)slot_to_iws(slot));
+#endif
+
+ iwp_session_init(&iwp_session, NULL);
+ /* sid is local. Set is to SID_CANCEL_OPERATION to make things clear */
+ iwp_session.sid = SID_CANCEL_OPERATION;
+ iwp_session.slot = slot;
+ mutex_lock(&l_ctx.sessions_lock);
+ list_add_tail(&iwp_session.list, &l_ctx.sessions);
+ mutex_unlock(&l_ctx.sessions_lock);
+ ret = iwp_cmd(&iwp_session, SID_CANCEL_OPERATION, NULL, false);
+ mutex_lock(&l_ctx.sessions_lock);
+ list_del(&iwp_session.list);
+ mutex_unlock(&l_ctx.sessions_lock);
+ return ret;
+}
+
+static int debug_sessions(struct kasnprintf_buf *buf)
+{
+ struct iwp_session *session;
+ int ret;
+
+ /* Header */
+ ret = kasnprintf(buf, "%20s %4s %-15s %-11s %7s\n",
+ "CPU clock", "ID", "state", "notif state", "slot");
+ if (ret < 0)
+ return ret;
+
+ mutex_lock(&l_ctx.sessions_lock);
+ list_for_each_entry(session, &l_ctx.sessions, list) {
+ const char *state_str;
+ u64 cpu_clk;
+
+ state_str = nq_session_state(&session->nq_session, &cpu_clk);
+ ret = kasnprintf(buf, "%20llu %4x %-15s %-11s %7llu\n", cpu_clk,
+ session->sid == SID_INVALID ? 0 : session->sid,
+ state_to_string(session->state), state_str,
+ session->slot);
+ if (ret < 0)
+ break;
+ }
+ mutex_unlock(&l_ctx.sessions_lock);
+ return ret;
+}
+
+static ssize_t debug_sessions_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ return debug_generic_read(file, user_buf, count, ppos,
+ debug_sessions);
+}
+
+static const struct file_operations debug_sessions_ops = {
+ .read = debug_sessions_read,
+ .llseek = default_llseek,
+ .open = debug_generic_open,
+ .release = debug_generic_release,
+};
+
+static inline int show_log_entry(struct kasnprintf_buf *buf,
+ struct command_info *cmd_info)
+{
+ const char *state_str = "unknown";
+ const char *value_str = value_to_string(cmd_info->result.value);
+ char value[16];
+
+ switch (cmd_info->state) {
+ case UNUSED:
+ state_str = "unused";
+ break;
+ case PENDING:
+ state_str = "pending";
+ break;
+ case SENT:
+ state_str = "sent";
+ break;
+ case COMPLETE:
+ state_str = "complete";
+ break;
+ case FAILED:
+ state_str = "failed";
+ break;
+ }
+
+ if (!value_str) {
+ snprintf(value, sizeof(value), "%08x", cmd_info->result.value);
+ value_str = value;
+ }
+
+ return kasnprintf(buf, "%20llu %5d %-16s %5x %-8s %5d %-11s %-17s%s\n",
+ cmd_info->cpu_clk, cmd_info->pid,
+ cmd_to_string(cmd_info->id), cmd_info->session_id,
+ state_str, cmd_info->errno,
+ origin_to_string(cmd_info->result.origin), value_str,
+ cmd_info->uuid_str);
+}
+
+static int debug_last_cmds(struct kasnprintf_buf *buf)
+{
+ struct command_info *cmd_info;
+ int i, ret = 0;
+
+ /* Initialize MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ ret = kasnprintf(buf, "%20s %5s %-16s %5s %-8s %5s %-11s %-17s%s\n",
+ "CPU clock", "PID", "command", "S-ID",
+ "state", "errno", "origin", "value", "UUID");
+ if (ret < 0)
+ goto out;
+
+ cmd_info = &l_ctx.last_cmds[l_ctx.last_cmds_index];
+ if (cmd_info->state != UNUSED)
+ /* Buffer has wrapped around, dump end (oldest records) */
+ for (i = l_ctx.last_cmds_index; i < LAST_CMDS_SIZE; i++) {
+ ret = show_log_entry(buf, cmd_info++);
+ if (ret < 0)
+ goto out;
+ }
+
+ /* Dump first records */
+ cmd_info = &l_ctx.last_cmds[0];
+ for (i = 0; i < l_ctx.last_cmds_index; i++) {
+ ret = show_log_entry(buf, cmd_info++);
+ if (ret < 0)
+ goto out;
+ }
+
+out:
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+ return ret;
+}
+
+static ssize_t debug_last_cmds_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ return debug_generic_read(file, user_buf, count, ppos, debug_last_cmds);
+}
+
+static const struct file_operations debug_last_cmds_ops = {
+ .read = debug_last_cmds_read,
+ .llseek = default_llseek,
+ .open = debug_generic_open,
+ .release = debug_generic_release,
+};
+
+static inline void mark_iwp_dead(void)
+{
+ struct iwp_session *session;
+
+ l_ctx.iwp_dead = true;
+ /* Signal all potential waiters that SWd is going away */
+ mutex_lock(&l_ctx.sessions_lock);
+ list_for_each_entry(session, &l_ctx.sessions, list)
+ complete(&session->completion);
+ mutex_unlock(&l_ctx.sessions_lock);
+}
+
+static int tee_stop_notifier_fn(struct notifier_block *nb, unsigned long event,
+ void *data)
+{
+ mark_iwp_dead();
+ return 0;
+}
+
+int iwp_init(void)
+{
+ int i;
+
+ l_ctx.iws = nq_get_iwp_buffer();
+ INIT_LIST_HEAD(&l_ctx.free_iws);
+ INIT_LIST_HEAD(&l_ctx.allocd_iws);
+ l_ctx.iws_list_pool = kcalloc(MAX_IW_SESSION, sizeof(struct iws),
+ GFP_KERNEL);
+ if (!l_ctx.iws_list_pool)
+ return -ENOMEM;
+
+ for (i = 0; i < MAX_IW_SESSION; i++) {
+ l_ctx.iws_list_pool[i].slot =
+ i * sizeof(struct interworld_session);
+ list_add(&l_ctx.iws_list_pool[i].list, &l_ctx.free_iws);
+ }
+
+ mutex_init(&l_ctx.iws_list_lock);
+ INIT_LIST_HEAD(&l_ctx.sessions);
+ mutex_init(&l_ctx.sessions_lock);
+ nq_register_notif_handler(iwp_notif_handler, true);
+ l_ctx.tee_stop_notifier.notifier_call = tee_stop_notifier_fn;
+ nq_register_tee_stop_notifier(&l_ctx.tee_stop_notifier);
+ /* Debugfs */
+ mutex_init(&l_ctx.last_cmds_mutex);
+ return 0;
+}
+
+void iwp_exit(void)
+{
+ mark_iwp_dead();
+ nq_unregister_tee_stop_notifier(&l_ctx.tee_stop_notifier);
+}
+
+int iwp_start(void)
+{
+ /* Create debugfs sessions and last commands entries */
+ debugfs_create_file("iwp_sessions", 0400, g_ctx.debug_dir, NULL,
+ &debug_sessions_ops);
+ debugfs_create_file("last_iwp_commands", 0400, g_ctx.debug_dir, NULL,
+ &debug_last_cmds_ops);
+ return 0;
+}
+
+void iwp_stop(void)
+{
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/iwp.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/iwp.h
new file mode 100644
index 0000000..5e98322
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/iwp.h
@@ -0,0 +1,114 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_IWP_H_
+#define _MC_IWP_H_
+
+#include "mci/mcloadformat.h" /* struct identity */
+
+#include "nq.h"
+#include "mcp.h" /* mcp_buffer_map FIXME move to nq? */
+
+struct iwp_session {
+ /* Notification queue session */
+ struct nq_session nq_session;
+ /* Session ID */
+ u32 sid;
+ /* IWS slot */
+ u64 slot;
+ /* IWS other slot needed at open */
+ u64 op_slot;
+ /* Sessions list (protected by iwp sessions_lock) */
+ struct list_head list;
+ /* Notification waiter lock */
+ struct mutex notif_wait_lock; /* Only one at a time */
+ /* Notification received */
+ struct completion completion;
+ /* Interworld struct lock */
+ struct mutex iws_lock;
+ /* Session state (protected by iwp sessions_lock) */
+ enum iwp_session_state {
+ IWP_SESSION_RUNNING,
+ IWP_SESSION_CLOSE_REQUESTED,
+ IWP_SESSION_CLOSED,
+ } state;
+ /* GP TAs have login information */
+ struct identity client_identity;
+};
+
+struct iwp_buffer_map {
+ struct mcp_buffer_map map;
+ u32 sva;
+};
+
+/* Private to iwp_session structure */
+void iwp_session_init(struct iwp_session *session,
+ const struct identity *identity);
+
+/* Getters */
+static inline u32 iwp_session_id(struct iwp_session *session)
+{
+ return session->sid;
+}
+
+static inline u64 iwp_session_slot(struct iwp_session *session)
+{
+ return session->slot;
+}
+
+/* Convert local errno to GP return values */
+int iwp_set_ret(int ret, struct gp_return *gp_ret);
+
+/* Commands */
+int iwp_register_shared_mem(
+ struct tee_mmu *mmu,
+ u32 *sva,
+ struct gp_return *gp_ret);
+int iwp_release_shared_mem(
+ struct mcp_buffer_map *map);
+int iwp_open_session_prepare(
+ struct iwp_session *session,
+ struct gp_operation *operation,
+ struct mc_ioctl_buffer *bufs,
+ struct gp_shared_memory **parents,
+ struct gp_return *gp_ret);
+void iwp_open_session_abort(
+ struct iwp_session *iwp_session);
+int iwp_open_session(
+ struct iwp_session *iwp_session,
+ const struct mc_uuid_t *uuid,
+ struct gp_operation *operation,
+ const struct iwp_buffer_map *maps,
+ struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret);
+int iwp_close_session(
+ struct iwp_session *iwp_session);
+int iwp_invoke_command_prepare(
+ struct iwp_session *iwp_session,
+ u32 command_id,
+ struct gp_operation *operation,
+ struct mc_ioctl_buffer *bufs,
+ struct gp_shared_memory **parents,
+ struct gp_return *gp_ret);
+void iwp_invoke_command_abort(
+ struct iwp_session *iwp_session);
+int iwp_invoke_command(
+ struct iwp_session *iwp_session,
+ struct gp_operation *operation,
+ const struct iwp_buffer_map *maps,
+ struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret);
+int iwp_request_cancellation(
+ u64 slot);
+
+/* Initialisation/cleanup */
+int iwp_init(void);
+void iwp_exit(void);
+int iwp_start(void);
+void iwp_stop(void);
+
+#endif /* _MC_IWP_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/logging.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/logging.c
new file mode 100644
index 0000000..d92ffb4
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/logging.c
@@ -0,0 +1,238 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/kthread.h>
+#include <linux/mutex.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/debugfs.h>
+#include <linux/version.h>
+
+#include "main.h"
+#include "logging.h"
+
+/* Supported log buffer version */
+#define MC_LOG_VERSION 2
+
+/* Default length of the log ring buffer 256KiB */
+#define LOG_BUF_ORDER 6
+
+/* Max Len of a log line for printing */
+#define LOG_LINE_SIZE 256
+
+/* Definitions for log version 2 */
+#define LOG_TYPE_MASK (0x0007)
+#define LOG_TYPE_CHAR 0
+#define LOG_TYPE_INTEGER 1
+
+/* Field length */
+#define LOG_LENGTH_MASK (0x00F8)
+#define LOG_LENGTH_SHIFT 3
+
+/* Extra attributes */
+#define LOG_EOL (0x0100)
+#define LOG_INTEGER_DECIMAL (0x0200)
+#define LOG_INTEGER_SIGNED (0x0400)
+
+/* active cpu id */
+#define LOG_CPUID_MASK (0xF000)
+#define LOG_CPUID_SHIFT 12
+
+struct mc_logmsg {
+ u16 ctrl; /* Type and format of data */
+ u16 source; /* Unique value for each event source */
+ u32 log_data; /* Value, if any */
+};
+
+/* MobiCore internal trace buffer structure. */
+struct mc_trace_buf {
+ u32 version; /* version of trace buffer */
+ u32 length; /* length of buff */
+ u32 head; /* last write position */
+ u8 buff[]; /* start of the log buffer */
+};
+
+static struct logging_ctx {
+ struct kthread_work work;
+ struct kthread_worker worker;
+ struct task_struct *thread;
+ union {
+ struct mc_trace_buf *trace_buf; /* Circular log buffer */
+ unsigned long trace_page;
+ };
+ u32 tail; /* MobiCore log read position */
+ int thread_err;
+ u16 prev_source; /* Previous Log source */
+ char line[LOG_LINE_SIZE + 1];/* Log Line buffer */
+ u32 line_len; /* Log Line buffer current length */
+ bool enabled; /* Log can be disabled via debugfs */
+ bool dead;
+} log_ctx;
+
+static inline void log_eol(u16 source, u32 cpuid)
+{
+ if (!log_ctx.line_len)
+ return;
+
+ if (log_ctx.prev_source)
+ /* TEE user-space */
+ dev_info(g_ctx.mcd, "%03x(%u)|%s\n", log_ctx.prev_source,
+ cpuid, log_ctx.line);
+ else
+ /* TEE kernel */
+ dev_info(g_ctx.mcd, "mtk(%u)|%s\n", cpuid, log_ctx.line);
+ log_ctx.line[0] = '\0';
+ log_ctx.line_len = 0;
+}
+
+/*
+ * Collect chars in log_ctx.line buffer and output the buffer when it is full.
+ * No locking needed because only "mobicore_log" thread updates this buffer.
+ */
+static inline void log_char(char ch, u16 source, u32 cpuid)
+{
+ if (ch == '\0')
+ return;
+
+ if (ch == '\n' || ch == '\r') {
+ log_eol(source, cpuid);
+ return;
+ }
+
+ if (log_ctx.line_len >= LOG_LINE_SIZE || source != log_ctx.prev_source)
+ log_eol(source, cpuid);
+
+ log_ctx.line[log_ctx.line_len++] = ch;
+ log_ctx.line[log_ctx.line_len] = 0;
+ log_ctx.prev_source = source;
+}
+
+static inline void log_string(u32 ch, u16 source, u32 cpuid)
+{
+ while (ch) {
+ log_char(ch & 0xFF, source, cpuid);
+ ch >>= 8;
+ }
+}
+
+static inline void log_number(u32 format, u32 value, u16 source, u32 cpuid)
+{
+ int width = (format & LOG_LENGTH_MASK) >> LOG_LENGTH_SHIFT;
+ char fmt[16];
+ char buffer[32];
+ const char *reader = buffer;
+
+ if (format & LOG_INTEGER_DECIMAL)
+ if (format & LOG_INTEGER_SIGNED)
+ snprintf(fmt, sizeof(fmt), "%%%ud", width);
+ else
+ snprintf(fmt, sizeof(fmt), "%%%uu", width);
+ else
+ snprintf(fmt, sizeof(fmt), "%%0%ux", width);
+
+ snprintf(buffer, sizeof(buffer), fmt, value);
+ while (*reader)
+ log_char(*reader++, source, cpuid);
+}
+
+static inline int log_msg(void *data)
+{
+ struct mc_logmsg *msg = (struct mc_logmsg *)data;
+ int log_type = msg->ctrl & LOG_TYPE_MASK;
+ int cpuid = ((msg->ctrl & LOG_CPUID_MASK) >> LOG_CPUID_SHIFT);
+
+ switch (log_type) {
+ case LOG_TYPE_CHAR:
+ log_string(msg->log_data, msg->source, cpuid);
+ break;
+ case LOG_TYPE_INTEGER:
+ log_number(msg->ctrl, msg->log_data, msg->source, cpuid);
+ break;
+ }
+ if (msg->ctrl & LOG_EOL)
+ log_eol(msg->source, cpuid);
+
+ return sizeof(*msg);
+}
+
+static void logging_worker(struct kthread_work *work)
+{
+ static DEFINE_MUTEX(local_mutex);
+
+ mutex_lock(&local_mutex);
+ while (log_ctx.trace_buf->head != log_ctx.tail) {
+ if (log_ctx.trace_buf->version != MC_LOG_VERSION) {
+ mc_dev_err(-EINVAL, "Bad log data v%d (exp. v%d), stop",
+ log_ctx.trace_buf->version, MC_LOG_VERSION);
+ log_ctx.dead = true;
+ break;
+ }
+
+ log_ctx.tail += log_msg(&log_ctx.trace_buf->buff[log_ctx.tail]);
+ /* Wrap over if no space left for a complete message */
+ if ((log_ctx.tail + sizeof(struct mc_logmsg)) >
+ log_ctx.trace_buf->length)
+ log_ctx.tail = 0;
+ }
+ mutex_unlock(&local_mutex);
+}
+
+/*
+ * Wake up the log reader thread
+ * This should be called from the places where calls into MobiCore have
+ * generated some logs(eg, yield, SIQ...)
+ */
+void logging_run(void)
+{
+ if (log_ctx.enabled && !log_ctx.dead &&
+ log_ctx.trace_buf->head != log_ctx.tail)
+ kthread_queue_work(&log_ctx.worker, &log_ctx.work);
+}
+
+/*
+ * Setup MobiCore kernel log. It assumes it's running on CORE 0!
+ * The fastcall will complain if that is not the case!
+ */
+int logging_init(phys_addr_t *buffer, u32 *size)
+{
+ /*
+ * We are going to map this buffer into virtual address space in SWd.
+ * To reduce complexity there, we use a contiguous buffer.
+ */
+ log_ctx.trace_page = __get_free_pages(GFP_KERNEL | __GFP_ZERO,
+ LOG_BUF_ORDER);
+ if (!log_ctx.trace_page)
+ return -ENOMEM;
+
+ *buffer = virt_to_phys((void *)(log_ctx.trace_page));
+ *size = BIT(LOG_BUF_ORDER) * PAGE_SIZE;
+
+ /* Logging thread */
+ kthread_init_work(&log_ctx.work, logging_worker);
+ kthread_init_worker(&log_ctx.worker);
+ log_ctx.thread = kthread_create(kthread_worker_fn, &log_ctx.worker,
+ "tee_log");
+ if (IS_ERR(log_ctx.thread))
+ return PTR_ERR(log_ctx.thread);
+
+ wake_up_process(log_ctx.thread);
+
+ /* Debugfs switch */
+ log_ctx.enabled = true;
+ debugfs_create_bool("swd_debug", 0600, g_ctx.debug_dir,
+ &log_ctx.enabled);
+ return 0;
+}
+
+void logging_exit(bool buffer_busy)
+{
+ /*
+ * This is not racey as the only caller for logging_run is the
+ * scheduler which gets stopped before us, and long before we exit.
+ */
+ kthread_stop(log_ctx.thread);
+ if (!buffer_busy)
+ free_pages(log_ctx.trace_page, LOG_BUF_ORDER);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/logging.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/logging.h
new file mode 100644
index 0000000..7a4bc96
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/logging.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_LOGGING_H_
+#define _MC_LOGGING_H_
+
+void logging_run(void);
+int logging_init(phys_addr_t *buffer, u32 *size);
+void logging_exit(bool buffer_busy);
+
+#endif /* _MC_LOGGING_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/main.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/main.c
new file mode 100644
index 0000000..99ef68f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/main.c
@@ -0,0 +1,738 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/platform_device.h>
+#include <linux/module.h>
+#include <linux/cdev.h>
+#include <linux/debugfs.h>
+#include <linux/delay.h>
+#include <linux/of.h>
+#include <linux/reboot.h>
+#include <linux/suspend.h>
+
+#include "public/mc_user.h"
+#include "public/mc_admin.h" /* MC_ADMIN_DEVNODE */
+
+#include "platform.h" /* MC_PM_RUNTIME */
+#include "main.h"
+#include "arm.h"
+#include "admin.h"
+#include "user.h"
+#include "iwp.h"
+#include "mcp.h"
+#include "nq.h"
+#include "client.h"
+#include "xen_be.h"
+#include "xen_fe.h"
+#include "build_tag.h"
+
+/* Default entry for our driver in device tree */
+#ifndef MC_DEVICE_PROPNAME
+#define MC_DEVICE_PROPNAME "trustonic,mobicore"
+#endif
+
+/* Define a MobiCore device structure for use with dev_debug() etc */
+static struct device_driver driver = {
+ .name = "Trustonic"
+};
+
+static struct device device = {
+ .driver = &driver
+};
+
+struct mc_device_ctx g_ctx = {
+ .mcd = &device
+};
+
+static struct {
+ /* Device tree compatibility */
+ bool use_platform_driver;
+ /* TEE start return code mutex */
+ struct mutex start_mutex;
+ /* TEE start return code */
+ int start_ret;
+#ifdef MC_PM_RUNTIME
+ /* Whether hibernation succeeded */
+ bool did_hibernate;
+ /* Reboot notifications */
+ struct notifier_block reboot_notifier;
+ /* PM notifications */
+ struct notifier_block pm_notifier;
+#endif
+ /* Devices */
+ dev_t device;
+ struct class *class;
+ /* Admin device */
+ struct cdev admin_cdev;
+ /* User device */
+ dev_t user_dev;
+ struct cdev user_cdev;
+ /* Debug counters */
+ struct mutex struct_counters_buf_mutex;
+ char struct_counters_buf[256];
+ int struct_counters_buf_len;
+} main_ctx;
+
+static int mobicore_start(void);
+static void mobicore_stop(void);
+
+static bool mobicore_ready;
+bool is_mobicore_ready(void)
+{
+ return mobicore_ready;
+}
+
+int kasnprintf(struct kasnprintf_buf *buf, const char *fmt, ...)
+{
+ va_list args;
+ int max_size = buf->size - buf->off;
+ int i;
+
+ va_start(args, fmt);
+ i = vsnprintf(buf->buf + buf->off, max_size, fmt, args);
+ if (i >= max_size) {
+ int new_size = PAGE_ALIGN(buf->size + i + 1);
+ char *new_buf = krealloc(buf->buf, new_size, buf->gfp);
+
+ if (!new_buf) {
+ i = -ENOMEM;
+ } else {
+ buf->buf = new_buf;
+ buf->size = new_size;
+ max_size = buf->size - buf->off;
+ i = vsnprintf(buf->buf + buf->off, max_size, fmt, args);
+ }
+ }
+
+ if (i > 0)
+ buf->off += i;
+
+ va_end(args);
+ return i;
+}
+
+static inline void kasnprintf_buf_reset(struct kasnprintf_buf *buf)
+{
+ kfree(buf->buf);
+ buf->buf = NULL;
+ buf->size = 0;
+ buf->off = 0;
+}
+
+ssize_t debug_generic_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos,
+ int (*function)(struct kasnprintf_buf *buf))
+{
+ struct kasnprintf_buf *buf = file->private_data;
+ int ret = 0;
+
+ mutex_lock(&buf->mutex);
+ /* Add/update buffer */
+ if (!*ppos) {
+ kasnprintf_buf_reset(buf);
+ ret = function(buf);
+ if (ret < 0) {
+ kasnprintf_buf_reset(buf);
+ goto end;
+ }
+ }
+
+ ret = simple_read_from_buffer(user_buf, count, ppos, buf->buf,
+ buf->off);
+
+end:
+ mutex_unlock(&buf->mutex);
+ return ret;
+}
+
+int debug_generic_open(struct inode *inode, struct file *file)
+{
+ struct kasnprintf_buf *buf;
+
+ file->private_data = kzalloc(sizeof(*buf), GFP_KERNEL);
+ if (!file->private_data)
+ return -ENOMEM;
+
+ buf = file->private_data;
+ mutex_init(&buf->mutex);
+ buf->gfp = GFP_KERNEL;
+ return 0;
+}
+
+int debug_generic_release(struct inode *inode, struct file *file)
+{
+ struct kasnprintf_buf *buf = file->private_data;
+
+ if (!buf)
+ return 0;
+
+ kasnprintf_buf_reset(buf);
+ kfree(buf);
+ return 0;
+}
+
+static ssize_t debug_structs_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ return debug_generic_read(file, user_buf, count, ppos,
+ clients_debug_structs);
+}
+
+static const struct file_operations debug_structs_ops = {
+ .read = debug_structs_read,
+ .llseek = default_llseek,
+ .open = debug_generic_open,
+ .release = debug_generic_release,
+};
+
+static ssize_t debug_struct_counters_read(struct file *file,
+ char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ if (!*ppos) {
+ int ret;
+
+ mutex_lock(&main_ctx.struct_counters_buf_mutex);
+ ret = snprintf(main_ctx.struct_counters_buf,
+ sizeof(main_ctx.struct_counters_buf),
+ "clients: %d\n"
+ "cbufs: %d\n"
+ "cwsms: %d\n"
+ "sessions: %d\n"
+ "swsms: %d\n"
+ "mmus: %d\n"
+ "maps: %d\n"
+ "slots: %d\n"
+ "xen maps: %d\n"
+ "xen fes: %d\n",
+ atomic_read(&g_ctx.c_clients),
+ atomic_read(&g_ctx.c_cbufs),
+ atomic_read(&g_ctx.c_cwsms),
+ atomic_read(&g_ctx.c_sessions),
+ atomic_read(&g_ctx.c_wsms),
+ atomic_read(&g_ctx.c_mmus),
+ atomic_read(&g_ctx.c_maps),
+ atomic_read(&g_ctx.c_slots),
+ atomic_read(&g_ctx.c_xen_maps),
+ atomic_read(&g_ctx.c_xen_fes));
+ mutex_unlock(&main_ctx.struct_counters_buf_mutex);
+ if (ret > 0)
+ main_ctx.struct_counters_buf_len = ret;
+ }
+
+ return simple_read_from_buffer(user_buf, count, ppos,
+ main_ctx.struct_counters_buf,
+ main_ctx.struct_counters_buf_len);
+}
+
+static const struct file_operations debug_struct_counters_ops = {
+ .read = debug_struct_counters_read,
+ .llseek = default_llseek,
+};
+
+static inline int device_user_init(void)
+{
+ struct device *dev;
+ int ret = 0;
+
+ main_ctx.user_dev = MKDEV(MAJOR(main_ctx.device), 1);
+ /* Create the user node */
+ mc_user_init(&main_ctx.user_cdev);
+ ret = cdev_add(&main_ctx.user_cdev, main_ctx.user_dev, 1);
+ if (ret) {
+ mc_dev_err(ret, "user cdev_add failed");
+ return ret;
+ }
+
+ main_ctx.user_cdev.owner = THIS_MODULE;
+ dev = device_create(main_ctx.class, NULL, main_ctx.user_dev, NULL,
+ MC_USER_DEVNODE);
+ if (IS_ERR(dev)) {
+ ret = PTR_ERR(dev);
+ cdev_del(&main_ctx.user_cdev);
+ mc_dev_err(ret, "user device_create failed");
+ return ret;
+ }
+
+ /* Create debugfs structs entry */
+ debugfs_create_file("structs", 0400, g_ctx.debug_dir, NULL,
+ &debug_structs_ops);
+
+ return 0;
+}
+
+static inline void device_user_exit(void)
+{
+ device_destroy(main_ctx.class, main_ctx.user_dev);
+ cdev_del(&main_ctx.user_cdev);
+}
+
+#ifdef MC_PM_RUNTIME
+static int reboot_notifier(struct notifier_block *nb, unsigned long event,
+ void *dummy)
+{
+ switch (event) {
+ case SYS_HALT:
+ case SYS_POWER_OFF:
+ main_ctx.did_hibernate = true;
+ break;
+ }
+
+ return 0;
+}
+
+static int suspend_notifier(struct notifier_block *nb, unsigned long event,
+ void *dummy)
+{
+ int ret = 0;
+
+ main_ctx.did_hibernate = false;
+ switch (event) {
+ case PM_SUSPEND_PREPARE:
+ return nq_suspend();
+ case PM_POST_SUSPEND:
+ return nq_resume();
+#ifdef TRUSTONIC_HIBERNATION_SUPPORT
+ case PM_HIBERNATION_PREPARE:
+ /* Try to stop the TEE nicely (ignore failure) */
+ nq_stop();
+ break;
+ case PM_POST_HIBERNATION:
+ if (main_ctx.did_hibernate) {
+ /* Really did hibernate */
+ client_cleanup();
+ main_ctx.start_ret = TEE_START_NOT_TRIGGERED;
+ return mobicore_start();
+ }
+
+ /* Did not hibernate, just restart the TEE */
+ ret = nq_start();
+#endif
+ }
+
+ return ret;
+}
+#endif /* MC_PM_RUNTIME */
+
+static inline int check_version(void)
+{
+ struct mc_version_info version_info;
+ int ret;
+
+ /* Must be called before creating the user device node to avoid race */
+ ret = mcp_get_version(&version_info);
+ if (ret)
+ return ret;
+
+ /* CMP version is meaningless in this case and is thus not printed */
+ mc_dev_info("\n"
+ " product_id = %s\n"
+ " version_mci = 0x%08x\n"
+ " version_so = 0x%08x\n"
+ " version_mclf = 0x%08x\n"
+ " version_container = 0x%08x\n"
+ " version_mc_config = 0x%08x\n"
+ " version_tl_api = 0x%08x\n"
+ " version_dr_api = 0x%08x\n"
+ " version_nwd = 0x%08x\n",
+ version_info.product_id,
+ version_info.version_mci,
+ version_info.version_so,
+ version_info.version_mclf,
+ version_info.version_container,
+ version_info.version_mc_config,
+ version_info.version_tl_api,
+ version_info.version_dr_api,
+ version_info.version_nwd);
+
+ /* Determine which features are supported */
+ if (version_info.version_mci != MC_VERSION(1, 7)) {
+ ret = -EHOSTDOWN;
+ mc_dev_err(ret, "TEE incompatible with this driver");
+ return ret;
+ }
+
+ return 0;
+}
+
+static int mobicore_start_domu(void)
+{
+ mutex_lock(&main_ctx.start_mutex);
+ if (main_ctx.start_ret != TEE_START_NOT_TRIGGERED)
+ goto end;
+
+ /* Must be called before creating the user device node to avoid race */
+ main_ctx.start_ret = check_version();
+ if (main_ctx.start_ret)
+ goto end;
+
+ main_ctx.start_ret = device_user_init();
+end:
+ mutex_unlock(&main_ctx.start_mutex);
+ return main_ctx.start_ret;
+}
+
+static int mobicore_start(void)
+{
+ int ret;
+
+ mutex_lock(&main_ctx.start_mutex);
+ if (main_ctx.start_ret != TEE_START_NOT_TRIGGERED)
+ goto got_ret;
+
+ ret = nq_start();
+ if (ret) {
+ mc_dev_err(ret, "NQ start failed");
+ goto err_nq;
+ }
+
+ ret = mcp_start();
+ if (ret) {
+ mc_dev_err(ret, "MCP start failed");
+ goto err_mcp;
+ }
+
+ ret = iwp_start();
+ if (ret) {
+ mc_dev_err(ret, "IWP start failed");
+ goto err_iwp;
+ }
+
+ /* Must be called before creating the user device node to avoid race */
+ ret = check_version();
+ if (ret)
+ goto err_version;
+
+#ifdef MC_PM_RUNTIME
+ main_ctx.reboot_notifier.notifier_call = reboot_notifier;
+ ret = register_reboot_notifier(&main_ctx.reboot_notifier);
+ if (ret) {
+ mc_dev_err(ret, "reboot notifier registration failed");
+ goto err_pm_notif;
+ }
+
+ main_ctx.pm_notifier.notifier_call = suspend_notifier;
+ ret = register_pm_notifier(&main_ctx.pm_notifier);
+ if (ret) {
+ unregister_reboot_notifier(&main_ctx.reboot_notifier);
+ mc_dev_err(ret, "PM notifier register failed");
+ goto err_pm_notif;
+ }
+#endif
+
+ if (is_xen_dom0()) {
+ ret = xen_be_init();
+ if (ret)
+ goto err_xen_be;
+ }
+
+ ret = device_user_init();
+ if (ret)
+ goto err_device_user;
+
+ main_ctx.start_ret = 0;
+ mobicore_ready = true;
+ goto got_ret;
+
+err_device_user:
+ if (is_xen_dom0())
+ xen_be_exit();
+err_xen_be:
+#ifdef MC_PM_RUNTIME
+ unregister_reboot_notifier(&main_ctx.reboot_notifier);
+ unregister_pm_notifier(&main_ctx.pm_notifier);
+err_pm_notif:
+#endif
+err_version:
+ iwp_stop();
+err_iwp:
+ mcp_stop();
+err_mcp:
+ nq_stop();
+err_nq:
+ main_ctx.start_ret = ret;
+got_ret:
+ mutex_unlock(&main_ctx.start_mutex);
+ return main_ctx.start_ret;
+}
+
+static void mobicore_stop(void)
+{
+ device_user_exit();
+ if (is_xen_dom0())
+ xen_be_exit();
+
+ if (!is_xen_domu()) {
+#ifdef MC_PM_RUNTIME
+ unregister_reboot_notifier(&main_ctx.reboot_notifier);
+ unregister_pm_notifier(&main_ctx.pm_notifier);
+#endif
+ iwp_stop();
+ mcp_stop();
+ nq_stop();
+ }
+}
+
+int mc_wait_tee_start(void)
+{
+ int ret;
+
+ while (!is_mobicore_ready())
+ ssleep(1);
+
+ mutex_lock(&main_ctx.start_mutex);
+ while (main_ctx.start_ret == TEE_START_NOT_TRIGGERED) {
+ mutex_unlock(&main_ctx.start_mutex);
+ ssleep(1);
+ mutex_lock(&main_ctx.start_mutex);
+ }
+
+ ret = main_ctx.start_ret;
+ mutex_unlock(&main_ctx.start_mutex);
+ return ret;
+}
+
+static inline int device_common_init(void)
+{
+ int ret;
+
+ ret = alloc_chrdev_region(&main_ctx.device, 0, 2, "trustonic_tee");
+ if (ret) {
+ mc_dev_err(ret, "alloc_chrdev_region failed");
+ return ret;
+ }
+
+ main_ctx.class = class_create(THIS_MODULE, "trustonic_tee");
+ if (IS_ERR(main_ctx.class)) {
+ ret = PTR_ERR(main_ctx.class);
+ mc_dev_err(ret, "class_create failed");
+ unregister_chrdev_region(main_ctx.device, 2);
+ return ret;
+ }
+
+ return 0;
+}
+
+static inline void device_common_exit(void)
+{
+ class_destroy(main_ctx.class);
+ unregister_chrdev_region(main_ctx.device, 2);
+}
+
+static inline int device_admin_init(void)
+{
+ struct device *dev;
+ int ret = 0;
+
+ /* Create the ADMIN node */
+ ret = mc_admin_init(&main_ctx.admin_cdev, mobicore_start,
+ mobicore_stop);
+ if (ret)
+ goto err_init;
+
+ ret = cdev_add(&main_ctx.admin_cdev, main_ctx.device, 1);
+ if (ret) {
+ mc_dev_err(ret, "admin cdev_add failed");
+ goto err_cdev;
+ }
+
+ main_ctx.admin_cdev.owner = THIS_MODULE;
+ dev = device_create(main_ctx.class, NULL, main_ctx.device, NULL,
+ MC_ADMIN_DEVNODE);
+ if (IS_ERR(dev)) {
+ ret = PTR_ERR(dev);
+ mc_dev_err(ret, "admin device_create failed");
+ goto err_device;
+ }
+
+ return 0;
+
+err_device:
+ cdev_del(&main_ctx.admin_cdev);
+err_cdev:
+ mc_admin_exit();
+err_init:
+ return ret;
+}
+
+static inline void device_admin_exit(void)
+{
+ device_destroy(main_ctx.class, main_ctx.device);
+ cdev_del(&main_ctx.admin_cdev);
+ mc_admin_exit();
+}
+
+/*
+ * This function is called by the kernel during startup or by a insmod command.
+ * This device is installed and registered as cdev, then interrupt and
+ * queue handling is set up
+ */
+static int mobicore_probe(struct platform_device *pdev)
+{
+ int ret = 0;
+
+ if (pdev)
+ g_ctx.mcd->of_node = pdev->dev.of_node;
+
+#ifdef MOBICORE_COMPONENT_BUILD_TAG
+ mc_dev_info("MobiCore %s", MOBICORE_COMPONENT_BUILD_TAG);
+#endif
+ /* Hardware does not support ARM TrustZone -> Cannot continue! */
+ if (!is_xen_domu() && !has_security_extensions()) {
+ ret = -ENODEV;
+ mc_dev_err(ret, "Hardware doesn't support ARM TrustZone!");
+ return ret;
+ }
+
+ /* Running in secure mode -> Cannot load the driver! */
+ if (is_secure_mode()) {
+ ret = -ENODEV;
+ mc_dev_err(ret, "Running in secure MODE!");
+ return ret;
+ }
+
+ /* Make sure we can create debugfs entries */
+ g_ctx.debug_dir = debugfs_create_dir("trustonic_tee", NULL);
+
+ /* Initialize debug counters */
+ atomic_set(&g_ctx.c_clients, 0);
+ atomic_set(&g_ctx.c_cbufs, 0);
+ atomic_set(&g_ctx.c_cwsms, 0);
+ atomic_set(&g_ctx.c_sessions, 0);
+ atomic_set(&g_ctx.c_wsms, 0);
+ atomic_set(&g_ctx.c_mmus, 0);
+ atomic_set(&g_ctx.c_maps, 0);
+ atomic_set(&g_ctx.c_slots, 0);
+ atomic_set(&g_ctx.c_xen_maps, 0);
+ atomic_set(&g_ctx.c_xen_fes, 0);
+ main_ctx.start_ret = TEE_START_NOT_TRIGGERED;
+ mutex_init(&main_ctx.start_mutex);
+ mutex_init(&main_ctx.struct_counters_buf_mutex);
+ /* Create debugfs info entries */
+ debugfs_create_file("structs_counters", 0400, g_ctx.debug_dir, NULL,
+ &debug_struct_counters_ops);
+
+ /* Initialize common API layer */
+ client_init();
+
+ /* Initialize plenty of nice features */
+ ret = nq_init();
+ if (ret) {
+ mc_dev_err(ret, "NQ init failed");
+ goto fail_nq_init;
+ }
+
+ ret = mcp_init();
+ if (ret) {
+ mc_dev_err(ret, "MCP init failed");
+ goto err_mcp;
+ }
+
+ ret = iwp_init();
+ if (ret) {
+ mc_dev_err(ret, "IWP init failed");
+ goto err_iwp;
+ }
+
+ ret = device_common_init();
+ if (ret)
+ goto err_common;
+
+ if (!is_xen_domu()) {
+ /* Admin dev is for the daemon to communicate with the driver */
+ ret = device_admin_init();
+ if (ret)
+ goto err_admin;
+
+#ifndef MC_DELAYED_TEE_START
+ ret = mobicore_start();
+#endif
+ if (ret)
+ goto err_start;
+ }
+
+ return 0;
+
+err_start:
+ device_admin_exit();
+err_admin:
+ device_common_exit();
+err_common:
+ iwp_exit();
+err_iwp:
+ mcp_exit();
+err_mcp:
+ nq_exit();
+fail_nq_init:
+ debugfs_remove_recursive(g_ctx.debug_dir);
+ return ret;
+}
+
+static int mobicore_probe_not_of(void)
+{
+ return mobicore_probe(NULL);
+}
+
+static const struct of_device_id of_match_table[] = {
+ { .compatible = MC_DEVICE_PROPNAME },
+ { }
+};
+
+static struct platform_driver mc_plat_driver = {
+ .probe = mobicore_probe,
+ .driver = {
+ .name = "mcd",
+ .owner = THIS_MODULE,
+ .of_match_table = of_match_table,
+ }
+};
+
+static int __init mobicore_init(void)
+{
+ dev_set_name(g_ctx.mcd, "TEE");
+ /*
+ * Do not remove or change the following trace.
+ * The string "MobiCore" is used to detect if the TEE is in of the image
+ */
+ mc_dev_info("MobiCore mcDrvModuleApi version is %d.%d",
+ MCDRVMODULEAPI_VERSION_MAJOR,
+ MCDRVMODULEAPI_VERSION_MINOR);
+
+ /* In a Xen DomU, just register the front-end */
+ if (is_xen_domu())
+ return xen_fe_init(mobicore_probe_not_of, mobicore_start_domu);
+
+ main_ctx.use_platform_driver =
+ of_find_compatible_node(NULL, NULL, MC_DEVICE_PROPNAME);
+ if (main_ctx.use_platform_driver)
+ return platform_driver_register(&mc_plat_driver);
+
+ return mobicore_probe_not_of();
+}
+
+static void __exit mobicore_exit(void)
+{
+ if (is_xen_domu())
+ xen_fe_exit();
+
+ if (main_ctx.use_platform_driver)
+ platform_driver_unregister(&mc_plat_driver);
+
+ if (!is_xen_domu())
+ device_admin_exit();
+
+ device_common_exit();
+ iwp_exit();
+ mcp_exit();
+ nq_exit();
+ debugfs_remove_recursive(g_ctx.debug_dir);
+}
+
+module_init(mobicore_init);
+module_exit(mobicore_exit);
+
+MODULE_AUTHOR("Trustonic Limited");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("MobiCore driver");
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/main.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/main.h
new file mode 100644
index 0000000..0b25123
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/main.h
@@ -0,0 +1,100 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_MAIN_H_
+#define _MC_MAIN_H_
+
+#include <linux/device.h> /* dev_* macros */
+#include <linux/slab.h> /* gfp_t */
+#include <linux/fs.h> /* struct inode and struct file */
+#include <linux/mutex.h>
+#include <linux/version.h>
+#include <xen/xen.h>
+
+#define MC_VERSION(major, minor) \
+ ((((major) & 0x0000ffff) << 16) | ((minor) & 0x0000ffff))
+#define MC_VERSION_MAJOR(x) ((x) >> 16)
+#define MC_VERSION_MINOR(x) ((x) & 0xffff)
+
+#define mc_dev_err(__ret__, fmt, ...) \
+ dev_err(g_ctx.mcd, "ERROR %d %s: " fmt "\n", \
+ __ret__, __func__, ##__VA_ARGS__)
+
+#define mc_dev_info(fmt, ...) \
+ dev_info(g_ctx.mcd, "%s: " fmt "\n", __func__, ##__VA_ARGS__)
+
+#ifdef DEBUG
+#define mc_dev_devel(fmt, ...) \
+ dev_info(g_ctx.mcd, "%s: " fmt "\n", __func__, ##__VA_ARGS__)
+#else /* DEBUG */
+#define mc_dev_devel(...) do {} while (0)
+#endif /* !DEBUG */
+
+#define TEEC_TT_LOGIN_KERNEL 0x80000000
+
+#define TEE_START_NOT_TRIGGERED 1
+
+/* MobiCore Driver Kernel Module context data. */
+struct mc_device_ctx {
+ struct device *mcd;
+ /* debugfs root */
+ struct dentry *debug_dir;
+
+ /* Debug counters */
+ atomic_t c_clients;
+ atomic_t c_cbufs;
+ atomic_t c_cwsms;
+ atomic_t c_sessions;
+ atomic_t c_wsms;
+ atomic_t c_mmus;
+ atomic_t c_maps;
+ atomic_t c_slots;
+ atomic_t c_xen_maps;
+ atomic_t c_xen_fes;
+};
+
+extern struct mc_device_ctx g_ctx;
+
+/* Debug stuff */
+struct kasnprintf_buf {
+ struct mutex mutex; /* Protect buf/size/off access */
+ gfp_t gfp;
+ void *buf;
+ int size;
+ int off;
+};
+
+/* Wait for TEE to start and get status */
+int mc_wait_tee_start(void);
+
+extern __printf(2, 3)
+int kasnprintf(struct kasnprintf_buf *buf, const char *fmt, ...);
+ssize_t debug_generic_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos,
+ int (*function)(struct kasnprintf_buf *buf));
+int debug_generic_open(struct inode *inode, struct file *file);
+int debug_generic_release(struct inode *inode, struct file *file);
+
+/* Xen support */
+
+#ifdef CONFIG_XEN
+#define TRUSTONIC_XEN_DOMU
+#endif
+
+static inline bool is_xen_dom0(void)
+{
+ return xen_domain() && xen_initial_domain();
+}
+
+static inline bool is_xen_domu(void)
+{
+#ifdef TRUSTONIC_XEN_DOMU
+ return xen_domain() && !xen_initial_domain();
+#else
+ return false;
+#endif
+}
+
+#endif /* _MC_MAIN_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/gptci.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/gptci.h
new file mode 100644
index 0000000..40363e6
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/gptci.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _GP_TCI_H_
+#define _GP_TCI_H_
+
+struct tee_value {
+ u32 a;
+ u32 b;
+};
+
+struct _teec_memory_reference_internal {
+ u32 sva;
+ u32 len;
+ u32 output_size;
+};
+
+union _teec_parameter_internal {
+ struct tee_value value;
+ struct _teec_memory_reference_internal memref;
+};
+
+enum _teec_tci_type {
+ _TA_OPERATION_OPEN_SESSION = 1,
+ _TA_OPERATION_INVOKE_COMMAND = 2,
+ _TA_OPERATION_CLOSE_SESSION = 3,
+};
+
+struct _teec_operation_internal {
+ enum _teec_tci_type type;
+ u32 command_id;
+ u32 param_types;
+ union _teec_parameter_internal params[4];
+ bool is_cancelled;
+ u8 rfu_padding[3];
+};
+
+struct _teec_tci {
+ char header[8];
+ struct teec_uuid destination;
+ struct _teec_operation_internal operation;
+ u32 ready;
+ u32 return_origin;
+ u32 return_status;
+};
+
+/**
+ * Termination codes
+ */
+#define TA_EXIT_CODE_PANIC 300
+#define TA_EXIT_CODE_TCI 301
+#define TA_EXIT_CODE_PARAMS 302
+#define TA_EXIT_CODE_FINISHED 303
+#define TA_EXIT_CODE_SESSIONSTATE 304
+#define TA_EXIT_CODE_CREATEFAILED 305
+
+#endif /* _GP_TCI_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcifc.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcifc.h
new file mode 100644
index 0000000..85875cf
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcifc.h
@@ -0,0 +1,150 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef MCIFC_H_
+#define MCIFC_H_
+
+#include "platform.h"
+
+/** @name MobiCore FastCall Defines
+ * Defines for the two different FastCall's.
+ */
+/**/
+
+/* --- global ---- */
+#define MC_FC_INVALID ((u32)0) /**< Invalid FastCall ID */
+
+#if (defined(CONFIG_ARM64) && !defined(MC_ARMV7_FC)) || (defined(MC_AARCH32_FC))
+
+#define FASTCALL_OWNER_TZOS (0x3F000000)
+#define FASTCALL_ATOMIC_MASK BIT(31)
+/**Trusted OS Fastcalls SMC32 */
+#define MC_FC_STD32_BASE \
+ ((u32)(FASTCALL_OWNER_TZOS | FASTCALL_ATOMIC_MASK))
+/* SMC32 Trusted OS owned Fastcalls */
+#define MC_FC_STD32(x) ((u32)(MC_FC_STD32_BASE + (x)))
+
+#define MC_FC_INIT MC_FC_STD32(1) /**< Initializing FastCall. */
+#define MC_FC_INFO MC_FC_STD32(2) /**< Info FastCall. */
+#define MC_FC_MEM_TRACE MC_FC_STD32(10) /**< Enable SWd tracing via memory */
+
+#else
+
+#define MC_FC_INIT ((u32)(-1)) /**< Initializing FastCall. */
+#define MC_FC_INFO ((u32)(-2)) /**< Info FastCall. */
+#define MC_FC_MEM_TRACE ((u32)(-31)) /**< Enable SWd tracing via memory */
+
+#endif
+
+/** @} */
+
+/** @name MobiCore SMC Defines
+ * Defines the different secure monitor calls (SMC) for world switching.
+ */
+/**< Yield to switch from NWd to SWd. */
+#define MC_SMC_N_YIELD 3
+/**< SIQ to switch from NWd to SWd. */
+#define MC_SMC_N_SIQ 4
+/** @} */
+
+/** @name MobiCore status
+ * MobiCore status information.
+ */
+/**< MobiCore is not yet initialized. FastCall FcInit() to set up MobiCore.*/
+#define MC_STATUS_NOT_INITIALIZED 0
+/**< Bad parameters have been passed in FcInit(). */
+#define MC_STATUS_BAD_INIT 1
+/**< MobiCore did initialize properly. */
+#define MC_STATUS_INITIALIZED 2
+/**< MobiCore kernel halted due to an unrecoverable exception. Further
+ * information is available extended info
+ */
+#define MC_STATUS_HALT 3
+/** @} */
+
+/** @name Extended Info Identifiers
+ * Extended info parameters for MC_FC_INFO to obtain further information
+ * depending on MobiCore state.
+ */
+/**< Version of the MobiCore Control Interface (MCI) */
+#define MC_EXT_INFO_ID_MCI_VERSION 0
+/**< MobiCore control flags */
+#define MC_EXT_INFO_ID_FLAGS 1
+/**< MobiCore halt condition code */
+#define MC_EXT_INFO_ID_HALT_CODE 2
+/**< MobiCore halt condition instruction pointer */
+#define MC_EXT_INFO_ID_HALT_IP 3
+/**< MobiCore fault counter */
+#define MC_EXT_INFO_ID_FAULT_CNT 4
+/**< MobiCore last fault cause */
+#define MC_EXT_INFO_ID_FAULT_CAUSE 5
+/**< MobiCore last fault meta */
+#define MC_EXT_INFO_ID_FAULT_META 6
+/**< MobiCore last fault threadid */
+#define MC_EXT_INFO_ID_FAULT_THREAD 7
+/**< MobiCore last fault instruction pointer */
+#define MC_EXT_INFO_ID_FAULT_IP 8
+/**< MobiCore last fault stack pointer */
+#define MC_EXT_INFO_ID_FAULT_SP 9
+/**< MobiCore last fault ARM arch information */
+#define MC_EXT_INFO_ID_FAULT_ARCH_DFSR 10
+/**< MobiCore last fault ARM arch information */
+#define MC_EXT_INFO_ID_FAULT_ARCH_ADFSR 11
+/**< MobiCore last fault ARM arch information */
+#define MC_EXT_INFO_ID_FAULT_ARCH_DFAR 12
+/**< MobiCore last fault ARM arch information */
+#define MC_EXT_INFO_ID_FAULT_ARCH_IFSR 13
+/**< MobiCore last fault ARM arch information */
+#define MC_EXT_INFO_ID_FAULT_ARCH_AIFSR 14
+/**< MobiCore last fault ARM arch information */
+#define MC_EXT_INFO_ID_FAULT_ARCH_IFAR 15
+/**< MobiCore configured by Daemon via fc_init flag */
+#define MC_EXT_INFO_ID_MC_CONFIGURED 16
+/**< MobiCore scheduling status: idle/non-idle */
+#define MC_EXT_INFO_ID_MC_SCHED_STATUS 17
+/**< MobiCore runtime status: initialized, halted */
+#define MC_EXT_INFO_ID_MC_STATUS 18
+/**< MobiCore exception handler last partner */
+#define MC_EXT_INFO_ID_MC_EXC_PARTNER 19
+/**< MobiCore exception handler last peer */
+#define MC_EXT_INFO_ID_MC_EXC_IPCPEER 20
+/**< MobiCore exception handler last IPC message */
+#define MC_EXT_INFO_ID_MC_EXC_IPCMSG 21
+/**< MobiCore exception handler last IPC data */
+#define MC_EXT_INFO_ID_MC_EXC_IPCDATA 22
+/**< MobiCore exception handler last UUID (uses 4 slots: 23 to 26) */
+#define MC_EXT_INFO_ID_MC_EXC_UUID 23
+#define MC_EXT_INFO_ID_MC_EXC_UUID1 24
+#define MC_EXT_INFO_ID_MC_EXC_UUID2 25
+#define MC_EXT_INFO_ID_MC_EXC_UUID3 26
+/**< MobiCore exception handler last crashing task offset */
+#define MC_EXT_INFO_ID_TASK_OFFSET 27
+/**< MobiCore exception handler last crashing task's mclib offset */
+#define MC_EXT_INFO_ID_MCLIB_OFFSET 28
+
+/** @} */
+
+/** @name FastCall return values
+ * Return values of the MobiCore FastCalls.
+ */
+/**< No error. Everything worked fine. */
+#define MC_FC_RET_OK 0
+/**< FastCall was not successful. */
+#define MC_FC_RET_ERR_INVALID 1
+/**< MobiCore has already been initialized. */
+#define MC_FC_RET_ERR_ALREADY_INITIALIZED 5
+/**< Call is not allowed. */
+#define TEE_FC_RET_ERR_NOABILITY 6
+/** @} */
+
+/** @name Init FastCall flags
+ * Return flags of the Init FastCall.
+ */
+/**< SWd uses LPAE MMU table format. */
+#define MC_FC_INIT_FLAG_LPAE BIT(0)
+/** @} */
+
+#endif /** MCIFC_H_ */
+
+/** @} */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mciiwp.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mciiwp.h
new file mode 100644
index 0000000..970e8fa
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mciiwp.h
@@ -0,0 +1,113 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef MCIIWP_H_
+#define MCIIWP_H_
+
+#include "public/GP/tee_client_types.h" /* teec_uuid FIXME it's all mixed up! */
+
+/** Session ID for notifications for the Dragon CA-to-TA communication protocol
+ *
+ * Session ID are distinct from any valid MCP session identifier
+ * and from the existing pseudo-session identifiers :
+ * - SID_MCP = 0
+ * - SID_INVALID = 0xffffffff
+ *
+ * A session ID is a thread ID, and since thread IDs have a nonzero task ID as
+ * their lowest 16 bits, we can use values of the form 0x????0000
+ */
+#define SID_OPEN_SESSION (0x00010000)
+#define SID_INVOKE_COMMAND (0x00020000)
+#define SID_CLOSE_SESSION (0x00030000)
+#define SID_CANCEL_OPERATION (0x00040000)
+#define SID_MEMORY_REFERENCE (0x00050000)
+#define SID_OPEN_TA (0x00060000)
+#define SID_REQ_TA (0x00070000)
+
+/* To quickly detect IWP notifications */
+#define SID_IWP_NOTIFICATION \
+ (SID_OPEN_SESSION | SID_INVOKE_COMMAND | SID_CLOSE_SESSION | \
+ SID_CANCEL_OPERATION | SID_MEMORY_REFERENCE | SID_OPEN_TA | SID_REQ_TA)
+
+struct interworld_parameter_value {
+ u32 a;
+ u32 b;
+ u8 unused[8];
+};
+
+/** The API parameter type TEEC_MEMREF_WHOLE is translated into these types
+ * and does not appear in the inter-world protocol.
+ *
+ * - memref_handle references a previously registered memory reference
+ * 'offset' bytes <= memref_handle < 'offset + size' bytes
+ *
+ * These sizes must be contained within the memory reference.
+ */
+struct interworld_parameter_memref {
+ u32 offset;
+ u32 size;
+ u32 memref_handle;
+ u32 unused;
+};
+
+/** This structure is used for the parameter types TEEC_MEMREF_TEMP_xxx.
+ *
+ * The parameter is located in World Shared Memory which is established
+ * for the command and torn down afterwards.
+ *
+ * The number of pages to share is 'size + offset' divided by the page
+ * size, rounded up.
+ * Inside the shared pages, the buffer starts at address 'offset'
+ * and ends after 'size' bytes.
+ *
+ * - wsm_type parameter may be WSM_CONTIGUOUS or WSM_L1.
+ * - offset must be less than the page size (4096).
+ * - size must be less than 0xfffff000.
+ */
+struct interworld_parameter_tmpref {
+ u16 wsm_type;
+ u16 offset;
+ u32 size;
+ u64 physical_address;
+};
+
+/**
+ *
+ */
+union interworld_parameter {
+ struct interworld_parameter_value value;
+ struct interworld_parameter_memref memref;
+ struct interworld_parameter_tmpref tmpref;
+};
+
+/**
+ * An inter-world session structure represents an active session between
+ * a normal world client and RTM.
+ * It is located in the MCI buffer, must be 8-byte aligned
+ *
+ * NB : since the session structure is in shared memory, it must have the
+ * same layout on both sides (normal world kernel and RTM).
+ * All types use platform endianness (specifically, the endianness used by
+ * the secure world).
+ */
+struct interworld_session {
+ u32 status;
+ u32 return_origin;
+ u16 session_handle;
+ u16 param_types;
+
+ union {
+ u32 command_id; /** invoke-command only */
+ u32 login; /** open-session only */
+ };
+
+ union interworld_parameter params[4];
+
+ /* The following fields are only used during open-session */
+ struct teec_uuid target_uuid;
+ struct teec_uuid client_uuid;
+};
+
+#endif /** MCIIWP_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcimcp.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcimcp.h
new file mode 100644
index 0000000..386237f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcimcp.h
@@ -0,0 +1,477 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef MCP_H_
+#define MCP_H_
+
+#include "mci/mcloadformat.h"
+
+/** Indicates a response */
+#define FLAG_RESPONSE BIT(31)
+
+/** MobiCore Return Code Defines.
+ * List of the possible MobiCore return codes.
+ */
+enum mcp_result {
+ /** Memory has successfully been mapped */
+ MC_MCP_RET_OK = 0,
+ /** The session ID is invalid */
+ MC_MCP_RET_ERR_INVALID_SESSION = 1,
+ /** The UUID of the Trustlet is unknown */
+ MC_MCP_RET_ERR_UNKNOWN_UUID = 2,
+ /** The ID of the driver is unknown */
+ MC_MCP_RET_ERR_UNKNOWN_DRIVER_ID = 3,
+ /** No more session are allowed */
+ MC_MCP_RET_ERR_NO_MORE_SESSIONS = 4,
+ /** The container is invalid */
+ MC_MCP_RET_ERR_CONTAINER_INVALID = 5,
+ /** The Trustlet is invalid */
+ MC_MCP_RET_ERR_TRUSTLET_INVALID = 6,
+ /** The memory block has already been mapped before */
+ MC_MCP_RET_ERR_ALREADY_MAPPED = 7,
+ /** Alignment or length error in the command parameters */
+ MC_MCP_RET_ERR_INVALID_PARAM = 8,
+ /** No space left in the virtual address space of the session */
+ MC_MCP_RET_ERR_OUT_OF_RESOURCES = 9,
+ /** WSM type unknown or broken WSM */
+ MC_MCP_RET_ERR_INVALID_WSM = 10,
+ /** unknown error */
+ MC_MCP_RET_ERR_UNKNOWN = 11,
+ /** Length of map invalid */
+ MC_MCP_RET_ERR_INVALID_MAPPING_LENGTH = 12,
+ /** Map can only be applied to Trustlet session */
+ MC_MCP_RET_ERR_MAPPING_TARGET = 13,
+ /** Couldn't open crypto session */
+ MC_MCP_RET_ERR_OUT_OF_CRYPTO_RESOURCES = 14,
+ /** System Trustlet signature verification failed */
+ MC_MCP_RET_ERR_SIGNATURE_VERIFICATION_FAILED = 15,
+ /** System Trustlet public key is wrong */
+ MC_MCP_RET_ERR_WRONG_PUBLIC_KEY = 16,
+ /** Wrong containter type(s) */
+ MC_MCP_RET_ERR_CONTAINER_TYPE_MISMATCH = 17,
+ /** Container is locked (or not activated) */
+ MC_MCP_RET_ERR_CONTAINER_LOCKED = 18,
+ /** SPID is not registered with root container */
+ MC_MCP_RET_ERR_SP_NO_CHILD = 19,
+ /** UUID is not registered with sp container */
+ MC_MCP_RET_ERR_TL_NO_CHILD = 20,
+ /** Unwrapping of root container failed */
+ MC_MCP_RET_ERR_UNWRAP_ROOT_FAILED = 21,
+ /** Unwrapping of service provider container failed */
+ MC_MCP_RET_ERR_UNWRAP_SP_FAILED = 22,
+ /** Unwrapping of Trustlet container failed */
+ MC_MCP_RET_ERR_UNWRAP_TRUSTLET_FAILED = 23,
+ /** Container version mismatch */
+ MC_MCP_RET_ERR_CONTAINER_VERSION_MISMATCH = 24,
+ /** Decryption of service provider trustlet failed */
+ MC_MCP_RET_ERR_SP_TL_DECRYPTION_FAILED = 25,
+ /** Hash check of service provider trustlet failed */
+ MC_MCP_RET_ERR_SP_TL_HASH_CHECK_FAILED = 26,
+ /** Activation/starting of task failed */
+ MC_MCP_RET_ERR_LAUNCH_TASK_FAILED = 27,
+ /** Closing of task not yet possible, try again later */
+ MC_MCP_RET_ERR_CLOSE_TASK_FAILED = 28,
+ /**< Service is blocked and a session cannot be opened to it */
+ MC_MCP_RET_ERR_SERVICE_BLOCKED = 29,
+ /**< Service is locked and a session cannot be opened to it */
+ MC_MCP_RET_ERR_SERVICE_LOCKED = 30,
+ /**< Service was forcefully killed (due to an administrative command) */
+ MC_MCP_RET_ERR_SERVICE_KILLED = 31,
+ /**< Service version is lower than the one installed. */
+ MC_MCP_RET_ERR_DOWNGRADE_NOT_AUTHORIZED = 32,
+ /**< Filesystem not yet ready. */
+ MC_MCP_RET_ERR_SYSTEM_NOT_READY = 33,
+ /** The command is unknown */
+ MC_MCP_RET_ERR_UNKNOWN_COMMAND = 50,
+ /** The command data is invalid */
+ MC_MCP_RET_ERR_INVALID_DATA = 51
+};
+
+/** Possible MCP Command IDs
+ * Command ID must be between 0 and 0x7FFFFFFF.
+ */
+enum cmd_id {
+ /** Invalid command ID */
+ MC_MCP_CMD_ID_INVALID = 0x00,
+ /** Open a session */
+ MC_MCP_CMD_OPEN_SESSION = 0x01,
+ /** Close an existing session */
+ MC_MCP_CMD_CLOSE_SESSION = 0x03,
+ /** Map WSM to session */
+ MC_MCP_CMD_MAP = 0x04,
+ /** Unmap WSM from session */
+ MC_MCP_CMD_UNMAP = 0x05,
+ /** Prepare for suspend */
+ MC_MCP_CMD_SUSPEND = 0x06,
+ /** Resume from suspension */
+ MC_MCP_CMD_RESUME = 0x07,
+ /** Get MobiCore version information */
+ MC_MCP_CMD_GET_MOBICORE_VERSION = 0x09,
+ /** Close MCP and unmap MCI */
+ MC_MCP_CMD_CLOSE_MCP = 0x0A,
+ /** Load token for device attestation */
+ MC_MCP_CMD_LOAD_TOKEN = 0x0B,
+ /** Check that TA can be loaded */
+ MC_MCP_CMD_CHECK_LOAD_TA = 0x0C,
+ /** Load a decryption key */
+ MC_MCP_CMD_LOAD_SYSENC_KEY_SO = 0x0D,
+};
+
+/*
+ * Types of WSM known to the MobiCore.
+ */
+#define WSM_TYPE_MASK 0xFF
+#define WSM_INVALID 0 /** Invalid memory type */
+#define WSM_L1 3 /** Buffer mapping uses fake L1 table */
+/**< Bitflag indicating that the buffer should be uncached */
+#define WSM_UNCACHED 0x100
+
+/*
+ * Magic number used to identify if Open Command supports GP client
+ * authentication.
+ */
+#define MC_GP_CLIENT_AUTH_MAGIC 0x47504131 /* "GPA1" */
+
+/*
+ * Initialisation values flags
+ */
+/* Set if IRQ is present */
+#define MC_IV_FLAG_IRQ BIT(0)
+/* Set if GP TIME is supported */
+#define MC_IV_FLAG_TIME BIT(1)
+/* Set if GP client uses interworld session */
+#define MC_IV_FLAG_IWP BIT(2)
+
+struct init_values {
+ u32 flags;
+ u32 irq;
+ u32 time_ofs;
+ u32 time_len;
+ /* interworld session buffer offset in MCI */
+ u32 iws_buf_ofs;
+ /* interworld session buffer size */
+ u32 iws_buf_size;
+ u8 padding[8];
+};
+
+/** Command header.
+ * It just contains the command ID. Only values specified in cmd_id are
+ * allowed as command IDs. If the command ID is unspecified the MobiCore
+ * returns an empty response with the result set to
+ * MC_MCP_RET_ERR_UNKNOWN_COMMAND.
+ */
+struct cmd_header {
+ enum cmd_id cmd_id; /** Command ID of the command */
+};
+
+/** Response header.
+ * MobiCore will reply to every MCP command with an MCP response. Like the MCP
+ * command the response consists of a header followed by response data. The
+ * response is written to the same memory location as the MCP command.
+ */
+struct rsp_header {
+ u32 rsp_id; /** Command ID | FLAG_RESPONSE */
+ enum mcp_result result; /** Result of the command execution */
+};
+
+/** @defgroup CMD MCP Commands
+ */
+
+/** @defgroup ASMCMD Administrative Commands
+ */
+
+/** @defgroup MCPGETMOBICOREVERSION GET_MOBICORE_VERSION
+ * Get MobiCore version info.
+ *
+ */
+
+/** Get MobiCore Version Command */
+struct cmd_get_version {
+ struct cmd_header cmd_header; /** Command header */
+};
+
+/** Get MobiCore Version Command Response */
+struct rsp_get_version {
+ struct rsp_header rsp_header; /** Response header */
+ struct mc_version_info version_info; /** MobiCore version info */
+};
+
+/** @defgroup POWERCMD Power Management Commands
+ */
+
+/** @defgroup MCPSUSPEND SUSPEND
+ * Prepare MobiCore suspension.
+ * This command allows MobiCore and MobiCore drivers to release or clean
+ * resources and save device state.
+ *
+ */
+
+/** Suspend Command */
+struct cmd_suspend {
+ struct cmd_header cmd_header; /** Command header */
+};
+
+/** Suspend Command Response */
+struct rsp_suspend {
+ struct rsp_header rsp_header; /** Response header */
+};
+
+/** @defgroup MCPRESUME RESUME
+ * Resume MobiCore from suspension.
+ * This command allows MobiCore and MobiCore drivers to reinitialize hardware
+ * affected by suspension.
+ *
+ */
+
+/** Resume Command */
+struct cmd_resume {
+ struct cmd_header cmd_header; /** Command header */
+};
+
+/** Resume Command Response */
+struct rsp_resume {
+ struct rsp_header rsp_header; /** Response header */
+};
+
+/** @defgroup SESSCMD Session Management Commands
+ */
+
+/** @defgroup MCPOPEN OPEN
+ * Load and open a session to a Trustlet.
+ * The OPEN command loads Trustlet data to the MobiCore context and opens a
+ * session to the Trustlet. If wsm_data_type is WSM_INVALID MobiCore tries to
+ * start a pre-installed Trustlet associated with the uuid passed. The uuid
+ * passed must match the uuid contained in the load data (if available).
+ * On success, MobiCore returns the session ID which can be used for further
+ * communication.
+ */
+
+/** GP client authentication data */
+struct cmd_open_data {
+ u32 mclf_magic; /** ASCII "MCLF" on older versions */
+ struct identity identity; /** Login method and data */
+};
+
+/** Open Command */
+struct cmd_open {
+ struct cmd_header cmd_header; /** Command header */
+ struct mc_uuid_t uuid; /** Service UUID */
+ u8 unused[4]; /** Padding to be 64-bit aligned */
+ u64 adr_tci_buffer; /** Physical address of the TCI MMU */
+ u64 adr_load_data; /** Physical address of the data MMU */
+ u32 ofs_tci_buffer; /** Offset to the data */
+ u32 len_tci_buffer; /** Length of the TCI */
+ u32 wsmtype_tci; /** Type of WSM used for the TCI */
+ u32 wsm_data_type; /** Type of MMU */
+ u32 ofs_load_data; /** Offset to the data */
+ u32 len_load_data; /** Length of the data to load */
+ union {
+ struct cmd_open_data cmd_open_data; /** Client login data */
+ union mclf_header tl_header; /** Service header */
+ };
+ u32 is_gpta; /** true if looking for an SD/GP-TA */
+};
+
+/** Open Command Response */
+struct rsp_open {
+ struct rsp_header rsp_header; /** Response header */
+ u32 session_id; /** Session ID */
+};
+
+/** TA Load Check Command */
+struct cmd_check_load {
+ struct cmd_header cmd_header; /** Command header */
+ struct mc_uuid_t uuid; /** Service UUID */
+ u8 unused[4]; /** Padding to be 64-bit aligned */
+ u64 adr_load_data; /** Physical address of the data */
+ u32 wsm_data_type; /** Type of MMU */
+ u32 ofs_load_data; /** Offset to the data */
+ u32 len_load_data; /** Length of the data to load */
+ union mclf_header tl_header; /** Service header */
+};
+
+/** TA Load Check Response */
+struct rsp_check_load {
+ struct rsp_header rsp_header; /** Response header */
+};
+
+/** @defgroup MCPCLOSE CLOSE
+ * Close an existing session to a Trustlet.
+ * The CLOSE command terminates a session and frees all resources in the
+ * MobiCore system which are currently occupied by the session. Before closing
+ * the session, the MobiCore runtime management waits until all pending
+ * operations, like calls to drivers, invoked by the Trustlet have been
+ * terminated. Mapped memory will automatically be unmapped from the MobiCore
+ * context. The NWd is responsible for processing the freed memory according to
+ * the Rich-OS needs.
+ *
+ */
+
+/** Close Command */
+struct cmd_close {
+ struct cmd_header cmd_header; /** Command header */
+ u32 session_id; /** Session ID */
+};
+
+/** Close Command Response */
+struct rsp_close {
+ struct rsp_header rsp_header; /** Response header */
+};
+
+/** @defgroup MCPMAP MAP
+ * Map a portion of memory to a session.
+ * The MAP command provides a block of memory to the context of a service.
+ * The memory then becomes world-shared memory (WSM).
+ * The only allowed memory type here is WSM_L1.
+ */
+
+/** Map Command */
+struct cmd_map {
+ struct cmd_header cmd_header; /** Command header */
+ u32 session_id; /** Session ID */
+ u32 wsm_type; /** Type of MMU */
+ u32 ofs_buffer; /** Offset to the payload */
+ u64 adr_buffer; /** Physical address of the MMU */
+ u32 len_buffer; /** Length of the buffer */
+ u32 flags; /** Attributes (read/write) */
+};
+
+#define MCP_MAP_MAX 0x100000 /** Maximum length for MCP map */
+
+/** Map Command Response */
+struct rsp_map {
+ struct rsp_header rsp_header; /** Response header */
+ /** Virtual address the WSM is mapped to, may include an offset! */
+ u32 secure_va;
+};
+
+/** @defgroup MCPUNMAP UNMAP
+ * Unmap a portion of world-shared memory from a session.
+ * The UNMAP command is used to unmap a previously mapped block of
+ * world shared memory from the context of a session.
+ *
+ * Attention: The memory block will be immediately unmapped from the specified
+ * session. If the service is still accessing the memory, the service will
+ * trigger a segmentation fault.
+ */
+
+/** Unmap Command */
+struct cmd_unmap {
+ struct cmd_header cmd_header; /** Command header */
+ u32 session_id; /** Session ID */
+ u32 wsm_type; /** Type of WSM used of the memory */
+ /** Virtual address the WSM is mapped to, may include an offset! */
+ u32 secure_va;
+ u32 virtual_buffer_len; /** Length of virtual buffer */
+};
+
+/** Unmap Command Response */
+struct rsp_unmap {
+ struct rsp_header rsp_header; /** Response header */
+};
+
+/** @defgroup MCPLOADTOKEN
+ * Load a token from the normal world and share it with the TEE
+ * If something fails, the device attestation functionality will be disabled
+ */
+
+/** Load Token */
+struct cmd_load_token {
+ struct cmd_header cmd_header; /** Command header */
+ u32 wsm_data_type; /** Type of MMU */
+ u64 adr_load_data; /** Physical address of the MMU */
+ u64 ofs_load_data; /** Offset to the data */
+ u64 len_load_data; /** Length of the data */
+};
+
+/** Load Token Command Response */
+struct rsp_load_token {
+ struct rsp_header rsp_header; /** Response header */
+};
+
+/** @defgroup MCPLOADKEYSO
+ * Load a key SO from the normal world and share it with the TEE
+ * If something fails, the device attestation functionality will be disabled
+ */
+
+/** Load key SO */
+struct cmd_load_key_so {
+ struct cmd_header cmd_header; /** Command header */
+ u32 wsm_data_type; /** Type of MMU */
+ u64 adr_load_data; /** Physical address of the MMU */
+ u64 ofs_load_data; /** Offset to the data */
+ u64 len_load_data; /** Length of the data */
+};
+
+/** Load key SO Command Response */
+struct rsp_load_key_so {
+ struct rsp_header rsp_header; /** Response header */
+};
+
+/** Structure of the MCP buffer */
+union mcp_message {
+ struct init_values init_values; /** Initialisation values */
+ struct cmd_header cmd_header; /** Command header */
+ struct rsp_header rsp_header;
+ struct cmd_open cmd_open; /** Load and open service */
+ struct rsp_open rsp_open;
+ struct cmd_close cmd_close; /** Close command */
+ struct rsp_close rsp_close;
+ struct cmd_map cmd_map; /** Map WSM to service */
+ struct rsp_map rsp_map;
+ struct cmd_unmap cmd_unmap; /** Unmap WSM from service */
+ struct rsp_unmap rsp_unmap;
+ struct cmd_suspend cmd_suspend; /** Suspend MobiCore */
+ struct rsp_suspend rsp_suspend;
+ struct cmd_resume cmd_resume; /** Resume MobiCore */
+ struct rsp_resume rsp_resume;
+ struct cmd_get_version cmd_get_version; /** Get MobiCore Version */
+ struct rsp_get_version rsp_get_version;
+ struct cmd_load_token cmd_load_token; /** Load token */
+ struct rsp_load_token rsp_load_token;
+ struct cmd_check_load cmd_check_load; /** TA load check */
+ struct rsp_check_load rsp_check_load;
+ struct cmd_load_key_so cmd_load_key_so;/** Load key SO */
+ struct rsp_load_key_so rsp_load_key_so;
+};
+
+#define MC_FLAG_NO_SLEEP_REQ 0
+#define MC_FLAG_REQ_TO_SLEEP 1
+
+#define MC_STATE_NORMAL_EXECUTION 0
+#define MC_STATE_READY_TO_SLEEP 1
+
+#define MC_STATE_FLAG_TEE_HALT_MASK BIT(0)
+
+struct sleep_mode {
+ u16 sleep_req; /** Ask SWd to get ready to sleep */
+ u16 ready_to_sleep; /** SWd is now ready to sleep */
+};
+
+/** MobiCore status flags */
+struct mcp_flags {
+ /** If not MC_FLAG_SCHEDULE_IDLE, MobiCore needs scheduling */
+ u32 schedule;
+ struct sleep_mode sleep_mode;
+ /** Secure-world sleep timeout in milliseconds */
+ s32 timeout_ms;
+ /** TEE flags */
+ u8 tee_flags;
+ /** Reserved for future use */
+ u8 RFU_padding[3];
+};
+
+/** MobiCore is idle. No scheduling required */
+#define MC_FLAG_SCHEDULE_IDLE 0
+/** MobiCore is non idle, scheduling is required */
+#define MC_FLAG_SCHEDULE_NON_IDLE 1
+
+/** MCP buffer structure */
+struct mcp_buffer {
+ struct mcp_flags flags; /** MobiCore Flags */
+ union mcp_message message; /** MCP message buffer */
+};
+
+#endif /* MCP_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcinq.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcinq.h
new file mode 100644
index 0000000..2207bda
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcinq.h
@@ -0,0 +1,81 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef NQ_H_
+#define NQ_H_
+
+/** \name NQ Size Defines
+ * Minimum and maximum count of elements in the notification queue.
+ */
+#define MIN_NQ_ELEM 1 /** Minimum notification queue elements */
+#define MAX_NQ_ELEM 64 /** Maximum notification queue elements */
+
+/* Compute notification queue size in bytes from its number of elements */
+#define NQ_SIZE(n) (2 * (sizeof(struct notification_queue_header)\
+ + (n) * sizeof(struct notification)))
+
+/** \name NQ Length Defines
+ * Note that there is one queue for NWd->SWd and one queue for SWd->NWd
+ */
+/** Minimum size for the notification queue data structure */
+#define MIN_NQ_LEN NQ_SIZE(MIN_NQ_ELEM)
+/** Maximum size for the notification queue data structure */
+#define MAX_NQ_LEN NQ_SIZE(MAX_NQ_ELEM)
+
+/** \name Session ID Defines
+ * Standard Session IDs.
+ */
+/** MCP session ID, used to communicate with MobiCore (e.g. to start/stop TA) */
+#define SID_MCP 0
+/** Invalid session id, returned in case of error */
+#define SID_INVALID 0xffffffff
+
+/** Notification data structure */
+struct notification {
+ u32 session_id; /** Session ID */
+ s32 payload; /** Additional notification info */
+};
+
+/** Notification payload codes.
+ * 0 indicated a plain simple notification,
+ * a positive value is a termination reason from the task,
+ * a negative value is a termination reason from MobiCore.
+ * Possible negative values are given below.
+ */
+enum notification_payload {
+ /** task terminated, but exit code is invalid */
+ ERR_INVALID_EXIT_CODE = -1,
+ /** task terminated due to session end, no exit code available */
+ ERR_SESSION_CLOSE = -2,
+ /** task terminated due to invalid operation */
+ ERR_INVALID_OPERATION = -3,
+ /** session ID is unknown */
+ ERR_INVALID_SID = -4,
+ /** session is not active */
+ ERR_SID_NOT_ACTIVE = -5,
+ /** session was force-killed (due to an administrative command). */
+ ERR_SESSION_KILLED = -6,
+};
+
+/** Declaration of the notification queue header.
+ * layout as specified in the data structure specification.
+ */
+struct notification_queue_header {
+ u32 write_cnt; /** Write counter */
+ u32 read_cnt; /** Read counter */
+ u32 queue_size; /** Queue size */
+};
+
+/** Queue struct which defines a queue object.
+ * The queue struct is accessed by the queue<operation> type of
+ * function. elementCnt must be a power of two and the power needs
+ * to be smaller than power of u32 (obviously 32).
+ */
+struct notification_queue {
+ struct notification_queue_header hdr; /** Queue header */
+ struct notification notification[MIN_NQ_ELEM]; /** Elements */
+};
+
+#endif /** NQ_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcitime.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcitime.h
new file mode 100644
index 0000000..94dac30
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcitime.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef MCITIME_H_
+#define MCITIME_H_
+
+/*
+ * Trustonic TEE RICH OS Time:
+ * -seconds and nanoseconds since Jan 1, 1970, UTC
+ * -monotonic counter
+ */
+struct mcp_time {
+ u64 wall_clock_seconds;
+ u64 wall_clock_nsec;
+ u64 monotonic_seconds;
+ u64 monotonic_nsec;
+};
+
+#endif /* MCITIME_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcloadformat.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcloadformat.h
new file mode 100644
index 0000000..57501bf
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mci/mcloadformat.h
@@ -0,0 +1,133 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef MCLOADFORMAT_H_
+#define MCLOADFORMAT_H_
+
+/** Trustlet Blob length info */
+#define MC_TLBLOBLEN_MAGIC 0x7672746C /* Magic for SWd: vrtl */
+#define MAX_SO_CONT_SIZE 512 /* Max size for a container */
+
+/** MCLF magic */
+/**< "MCLF" in big endian integer representation */
+#define MC_SERVICE_HEADER_MAGIC_BE \
+ ((uint32_t)('M' | ('C' << 8) | ('L' << 16) | ('F' << 24)))
+/**< "MCLF" in little endian integer representation */
+#define MC_SERVICE_HEADER_MAGIC_LE \
+ ((uint32_t)(('M' << 24) | ('C' << 16) | ('L' << 8) | 'F'))
+
+/** MCLF flags */
+/**< Loaded service cannot be unloaded from MobiCore. */
+#define MC_SERVICE_HEADER_FLAGS_PERMANENT BIT(0)
+/**< Service has no WSM control interface. */
+#define MC_SERVICE_HEADER_FLAGS_NO_CONTROL_INTERFACE BIT(1)
+/**< Service can be debugged. */
+#define MC_SERVICE_HEADER_FLAGS_DEBUGGABLE BIT(2)
+/**< New-layout trusted application or trusted driver. */
+#define MC_SERVICE_HEADER_FLAGS_EXTENDED_LAYOUT BIT(3)
+
+/** Service type.
+ * The service type defines the type of executable.
+ */
+enum service_type {
+ SERVICE_TYPE_ILLEGAL = 0,
+ SERVICE_TYPE_DRIVER = 1,
+ SERVICE_TYPE_SP_TRUSTLET = 2,
+ SERVICE_TYPE_SYSTEM_TRUSTLET = 3,
+ SERVICE_TYPE_MIDDLEWARE = 4,
+ SERVICE_TYPE_LAST_ENTRY = 5,
+};
+
+/**
+ * Descriptor for a memory segment.
+ */
+struct segment_descriptor {
+ u32 start; /**< Virtual start address */
+ u32 len; /**< Segment length in bytes */
+};
+
+/**
+ * MCLF intro for data structure identification.
+ * Must be the first element of a valid MCLF file.
+ */
+struct mclf_intro {
+ u32 magic; /**< Header magic value ASCII "MCLF" */
+ u32 version; /**< Version the MCLF header struct */
+};
+
+/**
+ * @defgroup MCLF_VER_V2 MCLF Version 32
+ * @ingroup MCLF_VER
+ *
+ * @addtogroup MCLF_VER_V2
+ */
+
+/*
+ * GP TA identity.
+ */
+struct identity {
+ /**< GP TA login type */
+ u32 login_type;
+ /**< GP TA login data */
+ u8 login_data[16];
+};
+
+/**
+ * Version 2.1/2.2 MCLF header.
+ */
+struct mclf_header_v2 {
+ /**< MCLF header start with the mandatory intro */
+ struct mclf_intro intro;
+ /**< Service flags */
+ u32 flags;
+ /**< Type of memory the service must be executed from */
+ u32 mem_type;
+ /**< Type of service */
+ enum service_type service_type;
+ /**< Number of instances which can be run simultaneously */
+ u32 num_instances;
+ /**< Loadable service unique identifier (UUID) */
+ struct mc_uuid_t uuid;
+ /**< If the service_type is SERVICE_TYPE_DRIVER the Driver ID is used */
+ u32 driver_id;
+ /**<
+ * Number of threads (N) in a service:
+ * SERVICE_TYPE_SP_TRUSTLET: N = 1
+ * SERVICE_TYPE_SYSTEM_TRUSTLET: N = 1
+ * SERVICE_TYPE_DRIVER: N >= 1
+ */
+ u32 num_threads;
+ /**< Virtual text segment */
+ struct segment_descriptor text;
+ /**< Virtual data segment */
+ struct segment_descriptor data;
+ /**< Length of the BSS segment in bytes. MUST be at least 8 byte */
+ u32 bss_len;
+ /**< Virtual start address of service code */
+ u32 entry;
+ /**< Version of the interface the driver exports */
+ u32 service_version;
+};
+
+/**
+ * @addtogroup MCLF
+ */
+
+/** MCLF header */
+union mclf_header {
+ /**< Intro for data identification */
+ struct mclf_intro intro;
+ /**< Version 2 header */
+ struct mclf_header_v2 mclf_header_v2;
+};
+
+struct mc_blob_len_info {
+ u32 magic; /**< New blob format magic number */
+ u32 root_size; /**< Root container size */
+ u32 sp_size; /**< SP container size */
+ u32 ta_size; /**< TA container size */
+ u32 reserved[4]; /**< Reserved for further Use */
+};
+
+#endif /* MCLOADFORMAT_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mcp.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mcp.c
new file mode 100644
index 0000000..5ab0c07
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mcp.c
@@ -0,0 +1,1025 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/mutex.h>
+#include <linux/device.h>
+#include <linux/sched.h>
+#include <linux/kthread.h>
+#include <linux/completion.h>
+#include <linux/circ_buf.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/debugfs.h>
+#include <linux/of_irq.h>
+#include <linux/freezer.h>
+#include <asm/barrier.h>
+#include <linux/irq.h>
+#include <linux/version.h>
+#include <linux/sched/clock.h> /* local_clock */
+
+#include "public/mc_user.h"
+#include "public/mc_admin.h"
+
+#include "mci/mcimcp.h"
+#include "mci/mcifc.h"
+#include "mci/mcinq.h" /* SID_MCP */
+#include "mci/mcitime.h" /* struct mcp_time */
+#include "mci/mciiwp.h"
+
+#include "main.h"
+#include "admin.h" /* tee_object* for 'blob' */
+#include "mmu.h" /* MMU for 'blob' */
+#include "nq.h"
+#include "xen_fe.h"
+#include "mcp.h"
+
+/* respond timeout for MCP notification, in secs */
+#define MCP_TIMEOUT 10
+#define MCP_RETRIES 5
+#define MCP_NF_QUEUE_SZ 8
+
+static struct {
+ union mcp_message *buffer; /* MCP communication buffer */
+ struct mutex buffer_mutex; /* Lock for the buffer above */
+ struct completion complete;
+ bool mcp_dead;
+ struct mcp_session mcp_session; /* Pseudo session for MCP */
+ /* Unexpected notification (during MCP open) */
+ struct mutex unexp_notif_mutex;
+ struct notification unexp_notif;
+ /* Sessions */
+ struct mutex sessions_lock;
+ struct list_head sessions;
+ /* TEE bad state detection */
+ struct notifier_block tee_stop_notifier;
+ u32 timeout_period;
+ /* Log of last commands */
+#define LAST_CMDS_SIZE 1024
+ struct mutex last_cmds_mutex; /* Log protection */
+ struct command_info {
+ u64 cpu_clk; /* Kernel time */
+ pid_t pid; /* Caller PID */
+ enum cmd_id id; /* MCP command ID */
+ u32 session_id;
+ char uuid_str[34];
+ enum state {
+ UNUSED, /* Unused slot */
+ PENDING, /* Previous command in progress */
+ SENT, /* Waiting for response */
+ COMPLETE, /* Got result */
+ FAILED, /* Something went wrong */
+ } state; /* Command processing state */
+ int errno; /* Return code */
+ enum mcp_result result; /* Command result */
+ } last_cmds[LAST_CMDS_SIZE];
+ int last_cmds_index;
+} l_ctx;
+
+static const char *cmd_to_string(enum cmd_id id)
+{
+ switch (id) {
+ case MC_MCP_CMD_ID_INVALID:
+ return "invalid";
+ case MC_MCP_CMD_OPEN_SESSION:
+ return "open session";
+ case MC_MCP_CMD_CLOSE_SESSION:
+ return "close session";
+ case MC_MCP_CMD_MAP:
+ return "map";
+ case MC_MCP_CMD_UNMAP:
+ return "unmap";
+ case MC_MCP_CMD_SUSPEND:
+ return "suspend";
+ case MC_MCP_CMD_RESUME:
+ return "resume";
+ case MC_MCP_CMD_GET_MOBICORE_VERSION:
+ return "get version";
+ case MC_MCP_CMD_CLOSE_MCP:
+ return "close mcp";
+ case MC_MCP_CMD_LOAD_TOKEN:
+ return "load token";
+ case MC_MCP_CMD_CHECK_LOAD_TA:
+ return "check load TA";
+ case MC_MCP_CMD_LOAD_SYSENC_KEY_SO:
+ return "load Key SO";
+ }
+ return "unknown";
+}
+
+static const char *state_to_string(enum mcp_session_state state)
+{
+ switch (state) {
+ case MCP_SESSION_RUNNING:
+ return "running";
+ case MCP_SESSION_CLOSE_FAILED:
+ return "close failed";
+ case MCP_SESSION_CLOSED:
+ return "closed";
+ }
+ return "error";
+}
+
+static inline void mark_mcp_dead(void)
+{
+ struct mcp_session *session;
+
+ l_ctx.mcp_dead = true;
+ complete(&l_ctx.complete);
+ /* Signal all potential waiters that SWd is going away */
+ list_for_each_entry(session, &l_ctx.sessions, list)
+ complete(&session->completion);
+}
+
+static int tee_stop_notifier_fn(struct notifier_block *nb, unsigned long event,
+ void *data)
+{
+ mark_mcp_dead();
+ return 0;
+}
+
+void mcp_session_init(struct mcp_session *session)
+{
+ nq_session_init(&session->nq_session, false);
+ session->sid = SID_INVALID;
+ INIT_LIST_HEAD(&session->list);
+ mutex_init(&session->notif_wait_lock);
+ init_completion(&session->completion);
+ mutex_init(&session->exit_code_lock);
+ session->exit_code = 0;
+ session->state = MCP_SESSION_RUNNING;
+ session->notif_count = 0;
+}
+
+static inline bool mcp_session_isrunning(struct mcp_session *session)
+{
+ bool ret;
+
+ mutex_lock(&l_ctx.sessions_lock);
+ ret = session->state == MCP_SESSION_RUNNING;
+ mutex_unlock(&l_ctx.sessions_lock);
+ return ret;
+}
+
+/*
+ * session remains valid thanks to the upper layers reference counters, but the
+ * SWd session may have died, in which case we are informed.
+ */
+int mcp_wait(struct mcp_session *session, s32 timeout, bool silent_expiry)
+{
+ s32 err;
+ int ret = 0;
+
+ mutex_lock(&session->notif_wait_lock);
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu()) {
+ ret = xen_mc_wait(session, timeout, silent_expiry);
+ mutex_unlock(&session->notif_wait_lock);
+ return ret;
+ }
+#endif
+
+ if (l_ctx.mcp_dead) {
+ ret = -EHOSTUNREACH;
+ goto end;
+ }
+
+ if (!mcp_session_isrunning(session)) {
+ ret = -ENXIO;
+ goto end;
+ }
+
+ mcp_get_err(session, &err);
+ if (err) {
+ ret = -ECOMM;
+ goto end;
+ }
+
+ if (timeout < 0) {
+ ret = wait_for_completion_interruptible(&session->completion);
+ if (ret)
+ goto end;
+ } else {
+ ret = wait_for_completion_interruptible_timeout(
+ &session->completion, timeout * HZ / 1000);
+ if (ret < 0)
+ /* Interrupted */
+ goto end;
+
+ if (!ret) {
+ /* Timed out */
+ ret = -ETIME;
+ goto end;
+ }
+
+ ret = 0;
+ }
+
+ if (l_ctx.mcp_dead) {
+ ret = -EHOSTUNREACH;
+ goto end;
+ }
+
+ mcp_get_err(session, &err);
+ if (err) {
+ ret = -ECOMM;
+ goto end;
+ }
+
+ if (!mcp_session_isrunning(session)) {
+ ret = -ENXIO;
+ goto end;
+ }
+
+end:
+ if (!ret)
+ nq_session_state_update(&session->nq_session,
+ NQ_NOTIF_CONSUMED);
+ else if (ret != -ERESTARTSYS)
+ nq_session_state_update(&session->nq_session, NQ_NOTIF_DEAD);
+
+ mutex_unlock(&session->notif_wait_lock);
+ if (ret && ((ret != -ETIME) || !silent_expiry)) {
+#ifdef CONFIG_FREEZER
+ if (ret == -ERESTARTSYS && system_freezing_cnt.counter == 1)
+ mc_dev_devel("freezing session %x", session->sid);
+ else
+#endif
+ mc_dev_devel("session %x ec %d ret %d",
+ session->sid, session->exit_code, ret);
+ }
+
+ return ret;
+}
+
+int mcp_get_err(struct mcp_session *session, s32 *err)
+{
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_mc_get_err(session, err);
+#endif
+
+ mutex_lock(&session->exit_code_lock);
+ *err = session->exit_code;
+ mutex_unlock(&session->exit_code_lock);
+ if (*err)
+ mc_dev_info("session %x ec %d", session->sid, *err);
+
+ return 0;
+}
+
+static inline int wait_mcp_notification(void)
+{
+ unsigned long timeout = msecs_to_jiffies(l_ctx.timeout_period * 1000);
+ int try, ret = -ETIME;
+
+ /*
+ * Total timeout is l_ctx.timeout_period * MCP_RETRIES, but we check for
+ * a crash to try and terminate before then if things go wrong.
+ */
+ for (try = 1; try <= MCP_RETRIES; try++) {
+ /*
+ * Wait non-interruptible to keep MCP synchronised even if
+ * caller is interrupted by signal.
+ */
+ if (wait_for_completion_timeout(&l_ctx.complete, timeout) > 0)
+ return 0;
+
+ mc_dev_err(ret, "no answer after %ds",
+ l_ctx.timeout_period * try);
+ }
+
+ mc_dev_err(ret, "timed out waiting for MCP notification");
+ nq_signal_tee_hung();
+ return ret;
+}
+
+static int mcp_cmd(union mcp_message *cmd,
+ /* The fields below are for debug purpose only */
+ u32 in_session_id,
+ u32 *out_session_id,
+ struct mc_uuid_t *uuid)
+{
+ int err = 0, ret = -EHOSTUNREACH;
+ union mcp_message *msg;
+ enum cmd_id cmd_id = cmd->cmd_header.cmd_id;
+ struct command_info *cmd_info;
+
+ /* Initialize MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ cmd_info = &l_ctx.last_cmds[l_ctx.last_cmds_index];
+ cmd_info->cpu_clk = local_clock();
+ cmd_info->pid = current->pid;
+ cmd_info->id = cmd_id;
+ cmd_info->session_id = in_session_id;
+ if (uuid) {
+ /* Keep UUID because it's an 'open session' cmd */
+ size_t i;
+
+ cmd_info->uuid_str[0] = ' ';
+ for (i = 0; i < sizeof(uuid->value); i++) {
+ snprintf(&cmd_info->uuid_str[1 + i * 2], 3, "%02x",
+ uuid->value[i]);
+ }
+ } else {
+ cmd_info->uuid_str[0] = '\0';
+ }
+
+ cmd_info->state = PENDING;
+ cmd_info->errno = 0;
+ cmd_info->result = MC_MCP_RET_OK;
+ if (++l_ctx.last_cmds_index >= LAST_CMDS_SIZE)
+ l_ctx.last_cmds_index = 0;
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+
+ mutex_lock(&l_ctx.buffer_mutex);
+ msg = l_ctx.buffer;
+ if (l_ctx.mcp_dead)
+ goto out;
+
+ /* Copy message to MCP buffer */
+ memcpy(msg, cmd, sizeof(*msg));
+
+ /* Send MCP notification, with cmd_id as payload for debug purpose */
+ nq_session_notify(&l_ctx.mcp_session.nq_session, l_ctx.mcp_session.sid,
+ cmd_id);
+
+ /* Update MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ cmd_info->state = SENT;
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+ ret = wait_mcp_notification();
+ if (ret)
+ goto out;
+
+ /* Check response ID */
+ if (msg->rsp_header.rsp_id != (cmd_id | FLAG_RESPONSE)) {
+ ret = -EBADE;
+ mc_dev_err(ret, "MCP command got invalid response (0x%X)",
+ msg->rsp_header.rsp_id);
+ goto out;
+ }
+
+ /* Convert result */
+ switch (msg->rsp_header.result) {
+ case MC_MCP_RET_OK:
+ err = 0;
+ break;
+ case MC_MCP_RET_ERR_CLOSE_TASK_FAILED:
+ err = -EAGAIN;
+ break;
+ case MC_MCP_RET_ERR_NO_MORE_SESSIONS:
+ err = -EBUSY;
+ break;
+ case MC_MCP_RET_ERR_OUT_OF_RESOURCES:
+ err = -ENOSPC;
+ break;
+ case MC_MCP_RET_ERR_UNKNOWN_UUID:
+ err = -ENOENT;
+ break;
+ case MC_MCP_RET_ERR_WRONG_PUBLIC_KEY:
+ err = -EKEYREJECTED;
+ break;
+ case MC_MCP_RET_ERR_SERVICE_BLOCKED:
+ err = -ECONNREFUSED;
+ break;
+ case MC_MCP_RET_ERR_SERVICE_LOCKED:
+ err = -ECONNABORTED;
+ break;
+ case MC_MCP_RET_ERR_SERVICE_KILLED:
+ err = -ECONNRESET;
+ break;
+ case MC_MCP_RET_ERR_SYSTEM_NOT_READY:
+ err = -EAGAIN;
+ break;
+ case MC_MCP_RET_ERR_DOWNGRADE_NOT_AUTHORIZED:
+ err = -EPERM;
+ break;
+ default:
+ err = -EPERM;
+ }
+
+ /* Copy response back to caller struct */
+ memcpy(cmd, msg, sizeof(*cmd));
+
+out:
+ /* Update MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ if (ret) {
+ cmd_info->state = FAILED;
+ cmd_info->errno = -ret;
+ } else {
+ cmd_info->state = COMPLETE;
+ cmd_info->errno = -err;
+ cmd_info->result = msg->rsp_header.result;
+ /* For open session: get SID */
+ if (!err && out_session_id)
+ cmd_info->session_id = *out_session_id;
+ }
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+ mutex_unlock(&l_ctx.buffer_mutex);
+ if (ret) {
+ mc_dev_err(ret, "%s: sending failed", cmd_to_string(cmd_id));
+ return ret;
+ }
+
+ if (err) {
+ if (cmd_id == MC_MCP_CMD_CLOSE_SESSION && err == -EAGAIN)
+ mc_dev_devel("%s: try again",
+ cmd_to_string(cmd_id));
+ else
+ mc_dev_err(err, "%s: res %d", cmd_to_string(cmd_id),
+ msg->rsp_header.result);
+ return err;
+ }
+
+ return 0;
+}
+
+static inline int __mcp_get_version(struct mc_version_info *version_info)
+{
+ union mcp_message cmd;
+ u32 version;
+ int ret;
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_mc_get_version(version_info);
+#endif
+
+ version = MC_VERSION(MCDRVMODULEAPI_VERSION_MAJOR,
+ MCDRVMODULEAPI_VERSION_MINOR);
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_GET_MOBICORE_VERSION;
+ ret = mcp_cmd(&cmd, 0, NULL, NULL);
+ if (ret)
+ return ret;
+
+ memcpy(version_info, &cmd.rsp_get_version.version_info,
+ sizeof(*version_info));
+ /*
+ * The CMP version is meaningless in this case, and is replaced
+ * by the driver's own version.
+ */
+ version_info->version_nwd = version;
+ return 0;
+}
+
+int mcp_get_version(struct mc_version_info *version_info)
+{
+ static struct mc_version_info static_version_info;
+
+ /* If cache empty, get version from the SWd and cache it */
+ if (!static_version_info.version_nwd) {
+ int ret = __mcp_get_version(&static_version_info);
+
+ if (ret)
+ return ret;
+ }
+
+ /* Copy cached version */
+ memcpy(version_info, &static_version_info, sizeof(*version_info));
+ nq_set_version_ptr(static_version_info.product_id);
+ return 0;
+}
+
+int mcp_load_token(uintptr_t data, const struct mcp_buffer_map *map)
+{
+ union mcp_message cmd;
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_LOAD_TOKEN;
+ cmd.cmd_load_token.wsm_data_type = map->type;
+ cmd.cmd_load_token.adr_load_data = map->addr;
+ cmd.cmd_load_token.ofs_load_data = map->offset;
+ cmd.cmd_load_token.len_load_data = map->length;
+ return mcp_cmd(&cmd, 0, NULL, NULL);
+}
+
+int mcp_load_check(const struct tee_object *obj,
+ const struct mcp_buffer_map *map)
+{
+ const union mclf_header *header;
+ union mcp_message cmd;
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_CHECK_LOAD_TA;
+ /* Data */
+ cmd.cmd_check_load.wsm_data_type = map->type;
+ cmd.cmd_check_load.adr_load_data = map->addr;
+ cmd.cmd_check_load.ofs_load_data = map->offset;
+ cmd.cmd_check_load.len_load_data = map->length;
+ /* Header */
+ header = (union mclf_header *)(obj->data + obj->header_length);
+ cmd.cmd_check_load.uuid = header->mclf_header_v2.uuid;
+ return mcp_cmd(&cmd, 0, NULL, &cmd.cmd_check_load.uuid);
+}
+
+int mcp_load_key_so(uintptr_t data, const struct mcp_buffer_map *map)
+{
+ union mcp_message cmd;
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_LOAD_SYSENC_KEY_SO;
+ cmd.cmd_load_key_so.wsm_data_type = map->type;
+ cmd.cmd_load_key_so.adr_load_data = map->addr;
+ cmd.cmd_load_key_so.ofs_load_data = map->offset;
+ cmd.cmd_load_key_so.len_load_data = map->length;
+ return mcp_cmd(&cmd, 0, NULL, NULL);
+}
+
+int mcp_open_session(struct mcp_session *session, struct mcp_open_info *info,
+ bool *tci_in_use)
+{
+ static DEFINE_MUTEX(local_mutex);
+ struct tee_object *obj;
+ const union mclf_header *header;
+ struct tee_mmu *obj_mmu;
+ struct mcp_buffer_map obj_map;
+ union mcp_message cmd;
+ int ret;
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu()) {
+ ret = xen_mc_open_session(session, info);
+ if (ret)
+ return ret;
+
+ /* Add to list of sessions */
+ mutex_lock(&l_ctx.sessions_lock);
+ list_add_tail(&session->list, &l_ctx.sessions);
+ mutex_unlock(&l_ctx.sessions_lock);
+ return 0;
+ }
+#endif
+
+ /* Create 'blob' */
+ if (info->type == TEE_MC_UUID) {
+ /* Get TA from registry */
+ obj = tee_object_get(info->uuid, false);
+ /* Tell SWd to load TA from SFS as not in registry */
+ if (IS_ERR(obj) && (PTR_ERR(obj) == -ENOENT))
+ obj = tee_object_select(info->uuid);
+ } else if (info->type == TEE_MC_DRIVER_UUID) {
+ /* Load driver using only uuid */
+ obj = tee_object_select(info->uuid);
+ *tci_in_use = false;
+ } else if (info->user) {
+ /* Create secure object from user-space trustlet binary */
+ obj = tee_object_read(info->spid, info->va, info->len);
+ } else {
+ /* Create secure object from kernel-space trustlet binary */
+ obj = tee_object_copy(info->va, info->len);
+ }
+
+ if (IS_ERR(obj))
+ return PTR_ERR(obj);
+
+ /* Header */
+ header = (const union mclf_header *)(&obj->data[obj->header_length]);
+ if (info->type == TEE_MC_DRIVER &&
+ (header->mclf_header_v2.flags &
+ MC_SERVICE_HEADER_FLAGS_NO_CONTROL_INTERFACE))
+ *tci_in_use = false;
+
+ /* Create mapping for blob (allocated by driver, so task = NULL) */
+ {
+ struct mc_ioctl_buffer buf = {
+ .va = (uintptr_t)obj->data,
+ .len = obj->length,
+ .flags = MC_IO_MAP_INPUT,
+ };
+
+ obj_mmu = tee_mmu_create(NULL, &buf);
+ if (IS_ERR(obj_mmu)) {
+ ret = PTR_ERR(obj_mmu);
+ goto err_mmu;
+ }
+
+ tee_mmu_buffer(obj_mmu, &obj_map);
+ }
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_OPEN_SESSION;
+ /* Data */
+ cmd.cmd_open.uuid = header->mclf_header_v2.uuid;
+ cmd.cmd_open.wsm_data_type = obj_map.type;
+ cmd.cmd_open.adr_load_data = obj_map.addr;
+ cmd.cmd_open.ofs_load_data = obj_map.offset;
+ cmd.cmd_open.len_load_data = obj_map.length;
+ /* Buffer */
+ if (*tci_in_use) {
+ struct mcp_buffer_map map;
+
+ tee_mmu_buffer(info->tci_mmu, &map);
+ cmd.cmd_open.wsmtype_tci = map.type;
+ cmd.cmd_open.adr_tci_buffer = map.addr;
+ cmd.cmd_open.ofs_tci_buffer = map.offset;
+ cmd.cmd_open.len_tci_buffer = map.length;
+ } else {
+ cmd.cmd_open.wsmtype_tci = WSM_INVALID;
+ }
+
+ /* Reset unexpected notification */
+ mutex_lock(&local_mutex);
+ l_ctx.unexp_notif.session_id = SID_MCP; /* Cannot be */
+ cmd.cmd_open.cmd_open_data.mclf_magic = MC_GP_CLIENT_AUTH_MAGIC;
+
+ /* Send MCP open command */
+ ret = mcp_cmd(&cmd, 0, &cmd.rsp_open.session_id, &cmd.cmd_open.uuid);
+ /* Make sure we have a valid session ID */
+ if (!ret && !cmd.rsp_open.session_id)
+ ret = -EBADE;
+
+ if (!ret) {
+ session->sid = cmd.rsp_open.session_id;
+ /* Add to list of sessions */
+ mutex_lock(&l_ctx.sessions_lock);
+ list_add_tail(&session->list, &l_ctx.sessions);
+ mutex_unlock(&l_ctx.sessions_lock);
+ /* Check for spurious notification */
+ mutex_lock(&l_ctx.unexp_notif_mutex);
+ if (l_ctx.unexp_notif.session_id == session->sid) {
+ mutex_lock(&session->exit_code_lock);
+ session->exit_code = l_ctx.unexp_notif.payload;
+ mutex_unlock(&session->exit_code_lock);
+ nq_session_state_update(&session->nq_session,
+ NQ_NOTIF_RECEIVED);
+ complete(&session->completion);
+ }
+
+ mutex_unlock(&l_ctx.unexp_notif_mutex);
+ }
+
+ mutex_unlock(&local_mutex);
+
+ /* Blob for UUID/TA not needed as re-mapped by the SWd */
+ tee_mmu_put(obj_mmu);
+
+err_mmu:
+ /* Delete secure object */
+ tee_object_free(obj);
+
+ return ret;
+}
+
+/*
+ * Legacy and GP TAs close differently:
+ * - GP TAs always send a notification with payload, whether on close or crash
+ * - Legacy TAs only send a notification with payload on crash
+ * - GP TAs may take time to close, and we get -EAGAIN back from mcp_cmd
+ * - Legacy TAs always close when asked, unless they are driver in which case
+ * they just don't close at all
+ */
+int mcp_close_session(struct mcp_session *session)
+{
+ union mcp_message cmd;
+ int ret;
+
+ if (is_xen_domu()) {
+#ifdef TRUSTONIC_XEN_DOMU
+ ret = xen_mc_close_session(session);
+#endif
+ } else {
+ /* Signal a potential waiter that SWd session is going away */
+ complete(&session->completion);
+ /* Send MCP command */
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_CLOSE_SESSION;
+ cmd.cmd_close.session_id = session->sid;
+ ret = mcp_cmd(&cmd, cmd.cmd_close.session_id, NULL, NULL);
+ }
+
+ mutex_lock(&l_ctx.sessions_lock);
+ if (!ret) {
+ session->state = MCP_SESSION_CLOSED;
+ list_del(&session->list);
+ nq_session_exit(&session->nq_session);
+ } else {
+ /* Something is not right, assume session is still running */
+ session->state = MCP_SESSION_CLOSE_FAILED;
+ }
+ mutex_unlock(&l_ctx.sessions_lock);
+ mc_dev_devel("close session %x ret %d state %s",
+ session->sid, ret, state_to_string(session->state));
+ return ret;
+}
+
+/*
+ * Session is to be removed from NWd records as SWd has been wiped clean
+ */
+void mcp_cleanup_session(struct mcp_session *session)
+{
+ mutex_lock(&l_ctx.sessions_lock);
+ session->state = MCP_SESSION_CLOSED;
+ list_del(&session->list);
+ nq_session_exit(&session->nq_session);
+ mutex_unlock(&l_ctx.sessions_lock);
+}
+
+int mcp_map(u32 session_id, struct tee_mmu *mmu, u32 *sva)
+{
+ struct mcp_buffer_map map;
+ union mcp_message cmd;
+ int ret;
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_mc_map(session_id, mmu, sva);
+#endif
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_MAP;
+ cmd.cmd_map.session_id = session_id;
+ tee_mmu_buffer(mmu, &map);
+ cmd.cmd_map.wsm_type = map.type;
+ cmd.cmd_map.adr_buffer = map.addr;
+ cmd.cmd_map.ofs_buffer = map.offset;
+ cmd.cmd_map.len_buffer = map.length;
+ cmd.cmd_map.flags = map.flags;
+ ret = mcp_cmd(&cmd, session_id, NULL, NULL);
+ if (!ret) {
+ *sva = cmd.rsp_map.secure_va;
+ atomic_inc(&g_ctx.c_maps);
+ }
+
+ return ret;
+}
+
+int mcp_unmap(u32 session_id, const struct mcp_buffer_map *map)
+{
+ union mcp_message cmd;
+ int ret;
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_mc_unmap(session_id, map);
+#endif
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_UNMAP;
+ cmd.cmd_unmap.session_id = session_id;
+ cmd.cmd_unmap.wsm_type = map->type;
+ cmd.cmd_unmap.virtual_buffer_len = map->length;
+ cmd.cmd_unmap.secure_va = map->secure_va;
+ ret = mcp_cmd(&cmd, session_id, NULL, NULL);
+ if (!ret)
+ atomic_dec(&g_ctx.c_maps);
+
+ return ret;
+}
+
+static int mcp_close(void)
+{
+ union mcp_message cmd;
+
+ memset(&cmd, 0, sizeof(cmd));
+ cmd.cmd_header.cmd_id = MC_MCP_CMD_CLOSE_MCP;
+ return mcp_cmd(&cmd, 0, NULL, NULL);
+}
+
+int mcp_notify(struct mcp_session *session)
+{
+ if (l_ctx.mcp_dead)
+ return -EHOSTUNREACH;
+
+ if (session->sid == SID_MCP)
+ mc_dev_devel("notify MCP");
+ else
+ mc_dev_devel("notify session %x", session->sid);
+
+#ifdef TRUSTONIC_XEN_DOMU
+ if (is_xen_domu())
+ return xen_mc_notify(session);
+#endif
+
+ /* Put notif_count as payload for debug purpose */
+ return nq_session_notify(&session->nq_session, session->sid,
+ ++session->notif_count);
+}
+
+static inline void session_notif_handler(struct mcp_session *session, u32 id,
+ u32 payload)
+{
+ mutex_lock(&l_ctx.sessions_lock);
+ mc_dev_devel("MCP notif from session %x exit code %d state %d",
+ id, payload, session ? session->state : -1);
+ if (session) {
+ /* TA has terminated */
+ if (payload) {
+ /* Update exit code, or not */
+ mutex_lock(&session->exit_code_lock);
+ session->exit_code = payload;
+ mutex_unlock(&session->exit_code_lock);
+ }
+
+ nq_session_state_update(&session->nq_session,
+ NQ_NOTIF_RECEIVED);
+
+ /* Unblock waiter */
+ complete(&session->completion);
+ }
+ mutex_unlock(&l_ctx.sessions_lock);
+
+ /* Unknown session, probably being started */
+ if (!session) {
+ mutex_lock(&l_ctx.unexp_notif_mutex);
+ l_ctx.unexp_notif.session_id = id;
+ l_ctx.unexp_notif.payload = payload;
+ mutex_unlock(&l_ctx.unexp_notif_mutex);
+ }
+}
+
+static void mcp_notif_handler(u32 id, u32 payload)
+{
+ if (id == SID_MCP) {
+ /* MCP notification */
+ mc_dev_devel("notification from MCP");
+ complete(&l_ctx.complete);
+ } else {
+ /* Session notification */
+ struct mcp_session *session = NULL, *candidate;
+
+ mutex_lock(&l_ctx.sessions_lock);
+ list_for_each_entry(candidate, &l_ctx.sessions, list) {
+ if (candidate->sid == id) {
+ session = candidate;
+ break;
+ }
+ }
+ mutex_unlock(&l_ctx.sessions_lock);
+
+ /* session is NULL if id not found */
+ session_notif_handler(session, id, payload);
+ }
+}
+
+static int debug_sessions(struct kasnprintf_buf *buf)
+{
+ struct mcp_session *session;
+ int ret;
+
+ /* Header */
+ ret = kasnprintf(buf, "%20s %4s %-15s %-11s %4s\n",
+ "CPU clock", "ID", "state", "notif state", "ec");
+ if (ret < 0)
+ return ret;
+
+ mutex_lock(&l_ctx.sessions_lock);
+ list_for_each_entry(session, &l_ctx.sessions, list) {
+ const char *state_str;
+ u64 cpu_clk;
+ s32 err;
+
+ state_str = nq_session_state(&session->nq_session, &cpu_clk);
+ mcp_get_err(session, &err);
+ ret = kasnprintf(buf, "%20llu %4x %-15s %-11s %4d\n", cpu_clk,
+ session->sid, state_to_string(session->state),
+ state_str, err);
+ if (ret < 0)
+ break;
+ }
+ mutex_unlock(&l_ctx.sessions_lock);
+ return ret;
+}
+
+static ssize_t debug_sessions_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ return debug_generic_read(file, user_buf, count, ppos,
+ debug_sessions);
+}
+
+static const struct file_operations debug_sessions_ops = {
+ .read = debug_sessions_read,
+ .llseek = default_llseek,
+ .open = debug_generic_open,
+ .release = debug_generic_release,
+};
+
+static inline int show_log_entry(struct kasnprintf_buf *buf,
+ struct command_info *cmd_info)
+{
+ const char *state_str = "unknown";
+
+ switch (cmd_info->state) {
+ case UNUSED:
+ state_str = "unused";
+ break;
+ case PENDING:
+ state_str = "pending";
+ break;
+ case SENT:
+ state_str = "sent";
+ break;
+ case COMPLETE:
+ state_str = "complete";
+ break;
+ case FAILED:
+ state_str = "failed";
+ break;
+ }
+
+ return kasnprintf(buf, "%20llu %5d %-16s %5x %-8s %5d %6d%s\n",
+ cmd_info->cpu_clk, cmd_info->pid,
+ cmd_to_string(cmd_info->id), cmd_info->session_id,
+ state_str, cmd_info->errno, cmd_info->result,
+ cmd_info->uuid_str);
+}
+
+static int debug_last_cmds(struct kasnprintf_buf *buf)
+{
+ struct command_info *cmd_info;
+ int i, ret = 0;
+
+ /* Initialize MCP log */
+ mutex_lock(&l_ctx.last_cmds_mutex);
+ ret = kasnprintf(buf, "%20s %5s %-16s %5s %-8s %5s %6s %s\n",
+ "CPU clock", "PID", "command", "S-ID",
+ "state", "errno", "result", "UUID");
+ if (ret < 0)
+ goto out;
+
+ cmd_info = &l_ctx.last_cmds[l_ctx.last_cmds_index];
+ if (cmd_info->state != UNUSED)
+ /* Buffer has wrapped around, dump end (oldest records) */
+ for (i = l_ctx.last_cmds_index; i < LAST_CMDS_SIZE; i++) {
+ ret = show_log_entry(buf, cmd_info++);
+ if (ret < 0)
+ goto out;
+ }
+
+ /* Dump first records */
+ cmd_info = &l_ctx.last_cmds[0];
+ for (i = 0; i < l_ctx.last_cmds_index; i++) {
+ ret = show_log_entry(buf, cmd_info++);
+ if (ret < 0)
+ goto out;
+ }
+
+out:
+ mutex_unlock(&l_ctx.last_cmds_mutex);
+ return ret;
+}
+
+static ssize_t debug_last_cmds_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ return debug_generic_read(file, user_buf, count, ppos, debug_last_cmds);
+}
+
+static const struct file_operations debug_last_cmds_ops = {
+ .read = debug_last_cmds_read,
+ .llseek = default_llseek,
+ .open = debug_generic_open,
+ .release = debug_generic_release,
+};
+
+int mcp_init(void)
+{
+ l_ctx.buffer = nq_get_mcp_buffer();
+ mutex_init(&l_ctx.buffer_mutex);
+ init_completion(&l_ctx.complete);
+ /* Setup notification queue mutex */
+ mcp_session_init(&l_ctx.mcp_session);
+ l_ctx.mcp_session.sid = SID_MCP;
+ mutex_init(&l_ctx.unexp_notif_mutex);
+ INIT_LIST_HEAD(&l_ctx.sessions);
+ mutex_init(&l_ctx.sessions_lock);
+ mutex_init(&l_ctx.last_cmds_mutex);
+
+ l_ctx.timeout_period = MCP_TIMEOUT;
+
+ nq_register_notif_handler(mcp_notif_handler, false);
+ l_ctx.tee_stop_notifier.notifier_call = tee_stop_notifier_fn;
+ nq_register_tee_stop_notifier(&l_ctx.tee_stop_notifier);
+
+ return 0;
+}
+
+void mcp_exit(void)
+{
+ mark_mcp_dead();
+ nq_unregister_tee_stop_notifier(&l_ctx.tee_stop_notifier);
+}
+
+int mcp_start(void)
+{
+ /* Create debugfs sessions and last commands entries */
+ debugfs_create_file("sessions", 0400, g_ctx.debug_dir, NULL,
+ &debug_sessions_ops);
+ debugfs_create_file("last_mcp_commands", 0400, g_ctx.debug_dir, NULL,
+ &debug_last_cmds_ops);
+ debugfs_create_u32("mcp_timeout", 0600, g_ctx.debug_dir,
+ &l_ctx.timeout_period);
+ return 0;
+}
+
+void mcp_stop(void)
+{
+ mcp_close();
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mcp.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mcp.h
new file mode 100644
index 0000000..cf4c6a7
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mcp.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_MCP_H_
+#define _MC_MCP_H_
+
+#include "mci/mcloadformat.h" /* struct identity */
+#include "nq.h"
+
+struct tee_mmu;
+
+/* Structure to hold the TA/driver information at open */
+struct mcp_open_info {
+ enum {
+ TEE_MC_UUID,
+ TEE_MC_TA,
+ TEE_MC_DRIVER,
+ TEE_MC_DRIVER_UUID,
+ } type;
+ /* TA/driver */
+ const struct mc_uuid_t *uuid;
+ u32 spid;
+ uintptr_t va;
+ size_t len;
+ /* TCI */
+ uintptr_t tci_va;
+ size_t tci_len;
+ struct tee_mmu *tci_mmu;
+ /* Origin */
+ bool user;
+};
+
+/* Structure to hold the TA/driver descriptor to pass to MCP */
+struct tee_object {
+ u32 length; /* Total length */
+ u32 header_length; /* Length of header before payload */
+ u8 data[]; /* Header followed by payload */
+};
+
+/* Structure to hold all mapped buffer data to pass to MCP */
+struct mcp_buffer_map {
+ u64 addr; /** Page-aligned PA, or VA */
+ unsigned long nr_pages; /** Total number of pages mapped */
+ u32 secure_va; /** SWd virtual address */
+ u32 offset; /** Data offset inside the first page */
+ u32 length; /** Length of the data */
+ u32 type; /** Type of MMU */
+ u32 flags; /** Flags (typically read/write) */
+ struct tee_mmu *mmu; /** MMU from which the map was made */
+};
+
+struct mcp_session {
+ /* Notification queue session */
+ struct nq_session nq_session;
+ /* Session ID */
+ u32 sid;
+ /* Sessions list (protected by mcp sessions_lock) */
+ struct list_head list;
+ /* Notification waiter lock */
+ struct mutex notif_wait_lock; /* Only one at a time */
+ /* Notification received */
+ struct completion completion;
+ /* Notification lock */
+ struct mutex exit_code_lock;
+ /* Last notification */
+ s32 exit_code;
+ /* Session state (protected by mcp sessions_lock) */
+ enum mcp_session_state {
+ MCP_SESSION_RUNNING,
+ MCP_SESSION_CLOSE_FAILED,
+ MCP_SESSION_CLOSED,
+ } state;
+ /* Notification counter */
+ u32 notif_count;
+};
+
+/* Init for the mcp_session structure */
+void mcp_session_init(struct mcp_session *session);
+
+/* Commands */
+int mcp_get_version(struct mc_version_info *version_info);
+int mcp_load_token(uintptr_t data, const struct mcp_buffer_map *buffer_map);
+int mcp_load_check(const struct tee_object *obj,
+ const struct mcp_buffer_map *buffer_map);
+int mcp_load_key_so(uintptr_t data, const struct mcp_buffer_map *buffer_map);
+int mcp_open_session(struct mcp_session *session, struct mcp_open_info *info,
+ bool *tci_in_use);
+int mcp_close_session(struct mcp_session *session);
+void mcp_cleanup_session(struct mcp_session *session);
+int mcp_map(u32 session_id, struct tee_mmu *mmu, u32 *sva);
+int mcp_unmap(u32 session_id, const struct mcp_buffer_map *map);
+int mcp_notify(struct mcp_session *mcp_session);
+int mcp_wait(struct mcp_session *session, s32 timeout, bool silent_expiry);
+int mcp_get_err(struct mcp_session *session, s32 *err);
+
+/* Initialisation/cleanup */
+int mcp_init(void);
+void mcp_exit(void);
+int mcp_start(void);
+void mcp_stop(void);
+
+#endif /* _MC_MCP_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mmu.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mmu.c
new file mode 100644
index 0000000..dce1e43
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mmu.c
@@ -0,0 +1,632 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <asm/pgtable.h>
+#include <linux/semaphore.h>
+#include <linux/completion.h>
+#include <linux/mutex.h>
+#include <linux/highmem.h>
+#include <linux/slab.h>
+#include <linux/kthread.h>
+#include <linux/pagemap.h>
+#include <linux/device.h>
+#include <linux/version.h>
+#include <linux/dma-buf.h>
+#ifdef CONFIG_DMA_SHARED_BUFFER
+#include <ion.h>
+#endif
+
+#ifdef CONFIG_XEN
+/* To get the MFN */
+#include <linux/pfn.h>
+#include <xen/page.h>
+#endif
+
+#include "public/mc_user.h"
+
+#include "mci/mcimcp.h"
+
+#include "main.h"
+#include "mcp.h" /* mcp_buffer_map */
+#include "mmu.h"
+
+#define PHYS_48BIT_MASK (BIT(48) - 1)
+
+/* Common */
+#define MMU_BUFFERABLE BIT(2) /* AttrIndx[0] */
+#define MMU_CACHEABLE BIT(3) /* AttrIndx[1] */
+#define MMU_EXT_NG BIT(11) /* ARMv6 and higher */
+
+/* LPAE */
+#define MMU_TYPE_PAGE (3 << 0)
+#define MMU_NS BIT(5)
+#define MMU_AP_RW_ALL BIT(6) /* AP[2:1], RW, at any privilege level */
+#define MMU_AP2_RO BIT(7)
+#define MMU_EXT_SHARED_64 (3 << 8) /* SH[1:0], inner shareable */
+#define MMU_EXT_AF BIT(10) /* Access Flag */
+#define MMU_EXT_XN (((u64)1) << 54) /* XN */
+
+/* Non-LPAE */
+#define MMU_TYPE_EXT (3 << 0) /* v5 */
+#define MMU_TYPE_SMALL (2 << 0)
+#define MMU_EXT_AP0 BIT(4)
+#define MMU_EXT_AP1 (2 << 4)
+#define MMU_EXT_AP2 BIT(9)
+#define MMU_EXT_TEX(x) ((x) << 6) /* v5 */
+#define MMU_EXT_SHARED_32 BIT(10) /* ARMv6 and higher */
+
+/* ION */
+/* Trustonic Specific flag to detect ION mem */
+#define MMU_ION_BUF BIT(24)
+
+static inline long gup_local(struct mm_struct *mm, uintptr_t start,
+ unsigned long nr_pages, int write,
+ struct page **pages)
+{
+ unsigned int gup_flags = 0;
+
+ if (write)
+ gup_flags |= FOLL_WRITE;
+
+ return get_user_pages_remote(NULL, mm, start, nr_pages, gup_flags,
+ pages, NULL, NULL);
+}
+
+static inline long gup_local_repeat(struct mm_struct *mm, uintptr_t start,
+ unsigned long nr_pages, int write,
+ struct page **pages)
+{
+ int retries = 10;
+ long ret = 0;
+
+ while (retries--) {
+ ret = gup_local(mm, start, nr_pages, write, pages);
+
+ if (-EBUSY != ret)
+ break;
+ }
+
+ return ret;
+}
+
+/*
+ * A table that could be either a pmd or pte
+ */
+union mmu_table {
+ u64 *entries; /* Array of PTEs */
+ /* Array of pages */
+ struct page **pages;
+ /* Array of VAs */
+ uintptr_t *vas;
+ /* Address of table */
+ void *addr;
+ /* Page for table */
+ unsigned long page;
+};
+
+/*
+ * MMU table allocated to the Daemon or a TLC describing a world shared
+ * buffer.
+ * When users map a malloc()ed area into SWd, a MMU table is allocated.
+ * In addition, the area of maximum 1MB virtual address space is mapped into
+ * the MMU table and a handle for this table is returned to the user.
+ */
+struct tee_mmu {
+ struct kref kref;
+ /* Array of pages that hold buffer ptes*/
+ union mmu_table pte_tables[PMD_ENTRIES_MAX];
+ /* Actual number of ptes tables */
+ size_t nr_pmd_entries;
+ /* Contains phys @ of ptes tables */
+ union mmu_table pmd_table;
+ struct tee_deleter *deleter; /* Xen map to free */
+ unsigned long nr_pages;
+ int pages_created; /* Leak check */
+ int pages_locked; /* Leak check */
+ u32 offset;
+ u32 length;
+ u32 flags;
+ /* Pages are from user space */
+ bool user;
+ bool use_pages_and_vas;
+ /* ION case only */
+ struct dma_buf *dma_buf;
+ struct dma_buf_attachment *attach;
+ struct sg_table *sgt;
+};
+
+static void tee_mmu_delete(struct tee_mmu *mmu)
+{
+ unsigned long chunk, nr_pages_left = mmu->nr_pages;
+
+#ifdef CONFIG_DMA_SHARED_BUFFER
+ if (mmu->dma_buf) {
+ dma_buf_unmap_attachment(mmu->attach, mmu->sgt,
+ DMA_BIDIRECTIONAL);
+ dma_buf_detach(mmu->dma_buf, mmu->attach);
+ dma_buf_put(mmu->dma_buf);
+ }
+#endif
+
+ /* Release all locked user space pages */
+ for (chunk = 0; chunk < mmu->nr_pmd_entries; chunk++) {
+ union mmu_table *pte_table = &mmu->pte_tables[chunk];
+ unsigned long nr_pages = nr_pages_left;
+
+ if (nr_pages > PTE_ENTRIES_MAX)
+ nr_pages = PTE_ENTRIES_MAX;
+
+ nr_pages_left -= nr_pages;
+
+ if (!pte_table->page)
+ break;
+
+ if (mmu->user && mmu->use_pages_and_vas) {
+ struct page **page = pte_table->pages;
+ int i;
+
+ for (i = 0; i < nr_pages; i++, page++)
+ put_page(*page);
+
+ mmu->pages_locked -= nr_pages;
+ } else if (mmu->user) {
+ u64 *pte64 = pte_table->entries;
+ pte_t pte;
+ int i;
+
+ for (i = 0; i < nr_pages; i++) {
+#if defined(CONFIG_ARM)
+ {
+ pte = *pte64++;
+ /* Unused entries are 0 */
+ if (!pte)
+ break;
+ }
+#else
+ {
+ pte.pte = *pte64++;
+ /* Unused entries are 0 */
+ if (!pte.pte)
+ break;
+ }
+#endif
+
+ /* pte_page() cannot return NULL */
+ put_page(pte_page(pte));
+ }
+
+ mmu->pages_locked -= nr_pages;
+ }
+
+ free_page(pte_table->page);
+ mmu->pages_created--;
+ }
+
+ if (mmu->pmd_table.page) {
+ free_page(mmu->pmd_table.page);
+ mmu->pages_created--;
+ }
+
+ if (mmu->pages_created || mmu->pages_locked)
+ mc_dev_err(-EUCLEAN,
+ "leak detected: still in use %d, still locked %d",
+ mmu->pages_created, mmu->pages_locked);
+
+ if (mmu->deleter)
+ mmu->deleter->delete(mmu->deleter->object);
+
+ kfree(mmu);
+
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_mmus);
+}
+
+static struct tee_mmu *tee_mmu_create_common(const struct mcp_buffer_map *b_map)
+{
+ struct tee_mmu *mmu;
+ int ret = -ENOMEM;
+
+ if (b_map->nr_pages > (PMD_ENTRIES_MAX * PTE_ENTRIES_MAX)) {
+ ret = -EINVAL;
+ mc_dev_err(ret, "data mapping exceeds %d pages: %lu",
+ PMD_ENTRIES_MAX * PTE_ENTRIES_MAX, b_map->nr_pages);
+ return ERR_PTR(ret);
+ }
+
+ /* Allocate the struct */
+ mmu = kzalloc(sizeof(*mmu), GFP_KERNEL);
+ if (!mmu)
+ return ERR_PTR(-ENOMEM);
+
+ /* Increment debug counter */
+ atomic_inc(&g_ctx.c_mmus);
+ kref_init(&mmu->kref);
+
+ /* The Xen front-end does not use PTEs */
+ if (is_xen_domu())
+ mmu->use_pages_and_vas = true;
+
+ /* Buffer info */
+ mmu->offset = b_map->offset;
+ mmu->length = b_map->length;
+ mmu->flags = b_map->flags;
+
+ /* Pages info */
+ mmu->nr_pages = b_map->nr_pages;
+ mmu->nr_pmd_entries = (mmu->nr_pages + PTE_ENTRIES_MAX - 1) /
+ PTE_ENTRIES_MAX;
+ mc_dev_devel("mmu->nr_pages %lu num_ptes_pages %zu",
+ mmu->nr_pages, mmu->nr_pmd_entries);
+
+ /* Allocate a page for the L1 table, always used for DomU */
+ mmu->pmd_table.page = get_zeroed_page(GFP_KERNEL);
+ if (!mmu->pmd_table.page)
+ goto end;
+
+ mmu->pages_created++;
+
+ return mmu;
+
+end:
+ tee_mmu_delete(mmu);
+ return ERR_PTR(ret);
+}
+
+static bool mmu_get_dma_buffer(struct tee_mmu *mmu, int va)
+{
+#ifdef CONFIG_DMA_SHARED_BUFFER
+ struct dma_buf *buf;
+
+ buf = dma_buf_get(va);
+ if (IS_ERR(buf))
+ return false;
+
+ mmu->dma_buf = buf;
+ mmu->attach = dma_buf_attach(mmu->dma_buf, g_ctx.mcd);
+ if (IS_ERR(mmu->attach))
+ goto err_attach;
+
+ mmu->sgt = dma_buf_map_attachment(mmu->attach, DMA_BIDIRECTIONAL);
+ if (IS_ERR(mmu->sgt))
+ goto err_map;
+
+ return true;
+
+err_map:
+ dma_buf_detach(mmu->dma_buf, mmu->attach);
+
+err_attach:
+ dma_buf_put(mmu->dma_buf);
+#endif
+ return false;
+}
+
+/*
+ * Allocate MMU table and map buffer into it.
+ * That is, create respective table entries.
+ */
+struct tee_mmu *tee_mmu_create(struct mm_struct *mm,
+ const struct mc_ioctl_buffer *buf)
+{
+ struct tee_mmu *mmu;
+ const void *data = (const void *)(uintptr_t)buf->va;
+ const void *reader = (const void *)((uintptr_t)data & PAGE_MASK);
+ struct page **pages; /* Same as below, conveniently typed */
+ unsigned long pages_page = 0; /* Page to contain the page pointers */
+ unsigned long chunk;
+ struct mcp_buffer_map b_map = {
+ .offset = (u32)(buf->va & ~PAGE_MASK),
+ .length = buf->len,
+ .flags = buf->flags,
+ };
+ bool writeable = buf->flags & MC_IO_MAP_OUTPUT;
+ int ret = 0;
+
+#ifndef CONFIG_DMA_SHARED_BUFFER
+ if (buf->flags & MMU_ION_BUF) {
+ mc_dev_err(-EINVAL, "ION buffers not supported by kernel");
+ return ERR_PTR(-EINVAL);
+ }
+#endif
+
+ /* Check input arguments */
+ if (!(buf->flags & MMU_ION_BUF) && !buf->va)
+ return ERR_PTR(-EINVAL);
+
+ if (buf->flags & MMU_ION_BUF)
+ /* buf->va is not a valid address. ION buffers are aligned */
+ b_map.offset = 0;
+
+ /* Allocate the struct */
+ b_map.nr_pages = PAGE_ALIGN(b_map.offset + b_map.length) / PAGE_SIZE;
+ /* Allow Registered Shared mem with valid pointer and zero size. */
+ if (!b_map.nr_pages)
+ b_map.nr_pages = 1;
+
+ mmu = tee_mmu_create_common(&b_map);
+ if (IS_ERR(mmu))
+ return mmu;
+
+ if (buf->flags & MMU_ION_BUF) {
+ mc_dev_devel("Buffer is ION");
+ /* Buffer is ION -
+ * va is the client's dma_buf fd, which should be converted
+ * to a struct sg_table * directly.
+ */
+ if (!mmu_get_dma_buffer(mmu, buf->va)) {
+ mc_dev_err(ret, "mmu_get_dma_buffer failed");
+ ret = -EINVAL;
+ goto end;
+ }
+ }
+ /* Get a page to store page pointers */
+ pages_page = get_zeroed_page(GFP_KERNEL);
+ if (!pages_page) {
+ ret = -ENOMEM;
+ goto end;
+ }
+ mmu->pages_created++;
+
+ pages = (struct page **)pages_page;
+ for (chunk = 0; chunk < mmu->nr_pmd_entries; chunk++) {
+ unsigned long nr_pages;
+ int i;
+
+ /* Size to map for this chunk */
+ if (chunk == (mmu->nr_pmd_entries - 1))
+ nr_pages = ((mmu->nr_pages - 1) % PTE_ENTRIES_MAX) + 1;
+ else
+ nr_pages = PTE_ENTRIES_MAX;
+
+ /* Allocate a page to hold ptes that describe buffer pages */
+ mmu->pte_tables[chunk].page = get_zeroed_page(GFP_KERNEL);
+ if (!mmu->pte_tables[chunk].page) {
+ ret = -ENOMEM;
+ goto end;
+ }
+ mmu->pages_created++;
+
+ /* Add page address to pmd table if needed */
+ if (mmu->use_pages_and_vas)
+ mmu->pmd_table.vas[chunk] =
+ mmu->pte_tables[chunk].page;
+ else
+ mmu->pmd_table.entries[chunk] =
+ virt_to_phys(mmu->pte_tables[chunk].addr);
+
+ /* Get pages */
+ if (mmu->dma_buf) {
+ /* Buffer is ION */
+ struct sg_mapping_iter miter;
+ struct page **page_ptr;
+
+ page_ptr = &pages[0];
+ sg_miter_start(&miter, mmu->sgt->sgl,
+ mmu->sgt->nents,
+ SG_MITER_FROM_SG);
+ while (sg_miter_next(&miter))
+ *page_ptr++ = miter.page;
+
+ sg_miter_stop(&miter);
+ } else if (mm) {
+ long gup_ret;
+
+ /* Buffer was allocated in user space */
+ down_read(&mm->mmap_sem);
+ /*
+ * Always try to map read/write from a Linux PoV, so
+ * Linux creates (page faults) the underlying pages if
+ * missing.
+ */
+ gup_ret = gup_local_repeat(mm, (uintptr_t)reader,
+ nr_pages, 1, pages);
+ if ((gup_ret == -EFAULT) && !writeable) {
+ /*
+ * If mapping read/write fails, and the buffer
+ * is to be shared as input only, try to map
+ * again read-only.
+ */
+ gup_ret = gup_local_repeat(mm,
+ (uintptr_t)reader,
+ nr_pages, 0, pages);
+ }
+ up_read(&mm->mmap_sem);
+ if (gup_ret < 0) {
+ ret = gup_ret;
+ mc_dev_err(ret, "failed to get user pages @%p",
+ reader);
+ goto end;
+ }
+
+ /* check if we could lock all pages. */
+ if (gup_ret != nr_pages) {
+ mc_dev_err((int)gup_ret,
+ "failed to get user pages");
+ release_pages(pages, gup_ret);
+ ret = -EINVAL;
+ goto end;
+ }
+
+ reader += nr_pages * PAGE_SIZE;
+ mmu->user = true;
+ mmu->pages_locked += nr_pages;
+ } else if (is_vmalloc_addr(data)) {
+ /* Buffer vmalloc'ed in kernel space */
+ for (i = 0; i < nr_pages; i++) {
+ struct page *page = vmalloc_to_page(reader);
+
+ if (!page) {
+ ret = -EINVAL;
+ mc_dev_err(ret,
+ "failed to map address");
+ goto end;
+ }
+
+ pages[i] = page;
+ reader += PAGE_SIZE;
+ }
+ } else {
+ /* Buffer kmalloc'ed in kernel space */
+ struct page *page = virt_to_page(reader);
+
+ reader += nr_pages * PAGE_SIZE;
+ for (i = 0; i < nr_pages; i++)
+ pages[i] = page++;
+ }
+
+ /* Create Table of physical addresses*/
+ if (mmu->use_pages_and_vas) {
+ memcpy(mmu->pte_tables[chunk].pages, pages,
+ nr_pages * sizeof(*pages));
+ } else {
+ for (i = 0; i < nr_pages; i++) {
+ mmu->pte_tables[chunk].entries[i] =
+ page_to_phys(pages[i]);
+ }
+ }
+ }
+
+end:
+ if (pages_page) {
+ free_page(pages_page);
+ mmu->pages_created--;
+ }
+
+ if (ret) {
+ tee_mmu_delete(mmu);
+ return ERR_PTR(ret);
+ }
+
+ mc_dev_devel(
+ "created mmu %p: %s va %llx len %u off %u flg %x pmd table %lx",
+ mmu, mmu->user ? "user" : "kernel", buf->va, mmu->length,
+ mmu->offset, mmu->flags, mmu->pmd_table.page);
+ return mmu;
+}
+
+struct tee_mmu *tee_mmu_wrap(struct tee_deleter *deleter, struct page **pages,
+ const struct mcp_buffer_map *b_map)
+{
+ int ret = -EINVAL;
+#ifdef CONFIG_XEN
+ struct tee_mmu *mmu;
+ unsigned long chunk, nr_pages_left;
+
+ /* Allocate the struct */
+ mmu = tee_mmu_create_common(b_map);
+ if (IS_ERR(mmu))
+ return mmu;
+
+ nr_pages_left = mmu->nr_pages;
+ for (chunk = 0; chunk < mmu->nr_pmd_entries; chunk++) {
+ unsigned long nr_pages = nr_pages_left;
+ u64 *pte;
+ int i;
+
+ if (nr_pages > PTE_ENTRIES_MAX)
+ nr_pages = PTE_ENTRIES_MAX;
+
+ nr_pages_left -= nr_pages;
+
+ /* Allocate a page to hold ptes that describe buffer pages */
+ mmu->pte_tables[chunk].page = get_zeroed_page(GFP_KERNEL);
+ if (!mmu->pte_tables[chunk].page) {
+ ret = -ENOMEM;
+ goto err;
+ }
+ mmu->pages_created++;
+
+ /* Add page address to pmd table if needed */
+ mmu->pmd_table.entries[chunk] =
+ virt_to_phys(mmu->pte_tables[chunk].addr);
+
+ /* Convert to PTEs */
+ pte = &mmu->pte_tables[chunk].entries[0];
+
+ for (i = 0; i < nr_pages; i++, pages++, pte++) {
+ unsigned long phys;
+ unsigned long pfn;
+
+ phys = page_to_phys(*pages);
+#if defined CONFIG_ARM64
+ phys &= PHYS_48BIT_MASK;
+#endif
+ pfn = PFN_DOWN(phys);
+ *pte = __pfn_to_mfn(pfn) << PAGE_SHIFT;
+ }
+ }
+
+ mmu->deleter = deleter;
+ mc_dev_devel("wrapped mmu %p: len %u off %u flg %x pmd table %lx",
+ mmu, mmu->length, mmu->offset, mmu->flags,
+ mmu->pmd_table.page);
+ return mmu;
+
+err:
+ tee_mmu_delete(mmu);
+#endif
+ return ERR_PTR(ret);
+}
+
+void tee_mmu_set_deleter(struct tee_mmu *mmu, struct tee_deleter *deleter)
+{
+ mmu->deleter = deleter;
+}
+
+static void tee_mmu_release(struct kref *kref)
+{
+ struct tee_mmu *mmu = container_of(kref, struct tee_mmu, kref);
+
+ mc_dev_devel("free mmu %p: %s len %u off %u pmd table %lx",
+ mmu, mmu->user ? "user" : "kernel", mmu->length,
+ mmu->offset, mmu->pmd_table.page);
+ tee_mmu_delete(mmu);
+}
+
+void tee_mmu_get(struct tee_mmu *mmu)
+{
+ kref_get(&mmu->kref);
+}
+
+void tee_mmu_put(struct tee_mmu *mmu)
+{
+ kref_put(&mmu->kref, tee_mmu_release);
+}
+
+void tee_mmu_buffer(struct tee_mmu *mmu, struct mcp_buffer_map *map)
+{
+ if (mmu->use_pages_and_vas)
+ map->addr = mmu->pmd_table.page;
+ else
+ map->addr = virt_to_phys(mmu->pmd_table.addr);
+
+ map->secure_va = 0;
+ map->offset = mmu->offset;
+ map->length = mmu->length;
+ map->nr_pages = mmu->nr_pages;
+ map->flags = mmu->flags;
+ map->type = WSM_L1;
+#ifdef CONFIG_DMA_SHARED_BUFFER
+ if (mmu->dma_buf) {
+ /* ION */
+ if (!(((struct ion_buffer *)mmu->dma_buf->priv)->flags
+ & ION_FLAG_CACHED)) {
+ map->type |= WSM_UNCACHED;
+ mc_dev_devel("ION buffer Non cacheable");
+ } else {
+ mc_dev_devel("ION buffer cacheable");
+ }
+ }
+#endif
+ map->mmu = mmu;
+}
+
+int tee_mmu_debug_structs(struct kasnprintf_buf *buf, const struct tee_mmu *mmu)
+{
+ return kasnprintf(buf,
+ "\t\t\tmmu %pK: %s len %u off %u table %pK\n",
+ mmu, mmu->user ? "user" : "kernel", mmu->length,
+ mmu->offset, (void *)mmu->pmd_table.page);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mmu.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mmu.h
new file mode 100644
index 0000000..a5b001f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/mmu.h
@@ -0,0 +1,72 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _TBASE_MEM_H_
+#define _TBASE_MEM_H_
+
+/*
+ * This represents the maximum number of entries in a Page Table Entries
+ * array which maps one 4KiB page. Each entry is 64 bits long physical
+ * address with some possible flags. With 512 entries it is possible
+ * to map 2MiB memory block.
+ */
+#define PTE_ENTRIES_MAX 512
+
+/*
+ * This represents the maximum number of entries in a Page Middle Directory
+ * which maps one 4KiB page. Each entry is a 64 bits physical address that
+ * points to a PTE. With 512 entries t is possible to map 1GB memory block.
+ */
+#define PMD_ENTRIES_MAX 512
+
+struct tee_mmu;
+struct mcp_buffer_map;
+
+struct tee_deleter {
+ void *object;
+ void (*delete)(void *object);
+};
+
+/*
+ * Allocate MMU table and map buffer into it.
+ * That is, create respective table entries.
+ */
+struct tee_mmu *tee_mmu_create(struct mm_struct *mm,
+ const struct mc_ioctl_buffer *buf);
+
+/*
+ * Allocate MMU table and map pages into it.
+ * This is for Xen Dom0 to re-create a buffer with existing pages.
+ */
+struct tee_mmu *tee_mmu_wrap(struct tee_deleter *deleter, struct page **pages,
+ const struct mcp_buffer_map *buf);
+
+/*
+ * Give the MMU an object to release when released
+ */
+void tee_mmu_set_deleter(struct tee_mmu *mmu, struct tee_deleter *deleter);
+
+/*
+ * Gets a reference on a MMU table.
+ */
+void tee_mmu_get(struct tee_mmu *mmu);
+
+/*
+ * Puts a reference on a MMU table.
+ */
+void tee_mmu_put(struct tee_mmu *mmu);
+
+/*
+ * Fill in buffer info for MMU table.
+ */
+void tee_mmu_buffer(struct tee_mmu *mmu, struct mcp_buffer_map *map);
+
+/*
+ * Add info to debug buffer.
+ */
+int tee_mmu_debug_structs(struct kasnprintf_buf *buf,
+ const struct tee_mmu *mmu);
+
+#endif /* _TBASE_MEM_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/nq.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/nq.c
new file mode 100644
index 0000000..0dc493d
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/nq.c
@@ -0,0 +1,1123 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/debugfs.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/kthread.h>
+#include <linux/of_irq.h>
+#include <linux/uaccess.h>
+#include <linux/version.h>
+#include <linux/sched.h>
+#include <linux/sched/clock.h> /* local_clock */
+
+#include "platform.h" /* CPU-related information */
+
+#include "public/mc_user.h"
+
+#include "mci/mcifc.h"
+#include "mci/mciiwp.h"
+#include "mci/mcimcp.h"
+#include "mci/mcinq.h"
+#include "mci/mcitime.h" /* struct mcp_time */
+
+#include "main.h"
+#include "clock.h"
+#include "fastcall.h"
+#include "logging.h"
+#include "nq.h"
+
+#define NQ_NUM_ELEMS 64
+#define SCHEDULING_FREQ 5 /**< N-SIQ every n-th time */
+#define DEFAULT_TIMEOUT_MS 20000 /* We do nothing on timeout anyway */
+
+static struct {
+ struct mutex buffer_mutex; /* Lock on SWd communication buffer */
+ struct mcp_buffer *mcp_buffer;
+ struct interworld_session *iwp_buffer;
+ struct task_struct *irq_bh_thread;
+ struct completion irq_bh_complete;
+ bool irq_bh_thread_run;
+ int irq;
+ struct blocking_notifier_head tee_stop_notifiers;
+ void (*mcp_notif_handler)(u32 id, u32 payload);
+ void (*iwp_notif_handler)(u32 id, u32 payload);
+ /* MobiCore MCI information */
+ unsigned int order;
+ union {
+ void *mci;
+ struct {
+ struct notification_queue *tx;
+ struct notification_queue *rx;
+ } nq;
+ };
+ /*
+ * This notifications list is to be used to queue notifications when the
+ * notification queue overflows, so no session gets its notification
+ * lost, especially MCP.
+ */
+ struct mutex notifications_mutex;
+ struct list_head notifications;
+ /* Dump buffer */
+ char *tee_version;
+ struct kasnprintf_buf dump;
+ /* Time */
+ struct mcp_time *time;
+
+ /* Scheduler */
+ struct task_struct *tee_scheduler_thread;
+ bool tee_scheduler_run;
+ bool tee_hung;
+ int boot_ret;
+ struct completion boot_complete; /* Signal end of boot */
+ struct completion idle_complete; /* Unblock scheduler thread */
+ struct completion sleep_complete; /* Wait for sleep status */
+ struct mutex sleep_mutex; /* Protect sleep request */
+ struct mutex request_mutex; /* Protect all below */
+ /* The order of this enum matters */
+ enum sched_command {
+ NONE, /* No specific request */
+ YIELD, /* Run the SWd */
+ NSIQ, /* Schedule the SWd */
+ SUSPEND, /* Suspend the SWd */
+ RESUME, /* Resume the SWd */
+ } request;
+ bool suspended;
+
+ /* Logging */
+ phys_addr_t log_buffer;
+ u32 log_buffer_size;
+ bool log_buffer_busy;
+} l_ctx;
+
+static inline bool is_iwp_id(u32 id)
+{
+ return (id & SID_IWP_NOTIFICATION) != 0;
+}
+
+static inline void session_state_update_internal(struct nq_session *session,
+ enum nq_notif_state state)
+{
+ mutex_lock(&session->mutex);
+ session->state = state;
+ session->cpu_clk = local_clock();
+ mutex_unlock(&session->mutex);
+}
+
+/*
+ * Notification Queue overflow management:
+ * - once the SWd NQ is full, sessions get added to the overflow queue:
+ * 'l_ctx.notifications'
+ * - as long as this queue is not empty, new notifications get added there
+ * first, if not already present, then the queue is flushed
+ * - the queue is also flushed by the scheduler once the SWd has run
+ */
+static inline bool notif_queue_full(void)
+{
+ struct notification_queue *tx = l_ctx.nq.tx;
+
+ return (tx->hdr.write_cnt - tx->hdr.read_cnt) == tx->hdr.queue_size;
+}
+
+static inline void notif_queue_push(u32 session_id, u32 payload)
+{
+ struct notification_queue_header *hdr = &l_ctx.nq.tx->hdr;
+ u32 i = hdr->write_cnt % hdr->queue_size;
+
+ l_ctx.nq.tx->notification[i].session_id = session_id;
+ l_ctx.nq.tx->notification[i].payload = payload;
+ /*
+ * Ensure notification[] is written before we update the counter
+ * We want a ARM dmb() / ARM64 dmb(sy) here
+ */
+ smp_mb();
+
+ hdr->write_cnt++;
+ /*
+ * Ensure write_cnt is written before new notification
+ * We want a ARM dsb() / ARM64 dsb(sy) here
+ */
+ rmb();
+}
+
+static void retrieve_last_session_payload(u32 *session_id, u32 *payload)
+{
+ struct notification_queue_header *hdr = &l_ctx.nq.tx->hdr;
+ u32 i = (hdr->write_cnt - 1) % hdr->queue_size;
+
+ *session_id = l_ctx.nq.tx->notification[i].session_id;
+ *payload = l_ctx.nq.tx->notification[i].payload;
+}
+
+/* Must be called with l_ctx.notifications_mutex taken */
+static inline bool nq_notifications_flush(void)
+{
+ bool flushed = false;
+
+ while (!list_empty(&l_ctx.notifications) && !notif_queue_full()) {
+ struct nq_session *session;
+
+ session = list_first_entry(&l_ctx.notifications,
+ struct nq_session, list);
+ mc_dev_devel("pop %x", session->id);
+ notif_queue_push(session->id, session->payload);
+ session_state_update_internal(session, NQ_NOTIF_SENT);
+ list_del_init(&session->list);
+ flushed = true;
+ }
+
+ return flushed;
+}
+
+static int nq_scheduler_command(enum sched_command command)
+{
+ if (IS_ERR_OR_NULL(l_ctx.tee_scheduler_thread))
+ return -EFAULT;
+
+ mutex_lock(&l_ctx.request_mutex);
+ if (l_ctx.request < command) {
+ l_ctx.request = command;
+ complete(&l_ctx.idle_complete);
+ }
+
+ mutex_unlock(&l_ctx.request_mutex);
+ return 0;
+}
+
+static inline void nq_update_time(void)
+{
+ struct timespec tm;
+
+ getnstimeofday(&tm);
+ l_ctx.time->wall_clock_seconds = tm.tv_sec;
+ l_ctx.time->wall_clock_nsec = tm.tv_nsec;
+ getrawmonotonic(&tm);
+ l_ctx.time->monotonic_seconds = tm.tv_sec;
+ l_ctx.time->monotonic_nsec = tm.tv_nsec;
+}
+
+static inline void nq_notif_handler(u32 id, u32 payload)
+{
+ mc_dev_devel("NQ notif for id %x payload %x", id, payload);
+ if (is_iwp_id(id))
+ l_ctx.iwp_notif_handler(id, payload);
+ else
+ l_ctx.mcp_notif_handler(id, payload);
+}
+
+static int irq_bh_worker(void *arg)
+{
+ struct notification_queue *rx = l_ctx.nq.rx;
+
+ while (1) {
+ wait_for_completion_killable(&l_ctx.irq_bh_complete);
+
+ /* This thread can only be stopped with nq_stop */
+ if (!l_ctx.irq_bh_thread_run)
+ break;
+
+ /* Deal with all pending notifications in one go */
+ while ((rx->hdr.write_cnt - rx->hdr.read_cnt) > 0) {
+ struct notification nf;
+
+ nf = rx->notification[
+ rx->hdr.read_cnt % rx->hdr.queue_size];
+
+ /*
+ * Ensure read_cnt writing happens after buffer read
+ * We want a ARM dmb() / ARM64 dmb(sy) here
+ */
+ smp_mb();
+ rx->hdr.read_cnt++;
+ /*
+ * Ensure read_cnt writing finishes before reader
+ * We want a ARM dsb() / ARM64 dsb(sy) here
+ */
+ rmb();
+ nq_notif_handler(nf.session_id, nf.payload);
+ }
+
+ /*
+ * Finished processing notifications. It does not matter whether
+ * there actually were any notification or not. S-SIQs can also
+ * be triggered by an SWd driver which was waiting for a FIQ.
+ * In this case the S-SIQ tells NWd that SWd is no longer idle
+ * an will need scheduling again.
+ */
+ nq_scheduler_command(NSIQ);
+ }
+ return 0;
+}
+
+static irqreturn_t irq_handler(int intr, void *arg)
+{
+ /* wake up thread to continue handling this interrupt */
+ complete(&l_ctx.irq_bh_complete);
+ return IRQ_HANDLED;
+}
+
+void nq_session_init(struct nq_session *session, bool is_gp)
+{
+ session->id = SID_INVALID;
+ session->payload = 0;
+ INIT_LIST_HEAD(&session->list);
+ mutex_init(&session->mutex);
+ session->state = NQ_NOTIF_IDLE;
+ session->cpu_clk = 0;
+ session->is_gp = is_gp;
+}
+
+void nq_session_exit(struct nq_session *session)
+{
+ mutex_lock(&l_ctx.notifications_mutex);
+ if (!list_empty(&session->list))
+ list_del(&session->list);
+ mutex_unlock(&l_ctx.notifications_mutex);
+}
+
+void nq_session_state_update(struct nq_session *session,
+ enum nq_notif_state state)
+{
+ if (state < NQ_NOTIF_RECEIVED)
+ return;
+
+ session_state_update_internal(session, state);
+}
+
+int nq_session_notify(struct nq_session *session, u32 id, u32 payload)
+{
+ int ret = 0;
+
+ mutex_lock(&l_ctx.notifications_mutex);
+ session->id = id;
+ session->payload = payload;
+ if (!list_empty(&l_ctx.notifications) || notif_queue_full()) {
+ if (!list_empty(&session->list)) {
+ ret = -EAGAIN;
+ if (payload != session->payload) {
+ mc_dev_err(ret,
+ "skip %x payload change %x -> %x",
+ session->id, session->payload,
+ payload);
+ } else {
+ mc_dev_devel("skip %x payload %x",
+ session->id, payload);
+ }
+ } else {
+ mc_dev_devel("push %x payload %x", session->id,
+ payload);
+ /* session->payload = payload; */
+ list_add_tail(&session->list, &l_ctx.notifications);
+ session_state_update_internal(session, NQ_NOTIF_QUEUED);
+ }
+
+ nq_notifications_flush();
+
+ if (nq_scheduler_command(YIELD))
+ ret = -EPROTO;
+ } else {
+ mc_dev_devel("send %x payload %x", session->id, payload);
+ notif_queue_push(session->id, payload);
+ session_state_update_internal(session, NQ_NOTIF_SENT);
+ if (nq_scheduler_command(NSIQ))
+ ret = -EPROTO;
+ }
+
+ mutex_unlock(&l_ctx.notifications_mutex);
+ return ret;
+}
+
+const char *nq_session_state(const struct nq_session *session, u64 *cpu_clk)
+{
+ if (cpu_clk)
+ *cpu_clk = session->cpu_clk;
+
+ switch (session->state) {
+ case NQ_NOTIF_IDLE:
+ return "idle";
+ case NQ_NOTIF_QUEUED:
+ return "queued";
+ case NQ_NOTIF_SENT:
+ return "sent";
+ case NQ_NOTIF_RECEIVED:
+ return "received";
+ case NQ_NOTIF_CONSUMED:
+ return "consumed";
+ case NQ_NOTIF_DEAD:
+ return "dead";
+ }
+ return "error";
+}
+
+static ssize_t debug_crashdump_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ if (l_ctx.dump.off)
+ return simple_read_from_buffer(user_buf, count, ppos,
+ l_ctx.dump.buf, l_ctx.dump.off);
+
+ return 0;
+}
+
+static const struct file_operations debug_crashdump_ops = {
+ .read = debug_crashdump_read,
+ .llseek = default_llseek,
+};
+
+static ssize_t debug_smclog_read(struct file *file, char __user *user_buf,
+ size_t count, loff_t *ppos)
+{
+ return debug_generic_read(file, user_buf, count, ppos,
+ mc_fastcall_debug_smclog);
+}
+
+static const struct file_operations debug_smclog_ops = {
+ .read = debug_smclog_read,
+ .llseek = default_llseek,
+ .open = debug_generic_open,
+ .release = debug_generic_release,
+};
+
+static void nq_dump_status(void)
+{
+ static const struct {
+ unsigned int index;
+ const char *msg;
+ } status_map[] = {
+ /**< MobiCore control flags */
+ { MC_EXT_INFO_ID_FLAGS, "flags"},
+ /**< MobiCore halt condition code */
+ { MC_EXT_INFO_ID_HALT_CODE, "haltCode"},
+ /**< MobiCore halt condition instruction pointer */
+ { MC_EXT_INFO_ID_HALT_IP, "haltIp"},
+ /**< MobiCore fault counter */
+ { MC_EXT_INFO_ID_FAULT_CNT, "faultRec.cnt"},
+ /**< MobiCore last fault cause */
+ { MC_EXT_INFO_ID_FAULT_CAUSE, "faultRec.cause"},
+ /**< MobiCore last fault meta */
+ { MC_EXT_INFO_ID_FAULT_META, "faultRec.meta"},
+ /**< MobiCore last fault threadid */
+ { MC_EXT_INFO_ID_FAULT_THREAD, "faultRec.thread"},
+ /**< MobiCore last fault instruction pointer */
+ { MC_EXT_INFO_ID_FAULT_IP, "faultRec.ip"},
+ /**< MobiCore last fault stack pointer */
+ { MC_EXT_INFO_ID_FAULT_SP, "faultRec.sp"},
+ /**< MobiCore last fault ARM arch information */
+ { MC_EXT_INFO_ID_FAULT_ARCH_DFSR, "faultRec.arch.dfsr"},
+ /**< MobiCore last fault ARM arch information */
+ { MC_EXT_INFO_ID_FAULT_ARCH_ADFSR, "faultRec.arch.adfsr"},
+ /**< MobiCore last fault ARM arch information */
+ { MC_EXT_INFO_ID_FAULT_ARCH_DFAR, "faultRec.arch.dfar"},
+ /**< MobiCore last fault ARM arch information */
+ { MC_EXT_INFO_ID_FAULT_ARCH_IFSR, "faultRec.arch.ifsr"},
+ /**< MobiCore last fault ARM arch information */
+ { MC_EXT_INFO_ID_FAULT_ARCH_AIFSR, "faultRec.arch.aifsr"},
+ /**< MobiCore last fault ARM arch information */
+ { MC_EXT_INFO_ID_FAULT_ARCH_IFAR, "faultRec.arch.ifar"},
+ /**< MobiCore configured by Daemon via fc_init flag */
+ { MC_EXT_INFO_ID_MC_CONFIGURED, "mcData.flags"},
+ /**< MobiCore exception handler last partner */
+ { MC_EXT_INFO_ID_MC_EXC_PARTNER, "mcExcep.partner"},
+ /**< MobiCore exception handler last peer */
+ { MC_EXT_INFO_ID_MC_EXC_IPCPEER, "mcExcep.peer"},
+ /**< MobiCore exception handler last IPC message */
+ { MC_EXT_INFO_ID_MC_EXC_IPCMSG, "mcExcep.cause"},
+ /**< MobiCore exception handler last IPC data */
+ {MC_EXT_INFO_ID_MC_EXC_IPCDATA, "mcExcep.meta"},
+ /**< MobiCore last crashing task offset */
+ {MC_EXT_INFO_ID_TASK_OFFSET,
+ "faultRec.offset.task"},
+ /**< MobiCore last crashing task's mcLib offset */
+ {MC_EXT_INFO_ID_MCLIB_OFFSET,
+ "faultRec.offset.mclib"},
+ };
+
+ char uuid_str[33];
+ int ret = 0;
+ size_t i;
+
+ if (l_ctx.dump.off)
+ ret = -EBUSY;
+
+ mc_dev_info("TEE HALTED");
+ if (l_ctx.tee_version) {
+ mc_dev_info("TEE version: %s", l_ctx.tee_version);
+ if (ret >= 0)
+ ret = kasnprintf(&l_ctx.dump, "TEE version: %s\n",
+ l_ctx.tee_version);
+ }
+
+ mc_dev_info("Status dump:");
+ for (i = 0; i < (size_t)ARRAY_SIZE(status_map); i++) {
+ u32 info;
+
+ if (fc_info(status_map[i].index, NULL, &info))
+ return;
+
+ mc_dev_info(" %-22s= 0x%08x", status_map[i].msg, info);
+ if (ret >= 0)
+ ret = kasnprintf(&l_ctx.dump, "%-22s= 0x%08x\n",
+ status_map[i].msg, info);
+ }
+
+ /* construct UUID string */
+ for (i = 0; i < 4; i++) {
+ u32 info;
+ size_t j;
+
+ if (fc_info(MC_EXT_INFO_ID_MC_EXC_UUID + i, NULL, &info))
+ return;
+
+ for (j = 0; j < sizeof(info); j++) {
+ snprintf(&uuid_str[(i * sizeof(info) + j) * 2], 3,
+ "%02x", (info >> (j * 8)) & 0xff);
+ }
+ }
+
+ mc_dev_info(" %-22s= 0x%s", "mcExcep.uuid", uuid_str);
+ if (ret >= 0)
+ ret = kasnprintf(&l_ctx.dump, "%-22s= 0x%s\n", "mcExcep.uuid",
+ uuid_str);
+
+ if (ret < 0) {
+ kfree(l_ctx.dump.buf);
+ l_ctx.dump.off = 0;
+ return;
+ }
+
+ debugfs_create_file("crashdump", 0400, g_ctx.debug_dir, NULL,
+ &debug_crashdump_ops);
+ debugfs_create_file("last_smc_commands", 0400, g_ctx.debug_dir, NULL,
+ &debug_smclog_ops);
+}
+
+static void nq_handle_tee_crash(void)
+{
+ /*
+ * Do not change the call order: the debugfs nq status file needs
+ * to be created before requesting the Daemon to read it.
+ */
+ nq_dump_status();
+ blocking_notifier_call_chain(&l_ctx.tee_stop_notifiers, 0, NULL);
+}
+
+static inline void set_sleep_mode_rq(u16 sleep_req)
+{
+ mutex_lock(&l_ctx.buffer_mutex);
+ l_ctx.mcp_buffer->flags.sleep_mode.sleep_req = sleep_req;
+ mutex_unlock(&l_ctx.buffer_mutex);
+}
+
+static inline bool nq_suspended(void)
+{
+ struct mcp_flags *flags = &l_ctx.mcp_buffer->flags;
+ bool ret;
+
+ mutex_lock(&l_ctx.buffer_mutex);
+ ret = flags->sleep_mode.ready_to_sleep & MC_STATE_READY_TO_SLEEP;
+ if (!ret) {
+ mc_dev_devel("IDLE=%d", flags->schedule);
+ mc_dev_devel("Request Sleep=%d", flags->sleep_mode.sleep_req);
+ mc_dev_devel("Sleep Ready=%d",
+ flags->sleep_mode.ready_to_sleep);
+ }
+
+ mutex_unlock(&l_ctx.buffer_mutex);
+ return ret;
+}
+
+/*
+ * Get the requested SWd sleep timeout value (ms)
+ * - if the timeout is -1, wait indefinitely
+ * - if the timeout is 0, re-schedule immediately (timeouts in µs in the SWd)
+ * - otherwise sleep for the required time
+ * returns true if sleep is required, false otherwise
+ */
+static inline bool nq_get_idle_timeout(s32 *timeout)
+{
+ u32 schedule;
+ bool ret;
+
+ mutex_lock(&l_ctx.buffer_mutex);
+ schedule = l_ctx.mcp_buffer->flags.schedule;
+ if (schedule == MC_FLAG_SCHEDULE_IDLE) {
+ *timeout = l_ctx.mcp_buffer->flags.timeout_ms;
+ ret = true;
+ } else {
+ ret = false;
+ }
+
+ mutex_unlock(&l_ctx.buffer_mutex);
+ return ret;
+}
+
+union mcp_message *nq_get_mcp_buffer(void)
+{
+ return &l_ctx.mcp_buffer->message;
+}
+
+struct interworld_session *nq_get_iwp_buffer(void)
+{
+ return l_ctx.iwp_buffer;
+}
+
+void nq_set_version_ptr(char *version)
+{
+ l_ctx.tee_version = version;
+}
+
+void nq_register_notif_handler(void (*handler)(u32 id, u32 payload), bool iwp)
+{
+ if (iwp)
+ l_ctx.iwp_notif_handler = handler;
+ else
+ l_ctx.mcp_notif_handler = handler;
+}
+
+int nq_register_tee_stop_notifier(struct notifier_block *nb)
+{
+ return blocking_notifier_chain_register(&l_ctx.tee_stop_notifiers, nb);
+}
+
+int nq_unregister_tee_stop_notifier(struct notifier_block *nb)
+{
+ return blocking_notifier_chain_unregister(&l_ctx.tee_stop_notifiers,
+ nb);
+}
+
+ssize_t nq_get_stop_message(char __user *buffer, size_t size)
+{
+ size_t max_len = l_ctx.dump.size - l_ctx.dump.off;
+ char *buf = l_ctx.dump.buf;
+ int ret;
+
+ if (!l_ctx.dump.off || !max_len)
+ return 0;
+
+ if (size > max_len)
+ size = max_len;
+
+ ret = copy_to_user(buffer, buf, size);
+ if (ret)
+ return -EFAULT;
+
+ return size;
+}
+
+void nq_signal_tee_hung(void)
+{
+ mc_dev_devel("force stop the notification queue");
+ /* Stop the tee_scheduler thread */
+ l_ctx.tee_hung = true;
+ l_ctx.tee_scheduler_run = false;
+ complete(&l_ctx.idle_complete);
+ nq_scheduler_command(NONE);
+}
+
+static int nq_scheduler_pm_command(enum sched_command command)
+{
+ int ret = -EPERM;
+
+ if (IS_ERR_OR_NULL(l_ctx.tee_scheduler_thread))
+ return -EFAULT;
+
+ mutex_lock(&l_ctx.sleep_mutex);
+
+ /* Send request */
+ nq_scheduler_command(command);
+
+ /* Wait for scheduler to reply */
+ wait_for_completion(&l_ctx.sleep_complete);
+ mutex_lock(&l_ctx.request_mutex);
+ if (command == SUSPEND) {
+ if (l_ctx.suspended)
+ ret = 0;
+ } else {
+ if (!l_ctx.suspended)
+ ret = 0;
+ }
+
+ mutex_unlock(&l_ctx.request_mutex);
+ mutex_unlock(&l_ctx.sleep_mutex);
+ return ret;
+}
+
+static int nq_boot_tee(void)
+{
+ size_t q_len = ALIGN(2 * (sizeof(struct notification_queue_header) +
+ NQ_NUM_ELEMS * sizeof(struct notification)), 4);
+ struct irq_data *irq_d = irq_get_irq_data(l_ctx.irq);
+ int ret;
+
+ /* Call the INIT fastcall to setup shared buffers */
+ ret = fc_init(virt_to_phys(l_ctx.mci),
+ (uintptr_t)l_ctx.mcp_buffer - (uintptr_t)l_ctx.mci, q_len,
+ sizeof(*l_ctx.mcp_buffer));
+ logging_run();
+ if (ret)
+ return ret;
+
+ /* Set initialization values */
+#if defined(MC_INTR_SSIQ_SWD)
+ l_ctx.mcp_buffer->message.init_values.flags |= MC_IV_FLAG_IRQ;
+ l_ctx.mcp_buffer->message.init_values.irq = MC_INTR_SSIQ_SWD;
+#endif
+ l_ctx.mcp_buffer->message.init_values.flags |= MC_IV_FLAG_TIME;
+ if (irq_d) {
+#ifdef CONFIG_ARCH_MEDIATEK
+ if (irq_d->parent_data) {
+ l_ctx.mcp_buffer->message.init_values.flags |=
+ MC_IV_FLAG_IRQ;
+ l_ctx.mcp_buffer->message.init_values.irq =
+ irq_d->parent_data->hwirq;
+ mc_dev_info("irq_d->parent_data->hwirq is 0x%lx\n",
+ irq_d->parent_data->hwirq);
+ }
+#else
+ l_ctx.mcp_buffer->message.init_values.flags |= MC_IV_FLAG_IRQ;
+ l_ctx.mcp_buffer->message.init_values.irq = irq_d->hwirq;
+ mc_dev_info("irq_d->hwirq is 0x%lx\n", irq_d->hwirq);
+#endif
+ }
+ l_ctx.mcp_buffer->message.init_values.time_ofs =
+ (u32)((uintptr_t)l_ctx.time - (uintptr_t)l_ctx.mci);
+ l_ctx.mcp_buffer->message.init_values.time_len =
+ sizeof(*l_ctx.time);
+
+ l_ctx.mcp_buffer->message.init_values.flags |= MC_IV_FLAG_IWP;
+ l_ctx.mcp_buffer->message.init_values.iws_buf_ofs =
+ (u64)((uintptr_t)l_ctx.iwp_buffer - (uintptr_t)l_ctx.mci);
+ l_ctx.mcp_buffer->message.init_values.iws_buf_size =
+ MAX_IW_SESSION * sizeof(struct interworld_session);
+
+ /* First empty N-SIQ to setup of the MCI structure */
+ ret = fc_nsiq(0, 0);
+ logging_run();
+ if (ret)
+ return ret;
+
+ /*
+ * Wait until the TEE state switches to MC_STATUS_INITIALIZED
+ * It is assumed that it always switches state at some point
+ */
+ do {
+ u32 status = 0;
+ u32 timeslice;
+
+ ret = fc_info(MC_EXT_INFO_ID_MCI_VERSION, &status, NULL);
+ logging_run();
+ if (ret)
+ return ret;
+
+ switch (status) {
+ case MC_STATUS_NOT_INITIALIZED:
+ /* Switch to the TEE to give it more CPU time. */
+ ret = EAGAIN;
+ for (timeslice = 0; timeslice < 10; timeslice++) {
+ int tmp_ret = fc_yield(timeslice);
+
+ logging_run();
+ if (tmp_ret)
+ return tmp_ret;
+ }
+
+ /* No need to loop like mad */
+ if (ret == EAGAIN)
+ usleep_range(100, 500);
+
+ break;
+ case MC_STATUS_HALT:
+ ret = -ENODEV;
+ nq_handle_tee_crash();
+ mc_dev_err(ret, "halt during init, state 0x%x", status);
+ return ret;
+ case MC_STATUS_INITIALIZED:
+ mc_dev_devel("ready");
+ break;
+ default:
+ /* MC_STATUS_BAD_INIT or anything else */
+ ret = -EIO;
+ mc_dev_err(ret, "MCI init failed, state 0x%x", status);
+ return ret;
+ }
+ } while (ret == EAGAIN);
+
+ return ret;
+}
+
+static inline bool tee_sleep(s32 timeout_ms)
+{
+ bool infinite_timeout = timeout_ms < 0;
+
+ /* TEE is going to sleep */
+ mc_clock_disable();
+ do {
+ s32 local_timeout_ms;
+ unsigned long jiffies;
+
+ if (infinite_timeout) {
+ local_timeout_ms = DEFAULT_TIMEOUT_MS;
+ } else {
+ local_timeout_ms = timeout_ms;
+ if (local_timeout_ms > DEFAULT_TIMEOUT_MS)
+ local_timeout_ms = DEFAULT_TIMEOUT_MS;
+ }
+
+ jiffies = msecs_to_jiffies(local_timeout_ms);
+ if (wait_for_completion_timeout(&l_ctx.idle_complete, jiffies))
+ break;
+
+ if (!infinite_timeout)
+ timeout_ms -= local_timeout_ms;
+ } while (timeout_ms);
+
+ /* TEE is getting back to work */
+ mc_clock_enable();
+ return timeout_ms == 0;
+}
+
+/*
+ * This thread, and only this thread, schedules the SWd. Hence, reading the idle
+ * status and its associated timeout is safe from race conditions.
+ */
+static int tee_scheduler(void *arg)
+{
+ bool swd_notify = false;
+ int ret = 0;
+
+ /* Enable TEE clock */
+ mc_clock_enable();
+
+ /* Logging */
+ if (l_ctx.log_buffer_size) {
+ ret = fc_trace_init(l_ctx.log_buffer, l_ctx.log_buffer_size);
+ if (!ret) {
+ logging_run();
+ l_ctx.log_buffer_busy = true;
+ mc_dev_info("registered log buffer of size %d",
+ l_ctx.log_buffer_size);
+ } else {
+ mc_dev_err(ret, "failed to register log buffer");
+ /* Ignore error */
+ ret = 0;
+ }
+ } else {
+ mc_dev_info("no log buffer to register");
+ }
+
+ /* Bootup */
+ l_ctx.boot_ret = nq_boot_tee();
+ complete(&l_ctx.boot_complete);
+ if (l_ctx.boot_ret) {
+ mc_clock_disable();
+ return l_ctx.boot_ret;
+ }
+
+ /* Run */
+ while (1) {
+ s32 timeout_ms = -1;
+ bool pm_request = false;
+ u8 tee_flags;
+
+ if (l_ctx.suspended || nq_get_idle_timeout(&timeout_ms)) {
+ /* If timeout is 0 we keep scheduling the SWd */
+ if (!timeout_ms)
+ nq_scheduler_command(NSIQ);
+ else if (tee_sleep(timeout_ms))
+ /* Timed out, force SWd schedule */
+ nq_scheduler_command(NSIQ);
+ }
+
+ /*
+ * Potential exit causes:
+ * 1) nq_stop is called: just stop the thread (no crash dump)
+ * 2) nq_signal_tee_hung: breaks the loop and handle the hang as
+ * a crash
+ * 3) The thread detects a TEE crash and breaks the loop
+ */
+ if (!l_ctx.tee_scheduler_run)
+ break;
+
+ /* Get requested command if any */
+ mutex_lock(&l_ctx.request_mutex);
+ switch (l_ctx.request) {
+ case NONE:
+ break;
+ case YIELD:
+ swd_notify = false;
+ break;
+ case NSIQ:
+ swd_notify = true;
+ break;
+ case SUSPEND:
+ /* Force N_SIQ */
+ swd_notify = true;
+ set_sleep_mode_rq(MC_FLAG_REQ_TO_SLEEP);
+ pm_request = true;
+ break;
+ case RESUME:
+ /* Force N_SIQ */
+ swd_notify = true;
+ set_sleep_mode_rq(MC_FLAG_NO_SLEEP_REQ);
+ pm_request = true;
+ break;
+ }
+
+ l_ctx.request = NONE;
+ nq_update_time();
+ mutex_unlock(&l_ctx.request_mutex);
+
+ /* Reset timeout so we don't loop if SWd halted */
+ mutex_lock(&l_ctx.buffer_mutex);
+ l_ctx.mcp_buffer->flags.timeout_ms = -1;
+ mutex_unlock(&l_ctx.buffer_mutex);
+
+ if (swd_notify) {
+ u32 session_id = 0;
+ u32 payload = 0;
+
+ retrieve_last_session_payload(&session_id, &payload);
+ swd_notify = false;
+
+ /* Call SWd scheduler */
+ fc_nsiq(session_id, payload);
+ } else {
+ /* Resume SWd from where it was */
+ fc_yield(0);
+ }
+
+ /* Always flush log buffer after the SWd has run */
+ logging_run();
+
+ /* Check crash */
+ mutex_lock(&l_ctx.buffer_mutex);
+ tee_flags = l_ctx.mcp_buffer->flags.tee_flags;
+ mutex_unlock(&l_ctx.buffer_mutex);
+ if (tee_flags & MC_STATE_FLAG_TEE_HALT_MASK) {
+ ret = -EHOSTUNREACH;
+ mc_dev_err(ret, "TEE halted, exiting");
+ break;
+ }
+
+ /* Should have suspended by now if requested */
+ mutex_lock(&l_ctx.request_mutex);
+ if (pm_request) {
+ l_ctx.suspended = nq_suspended();
+ complete(&l_ctx.sleep_complete);
+ }
+
+ mutex_unlock(&l_ctx.request_mutex);
+
+ /* Flush pending notifications if possible */
+ mutex_lock(&l_ctx.notifications_mutex);
+ if (nq_notifications_flush())
+ complete(&l_ctx.idle_complete);
+
+ mutex_unlock(&l_ctx.notifications_mutex);
+ }
+
+ mc_dev_devel("loop exit, ret is %d", ret);
+ if (ret || l_ctx.tee_hung) {
+ /* There is an error, the tee must have crashed */
+ nq_handle_tee_crash();
+ }
+
+ /* Logging */
+ ret = fc_trace_deinit();
+ if (!ret)
+ l_ctx.log_buffer_busy = false;
+ else
+ mc_dev_err(ret, "failed to unregister log buffer");
+
+ mc_clock_disable();
+ return ret;
+}
+
+int nq_suspend(void)
+{
+ return nq_scheduler_pm_command(SUSPEND);
+}
+
+int nq_resume(void)
+{
+ return nq_scheduler_pm_command(RESUME);
+}
+
+int nq_start(void)
+{
+ int ret;
+#if defined(CPU_IDS)
+ struct cpumask new_mask;
+ unsigned int cpu_id[] = CPU_IDS;
+ int i;
+#endif
+ /* Make sure we have the interrupt before going on */
+#if defined(CONFIG_OF)
+ l_ctx.irq = irq_of_parse_and_map(g_ctx.mcd->of_node, 0);
+ mc_dev_info("SSIQ from dts is 0x%08x", l_ctx.irq);
+#endif
+#if defined(MC_INTR_SSIQ)
+ if (l_ctx.irq <= 0)
+ l_ctx.irq = MC_INTR_SSIQ;
+#endif
+
+ if (l_ctx.irq <= 0) {
+ ret = -EINVAL;
+ mc_dev_err(ret, "No IRQ number, aborting");
+ return ret;
+ }
+
+ ret = request_irq(l_ctx.irq, irq_handler, IRQF_TRIGGER_RISING,
+ "trustonic", NULL);
+ if (ret)
+ return ret;
+
+ /*
+ * Initialize the time structure for SWd
+ * At this stage, we don't know if the SWd needs to get the REE time and
+ * we set it anyway.
+ */
+ nq_update_time();
+
+ /* Setup S-SIQ interrupt handler and its bottom-half */
+ l_ctx.irq_bh_thread_run = true;
+ l_ctx.irq_bh_thread = kthread_run(irq_bh_worker, NULL, "tee_irq_bh");
+ if (IS_ERR(l_ctx.irq_bh_thread)) {
+ ret = PTR_ERR(l_ctx.irq_bh_thread);
+ mc_dev_err(ret, "irq_bh_worker thread creation failed");
+ return ret;
+ }
+
+ /* Scheduler */
+ l_ctx.tee_scheduler_run = true;
+ l_ctx.tee_scheduler_thread = kthread_create(tee_scheduler, NULL,
+ "tee_scheduler");
+ if (IS_ERR(l_ctx.tee_scheduler_thread)) {
+ ret = PTR_ERR(l_ctx.tee_scheduler_thread);
+ mc_dev_err(ret, "tee_scheduler thread creation failed");
+ return ret;
+ }
+#if defined(CPU_IDS)
+ cpumask_clear(&new_mask);
+ for (i = 0; i < NB_CPU; i++)
+ cpumask_set_cpu(cpu_id[i], &new_mask);
+ set_cpus_allowed_ptr(l_ctx.tee_scheduler_thread, &new_mask);
+ mc_dev_info("tee_scheduler running only on %d CPU", NB_CPU);
+#endif
+
+ wake_up_process(l_ctx.tee_scheduler_thread);
+
+ wait_for_completion(&l_ctx.boot_complete);
+ if (l_ctx.boot_ret)
+ return l_ctx.boot_ret;
+
+ complete(&l_ctx.idle_complete);
+ return 0;
+}
+
+void nq_stop(void)
+{
+ /* Scheduler */
+ l_ctx.tee_scheduler_run = false;
+ complete(&l_ctx.idle_complete);
+ kthread_stop(l_ctx.tee_scheduler_thread);
+
+ /* NQ */
+ l_ctx.irq_bh_thread_run = false;
+ complete(&l_ctx.irq_bh_complete);
+ kthread_stop(l_ctx.irq_bh_thread);
+ free_irq(l_ctx.irq, NULL);
+}
+
+int nq_init(void)
+{
+ size_t q_len, mci_len;
+ unsigned long mci;
+ int ret;
+
+ ret = mc_clock_init();
+ if (ret)
+ goto err_clock;
+
+ ret = logging_init(&l_ctx.log_buffer, &l_ctx.log_buffer_size);
+ if (ret)
+ goto err_logging;
+
+ /* Setup crash handler function list */
+ BLOCKING_INIT_NOTIFIER_HEAD(&l_ctx.tee_stop_notifiers);
+
+ mutex_init(&l_ctx.buffer_mutex);
+ init_completion(&l_ctx.irq_bh_complete);
+ /* Setup notification queue mutex */
+ mutex_init(&l_ctx.notifications_mutex);
+ INIT_LIST_HEAD(&l_ctx.notifications);
+
+ /* NQ_NUM_ELEMS must be power of 2 */
+ q_len = ALIGN(2 * (sizeof(struct notification_queue_header) +
+ NQ_NUM_ELEMS * sizeof(struct notification)), 4);
+
+ mci_len = q_len +
+ sizeof(*l_ctx.time) +
+ sizeof(*l_ctx.mcp_buffer) +
+ MAX_IW_SESSION * sizeof(struct interworld_session);
+
+ l_ctx.order = get_order(mci_len);
+
+ mci = __get_free_pages(GFP_USER | __GFP_ZERO, l_ctx.order);
+ if (!mci)
+ goto err_mci;
+
+ l_ctx.nq.tx = (struct notification_queue *)mci;
+ l_ctx.nq.tx->hdr.queue_size = NQ_NUM_ELEMS;
+ mci += sizeof(struct notification_queue_header) +
+ l_ctx.nq.tx->hdr.queue_size * sizeof(struct notification);
+
+ l_ctx.nq.rx = (struct notification_queue *)mci;
+ l_ctx.nq.rx->hdr.queue_size = NQ_NUM_ELEMS;
+ mci += sizeof(struct notification_queue_header) +
+ l_ctx.nq.rx->hdr.queue_size * sizeof(struct notification);
+
+ l_ctx.mcp_buffer = (void *)ALIGN(mci, 8);
+ mci += sizeof(struct mcp_buffer);
+
+ /* interworld_buffer contains:
+ * MAX_IW_SESSION session, and for each session S(i), we could have
+ * D(i) extra data, NB: D(i) could be different from D(j)
+ *
+ * v0: D(i) = 0
+ */
+ /* mci should be already 8 bytes aligned */
+ l_ctx.iwp_buffer = (void *)ALIGN(mci, 8);
+ mci += MAX_IW_SESSION * sizeof(struct interworld_session);
+
+ l_ctx.time = (void *)ALIGN(mci, 8);
+
+ /* Scheduler */
+ init_completion(&l_ctx.boot_complete);
+ init_completion(&l_ctx.idle_complete);
+ init_completion(&l_ctx.sleep_complete);
+ mutex_init(&l_ctx.sleep_mutex);
+ mutex_init(&l_ctx.request_mutex);
+ return 0;
+
+err_mci:
+ logging_exit(l_ctx.log_buffer_busy);
+err_logging:
+ mc_clock_exit();
+err_clock:
+ return ret;
+}
+
+void nq_exit(void)
+{
+ if (l_ctx.dump.off)
+ kfree(l_ctx.dump.buf);
+
+ free_pages((unsigned long)l_ctx.mci, l_ctx.order);
+ logging_exit(l_ctx.log_buffer_busy);
+ mc_clock_exit();
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/nq.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/nq.h
new file mode 100644
index 0000000..9d2e6c9
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/nq.h
@@ -0,0 +1,73 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_NQ_H_
+#define _MC_NQ_H_
+
+#include <linux/list.h>
+#include <linux/mutex.h>
+#include <linux/notifier.h>
+
+/** Max number of interworld session allocated in MCI buffer */
+#define MAX_IW_SESSION 256
+
+enum nq_notif_state {
+ NQ_NOTIF_IDLE, /* Nothing happened yet */
+ NQ_NOTIF_QUEUED, /* Notification in overflow queue */
+ NQ_NOTIF_SENT, /* Notification in send queue */
+ NQ_NOTIF_RECEIVED, /* Notification received */
+ NQ_NOTIF_CONSUMED, /* Notification reported to CA */
+ NQ_NOTIF_DEAD, /* Error reported to CA */
+};
+
+/* FIXME to be renamed */
+struct nq_session {
+ /* Notification id */
+ u32 id;
+ /* Notification payload */
+ u32 payload;
+ /* Notifications list */
+ struct list_head list;
+ /* Notification debug mutex */
+ struct mutex mutex;
+ /* Current notification/session state */
+ enum nq_notif_state state;
+ /* Time at notification state change */
+ u64 cpu_clk;
+ /* This TA is of Global Platform type, set by upper layer */
+ int is_gp;
+};
+
+/* Notification queue channel */
+void nq_session_init(struct nq_session *session, bool is_gp);
+void nq_session_exit(struct nq_session *session);
+void nq_session_state_update(struct nq_session *session,
+ enum nq_notif_state state);
+int nq_session_notify(struct nq_session *session, u32 id, u32 payload);
+const char *nq_session_state(const struct nq_session *session, u64 *cpu_clk);
+
+/* Services */
+union mcp_message *nq_get_mcp_buffer(void);
+struct interworld_session *nq_get_iwp_buffer(void);
+void nq_set_version_ptr(char *version);
+void nq_register_notif_handler(void (*handler)(u32 id, u32 payload), bool iwp);
+int nq_register_tee_stop_notifier(struct notifier_block *nb);
+int nq_unregister_tee_stop_notifier(struct notifier_block *nb);
+ssize_t nq_get_stop_message(char __user *buffer, size_t size);
+void nq_signal_tee_hung(void);
+
+/* SWd suspend/resume */
+int nq_suspend(void);
+int nq_resume(void);
+
+/* Start/stop TEE */
+int nq_start(void);
+void nq_stop(void);
+
+/* Initialisation/cleanup */
+int nq_init(void);
+void nq_exit(void);
+
+#endif /* _MC_NQ_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/platform.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/platform.h
new file mode 100644
index 0000000..a93a156
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/platform.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_DRV_PLATFORM_H_
+#define _MC_DRV_PLATFORM_H_
+
+/* Ensure consistency for Fastcall ID between NWd and TEE*/
+#define MC_AARCH32_FC
+
+/* Enable Fastcall worker thread */
+#define MC_FASTCALL_WORKER_THREAD
+
+#if defined(CONFIG_ARM64)
+/* Enable LPAE on 64-bit platforms */
+#ifndef CONFIG_TRUSTONIC_TEE_LPAE
+#define CONFIG_TRUSTONIC_TEE_LPAE
+#endif
+#endif
+
+/* For retrieving SSIQ from dts */
+#define MC_DEVICE_PROPNAME "trustonic,mobicore"
+
+#endif /* _MC_DRV_PLATFORM_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api.h
new file mode 100644
index 0000000..2c7a4c6
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api.h
@@ -0,0 +1,157 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef __TEE_CLIENT_API_H__
+#define __TEE_CLIENT_API_H__
+
+#include "tee_client_types.h"
+#include "tee_client_error.h"
+
+#include "tee_client_api_imp.h"
+
+/* Include GP spec naming (TEEC_*) data type and functions */
+#include "tee_client_api_cust.h"
+
+#define TEEC_EXPORT
+
+/*
+ * The header tee_client_api_imp.h must define implementation-dependent types,
+ * constants and macros.
+ *
+ * The implementation-dependent types are:
+ * - teec_context_imp
+ * - teec_session_imp
+ * - teec_shared_memory_imp
+ * - teec_operation_imp
+ *
+ * The implementation-dependent constants are:
+ * - TEEC_CONFIG_SHAREDMEM_MAX_SIZE
+ * The implementation-dependent macros are:
+ * - TEEC_PARAM_TYPES
+ */
+
+struct teec_value {
+ u32 a;
+ u32 b;
+};
+
+/* Type definitions */
+struct teec_context {
+ struct teec_context_imp imp;
+};
+
+struct teec_session {
+ struct teec_session_imp imp;
+};
+
+struct teec_shared_memory {
+ union {
+ void *buffer;
+ int fd;
+ };
+ size_t size;
+ u32 flags;
+ struct teec_shared_memory_imp imp;
+};
+
+struct teec_temp_memory_reference {
+ void *buffer;
+ size_t size;
+};
+
+struct teec_registered_memory_reference {
+ struct teec_shared_memory *parent;
+ size_t size;
+ size_t offset;
+};
+
+union teec_parameter {
+ struct teec_temp_memory_reference tmpref;
+ struct teec_registered_memory_reference memref;
+ struct teec_value value;
+};
+
+struct teec_operation {
+ u32 started;
+ union {
+ u32 param_types;
+ u32 paramTypes;
+ };
+ union teec_parameter params[4];
+ struct teec_operation_imp imp;
+};
+
+#define TEEC_ORIGIN_API 0x00000001
+#define TEEC_ORIGIN_COMMS 0x00000002
+#define TEEC_ORIGIN_TEE 0x00000003
+#define TEEC_ORIGIN_TRUSTED_APP 0x00000004
+
+#define TEEC_MEM_INPUT 0x00000001
+#define TEEC_MEM_OUTPUT 0x00000002
+#define TEEC_MEM_ION 0x01000000
+
+#define TEEC_NONE 0x0
+#define TEEC_VALUE_INPUT 0x1
+#define TEEC_VALUE_OUTPUT 0x2
+#define TEEC_VALUE_INOUT 0x3
+#define TEEC_MEMREF_TEMP_INPUT 0x5
+#define TEEC_MEMREF_TEMP_OUTPUT 0x6
+#define TEEC_MEMREF_TEMP_INOUT 0x7
+#define TEEC_MEMREF_WHOLE 0xC
+#define TEEC_MEMREF_PARTIAL_INPUT 0xD
+#define TEEC_MEMREF_PARTIAL_OUTPUT 0xE
+#define TEEC_MEMREF_PARTIAL_INOUT 0xF
+
+#define TEEC_LOGIN_PUBLIC 0x00000000
+#define TEEC_LOGIN_USER 0x00000001
+#define TEEC_LOGIN_GROUP 0x00000002
+#define TEEC_LOGIN_APPLICATION 0x00000004
+#define TEEC_LOGIN_USER_APPLICATION 0x00000005
+#define TEEC_LOGIN_GROUP_APPLICATION 0x00000006
+
+#define TEEC_TIMEOUT_INFINITE 0xFFFFFFFF
+
+#pragma GCC visibility push(default)
+
+TEEC_EXPORT u32
+teec_initialize_context(const char *name, struct teec_context *context);
+
+TEEC_EXPORT void
+teec_finalize_context(struct teec_context *context);
+
+TEEC_EXPORT u32
+teec_register_shared_memory(struct teec_context *context,
+ struct teec_shared_memory *shared_mem);
+
+TEEC_EXPORT u32
+teec_allocate_shared_memory(struct teec_context *context,
+ struct teec_shared_memory *shared_mem);
+
+TEEC_EXPORT void
+teec_release_shared_memory(struct teec_shared_memory *shared_mem);
+
+TEEC_EXPORT u32
+teec_open_session(struct teec_context *context,
+ struct teec_session *session,
+ const struct teec_uuid *destination,
+ u32 connection_method, /* Should be 0 */
+ const void *connection_data,
+ struct teec_operation *operation,
+ u32 *return_origin);
+
+TEEC_EXPORT void
+teec_close_session(struct teec_session *session);
+
+TEEC_EXPORT u32
+teec_invoke_command(struct teec_session *session,
+ u32 command_id,
+ struct teec_operation *operation,
+ u32 *return_origin);
+
+TEEC_EXPORT void
+teec_request_cancellation(struct teec_operation *operation);
+
+#pragma GCC visibility pop
+
+#endif /* __TEE_CLIENT_API_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api_cust.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api_cust.h
new file mode 100644
index 0000000..61f8633
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api_cust.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+
+/*
+ * This header file corresponds to V1.0 of the GlobalPlatform
+ * TEE Client API Specification
+ */
+#ifndef __TEE_CLIENT_API_CUST_H__
+#define __TEE_CLIENT_API_CUST_H__
+
+/*
+ * DATA TYPES
+ */
+#define TEEC_UUID teec_uuid
+#define TEEC_Context teec_context
+#define TEEC_Session teec_session
+#define TEEC_SharedMemory teec_shared_memory
+#define TEEC_TempMemoryReference teec_temp_memory_reference
+#define TEEC_RegisteredMemoryReference teec_registered_memory_reference
+#define TEEC_Value teec_value
+#define TEEC_Parameter teec_parameter
+#define TEEC_Operation teec_operation
+
+/*
+ * FUNCTIONS
+ */
+#define TEEC_InitializeContext teec_initialize_context
+#define TEEC_FinalizeContext teec_finalize_context
+#define TEEC_RegisterSharedMemory teec_register_shared_memory
+#define TEEC_AllocateSharedMemory teec_allocate_shared_memory
+#define TEEC_ReleaseSharedMemory teec_release_shared_memory
+#define TEEC_OpenSession teec_open_session
+#define TEEC_CloseSession teec_close_session
+#define TEEC_InvokeCommand teec_invoke_command
+#define TEEC_RequestCancellation teec_request_cancellation
+
+#endif /* __TEE_CLIENT_API_CUST_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api_imp.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api_imp.h
new file mode 100644
index 0000000..51afe92
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_api_imp.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef __TEE_CLIENT_API_IMP_H__
+#define __TEE_CLIENT_API_IMP_H__
+
+#define TEEC_MEM_INOUT (TEEC_MEM_INPUT | TEEC_MEM_OUTPUT)
+#define TEEC_MEM_FLAGS_MASK (TEEC_MEM_ION | TEEC_MEM_INPUT | TEEC_MEM_OUTPUT)
+
+struct tee_client;
+
+struct teec_context_imp {
+ struct tee_client *client;
+};
+
+struct teec_session_imp {
+ u32 session_id;
+ struct teec_context_imp context;
+ int active;
+};
+
+struct teec_shared_memory_imp {
+ struct tee_client *client;
+ int implementation_allocated;
+};
+
+struct teec_operation_imp {
+ struct teec_session_imp *session;
+};
+
+/*
+ * There is no natural, compile-time limit on the shared memory, but a specific
+ * implementation may introduce a limit (in particular on TrustZone)
+ */
+#define TEEC_CONFIG_SHAREDMEM_MAX_SIZE ((size_t)0xFFFFFFFF)
+
+#define TEEC_PARAM_TYPES(entry0_type, entry1_type, entry2_type, entry3_type) \
+ ((entry0_type) | ((entry1_type) << 4) | \
+ ((entry2_type) << 8) | ((entry3_type) << 12))
+
+#endif /* __TEE_CLIENT_API_IMP_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_error.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_error.h
new file mode 100644
index 0000000..e77583d
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_error.h
@@ -0,0 +1,110 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef __TEE_CLIENT_ERROR_H__
+#define __TEE_CLIENT_ERROR_H__
+
+#define TEEC_SUCCESS ((uint32_t)0x00000000)
+
+/**
+ * Generic error code : Generic error
+ **/
+#define TEEC_ERROR_GENERIC ((uint32_t)0xFFFF0000)
+
+/**
+ * Generic error code : The underlying security system denies the access to the
+ * object
+ **/
+#define TEEC_ERROR_ACCESS_DENIED ((uint32_t)0xFFFF0001)
+
+/**
+ * Generic error code : The pending operation is cancelled.
+ **/
+#define TEEC_ERROR_CANCEL ((uint32_t)0xFFFF0002)
+
+/**
+ * Generic error code : The underlying system detects a conflict
+ **/
+#define TEEC_ERROR_ACCESS_CONFLICT ((uint32_t)0xFFFF0003)
+
+/**
+ * Generic error code : Too much data for the operation or some data remain
+ * unprocessed by the operation.
+ **/
+#define TEEC_ERROR_EXCESS_DATA ((uint32_t)0xFFFF0004)
+
+/**
+ * Generic error code : Error of data format
+ **/
+#define TEEC_ERROR_BAD_FORMAT ((uint32_t)0xFFFF0005)
+
+/**
+ * Generic error code : The specified parameters are invalid
+ **/
+#define TEEC_ERROR_BAD_PARAMETERS ((uint32_t)0xFFFF0006)
+
+/**
+ * Generic error code : Illegal state for the operation.
+ **/
+#define TEEC_ERROR_BAD_STATE ((uint32_t)0xFFFF0007)
+
+/**
+ * Generic error code : The item is not found
+ **/
+#define TEEC_ERROR_ITEM_NOT_FOUND ((uint32_t)0xFFFF0008)
+
+/**
+ * Generic error code : The specified operation is not implemented
+ **/
+#define TEEC_ERROR_NOT_IMPLEMENTED ((uint32_t)0xFFFF0009)
+
+/**
+ * Generic error code : The specified operation is not supported
+ **/
+#define TEEC_ERROR_NOT_SUPPORTED ((uint32_t)0xFFFF000A)
+
+/**
+ * Generic error code : Insufficient data is available for the operation.
+ **/
+#define TEEC_ERROR_NO_DATA ((uint32_t)0xFFFF000B)
+
+/**
+ * Generic error code : Not enough memory to perform the operation
+ **/
+#define TEEC_ERROR_OUT_OF_MEMORY ((uint32_t)0xFFFF000C)
+
+/**
+ * Generic error code : The service is currently unable to handle the request;
+ * try later
+ **/
+#define TEEC_ERROR_BUSY ((uint32_t)0xFFFF000D)
+
+/**
+ * Generic communication error
+ **/
+#define TEEC_ERROR_COMMUNICATION ((uint32_t)0xFFFF000E)
+
+/**
+ * Generic error code : security violation
+ **/
+#define TEEC_ERROR_SECURITY ((uint32_t)0xFFFF000F)
+
+/**
+ * Generic error code : the buffer is too short
+ **/
+#define TEEC_ERROR_SHORT_BUFFER ((uint32_t)0xFFFF0010)
+
+/**
+ * Error of communication: The target of the connection is dead
+ **/
+#define TEEC_ERROR_TARGET_DEAD ((uint32_t)0xFFFF3024)
+
+/**
+ * File system error code: not enough space to complete the operation.
+ **/
+#define TEEC_ERROR_STORAGE_NO_SPACE ((uint32_t)0xFFFF3041)
+
+#endif /* __TEE_CLIENT_ERROR_H__ */
+
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_types.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_types.h
new file mode 100644
index 0000000..bf8e9ad
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/GP/tee_client_types.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef __TEE_CLIENT_TYPES_H__
+#define __TEE_CLIENT_TYPES_H__
+
+/* Definition of an UUID (from RFC 4122 http://www.ietf.org/rfc/rfc4122.txt) */
+struct teec_uuid {
+ u32 time_low;
+ u16 time_mid;
+ u16 time_hi_and_version;
+ u8 clock_seq_and_node[8];
+};
+
+/* Type definition for a TEE Identity */
+struct tee_identity {
+ u32 login;
+ struct teec_uuid uuid;
+};
+
+#endif /* __TEE_CLIENT_TYPES_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mc_admin.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mc_admin.h
new file mode 100644
index 0000000..eee82e0
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mc_admin.h
@@ -0,0 +1,76 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef __MC_ADMIN_IOCTL_H__
+#define __MC_ADMIN_IOCTL_H__
+
+#include <linux/types.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#define MC_ADMIN_DEVNODE "mobicore"
+
+/* Driver/daemon commands */
+enum {
+ /* Command 0 is reserved */
+ MC_DRV_GET_ROOT_CONTAINER = 1,
+ MC_DRV_GET_SP_CONTAINER = 2,
+ MC_DRV_GET_TRUSTLET_CONTAINER = 3,
+ MC_DRV_GET_TRUSTLET = 4,
+ MC_DRV_SIGNAL_CRASH = 5,
+};
+
+/* MobiCore IOCTL magic number */
+#define MC_IOC_MAGIC 'M'
+
+struct mc_admin_request {
+ __u32 request_id; /* Unique request identifier */
+ __u32 command; /* Command to daemon */
+ struct mc_uuid_t uuid; /* UUID of trustlet, if relevant */
+ __u32 is_gp; /* Whether trustlet is GP */
+ __u32 spid; /* SPID of trustlet, if relevant */
+};
+
+struct mc_admin_response {
+ __u32 request_id; /* Unique request identifier */
+ __u32 error_no; /* Errno from daemon */
+ __u32 spid; /* SPID of trustlet, if relevant */
+ __u32 service_type; /* Type of trustlet being returned */
+ __u32 length; /* Length of data to get */
+ /* Any data follows */
+};
+
+struct mc_admin_driver_info {
+ /* Version, and something else..*/
+ __u32 drv_version;
+ __u32 initial_cmd_id;
+};
+
+struct mc_admin_load_info {
+ __u32 spid; /* SPID of trustlet, if relevant */
+ __u64 address; /* Address of the data */
+ __u32 length; /* Length of data to get */
+ struct mc_uuid_t uuid; /* UUID of trustlet, if relevant */
+};
+
+#define MC_ADMIN_IO_GET_DRIVER_REQUEST \
+ _IOR(MC_IOC_MAGIC, 0, struct mc_admin_request)
+#define MC_ADMIN_IO_GET_INFO \
+ _IOR(MC_IOC_MAGIC, 1, struct mc_admin_driver_info)
+#define MC_ADMIN_IO_LOAD_DRIVER \
+ _IOW(MC_IOC_MAGIC, 2, struct mc_admin_load_info)
+#define MC_ADMIN_IO_LOAD_TOKEN \
+ _IOW(MC_IOC_MAGIC, 3, struct mc_admin_load_info)
+#define MC_ADMIN_IO_LOAD_CHECK \
+ _IOW(MC_IOC_MAGIC, 4, struct mc_admin_load_info)
+#define MC_ADMIN_IO_LOAD_KEY_SO \
+ _IOW(MC_IOC_MAGIC, 5, struct mc_admin_load_info)
+
+#ifdef __cplusplus
+}
+#endif
+#endif /* __MC_ADMIN_IOCTL_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mc_user.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mc_user.h
new file mode 100644
index 0000000..4e66b81
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mc_user.h
@@ -0,0 +1,297 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_USER_H_
+#define _MC_USER_H_
+
+#define MCDRVMODULEAPI_VERSION_MAJOR 7
+#define MCDRVMODULEAPI_VERSION_MINOR 0
+
+#include <linux/types.h>
+
+#ifndef __KERNEL__
+#define BIT(n) (1 << (n))
+#endif /* __KERNEL__ */
+
+#define MC_USER_DEVNODE "mobicore-user"
+
+/** Maximum length of MobiCore product ID string. */
+#define MC_PRODUCT_ID_LEN 64
+
+/** Number of buffers that can be mapped at once */
+#define MC_MAP_MAX 4
+
+/* Max length for buffers */
+#define MC_MAX_TCI_LEN 0x100000
+#define BUFFER_LENGTH_MAX 0x40000000
+
+/* Max length for objects */
+#define OBJECT_LENGTH_MAX 0x8000000
+
+/* Flags for buffers to map (aligned on GP) */
+#define MC_IO_MAP_INPUT BIT(0)
+#define MC_IO_MAP_OUTPUT BIT(1)
+#define MC_IO_MAP_INPUT_OUTPUT (MC_IO_MAP_INPUT | MC_IO_MAP_OUTPUT)
+
+/*
+ * Universally Unique Identifier (UUID) according to ISO/IEC 11578.
+ */
+struct mc_uuid_t {
+ __u8 value[16]; /* Value of the UUID */
+};
+
+/*
+ * GP TA login types.
+ */
+enum mc_login_type {
+ LOGIN_PUBLIC = 0,
+ LOGIN_USER,
+ LOGIN_GROUP,
+ LOGIN_APPLICATION = 4,
+ LOGIN_USER_APPLICATION,
+ LOGIN_GROUP_APPLICATION,
+};
+
+/*
+ * GP TA identity structure.
+ */
+struct mc_identity {
+ enum mc_login_type login_type;
+ union {
+ __u8 login_data[16];
+ gid_t gid; /* Requested group id */
+ struct {
+ uid_t euid;
+ uid_t ruid;
+ } uid;
+ };
+};
+
+/*
+ * Data exchange structure of the MC_IO_OPEN_SESSION ioctl command.
+ */
+struct mc_ioctl_open_session {
+ struct mc_uuid_t uuid; /* trustlet uuid */
+ __u32 is_gp_uuid; /* uuid is for GP TA */
+ __u32 sid; /* session id (out) */
+ __u64 tci; /* tci buffer pointer */
+ __u32 tcilen; /* tci length */
+ struct mc_identity identity; /* GP TA identity */
+};
+
+/*
+ * Data exchange structure of the MC_IO_OPEN_TRUSTLET ioctl command.
+ */
+struct mc_ioctl_open_trustlet {
+ __u32 sid; /* session id (out) */
+ __u32 spid; /* trustlet spid */
+ __u64 buffer; /* trustlet binary pointer */
+ __u32 tlen; /* binary length */
+ __u64 tci; /* tci buffer pointer */
+ __u32 tcilen; /* tci length */
+};
+
+/*
+ * Data exchange structure of the MC_IO_WAIT ioctl command.
+ */
+struct mc_ioctl_wait {
+ __u32 sid; /* session id (in) */
+ __s32 timeout; /* notification timeout */
+ __u32 partial; /* for proxy server to retry silently */
+};
+
+/*
+ * Data exchange structure of the MC_IO_ALLOC ioctl command.
+ */
+struct mc_ioctl_alloc {
+ __u32 len; /* buffer length */
+ __u32 handle; /* user handle for the buffer (out) */
+};
+
+/*
+ * Buffer mapping incoming and outgoing information.
+ */
+struct mc_ioctl_buffer {
+ __u64 va; /* user space address of buffer */
+ __u32 len; /* buffer length */
+ __u64 sva; /* SWd virt address of buffer (out) */
+ __u32 flags; /* buffer flags */
+};
+
+/*
+ * Data exchange structure of the MC_IO_MAP and MC_IO_UNMAP ioctl commands.
+ */
+struct mc_ioctl_map {
+ __u32 sid; /* session id */
+ struct mc_ioctl_buffer buf; /* buffers info */
+};
+
+/*
+ * Data exchange structure of the MC_IO_ERR ioctl command.
+ */
+struct mc_ioctl_geterr {
+ __u32 sid; /* session id */
+ __s32 value; /* error value (out) */
+};
+
+/*
+ * Global MobiCore Version Information.
+ */
+struct mc_version_info {
+ char product_id[MC_PRODUCT_ID_LEN]; /* Product ID string */
+ __u32 version_mci; /* Mobicore Control Interface */
+ __u32 version_so; /* Secure Objects */
+ __u32 version_mclf; /* MobiCore Load Format */
+ __u32 version_container; /* MobiCore Container Format */
+ __u32 version_mc_config; /* MobiCore Config. Block Format */
+ __u32 version_tl_api; /* MobiCore Trustlet API */
+ __u32 version_dr_api; /* MobiCore Driver API */
+ __u32 version_nwd; /* This Driver */
+};
+
+/*
+ * GP TA operation structure.
+ */
+struct gp_value {
+ __u32 a;
+ __u32 b;
+};
+
+struct gp_temp_memref {
+ __u64 buffer;
+ __u64 size;
+};
+
+struct gp_shared_memory {
+ __u64 buffer;
+ __u64 size;
+ __u32 flags;
+};
+
+struct gp_regd_memref {
+ struct gp_shared_memory parent;
+ __u64 size;
+ __u64 offset;
+};
+
+union gp_param {
+ struct gp_temp_memref tmpref;
+ struct gp_regd_memref memref;
+ struct gp_value value;
+};
+
+struct gp_operation {
+ __u32 started;
+ __u32 param_types;
+ union gp_param params[4];
+};
+
+struct gp_return {
+ __u32 origin;
+ __u32 value;
+};
+
+/*
+ * Data exchange structure of the MC_IO_GP_INITIALIZE_CONTEXT ioctl command.
+ */
+struct mc_ioctl_gp_initialize_context {
+ struct gp_return ret; /* return origin/value (out) */
+};
+
+/*
+ * Data exchange structure of the MC_IO_GP_REGISTER_SHARED_MEM ioctl command.
+ */
+struct mc_ioctl_gp_register_shared_mem {
+ struct gp_shared_memory memref;
+ struct gp_return ret; /* return origin/value (out) */
+};
+
+/*
+ * Data exchange structure of the MC_IO_GP_RELEASE_SHARED_MEM ioctl command.
+ */
+struct mc_ioctl_gp_release_shared_mem {
+ struct gp_shared_memory memref;
+};
+
+/*
+ * Data exchange structure of the MC_IO_GP_OPEN_SESSION ioctl command.
+ */
+struct mc_ioctl_gp_open_session {
+ struct mc_uuid_t uuid; /* trustlet uuid */
+ struct mc_identity identity; /* GP TA identity */
+ struct gp_operation operation; /* set of parameters */
+ struct gp_return ret; /* return origin/value (out) */
+ __u32 session_id; /* session id (out) */
+};
+
+/*
+ * Data exchange structure of the MC_IO_GP_CLOSE_SESSION ioctl command.
+ */
+struct mc_ioctl_gp_close_session {
+ __u32 session_id; /* session id */
+};
+
+/*
+ * Data exchange structure of the MC_IO_GP_INVOKE_COMMAND ioctl command.
+ */
+struct mc_ioctl_gp_invoke_command {
+ struct gp_operation operation; /* set of parameters */
+ __u32 session_id; /* session id */
+ __u32 command_id; /* ID of the command */
+ struct gp_return ret; /* return origin/value (out) */
+};
+
+/*
+ * Data exchange structure of the MC_IO_GP_CANCEL ioctl command.
+ */
+struct mc_ioctl_gp_request_cancellation {
+ struct gp_operation operation; /* set of parameters */
+};
+
+/*
+ * defines for the ioctl mobicore driver module function call from user space.
+ */
+/* MobiCore IOCTL magic number */
+#define MC_IOC_MAGIC 'M'
+
+/*
+ * Implement corresponding functions from user api
+ */
+#define MC_IO_OPEN_SESSION \
+ _IOWR(MC_IOC_MAGIC, 0, struct mc_ioctl_open_session)
+#define MC_IO_OPEN_TRUSTLET \
+ _IOWR(MC_IOC_MAGIC, 1, struct mc_ioctl_open_trustlet)
+#define MC_IO_CLOSE_SESSION \
+ _IO(MC_IOC_MAGIC, 2)
+#define MC_IO_NOTIFY \
+ _IO(MC_IOC_MAGIC, 3)
+#define MC_IO_WAIT \
+ _IOW(MC_IOC_MAGIC, 4, struct mc_ioctl_wait)
+#define MC_IO_MAP \
+ _IOWR(MC_IOC_MAGIC, 5, struct mc_ioctl_map)
+#define MC_IO_UNMAP \
+ _IOW(MC_IOC_MAGIC, 6, struct mc_ioctl_map)
+#define MC_IO_ERR \
+ _IOWR(MC_IOC_MAGIC, 7, struct mc_ioctl_geterr)
+#define MC_IO_HAS_SESSIONS \
+ _IO(MC_IOC_MAGIC, 8)
+#define MC_IO_VERSION \
+ _IOR(MC_IOC_MAGIC, 9, struct mc_version_info)
+#define MC_IO_GP_INITIALIZE_CONTEXT \
+ _IOW(MC_IOC_MAGIC, 20, struct mc_ioctl_gp_initialize_context)
+#define MC_IO_GP_REGISTER_SHARED_MEM \
+ _IOWR(MC_IOC_MAGIC, 21, struct mc_ioctl_gp_register_shared_mem)
+#define MC_IO_GP_RELEASE_SHARED_MEM \
+ _IOW(MC_IOC_MAGIC, 23, struct mc_ioctl_gp_release_shared_mem)
+#define MC_IO_GP_OPEN_SESSION \
+ _IOWR(MC_IOC_MAGIC, 24, struct mc_ioctl_gp_open_session)
+#define MC_IO_GP_CLOSE_SESSION \
+ _IOW(MC_IOC_MAGIC, 25, struct mc_ioctl_gp_close_session)
+#define MC_IO_GP_INVOKE_COMMAND \
+ _IOWR(MC_IOC_MAGIC, 26, struct mc_ioctl_gp_invoke_command)
+#define MC_IO_GP_REQUEST_CANCELLATION \
+ _IOW(MC_IOC_MAGIC, 27, struct mc_ioctl_gp_request_cancellation)
+
+#endif /* _MC_USER_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mobicore_driver_api.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mobicore_driver_api.h
new file mode 100644
index 0000000..be1d1e0
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/public/mobicore_driver_api.h
@@ -0,0 +1,460 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef _MOBICORE_DRIVER_API_H_
+#define _MOBICORE_DRIVER_API_H_
+
+#include "mc_user.h"
+
+#define __MC_CLIENT_LIB_API
+
+/*
+ * Return values of MobiCore driver functions.
+ */
+enum mc_result {
+ /* Function call succeeded. */
+ MC_DRV_OK = 0,
+ /* No notification available. */
+ MC_DRV_NO_NOTIFICATION = 1,
+ /* Error during notification on communication level. */
+ MC_DRV_ERR_NOTIFICATION = 2,
+ /* Function not implemented. */
+ MC_DRV_ERR_NOT_IMPLEMENTED = 3,
+ /* No more resources available. */
+ MC_DRV_ERR_OUT_OF_RESOURCES = 4,
+ /* Driver initialization failed. */
+ MC_DRV_ERR_INIT = 5,
+ /* Unknown error. */
+ MC_DRV_ERR_UNKNOWN = 6,
+ /* The specified device is unknown. */
+ MC_DRV_ERR_UNKNOWN_DEVICE = 7,
+ /* The specified session is unknown.*/
+ MC_DRV_ERR_UNKNOWN_SESSION = 8,
+ /* The specified operation is not allowed. */
+ MC_DRV_ERR_INVALID_OPERATION = 9,
+ /* The response header from the MC is invalid. */
+ MC_DRV_ERR_INVALID_RESPONSE = 10,
+ /* Function call timed out. */
+ MC_DRV_ERR_TIMEOUT = 11,
+ /* Can not allocate additional memory. */
+ MC_DRV_ERR_NO_FREE_MEMORY = 12,
+ /* Free memory failed. */
+ MC_DRV_ERR_FREE_MEMORY_FAILED = 13,
+ /* Still some open sessions pending. */
+ MC_DRV_ERR_SESSION_PENDING = 14,
+ /* MC daemon not reachable */
+ MC_DRV_ERR_DAEMON_UNREACHABLE = 15,
+ /* The device file of the kernel module could not be opened. */
+ MC_DRV_ERR_INVALID_DEVICE_FILE = 16,
+ /* Invalid parameter. */
+ MC_DRV_ERR_INVALID_PARAMETER = 17,
+ /* Unspecified error from Kernel Module*/
+ MC_DRV_ERR_KERNEL_MODULE = 18,
+ /* Error during mapping of additional bulk memory to session. */
+ MC_DRV_ERR_BULK_MAPPING = 19,
+ /* Error during unmapping of additional bulk memory to session. */
+ MC_DRV_ERR_BULK_UNMAPPING = 20,
+ /* Notification received, exit code available. */
+ MC_DRV_INFO_NOTIFICATION = 21,
+ /* Set up of NWd connection failed. */
+ MC_DRV_ERR_NQ_FAILED = 22,
+ /* Wrong daemon version. */
+ MC_DRV_ERR_DAEMON_VERSION = 23,
+ /* Wrong container version. */
+ MC_DRV_ERR_CONTAINER_VERSION = 24,
+ /* System Trustlet public key is wrong. */
+ MC_DRV_ERR_WRONG_PUBLIC_KEY = 25,
+ /* Wrong container type(s). */
+ MC_DRV_ERR_CONTAINER_TYPE_MISMATCH = 26,
+ /* Container is locked (or not activated). */
+ MC_DRV_ERR_CONTAINER_LOCKED = 27,
+ /* SPID is not registered with root container. */
+ MC_DRV_ERR_SP_NO_CHILD = 28,
+ /* UUID is not registered with sp container. */
+ MC_DRV_ERR_TL_NO_CHILD = 29,
+ /* Unwrapping of root container failed. */
+ MC_DRV_ERR_UNWRAP_ROOT_FAILED = 30,
+ /* Unwrapping of service provider container failed. */
+ MC_DRV_ERR_UNWRAP_SP_FAILED = 31,
+ /* Unwrapping of Trustlet container failed. */
+ MC_DRV_ERR_UNWRAP_TRUSTLET_FAILED = 32,
+ /* No device associated with connection. */
+ MC_DRV_ERR_DAEMON_DEVICE_NOT_OPEN = 33,
+ /* TA blob attestation is incorrect. */
+ MC_DRV_ERR_TA_ATTESTATION_ERROR = 34,
+ /* Interrupted system call. */
+ MC_DRV_ERR_INTERRUPTED_BY_SIGNAL = 35,
+ /* Service is blocked and opensession is thus not allowed. */
+ MC_DRV_ERR_SERVICE_BLOCKED = 36,
+ /* Service is locked and opensession is thus not allowed. */
+ MC_DRV_ERR_SERVICE_LOCKED = 37,
+ /* Service was killed by the TEE (due to an administrative command). */
+ MC_DRV_ERR_SERVICE_KILLED = 38,
+ /* All permitted instances to the service are used */
+ MC_DRV_ERR_NO_FREE_INSTANCES = 39,
+ /* TA blob header is incorrect. */
+ MC_DRV_ERR_TA_HEADER_ERROR = 40,
+};
+
+/*
+ * Structure of Session Handle, includes the Session ID and the Device ID the
+ * Session belongs to.
+ * The session handle will be used for session-based MobiCore communication.
+ * It will be passed to calls which address a communication end point in the
+ * MobiCore environment.
+ */
+struct mc_session_handle {
+ u32 session_id; /* MobiCore session ID */
+ u32 device_id; /* Device ID the session belongs to */
+};
+
+/*
+ * Information structure about additional mapped Bulk buffer between the
+ * Trustlet Connector (NWd) and the Trustlet (SWd). This structure is
+ * initialized from a Trustlet Connector by calling mc_map().
+ * In order to use the memory within a Trustlet the Trustlet Connector has to
+ * inform the Trustlet with the content of this structure via the TCI.
+ */
+struct mc_bulk_map {
+ /*
+ * The virtual address of the Bulk buffer regarding the address space
+ * of the Trustlet, already includes a possible offset!
+ */
+ u32 secure_virt_addr;
+ u32 secure_virt_len; /* Length of the mapped Bulk buffer */
+};
+
+/* The default device ID */
+#define MC_DEVICE_ID_DEFAULT 0
+/* Wait infinite for a response of the MC. */
+#define MC_INFINITE_TIMEOUT ((s32)(-1))
+/* Do not wait for a response of the MC. */
+#define MC_NO_TIMEOUT 0
+/* TCI/DCI must not exceed 1MiB */
+#define MC_MAX_TCI_LEN 0x100000
+
+/**
+ * mc_open_device() - Open a new connection to a MobiCore device.
+ * @device_id: Identifier for the MobiCore device to be used.
+ * MC_DEVICE_ID_DEFAULT refers to the default device.
+ *
+ * Initializes all device specific resources required to communicate with a
+ * MobiCore instance located on the specified device in the system. If the
+ * device does not exist the function will return MC_DRV_ERR_UNKNOWN_DEVICE.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_ERR_INVALID_OPERATION: device already opened
+ * MC_DRV_ERR_DAEMON_UNREACHABLE: problems with daemon
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device_id unknown
+ * MC_DRV_ERR_INVALID_DEVICE_FILE: kernel module under /dev/mobicore
+ * cannot be opened
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_open_device(
+ u32 device_id);
+
+/**
+ * mc_close_device() - Close the connection to a MobiCore device.
+ * @device_id: Identifier for the MobiCore device.
+ *
+ * When closing a device, active sessions have to be closed beforehand.
+ * Resources associated with the device will be released.
+ * The device may be opened again after it has been closed.
+ *
+ * MC_DEVICE_ID_DEFAULT refers to the default device.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id is invalid
+ * MC_DRV_ERR_SESSION_PENDING: a session is still open
+ * MC_DRV_ERR_DAEMON_UNREACHABLE: problems with daemon occur
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_close_device(
+ u32 device_id);
+
+/**
+ * mc_open_session() - Open a new session to a Trustlet.
+ * @session: On success, the session data will be returned
+ * @uuid: UUID of the Trustlet to be opened
+ * @tci: TCI buffer for communicating with the Trustlet
+ * @tci_len: Length of the TCI buffer. Maximum allowed value
+ * is MC_MAX_TCI_LEN
+ *
+ * The Trustlet with the given UUID has to be available in the flash filesystem.
+ *
+ * Write MCP open message to buffer and notify MobiCore about the availability
+ * of a new command.
+ *
+ * Waits till the MobiCore responses with the new session ID (stored in the MCP
+ * buffer).
+ *
+ * Note that session.device_id has to be the device id of an opened device.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: session parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id is invalid
+ * MC_DRV_ERR_DAEMON_UNREACHABLE: problems with daemon socket occur
+ * MC_DRV_ERR_NQ_FAILED: daemon returns an error
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_open_session(
+ struct mc_session_handle *session,
+ const struct mc_uuid_t *uuid,
+ u8 *tci,
+ u32 tci_len);
+
+/**
+ * mc_open_trustlet() - Open a new session to the provided Trustlet.
+ * @session: On success, the session data will be returned
+ * @spid: Service Provider ID (for SP trustlets otherwise ignored)
+ * @trustlet Memory buffer containing the Trusted Application binary
+ * @trustlet_len Trusted Application length
+ * @tci: TCI buffer for communicating with the Trustlet
+ * @tci_len: Length of the TCI buffer. Maximum allowed value
+ * is MC_MAX_TCI_LEN
+ *
+ * Write MCP open message to buffer and notify MobiCore about the availability
+ * of a new command.
+ *
+ * Waits till the MobiCore responses with the new session ID (stored in the MCP
+ * buffer).
+ *
+ * Note that session.device_id has to be the device id of an opened device.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: session parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id is invalid
+ * MC_DRV_ERR_DAEMON_UNREACHABLE: problems with daemon socket occur
+ * MC_DRV_ERR_NQ_FAILED: daemon returns an error
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_open_trustlet(
+ struct mc_session_handle *session,
+ u32 spid,
+ u8 *trustlet,
+ u32 trustlet_len,
+ u8 *tci,
+ u32 len);
+
+/**
+ * mc_close_session() - Close a Trustlet session.
+ * @session: Session to be closed.
+ *
+ * Closes the specified MobiCore session. The call will block until the
+ * session has been closed.
+ *
+ * Device device_id has to be opened in advance.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: session parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_SESSION: session id is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id of session is invalid
+ * MC_DRV_ERR_DAEMON_UNREACHABLE: problems with daemon occur
+ * MC_DRV_ERR_INVALID_DEVICE_FILE: daemon cannot open Trustlet file
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_close_session(
+ struct mc_session_handle *session);
+
+/**
+ * mc_notify() - Notify a session.
+ * @session: The session to be notified.
+ *
+ * Notifies the session end point about available message data.
+ * If the session parameter is correct, notify will always succeed.
+ * Corresponding errors can only be received by mc_wait_notification().
+ *
+ * A session has to be opened in advance.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: session parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_SESSION: session id is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id of session is invalid
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_notify(
+ struct mc_session_handle *session);
+
+/**
+ * mc_wait_notification() - Wait for a notification.
+ * @session: The session the notification should correspond to.
+ * @timeout: Time in milliseconds to wait
+ * (MC_NO_TIMEOUT : direct return, > 0 : milliseconds,
+ * MC_INFINITE_TIMEOUT : wait infinitely)
+ *
+ * Wait for a notification issued by the MobiCore for a specific session.
+ * The timeout parameter specifies the number of milliseconds the call will wait
+ * for a notification.
+ *
+ * If the caller passes 0 as timeout value the call will immediately return.
+ * If timeout value is below 0 the call will block until a notification for the
+ * session has been received.
+ *
+ * If timeout is below 0, call will block.
+ *
+ * Caller has to trust the other side to send a notification to wake him up
+ * again.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_ERR_TIMEOUT: no notification arrived in time
+ * MC_DRV_INFO_NOTIFICATION: a problem with the session was
+ * encountered. Get more details with
+ * mc_get_session_error_code()
+ * MC_DRV_ERR_NOTIFICATION: a problem with the socket occurred
+ * MC_DRV_INVALID_PARAMETER: a parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_SESSION: session id is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id of session is invalid
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_wait_notification(
+ struct mc_session_handle *session,
+ s32 timeout);
+
+/**
+ * mc_malloc_wsm() - Allocate a block of world shared memory (WSM).
+ * @device_id: The ID of an opened device to retrieve the WSM from.
+ * @align: The alignment (number of pages) of the memory block
+ * (e.g. 0x00000001 for 4kb).
+ * @len: Length of the block in bytes.
+ * @wsm: Virtual address of the world shared memory block.
+ * @wsm_flags: Platform specific flags describing the memory to
+ * be allocated.
+ *
+ * The MC driver allocates a contiguous block of memory which can be used as
+ * WSM.
+ * This implicates that the allocated memory is aligned according to the
+ * alignment parameter.
+ *
+ * Always returns a buffer of size WSM_SIZE aligned to 4K.
+ *
+ * Align and wsm_flags are currently ignored
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: a parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id is invalid
+ * MC_DRV_ERR_NO_FREE_MEMORY: no more contiguous memory is
+ * available in this size or for this
+ * process
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_malloc_wsm(
+ u32 device_id,
+ u32 align,
+ u32 len,
+ u8 **wsm,
+ u32 wsm_flags);
+
+/**
+ * mc_free_wsm() - Free a block of world shared memory (WSM).
+ * @device_id: The ID to which the given address belongs
+ * @wsm: Address of WSM block to be freed
+ *
+ * The MC driver will free a block of world shared memory (WSM) previously
+ * allocated with mc_malloc_wsm(). The caller has to assure that the address
+ * handed over to the driver is a valid WSM address.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: a parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: when device id is invalid
+ * MC_DRV_ERR_FREE_MEMORY_FAILED: on failure
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_free_wsm(
+ u32 device_id,
+ u8 *wsm);
+
+/**
+ *mc_map() - Map additional bulk buffer between a Trustlet Connector (TLC)
+ * and the Trustlet (TL) for a session
+ * @session: Session handle with information of the device_id and
+ * the session_id. The given buffer is mapped to the
+ * session specified in the sessionHandle
+ * @buf: Virtual address of a memory portion (relative to TLC)
+ * to be shared with the Trustlet, already includes a
+ * possible offset!
+ * @len: length of buffer block in bytes.
+ * @map_info: Information structure about the mapped Bulk buffer
+ * between the TLC (NWd) and the TL (SWd).
+ *
+ * Memory allocated in user space of the TLC can be mapped as additional
+ * communication channel (besides TCI) to the Trustlet. Limitation of the
+ * Trustlet memory structure apply: only 6 chunks can be mapped with a maximum
+ * chunk size of 1 MiB each.
+ *
+ * It is up to the application layer (TLC) to inform the Trustlet
+ * about the additional mapped bulk memory.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: a parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_SESSION: session id is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id of session is invalid
+ * MC_DRV_ERR_DAEMON_UNREACHABLE: problems with daemon occur
+ * MC_DRV_ERR_BULK_MAPPING: buf is already uses as bulk buffer or
+ * when registering the buffer failed
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_map(
+ struct mc_session_handle *session,
+ void *buf,
+ u32 len,
+ struct mc_bulk_map *map_info);
+
+/**
+ * mc_unmap() - Remove additional mapped bulk buffer between Trustlet Connector
+ * (TLC) and the Trustlet (TL) for a session
+ * @session: Session handle with information of the device_id and
+ * the session_id. The given buffer is unmapped from the
+ * session specified in the sessionHandle.
+ * @buf: Virtual address of a memory portion (relative to TLC)
+ * shared with the TL, already includes a possible offset!
+ * @map_info: Information structure about the mapped Bulk buffer
+ * between the TLC (NWd) and the TL (SWd)
+ *
+ * The bulk buffer will immediately be unmapped from the session context.
+ *
+ * The application layer (TLC) must inform the TL about unmapping of the
+ * additional bulk memory before calling mc_unmap!
+ *
+ * The clientlib currently ignores the len field in map_info.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: a parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_SESSION: session id is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id of session is invalid
+ * MC_DRV_ERR_DAEMON_UNREACHABLE: problems with daemon occur
+ * MC_DRV_ERR_BULK_UNMAPPING: buf was not registered earlier
+ * or when unregistering failed
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_unmap(
+ struct mc_session_handle *session,
+ void *buf,
+ struct mc_bulk_map *map_info);
+
+/*
+ * mc_get_session_error_code() - Get additional error information of the last
+ * error that occurred on a session.
+ * @session: Session handle with information of the device_id and
+ * the session_id
+ * @exit_code: >0 Trustlet has terminated itself with this value,
+ * <0 Trustlet is dead because of an error within the
+ * MobiCore (e.g. Kernel exception). See also MCI
+ * definition.
+ *
+ * After the request the stored error code will be deleted.
+ *
+ * Return codes:
+ * MC_DRV_OK: operation completed successfully
+ * MC_DRV_INVALID_PARAMETER: a parameter is invalid
+ * MC_DRV_ERR_UNKNOWN_SESSION: session id is invalid
+ * MC_DRV_ERR_UNKNOWN_DEVICE: device id of session is invalid
+ */
+__MC_CLIENT_LIB_API enum mc_result mc_get_session_error_code(
+ struct mc_session_handle *session,
+ s32 *exit_code);
+
+/* Return true if MobiCore is ready */
+__MC_CLIENT_LIB_API bool is_mobicore_ready(void);
+
+#endif /* _MOBICORE_DRIVER_API_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/session.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/session.c
new file mode 100644
index 0000000..2a8af1e
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/session.c
@@ -0,0 +1,902 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/jiffies.h>
+#include <linux/sched.h>
+#include <linux/workqueue.h>
+#include <linux/err.h>
+#include <linux/mm.h>
+#include <crypto/hash.h>
+#include <linux/scatterlist.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/net.h>
+#include <net/sock.h> /* sockfd_lookup */
+#include <linux/version.h>
+#include <linux/sched/clock.h> /* local_clock */
+#include <linux/sched/task.h> /* put_task_struct */
+
+#include "public/mc_user.h"
+#include "public/mc_admin.h"
+
+#include <linux/uidgid.h>
+#include "main.h"
+#include "mmu.h" /* tee_mmu_buffer, tee_mmu_debug_structs */
+#include "iwp.h"
+#include "mcp.h"
+#include "client.h" /* *cbuf* */
+#include "session.h"
+#include "mci/mcimcp.h" /* WSM_INVALID */
+
+#define SHA1_HASH_SIZE 20
+
+static int wsm_create(struct tee_session *session, struct tee_wsm *wsm,
+ const struct mc_ioctl_buffer *buf)
+{
+ if (wsm->in_use) {
+ mc_dev_err(-EINVAL, "wsm already in use");
+ return -EINVAL;
+ }
+
+ if (buf->len > BUFFER_LENGTH_MAX) {
+ mc_dev_err(-EINVAL, "buffer size %u too big", buf->len);
+ return -EINVAL;
+ }
+
+ wsm->mmu = client_mmu_create(session->client, buf, &wsm->cbuf);
+ if (IS_ERR(wsm->mmu))
+ return PTR_ERR(wsm->mmu);
+
+ /* Increment debug counter */
+ atomic_inc(&g_ctx.c_wsms);
+ wsm->va = buf->va;
+ wsm->len = buf->len;
+ wsm->flags = buf->flags;
+ wsm->in_use = true;
+ return 0;
+}
+
+static int wsm_wrap(struct tee_session *session, struct tee_wsm *wsm,
+ struct tee_mmu *mmu)
+{
+ struct mcp_buffer_map map;
+
+ if (wsm->in_use) {
+ mc_dev_err(-EINVAL, "wsm already in use");
+ return -EINVAL;
+ }
+
+ wsm->mmu = mmu;
+ tee_mmu_get(wsm->mmu);
+
+ /* Increment debug counter */
+ atomic_inc(&g_ctx.c_wsms);
+ tee_mmu_buffer(wsm->mmu, &map);
+ wsm->va = 0;
+ wsm->len = map.length;
+ wsm->flags = map.flags;
+ wsm->in_use = true;
+ return 0;
+}
+
+/*
+ * Free a WSM object, must be called under the session's wsms_lock
+ */
+static void wsm_free(struct tee_session *session, struct tee_wsm *wsm)
+{
+ if (!wsm->in_use) {
+ mc_dev_err(-EINVAL, "wsm not in use");
+ return;
+ }
+
+ mc_dev_devel("free wsm %p: mmu %p cbuf %p va %lx len %u sva %x",
+ wsm, wsm->mmu, wsm->cbuf, wsm->va, wsm->len, wsm->sva);
+ /* Free MMU table */
+ tee_mmu_put(wsm->mmu);
+ if (wsm->cbuf)
+ tee_cbuf_put(wsm->cbuf);
+
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_wsms);
+ wsm->in_use = false;
+}
+
+static int hash_path_and_data(struct task_struct *task, u8 *hash,
+ const void *data, unsigned int data_len)
+{
+ struct file *exe_file;
+ struct crypto_shash *tfm;
+ struct shash_desc *desc;
+ size_t desc_size;
+ char *buf;
+ char *path;
+ unsigned int path_len;
+ int ret = 0;
+
+ buf = (char *)__get_free_page(GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ exe_file = get_task_exe_file(task);
+ if (!exe_file) {
+ ret = -ENOENT;
+ goto end;
+ }
+
+ path = d_path(&exe_file->f_path, buf, PAGE_SIZE);
+ if (IS_ERR(path)) {
+ ret = PTR_ERR(path);
+ goto end;
+ }
+
+ mc_dev_devel("process path =");
+ {
+ char *c;
+
+ for (c = path; *c; c++)
+ mc_dev_devel("%c %d", *c, *c);
+ }
+
+ path_len = (unsigned int)strnlen(path, PAGE_SIZE);
+ mc_dev_devel("path_len = %u", path_len);
+ /* Compute hash of path */
+ tfm = crypto_alloc_shash("sha1", 0, 0);
+ if (IS_ERR(tfm)) {
+ ret = PTR_ERR(tfm);
+ mc_dev_err(ret, "cannot allocate shash");
+ goto end;
+ }
+
+ desc_size = crypto_shash_descsize(tfm) + sizeof(*desc);
+ desc = kzalloc(desc_size, GFP_KERNEL);
+ if (!desc) {
+ ret = -ENOMEM;
+ goto err_desc;
+ }
+
+ desc->tfm = tfm;
+ desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
+ crypto_shash_init(desc);
+ crypto_shash_update(desc, (u8 *)path, path_len);
+ if (data) {
+ mc_dev_devel("hashing additional data");
+ crypto_shash_update(desc, data, data_len);
+ }
+
+ crypto_shash_final(desc, hash);
+ shash_desc_zero(desc);
+ kfree(desc);
+err_desc:
+ crypto_free_shash(tfm);
+end:
+ free_page((unsigned long)buf);
+
+ return ret;
+}
+
+#define GROUP_AT(gi, i) ((gi)->gid[i])
+
+/*
+ * groups_search is not EXPORTed so copied from kernel/groups.c
+ * a simple bsearch
+ */
+static int has_group(const struct cred *cred, gid_t id_gid)
+{
+ const struct group_info *group_info = cred->group_info;
+ unsigned int left, right;
+ kgid_t gid = KGIDT_INIT(id_gid);
+
+ if (gid_eq(gid, cred->fsgid) || gid_eq(gid, cred->egid))
+ return 1;
+
+ if (!group_info)
+ return 0;
+
+ left = 0;
+ right = group_info->ngroups;
+ while (left < right) {
+ unsigned int mid = (left + right) / 2;
+
+ if (gid_gt(gid, GROUP_AT(group_info, mid)))
+ left = mid + 1;
+ else if (gid_lt(gid, GROUP_AT(group_info, mid)))
+ right = mid;
+ else
+ return 1;
+ }
+ return 0;
+}
+
+static int check_prepare_identity(const struct mc_identity *identity,
+ struct identity *mcp_identity,
+ struct task_struct *task)
+{
+ struct mc_identity *mcp_id = (struct mc_identity *)mcp_identity;
+ u8 hash[SHA1_HASH_SIZE] = { 0 };
+ bool application = false;
+ bool supplied_ca_identity = false;
+ const void *data;
+ unsigned int data_len;
+ static const u8 zero_buffer[sizeof(identity->login_data)] = { 0 };
+
+ /* Copy login type */
+ mcp_identity->login_type = identity->login_type;
+
+ if (identity->login_type == LOGIN_PUBLIC ||
+ identity->login_type == TEEC_TT_LOGIN_KERNEL)
+ return 0;
+
+ /* Fill in uid field */
+ if (identity->login_type == LOGIN_USER ||
+ identity->login_type == LOGIN_USER_APPLICATION) {
+ /* Set euid and ruid of the process. */
+ mcp_id->uid.euid = __kuid_val(task_euid(task));
+ mcp_id->uid.ruid = __kuid_val(task_uid(task));
+ }
+
+ /* Check gid field */
+ if (identity->login_type == LOGIN_GROUP ||
+ identity->login_type == LOGIN_GROUP_APPLICATION) {
+ const struct cred *cred = __task_cred(task);
+
+ /*
+ * Check if gid is one of: egid of the process, its rgid or one
+ * of its supplementary groups
+ */
+ if (!has_group(cred, identity->gid)) {
+ mc_dev_err(-EACCES, "group %d not allowed",
+ identity->gid);
+ return -EACCES;
+ }
+
+ mc_dev_devel("group %d found", identity->gid);
+ mcp_id->gid = identity->gid;
+ }
+
+ switch (identity->login_type) {
+ case LOGIN_PUBLIC:
+ case LOGIN_GROUP:
+ break;
+ case LOGIN_USER:
+ data = NULL;
+ data_len = 0;
+ break;
+ case LOGIN_APPLICATION:
+ application = true;
+ supplied_ca_identity = true;
+ data = NULL;
+ data_len = 0;
+ break;
+ case LOGIN_USER_APPLICATION:
+ application = true;
+ supplied_ca_identity = true;
+ data = &mcp_id->uid;
+ data_len = sizeof(mcp_id->uid);
+ break;
+ case LOGIN_GROUP_APPLICATION:
+ application = true;
+ data = &identity->gid;
+ data_len = sizeof(identity->gid);
+ break;
+ default:
+ /* Any other login_type value is invalid. */
+ mc_dev_err(-EINVAL, "Invalid login type %d",
+ identity->login_type);
+ return -EINVAL;
+ }
+
+ /* let the supplied login_data pass through if it is LOGIN_APPLICATION
+ * or LOGIN_USER_APPLICATION and not a zero-filled buffer
+ * That buffer is expected to contain a NWd computed hash containing the
+ * CA identity
+ */
+ if (supplied_ca_identity &&
+ memcmp(identity->login_data, zero_buffer,
+ sizeof(identity->login_data)) != 0) {
+ memcpy(&mcp_id->login_data, identity->login_data,
+ sizeof(mcp_id->login_data));
+ } else if (application) {
+ int ret = hash_path_and_data(task, hash, data, data_len);
+
+ if (ret) {
+ mc_dev_devel("hash calculation returned %d", ret);
+ return ret;
+ }
+
+ memcpy(&mcp_id->login_data, hash, sizeof(mcp_id->login_data));
+ }
+
+ return 0;
+}
+
+/*
+ * Create a session object.
+ * Note: object is not attached to client yet.
+ */
+struct tee_session *session_create(struct tee_client *client,
+ const struct mc_identity *identity)
+{
+ struct tee_session *session;
+ struct identity mcp_identity;
+
+ if (!IS_ERR_OR_NULL(identity)) {
+ /* Check identity method and data. */
+ int ret;
+
+ ret = check_prepare_identity(identity, &mcp_identity, current);
+ if (ret)
+ return ERR_PTR(ret);
+ }
+
+ /* Allocate session object */
+ session = kzalloc(sizeof(*session), GFP_KERNEL);
+ if (!session)
+ return ERR_PTR(-ENOMEM);
+
+ /* Increment debug counter */
+ atomic_inc(&g_ctx.c_sessions);
+ /* Initialise object members */
+ if (identity) {
+ session->is_gp = true;
+ iwp_session_init(&session->iwp_session, &mcp_identity);
+ } else {
+ session->is_gp = false;
+ mcp_session_init(&session->mcp_session);
+ }
+
+ client_get(client);
+ session->client = client;
+ kref_init(&session->kref);
+ INIT_LIST_HEAD(&session->list);
+ mutex_init(&session->wsms_lock);
+ mc_dev_devel("created session %p: client %p",
+ session, session->client);
+ return session;
+}
+
+/*
+ * Free session object and all objects it contains (wsm).
+ */
+static void session_release(struct kref *kref)
+{
+ struct tee_session *session;
+ int i;
+
+ /* Remove remaining shared buffers (unmapped in SWd by mcp_close) */
+ session = container_of(kref, struct tee_session, kref);
+ for (i = 0; i < MC_MAP_MAX; i++) {
+ if (!session->wsms[i].in_use)
+ continue;
+
+ mc_dev_devel("session %p: free wsm #%d", session, i);
+ wsm_free(session, &session->wsms[i]);
+ /* Buffer unmapped by SWd */
+ atomic_dec(&g_ctx.c_maps);
+ }
+
+ if (session->tci.in_use) {
+ mc_dev_devel("session %p: free tci", session);
+ wsm_free(session, &session->tci);
+ }
+
+ if (session->is_gp)
+ mc_dev_devel("freed GP session %p: client %p id %x", session,
+ session->client, session->iwp_session.sid);
+ else
+ mc_dev_devel("freed MC session %p: client %p id %x", session,
+ session->client, session->mcp_session.sid);
+
+ client_put(session->client);
+ kfree(session);
+ /* Decrement debug counter */
+ atomic_dec(&g_ctx.c_sessions);
+}
+
+/*
+ * Unreference session.
+ * Free session object if reference reaches 0.
+ */
+int session_put(struct tee_session *session)
+{
+ return kref_put(&session->kref, session_release);
+}
+
+static int wsm_debug_structs(struct kasnprintf_buf *buf, struct tee_wsm *wsm,
+ int no)
+{
+ ssize_t ret;
+
+ if (!wsm->in_use)
+ return 0;
+
+ ret = kasnprintf(buf, "\t\t");
+ if (no < 0)
+ ret = kasnprintf(buf, "tci %pK: cbuf %pK va %pK len %u\n",
+ wsm, wsm->cbuf, (void *)wsm->va, wsm->len);
+ else if (wsm->in_use)
+ ret = kasnprintf(buf,
+ "wsm #%d: cbuf %pK va %pK len %u sva %x\n",
+ no, wsm->cbuf, (void *)wsm->va, wsm->len,
+ wsm->sva);
+
+ if (ret < 0)
+ return ret;
+
+ if (wsm->mmu) {
+ ret = tee_mmu_debug_structs(buf, wsm->mmu);
+ if (ret < 0)
+ return ret;
+ }
+
+ return 0;
+}
+
+int session_mc_open_session(struct tee_session *session,
+ struct mcp_open_info *info)
+{
+ struct tee_wsm *wsm = &session->tci;
+ bool tci_in_use = false;
+ int ret;
+
+ /* Check that tci and its length make sense */
+ if (info->tci_len > MC_MAX_TCI_LEN)
+ return -EINVAL;
+
+ if (!info->tci_va != !info->tci_len) {
+ mc_dev_devel("TCI pointer and length are inconsistent");
+ return -EINVAL;
+ }
+
+ /* Add existing TCI map */
+ if (info->tci_mmu) {
+ ret = wsm_wrap(session, wsm, info->tci_mmu);
+ if (ret)
+ return ret;
+
+ tci_in_use = true;
+ mc_dev_devel("wrapped tci: mmu %p len %u flags %x",
+ wsm->mmu, wsm->len, wsm->flags);
+ }
+
+ /* Create mapping for TCI */
+ if (info->tci_va) {
+ struct mc_ioctl_buffer buf = {
+ .va = info->tci_va,
+ .len = info->tci_len,
+ .flags = MC_IO_MAP_INPUT_OUTPUT,
+ };
+
+ ret = wsm_create(session, wsm, &buf);
+ if (ret)
+ return ret;
+
+ tci_in_use = true;
+ info->tci_mmu = wsm->mmu;
+ mc_dev_devel(
+ "created tci: mmu %p cbuf %p va %lx len %u flags %x",
+ wsm->mmu, wsm->cbuf, wsm->va, wsm->len, wsm->flags);
+ }
+
+ ret = mcp_open_session(&session->mcp_session, info, &tci_in_use);
+ if (info->tci_va && (ret || !tci_in_use))
+ wsm_free(session, &session->tci);
+
+ return ret;
+}
+
+/*
+ * Close session and unreference session object.
+ * Session object is assumed to have been removed from main list, which means
+ * that session_close cannot be called anymore.
+ */
+int session_close(struct tee_session *session)
+{
+ int ret;
+
+ if (session->is_gp) {
+ ret = iwp_close_session(&session->iwp_session);
+ if (!ret)
+ mc_dev_devel("closed GP session %x",
+ session->iwp_session.sid);
+ } else {
+ ret = mcp_close_session(&session->mcp_session);
+ if (!ret)
+ mc_dev_devel("closed MC session %x",
+ session->mcp_session.sid);
+ }
+ return ret;
+}
+
+/*
+ * Session is to be removed from NWd records as SWd is dead
+ */
+int session_mc_cleanup_session(struct tee_session *session)
+{
+ mcp_cleanup_session(&session->mcp_session);
+ return session_put(session);
+}
+
+/*
+ * Send a notification to TA
+ */
+int session_mc_notify(struct tee_session *session)
+{
+ if (!session) {
+ mc_dev_devel("Session pointer is null");
+ return -EINVAL;
+ }
+
+ return mcp_notify(&session->mcp_session);
+}
+
+/*
+ * Sleep until next notification from SWd.
+ */
+int session_mc_wait(struct tee_session *session, s32 timeout,
+ bool silent_expiry)
+{
+ return mcp_wait(&session->mcp_session, timeout, silent_expiry);
+}
+
+/*
+ * Share buffers with SWd and add corresponding WSM objects to session.
+ * This may involve some re-use or cleanup of inactive mappings.
+ */
+int session_mc_map(struct tee_session *session, struct tee_mmu *mmu,
+ struct mc_ioctl_buffer *buf)
+{
+ struct tee_wsm *wsm;
+ u32 sva;
+ int i, ret;
+
+ mutex_lock(&session->wsms_lock);
+ /* Look for an available slot in the session WSMs array */
+ for (i = 0; i < MC_MAP_MAX; i++)
+ if (!session->wsms[i].in_use)
+ break;
+
+ if (i == MC_MAP_MAX) {
+ ret = -EPERM;
+ mc_dev_devel("no available WSM slot in session %x",
+ session->mcp_session.sid);
+ goto out;
+ }
+
+ wsm = &session->wsms[i];
+ if (!mmu)
+ ret = wsm_create(session, wsm, buf);
+ else
+ ret = wsm_wrap(session, wsm, mmu);
+
+ if (ret) {
+ mc_dev_devel("maps[%d] va=%llx create failed: %d",
+ i, buf->va, ret);
+ goto out;
+ }
+
+ mc_dev_devel("created wsm #%d: mmu %p cbuf %p va %lx len %u flags %x",
+ i, wsm->mmu, wsm->cbuf, wsm->va, wsm->len, wsm->flags);
+ ret = mcp_map(session->mcp_session.sid, wsm->mmu, &sva);
+ if (ret) {
+ wsm_free(session, wsm);
+ } else {
+ buf->sva = sva;
+ wsm->sva = sva;
+ }
+
+out:
+ mutex_unlock(&session->wsms_lock);
+ mc_dev_devel("ret=%d", ret);
+ return ret;
+}
+
+/*
+ * In theory, stop sharing buffers with the SWd. In fact, mark them inactive.
+ */
+int session_mc_unmap(struct tee_session *session,
+ const struct mc_ioctl_buffer *buf)
+{
+ struct tee_wsm *wsm;
+ struct mcp_buffer_map map;
+ int i, ret = -EINVAL;
+
+ mutex_lock(&session->wsms_lock);
+ /* Look for buffer in the session WSMs array */
+ for (i = 0; i < MC_MAP_MAX; i++)
+ if (session->wsms[i].in_use &&
+ buf->va == session->wsms[i].va &&
+ buf->len == session->wsms[i].len &&
+ buf->sva == session->wsms[i].sva)
+ break;
+
+ if (i == MC_MAP_MAX) {
+ ret = -EINVAL;
+ mc_dev_devel("maps[%d] va=%llx sva=%llx not found",
+ i, buf[i].va, buf[i].sva);
+ goto out;
+ }
+
+ wsm = &session->wsms[i];
+ tee_mmu_buffer(wsm->mmu, &map);
+ map.secure_va = wsm->sva;
+
+ ret = mcp_unmap(session->mcp_session.sid, &map);
+ if (!ret)
+ wsm_free(session, wsm);
+
+out:
+ mutex_unlock(&session->wsms_lock);
+ return ret;
+}
+
+/*
+ * Read and clear last notification received from TA
+ */
+int session_mc_get_err(struct tee_session *session, s32 *err)
+{
+ return mcp_get_err(&session->mcp_session, err);
+}
+
+static void unmap_gp_bufs(struct tee_session *session,
+ struct iwp_buffer_map *maps)
+{
+ int i;
+
+ /* Create WSMs from bufs */
+ mutex_lock(&session->wsms_lock);
+ for (i = 0; i < MC_MAP_MAX; i++) {
+ if (session->wsms[i].in_use)
+ wsm_free(session, &session->wsms[i]);
+
+ if (maps[i].sva)
+ client_put_cwsm_sva(session->client, maps[i].sva);
+ }
+ mutex_unlock(&session->wsms_lock);
+}
+
+static int map_gp_bufs(struct tee_session *session,
+ const struct mc_ioctl_buffer *bufs,
+ struct gp_shared_memory **parents,
+ struct iwp_buffer_map *maps)
+{
+ int i, ret = 0;
+
+ /* Create WSMs from bufs */
+ mutex_lock(&session->wsms_lock);
+ for (i = 0; i < MC_MAP_MAX; i++) {
+ /* Reset reference for temporary memory */
+ maps[i].map.addr = 0;
+ /* Reset reference for registered memory */
+ maps[i].sva = 0;
+ if (bufs[i].va) {
+ /* Temporary memory, needs mapping */
+ ret = wsm_create(session, &session->wsms[i], &bufs[i]);
+ if (ret) {
+ mc_dev_devel(
+ "maps[%d] va=%llx create failed: %d",
+ i, bufs[i].va, ret);
+ break;
+ }
+
+ tee_mmu_buffer(session->wsms[i].mmu, &maps[i].map);
+ } else if (parents[i]) {
+ /* Registered memory, already mapped */
+ maps[i].sva = client_get_cwsm_sva(session->client,
+ parents[i]);
+ if (!maps[i].sva) {
+ ret = -EINVAL;
+ mc_dev_devel("couldn't find shared mem");
+ break;
+ }
+
+ mc_dev_devel("param[%d] has sva %x", i, maps[i].sva);
+ }
+ }
+ mutex_unlock(&session->wsms_lock);
+
+ /* Failed above */
+ if (i < MC_MAP_MAX)
+ unmap_gp_bufs(session, maps);
+
+ return ret;
+}
+
+int session_gp_open_session(struct tee_session *session,
+ const struct mc_uuid_t *uuid,
+ struct gp_operation *operation,
+ struct gp_return *gp_ret)
+{
+ /* TEEC_MEMREF_TEMP_* buffers to map */
+ struct mc_ioctl_buffer bufs[MC_MAP_MAX];
+ struct iwp_buffer_map maps[MC_MAP_MAX];
+ struct gp_shared_memory *parents[MC_MAP_MAX] = { NULL };
+ struct client_gp_operation client_operation;
+ int ret = 0;
+
+ ret = iwp_open_session_prepare(&session->iwp_session, operation, bufs,
+ parents, gp_ret);
+ if (ret)
+ return ret;
+
+ /* Create WSMs from bufs */
+ ret = map_gp_bufs(session, bufs, parents, maps);
+ if (ret) {
+ iwp_open_session_abort(&session->iwp_session);
+ return iwp_set_ret(ret, gp_ret);
+ }
+
+ /* Tell client about operation */
+ client_operation.started = operation->started;
+ client_operation.slot = iwp_session_slot(&session->iwp_session);
+ client_operation.cancelled = false;
+ if (!client_gp_operation_add(session->client, &client_operation)) {
+ iwp_open_session_abort(&session->iwp_session);
+ return iwp_set_ret(-ECANCELED, gp_ret);
+ }
+
+ /* Open/call TA */
+ ret = iwp_open_session(&session->iwp_session, uuid, operation, maps,
+ NULL, NULL, gp_ret);
+ /* Cleanup */
+ client_gp_operation_remove(session->client, &client_operation);
+ unmap_gp_bufs(session, maps);
+ return ret;
+}
+
+int session_gp_open_session_domu(struct tee_session *session,
+ const struct mc_uuid_t *uuid, u64 started,
+ struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret)
+{
+ /* TEEC_MEMREF_TEMP_* buffers to map */
+ struct client_gp_operation client_operation;
+ int ret = 0;
+
+ ret = iwp_open_session_prepare(&session->iwp_session, NULL, NULL, NULL,
+ gp_ret);
+ if (ret)
+ return ret;
+
+ /* Tell client about operation */
+ client_operation.started = started;
+ client_operation.slot = iwp_session_slot(&session->iwp_session);
+ client_operation.cancelled = false;
+ if (!client_gp_operation_add(session->client, &client_operation)) {
+ iwp_open_session_abort(&session->iwp_session);
+ return iwp_set_ret(-ECANCELED, gp_ret);
+ }
+
+ /* Open/call TA */
+ ret = iwp_open_session(&session->iwp_session, uuid, NULL, NULL, iws,
+ mmus, gp_ret);
+ /* Cleanup */
+ client_gp_operation_remove(session->client, &client_operation);
+ return ret;
+}
+
+int session_gp_invoke_command(struct tee_session *session, u32 command_id,
+ struct gp_operation *operation,
+ struct gp_return *gp_ret)
+{
+ /* TEEC_MEMREF_TEMP_* buffers to map */
+ struct mc_ioctl_buffer bufs[4];
+ struct iwp_buffer_map maps[MC_MAP_MAX];
+ struct gp_shared_memory *parents[MC_MAP_MAX] = { NULL };
+ struct client_gp_operation client_operation;
+ int ret = 0;
+
+ ret = iwp_invoke_command_prepare(&session->iwp_session, command_id,
+ operation, bufs, parents, gp_ret);
+ if (ret)
+ return ret;
+
+ /* Create WSMs from bufs */
+ ret = map_gp_bufs(session, bufs, parents, maps);
+ if (ret) {
+ iwp_invoke_command_abort(&session->iwp_session);
+ return iwp_set_ret(ret, gp_ret);
+ }
+
+ /* Tell client about operation */
+ client_operation.started = operation->started;
+ client_operation.slot = iwp_session_slot(&session->iwp_session);
+ client_operation.cancelled = false;
+ if (!client_gp_operation_add(session->client, &client_operation)) {
+ iwp_invoke_command_abort(&session->iwp_session);
+ return iwp_set_ret(-ECANCELED, gp_ret);
+ }
+
+ /* Call TA */
+ ret = iwp_invoke_command(&session->iwp_session, operation, maps, NULL,
+ NULL, gp_ret);
+ /* Cleanup */
+ client_gp_operation_remove(session->client, &client_operation);
+ unmap_gp_bufs(session, maps);
+ return ret;
+}
+
+int session_gp_invoke_command_domu(struct tee_session *session,
+ u64 started, struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret)
+{
+ struct client_gp_operation client_operation;
+ int ret = 0;
+
+ ret = iwp_invoke_command_prepare(&session->iwp_session, 0, NULL, NULL,
+ NULL, gp_ret);
+ if (ret)
+ return ret;
+
+ /* Tell client about operation */
+ client_operation.started = started;
+ client_operation.slot = iwp_session_slot(&session->iwp_session);
+ client_operation.cancelled = false;
+ if (!client_gp_operation_add(session->client, &client_operation)) {
+ iwp_invoke_command_abort(&session->iwp_session);
+ return iwp_set_ret(-ECANCELED, gp_ret);
+ }
+
+ /* Call TA */
+ ret = iwp_invoke_command(&session->iwp_session, NULL, NULL, iws, mmus,
+ gp_ret);
+ /* Cleanup */
+ client_gp_operation_remove(session->client, &client_operation);
+ return ret;
+}
+
+int session_gp_request_cancellation(u64 slot)
+{
+ return iwp_request_cancellation(slot);
+}
+
+int session_debug_structs(struct kasnprintf_buf *buf,
+ struct tee_session *session, bool is_closing)
+{
+ const char *type;
+ u32 session_id;
+ s32 err;
+ int i, ret;
+
+ if (session->is_gp) {
+ session_id = session->iwp_session.sid;
+ err = 0;
+ type = "GP";
+ } else {
+ session_id = session->mcp_session.sid;
+ session_mc_get_err(session, &err);
+ type = "MC";
+ }
+
+ ret = kasnprintf(buf, "\tsession %pK [%d]: %4x %s ec %d%s\n",
+ session, kref_read(&session->kref), session_id, type,
+ err, is_closing ? " <closing>" : "");
+ if (ret < 0)
+ return ret;
+
+ /* TCI */
+ if (session->tci.in_use) {
+ ret = wsm_debug_structs(buf, &session->tci, -1);
+ if (ret < 0)
+ return ret;
+ }
+
+ /* WMSs */
+ mutex_lock(&session->wsms_lock);
+ for (i = 0; i < MC_MAP_MAX; i++) {
+ ret = wsm_debug_structs(buf, &session->wsms[i], i);
+ if (ret < 0)
+ break;
+ }
+ mutex_unlock(&session->wsms_lock);
+ if (ret < 0)
+ return ret;
+
+ return 0;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/session.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/session.h
new file mode 100644
index 0000000..214d044
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/session.h
@@ -0,0 +1,104 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _SESSION_H_
+#define _SESSION_H_
+
+#include <linux/list.h>
+
+#include "mcp.h"
+#include "iwp.h"
+
+struct tee_object;
+struct tee_mmu;
+struct mc_ioctl_buffer;
+
+struct tee_wsm {
+ /* Buffer NWd address (uva or kva, used only for lookup) */
+ uintptr_t va;
+ /* Buffer length */
+ u32 len;
+ /* Buffer flags */
+ u32 flags;
+ /* Buffer SWd address */
+ u32 sva;
+ union {
+ /* MMU table */
+ struct tee_mmu *mmu;
+ /* Index of re-used buffer (temporary) */
+ int index;
+ };
+ /* Pointer to associated cbuf, if relevant */
+ struct cbuf *cbuf;
+ /* State of this WSM */
+ int in_use;
+};
+
+struct tee_session {
+ /* Session descriptor */
+ union {
+ struct mcp_session mcp_session;
+ struct iwp_session iwp_session;
+ };
+ /* Owner */
+ struct tee_client *client;
+ /* Number of references kept to this object */
+ struct kref kref;
+ /* WSM for the TCI */
+ struct tee_wsm tci;
+ /* The list entry to attach to session list of owner */
+ struct list_head list;
+ /* Session WSMs lock */
+ struct mutex wsms_lock;
+ /* WSMs for a session */
+ struct tee_wsm wsms[MC_MAP_MAX];
+ /* This TA is of Global Platform type */
+ bool is_gp;
+};
+
+struct tee_session *session_create(struct tee_client *client,
+ const struct mc_identity *identity);
+static inline void session_get(struct tee_session *session)
+{
+ kref_get(&session->kref);
+}
+
+int session_put(struct tee_session *session);
+int session_close(struct tee_session *session);
+
+int session_mc_open_session(struct tee_session *session,
+ struct mcp_open_info *info);
+int session_mc_cleanup_session(struct tee_session *session);
+int session_mc_notify(struct tee_session *session);
+int session_mc_wait(struct tee_session *session, s32 timeout,
+ bool silent_expiry);
+int session_mc_map(struct tee_session *session, struct tee_mmu *mmu,
+ struct mc_ioctl_buffer *bufs);
+int session_mc_unmap(struct tee_session *session,
+ const struct mc_ioctl_buffer *bufs);
+int session_mc_get_err(struct tee_session *session, s32 *err);
+
+int session_gp_open_session(struct tee_session *session,
+ const struct mc_uuid_t *uuid,
+ struct gp_operation *operation,
+ struct gp_return *gp_ret);
+int session_gp_open_session_domu(struct tee_session *session,
+ const struct mc_uuid_t *uuid, u64 started,
+ struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret);
+int session_gp_invoke_command(struct tee_session *session, u32 command_id,
+ struct gp_operation *operation,
+ struct gp_return *gp_ret);
+int session_gp_invoke_command_domu(struct tee_session *session,
+ u64 started, struct interworld_session *iws,
+ struct tee_mmu **mmus,
+ struct gp_return *gp_ret);
+int session_gp_request_cancellation(u64 slot);
+
+int session_debug_structs(struct kasnprintf_buf *buf,
+ struct tee_session *session, bool is_closing);
+
+#endif /* _SESSION_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/teeclientapi.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/teeclientapi.c
new file mode 100644
index 0000000..466efcf
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/teeclientapi.c
@@ -0,0 +1,586 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/vmalloc.h>
+#include <linux/export.h>
+
+#include "public/GP/tee_client_api.h"
+#include "public/mc_user.h"
+
+#include "main.h"
+#include "mci/mcinq.h" /* TA termination codes */
+#include "client.h"
+
+/* Macros */
+#define _TEEC_GET_PARAM_TYPE(t, i) (((t) >> (4 * (i))) & 0xF)
+
+/* Parameter number */
+#define _TEEC_PARAMETER_NUMBER 4
+
+/**teec_shared_memory
+ * These error codes are still to be decided by GP and as we do not wish to
+ * expose any part of the GP TAF as of yet, for now they will have to live here
+ * until we decide what to do about them.
+ */
+#define TEEC_ERROR_TA_LOCKED 0xFFFF0257
+#define TEEC_ERROR_SD_BLOCKED 0xFFFF0258
+#define TEEC_ERROR_TARGET_KILLED 0xFFFF0259
+
+static DECLARE_WAIT_QUEUE_HEAD(operations_wq);
+
+static void _lib_uuid_to_array(const struct teec_uuid *uuid, u8 *uuid_array)
+{
+ u8 *identifier_cursor = (u8 *)uuid;
+ /* offsets and syntax constants. See explanations above */
+#ifdef S_BIG_ENDIAN
+ u32 offsets = 0;
+#else
+ u32 offsets = 0xF1F1DF13;
+#endif
+ u32 i;
+
+ for (i = 0; i < sizeof(struct teec_uuid); i++) {
+ /* Two-digit hex number */
+ s32 offset = ((s32)((offsets & 0xF) << 28)) >> 28;
+ u8 number = identifier_cursor[offset];
+
+ offsets >>= 4;
+ identifier_cursor++;
+
+ uuid_array[i] = number;
+ }
+}
+
+static u32 _teec_to_gp_operation(struct teec_operation *teec_op,
+ struct gp_operation *gp_op)
+{
+ int i;
+ int ret = 0;
+
+ for (i = 0; i < _TEEC_PARAMETER_NUMBER; i++) {
+ switch (_TEEC_GET_PARAM_TYPE(teec_op->param_types, i)) {
+ case TEEC_VALUE_INPUT:
+ case TEEC_VALUE_INOUT:
+ gp_op->params[i].value.a = teec_op->params[i].value.a;
+ gp_op->params[i].value.b = teec_op->params[i].value.b;
+ break;
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ gp_op->params[i].tmpref.buffer =
+ (uintptr_t)teec_op->params[i].tmpref.buffer;
+ gp_op->params[i].tmpref.size =
+ teec_op->params[i].tmpref.size;
+ break;
+ case TEEC_MEMREF_WHOLE:
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ gp_op->params[i].memref.offset =
+ teec_op->params[i].memref.offset;
+ gp_op->params[i].memref.size =
+ teec_op->params[i].memref.size;
+ gp_op->params[i].memref.parent.buffer =
+ (uintptr_t)teec_op->params[i].memref.parent->buffer;
+ gp_op->params[i].memref.parent.size =
+ teec_op->params[i].memref.parent->size;
+ gp_op->params[i].memref.parent.flags =
+ teec_op->params[i].memref.parent->flags;
+ break;
+ case TEEC_NONE:
+ case TEEC_VALUE_OUTPUT:
+ break;
+ default:
+ ret = -EINVAL;
+ }
+ }
+ gp_op->param_types = teec_op->param_types;
+ return ret;
+}
+
+static void _teec_from_gp_operation(struct gp_operation *gp_op,
+ struct teec_operation *teec_op)
+{
+ int i;
+
+ for (i = 0; i < _TEEC_PARAMETER_NUMBER; i++) {
+ switch (_TEEC_GET_PARAM_TYPE(gp_op->param_types, i)) {
+ case TEEC_VALUE_OUTPUT:
+ case TEEC_VALUE_INOUT:
+ teec_op->params[i].value.a = gp_op->params[i].value.a;
+ teec_op->params[i].value.b = gp_op->params[i].value.b;
+ break;
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ teec_op->params[i].tmpref.size =
+ gp_op->params[i].tmpref.size;
+ break;
+ case TEEC_MEMREF_WHOLE:
+ break;
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ teec_op->params[i].memref.size =
+ gp_op->params[i].memref.size;
+ break;
+ case TEEC_NONE:
+ case TEEC_VALUE_INPUT:
+ break;
+ default:
+ break;
+ }
+ }
+}
+
+static u32 _teec_convert_error(int errno)
+{
+ switch (errno) {
+ case ENOENT:
+ return TEEC_ERROR_ITEM_NOT_FOUND;
+ case EACCES:
+ return TEEC_ERROR_ACCESS_DENIED;
+ case EINVAL:
+ return TEEC_ERROR_BAD_PARAMETERS;
+ case ENOSPC:
+ return TEEC_ERROR_OUT_OF_MEMORY;
+ case ECONNREFUSED:
+ return TEEC_ERROR_SD_BLOCKED;
+ case ECONNABORTED:
+ return TEEC_ERROR_TA_LOCKED;
+ case ECONNRESET:
+ return TEEC_ERROR_TARGET_KILLED;
+ case EBUSY:
+ return TEEC_ERROR_BUSY;
+ case EKEYREJECTED:
+ return TEEC_ERROR_SECURITY;
+ case ETIME:
+ return TEEC_ERROR_TARGET_DEAD;
+ default:
+ return TEEC_ERROR_GENERIC;
+ }
+}
+
+/* teec_initialize_context: TEEC_SUCCESS, Another error code from Table 4-2 */
+u32 teec_initialize_context(const char *name, struct teec_context *context)
+{
+ struct tee_client *client;
+ int ret;
+ (void)name;
+
+ mc_dev_devel("== %s() ==============", __func__);
+
+ if (!context) {
+ mc_dev_devel("context is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ /* Make sure TEE was started */
+ ret = mc_wait_tee_start();
+ if (ret) {
+ mc_dev_err(ret, "TEE failed to start, now or in the past");
+ return TEEC_ERROR_BAD_STATE;
+ }
+
+ /* Create client */
+ client = client_create(true);
+ if (!client)
+ return TEEC_ERROR_OUT_OF_MEMORY;
+
+ /* Store client in context */
+ context->imp.client = client;
+
+ return TEEC_SUCCESS;
+}
+EXPORT_SYMBOL(teec_initialize_context);
+
+/*
+ * The implementation of this function MUST NOT be able to fail: after this
+ * function returns the Client Application must be able to consider that the
+ * Context has been closed
+ */
+void teec_finalize_context(struct teec_context *context)
+{
+ mc_dev_devel("== %s() ==============", __func__);
+
+ /* The parameter context MUST point to an initialized TEE Context */
+ if (!context) {
+ mc_dev_devel("context is NULL");
+ return;
+ }
+
+ /* The implementation of this function MUST NOT be able to fail: after
+ * this function returns the Client Application must be able to
+ * consider that the Context has been closed
+ */
+ client_close(context->imp.client);
+ context->imp.client = NULL;
+}
+EXPORT_SYMBOL(teec_finalize_context);
+
+/*
+ * If the return_origin is different from TEEC_ORIGIN_TRUSTED_APP, an error code
+ * from Table 4-2. If the return_origin is equal to TEEC_ORIGIN_TRUSTED_APP, a
+ * return code defined by the protocol between the Client Application and the
+ * Trusted Application
+ */
+u32 teec_open_session(struct teec_context *context,
+ struct teec_session *session,
+ const struct teec_uuid *destination,
+ u32 connection_method,
+ const void *connection_data,
+ struct teec_operation *operation,
+ u32 *return_origin)
+{
+ struct mc_uuid_t uuid;
+ struct mc_identity identity = {0};
+ struct tee_client *client = NULL;
+ struct gp_operation gp_op;
+ struct gp_return gp_ret;
+ int ret = 0, timeout;
+
+ mc_dev_devel("== %s() ==============", __func__);
+ gp_ret.value = TEEC_SUCCESS;
+ if (return_origin)
+ *return_origin = TEEC_ORIGIN_API;
+
+ /* The parameter context MUST point to an initialized TEE Context */
+ if (!context) {
+ mc_dev_devel("context is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ if (!context->imp.client) {
+ mc_dev_devel("context not initialized");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ client = context->imp.client;
+
+ if (!session) {
+ mc_dev_devel("session is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ connection_method = TEEC_TT_LOGIN_KERNEL;
+ session->imp.active = false;
+
+ _lib_uuid_to_array(destination, uuid.value);
+
+ memset(&gp_op, 0, sizeof(gp_op));
+ if (operation) {
+ operation->imp.session = &session->imp;
+ ret = _teec_to_gp_operation(operation, &gp_op);
+ if (ret)
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ identity.login_type = (enum mc_login_type)connection_method;
+
+ /* Wait for GP loading to be possible, maximum 30s */
+ timeout = 30;
+ do {
+ ret = client_gp_open_session(client, &uuid, &gp_op, &identity,
+ &gp_ret, &session->imp.session_id);
+ if (!ret || ret != EAGAIN)
+ break;
+
+ msleep(1000);
+ } while (--timeout);
+
+ if (ret || gp_ret.value != TEEC_SUCCESS) {
+ mc_dev_devel("client_gp_open_session failed(%08x) %08x", ret,
+ gp_ret.value);
+ if (ret)
+ gp_ret.value = _teec_convert_error(-ret);
+ else if (return_origin)
+ /* Update origin as it's not the API */
+ *return_origin = gp_ret.origin;
+ } else {
+ mc_dev_devel(" created session ID %x", session->imp.session_id);
+ session->imp.context = context->imp;
+ session->imp.active = true;
+ if (operation)
+ _teec_from_gp_operation(&gp_op, operation);
+ }
+
+ mc_dev_devel(" %s() = 0x%x", __func__, gp_ret.value);
+ return gp_ret.value;
+}
+EXPORT_SYMBOL(teec_open_session);
+
+u32 teec_invoke_command(struct teec_session *session,
+ u32 command_id,
+ struct teec_operation *operation,
+ u32 *return_origin)
+{
+ struct tee_client *client = NULL;
+ struct gp_operation gp_op = {0};
+ struct gp_return gp_ret = {0};
+ int ret = 0;
+
+ mc_dev_devel("== %s() ==============", __func__);
+
+ gp_ret.value = TEEC_SUCCESS;
+ if (return_origin)
+ *return_origin = TEEC_ORIGIN_API;
+
+ if (!session) {
+ mc_dev_devel("session is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ if (!session->imp.active) {
+ mc_dev_devel("session is inactive");
+ return TEEC_ERROR_BAD_STATE;
+ }
+ client = session->imp.context.client;
+
+ if (operation) {
+ operation->imp.session = &session->imp;
+ if (_teec_to_gp_operation(operation, &gp_op))
+ return TEEC_ERROR_BAD_PARAMETERS;
+ } else {
+ gp_op.param_types = 0;
+ }
+
+ ret = client_gp_invoke_command(client, session->imp.session_id,
+ command_id, &gp_op, &gp_ret);
+
+ if (ret || gp_ret.value != TEEC_SUCCESS) {
+ mc_dev_devel("client_gp_invoke_command failed(%08x) %08x", ret,
+ gp_ret.value);
+ if (ret)
+ gp_ret.value = _teec_convert_error(-ret);
+ else if (return_origin)
+ /* Update origin as it's not the API */
+ *return_origin = gp_ret.origin;
+ } else if (operation) {
+ _teec_from_gp_operation(&gp_op, operation);
+ }
+
+ mc_dev_devel(" %s() = 0x%x", __func__, gp_ret.value);
+ return gp_ret.value;
+}
+EXPORT_SYMBOL(teec_invoke_command);
+
+void teec_close_session(struct teec_session *session)
+{
+ int ret = 0;
+ struct tee_client *client = NULL;
+
+ mc_dev_devel("== %s() ==============", __func__);
+
+ /* The implementation MUST do nothing if session is NULL */
+ if (!session) {
+ mc_dev_devel("session is NULL");
+ return;
+ }
+ client = session->imp.context.client;
+
+ if (session->imp.active) {
+ ret = client_gp_close_session(client, session->imp.session_id);
+
+ if (ret)
+ /* continue even in case of error */
+ mc_dev_devel("client_gp_close failed(%08x)", ret);
+
+ session->imp.active = false;
+ }
+
+ mc_dev_devel(" %s() = 0x%x", __func__, ret);
+}
+EXPORT_SYMBOL(teec_close_session);
+
+/*
+ * Implementation note. We handle internally 2 kind of pointers : kernel memory
+ * (kmalloc, get_pages, ...) and dynamic memory (vmalloc). A global pointer from
+ * a kernel module has the same format as a vmalloc buffer. However, our code
+ * cannot detect that, so it considers it a kmalloc buffer. The TA trying to use
+ * that shared buffer is likely to crash
+ */
+u32 teec_register_shared_memory(struct teec_context *context,
+ struct teec_shared_memory *shared_mem)
+{
+ struct gp_shared_memory memref;
+ struct gp_return gp_ret;
+ int ret = 0;
+
+ mc_dev_devel("== %s() ==============", __func__);
+
+ /* The parameter context MUST point to an initialized TEE Context */
+ if (!context) {
+ mc_dev_devel("context is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ /*
+ * The parameter shared_mem MUST point to the Shared Memory structure
+ * defining the memory region to register
+ */
+ if (!shared_mem) {
+ mc_dev_devel("shared_mem is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ /*
+ * The buffer field MUST point to the memory region to be shared,
+ * and MUST not be NULL
+ */
+ if (!shared_mem->buffer) {
+ mc_dev_devel("shared_mem->buffer is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ if (shared_mem->flags & ~TEEC_MEM_INOUT) {
+ mc_dev_devel("shared_mem->flags is incorrect");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ if (!shared_mem->flags) {
+ mc_dev_devel("shared_mem->flags is incorrect");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ memref.buffer = (uintptr_t)shared_mem->buffer;
+ memref.flags = shared_mem->flags;
+ memref.size = shared_mem->size;
+ ret = client_gp_register_shared_mem(context->imp.client, NULL, NULL,
+ &memref, &gp_ret);
+
+ if (ret)
+ return _teec_convert_error(-ret);
+
+ shared_mem->imp.client = context->imp.client;
+ shared_mem->imp.implementation_allocated = false;
+
+ return TEEC_SUCCESS;
+}
+EXPORT_SYMBOL(teec_register_shared_memory);
+
+u32 teec_allocate_shared_memory(struct teec_context *context,
+ struct teec_shared_memory *shared_mem)
+{
+ struct gp_shared_memory memref;
+ struct gp_return gp_ret;
+ int ret = 0;
+
+ /* No connection to "context"? */
+ mc_dev_devel("== %s() ==============", __func__);
+
+ /* The parameter context MUST point to an initialized TEE Context */
+ if (!context) {
+ mc_dev_devel("context is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ /*
+ * The parameter shared_mem MUST point to the Shared Memory structure
+ * defining the memory region to register
+ */
+ if (!shared_mem) {
+ mc_dev_devel("shared_mem is NULL");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ if (shared_mem->flags & ~TEEC_MEM_INOUT) {
+ mc_dev_devel("shared_mem->flags is incorrect");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ if (!shared_mem->flags) {
+ mc_dev_devel("shared_mem->flags is incorrect");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ shared_mem->buffer = vmalloc(shared_mem->size);
+ if (!shared_mem->buffer)
+ return TEEC_ERROR_OUT_OF_MEMORY;
+
+ memref.buffer = (uintptr_t)shared_mem->buffer;
+ memref.flags = shared_mem->flags;
+ memref.size = shared_mem->size;
+ ret = client_gp_register_shared_mem(context->imp.client, NULL, NULL,
+ &memref, &gp_ret);
+
+ if (ret) {
+ vfree(shared_mem->buffer);
+ shared_mem->buffer = NULL;
+ shared_mem->size = 0;
+ return _teec_convert_error(-ret);
+ }
+
+ shared_mem->imp.client = context->imp.client;
+ shared_mem->imp.implementation_allocated = true;
+
+ return TEEC_SUCCESS;
+}
+EXPORT_SYMBOL(teec_allocate_shared_memory);
+
+void teec_release_shared_memory(struct teec_shared_memory *shared_mem)
+{
+ struct gp_shared_memory memref;
+
+ /* No connection to "context"? */
+ mc_dev_devel("== %s() ==============", __func__);
+
+ /* The implementation MUST do nothing if shared_mem is NULL */
+ if (!shared_mem) {
+ mc_dev_devel("shared_mem is NULL");
+ return;
+ }
+
+ memref.buffer = (uintptr_t)shared_mem->buffer;
+ memref.flags = shared_mem->flags;
+ memref.size = shared_mem->size;
+ (void)client_gp_release_shared_mem(shared_mem->imp.client, &memref);
+
+ /*
+ * For a memory buffer allocated using teec_allocate_shared_memory the
+ * Implementation MUST free the underlying memory
+ */
+ if (shared_mem->imp.implementation_allocated) {
+ if (shared_mem->buffer) {
+ vfree(shared_mem->buffer);
+ shared_mem->buffer = NULL;
+ shared_mem->size = 0;
+ }
+ }
+}
+EXPORT_SYMBOL(teec_release_shared_memory);
+
+void teec_request_cancellation(struct teec_operation *operation)
+{
+ struct teec_session_imp *session;
+ int ret;
+
+ mc_dev_devel("== %s() ==============", __func__);
+
+ ret = wait_event_interruptible(operations_wq, operation->started);
+ if (ret == -ERESTARTSYS) {
+ mc_dev_devel("signal received");
+ return;
+ }
+
+ mc_dev_devel("operation->started changed from 0 to %d",
+ operation->started);
+
+ if (operation->started > 1) {
+ mc_dev_devel("the operation has finished");
+ return;
+ }
+
+ session = operation->imp.session;
+ operation->started = 2;
+ wake_up_interruptible(&operations_wq);
+
+ if (!session->active) {
+ mc_dev_devel("Corresponding session is not active");
+ return;
+ }
+
+ /* TODO: handle cancellation */
+
+ /* Signal the Trustlet */
+ ret = client_notify_session(session->context.client,
+ session->session_id);
+ if (ret)
+ mc_dev_devel("Notify failed: %d", ret);
+}
+EXPORT_SYMBOL(teec_request_cancellation);
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/user.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/user.c
new file mode 100644
index 0000000..afcefe9
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/user.c
@@ -0,0 +1,405 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/export.h>
+#include <linux/fs.h>
+#include <linux/mm_types.h> /* struct vm_area_struct */
+#include <linux/uaccess.h>
+
+#include "public/mc_user.h"
+
+#include "main.h"
+#include "user.h"
+#include "client.h"
+#include "mcp.h" /* mcp_get_version */
+
+/*
+ * Get client object from file pointer
+ */
+static inline struct tee_client *get_client(struct file *file)
+{
+ return (struct tee_client *)file->private_data;
+}
+
+/*
+ * Callback for system open()
+ * A set of internal client data are created and initialized.
+ *
+ * @inode
+ * @file
+ * Returns 0 if OK or -ENOMEM if no allocation was possible.
+ */
+static int user_open(struct inode *inode, struct file *file)
+{
+ struct tee_client *client;
+
+ /* Create client */
+ mc_dev_devel("from %s (%d)", current->comm, current->pid);
+ client = client_create(false);
+ if (!client)
+ return -ENOMEM;
+
+ /* Store client in user file */
+ file->private_data = client;
+ return 0;
+}
+
+/*
+ * Callback for system close()
+ * The client object is freed.
+ * @inode
+ * @file
+ * Returns 0
+ */
+static int user_release(struct inode *inode, struct file *file)
+{
+ struct tee_client *client = get_client(file);
+
+ /* Close client */
+ mc_dev_devel("from %s (%d)", current->comm, current->pid);
+ if (!client)
+ return -EPROTO;
+
+ /* Detach client from user file */
+ file->private_data = NULL;
+
+ /* Destroy client, including remaining sessions */
+ client_close(client);
+ return 0;
+}
+
+/*
+ * Check r/w access to referenced memory
+ */
+static inline int ioctl_check_pointer(unsigned int cmd, int __user *uarg)
+{
+ int err = 0;
+
+ if (_IOC_DIR(cmd) & _IOC_READ)
+ err = !access_ok(VERIFY_WRITE, uarg, _IOC_SIZE(cmd));
+ else if (_IOC_DIR(cmd) & _IOC_WRITE)
+ err = !access_ok(VERIFY_READ, uarg, _IOC_SIZE(cmd));
+
+ if (err)
+ return -EFAULT;
+
+ return 0;
+}
+
+/*
+ * Callback for system ioctl()
+ * Implement most of ClientLib API functions
+ * @file pointer to file
+ * @cmd command
+ * @arg arguments
+ *
+ * Returns 0 for OK and an errno in case of error
+ */
+static long user_ioctl(struct file *file, unsigned int id, unsigned long arg)
+{
+ struct tee_client *client = get_client(file);
+ int __user *uarg = (int __user *)arg;
+ int ret = -EINVAL;
+
+ mc_dev_devel("%u from %s", _IOC_NR(id), current->comm);
+
+ if (!client)
+ return -EPROTO;
+
+ if (ioctl_check_pointer(id, uarg))
+ return -EFAULT;
+
+ switch (id) {
+ case MC_IO_HAS_SESSIONS:
+ /* Freeze the client */
+ if (client_has_sessions(client))
+ ret = -ENOTEMPTY;
+ else
+ ret = 0;
+ break;
+
+ case MC_IO_OPEN_SESSION: {
+ struct mc_ioctl_open_session session;
+
+ if (copy_from_user(&session, uarg, sizeof(session))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_mc_open_session(client, &session.uuid,
+ session.tci, session.tcilen,
+ &session.sid);
+ if (ret)
+ break;
+
+ if (copy_to_user(uarg, &session, sizeof(session))) {
+ ret = -EFAULT;
+ client_remove_session(client, session.sid);
+ break;
+ }
+ break;
+ }
+ case MC_IO_OPEN_TRUSTLET: {
+ struct mc_ioctl_open_trustlet trustlet;
+
+ if (copy_from_user(&trustlet, uarg, sizeof(trustlet))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_mc_open_trustlet(client, trustlet.spid,
+ trustlet.buffer, trustlet.tlen,
+ trustlet.tci, trustlet.tcilen,
+ &trustlet.sid);
+ if (ret)
+ break;
+
+ if (copy_to_user(uarg, &trustlet, sizeof(trustlet))) {
+ ret = -EFAULT;
+ client_remove_session(client, trustlet.sid);
+ break;
+ }
+ break;
+ }
+ case MC_IO_CLOSE_SESSION: {
+ u32 sid = (u32)arg;
+
+ ret = client_remove_session(client, sid);
+ break;
+ }
+ case MC_IO_NOTIFY: {
+ u32 sid = (u32)arg;
+
+ ret = client_notify_session(client, sid);
+ break;
+ }
+ case MC_IO_WAIT: {
+ struct mc_ioctl_wait wait;
+
+ if (copy_from_user(&wait, uarg, sizeof(wait))) {
+ ret = -EFAULT;
+ break;
+ }
+ ret = client_waitnotif_session(client, wait.sid, wait.timeout,
+ wait.partial);
+ break;
+ }
+ case MC_IO_MAP: {
+ struct mc_ioctl_map map;
+
+ if (copy_from_user(&map, uarg, sizeof(map))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_mc_map(client, map.sid, NULL, &map.buf);
+ if (ret)
+ break;
+
+ /* Fill in return struct */
+ if (copy_to_user(uarg, &map, sizeof(map))) {
+ ret = -EFAULT;
+ break;
+ }
+ break;
+ }
+ case MC_IO_UNMAP: {
+ struct mc_ioctl_map map;
+
+ if (copy_from_user(&map, uarg, sizeof(map))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_mc_unmap(client, map.sid, &map.buf);
+ break;
+ }
+ case MC_IO_ERR: {
+ struct mc_ioctl_geterr __user *uerr =
+ (struct mc_ioctl_geterr __user *)uarg;
+ u32 sid;
+ s32 exit_code;
+
+ if (get_user(sid, &uerr->sid)) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_get_session_exitcode(client, sid, &exit_code);
+ if (ret)
+ break;
+
+ /* Fill in return struct */
+ if (put_user(exit_code, &uerr->value)) {
+ ret = -EFAULT;
+ break;
+ }
+
+ break;
+ }
+ case MC_IO_VERSION: {
+ struct mc_version_info version_info;
+
+ ret = mcp_get_version(&version_info);
+ if (ret)
+ break;
+
+ if (copy_to_user(uarg, &version_info, sizeof(version_info)))
+ ret = -EFAULT;
+
+ break;
+ }
+ case MC_IO_GP_INITIALIZE_CONTEXT: {
+ struct mc_ioctl_gp_initialize_context context;
+
+ if (copy_from_user(&context, uarg, sizeof(context))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_gp_initialize_context(client, &context.ret);
+
+ if (copy_to_user(uarg, &context, sizeof(context))) {
+ ret = -EFAULT;
+ break;
+ }
+ break;
+ }
+ case MC_IO_GP_REGISTER_SHARED_MEM: {
+ struct mc_ioctl_gp_register_shared_mem shared_mem;
+
+ if (copy_from_user(&shared_mem, uarg, sizeof(shared_mem))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_gp_register_shared_mem(client, NULL, NULL,
+ &shared_mem.memref,
+ &shared_mem.ret);
+
+ if (copy_to_user(uarg, &shared_mem, sizeof(shared_mem))) {
+ ret = -EFAULT;
+ break;
+ }
+ break;
+ }
+ case MC_IO_GP_RELEASE_SHARED_MEM: {
+ struct mc_ioctl_gp_release_shared_mem shared_mem;
+
+ if (copy_from_user(&shared_mem, uarg, sizeof(shared_mem))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_gp_release_shared_mem(client, &shared_mem.memref);
+ break;
+ }
+ case MC_IO_GP_OPEN_SESSION: {
+ struct mc_ioctl_gp_open_session session;
+
+ if (copy_from_user(&session, uarg, sizeof(session))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_gp_open_session(client, &session.uuid,
+ &session.operation,
+ &session.identity,
+ &session.ret, &session.session_id);
+
+ if (copy_to_user(uarg, &session, sizeof(session))) {
+ ret = -EFAULT;
+ break;
+ }
+ break;
+ }
+ case MC_IO_GP_CLOSE_SESSION: {
+ struct mc_ioctl_gp_close_session session;
+
+ if (copy_from_user(&session, uarg, sizeof(session))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_gp_close_session(client, session.session_id);
+ break;
+ }
+ case MC_IO_GP_INVOKE_COMMAND: {
+ struct mc_ioctl_gp_invoke_command command;
+
+ if (copy_from_user(&command, uarg, sizeof(command))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ ret = client_gp_invoke_command(client, command.session_id,
+ command.command_id,
+ &command.operation,
+ &command.ret);
+
+ if (copy_to_user(uarg, &command, sizeof(command))) {
+ ret = -EFAULT;
+ break;
+ }
+ break;
+ }
+ case MC_IO_GP_REQUEST_CANCELLATION: {
+ struct mc_ioctl_gp_request_cancellation cancel;
+
+ if (copy_from_user(&cancel, uarg, sizeof(cancel))) {
+ ret = -EFAULT;
+ break;
+ }
+
+ client_gp_request_cancellation(client,
+ cancel.operation.started);
+ ret = 0;
+ break;
+ }
+ default:
+ ret = -ENOIOCTLCMD;
+ mc_dev_err(ret, "unsupported command no %d", id);
+ }
+
+ return ret;
+}
+
+/*
+ * Callback for system mmap()
+ */
+static int user_mmap(struct file *file, struct vm_area_struct *vmarea)
+{
+ struct tee_client *client = get_client(file);
+
+ if ((vmarea->vm_end - vmarea->vm_start) > BUFFER_LENGTH_MAX) {
+ mc_dev_err(-EINVAL, "buffer size %lu too big",
+ vmarea->vm_end - vmarea->vm_start);
+ return -EINVAL;
+ }
+
+ /* Alloc contiguous buffer for this client */
+ return client_cbuf_create(client,
+ (u32)(vmarea->vm_end - vmarea->vm_start),
+ NULL, vmarea);
+}
+
+static const struct file_operations mc_user_fops = {
+ .owner = THIS_MODULE,
+ .open = user_open,
+ .release = user_release,
+ .unlocked_ioctl = user_ioctl,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = user_ioctl,
+#endif
+ .mmap = user_mmap,
+};
+
+int mc_user_init(struct cdev *cdev)
+{
+ cdev_init(cdev, &mc_user_fops);
+ return 0;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/user.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/user.h
new file mode 100644
index 0000000..1ca59ae
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/user.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _USER_H_
+#define _USER_H_
+
+struct cdev;
+
+int mc_user_init(struct cdev *cdev);
+static inline void mc_user_exit(void)
+{
+}
+
+#endif /* _USER_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_be.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_be.c
new file mode 100644
index 0000000..3d4efb2
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_be.c
@@ -0,0 +1,1124 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifdef CONFIG_XEN
+
+#include <linux/delay.h>
+#include <linux/mm.h>
+#include <linux/mutex.h>
+#include <linux/version.h>
+#include <linux/vmalloc.h>
+
+#include "platform.h" /* MC_XENBUS_MAP_RING_VALLOC_4_1 */
+#include "main.h"
+#include "admin.h" /* tee_object* */
+#include "client.h" /* Consider other VMs as clients */
+#include "mmu.h"
+#include "mcp.h" /* mcp_get_version */
+#include "nq.h"
+#include "xen_common.h"
+#include "xen_be.h"
+
+#define vaddr(page) ((unsigned long)pfn_to_kaddr(page_to_pfn(page)))
+
+static struct {
+ struct list_head xfes;
+ struct mutex xfes_mutex; /* Protect the above */
+} l_ctx;
+
+/* Maps */
+
+struct xen_be_map {
+ struct page **pages;
+ grant_handle_t *handles;
+ unsigned long nr_pages;
+ u32 flags;
+ bool pages_allocd;
+ bool refs_mapped;
+ /* To auto-delete */
+ struct tee_deleter deleter;
+};
+
+static void xen_be_map_delete(struct xen_be_map *map)
+{
+ int i;
+
+ if (map->refs_mapped) {
+ struct gnttab_unmap_grant_ref *unmaps;
+
+ unmaps = kcalloc(map->nr_pages, sizeof(*unmaps), GFP_KERNEL);
+ if (!unmaps)
+ /* Cannot go on */
+ return;
+
+ for (i = 0; i < map->nr_pages; i++)
+ gnttab_set_unmap_op(&unmaps[i], vaddr(map->pages[i]),
+ map->flags, map->handles[i]);
+
+ if (gnttab_unmap_refs(unmaps, NULL, map->pages, map->nr_pages))
+ /* Cannot go on */
+ return;
+
+ for (i = 0; i < map->nr_pages; i++)
+ put_page(map->pages[i]);
+
+ kfree(unmaps);
+ }
+
+ if (map->pages_allocd)
+ gnttab_free_pages(map->nr_pages, map->pages);
+
+ kfree(map->handles);
+ kfree(map->pages);
+ kfree(map);
+ mc_dev_devel("freed xen map %p", map);
+ atomic_dec(&g_ctx.c_xen_maps);
+}
+
+static struct xen_be_map *be_map_create(const struct xen_be_map *pte_map,
+ grant_ref_t *refs, int nr_refs,
+ int pte_entries_max, int dom_id,
+ bool readonly)
+{
+ struct xen_be_map *map;
+ struct gnttab_map_grant_ref *maps = NULL;
+ int i, ret = -ENOMEM;
+
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map)
+ return ERR_PTR(-ENOMEM);
+
+ atomic_inc(&g_ctx.c_xen_maps);
+ map->flags = GNTMAP_host_map;
+ if (readonly)
+ map->flags |= GNTMAP_readonly;
+
+ map->nr_pages = nr_refs;
+ map->pages = kcalloc(map->nr_pages, sizeof(*map->pages), GFP_KERNEL);
+ if (!map->pages)
+ goto out;
+
+ map->handles = kcalloc(map->nr_pages, sizeof(*map->handles),
+ GFP_KERNEL);
+ if (!map->handles)
+ goto out;
+
+ if (gnttab_alloc_pages(map->nr_pages, map->pages))
+ goto out;
+
+ map->pages_allocd = true;
+ maps = kcalloc(map->nr_pages, sizeof(*maps), GFP_KERNEL);
+ if (!maps)
+ goto out;
+
+ if (pte_map) {
+ int k = 0, nr_refs_left = nr_refs;
+
+ for (i = 0; i < pte_map->nr_pages; i++) {
+ int j, nr_refs = nr_refs_left;
+ grant_ref_t *refs = (void *)vaddr(pte_map->pages[i]);
+
+ if (nr_refs > pte_entries_max)
+ nr_refs = pte_entries_max;
+
+ for (j = 0; j < nr_refs; j++) {
+ mc_dev_devel("map [%d, %d] -> %d ref %u",
+ i, j, k, refs[j]);
+#ifdef DEBUG
+ /* Relax serial interface to not kill the USB */
+ usleep_range(100, 200);
+#endif
+ gnttab_set_map_op(
+ &maps[k], vaddr(map->pages[k]),
+ map->flags, refs[j], dom_id);
+ nr_refs_left--;
+ k++;
+ }
+ }
+ } else {
+ for (i = 0; i < map->nr_pages; i++) {
+ mc_dev_devel("map table %d ref %u", i, refs[i]);
+ gnttab_set_map_op(&maps[i], vaddr(map->pages[i]),
+ map->flags, refs[i], dom_id);
+ }
+ }
+
+ ret = gnttab_map_refs(maps, NULL, map->pages, map->nr_pages);
+ if (ret)
+ goto out;
+
+ map->refs_mapped = true;
+ /* Pin pages */
+ for (i = 0; i < map->nr_pages; i++) {
+ get_page(map->pages[i]);
+ map->handles[i] = maps[i].handle;
+ }
+
+out:
+ kfree(maps);
+
+ if (ret) {
+ xen_be_map_delete(map);
+ return ERR_PTR(-ret);
+ }
+
+ mc_dev_devel("created %s xen map %p", pte_map ? "buffer" : "ptes", map);
+ return map;
+}
+
+static struct xen_be_map *xen_be_map_create(struct tee_xen_buffer *buffer,
+ int pte_entries_max, int dom_id)
+{
+ struct xen_be_map *map;
+ struct xen_be_map *pte_map;
+ int nr_pte_refs =
+ (buffer->info->nr_refs + pte_entries_max - 1) / pte_entries_max;
+
+ /* First map the PTE pages */
+ pte_map = be_map_create(NULL, buffer->data.refs, nr_pte_refs,
+ pte_entries_max, dom_id, true);
+ if (IS_ERR(pte_map))
+ return pte_map;
+
+ /* Now map the pages */
+ map = be_map_create(pte_map, NULL, buffer->info->nr_refs,
+ pte_entries_max, dom_id,
+ buffer->info->flags == MC_IO_MAP_INPUT);
+ /* PTE pages mapping not needed any more */
+ xen_be_map_delete(pte_map);
+ if (!IS_ERR(map)) {
+ /* Auto-delete */
+ map->deleter.object = map;
+ map->deleter.delete = (void(*)(void *))xen_be_map_delete;
+ }
+
+ return map;
+}
+
+/* Dom0 call to DomU */
+
+/* Must be called under xfe->ring_mutex */
+static inline void call_domu(struct tee_xfe *xfe, enum tee_xen_dom0_cmd cmd,
+ u32 id, int ret)
+{
+ WARN_ON(!xfe->ring_busy);
+
+ /* Set command and ID */
+ xfe->ring->dom0.cmd = cmd;
+ xfe->ring->dom0.id = id;
+ xfe->ring->dom0.cmd_ret = ret;
+ mc_dev_devel("Dom0 -> DomU request %u id %u ret %d",
+ xfe->ring->dom0.cmd, xfe->ring->dom0.id,
+ xfe->ring->dom0.cmd_ret);
+ /* Call */
+ notify_remote_via_irq(xfe->irq_dom0);
+ wait_for_completion(&xfe->ring_completion);
+}
+
+/* Will be called back under xfe->ring_mutex */
+static irqreturn_t xen_be_irq_handler_dom0_th(int intr, void *arg)
+{
+ struct tee_xfe *xfe = arg;
+
+ if (!xfe->ring->dom0.cmd) {
+ mc_dev_devel("Ignore IRQ with no command (on DomU connect)");
+ return IRQ_HANDLED;
+ }
+
+ WARN_ON(!xfe->ring_busy);
+
+ /* Response to a dom0 command, our side of ring locked by us */
+ mc_dev_devel("Dom0 -> DomU response %u id %u ret %d",
+ xfe->ring->dom0.cmd, xfe->ring->dom0.id,
+ xfe->ring->dom0.cmd_ret);
+ xfe->ring->dom0.cmd = TEE_XEN_DOM0_NONE;
+ xfe->ring->dom0.id = 0;
+ xfe->ring->dom0.cmd_ret = -EPERM;
+ complete(&xfe->ring_completion);
+
+ return IRQ_HANDLED;
+}
+
+/* MC protocol interface */
+
+static inline int xen_be_get_version(struct tee_xfe *xfe)
+{
+ struct mc_version_info version_info;
+ int ret;
+
+ ret = mcp_get_version(&version_info);
+ if (ret)
+ return ret;
+
+ xfe->ring->domu.version_info = version_info;
+ return 0;
+}
+
+static inline int xen_be_mc_has_sessions(struct tee_xfe *xfe)
+{
+ return client_has_sessions(xfe->client) ? -EBUSY : 0;
+}
+
+static inline int xen_be_mc_open_session(struct tee_xfe *xfe)
+{
+ struct tee_xen_buffer *tci_buffer = &xfe->buffers[0];
+ struct mcp_open_info info = {
+ .type = TEE_MC_UUID,
+ .uuid = &xfe->ring->domu.uuid,
+ };
+ int ret;
+
+ if (tci_buffer->info->flags) {
+ struct xen_be_map *map;
+ struct mcp_buffer_map b_map = {
+ .offset = tci_buffer->info->offset,
+ .length = tci_buffer->info->length,
+ .flags = tci_buffer->info->flags,
+ };
+
+ map = xen_be_map_create(tci_buffer, xfe->pte_entries_max,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ goto out;
+ }
+
+ /* Shall be freed by session */
+ b_map.nr_pages = map->nr_pages;
+ info.tci_mmu = tee_mmu_wrap(&map->deleter, map->pages,
+ &b_map);
+ if (IS_ERR(info.tci_mmu)) {
+ ret = PTR_ERR(info.tci_mmu);
+ info.tci_mmu = NULL;
+ goto out;
+ }
+ }
+
+ /* Open session */
+ ret = client_mc_open_common(xfe->client, &info,
+ &xfe->ring->domu.session_id);
+
+out:
+ if (info.tci_mmu)
+ tee_mmu_put(info.tci_mmu);
+
+ mc_dev_devel("session %x, exit with %d",
+ xfe->ring->domu.session_id, ret);
+ return ret;
+}
+
+static inline int xen_be_mc_open_trustlet(struct tee_xfe *xfe)
+{
+ struct tee_xen_buffer *ta_buffer = &xfe->buffers[1];
+ struct tee_xen_buffer *tci_buffer = &xfe->buffers[0];
+ struct mcp_open_info info = {
+ .type = TEE_MC_TA,
+ };
+ struct xen_be_map *ta_map;
+ void *addr = NULL;
+ int ret = -ENOMEM;
+
+ ta_map = xen_be_map_create(ta_buffer, xfe->pte_entries_max,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(ta_map))
+ return PTR_ERR(ta_map);
+
+ info.spid = xfe->ring->domu.spid;
+ addr = vmap(ta_map->pages, ta_map->nr_pages,
+ VM_MAP | VM_IOREMAP | VM_USERMAP, PAGE_KERNEL);
+ if (!addr)
+ goto out;
+
+ info.va = (uintptr_t)addr + ta_buffer->info->offset;
+ info.len = ta_buffer->info->length;
+
+ if (tci_buffer->info->flags) {
+ struct xen_be_map *map;
+ struct mcp_buffer_map b_map = {
+ .offset = tci_buffer->info->offset,
+ .length = tci_buffer->info->length,
+ .flags = tci_buffer->info->flags,
+ };
+
+ map = xen_be_map_create(tci_buffer, xfe->pte_entries_max,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ goto out;
+ }
+
+ /* Shall be freed by session */
+ b_map.nr_pages = map->nr_pages;
+ info.tci_mmu = tee_mmu_wrap(&map->deleter, map->pages, &b_map);
+ if (IS_ERR(info.tci_mmu)) {
+ ret = PTR_ERR(info.tci_mmu);
+ info.tci_mmu = NULL;
+ goto out;
+ }
+ }
+
+ /* Open session */
+ ret = client_mc_open_common(xfe->client, &info,
+ &xfe->ring->domu.session_id);
+
+out:
+ if (info.tci_mmu)
+ tee_mmu_put(info.tci_mmu);
+
+ if (addr)
+ vunmap(addr);
+
+ xen_be_map_delete(ta_map);
+
+ mc_dev_devel("session %x, exit with %d",
+ xfe->ring->domu.session_id, ret);
+ return ret;
+}
+
+static inline int xen_be_mc_close_session(struct tee_xfe *xfe)
+{
+ return client_remove_session(xfe->client, xfe->ring->domu.session_id);
+}
+
+static inline int xen_be_mc_notify(struct tee_xfe *xfe)
+{
+ return client_notify_session(xfe->client, xfe->ring->domu.session_id);
+}
+
+/* mc_wait cannot keep the ring busy while waiting, so we use a worker */
+struct mc_wait_work {
+ struct work_struct work;
+ struct tee_xfe *xfe;
+ u32 session_id;
+ s32 timeout;
+ u32 id;
+};
+
+static void xen_be_mc_wait_worker(struct work_struct *work)
+{
+ struct mc_wait_work *wait_work =
+ container_of(work, struct mc_wait_work, work);
+ struct tee_xfe *xfe = wait_work->xfe;
+ int ret;
+
+ ret = client_waitnotif_session(wait_work->xfe->client,
+ wait_work->session_id,
+ wait_work->timeout, false);
+
+ /* Send return code */
+ mc_dev_devel("MC wait session done %x, ret %d",
+ wait_work->session_id, ret);
+ ring_get(xfe);
+ /* In */
+ xfe->ring->dom0.session_id = wait_work->session_id;
+ /* Call */
+ call_domu(xfe, TEE_XEN_MC_WAIT_DONE, wait_work->id, ret);
+ /* Out */
+ ring_put(xfe);
+ kfree(wait_work);
+ tee_xfe_put(xfe);
+}
+
+static inline int xen_be_mc_wait(struct tee_xfe *xfe)
+{
+ struct mc_wait_work *wait_work;
+
+ /* Wait in a separate thread to release the communication ring */
+ wait_work = kzalloc(sizeof(*wait_work), GFP_KERNEL);
+ if (!wait_work)
+ return -ENOMEM;
+
+ tee_xfe_get(xfe);
+ wait_work->xfe = xfe;
+ wait_work->session_id = xfe->ring->domu.session_id;
+ wait_work->timeout = xfe->ring->domu.timeout;
+ wait_work->id = xfe->ring->domu.id;
+ INIT_WORK(&wait_work->work, xen_be_mc_wait_worker);
+ schedule_work(&wait_work->work);
+ return 0;
+}
+
+static inline int xen_be_mc_map(struct tee_xfe *xfe)
+{
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ struct xen_be_map *map;
+ struct tee_mmu *mmu = NULL;
+ struct mc_ioctl_buffer buf;
+ struct mcp_buffer_map b_map = {
+ .offset = buffer->info->offset,
+ .length = buffer->info->length,
+ .flags = buffer->info->flags,
+ };
+ int ret;
+
+ map = xen_be_map_create(buffer, xfe->pte_entries_max,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ return ret;
+ }
+
+ /* Shall be freed by session */
+ b_map.nr_pages = map->nr_pages;
+ mmu = tee_mmu_wrap(&map->deleter, map->pages, &b_map);
+ if (IS_ERR(mmu)) {
+ xen_be_map_delete(map);
+ return PTR_ERR(mmu);
+ }
+
+ ret = client_mc_map(xfe->client, xfe->ring->domu.session_id, mmu, &buf);
+ /* Releasing the MMU shall also clear the map */
+ tee_mmu_put(mmu);
+ if (!ret)
+ buffer->info->sva = buf.sva;
+
+ mc_dev_devel("session %x, exit with %d",
+ xfe->ring->domu.session_id, ret);
+ return ret;
+}
+
+static inline int xen_be_mc_unmap(struct tee_xfe *xfe)
+{
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ struct mc_ioctl_buffer buf = {
+ .len = buffer->info->length,
+ .sva = buffer->info->sva,
+ };
+ int ret;
+
+ ret = client_mc_unmap(xfe->client, xfe->ring->domu.session_id, &buf);
+
+ mc_dev_devel("session %x, exit with %d",
+ xfe->ring->domu.session_id, ret);
+ return ret;
+}
+
+static inline int xen_be_mc_get_err(struct tee_xfe *xfe)
+{
+ int ret;
+
+ ret = client_get_session_exitcode(xfe->client,
+ xfe->ring->domu.session_id,
+ &xfe->ring->domu.err);
+ mc_dev_devel("session %x err %d, exit with %d",
+ xfe->ring->domu.session_id, xfe->ring->domu.err, ret);
+ return ret;
+}
+
+/* GP protocol interface */
+
+static inline int xen_be_gp_register_shared_mem(struct tee_xfe *xfe)
+{
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ struct xen_be_map *map;
+ struct tee_mmu *mmu = NULL;
+ struct gp_shared_memory memref = {
+ .buffer = buffer->info->addr,
+ .size = buffer->info->length,
+ .flags = buffer->info->flags,
+ };
+ struct mcp_buffer_map b_map = {
+ .offset = buffer->info->offset,
+ .length = buffer->info->length,
+ .flags = buffer->info->flags,
+ };
+ int ret;
+
+ map = xen_be_map_create(buffer, xfe->pte_entries_max,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ return ret;
+ }
+
+ /* Shall be freed by session */
+ b_map.nr_pages = map->nr_pages;
+ mmu = tee_mmu_wrap(&map->deleter, map->pages, &b_map);
+ if (IS_ERR(mmu)) {
+ xen_be_map_delete(map);
+ return PTR_ERR(mmu);
+ }
+
+ ret = client_gp_register_shared_mem(xfe->client, mmu,
+ &buffer->info->sva, &memref,
+ &xfe->ring->domu.gp_ret);
+ /* Releasing the MMU shall also clear the map */
+ tee_mmu_put(mmu);
+ mc_dev_devel("session %x, exit with %d",
+ xfe->ring->domu.session_id, ret);
+ return ret;
+}
+
+static inline int xen_be_gp_release_shared_mem(struct tee_xfe *xfe)
+{
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ struct gp_shared_memory memref = {
+ .buffer = buffer->info->addr,
+ .size = buffer->info->length,
+ .flags = buffer->info->flags,
+ };
+ int ret;
+
+ ret = client_gp_release_shared_mem(xfe->client, &memref);
+
+ mc_dev_devel("exit with %d", ret);
+ return ret;
+}
+
+/* GP functions cannot keep the ring busy while waiting, so we use a worker */
+struct gp_work {
+ struct work_struct work;
+ struct tee_xfe *xfe;
+ u64 operation_id;
+ struct interworld_session iws;
+ struct tee_mmu *mmus[4];
+ struct mc_uuid_t uuid;
+ u32 session_id;
+ u32 id;
+};
+
+static void xen_be_gp_open_session_worker(struct work_struct *work)
+{
+ struct gp_work *gp_work = container_of(work, struct gp_work, work);
+ struct tee_xfe *xfe = gp_work->xfe;
+ struct gp_return gp_ret;
+ int i, ret;
+
+ ret = client_gp_open_session_domu(xfe->client, &gp_work->uuid,
+ gp_work->operation_id, &gp_work->iws,
+ gp_work->mmus, &gp_ret);
+ mc_dev_devel("GP open session done, ret %d", ret);
+ for (i = 0; i < TEE_BUFFERS; i++)
+ if (gp_work->mmus[i])
+ tee_mmu_put(gp_work->mmus[i]);
+
+ /* Send return code */
+ ring_get(xfe);
+ /* In */
+ xfe->ring->dom0.operation_id = gp_work->operation_id;
+ xfe->ring->dom0.iws = gp_work->iws;
+ xfe->ring->dom0.gp_ret = gp_ret;
+ /* Call */
+ call_domu(xfe, TEE_XEN_GP_OPEN_SESSION_DONE, gp_work->id, ret);
+ /* Out */
+ ring_put(xfe);
+ kfree(gp_work);
+ tee_xfe_put(xfe);
+}
+
+static inline int xen_be_gp_open_session(struct tee_xfe *xfe)
+{
+ struct gp_work *gp_work;
+ int i, ret = 0;
+
+ gp_work = kzalloc(sizeof(*gp_work), GFP_KERNEL);
+ if (!gp_work)
+ return -ENOMEM;
+
+ /* Map tmpref buffers */
+ for (i = 0; i < TEE_BUFFERS; i++) {
+ struct tee_xen_buffer *buffer = &xfe->buffers[i];
+ struct xen_be_map *map;
+ struct mcp_buffer_map b_map = {
+ .offset = buffer->info->offset,
+ .length = buffer->info->length,
+ .flags = buffer->info->flags,
+ };
+
+ if (!buffer->info->flags)
+ continue;
+
+ map = xen_be_map_create(buffer, xfe->pte_entries_max,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ goto err_map;
+ }
+
+ /* Shall be freed by session */
+ b_map.nr_pages = map->nr_pages;
+ gp_work->mmus[i] = tee_mmu_wrap(&map->deleter, map->pages,
+ &b_map);
+ if (IS_ERR(gp_work->mmus[i])) {
+ xen_be_map_delete(map);
+ ret = PTR_ERR(gp_work->mmus[i]);
+ goto err_mmus;
+ }
+ }
+
+ tee_xfe_get(xfe);
+ gp_work->xfe = xfe;
+ gp_work->operation_id = xfe->ring->domu.operation_id;
+ gp_work->iws = xfe->ring->domu.iws;
+ gp_work->uuid = xfe->ring->domu.uuid;
+ gp_work->id = xfe->ring->domu.id;
+ INIT_WORK(&gp_work->work, xen_be_gp_open_session_worker);
+ schedule_work(&gp_work->work);
+ return 0;
+
+err_mmus:
+ for (i = 0; i < TEE_BUFFERS; i++)
+ if (!IS_ERR_OR_NULL(gp_work->mmus[i]))
+ tee_mmu_put(gp_work->mmus[i]);
+err_map:
+ kfree(gp_work);
+ return ret;
+}
+
+static void xen_be_gp_close_session_worker(struct work_struct *work)
+{
+ struct gp_work *gp_work = container_of(work, struct gp_work, work);
+ struct tee_xfe *xfe = gp_work->xfe;
+ int ret;
+
+ ret = client_gp_close_session(xfe->client, gp_work->session_id);
+ mc_dev_devel("GP close session done, ret %d", ret);
+
+ /* Send return code */
+ ring_get(xfe);
+ /* In */
+ xfe->ring->dom0.operation_id = gp_work->operation_id;
+ /* Call */
+ call_domu(xfe, TEE_XEN_GP_CLOSE_SESSION_DONE, gp_work->id, ret);
+ /* Out */
+ ring_put(xfe);
+ kfree(gp_work);
+ tee_xfe_put(xfe);
+}
+
+static inline int xen_be_gp_close_session(struct tee_xfe *xfe)
+{
+ struct gp_work *gp_work;
+
+ gp_work = kzalloc(sizeof(*gp_work), GFP_KERNEL);
+ if (!gp_work)
+ return -ENOMEM;
+
+ tee_xfe_get(xfe);
+ gp_work->xfe = xfe;
+ gp_work->operation_id = xfe->ring->domu.operation_id;
+ gp_work->session_id = xfe->ring->domu.session_id;
+ gp_work->id = xfe->ring->domu.id;
+ INIT_WORK(&gp_work->work, xen_be_gp_close_session_worker);
+ schedule_work(&gp_work->work);
+ return 0;
+}
+
+static void xen_be_gp_invoke_command_worker(struct work_struct *work)
+{
+ struct gp_work *gp_work = container_of(work, struct gp_work, work);
+ struct tee_xfe *xfe = gp_work->xfe;
+ struct gp_return gp_ret;
+ int i, ret;
+
+ ret = client_gp_invoke_command_domu(xfe->client, gp_work->session_id,
+ gp_work->operation_id,
+ &gp_work->iws, gp_work->mmus,
+ &gp_ret);
+ mc_dev_devel("GP invoke command done, ret %d", ret);
+ for (i = 0; i < TEE_BUFFERS; i++)
+ if (gp_work->mmus[i])
+ tee_mmu_put(gp_work->mmus[i]);
+
+ /* Send return code */
+ ring_get(xfe);
+ /* In */
+ xfe->ring->dom0.operation_id = gp_work->operation_id;
+ xfe->ring->dom0.iws = gp_work->iws;
+ xfe->ring->dom0.gp_ret = gp_ret;
+ /* Call */
+ call_domu(xfe, TEE_XEN_GP_INVOKE_COMMAND_DONE, gp_work->id, ret);
+ /* Out */
+ ring_put(xfe);
+ kfree(gp_work);
+ tee_xfe_put(xfe);
+}
+
+static inline int xen_be_gp_invoke_command(struct tee_xfe *xfe)
+{
+ struct gp_work *gp_work;
+ int i, ret = 0;
+
+ gp_work = kzalloc(sizeof(*gp_work), GFP_KERNEL);
+ if (!gp_work)
+ return -ENOMEM;
+
+ /* Map tmpref buffers */
+ for (i = 0; i < TEE_BUFFERS; i++) {
+ struct tee_xen_buffer *buffer = &xfe->buffers[i];
+ struct xen_be_map *map;
+ struct mcp_buffer_map b_map = {
+ .offset = buffer->info->offset,
+ .length = buffer->info->length,
+ .flags = buffer->info->flags,
+ };
+
+ if (!buffer->info->flags)
+ continue;
+
+ map = xen_be_map_create(buffer, xfe->pte_entries_max,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ goto err_map;
+ }
+
+ /* Shall be freed by session */
+ b_map.nr_pages = map->nr_pages;
+ gp_work->mmus[i] = tee_mmu_wrap(&map->deleter, map->pages,
+ &b_map);
+ if (IS_ERR(gp_work->mmus[i])) {
+ xen_be_map_delete(map);
+ ret = PTR_ERR(gp_work->mmus[i]);
+ goto err_mmus;
+ }
+ }
+
+ tee_xfe_get(xfe);
+ gp_work->xfe = xfe;
+ gp_work->operation_id = xfe->ring->domu.operation_id;
+ gp_work->iws = xfe->ring->domu.iws;
+ gp_work->session_id = xfe->ring->domu.session_id;
+ gp_work->id = xfe->ring->domu.id;
+ INIT_WORK(&gp_work->work, xen_be_gp_invoke_command_worker);
+ schedule_work(&gp_work->work);
+ return 0;
+
+err_mmus:
+ for (i = 0; i < TEE_BUFFERS; i++)
+ if (!IS_ERR_OR_NULL(gp_work->mmus[i]))
+ tee_mmu_put(gp_work->mmus[i]);
+err_map:
+ kfree(gp_work);
+ return ret;
+}
+
+static inline int xen_be_gp_request_cancellation(struct tee_xfe *xfe)
+{
+ client_gp_request_cancellation(xfe->client,
+ xfe->ring->domu.operation_id);
+ return 0;
+}
+
+static irqreturn_t xen_be_irq_handler_domu_th(int intr, void *arg)
+{
+ struct tee_xfe *xfe = arg;
+
+ if (!xfe->ring->domu.cmd) {
+ mc_dev_devel("Ignore IRQ with no command (on DomU connect)");
+ return IRQ_HANDLED;
+ }
+
+ /* DomU event, their side of ring locked by them */
+ schedule_work(&xfe->work);
+
+ return IRQ_HANDLED;
+}
+
+static void xen_be_irq_handler_domu_bh(struct work_struct *data)
+{
+ struct tee_xfe *xfe = container_of(data, struct tee_xfe, work);
+
+ xfe->ring->domu.otherend_ret = -EINVAL;
+ mc_dev_devel("DomU -> Dom0 command %u id %u",
+ xfe->ring->domu.cmd, xfe->ring->domu.id);
+ switch (xfe->ring->domu.cmd) {
+ case TEE_XEN_DOMU_NONE:
+ return;
+ /* MC */
+ case TEE_XEN_MC_HAS_SESSIONS:
+ xfe->ring->domu.otherend_ret = xen_be_mc_has_sessions(xfe);
+ break;
+ case TEE_XEN_GET_VERSION:
+ xfe->ring->domu.otherend_ret = xen_be_get_version(xfe);
+ break;
+ case TEE_XEN_MC_OPEN_SESSION:
+ xfe->ring->domu.otherend_ret = xen_be_mc_open_session(xfe);
+ break;
+ case TEE_XEN_MC_OPEN_TRUSTLET:
+ xfe->ring->domu.otherend_ret = xen_be_mc_open_trustlet(xfe);
+ break;
+ case TEE_XEN_MC_CLOSE_SESSION:
+ xfe->ring->domu.otherend_ret = xen_be_mc_close_session(xfe);
+ break;
+ case TEE_XEN_MC_NOTIFY:
+ xfe->ring->domu.otherend_ret = xen_be_mc_notify(xfe);
+ break;
+ case TEE_XEN_MC_WAIT:
+ xfe->ring->domu.otherend_ret = xen_be_mc_wait(xfe);
+ break;
+ case TEE_XEN_MC_MAP:
+ xfe->ring->domu.otherend_ret = xen_be_mc_map(xfe);
+ break;
+ case TEE_XEN_MC_UNMAP:
+ xfe->ring->domu.otherend_ret = xen_be_mc_unmap(xfe);
+ break;
+ case TEE_XEN_MC_GET_ERR:
+ xfe->ring->domu.otherend_ret = xen_be_mc_get_err(xfe);
+ break;
+ /* GP */
+ case TEE_XEN_GP_REGISTER_SHARED_MEM:
+ xfe->ring->domu.otherend_ret =
+ xen_be_gp_register_shared_mem(xfe);
+ break;
+ case TEE_XEN_GP_RELEASE_SHARED_MEM:
+ xfe->ring->domu.otherend_ret =
+ xen_be_gp_release_shared_mem(xfe);
+ break;
+ case TEE_XEN_GP_OPEN_SESSION:
+ xfe->ring->domu.otherend_ret = xen_be_gp_open_session(xfe);
+ break;
+ case TEE_XEN_GP_CLOSE_SESSION:
+ xfe->ring->domu.otherend_ret = xen_be_gp_close_session(xfe);
+ break;
+ case TEE_XEN_GP_INVOKE_COMMAND:
+ xfe->ring->domu.otherend_ret = xen_be_gp_invoke_command(xfe);
+ break;
+ case TEE_XEN_GP_REQUEST_CANCELLATION:
+ xfe->ring->domu.otherend_ret =
+ xen_be_gp_request_cancellation(xfe);
+ break;
+ }
+
+ mc_dev_devel("DomU -> Dom0 result %u id %u ret %d",
+ xfe->ring->domu.cmd, xfe->ring->domu.id,
+ xfe->ring->domu.otherend_ret);
+ notify_remote_via_irq(xfe->irq_domu);
+}
+
+/* Device */
+
+static const struct xenbus_device_id xen_be_ids[] = {
+ { "tee_xen" },
+ { "" }
+};
+
+/* Called when a front-end is created */
+static int xen_be_probe(struct xenbus_device *xdev,
+ const struct xenbus_device_id *id)
+{
+ struct tee_xfe *xfe;
+ int ret = 0;
+
+ ret = xenbus_switch_state(xdev, XenbusStateInitWait);
+ if (ret) {
+ xenbus_dev_fatal(xdev, ret,
+ "failed to change state to initwait");
+ return ret;
+ }
+
+ xfe = tee_xfe_create(xdev);
+ if (!xfe) {
+ ret = -ENOMEM;
+ xenbus_dev_fatal(xdev, ret, "failed to create FE struct");
+ goto err_xfe_create;
+ }
+
+ xfe->client = client_create(true);
+ if (!xfe->client) {
+ ret = -ENOMEM;
+ xenbus_dev_fatal(xdev, ret, "failed to create FE client");
+ goto err_client_create;
+ }
+
+ INIT_WORK(&xfe->work, xen_be_irq_handler_domu_bh);
+
+ mutex_lock(&l_ctx.xfes_mutex);
+ list_add_tail(&xfe->list, &l_ctx.xfes);
+ mutex_unlock(&l_ctx.xfes_mutex);
+
+ ret = xenbus_switch_state(xdev, XenbusStateInitialised);
+ if (ret) {
+ xenbus_dev_fatal(xdev, ret,
+ "failed to change state to initialised");
+ goto err_switch_state;
+ }
+
+ return 0;
+
+err_switch_state:
+ mutex_lock(&l_ctx.xfes_mutex);
+ list_del(&xfe->list);
+ mutex_unlock(&l_ctx.xfes_mutex);
+err_client_create:
+ tee_xfe_put(xfe);
+err_xfe_create:
+ return ret;
+}
+
+/* Called when device is unregistered */
+static int xen_be_remove(struct xenbus_device *xdev)
+{
+ struct tee_xfe *xfe = dev_get_drvdata(&xdev->dev);
+
+ xenbus_switch_state(xdev, XenbusStateClosed);
+
+ mutex_lock(&l_ctx.xfes_mutex);
+ list_del(&xfe->list);
+ mutex_unlock(&l_ctx.xfes_mutex);
+
+ tee_xfe_put(xfe);
+ return 0;
+}
+
+static inline int xen_be_map_ring_valloc(struct xenbus_device *dev,
+ grant_ref_t ref, void **vaddr)
+{
+ return xenbus_map_ring_valloc(dev, &ref, 1, vaddr);
+}
+
+static inline void frontend_attach(struct tee_xfe *xfe)
+{
+ int domu_version;
+ int ret;
+ int i;
+
+ if (xenbus_read_driver_state(xfe->xdev->nodename) !=
+ XenbusStateInitialised)
+ return;
+
+ ret = xenbus_gather(XBT_NIL, xfe->xdev->otherend,
+ "ring-ref", "%u", &xfe->ring_ref,
+ "pte-entries-max", "%u", &xfe->pte_entries_max,
+ "event-channel-domu", "%u", &xfe->evtchn_domu,
+ "event-channel-dom0", "%u", &xfe->evtchn_dom0,
+ "domu-version", "%u", &domu_version, NULL);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to gather other domain info");
+ return;
+ }
+
+ mc_dev_devel("ring ref %u evtchn domu=%u dom0=%u version=%u",
+ xfe->ring_ref, xfe->evtchn_domu, xfe->evtchn_dom0,
+ domu_version);
+
+ if (domu_version != TEE_XEN_VERSION) {
+ xenbus_dev_fatal(
+ xfe->xdev, ret,
+ "front- and back-end versions do not match: %d vs %d",
+ domu_version, TEE_XEN_VERSION);
+ return;
+ }
+
+ ret = xen_be_map_ring_valloc(xfe->xdev, xfe->ring_ref, &xfe->ring_p);
+ if (ret < 0) {
+ xenbus_dev_fatal(xfe->xdev, ret, "failed to map ring");
+ return;
+ }
+ mc_dev_devel("mapped ring %p", xfe->ring_p);
+
+ /* Map buffers individually */
+ for (i = 0; i < TEE_BUFFERS; i++) {
+ ret = xen_be_map_ring_valloc(xfe->xdev,
+ xfe->ring->domu.buffers[i].pmd_ref,
+ &xfe->buffers[i].data.addr);
+ if (ret < 0) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to map buffer page");
+ return;
+ }
+
+ xfe->buffers[i].info = &xfe->ring->domu.buffers[i];
+ }
+
+ ret = bind_interdomain_evtchn_to_irqhandler(
+ xfe->xdev->otherend_id, xfe->evtchn_domu,
+ xen_be_irq_handler_domu_th, 0, "tee_be_domu", xfe);
+ if (ret < 0) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to bind event channel to DomU IRQ");
+ return;
+ }
+
+ xfe->irq_domu = ret;
+ mc_dev_devel("bound DomU IRQ %d", xfe->irq_domu);
+
+ ret = bind_interdomain_evtchn_to_irqhandler(
+ xfe->xdev->otherend_id, xfe->evtchn_dom0,
+ xen_be_irq_handler_dom0_th, 0, "tee_be_dom0", xfe);
+ if (ret < 0) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to bind event channel to Dom0 IRQ");
+ return;
+ }
+
+ xfe->irq_dom0 = ret;
+ mc_dev_devel("bound Dom0 IRQ %d", xfe->irq_dom0);
+
+ ret = xenbus_switch_state(xfe->xdev, XenbusStateConnected);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to change state to connected");
+ return;
+ }
+}
+
+static inline void frontend_detach(struct tee_xfe *xfe)
+{
+ int i;
+
+ xenbus_switch_state(xfe->xdev, XenbusStateClosing);
+ if (xfe->irq_domu >= 0)
+ unbind_from_irqhandler(xfe->irq_domu, xfe);
+
+ if (xfe->irq_dom0 >= 0)
+ unbind_from_irqhandler(xfe->irq_dom0, xfe);
+
+ for (i = 0; i < TEE_BUFFERS; i++)
+ xenbus_unmap_ring_vfree(xfe->xdev, xfe->buffers[i].data.addr);
+
+ if (xfe->ring_p)
+ xenbus_unmap_ring_vfree(xfe->xdev, xfe->ring_p);
+}
+
+static void xen_be_frontend_changed(struct xenbus_device *xdev,
+ enum xenbus_state fe_state)
+{
+ struct tee_xfe *xfe = dev_get_drvdata(&xdev->dev);
+
+ mc_dev_devel("fe state changed to %d", fe_state);
+ switch (fe_state) {
+ case XenbusStateInitialising:
+ case XenbusStateInitWait:
+ break;
+ case XenbusStateInitialised:
+ frontend_attach(xfe);
+ break;
+ case XenbusStateConnected:
+ break;
+ case XenbusStateClosing:
+ frontend_detach(xfe);
+ break;
+ case XenbusStateUnknown:
+ case XenbusStateClosed:
+ device_unregister(&xfe->xdev->dev);
+ break;
+ case XenbusStateReconfiguring:
+ case XenbusStateReconfigured:
+ break;
+ }
+}
+
+static struct xenbus_driver xen_be_driver = {
+ .ids = xen_be_ids,
+ .probe = xen_be_probe,
+ .remove = xen_be_remove,
+ .otherend_changed = xen_be_frontend_changed,
+};
+
+int xen_be_init(void)
+{
+ INIT_LIST_HEAD(&l_ctx.xfes);
+ mutex_init(&l_ctx.xfes_mutex);
+ return xenbus_register_backend(&xen_be_driver);
+}
+
+void xen_be_exit(void)
+{
+ xenbus_unregister_driver(&xen_be_driver);
+}
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_be.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_be.h
new file mode 100644
index 0000000..135503e
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_be.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_XEN_BE_H_
+#define _MC_XEN_BE_H_
+
+#include <linux/version.h>
+
+struct xen_be_map;
+
+#ifdef CONFIG_XEN
+int xen_be_init(void);
+void xen_be_exit(void);
+#else
+static inline int xen_be_init(void)
+{
+ return 0;
+}
+
+static inline void xen_be_exit(void)
+{
+}
+#endif
+
+#endif /* _MC_XEN_BE_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_common.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_common.c
new file mode 100644
index 0000000..19c0867
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_common.c
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifdef CONFIG_XEN
+
+#include "main.h"
+#include "client.h"
+#include "xen_common.h"
+
+struct tee_xfe *tee_xfe_create(struct xenbus_device *xdev)
+{
+ struct tee_xfe *xfe;
+
+ /* Alloc */
+ xfe = kzalloc(sizeof(*xfe), GFP_KERNEL);
+ if (!xfe)
+ return NULL;
+
+ atomic_inc(&g_ctx.c_xen_fes);
+ /* Init */
+ dev_set_drvdata(&xdev->dev, xfe);
+ xfe->xdev = xdev;
+ kref_init(&xfe->kref);
+ xfe->evtchn_domu = -1;
+ xfe->evtchn_dom0 = -1;
+ xfe->irq_domu = -1;
+ xfe->irq_dom0 = -1;
+ INIT_LIST_HEAD(&xfe->list);
+ mutex_init(&xfe->ring_mutex);
+ init_completion(&xfe->ring_completion);
+ return xfe;
+}
+
+static void tee_xfe_release(struct kref *kref)
+{
+ struct tee_xfe *xfe = container_of(kref, struct tee_xfe, kref);
+
+ if (xfe->client)
+ client_close(xfe->client);
+
+ kfree(xfe);
+ atomic_dec(&g_ctx.c_xen_fes);
+}
+
+void tee_xfe_put(struct tee_xfe *xfe)
+{
+ kref_put(&xfe->kref, tee_xfe_release);
+}
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_common.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_common.h
new file mode 100644
index 0000000..4fcb707
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_common.h
@@ -0,0 +1,169 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_XEN_COMMON_H_
+#define _MC_XEN_COMMON_H_
+
+#include <linux/list.h>
+#include <linux/workqueue.h>
+#include <xen/events.h>
+#include <xen/grant_table.h>
+#include <xen/xen.h>
+#include <xen/xenbus.h>
+
+#include "public/mc_user.h" /* many types */
+#include "mci/mciiwp.h"
+#include "mci/mcimcp.h"
+#include "mmu.h" /* PMD/PTE max entries */
+#include "client.h" /* For BE to treat other VMs as clients */
+
+#define TEE_XEN_VERSION 3
+
+#define TEE_BUFFERS 4
+
+enum tee_xen_domu_cmd {
+ TEE_XEN_DOMU_NONE,
+ TEE_XEN_GET_VERSION,
+ /* TEE_XEN_MC_OPEN_DEVICE = 11, SWd does not support this */
+ /* TEE_XEN_MC_CLOSE_DEVICE, SWd does not support this */
+ TEE_XEN_MC_HAS_SESSIONS = 13,
+ TEE_XEN_MC_OPEN_SESSION,
+ TEE_XEN_MC_OPEN_TRUSTLET,
+ TEE_XEN_MC_CLOSE_SESSION,
+ TEE_XEN_MC_NOTIFY,
+ TEE_XEN_MC_WAIT,
+ TEE_XEN_MC_MAP,
+ TEE_XEN_MC_UNMAP,
+ TEE_XEN_MC_GET_ERR,
+ /* TEE_XEN_GP_INITIALIZE_CONTEXT = 21, SWd does not support this */
+ /* TEE_XEN_GP_FINALIZE_CONTEXT, SWd does not support this */
+ TEE_XEN_GP_REGISTER_SHARED_MEM = 23,
+ TEE_XEN_GP_RELEASE_SHARED_MEM,
+ TEE_XEN_GP_OPEN_SESSION,
+ TEE_XEN_GP_CLOSE_SESSION,
+ TEE_XEN_GP_INVOKE_COMMAND,
+ TEE_XEN_GP_REQUEST_CANCELLATION,
+};
+
+enum tee_xen_dom0_cmd {
+ TEE_XEN_DOM0_NONE,
+ TEE_XEN_MC_WAIT_DONE = TEE_XEN_MC_WAIT,
+ TEE_XEN_GP_OPEN_SESSION_DONE = TEE_XEN_GP_OPEN_SESSION,
+ TEE_XEN_GP_CLOSE_SESSION_DONE = TEE_XEN_GP_CLOSE_SESSION,
+ TEE_XEN_GP_INVOKE_COMMAND_DONE = TEE_XEN_GP_INVOKE_COMMAND,
+};
+
+union tee_xen_mmu_table {
+ /* Array of references to pages (PTE_ENTRIES_MAX or PMD_ENTRIES_MAX) */
+ grant_ref_t *refs;
+ /* Address of table */
+ void *addr;
+ /* Page for table */
+ unsigned long page;
+};
+
+struct tee_xen_buffer_info {
+ /* Page Middle Directory, refs to tee_xen_pte_table's (full pages) */
+ grant_ref_t pmd_ref;
+ /* Total number of refs for buffer */
+ u32 nr_refs;
+ u64 addr; /* Unique VM address */
+ u32 offset;
+ u32 length;
+ u32 flags;
+ u32 sva;
+};
+
+/* Convenience structure to get buffer info and contents in one place */
+struct tee_xen_buffer {
+ struct tee_xen_buffer_info *info;
+ union tee_xen_mmu_table data;
+};
+
+struct tee_xen_ring {
+ /* DomU side, synchronous and asynchronous commands */
+ struct {
+ enum tee_xen_domu_cmd cmd; /* in */
+ u32 id; /* in (debug) */
+ /* Return code of this command from Dom0 */
+ int otherend_ret; /* out */
+ struct mc_uuid_t uuid; /* in */
+ u32 session_id; /* in/out */
+ /* Buffers to share (4 for GP, 2 for mcOpenTrustlet) */
+ struct tee_xen_buffer_info buffers[TEE_BUFFERS]; /* in */
+ /* MC */
+ struct mc_version_info version_info; /* out */
+ u32 spid; /* in */
+ s32 timeout; /* in */
+ s32 err; /* out */
+ /* GP */
+ u64 operation_id; /* in */
+ struct gp_return gp_ret; /* out */
+ struct interworld_session iws; /* in */
+ } domu;
+
+ /* Dom0 side, response to asynchronous command, never read by Dom0 */
+ struct {
+ enum tee_xen_dom0_cmd cmd; /* in */
+ u32 id; /* in (debug) */
+ /* Return code from command */
+ int cmd_ret; /* in */
+ /* The operation id is used to match GP request and response */
+ u64 operation_id; /* in */
+ struct gp_return gp_ret; /* in */
+ struct interworld_session iws; /* in */
+ /* The session id is used to match MC request and response */
+ u32 session_id; /* in */
+ } dom0;
+};
+
+struct tee_xfe {
+ struct xenbus_device *xdev;
+ struct kref kref;
+ grant_ref_t ring_ref;
+ int pte_entries_max;
+ int evtchn_domu;
+ int evtchn_dom0;
+ int irq_domu;
+ int irq_dom0;
+ struct list_head list;
+ struct tee_client *client;
+ struct work_struct work;
+ /* Ring page */
+ union {
+ unsigned long ring_ul;
+ void *ring_p;
+ struct tee_xen_ring *ring;
+ };
+ /* Buffer pages */
+ struct tee_xen_buffer buffers[TEE_BUFFERS];
+ struct mutex ring_mutex; /* Protect our side of ring */
+ struct completion ring_completion;
+ bool ring_busy;
+ /* Unique ID for commands */
+ u32 domu_cmd_id;
+};
+
+struct tee_xfe *tee_xfe_create(struct xenbus_device *xdev);
+static inline void tee_xfe_get(struct tee_xfe *xfe)
+{
+ kref_get(&xfe->kref);
+}
+
+void tee_xfe_put(struct tee_xfe *xfe);
+
+static inline void ring_get(struct tee_xfe *xfe)
+{
+ mutex_lock(&xfe->ring_mutex);
+ xfe->ring_busy = true;
+}
+
+static inline void ring_put(struct tee_xfe *xfe)
+{
+ xfe->ring_busy = false;
+ mutex_unlock(&xfe->ring_mutex);
+}
+
+#endif /* _MC_XEN_COMMON_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_fe.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_fe.c
new file mode 100644
index 0000000..2ed331f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_fe.c
@@ -0,0 +1,1184 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/irq.h>
+
+#include "mci/mciiwp.h" /* struct interworld_session */
+
+#include "main.h"
+
+#ifdef TRUSTONIC_XEN_DOMU
+
+#include "admin.h" /* tee_object* */
+#include "client.h"
+#include "iwp.h"
+#include "mcp.h"
+#include "xen_common.h"
+#include "xen_fe.h"
+
+#define page_to_gfn(p) (pfn_to_gfn(page_to_phys(p) >> XEN_PAGE_SHIFT))
+
+static struct {
+ int (*probe)(void);
+ int (*start)(void);
+ struct tee_xfe *xfe;
+ /* MC sessions */
+ struct mutex mc_sessions_lock;
+ struct list_head mc_sessions;
+ /* GP operations */
+ struct mutex gp_operations_lock;
+ struct list_head gp_operations;
+ /* Last back-end state,
+ * to overcome an issue in some Xen implementations
+ */
+ int last_be_state;
+} l_ctx;
+
+struct xen_fe_mc_session {
+ struct list_head list;
+ struct completion completion;
+ int ret;
+ struct mcp_session *session;
+};
+
+struct xen_fe_gp_operation {
+ struct list_head list;
+ struct completion completion;
+ int ret;
+ u64 slot;
+ struct gp_return *gp_ret;
+ struct interworld_session *iws;
+};
+
+static inline struct xen_fe_mc_session *find_mc_session(u32 session_id)
+{
+ struct xen_fe_mc_session *session = ERR_PTR(-ENXIO), *candidate;
+
+ mutex_lock(&l_ctx.mc_sessions_lock);
+ list_for_each_entry(candidate, &l_ctx.mc_sessions, list) {
+ struct mcp_session *mcp_session = candidate->session;
+
+ if (mcp_session->sid == session_id) {
+ session = candidate;
+ break;
+ }
+ }
+ mutex_unlock(&l_ctx.mc_sessions_lock);
+
+ WARN(IS_ERR(session), "MC session not found for ID %u", session_id);
+ return session;
+}
+
+static inline int xen_fe_mc_wait_done(struct tee_xfe *xfe)
+{
+ struct xen_fe_mc_session *session;
+
+ mc_dev_devel("received response to mc_wait for session %x: %d",
+ xfe->ring->dom0.session_id, xfe->ring->dom0.cmd_ret);
+ session = find_mc_session(xfe->ring->dom0.session_id);
+ if (IS_ERR(session))
+ return PTR_ERR(session);
+
+ session->ret = xfe->ring->dom0.cmd_ret;
+ complete(&session->completion);
+ return 0;
+}
+
+static struct xen_fe_gp_operation *find_gp_operation(u64 operation_id)
+{
+ struct xen_fe_gp_operation *operation = ERR_PTR(-ENXIO), *candidate;
+
+ mutex_lock(&l_ctx.gp_operations_lock);
+ list_for_each_entry(candidate, &l_ctx.gp_operations, list) {
+ if (candidate->slot == operation_id) {
+ operation = candidate;
+ list_del(&operation->list);
+ break;
+ }
+ }
+ mutex_unlock(&l_ctx.gp_operations_lock);
+
+ WARN(IS_ERR(operation), "GP operation not found for op id %llx",
+ operation_id);
+ return operation;
+}
+
+static inline int xen_fe_gp_open_session_done(struct tee_xfe *xfe)
+{
+ struct xen_fe_gp_operation *operation;
+
+ mc_dev_devel("received response to gp_open_session for op id %llx",
+ xfe->ring->dom0.operation_id);
+ operation = find_gp_operation(xfe->ring->dom0.operation_id);
+ if (IS_ERR(operation))
+ return PTR_ERR(operation);
+
+ operation->ret = xfe->ring->dom0.cmd_ret;
+ *operation->iws = xfe->ring->dom0.iws;
+ *operation->gp_ret = xfe->ring->dom0.gp_ret;
+ complete(&operation->completion);
+ return 0;
+}
+
+static inline int xen_fe_gp_close_session_done(struct tee_xfe *xfe)
+{
+ struct xen_fe_gp_operation *operation;
+
+ mc_dev_devel("received response to gp_close_session for op id %llx",
+ xfe->ring->dom0.operation_id);
+ operation = find_gp_operation(xfe->ring->dom0.operation_id);
+ if (IS_ERR(operation))
+ return PTR_ERR(operation);
+
+ operation->ret = xfe->ring->dom0.cmd_ret;
+ complete(&operation->completion);
+ return 0;
+}
+
+static inline int xen_fe_gp_invoke_command_done(struct tee_xfe *xfe)
+{
+ struct xen_fe_gp_operation *operation;
+
+ mc_dev_devel("received response to gp_invoke_command for op id %llx",
+ xfe->ring->dom0.operation_id);
+ operation = find_gp_operation(xfe->ring->dom0.operation_id);
+ if (IS_ERR(operation))
+ return PTR_ERR(operation);
+
+ operation->ret = xfe->ring->dom0.cmd_ret;
+ *operation->iws = xfe->ring->dom0.iws;
+ *operation->gp_ret = xfe->ring->dom0.gp_ret;
+ complete(&operation->completion);
+ return 0;
+}
+
+static irqreturn_t xen_fe_irq_handler_dom0_th(int intr, void *arg)
+{
+ struct tee_xfe *xfe = arg;
+
+ /* Dom0 event, their side of ring locked by them */
+ schedule_work(&xfe->work);
+
+ return IRQ_HANDLED;
+}
+
+static void xen_fe_irq_handler_dom0_bh(struct work_struct *data)
+{
+ struct tee_xfe *xfe = container_of(data, struct tee_xfe, work);
+ int ret = -EINVAL;
+
+ mc_dev_devel("Dom0 -> DomU command %u id %u cmd ret %d",
+ xfe->ring->dom0.cmd, xfe->ring->dom0.id,
+ xfe->ring->dom0.cmd_ret);
+ switch (xfe->ring->dom0.cmd) {
+ case TEE_XEN_DOM0_NONE:
+ return;
+ case TEE_XEN_MC_WAIT_DONE:
+ ret = xen_fe_mc_wait_done(xfe);
+ break;
+ case TEE_XEN_GP_OPEN_SESSION_DONE:
+ ret = xen_fe_gp_open_session_done(xfe);
+ break;
+ case TEE_XEN_GP_CLOSE_SESSION_DONE:
+ ret = xen_fe_gp_close_session_done(xfe);
+ break;
+ case TEE_XEN_GP_INVOKE_COMMAND_DONE:
+ ret = xen_fe_gp_invoke_command_done(xfe);
+ break;
+ }
+
+ if (ret)
+ mc_dev_err(ret, "Dom0 -> DomU result %u id %u",
+ xfe->ring->dom0.cmd, xfe->ring->dom0.id);
+ else
+ mc_dev_devel("Dom0 -> DomU result %u id %u",
+ xfe->ring->dom0.cmd, xfe->ring->dom0.id);
+
+ notify_remote_via_evtchn(xfe->evtchn_dom0);
+}
+
+/* Buffer management */
+
+struct xen_fe_map {
+ /* Array of PTE tables, so we can release the associated buffer refs */
+ union tee_xen_mmu_table *pte_tables;
+ int nr_pte_tables;
+ int nr_refs;
+ bool readonly;
+ int pages_created; /* Leak check */
+ int refs_granted; /* Leak check */
+ /* To auto-delete */
+ struct tee_deleter deleter;
+};
+
+static void xen_fe_map_release_pmd(struct xen_fe_map *map,
+ const struct tee_xen_buffer *buffer)
+{
+ int i;
+
+ if (IS_ERR_OR_NULL(map))
+ return;
+
+ for (i = 0; i < map->nr_pte_tables; i++) {
+ gnttab_end_foreign_access(buffer->data.refs[i], true, 0);
+ map->refs_granted--;
+ mc_dev_devel("unmapped table %d ref %u",
+ i, buffer->data.refs[i]);
+ }
+}
+
+static void xen_fe_map_release(struct xen_fe_map *map,
+ const struct tee_xen_buffer *buffer)
+{
+ int nr_refs_left = map->nr_refs;
+ int i;
+
+ if (buffer)
+ xen_fe_map_release_pmd(map, buffer);
+
+ for (i = 0; i < map->nr_pte_tables; i++) {
+ int j, nr_refs = nr_refs_left;
+
+ if (nr_refs > PTE_ENTRIES_MAX)
+ nr_refs = PTE_ENTRIES_MAX;
+
+ for (j = 0; j < nr_refs; j++) {
+ gnttab_end_foreign_access(map->pte_tables[i].refs[j],
+ map->readonly, 0);
+ map->refs_granted--;
+ nr_refs_left--;
+ mc_dev_devel("unmapped [%d, %d] ref %u, left %d",
+ i, j, map->pte_tables[i].refs[j],
+ nr_refs_left);
+ }
+
+ free_page(map->pte_tables[i].page);
+ map->pages_created--;
+ }
+
+ kfree(map->pte_tables);
+ if (map->pages_created || map->refs_granted)
+ mc_dev_err(-EUCLEAN,
+ "leak detected: still in use %d, still ref'd %d",
+ map->pages_created, map->refs_granted);
+
+ kfree(map);
+ atomic_dec(&g_ctx.c_xen_maps);
+ mc_dev_devel("freed map %p: refs=%u nr_pte_tables=%d",
+ map, map->nr_refs, map->nr_pte_tables);
+}
+
+static void xen_fe_map_delete(void *arg)
+{
+ struct xen_fe_map *map = arg;
+
+ xen_fe_map_release(map, NULL);
+}
+
+static struct xen_fe_map *xen_fe_map_create(struct tee_xen_buffer *buffer,
+ const struct mcp_buffer_map *b_map,
+ int dom_id)
+{
+ /* b_map describes the PMD which contains pointers to PTE tables */
+ uintptr_t *pte_tables = (uintptr_t *)(uintptr_t)b_map->addr;
+ struct xen_fe_map *map;
+ unsigned long nr_pte_tables =
+ (b_map->nr_pages + PTE_ENTRIES_MAX - 1) / PTE_ENTRIES_MAX;
+ unsigned long nr_pages_left = b_map->nr_pages;
+ int readonly = !(b_map->flags & MC_IO_MAP_OUTPUT);
+ int ret, i;
+
+ /*
+ * We always map the same way, to simplify:
+ * * the buffer contains references to PTE pages
+ * * PTE pages contain references to the buffer pages
+ */
+ map = kzalloc(sizeof(*map), GFP_KERNEL);
+ if (!map)
+ return ERR_PTR(-ENOMEM);
+
+ atomic_inc(&g_ctx.c_xen_maps);
+ map->readonly = readonly;
+
+ map->pte_tables = kcalloc(nr_pte_tables,
+ sizeof(union tee_xen_mmu_table), GFP_KERNEL);
+ if (!map->pte_tables) {
+ ret = -ENOMEM;
+ goto err;
+ }
+
+ for (i = 0; i < nr_pte_tables; i++) {
+ /* As expected, PTE tables contain pointers to buffer pages */
+ struct page **pages = (struct page **)pte_tables[i];
+ unsigned long nr_pages = nr_pages_left;
+ int j;
+
+ map->pte_tables[i].page = get_zeroed_page(GFP_KERNEL);
+ if (!map->pte_tables[i].page) {
+ ret = -ENOMEM;
+ goto err;
+ }
+ map->pages_created++;
+ map->nr_pte_tables++;
+
+ if (nr_pages > PTE_ENTRIES_MAX)
+ nr_pages = PTE_ENTRIES_MAX;
+
+ /* Create ref for this PTE table */
+ ret = gnttab_grant_foreign_access(
+ dom_id, virt_to_gfn(map->pte_tables[i].addr), true);
+ if (ret < 0) {
+ mc_dev_err(
+ ret,
+ "gnttab_grant_foreign_access failed:\t"
+ "PTE table %d", i);
+ goto err;
+ }
+
+ map->refs_granted++;
+ buffer->data.refs[i] = ret;
+ mc_dev_devel("mapped table %d ref %u for %lu pages",
+ i, buffer->data.refs[i], nr_pages);
+
+ /* Create refs for pages */
+ for (j = 0; j < nr_pages; j++) {
+ ret = gnttab_grant_foreign_access(
+ dom_id, page_to_gfn(pages[j]), readonly);
+ if (ret < 0) {
+ mc_dev_err(
+ ret,
+ "gnttab_grant_foreign_access failed:\t"
+ "PTE %d pg %d", i, j);
+ goto err;
+ }
+
+ map->refs_granted++;
+ map->pte_tables[i].refs[j] = ret;
+ map->nr_refs++;
+ nr_pages_left--;
+ mc_dev_devel("mapped [%d, %d] ref %u, left %lu",
+ i, j, map->pte_tables[i].refs[j],
+ nr_pages_left);
+ }
+ }
+
+ buffer->info->nr_refs = map->nr_refs;
+ buffer->info->addr = (uintptr_t)b_map->mmu;
+ buffer->info->offset = b_map->offset;
+ buffer->info->length = b_map->length;
+ buffer->info->flags = b_map->flags;
+
+ /* Auto-delete */
+ map->deleter.object = map;
+ map->deleter.delete = xen_fe_map_delete;
+ tee_mmu_set_deleter(b_map->mmu, &map->deleter);
+
+ mc_dev_devel("created map %p: refs=%u nr_pte_tables=%d",
+ map, map->nr_refs, map->nr_pte_tables);
+ return map;
+
+err:
+ xen_fe_map_release(map, buffer);
+ return ERR_PTR(ret);
+}
+
+/* DomU call to Dom0 */
+
+/* Must be called under xfe->ring_mutex */
+static inline void call_dom0(struct tee_xfe *xfe, enum tee_xen_domu_cmd cmd)
+{
+ WARN_ON(!xfe->ring_busy);
+
+ xfe->domu_cmd_id++;
+ if (!xfe->domu_cmd_id)
+ xfe->domu_cmd_id++;
+
+ /* Set command and ID */
+ xfe->ring->domu.cmd = cmd;
+ xfe->ring->domu.id = xfe->domu_cmd_id;
+ mc_dev_devel("DomU -> Dom0 request %u id %u pid %d",
+ xfe->ring->domu.cmd, xfe->ring->domu.id, current->pid);
+ /* Call */
+ notify_remote_via_evtchn(xfe->evtchn_domu);
+ wait_for_completion(&xfe->ring_completion);
+}
+
+/* Will be called back under xfe->ring_mutex */
+static irqreturn_t xen_fe_irq_handler_domu_th(int intr, void *arg)
+{
+ struct tee_xfe *xfe = arg;
+
+ WARN_ON(!xfe->ring_busy);
+
+ /* Response to a domU command, our side of ring locked by us */
+ mc_dev_devel("DomU -> Dom0 response %u id %u ret %d",
+ xfe->ring->domu.cmd, xfe->ring->domu.id,
+ xfe->ring->domu.otherend_ret);
+ xfe->ring->domu.cmd = TEE_XEN_DOMU_NONE;
+ xfe->ring->domu.id = 0;
+ complete(&xfe->ring_completion);
+
+ return IRQ_HANDLED;
+}
+
+/* MC protocol interface */
+
+int xen_mc_get_version(struct mc_version_info *version_info)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+
+ ring_get(xfe);
+ /* Call */
+ call_dom0(xfe, TEE_XEN_GET_VERSION);
+ /* Out */
+ memcpy(version_info, &xfe->ring->domu.version_info,
+ sizeof(*version_info));
+ ring_put(xfe);
+ return xfe->ring->domu.otherend_ret;
+}
+
+int xen_mc_open_session(struct mcp_session *session,
+ struct mcp_open_info *info)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct xen_fe_mc_session *fe_mc_session;
+ struct tee_xen_buffer *ta_buffer = &xfe->buffers[1];
+ struct tee_xen_buffer *tci_buffer = &xfe->buffers[0];
+ struct xen_fe_map *ta_map = NULL;
+ struct xen_fe_map *tci_map = NULL;
+ struct tee_mmu *mmu = NULL;
+ enum tee_xen_domu_cmd cmd;
+ int ret;
+
+ fe_mc_session = kzalloc(sizeof(*fe_mc_session), GFP_KERNEL);
+ if (!fe_mc_session)
+ return -ENOMEM;
+
+ INIT_LIST_HEAD(&fe_mc_session->list);
+ init_completion(&fe_mc_session->completion);
+ fe_mc_session->session = session;
+
+ ring_get(xfe);
+ /* In */
+ if (info->type == TEE_MC_UUID) {
+ cmd = TEE_XEN_MC_OPEN_SESSION;
+ xfe->ring->domu.uuid = *info->uuid;
+ } else {
+ struct mc_ioctl_buffer buf = {
+ .va = info->va,
+ .len = info->len,
+ .flags = MC_IO_MAP_INPUT,
+ };
+ struct mcp_buffer_map b_map;
+
+ cmd = TEE_XEN_MC_OPEN_TRUSTLET;
+ /* Use an otherwise unused field to pass the SPID */
+ xfe->ring->domu.spid = info->spid;
+ mmu = tee_mmu_create(info->user ? current->mm : NULL, &buf);
+ if (IS_ERR(mmu)) {
+ ret = PTR_ERR(mmu);
+ mmu = NULL;
+ goto out;
+ }
+
+ tee_mmu_buffer(mmu, &b_map);
+ ta_map = xen_fe_map_create(ta_buffer, &b_map,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(ta_map)) {
+ ret = PTR_ERR(ta_map);
+ goto out;
+ }
+ }
+
+ /* Convert IPAs to grant references in-place */
+ if (info->tci_mmu) {
+ struct mcp_buffer_map b_map;
+
+ tee_mmu_buffer(info->tci_mmu, &b_map);
+ tci_map = xen_fe_map_create(tci_buffer, &b_map,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(tci_map)) {
+ ret = PTR_ERR(tci_map);
+ goto out;
+ }
+ } else {
+ tci_buffer->info->flags = 0;
+ }
+
+ /* Call */
+ call_dom0(xfe, cmd);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ if (!ret)
+ session->sid = xfe->ring->domu.session_id;
+
+out:
+ if (!ret) {
+ mutex_lock(&l_ctx.mc_sessions_lock);
+ list_add_tail(&fe_mc_session->list, &l_ctx.mc_sessions);
+ mutex_unlock(&l_ctx.mc_sessions_lock);
+ } else {
+ kfree(fe_mc_session);
+ }
+
+ xen_fe_map_release_pmd(ta_map, ta_buffer);
+ xen_fe_map_release_pmd(tci_map, tci_buffer);
+ if (mmu)
+ tee_mmu_put(mmu);
+
+ ring_put(xfe);
+ return ret;
+}
+
+int xen_mc_close_session(struct mcp_session *session)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct xen_fe_mc_session *fe_mc_session;
+ int ret;
+
+ fe_mc_session = find_mc_session(session->sid);
+ if (!fe_mc_session)
+ return -ENXIO;
+
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.session_id = session->sid;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_MC_CLOSE_SESSION);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ if (!ret) {
+ mutex_lock(&l_ctx.mc_sessions_lock);
+ session->state = MCP_SESSION_CLOSED;
+ list_del(&fe_mc_session->list);
+ mutex_unlock(&l_ctx.mc_sessions_lock);
+ kfree(fe_mc_session);
+ }
+
+ ring_put(xfe);
+ return ret;
+}
+
+int xen_mc_notify(struct mcp_session *session)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ int ret;
+
+ mc_dev_devel("MC notify session %x", session->sid);
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.session_id = session->sid;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_MC_NOTIFY);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ ring_put(xfe);
+ return ret;
+}
+
+int xen_mc_wait(struct mcp_session *session, s32 timeout, bool silent_expiry)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct xen_fe_mc_session *fe_mc_session;
+ int ret;
+
+ /* Locked by caller so no two waits can happen on one session */
+ fe_mc_session = find_mc_session(session->sid);
+ if (!fe_mc_session)
+ return -ENXIO;
+
+ fe_mc_session->ret = 0;
+
+ mc_dev_devel("MC wait session %x", session->sid);
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.session_id = session->sid;
+ xfe->ring->domu.timeout = timeout;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_MC_WAIT);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ ring_put(xfe);
+
+ if (ret)
+ return ret;
+
+ /* Now wait for notification from Dom0 */
+ ret = wait_for_completion_interruptible(&fe_mc_session->completion);
+ if (!ret)
+ ret = fe_mc_session->ret;
+
+ return ret;
+}
+
+int xen_mc_map(u32 session_id, struct tee_mmu *mmu, u32 *sva)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ struct mcp_buffer_map b_map;
+ struct xen_fe_map *map = NULL;
+ int ret;
+
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.session_id = session_id;
+ tee_mmu_buffer(mmu, &b_map);
+ map = xen_fe_map_create(buffer, &b_map, xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ goto out;
+ }
+
+ /* Call */
+ call_dom0(xfe, TEE_XEN_MC_MAP);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ if (!ret) {
+ *sva = buffer->info->sva;
+ atomic_inc(&g_ctx.c_maps);
+ }
+
+out:
+ xen_fe_map_release_pmd(map, buffer);
+ ring_put(xfe);
+ return ret;
+}
+
+int xen_mc_unmap(u32 session_id, const struct mcp_buffer_map *map)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ int ret;
+
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.session_id = session_id;
+ buffer->info->length = map->length;
+ buffer->info->sva = map->secure_va;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_MC_UNMAP);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ if (!ret)
+ atomic_dec(&g_ctx.c_maps);
+
+ ring_put(xfe);
+ return ret;
+}
+
+int xen_mc_get_err(struct mcp_session *session, s32 *err)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ int ret;
+
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.session_id = session->sid;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_MC_GET_ERR);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ if (!ret)
+ *err = xfe->ring->domu.err;
+
+ mc_dev_devel("MC get_err session %x err %d", session->sid, *err);
+ ring_put(xfe);
+ return ret;
+}
+
+/* GP protocol interface */
+
+int xen_gp_register_shared_mem(struct tee_mmu *mmu, u32 *sva,
+ struct gp_return *gp_ret)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ struct mcp_buffer_map b_map;
+ struct xen_fe_map *map = NULL;
+ int ret;
+
+ ring_get(xfe);
+ /* In */
+ tee_mmu_buffer(mmu, &b_map);
+ map = xen_fe_map_create(buffer, &b_map, xfe->xdev->otherend_id);
+ if (IS_ERR(map)) {
+ ret = PTR_ERR(map);
+ goto out;
+ }
+
+ /* Call */
+ call_dom0(xfe, TEE_XEN_GP_REGISTER_SHARED_MEM);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ if (!ret) {
+ *sva = buffer->info->sva;
+ atomic_inc(&g_ctx.c_maps);
+ }
+
+ if (xfe->ring->domu.gp_ret.origin)
+ *gp_ret = xfe->ring->domu.gp_ret;
+
+out:
+ xen_fe_map_release_pmd(map, buffer);
+ ring_put(xfe);
+ return ret;
+}
+
+int xen_gp_release_shared_mem(struct mcp_buffer_map *map)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct tee_xen_buffer *buffer = &xfe->buffers[0];
+ int ret;
+
+ ring_get(xfe);
+ /* In */
+ buffer->info->addr = (uintptr_t)map->mmu;
+ buffer->info->length = map->length;
+ buffer->info->flags = map->flags;
+ buffer->info->sva = map->secure_va;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_GP_RELEASE_SHARED_MEM);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ if (!ret)
+ atomic_dec(&g_ctx.c_maps);
+
+ ring_put(xfe);
+ return ret;
+}
+
+int xen_gp_open_session(struct iwp_session *session,
+ const struct mc_uuid_t *uuid,
+ const struct iwp_buffer_map *b_maps,
+ struct interworld_session *iws,
+ struct interworld_session *op_iws,
+ struct gp_return *gp_ret)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct xen_fe_gp_operation operation = { .ret = 0 };
+ struct xen_fe_map *maps[4] = { NULL, NULL, NULL, NULL };
+ int i, ret;
+
+ /* Prepare operation first not to be racey */
+ INIT_LIST_HEAD(&operation.list);
+ init_completion(&operation.completion);
+ /* Note: slot is a unique identifier for a session/operation */
+ operation.slot = session->slot;
+ operation.gp_ret = gp_ret;
+ operation.iws = iws;
+ mutex_lock(&l_ctx.gp_operations_lock);
+ list_add_tail(&operation.list, &l_ctx.gp_operations);
+ mutex_unlock(&l_ctx.gp_operations_lock);
+
+ ring_get(xfe);
+ /* The operation may contain tmpref's to map */
+ for (i = 0; i < TEE_BUFFERS; i++) {
+ if (!b_maps[i].map.addr) {
+ xfe->buffers[i].info->flags = 0;
+ continue;
+ }
+
+ maps[i] = xen_fe_map_create(&xfe->buffers[i], &b_maps[i].map,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(maps[i])) {
+ ret = PTR_ERR(maps[i]);
+ goto err;
+ }
+ }
+
+ /* In */
+ xfe->ring->domu.uuid = *uuid;
+ xfe->ring->domu.operation_id = session->slot;
+ xfe->ring->domu.iws = *op_iws;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_GP_OPEN_SESSION);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+err:
+ for (i = 0; i < TEE_BUFFERS; i++)
+ xen_fe_map_release_pmd(maps[i], &xfe->buffers[i]);
+
+ ring_put(xfe);
+ if (ret) {
+ mutex_lock(&l_ctx.gp_operations_lock);
+ list_del(&operation.list);
+ mutex_unlock(&l_ctx.gp_operations_lock);
+ return ret;
+ }
+
+ /* Now wait for notification from Dom0 */
+ wait_for_completion(&operation.completion);
+ /* FIXME origins? */
+ return operation.ret;
+}
+
+int xen_gp_close_session(struct iwp_session *session)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct xen_fe_gp_operation operation = { .ret = 0 };
+ int ret;
+
+ /* Prepare operation first not to be racey */
+ INIT_LIST_HEAD(&operation.list);
+ init_completion(&operation.completion);
+ /* Note: slot is a unique identifier for a session/operation */
+ operation.slot = session->slot;
+ mutex_lock(&l_ctx.gp_operations_lock);
+ list_add_tail(&operation.list, &l_ctx.gp_operations);
+ mutex_unlock(&l_ctx.gp_operations_lock);
+
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.session_id = session->sid;
+ xfe->ring->domu.operation_id = session->slot;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_GP_CLOSE_SESSION);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ ring_put(xfe);
+ if (ret) {
+ mutex_lock(&l_ctx.gp_operations_lock);
+ list_del(&operation.list);
+ mutex_unlock(&l_ctx.gp_operations_lock);
+ return ret;
+ }
+
+ /* Now wait for notification from Dom0 */
+ wait_for_completion(&operation.completion);
+ return operation.ret;
+}
+
+int xen_gp_invoke_command(struct iwp_session *session,
+ const struct iwp_buffer_map *b_maps,
+ struct interworld_session *iws,
+ struct gp_return *gp_ret)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ struct xen_fe_gp_operation operation = { .ret = 0 };
+ struct xen_fe_map *maps[4] = { NULL, NULL, NULL, NULL };
+ int i, ret;
+
+ /* Prepare operation first not to be racey */
+ INIT_LIST_HEAD(&operation.list);
+ init_completion(&operation.completion);
+ /* Note: slot is a unique identifier for a session/operation */
+ operation.slot = session->slot;
+ operation.gp_ret = gp_ret;
+ operation.iws = iws;
+ mutex_lock(&l_ctx.gp_operations_lock);
+ list_add_tail(&operation.list, &l_ctx.gp_operations);
+ mutex_unlock(&l_ctx.gp_operations_lock);
+
+ ring_get(xfe);
+ /* The operation is in op_iws and may contain tmpref's to map */
+ for (i = 0; i < TEE_BUFFERS; i++) {
+ if (!b_maps[i].map.addr) {
+ xfe->buffers[i].info->flags = 0;
+ continue;
+ }
+
+ maps[i] = xen_fe_map_create(&xfe->buffers[i], &b_maps[i].map,
+ xfe->xdev->otherend_id);
+ if (IS_ERR(maps[i])) {
+ ret = PTR_ERR(maps[i]);
+ goto err;
+ }
+ }
+
+ /* In */
+ xfe->ring->domu.session_id = session->sid;
+ xfe->ring->domu.operation_id = session->slot;
+ xfe->ring->domu.iws = *iws;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_GP_INVOKE_COMMAND);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+err:
+ for (i = 0; i < TEE_BUFFERS; i++)
+ xen_fe_map_release_pmd(maps[i], &xfe->buffers[i]);
+
+ ring_put(xfe);
+ if (ret) {
+ mutex_lock(&l_ctx.gp_operations_lock);
+ list_del(&operation.list);
+ mutex_unlock(&l_ctx.gp_operations_lock);
+ return ret;
+ }
+
+ /* Now wait for notification from Dom0 */
+ wait_for_completion(&operation.completion);
+ /* FIXME origins? */
+ return operation.ret;
+}
+
+int xen_gp_request_cancellation(u64 slot)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+ int ret;
+
+ ring_get(xfe);
+ /* In */
+ xfe->ring->domu.operation_id = slot;
+ /* Call */
+ call_dom0(xfe, TEE_XEN_GP_REQUEST_CANCELLATION);
+ /* Out */
+ ret = xfe->ring->domu.otherend_ret;
+ ring_put(xfe);
+ return ret;
+}
+
+/* Device */
+
+static inline void xfe_release(struct tee_xfe *xfe)
+{
+ int i;
+
+ if (xfe->irq_domu >= 0)
+ unbind_from_irqhandler(xfe->irq_domu, xfe);
+
+ if (xfe->irq_dom0 >= 0)
+ unbind_from_irqhandler(xfe->irq_dom0, xfe);
+
+ if (xfe->evtchn_domu >= 0)
+ xenbus_free_evtchn(xfe->xdev, xfe->evtchn_domu);
+
+ if (xfe->evtchn_dom0 >= 0)
+ xenbus_free_evtchn(xfe->xdev, xfe->evtchn_dom0);
+
+ for (i = 0; i < TEE_BUFFERS; i++) {
+ if (!xfe->buffers[i].data.page)
+ break;
+
+ gnttab_end_foreign_access(xfe->ring->domu.buffers[i].pmd_ref, 0,
+ xfe->buffers[i].data.page);
+ free_page(xfe->buffers[i].data.page);
+ }
+
+ if (xfe->ring_ul) {
+ gnttab_end_foreign_access(xfe->ring_ref, 0, xfe->ring_ul);
+ free_page(xfe->ring_ul);
+ }
+
+ kfree(xfe);
+}
+
+static inline struct tee_xfe *xfe_create(struct xenbus_device *xdev)
+{
+ struct tee_xfe *xfe;
+ struct xenbus_transaction trans;
+ int i, ret = -ENOMEM;
+
+ /* Alloc */
+ xfe = tee_xfe_create(xdev);
+ if (!xfe)
+ return ERR_PTR(-ENOMEM);
+
+ /* Create shared information buffer */
+ xfe->ring_ul = get_zeroed_page(GFP_KERNEL);
+ if (!xfe->ring_ul)
+ goto err;
+
+ /* Connect */
+ ret = xenbus_grant_ring(xfe->xdev, xfe->ring, 1, &xfe->ring_ref);
+ if (ret < 0)
+ goto err;
+
+ for (i = 0; i < TEE_BUFFERS; i++) {
+ xfe->buffers[i].data.page = get_zeroed_page(GFP_KERNEL);
+ if (!xfe->buffers[i].data.page)
+ goto err;
+
+ ret = xenbus_grant_ring(xfe->xdev, xfe->buffers[i].data.addr, 1,
+ &xfe->ring->domu.buffers[i].pmd_ref);
+ if (ret < 0)
+ goto err;
+
+ xfe->buffers[i].info = &xfe->ring->domu.buffers[i];
+ }
+
+ ret = xenbus_alloc_evtchn(xfe->xdev, &xfe->evtchn_domu);
+ if (ret)
+ goto err;
+
+ ret = xenbus_alloc_evtchn(xfe->xdev, &xfe->evtchn_dom0);
+ if (ret)
+ goto err;
+
+ ret = bind_evtchn_to_irqhandler(xfe->evtchn_domu,
+ xen_fe_irq_handler_domu_th, 0,
+ "tee_fe_domu", xfe);
+ if (ret < 0)
+ goto err;
+
+ xfe->irq_domu = ret;
+
+ ret = bind_evtchn_to_irqhandler(xfe->evtchn_dom0,
+ xen_fe_irq_handler_dom0_th, 0,
+ "tee_fe_dom0", xfe);
+ if (ret < 0)
+ goto err;
+
+ xfe->irq_dom0 = ret;
+
+ /* Publish */
+ do {
+ ret = xenbus_transaction_start(&trans);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to start transaction");
+ goto err_transaction;
+ }
+
+ /* Ring is one page to support older kernels */
+ ret = xenbus_printf(trans, xfe->xdev->nodename,
+ "ring-ref", "%u", xfe->ring_ref);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to write ring ref");
+ goto err_transaction;
+ }
+
+ ret = xenbus_printf(trans, xfe->xdev->nodename,
+ "pte-entries-max", "%u",
+ PTE_ENTRIES_MAX);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to write PTE entries max");
+ goto err_transaction;
+ }
+
+ ret = xenbus_printf(trans, xfe->xdev->nodename,
+ "event-channel-domu", "%u",
+ xfe->evtchn_domu);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to write event channel domu");
+ goto err_transaction;
+ }
+
+ ret = xenbus_printf(trans, xfe->xdev->nodename,
+ "event-channel-dom0", "%u",
+ xfe->evtchn_dom0);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to write event channel dom0");
+ goto err_transaction;
+ }
+
+ ret = xenbus_printf(trans, xfe->xdev->nodename,
+ "domu-version", "%u", TEE_XEN_VERSION);
+ if (ret) {
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to write version");
+ goto err_transaction;
+ }
+
+ ret = xenbus_transaction_end(trans, 0);
+ if (ret) {
+ if (ret == -EAGAIN)
+ mc_dev_devel("retry");
+ else
+ xenbus_dev_fatal(xfe->xdev, ret,
+ "failed to end transaction");
+ }
+ } while (ret == -EAGAIN);
+
+ mc_dev_devel("evtchn domu=%u dom0=%u version=%u",
+ xfe->evtchn_domu, xfe->evtchn_dom0, TEE_XEN_VERSION);
+ xenbus_switch_state(xfe->xdev, XenbusStateInitialised);
+ return xfe;
+
+err_transaction:
+err:
+ xenbus_switch_state(xfe->xdev, XenbusStateClosed);
+ xfe_release(xfe);
+ return ERR_PTR(ret);
+}
+
+static const struct xenbus_device_id xen_fe_ids[] = {
+ { "tee_xen" },
+ { "" }
+};
+
+static int xen_fe_probe(struct xenbus_device *xdev,
+ const struct xenbus_device_id *id)
+{
+ int ret;
+
+ ret = l_ctx.probe();
+ if (ret)
+ return ret;
+
+ l_ctx.xfe = xfe_create(xdev);
+ if (IS_ERR(l_ctx.xfe))
+ return PTR_ERR(l_ctx.xfe);
+
+ INIT_WORK(&l_ctx.xfe->work, xen_fe_irq_handler_dom0_bh);
+
+ return 0;
+}
+
+static void xen_fe_backend_changed(struct xenbus_device *xdev,
+ enum xenbus_state be_state)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+
+ mc_dev_devel("be state changed to %d", be_state);
+
+ if (be_state == l_ctx.last_be_state) {
+ /* Protection against duplicated notifications (TBUG-1387) */
+ mc_dev_devel("be state (%d) already set... ignoring", be_state);
+ return;
+ }
+
+ switch (be_state) {
+ case XenbusStateUnknown:
+ case XenbusStateInitialising:
+ case XenbusStateInitWait:
+ case XenbusStateInitialised:
+ break;
+ case XenbusStateConnected:
+ if (l_ctx.start())
+ xenbus_switch_state(xfe->xdev, XenbusStateClosing);
+ else
+ xenbus_switch_state(xfe->xdev, XenbusStateConnected);
+ break;
+ case XenbusStateClosing:
+ case XenbusStateClosed:
+ case XenbusStateReconfiguring:
+ case XenbusStateReconfigured:
+ break;
+ }
+
+ /* Refresh last back-end state */
+ l_ctx.last_be_state = be_state;
+}
+
+static struct xenbus_driver xen_fe_driver = {
+ .ids = xen_fe_ids,
+ .probe = xen_fe_probe,
+ .otherend_changed = xen_fe_backend_changed,
+};
+
+int xen_fe_init(int (*probe)(void), int (*start)(void))
+{
+ l_ctx.probe = probe;
+ l_ctx.start = start;
+ mutex_init(&l_ctx.mc_sessions_lock);
+ INIT_LIST_HEAD(&l_ctx.mc_sessions);
+ mutex_init(&l_ctx.gp_operations_lock);
+ INIT_LIST_HEAD(&l_ctx.gp_operations);
+ return xenbus_register_frontend(&xen_fe_driver);
+}
+
+void xen_fe_exit(void)
+{
+ struct tee_xfe *xfe = l_ctx.xfe;
+
+ tee_xfe_put(xfe);
+ xenbus_unregister_driver(&xen_fe_driver);
+}
+
+#endif /* TRUSTONIC_XEN_DOMU */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_fe.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_fe.h
new file mode 100644
index 0000000..c2030a7
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/MobiCoreDriver/xen_fe.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _MC_XEN_FE_H_
+#define _MC_XEN_FE_H_
+
+#include <linux/version.h>
+
+#include "main.h"
+#include "client.h"
+#include "iwp.h"
+#include "mcp.h"
+
+#ifdef TRUSTONIC_XEN_DOMU
+/* MC protocol interface */
+int xen_mc_get_version(struct mc_version_info *version_info);
+int xen_mc_open_session(struct mcp_session *session,
+ struct mcp_open_info *info);
+int xen_mc_close_session(struct mcp_session *session);
+int xen_mc_map(u32 session_id, struct tee_mmu *mmu, u32 *sva);
+int xen_mc_unmap(u32 session_id, const struct mcp_buffer_map *map);
+int xen_mc_notify(struct mcp_session *session);
+int xen_mc_wait(struct mcp_session *session, s32 timeout, bool silent_expiry);
+int xen_mc_get_err(struct mcp_session *session, s32 *err);
+/* GP protocol interface */
+int xen_gp_register_shared_mem(struct tee_mmu *mmu, u32 *sva,
+ struct gp_return *gp_ret);
+int xen_gp_release_shared_mem(struct mcp_buffer_map *map);
+int xen_gp_open_session(struct iwp_session *session,
+ const struct mc_uuid_t *uuid,
+ const struct iwp_buffer_map *maps,
+ struct interworld_session *iws,
+ struct interworld_session *op_iws,
+ struct gp_return *gp_ret);
+int xen_gp_close_session(struct iwp_session *session);
+int xen_gp_invoke_command(struct iwp_session *session,
+ const struct iwp_buffer_map *maps,
+ struct interworld_session *iws,
+ struct gp_return *gp_ret);
+int xen_gp_request_cancellation(u64 slot);
+
+int xen_fe_init(int (*probe)(void), int (*start)(void));
+void xen_fe_exit(void);
+#else
+static inline int xen_fe_init(int (*probe)(void), int (*start)(void))
+{
+ return 0;
+}
+
+static inline void xen_fe_exit(void)
+{
+}
+#endif
+
+#endif /* _MC_XEN_FE_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/Makefile b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/Makefile
new file mode 100644
index 0000000..6aaae1f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/Makefile
@@ -0,0 +1,35 @@
+# Copyright (c) 2013-2018 TRUSTONIC LIMITED
+# All Rights Reserved.
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# version 2 as published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+#
+# Makefile for the Kinibi trusted UI driver
+#
+
+GUD_ROOT_FOLDER := drivers/gud/
+
+# add our modules to kernel.
+obj-$(CONFIG_TRUSTONIC_TRUSTED_UI) += TlcTui.o
+
+TlcTui-y := main.o tlcTui.o trustedui.o tui-hal.o
+
+# Release mode by default
+ccflags-y += -DNDEBUG
+ccflags-y += -Wno-declaration-after-statement
+
+ccflags-$(CONFIG_TRUSTONIC_TEE_DEBUG) += -DDEBUG
+
+# MobiCore Driver includes
+ccflags-y += -I$(GUD_ROOT_FOLDER)/MobiCoreDriver/public
+
+# MobiCore TlcTui required includes
+ccflags-y += -I$(GUD_ROOT_FOLDER)/TlcTui/inc \
+ -I$(GUD_ROOT_FOLDER)/TlcTui/public
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/build_tag.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/build_tag.h
new file mode 100644
index 0000000..db7db6f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/build_tag.h
@@ -0,0 +1,8 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#ifndef MOBICORE_COMPONENT_BUILD_TAG
+#define MOBICORE_COMPONENT_BUILD_TAG \
+ "t-base-MTK-A64-Android-410a-V002-20190318_110437_65733_93363"
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/inc/dciTui.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/inc/dciTui.h
new file mode 100644
index 0000000..dd3e54b
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/inc/dciTui.h
@@ -0,0 +1,158 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef __DCITUI_H__
+#define __DCITUI_H__
+
+/* Linux checkpatch suggests to use the BIT macro */
+#ifndef BIT
+#define BIT(n) (1U << (n))
+#endif
+
+#ifndef u32
+#define u32 uint32_t
+#endif
+
+#ifndef u64
+#define u64 uint64_t
+#endif
+
+/**< Responses have bit 31 set */
+#define RSP_ID_MASK BIT(31)
+
+#define RSP_ID(cmd_id) (((u32)(cmd_id)) | RSP_ID_MASK)
+#define IS_CMD(cmd_id) ((((u32)(cmd_id)) & RSP_ID_MASK) == 0)
+#define IS_RSP(cmd_id) ((((u32)(cmd_id)) & RSP_ID_MASK) == RSP_ID_MASK)
+#define CMD_ID_FROM_RSP(rsp_id) ((rsp_id) & (~RSP_ID_MASK))
+
+/**
+ * Return codes of driver commands.
+ */
+#define TUI_DCI_OK 0x00030000
+#define TUI_DCI_ERR_UNKNOWN_CMD 0x00030001
+#define TUI_DCI_ERR_NOT_SUPPORTED 0x00030002
+#define TUI_DCI_ERR_INTERNAL_ERROR 0x00030003
+#define TUI_DCI_ERR_NO_RESPONSE 0x00030004
+#define TUI_DCI_ERR_BAD_PARAMETERS 0x00030005
+#define TUI_DCI_ERR_NO_EVENT 0x00030006
+#define TUI_DCI_ERR_OUT_OF_DISPLAY 0x00030007
+/* ... add more error codes when needed */
+
+/**
+ * Notification ID's for communication Trustlet Connector -> Driver.
+ */
+#define NOT_TUI_NONE 0
+/* NWd system event that closes the current TUI session*/
+#define NOT_TUI_CANCEL_EVENT 1
+/* TODO put this in HAL specific code */
+#define NOT_TUI_HAL_TOUCH_EVENT 0x80000001
+
+/**
+ * Command ID's for communication Driver -> Trustlet Connector.
+ */
+#define CMD_TUI_SW_NONE 0
+/* SWd request to NWd to start the TUI session */
+#define CMD_TUI_SW_OPEN_SESSION 1
+/* SWd request to NWd to close the TUI session */
+#define CMD_TUI_SW_CLOSE_SESSION 2
+/* SWd request to NWd stop accessing display controller */
+#define CMD_TUI_SW_STOP_DISPLAY 3
+/* SWd request to get TlcTui DCI version */
+#define CMD_TUI_SW_GET_VERSION 4
+/* SWd request to NWd to execute a HAL command */
+#define CMD_TUI_SW_HAL 5
+
+#define CMD_TUI_HAL_NONE 0
+#define CMD_TUI_HAL_QUEUE_BUFFER 1
+#define CMD_TUI_HAL_QUEUE_DEQUEUE_BUFFER 2
+#define CMD_TUI_HAL_CLEAR_TOUCH_INTERRUPT 3
+#define CMD_TUI_HAL_HIDE_SURFACE 4
+#define CMD_TUI_HAL_GET_RESOLUTION 5
+
+/**
+ * Maximum data length.
+ */
+#define MAX_DCI_DATA_LEN (1024 * 100)
+
+/*
+ * TUI DCI VERSION
+ */
+#define TUI_DCI_VERSION_MAJOR (1u)
+#define TUI_DCI_VERSION_MINOR (1u)
+
+#define TUI_DCI_VERSION(major, minor) \
+ ((((major) & 0x0000ffff) << 16) | ((minor) & 0x0000ffff))
+#define TUI_DCI_VERSION_GET_MAJOR(version) (((version) >> 16) & 0x0000ffff)
+#define TUI_DCI_VERSION_GET_MINOR(version) ((version) & 0x0000ffff)
+
+/* Command payload */
+
+struct tui_disp_data_t {
+ u32 buff_id;
+};
+
+struct tui_hal_cmd_t {
+ u32 id; /* Id of the HAL command */
+ u32 size; /* Size of the data associated to the HAL command */
+ u64 data[2]; /* Data associated to the HAL command */
+};
+
+struct tui_hal_rsp_t {
+ u32 id; /* Id of the HAL response */
+ u32 return_code; /* Return code of the HAL response */
+ u32 size; /* Size of the data associated to the HAL response */
+ u32 data[3]; /* Data associated to the HAL response */
+};
+
+struct tui_alloc_data_t {
+ u32 alloc_size;
+ u32 num_of_buff;
+};
+
+union dci_cmd_payload_t {
+ struct tui_alloc_data_t alloc_data;
+ struct tui_disp_data_t disp_data;
+ struct tui_hal_cmd_t hal;
+};
+
+/* Command */
+struct dci_command_t {
+ u32 id;
+ union dci_cmd_payload_t payload;
+};
+
+/* TUI frame buffer (output from NWd) */
+struct tui_alloc_buffer_t {
+ u64 pa;
+};
+
+#define MAX_DCI_BUFFER_NUMBER 4
+
+/* Response */
+struct dci_response_t {
+ u32 id; /* must be command ID | RSP_ID_MASK */
+ u32 return_code;
+ union {
+ struct tui_alloc_buffer_t alloc_buffer[MAX_DCI_BUFFER_NUMBER];
+ struct tui_hal_rsp_t hal_rsp;
+ };
+};
+
+/* DCI buffer */
+struct tui_dci_msg_t {
+ u32 version;
+ u32 nwd_notif; /* Notification from TlcTui to DrTui */
+ struct dci_command_t cmd_nwd; /* Command from DrTui to TlcTui */
+ struct dci_response_t nwd_rsp; /* Response from TlcTui to DrTui */
+ u32 hal_cmd;
+ u32 hal_rsp;
+};
+
+/**
+ * Driver UUID. Update accordingly after reserving UUID
+ */
+#define DR_TUI_UUID { { 7, 0xC, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 } }
+
+#endif /* __DCITUI_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/inc/t-base-tui.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/inc/t-base-tui.h
new file mode 100644
index 0000000..e5fbfe7
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/inc/t-base-tui.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef __TBASE_TUI_H__
+#define __TBASE_TUI_H__
+
+#define TRUSTEDUI_MODE_OFF 0x00
+#define TRUSTEDUI_MODE_ALL 0xff
+#define TRUSTEDUI_MODE_TUI_SESSION 0x01
+#define TRUSTEDUI_MODE_VIDEO_SECURED 0x02
+#define TRUSTEDUI_MODE_INPUT_SECURED 0x04
+
+#ifdef CONFIG_TRUSTONIC_TRUSTED_UI
+
+int trustedui_blank_inc(void);
+int trustedui_blank_dec(void);
+int trustedui_blank_get_counter(void);
+void trustedui_blank_set_counter(int counter);
+
+int trustedui_get_current_mode(void);
+void trustedui_set_mode(int mode);
+int trustedui_set_mask(int mask);
+int trustedui_clear_mask(int mask);
+
+#endif /* CONFIG_TRUSTONIC_TRUSTED_UI */
+
+#endif /* __TBASE_TUI_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/main.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/main.c
new file mode 100644
index 0000000..5981e45
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/main.c
@@ -0,0 +1,207 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/ioctl.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/cdev.h>
+#include <linux/completion.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+
+#include "tui_ioctl.h"
+#include "tlcTui.h"
+#include "mobicore_driver_api.h"
+#include "dciTui.h"
+#include "tui-hal.h"
+#include "build_tag.h"
+
+/*static int tui_dev_major_number = 122; */
+
+/*module_param(tui_dev_major_number, int, 0000); */
+/*MODULE_PARM_DESC(major, */
+/* "The device major number used to register a unique char device driver"); */
+
+/* Static variables */
+static struct cdev tui_cdev;
+
+static long tui_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
+{
+ int ret = -ENOTTY;
+ int __user *uarg = (int __user *)arg;
+
+ if (_IOC_TYPE(cmd) != TUI_IO_MAGIC)
+ return -EINVAL;
+
+ pr_info("t-base-tui module: ioctl 0x%x ", cmd);
+
+ switch (cmd) {
+ case TUI_IO_SET_RESOLUTION:
+ /* TLC_TUI_CMD_SET_RESOLUTION is for specific platforms
+ * that rely on onConfigurationChanged to set resolution
+ * it has no effect on Trustonic reference implementaton.
+ */
+ pr_info("TLC_TUI_CMD_SET_RESOLUTION\n");
+ /* NOT IMPLEMENTED */
+ ret = 0;
+ break;
+ case TUI_IO_NOTIFY:
+ pr_info("TUI_IO_NOTIFY\n");
+
+ if (tlc_notify_event(arg))
+ ret = 0;
+ else
+ ret = -EFAULT;
+ break;
+
+ case TUI_IO_WAITCMD: {
+ struct tlc_tui_command_t tui_cmd = {0};
+
+ pr_info("TUI_IO_WAITCMD\n");
+
+ ret = tlc_wait_cmd(&tui_cmd);
+ if (ret) {
+ pr_debug("ERROR %s:%d tlc_wait_cmd returned (0x%08X)\n",
+ __func__, __LINE__, ret);
+ return ret;
+ }
+
+ /* Write command id to user */
+ pr_debug("IOCTL: sending command %d to user.\n", tui_cmd.id);
+
+ if (copy_to_user(uarg, &tui_cmd, sizeof(
+ struct tlc_tui_command_t)))
+ ret = -EFAULT;
+ else
+ ret = 0;
+
+ break;
+ }
+
+ case TUI_IO_ACK: {
+ struct tlc_tui_response_t rsp_id;
+
+ pr_info("TUI_IO_ACK\n");
+
+ /* Read user response */
+ if (copy_from_user(&rsp_id, uarg, sizeof(rsp_id)))
+ ret = -EFAULT;
+ else
+ ret = 0;
+
+ pr_debug("IOCTL: User completed command %d.\n", rsp_id.id);
+ ret = tlc_ack_cmd(&rsp_id);
+ if (ret)
+ return ret;
+ break;
+ }
+
+ case TUI_IO_INIT_DRIVER: {
+ pr_info("TUI_IO_INIT_DRIVER\n");
+
+ ret = tlc_init_driver();
+ if (ret) {
+ pr_debug("ERROR %s:%d tlc_init_driver returned (0x%08X)\n",
+ __func__, __LINE__, ret);
+ return ret;
+ }
+ break;
+ }
+
+ default:
+ pr_info("ERROR %s:%d Unknown ioctl (%u)!\n", __func__,
+ __LINE__, cmd);
+ return -ENOTTY;
+ }
+
+ return ret;
+}
+
+atomic_t fileopened;
+
+static int tui_open(struct inode *inode, struct file *file)
+{
+ pr_info("TUI file opened\n");
+ atomic_inc(&fileopened);
+ return 0;
+}
+
+static int tui_release(struct inode *inode, struct file *file)
+{
+ pr_info("TUI file closed\n");
+ if (atomic_dec_and_test(&fileopened))
+ tlc_notify_event(NOT_TUI_CANCEL_EVENT);
+
+ return 0;
+}
+
+static const struct file_operations tui_fops = {
+ .owner = THIS_MODULE,
+ .unlocked_ioctl = tui_ioctl,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = tui_ioctl,
+#endif
+ .open = tui_open,
+ .release = tui_release
+};
+
+/*--------------------------------------------------------------------------- */
+static int __init tlc_tui_init(void)
+{
+ pr_info("Loading t-base-tui module.\n");
+ pr_debug("\n=============== Running TUI Kernel TLC ===============\n");
+ pr_info("%s\n", MOBICORE_COMPONENT_BUILD_TAG);
+
+ dev_t devno;
+ int err;
+ static struct class *tui_class;
+
+ atomic_set(&fileopened, 0);
+
+ err = alloc_chrdev_region(&devno, 0, 1, TUI_DEV_NAME);
+ if (err) {
+ pr_debug("Unable to allocate Trusted UI device number\n");
+ return err;
+ }
+
+ cdev_init(&tui_cdev, &tui_fops);
+ tui_cdev.owner = THIS_MODULE;
+ /* tui_cdev.ops = &tui_fops; */
+
+ err = cdev_add(&tui_cdev, devno, 1);
+ if (err) {
+ pr_debug("Unable to add Trusted UI char device\n");
+ unregister_chrdev_region(devno, 1);
+ return err;
+ }
+
+ tui_class = class_create(THIS_MODULE, "tui_cls");
+ device_create(tui_class, NULL, devno, NULL, TUI_DEV_NAME);
+
+ if (!hal_tui_init())
+ return -EPERM;
+
+ return 0;
+}
+
+static void __exit tlc_tui_exit(void)
+{
+ pr_info("Unloading t-base-tui module.\n");
+
+ unregister_chrdev_region(tui_cdev.dev, 1);
+ cdev_del(&tui_cdev);
+
+ hal_tui_exit();
+}
+
+module_init(tlc_tui_init);
+module_exit(tlc_tui_exit);
+
+MODULE_AUTHOR("Trustonic Limited");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Kinibi TUI");
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/public/tui_ioctl.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/public/tui_ioctl.h
new file mode 100644
index 0000000..4e551ad
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/public/tui_ioctl.h
@@ -0,0 +1,92 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef TUI_IOCTL_H_
+#define TUI_IOCTL_H_
+
+#define MAX_BUFFER_NUMBER 3
+
+#ifndef u32
+#define u32 uint32_t
+#endif
+
+/* Command header */
+struct tlc_tui_command_t {
+ u32 id;
+ u32 data[2];
+};
+
+/* Response header */
+struct tlc_tui_response_t {
+ u32 id;
+ u32 return_code;
+ int ion_fd[MAX_BUFFER_NUMBER];
+ u32 screen_metrics[3];
+};
+
+/* Resolution */
+struct tlc_tui_resolution_t {
+ u32 width;
+ u32 height;
+};
+
+/* Command IDs */
+/* */
+#define TLC_TUI_CMD_NONE 0
+/* Start TUI session */
+#define TLC_TUI_CMD_START_ACTIVITY 1
+/* Stop TUI session */
+#define TLC_TUI_CMD_STOP_ACTIVITY 2
+/*
+ * Queue a buffer
+ * IN: index of buffer to be queued
+ */
+#define TLC_TUI_CMD_QUEUE 3
+/*
+ * Queue a new buffer and dequeue the buffer currently displayed
+ * IN: indexes of buffer to be queued
+ */
+#define TLC_TUI_CMD_QUEUE_DEQUEUE 4
+/*
+ * Alloc buffers
+ * IN: number of buffers
+ * OUT: ion fd
+ */
+#define TLC_TUI_CMD_ALLOC_FB 5
+/* Free buffers */
+#define TLC_TUI_CMD_FREE_FB 6
+/* hide secure surface */
+#define TLC_TUI_CMD_HIDE_SURFACE 7
+#define TLC_TUI_CMD_GET_RESOLUTION 8
+
+/* TLC_TUI_CMD_SET_RESOLUTION is for specific platforms
+ * that rely on onConfigurationChanged to set resolution
+ * it has no effect on Trustonic reference implementaton.
+ */
+#define TLC_TUI_CMD_SET_RESOLUTION 9
+
+/* Return codes */
+#define TLC_TUI_OK 0
+#define TLC_TUI_ERROR 1
+#define TLC_TUI_ERR_UNKNOWN_CMD 2
+
+/*
+ * defines for the ioctl TUI driver module function call from user space.
+ */
+#define TUI_DEV_NAME "t-base-tui"
+
+#define TUI_IO_MAGIC 't'
+
+#define TUI_IO_NOTIFY _IOW(TUI_IO_MAGIC, 1, u32)
+#define TUI_IO_WAITCMD _IOR(TUI_IO_MAGIC, 2, struct tlc_tui_command_t)
+#define TUI_IO_ACK _IOW(TUI_IO_MAGIC, 3, struct tlc_tui_response_t)
+#define TUI_IO_INIT_DRIVER _IO(TUI_IO_MAGIC, 4)
+#define TUI_IO_SET_RESOLUTION _IOW(TUI_IO_MAGIC, 9, struct tlc_tui_resolution_t)
+
+#ifdef INIT_COMPLETION
+#define reinit_completion(x) INIT_COMPLETION(*(x))
+#endif
+
+#endif /* TUI_IOCTL_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tlcTui.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tlcTui.c
new file mode 100644
index 0000000..e12909e
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tlcTui.c
@@ -0,0 +1,501 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/string.h>
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/kernel.h>
+#include <linux/kthread.h>
+
+#include "mobicore_driver_api.h"
+#include "tui_ioctl.h"
+#include "tlcTui.h"
+#include "dciTui.h"
+#include "tui-hal.h"
+
+/* ------------------------------------------------------------- */
+/* Globals */
+struct tui_dci_msg_t *dci;
+static DECLARE_COMPLETION(dci_comp);
+static DECLARE_COMPLETION(io_comp);
+
+/* ------------------------------------------------------------- */
+/* Static */
+static const u32 DEVICE_ID = MC_DEVICE_ID_DEFAULT;
+static struct task_struct *thread_id;
+static DEFINE_MUTEX(thread_mutex);
+static struct tlc_tui_command_t g_user_cmd = {.id = TLC_TUI_CMD_NONE};
+static struct mc_session_handle dr_session_handle = {0, 0};
+struct tlc_tui_response_t g_user_rsp = {.id = TLC_TUI_CMD_NONE,
+ .return_code = TLC_TUI_ERR_UNKNOWN_CMD};
+static bool g_dci_version_checked;
+
+/* Functions */
+
+/* ------------------------------------------------------------- */
+static bool tlc_open_driver(void)
+{
+ bool ret = false;
+ enum mc_result mc_ret;
+ struct mc_uuid_t dr_uuid = DR_TUI_UUID;
+
+ /* Allocate WSM buffer for the DCI */
+ mc_ret = mc_malloc_wsm(DEVICE_ID, 0, sizeof(struct tui_dci_msg_t),
+ (uint8_t **)&dci, 0);
+ if (mc_ret != MC_DRV_OK) {
+ pr_debug("ERROR %s:%d Allocation of DCI WSM failed: %d\n",
+ __func__, __LINE__, mc_ret);
+ return false;
+ }
+
+ /* Clear the session handle */
+ memset(&dr_session_handle, 0, sizeof(dr_session_handle));
+ /* The device ID (default device is used */
+ dr_session_handle.device_id = DEVICE_ID;
+ /* Open session with the Driver */
+ mc_ret = mc_open_session(&dr_session_handle, &dr_uuid, (uint8_t *)dci,
+ (u32)sizeof(struct tui_dci_msg_t));
+ if (mc_ret != MC_DRV_OK) {
+ pr_debug("ERROR %s:%d Open driver session failed: %d\n",
+ __func__, __LINE__, mc_ret);
+ ret = false;
+ } else {
+ ret = true;
+ }
+
+ return ret;
+}
+
+/* ------------------------------------------------------------- */
+static bool tlc_open(void)
+{
+ bool ret = false;
+ enum mc_result mc_ret;
+
+ /* Open the tbase device */
+ pr_debug("%s: Opening tbase device\n", __func__);
+ mc_ret = mc_open_device(DEVICE_ID);
+
+ /* In case the device is already open, mc_open_device will return an
+ * error (MC_DRV_ERR_INVALID_OPERATION). But in this case, we can
+ * continue, even though mc_open_device returned an error. Stop in all
+ * other case of error
+ */
+ if (MC_DRV_OK != mc_ret && MC_DRV_ERR_INVALID_OPERATION != mc_ret) {
+ pr_debug("ERROR %s:%d Error %d opening device\n", __func__,
+ __LINE__, mc_ret);
+ return false;
+ }
+
+ pr_debug("%s: Opening driver session\n", __func__);
+ ret = tlc_open_driver();
+
+ return ret;
+}
+
+/* ------------------------------------------------------------- */
+static void tlc_wait_cmd_from_driver(void)
+{
+ u32 ret = TUI_DCI_ERR_INTERNAL_ERROR;
+
+ /* Wait for a command from secure driver */
+ ret = mc_wait_notification(&dr_session_handle, -1);
+ if (ret == MC_DRV_OK)
+ pr_debug("%s: Got a command\n", __func__);
+ else
+ pr_debug("ERROR %s:%d mc_wait_notification() failed: %d\n",
+ __func__, __LINE__, ret);
+}
+
+struct mc_session_handle *get_session_handle(void)
+{
+ return &dr_session_handle;
+}
+
+u32 send_cmd_to_user(u32 command_id, u32 data0, u32 data1)
+{
+ u32 ret = TUI_DCI_ERR_NO_RESPONSE;
+ int retry = 10;
+
+ /* Init shared variables */
+ g_user_cmd.id = command_id;
+ g_user_cmd.data[0] = data0;
+ g_user_cmd.data[1] = data1;
+ /* Erase the rsp struct */
+ memset(&g_user_rsp, 0, sizeof(g_user_rsp));
+ g_user_rsp.id = TLC_TUI_CMD_NONE;
+ g_user_rsp.return_code = TLC_TUI_ERR_UNKNOWN_CMD;
+
+ while (!atomic_read(&fileopened) && retry--) {
+ msleep(100);
+ pr_debug("sleep for atomic_read(&fileopened) with retry = %d\n",
+ retry);
+ }
+
+ /*
+ * Check that the client (TuiService) is still present before to return
+ * the command.
+ */
+ if (atomic_read(&fileopened)) {
+ /* Clean up previous response. */
+ complete_all(&io_comp);
+ reinit_completion(&io_comp);
+
+ /*
+ * Unlock the ioctl thread (IOCTL_WAIT) in order to let the
+ * client know that there is a command to process.
+ */
+ pr_info("%s: give way to ioctl thread\n", __func__);
+ complete(&dci_comp);
+ pr_info("TUI TLC is running, waiting for the userland response\n");
+ /* Wait for the client acknowledge (IOCTL_ACK). */
+ unsigned long completed = wait_for_completion_timeout(&io_comp,
+ msecs_to_jiffies(5000));
+ if (!completed) {
+ pr_debug("%s:%d No acknowledge from client, timeout!\n",
+ __func__, __LINE__);
+ }
+ } else {
+ /*
+ * There is no client, do nothing except reporting an error to
+ * SWd.
+ */
+ pr_info("TUI TLC seems dead. Not waiting for userland answer\n");
+ ret = TUI_DCI_ERR_INTERNAL_ERROR;
+ goto end;
+ }
+
+ pr_debug("%s: Got an answer from ioctl thread.\n", __func__);
+ reinit_completion(&io_comp);
+
+ /* Check id of the cmd processed by ioctl thread (paranoia) */
+ if (g_user_rsp.id != command_id) {
+ pr_debug("ERROR %s:%d Wrong response id 0x%08x iso 0x%08x\n",
+ __func__, __LINE__, dci->nwd_rsp.id,
+ (u32)RSP_ID(command_id));
+ ret = TUI_DCI_ERR_INTERNAL_ERROR;
+ } else {
+ /* retrieve return code */
+ switch (g_user_rsp.return_code) {
+ case TLC_TUI_OK:
+ ret = TUI_DCI_OK;
+ break;
+ case TLC_TUI_ERROR:
+ ret = TUI_DCI_ERR_INTERNAL_ERROR;
+ break;
+ case TLC_TUI_ERR_UNKNOWN_CMD:
+ ret = TUI_DCI_ERR_UNKNOWN_CMD;
+ break;
+ }
+ }
+
+end:
+ /*
+ * In any case, reset the value of the command, to ensure that commands
+ * sent due to inturrupted wait_for_completion are TLC_TUI_CMD_NONE.
+ */
+ reset_global_command_id();
+ return ret;
+}
+
+/* ------------------------------------------------------------- */
+static void tlc_process_cmd(void)
+{
+ u32 ret = TUI_DCI_ERR_INTERNAL_ERROR;
+ u32 command_id = CMD_TUI_SW_NONE;
+
+ if (!dci) {
+ pr_debug("ERROR %s:%d DCI has not been set up properly - exiting\n",
+ __func__, __LINE__);
+ return;
+ }
+
+ command_id = dci->cmd_nwd.id;
+
+ if (dci->hal_rsp)
+ hal_tui_notif();
+
+ /* Warn if previous response was not acknowledged */
+ if (command_id == CMD_TUI_SW_NONE) {
+ pr_debug("ERROR %s:%d Notified without command\n", __func__,
+ __LINE__);
+ return;
+ }
+
+ if (dci->nwd_rsp.id != CMD_TUI_SW_NONE)
+ pr_debug("%s: Warning, previous response not ack\n",
+ __func__);
+
+ /* Handle command */
+ switch (command_id) {
+ case CMD_TUI_SW_OPEN_SESSION:
+ pr_debug("%s: CMD_TUI_SW_OPEN_SESSION.\n", __func__);
+
+ if (!g_dci_version_checked) {
+ pr_info("ERROR %s:%d DrTui version is not compatible!\n",
+ __func__, __LINE__);
+ ret = TUI_DCI_ERR_INTERNAL_ERROR;
+ break;
+ }
+ /* Start android TUI activity */
+ ret = send_cmd_to_user(
+ TLC_TUI_CMD_START_ACTIVITY,
+ dci->cmd_nwd.payload.alloc_data.num_of_buff,
+ dci->cmd_nwd.payload.alloc_data.alloc_size);
+ if (ret != TUI_DCI_OK) {
+ pr_debug("%s:%d return value is 0x%x.\n", __func__,
+ __LINE__, ret);
+ break;
+ }
+
+/*****************************************************************************/
+
+ /* Alloc work buffer separately and send it as last buffer */
+ ret = hal_tui_alloc(dci->nwd_rsp.alloc_buffer,
+ dci->cmd_nwd.payload.alloc_data.alloc_size,
+ dci->cmd_nwd.payload.alloc_data.num_of_buff);
+ if (ret != TUI_DCI_OK) {
+ pr_debug("%s: hal_tui_alloc() failed (0x%08X)",
+ __func__, ret);
+ send_cmd_to_user(TLC_TUI_CMD_STOP_ACTIVITY, 0, 0);
+ break;
+ }
+
+ /* Deactivate linux UI drivers */
+ ret = hal_tui_deactivate();
+
+ if (ret != TUI_DCI_OK) {
+ hal_tui_free();
+ send_cmd_to_user(TLC_TUI_CMD_STOP_ACTIVITY, 0, 0);
+ break;
+ }
+
+ break;
+
+ case CMD_TUI_SW_GET_VERSION: {
+ pr_debug("%s: CMD_TUI_SW_GET_VERSION.\n", __func__);
+ u32 drtui_dci_version = dci->version;
+ u32 tlctui_dci_version =
+ TUI_DCI_VERSION(TUI_DCI_VERSION_MAJOR,
+ TUI_DCI_VERSION_MINOR);
+ pr_info("%s: TlcTui DCI Version (%u.%u)\n", __func__,
+ TUI_DCI_VERSION_GET_MAJOR(tlctui_dci_version),
+ TUI_DCI_VERSION_GET_MINOR(tlctui_dci_version));
+ pr_info("%s: DrTui DCI Version (%u.%u)\n", __func__,
+ TUI_DCI_VERSION_GET_MAJOR(drtui_dci_version),
+ TUI_DCI_VERSION_GET_MINOR(drtui_dci_version));
+ /* Write the TlcTui DCI version in the response for the SWd */
+ dci->version = tlctui_dci_version;
+ g_dci_version_checked = true;
+ ret = TUI_DCI_OK;
+ break;
+ }
+
+ case CMD_TUI_SW_HAL:
+ /* TODO Always answer, even if there is a cancel!! */
+ ret = hal_tui_process_cmd(&dci->cmd_nwd.payload.hal,
+ &dci->nwd_rsp.hal_rsp);
+ break;
+
+ case CMD_TUI_SW_CLOSE_SESSION:
+ pr_debug("%s: CMD_TUI_SW_CLOSE_SESSION.\n", __func__);
+
+ /* QC: close ion client before activating linux UI */
+ hal_tui_free();
+
+ /* Activate linux UI drivers */
+ ret = hal_tui_activate();
+
+ /* Stop android TUI activity */
+ /* Ignore return code, because an error means the TLC has been
+ * killed, which imply that the activity is stopped already.
+ */
+ send_cmd_to_user(TLC_TUI_CMD_STOP_ACTIVITY, 0, 0);
+ ret = TUI_DCI_OK;
+
+ break;
+
+ default:
+ pr_debug("ERROR %s:%d Unknown command %d\n",
+ __func__, __LINE__, command_id);
+ ret = TUI_DCI_ERR_UNKNOWN_CMD;
+ break;
+ }
+
+ /* Fill in response to SWd, fill ID LAST */
+ pr_debug("%s: return 0x%08x to cmd 0x%08x\n",
+ __func__, ret, command_id);
+ /* TODO: fill data fields of pDci->nwdRsp */
+ dci->nwd_rsp.return_code = ret;
+ dci->nwd_rsp.id = RSP_ID(command_id);
+
+ /* Acknowledge command */
+ dci->cmd_nwd.id = CMD_TUI_SW_NONE;
+
+ /* Notify SWd */
+ pr_debug("DCI RSP NOTIFY CORE\n");
+ ret = mc_notify(&dr_session_handle);
+ if (ret != MC_DRV_OK)
+ pr_debug("ERROR %s:%d Notify failed: %d\n", __func__, __LINE__,
+ ret);
+}
+
+/* ------------------------------------------------------------- */
+static void tlc_close_driver(void)
+{
+ enum mc_result ret;
+
+ /* Close session with the Driver */
+ ret = mc_close_session(&dr_session_handle);
+ if (ret != MC_DRV_OK) {
+ pr_debug("ERROR %s:%d Closing driver session failed: %d\n",
+ __func__, __LINE__, ret);
+ }
+}
+
+/* ------------------------------------------------------------- */
+static void tlc_close(void)
+{
+ enum mc_result ret;
+
+ pr_debug("%s: Closing driver session\n", __func__);
+ tlc_close_driver();
+
+ pr_debug("%s: Closing tbase\n", __func__);
+ /* Close the tbase device */
+ ret = mc_close_device(DEVICE_ID);
+ if (ret != MC_DRV_OK) {
+ pr_debug("ERROR %s:%d Closing tbase device failed: %d\n",
+ __func__, __LINE__, ret);
+ }
+}
+
+void reset_global_command_id(void)
+{
+ g_user_cmd.id = TLC_TUI_CMD_NONE;
+}
+
+/* ------------------------------------------------------------- */
+
+bool tlc_notify_event(u32 event_type)
+{
+ bool ret = false;
+ enum mc_result result;
+
+ if (!dci) {
+ pr_warn("%s: DCI has not been set up properly - exiting\n",
+ __func__);
+ return false;
+ }
+
+ /* Prepare notification message in DCI */
+ pr_debug("%s: event_type = %d\n", __func__, event_type);
+ dci->nwd_notif = event_type;
+
+ /* Signal the Driver */
+ pr_debug("DCI EVENT NOTIFY CORE\n");
+ result = mc_notify(&dr_session_handle);
+ if (result != MC_DRV_OK) {
+ pr_err("%s: mc_notify failed: %d\n", __func__, result);
+ ret = false;
+ } else {
+ ret = true;
+ }
+
+ return ret;
+}
+
+/* ------------------------------------------------------------- */
+/**
+ */
+static int main_thread(void *uarg)
+{
+ pr_debug("%s: TlcTui start!\n", __func__);
+
+ /* Open session on the driver */
+ if (!tlc_open()) {
+ pr_err("%s: open driver failed!\n", __func__);
+ return 1;
+ }
+
+ /* TlcTui main thread loop */
+ for (;;) {
+ /* Wait for a command from the DrTui on DCI */
+ tlc_wait_cmd_from_driver();
+ /* Something has been received, process it. */
+ tlc_process_cmd();
+ }
+
+ /*
+ * Close tlc. Note that this frees the DCI pointer.
+ * Do not use this pointer after tlc_close().
+ */
+ tlc_close();
+
+ return 0;
+}
+
+static int start_thread_if_needed(void)
+{
+ int rc = 0;
+
+ /*
+ * Create the TlcTui Main thread and start secure driver (only 1st time)
+ */
+ mutex_lock(&thread_mutex);
+ if (thread_id)
+ /* Already started */
+ goto end;
+
+ thread_id = kthread_run(main_thread, NULL, "tee_tui");
+ if (IS_ERR_OR_NULL(thread_id)) {
+ rc = PTR_ERR(thread_id);
+ pr_err("Unable to start Trusted UI main thread: %d\n", rc);
+ thread_id = NULL;
+ }
+
+end:
+ mutex_unlock(&thread_mutex);
+ return rc;
+}
+
+int tlc_wait_cmd(struct tlc_tui_command_t *cmd_id)
+{
+ int ret = start_thread_if_needed();
+
+ if (ret)
+ return ret;
+
+ /* Wait for signal from DCI handler */
+ /* In case of an interrupted sys call, return with -EINTR */
+ if (wait_for_completion_interruptible(&dci_comp)) {
+ pr_debug("interrupted by system\n");
+ return -ERESTARTSYS;
+ }
+ reinit_completion(&dci_comp);
+
+ *cmd_id = g_user_cmd;
+ return 0;
+}
+
+int tlc_init_driver(void)
+{
+ return start_thread_if_needed();
+}
+
+int tlc_ack_cmd(struct tlc_tui_response_t *rsp)
+{
+ g_user_rsp = *rsp;
+
+ if (g_user_rsp.id == TLC_TUI_CMD_ALLOC_FB)
+ hal_tui_post_start(&g_user_rsp);
+
+ /* Send signal to DCI */
+ complete(&io_comp);
+
+ return 0;
+}
+
+/** @} */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tlcTui.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tlcTui.h
new file mode 100644
index 0000000..e426fd8
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tlcTui.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef TLCTUI_H_
+#define TLCTUI_H_
+
+#include "tui_ioctl.h"
+#define TUI_MOD_TAG "t-base-tui "
+
+#define ION_PHYS_WORKING_BUFFER_IDX (0)
+#define ION_PHYS_FRAME_BUFFER_IDX (1)
+
+void reset_global_command_id(void);
+int tlc_wait_cmd(struct tlc_tui_command_t *cmd);
+int tlc_ack_cmd(struct tlc_tui_response_t *rsp_id);
+bool tlc_notify_event(u32 event_type);
+int tlc_init_driver(void);
+u32 send_cmd_to_user(u32 command_id, u32 data0, u32 data1);
+struct mc_session_handle *get_session_handle(void);
+
+extern atomic_t fileopened;
+extern struct tui_dci_msg_t *dci;
+extern struct tlc_tui_response_t g_user_rsp;
+extern u64 g_ion_phys[MAX_BUFFER_NUMBER];
+extern u32 g_ion_size[MAX_BUFFER_NUMBER];
+#endif /* TLCTUI_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/trustedui.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/trustedui.c
new file mode 100644
index 0000000..2a1ad00
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/trustedui.c
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#include <linux/spinlock.h>
+#include <linux/module.h>
+#include <linux/t-base-tui.h>
+
+static int trustedui_mode = TRUSTEDUI_MODE_OFF;
+static int trustedui_blank_counter;
+
+static DEFINE_SPINLOCK(trustedui_lock);
+
+int trustedui_blank_inc(void)
+{
+ unsigned long flags;
+ int newvalue;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ newvalue = ++trustedui_blank_counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return newvalue;
+}
+EXPORT_SYMBOL(trustedui_blank_inc);
+
+int trustedui_blank_dec(void)
+{
+ unsigned long flags;
+ int newvalue;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ newvalue = --trustedui_blank_counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return newvalue;
+}
+EXPORT_SYMBOL(trustedui_blank_dec);
+
+int trustedui_blank_get_counter(void)
+{
+ unsigned long flags;
+ int newvalue;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ newvalue = trustedui_blank_counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return newvalue;
+}
+EXPORT_SYMBOL(trustedui_blank_get_counter);
+
+void trustedui_blank_set_counter(int counter)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ trustedui_blank_counter = counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+}
+EXPORT_SYMBOL(trustedui_blank_set_counter);
+
+int trustedui_get_current_mode(void)
+{
+ unsigned long flags;
+ int mode;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ mode = trustedui_mode;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return mode;
+}
+EXPORT_SYMBOL(trustedui_get_current_mode);
+
+void trustedui_set_mode(int mode)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ trustedui_mode = mode;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+}
+EXPORT_SYMBOL(trustedui_set_mode);
+
+int trustedui_set_mask(int mask)
+{
+ unsigned long flags;
+ int mode;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ mode = trustedui_mode |= mask;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return mode;
+}
+EXPORT_SYMBOL(trustedui_set_mask);
+
+int trustedui_clear_mask(int mask)
+{
+ unsigned long flags;
+ int mode;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ mode = trustedui_mode &= ~mask;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return mode;
+}
+EXPORT_SYMBOL(trustedui_clear_mask);
+
+MODULE_AUTHOR("Trustonic Limited");
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("Kinibi TUI");
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tui-hal.c b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tui-hal.c
new file mode 100644
index 0000000..5d067ef
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tui-hal.c
@@ -0,0 +1,255 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+#include <linux/types.h>
+#include <linux/device.h>
+#include <linux/fb.h>
+
+#ifndef CONFIG_TRUSTONIC_TRUSTED_UI
+#define CONFIG_TRUSTONIC_TRUSTED_UI
+#endif
+#include <t-base-tui.h>
+
+#include "tui_ioctl.h"
+#include "dciTui.h"
+#include "tlcTui.h"
+#include "tui-hal.h"
+
+#define TUI_MEMPOOL_SIZE 0
+
+struct tui_mempool {
+ void *va;
+ unsigned long pa;
+ size_t size;
+};
+
+static struct tui_mempool g_tui_mem_pool;
+
+/* basic implementation of a memory pool for TUI framebuffer. This
+ * implementation is using kmalloc, for the purpose of demonstration only.
+ * A real implementation might prefer using more advanced allocator, like ION,
+ * in order not to exhaust memory available to kmalloc
+ */
+static bool allocate_tui_memory_pool(struct tui_mempool *pool, size_t size)
+{
+ bool ret = false;
+ void *tui_mem_pool = NULL;
+
+ pr_info("%s %s:%d\n", __func__, __FILE__, __LINE__);
+ if (!size) {
+ pr_debug("TUI frame buffer: nothing to allocate.");
+ return true;
+ }
+
+ tui_mem_pool = kmalloc(size, GFP_KERNEL);
+ if (!tui_mem_pool) {
+ return ret;
+ } else if (ksize(tui_mem_pool) < size) {
+ pr_err("TUI mem pool size too small: req'd=%zu alloc'd=%zu",
+ size, ksize(tui_mem_pool));
+ kfree(tui_mem_pool);
+ } else {
+ pool->va = tui_mem_pool;
+ pool->pa = virt_to_phys(tui_mem_pool);
+ pool->size = ksize(tui_mem_pool);
+ ret = true;
+ }
+ return ret;
+}
+
+static void free_tui_memory_pool(struct tui_mempool *pool)
+{
+ kfree(pool->va);
+ memset(pool, 0, sizeof(*pool));
+}
+
+/**
+ * hal_tui_init() - integrator specific initialization for kernel module
+ *
+ * This function is called when the kernel module is initialized, either at
+ * boot time, if the module is built statically in the kernel, or when the
+ * kernel is dynamically loaded if the module is built as a dynamic kernel
+ * module. This function may be used by the integrator, for instance, to get a
+ * memory pool that will be used to allocate the secure framebuffer and work
+ * buffer for TUI sessions.
+ *
+ * Return: must return 0 on success, or non-zero on error. If the function
+ * returns an error, the module initialization will fail.
+ */
+u32 hal_tui_init(void)
+{
+ /* Allocate memory pool for the framebuffer
+ */
+ if (!allocate_tui_memory_pool(&g_tui_mem_pool, TUI_MEMPOOL_SIZE))
+ return TUI_DCI_ERR_INTERNAL_ERROR;
+
+ return TUI_DCI_OK;
+}
+
+/**
+ * hal_tui_exit() - integrator specific exit code for kernel module
+ *
+ * This function is called when the kernel module exit. It is called when the
+ * kernel module is unloaded, for a dynamic kernel module, and never called for
+ * a module built into the kernel. It can be used to free any resources
+ * allocated by hal_tui_init().
+ */
+void hal_tui_exit(void)
+{
+ /* delete memory pool if any */
+ if (g_tui_mem_pool.va)
+ free_tui_memory_pool(&g_tui_mem_pool);
+}
+
+/**
+ * hal_tui_alloc() - allocator for secure framebuffer and working buffer
+ * @allocbuffer: input parameter that the allocator fills with the physical
+ * addresses of the allocated buffers
+ * @allocsize: size of the buffer to allocate. All the buffer are of the
+ * same size
+ * @number: Number to allocate.
+ *
+ * This function is called when the module receives a CMD_TUI_SW_OPEN_SESSION
+ * message from the secure driver. The function must allocate 'number'
+ * buffer(s) of physically contiguous memory, where the length of each buffer
+ * is at least 'allocsize' bytes. The physical address of each buffer must be
+ * stored in the array of structure 'allocbuffer' which is provided as
+ * arguments.
+ *
+ * Physical address of the first buffer must be put in allocate[0].pa , the
+ * second one on allocbuffer[1].pa, and so on. The function must return 0 on
+ * success, non-zero on error. For integrations where the framebuffer is not
+ * allocated by the Normal World, this function should do nothing and return
+ * success (zero).
+ * If the working buffer allocation is different from framebuffers, ensure that
+ * the physical address of the working buffer is at index 0 of the allocbuffer
+ * table (allocbuffer[0].pa).
+ */
+u32 hal_tui_alloc(
+ struct tui_alloc_buffer_t allocbuffer[MAX_DCI_BUFFER_NUMBER],
+ size_t allocsize, u32 number)
+{
+ u32 ret = TUI_DCI_ERR_INTERNAL_ERROR;
+
+ if (!allocbuffer) {
+ pr_debug("%s(%d): allocbuffer is null\n", __func__, __LINE__);
+ return TUI_DCI_ERR_INTERNAL_ERROR;
+ }
+
+ pr_debug("%s(%d): Requested size=0x%zx x %u chunks\n",
+ __func__, __LINE__, allocsize, number);
+
+ if ((size_t)allocsize == 0) {
+ pr_debug("%s(%d): Nothing to allocate\n", __func__, __LINE__);
+ return TUI_DCI_OK;
+ }
+
+ if (number != 2) {
+ pr_debug("%s(%d): Unexpected number of buffers requested\n",
+ __func__, __LINE__);
+ return TUI_DCI_ERR_INTERNAL_ERROR;
+ }
+
+ if ((size_t)(allocsize * number) <= g_tui_mem_pool.size) {
+ /* requested buffer fits in the memory pool */
+ allocbuffer[0].pa = (u64)g_tui_mem_pool.pa;
+ allocbuffer[1].pa = (u64)(g_tui_mem_pool.pa +
+ g_tui_mem_pool.size / 2);
+ pr_debug("%s(%d): allocated at %llx\n", __func__, __LINE__,
+ allocbuffer[0].pa);
+ pr_debug("%s(%d): allocated at %llx\n", __func__, __LINE__,
+ allocbuffer[1].pa);
+ ret = TUI_DCI_OK;
+ } else {
+ /*
+ * requested buffer is bigger than the memory pool, return an
+ * error
+ */
+ pr_debug("%s(%d): Memory pool too small\n", __func__, __LINE__);
+ ret = TUI_DCI_ERR_INTERNAL_ERROR;
+ }
+
+ return ret;
+}
+
+/**
+ * hal_tui_free() - free memory allocated by hal_tui_alloc()
+ *
+ * This function is called at the end of the TUI session, when the TUI module
+ * receives the CMD_TUI_SW_CLOSE_SESSION message. The function should free the
+ * buffers allocated by hal_tui_alloc(...).
+ */
+void hal_tui_free(void)
+{
+}
+
+/**
+ * hal_tui_deactivate() - deactivate Normal World display and input
+ *
+ * This function should stop the Normal World display and, if necessary, Normal
+ * World input. It is called when a TUI session is opening, before the Secure
+ * World takes control of display and input.
+ *
+ * Return: must return 0 on success, non-zero otherwise.
+ */
+u32 hal_tui_deactivate(void)
+{
+ /* Set linux TUI flag */
+ trustedui_set_mask(TRUSTEDUI_MODE_TUI_SESSION);
+ /*
+ * Stop NWd display here. After this function returns, SWd will take
+ * control of the display and input. Therefore the NWd should no longer
+ * access it
+ * This can be done by calling the fb_blank(FB_BLANK_POWERDOWN) function
+ * on the appropriate framebuffer device
+ */
+ trustedui_set_mask(TRUSTEDUI_MODE_VIDEO_SECURED |
+ TRUSTEDUI_MODE_INPUT_SECURED);
+
+ return TUI_DCI_OK;
+}
+
+/**
+ * hal_tui_activate() - restore Normal World display and input after a TUI
+ * session
+ *
+ * This function should enable Normal World display and, if necessary, Normal
+ * World input. It is called after a TUI session, after the Secure World has
+ * released the display and input.
+ *
+ * Return: must return 0 on success, non-zero otherwise.
+ */
+u32 hal_tui_activate(void)
+{
+ /* Protect NWd */
+ trustedui_clear_mask(TRUSTEDUI_MODE_VIDEO_SECURED |
+ TRUSTEDUI_MODE_INPUT_SECURED);
+ /*
+ * Restart NWd display here. TUI session has ended, and therefore the
+ * SWd will no longer use display and input.
+ * This can be done by calling the fb_blank(FB_BLANK_UNBLANK) function
+ * on the appropriate framebuffer device
+ */
+ /* Clear linux TUI flag */
+ trustedui_set_mode(TRUSTEDUI_MODE_OFF);
+ return TUI_DCI_OK;
+}
+
+/* Do nothing it's only use for QC */
+u32 hal_tui_process_cmd(struct tui_hal_cmd_t *cmd, struct tui_hal_rsp_t *rsp)
+{
+ return TUI_DCI_OK;
+}
+
+/* Do nothing it's only use for QC */
+u32 hal_tui_notif(void)
+{
+ return TUI_DCI_OK;
+}
+
+/* Do nothing it's only use for QC */
+void hal_tui_post_start(struct tlc_tui_response_t *rsp)
+{
+ pr_info("%s(%d)\n", __func__, __LINE__);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tui-hal.h b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tui-hal.h
new file mode 100644
index 0000000..c6e7aa4
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/410/TlcTui/tui-hal.h
@@ -0,0 +1,144 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2019 TRUSTONIC LIMITED
+ */
+
+#ifndef _TUI_HAL_H_
+#define _TUI_HAL_H_
+
+#include <linux/types.h>
+#include "tui_ioctl.h"
+
+/**
+ * hal_tui_init() - integrator specific initialization for kernel module
+ *
+ * This function is called when the kernel module is initialized, either at
+ * boot time, if the module is built statically in the kernel, or when the
+ * kernel is dynamically loaded if the module is built as a dynamic kernel
+ * module. This function may be used by the integrator, for instance, to get a
+ * memory pool that will be used to allocate the secure framebuffer and work
+ * buffer for TUI sessions.
+ *
+ * Return: must return 0 on success, or non-zero on error. If the function
+ * returns an error, the module initialization will fail.
+ */
+uint32_t hal_tui_init(void);
+
+/**
+ * hal_tui_exit() - integrator specific exit code for kernel module
+ *
+ * This function is called when the kernel module exit. It is called when the
+ * kernel module is unloaded, for a dynamic kernel module, and never called for
+ * a module built into the kernel. It can be used to free any resources
+ * allocated by hal_tui_init().
+ */
+void hal_tui_exit(void);
+
+/**
+ * hal_tui_alloc() - allocator for secure framebuffer and working buffer
+ * @allocbuffer: input parameter that the allocator fills with the physical
+ * addresses of the allocated buffers
+ * @allocsize: size of the buffer to allocate. All the buffer are of the
+ * same size
+ * @number: Number to allocate.
+ *
+ * This function is called when the module receives a CMD_TUI_SW_OPEN_SESSION
+ * message from the secure driver. The function must allocate 'number'
+ * buffer(s) of physically contiguous memory, where the length of each buffer
+ * is at least 'allocsize' bytes. The physical address of each buffer must be
+ * stored in the array of structure 'allocbuffer' which is provided as
+ * arguments.
+ *
+ * Physical address of the first buffer must be put in allocate[0].pa , the
+ * second one on allocbuffer[1].pa, and so on. The function must return 0 on
+ * success, non-zero on error. For integrations where the framebuffer is not
+ * allocated by the Normal World, this function should do nothing and return
+ * success (zero).
+ * If the working buffer allocation is different from framebuffers, ensure that
+ * the physical address of the working buffer is at index 0 of the allocbuffer
+ * table (allocbuffer[0].pa).
+ */
+uint32_t hal_tui_alloc(
+ struct tui_alloc_buffer_t allocbuffer[MAX_DCI_BUFFER_NUMBER],
+ size_t allocsize, uint32_t number);
+
+/**
+ * hal_tui_free() - free memory allocated by hal_tui_alloc()
+ *
+ * This function is called at the end of the TUI session, when the TUI module
+ * receives the CMD_TUI_SW_CLOSE_SESSION message. The function should free the
+ * buffers allocated by hal_tui_alloc(...).
+ */
+void hal_tui_free(void);
+
+void hal_tui_post_start(struct tlc_tui_response_t *rsp);
+
+/**
+ * hal_tui_deactivate() - deactivate Normal World display and input
+ *
+ * This function should stop the Normal World display and, if necessary, Normal
+ * World input. It is called when a TUI session is opening, before the Secure
+ * World takes control of display and input.
+ *
+ * Return: must return 0 on success, non-zero otherwise.
+ */
+uint32_t hal_tui_deactivate(void);
+
+/**
+ * hal_tui_activate() - restore Normal World display and input after a TUI
+ * session
+ *
+ * This function should enable Normal World display and, if necessary, Normal
+ * World input. It is called after a TUI session, after the Secure World has
+ * released the display and input.
+ *
+ * Return: must return 0 on success, non-zero otherwise.
+ */
+uint32_t hal_tui_activate(void);
+uint32_t hal_tui_process_cmd(struct tui_hal_cmd_t *cmd,
+ struct tui_hal_rsp_t *rsp);
+uint32_t hal_tui_notif(void);
+
+/**
+ * hal_tui_process_cmd() - integrator specific exit code for kernel module
+ *
+ * This function is called when kernel module receives a command from the
+ * secure driver HAL, ie when drTuiCoreDciSendAndWait() is called.
+ */
+uint32_t hal_tui_process_cmd(struct tui_hal_cmd_t *cmd,
+ struct tui_hal_rsp_t *rsp);
+
+/**
+ * hal_tui_notif() - integrator specific exit code for kernel module
+ *
+ * This function is called when kernel module receives an answer from the
+ * secure driver HAL (the hal_rsp field of the world shared memory struct is
+ * not null).
+ * This should be the way to get an answer from the secure driver after a
+ * command has been sent to it (the hal_cmd field of the world shared memory
+ * struct has been set and a notification has been raised).
+ */
+uint32_t hal_tui_notif(void);
+
+/**
+ * hal_tui_process_cmd() - integrator specific exit code for kernel module
+ *
+ * This function is called when kernel module receives a command from the
+ * secure driver HAL, ie when drTuiCoreDciSendAndWait() is called.
+ */
+uint32_t hal_tui_process_cmd(struct tui_hal_cmd_t *cmd,
+ struct tui_hal_rsp_t *rsp);
+
+/**
+ * hal_tui_notif() - integrator specific exit code for kernel module
+ *
+ * This function is called when kernel module receives an answer from the
+ * secure driver HAL (the hal_rsp field of the world shared memory struct is
+ * not null).
+ * This should be the way to get an answer from the secure driver after a
+ * command has been sent to it (the hal_cmd field of the world shared memory
+ * struct has been set and a notification has been raised).
+ */
+uint32_t hal_tui_notif(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/Kconfig b/src/kernel/linux/v4.19/drivers/tee/gud/Kconfig
new file mode 100644
index 0000000..350c03f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/Kconfig
@@ -0,0 +1,35 @@
+#
+# TRUSTONIC TEE configuration
+#
+config TRUSTONIC_TEE_SUPPORT
+ tristate "Enable Trustonic TEE Support"
+ help
+ Enable Trustonic TEE Support.
+ This option enables MobiCore Driver which is used to communicate with
+ TEE OS, for things like, setting up log buffers, interrupt pins,
+ and IPC channels.
+
+config TRUSTONIC_TEE_VERSION
+ string "TRUSTONIC TEE Version"
+ depends on TRUSTONIC_TEE_SUPPORT
+ default "410"
+
+config TRUSTONIC_TEE_DEBUG
+ bool "Trustonic TEE driver debug mode"
+ depends on TRUSTONIC_TEE_SUPPORT
+ default n
+ help
+ Enable the debug mode in the Trustonic TEE Driver.
+ Unlike MOBICORE_DEBUG and MOBICORE_VERBOSE used in TBASE 302 series,
+ TBASE 311 series use one option to turn on necessary debug logs.
+ Enable this option for debugging and see more detailed driver flow.
+
+config TRUSTONIC_TRUSTED_UI
+ tristate "<t-base TUI"
+ depends on TRUSTONIC_TEE_SUPPORT
+ default n
+ help
+ Enable <t-base Trusted User Interface
+ Trustonic TUI features was based on Trustonic TEE mechanism to protect
+ Touch/Display inside TEE, to prevent malicious access of sensitive
+ data used by APPs like Banking.
diff --git a/src/kernel/linux/v4.19/drivers/tee/gud/Makefile b/src/kernel/linux/v4.19/drivers/tee/gud/Makefile
new file mode 100644
index 0000000..33dd1e7
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/gud/Makefile
@@ -0,0 +1,3 @@
+ifneq ($(CONFIG_TRUSTONIC_TEE_SUPPORT),)
+ obj-$(CONFIG_TRUSTONIC_TEE_SUPPORT) += $(subst ",,$(CONFIG_TRUSTONIC_TEE_VERSION))/
+endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/Kconfig b/src/kernel/linux/v4.19/drivers/tee/optee/Kconfig
new file mode 100644
index 0000000..3c59e19
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/Kconfig
@@ -0,0 +1,15 @@
+# OP-TEE Trusted Execution Environment Configuration
+config OPTEE
+ tristate "OP-TEE"
+ depends on HAVE_ARM_SMCCC
+ help
+ This implements the OP-TEE Trusted Execution Environment (TEE)
+ driver.
+
+config OPTEE_SHM_NUM_PRIV_PAGES
+ int "Private Shared Memory Pages"
+ default 1
+ depends on OPTEE
+ help
+ This sets the number of private shared memory pages to be
+ used by OP-TEE TEE driver.
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/Makefile b/src/kernel/linux/v4.19/drivers/tee/optee/Makefile
new file mode 100644
index 0000000..48d262a
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/Makefile
@@ -0,0 +1,7 @@
+# SPDX-License-Identifier: GPL-2.0
+obj-$(CONFIG_OPTEE) += optee.o
+optee-objs += core.o
+optee-objs += call.o
+optee-objs += rpc.o
+optee-objs += supp.o
+optee-objs += shm_pool.o
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/call.c b/src/kernel/linux/v4.19/drivers/tee/optee/call.c
new file mode 100644
index 0000000..a5afbe6
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/call.c
@@ -0,0 +1,662 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/arm-smccc.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/tee_drv.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include "optee_private.h"
+#include "optee_smc.h"
+
+struct optee_call_waiter {
+ struct list_head list_node;
+ struct completion c;
+};
+
+static void optee_cq_wait_init(struct optee_call_queue *cq,
+ struct optee_call_waiter *w)
+{
+ /*
+ * We're preparing to make a call to secure world. In case we can't
+ * allocate a thread in secure world we'll end up waiting in
+ * optee_cq_wait_for_completion().
+ *
+ * Normally if there's no contention in secure world the call will
+ * complete and we can cleanup directly with optee_cq_wait_final().
+ */
+ mutex_lock(&cq->mutex);
+
+ /*
+ * We add ourselves to the queue, but we don't wait. This
+ * guarantees that we don't lose a completion if secure world
+ * returns busy and another thread just exited and try to complete
+ * someone.
+ */
+ init_completion(&w->c);
+ list_add_tail(&w->list_node, &cq->waiters);
+
+ mutex_unlock(&cq->mutex);
+}
+
+static void optee_cq_wait_for_completion(struct optee_call_queue *cq,
+ struct optee_call_waiter *w)
+{
+ wait_for_completion(&w->c);
+
+ mutex_lock(&cq->mutex);
+
+ /* Move to end of list to get out of the way for other waiters */
+ list_del(&w->list_node);
+ reinit_completion(&w->c);
+ list_add_tail(&w->list_node, &cq->waiters);
+
+ mutex_unlock(&cq->mutex);
+}
+
+static void optee_cq_complete_one(struct optee_call_queue *cq)
+{
+ struct optee_call_waiter *w;
+
+ list_for_each_entry(w, &cq->waiters, list_node) {
+ if (!completion_done(&w->c)) {
+ complete(&w->c);
+ break;
+ }
+ }
+}
+
+static void optee_cq_wait_final(struct optee_call_queue *cq,
+ struct optee_call_waiter *w)
+{
+ /*
+ * We're done with the call to secure world. The thread in secure
+ * world that was used for this call is now available for some
+ * other task to use.
+ */
+ mutex_lock(&cq->mutex);
+
+ /* Get out of the list */
+ list_del(&w->list_node);
+
+ /* Wake up one eventual waiting task */
+ optee_cq_complete_one(cq);
+
+ /*
+ * If we're completed we've got a completion from another task that
+ * was just done with its call to secure world. Since yet another
+ * thread now is available in secure world wake up another eventual
+ * waiting task.
+ */
+ if (completion_done(&w->c))
+ optee_cq_complete_one(cq);
+
+ mutex_unlock(&cq->mutex);
+}
+
+/* Requires the filpstate mutex to be held */
+static struct optee_session *find_session(struct optee_context_data *ctxdata,
+ u32 session_id)
+{
+ struct optee_session *sess;
+
+ list_for_each_entry(sess, &ctxdata->sess_list, list_node)
+ if (sess->session_id == session_id)
+ return sess;
+
+ return NULL;
+}
+
+/**
+ * optee_do_call_with_arg() - Do an SMC to OP-TEE in secure world
+ * @ctx: calling context
+ * @parg: physical address of message to pass to secure world
+ *
+ * Does and SMC to OP-TEE in secure world and handles eventual resulting
+ * Remote Procedure Calls (RPC) from OP-TEE.
+ *
+ * Returns return code from secure world, 0 is OK
+ */
+u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg)
+{
+ struct optee *optee = tee_get_drvdata(ctx->teedev);
+ struct optee_call_waiter w;
+ struct optee_rpc_param param = { };
+ struct optee_call_ctx call_ctx = { };
+ u32 ret;
+
+ param.a0 = OPTEE_SMC_CALL_WITH_ARG;
+ reg_pair_from_64(¶m.a1, ¶m.a2, parg);
+ /* Initialize waiter */
+ optee_cq_wait_init(&optee->call_queue, &w);
+ while (true) {
+ struct arm_smccc_res res;
+
+ optee->invoke_fn(param.a0, param.a1, param.a2, param.a3,
+ param.a4, param.a5, param.a6, param.a7,
+ &res);
+
+ if (res.a0 == OPTEE_SMC_RETURN_ETHREAD_LIMIT) {
+ /*
+ * Out of threads in secure world, wait for a thread
+ * become available.
+ */
+ optee_cq_wait_for_completion(&optee->call_queue, &w);
+ } else if (OPTEE_SMC_RETURN_IS_RPC(res.a0)) {
+ param.a0 = res.a0;
+ param.a1 = res.a1;
+ param.a2 = res.a2;
+ param.a3 = res.a3;
+ optee_handle_rpc(ctx, ¶m, &call_ctx);
+ } else {
+ ret = res.a0;
+ break;
+ }
+ }
+
+ optee_rpc_finalize_call(&call_ctx);
+ /*
+ * We're done with our thread in secure world, if there's any
+ * thread waiters wake up one.
+ */
+ optee_cq_wait_final(&optee->call_queue, &w);
+
+ return ret;
+}
+
+static struct tee_shm *get_msg_arg(struct tee_context *ctx, size_t num_params,
+ struct optee_msg_arg **msg_arg,
+ phys_addr_t *msg_parg)
+{
+ int rc;
+ struct tee_shm *shm;
+ struct optee_msg_arg *ma;
+
+ shm = tee_shm_alloc(ctx, OPTEE_MSG_GET_ARG_SIZE(num_params),
+ TEE_SHM_MAPPED);
+ if (IS_ERR(shm))
+ return shm;
+
+ ma = tee_shm_get_va(shm, 0);
+ if (IS_ERR(ma)) {
+ rc = PTR_ERR(ma);
+ goto out;
+ }
+
+ rc = tee_shm_get_pa(shm, 0, msg_parg);
+ if (rc)
+ goto out;
+
+ memset(ma, 0, OPTEE_MSG_GET_ARG_SIZE(num_params));
+ ma->num_params = num_params;
+ *msg_arg = ma;
+out:
+ if (rc) {
+ tee_shm_free(shm);
+ return ERR_PTR(rc);
+ }
+
+ return shm;
+}
+
+int optee_open_session(struct tee_context *ctx,
+ struct tee_ioctl_open_session_arg *arg,
+ struct tee_param *param)
+{
+ struct optee_context_data *ctxdata = ctx->data;
+ int rc;
+ struct tee_shm *shm;
+ struct optee_msg_arg *msg_arg;
+ phys_addr_t msg_parg;
+ struct optee_session *sess = NULL;
+
+ /* +2 for the meta parameters added below */
+ shm = get_msg_arg(ctx, arg->num_params + 2, &msg_arg, &msg_parg);
+ if (IS_ERR(shm))
+ return PTR_ERR(shm);
+
+ msg_arg->cmd = OPTEE_MSG_CMD_OPEN_SESSION;
+ msg_arg->cancel_id = arg->cancel_id;
+
+ /*
+ * Initialize and add the meta parameters needed when opening a
+ * session.
+ */
+ msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT |
+ OPTEE_MSG_ATTR_META;
+ msg_arg->params[1].attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT |
+ OPTEE_MSG_ATTR_META;
+ memcpy(&msg_arg->params[0].u.value, arg->uuid, sizeof(arg->uuid));
+ memcpy(&msg_arg->params[1].u.value, arg->uuid, sizeof(arg->clnt_uuid));
+ msg_arg->params[1].u.value.c = arg->clnt_login;
+
+ rc = optee_to_msg_param(msg_arg->params + 2, arg->num_params, param);
+ if (rc)
+ goto out;
+
+ sess = kzalloc(sizeof(*sess), GFP_KERNEL);
+ if (!sess) {
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ if (optee_do_call_with_arg(ctx, msg_parg)) {
+ msg_arg->ret = TEEC_ERROR_COMMUNICATION;
+ msg_arg->ret_origin = TEEC_ORIGIN_COMMS;
+ }
+
+ if (msg_arg->ret == TEEC_SUCCESS) {
+ /* A new session has been created, add it to the list. */
+ sess->session_id = msg_arg->session;
+ mutex_lock(&ctxdata->mutex);
+ list_add(&sess->list_node, &ctxdata->sess_list);
+ mutex_unlock(&ctxdata->mutex);
+ } else {
+ kfree(sess);
+ }
+
+ if (optee_from_msg_param(param, arg->num_params, msg_arg->params + 2)) {
+ arg->ret = TEEC_ERROR_COMMUNICATION;
+ arg->ret_origin = TEEC_ORIGIN_COMMS;
+ /* Close session again to avoid leakage */
+ optee_close_session(ctx, msg_arg->session);
+ } else {
+ arg->session = msg_arg->session;
+ arg->ret = msg_arg->ret;
+ arg->ret_origin = msg_arg->ret_origin;
+ }
+out:
+ tee_shm_free(shm);
+
+ return rc;
+}
+
+int optee_close_session(struct tee_context *ctx, u32 session)
+{
+ struct optee_context_data *ctxdata = ctx->data;
+ struct tee_shm *shm;
+ struct optee_msg_arg *msg_arg;
+ phys_addr_t msg_parg;
+ struct optee_session *sess;
+
+ /* Check that the session is valid and remove it from the list */
+ mutex_lock(&ctxdata->mutex);
+ sess = find_session(ctxdata, session);
+ if (sess)
+ list_del(&sess->list_node);
+ mutex_unlock(&ctxdata->mutex);
+ if (!sess)
+ return -EINVAL;
+ kfree(sess);
+
+ shm = get_msg_arg(ctx, 0, &msg_arg, &msg_parg);
+ if (IS_ERR(shm))
+ return PTR_ERR(shm);
+
+ msg_arg->cmd = OPTEE_MSG_CMD_CLOSE_SESSION;
+ msg_arg->session = session;
+ optee_do_call_with_arg(ctx, msg_parg);
+
+ tee_shm_free(shm);
+ return 0;
+}
+
+int optee_invoke_func(struct tee_context *ctx, struct tee_ioctl_invoke_arg *arg,
+ struct tee_param *param)
+{
+ struct optee_context_data *ctxdata = ctx->data;
+ struct tee_shm *shm;
+ struct optee_msg_arg *msg_arg;
+ phys_addr_t msg_parg;
+ struct optee_session *sess;
+ int rc;
+
+ /* Check that the session is valid */
+ mutex_lock(&ctxdata->mutex);
+ sess = find_session(ctxdata, arg->session);
+ mutex_unlock(&ctxdata->mutex);
+ if (!sess)
+ return -EINVAL;
+
+ shm = get_msg_arg(ctx, arg->num_params, &msg_arg, &msg_parg);
+ if (IS_ERR(shm))
+ return PTR_ERR(shm);
+ msg_arg->cmd = OPTEE_MSG_CMD_INVOKE_COMMAND;
+ msg_arg->func = arg->func;
+ msg_arg->session = arg->session;
+ msg_arg->cancel_id = arg->cancel_id;
+
+ rc = optee_to_msg_param(msg_arg->params, arg->num_params, param);
+ if (rc)
+ goto out;
+
+ if (optee_do_call_with_arg(ctx, msg_parg)) {
+ msg_arg->ret = TEEC_ERROR_COMMUNICATION;
+ msg_arg->ret_origin = TEEC_ORIGIN_COMMS;
+ }
+
+ if (optee_from_msg_param(param, arg->num_params, msg_arg->params)) {
+ msg_arg->ret = TEEC_ERROR_COMMUNICATION;
+ msg_arg->ret_origin = TEEC_ORIGIN_COMMS;
+ }
+
+ arg->ret = msg_arg->ret;
+ arg->ret_origin = msg_arg->ret_origin;
+out:
+ tee_shm_free(shm);
+ return rc;
+}
+
+int optee_cancel_req(struct tee_context *ctx, u32 cancel_id, u32 session)
+{
+ struct optee_context_data *ctxdata = ctx->data;
+ struct tee_shm *shm;
+ struct optee_msg_arg *msg_arg;
+ phys_addr_t msg_parg;
+ struct optee_session *sess;
+
+ /* Check that the session is valid */
+ mutex_lock(&ctxdata->mutex);
+ sess = find_session(ctxdata, session);
+ mutex_unlock(&ctxdata->mutex);
+ if (!sess)
+ return -EINVAL;
+
+ shm = get_msg_arg(ctx, 0, &msg_arg, &msg_parg);
+ if (IS_ERR(shm))
+ return PTR_ERR(shm);
+
+ msg_arg->cmd = OPTEE_MSG_CMD_CANCEL;
+ msg_arg->session = session;
+ msg_arg->cancel_id = cancel_id;
+ optee_do_call_with_arg(ctx, msg_parg);
+
+ tee_shm_free(shm);
+ return 0;
+}
+
+/**
+ * optee_enable_shm_cache() - Enables caching of some shared memory allocation
+ * in OP-TEE
+ * @optee: main service struct
+ */
+void optee_enable_shm_cache(struct optee *optee)
+{
+ struct optee_call_waiter w;
+
+ /* We need to retry until secure world isn't busy. */
+ optee_cq_wait_init(&optee->call_queue, &w);
+ while (true) {
+ struct arm_smccc_res res;
+
+ optee->invoke_fn(OPTEE_SMC_ENABLE_SHM_CACHE, 0, 0, 0, 0, 0, 0,
+ 0, &res);
+ if (res.a0 == OPTEE_SMC_RETURN_OK)
+ break;
+ optee_cq_wait_for_completion(&optee->call_queue, &w);
+ }
+ optee_cq_wait_final(&optee->call_queue, &w);
+}
+
+/**
+ * optee_disable_shm_cache() - Disables caching of some shared memory allocation
+ * in OP-TEE
+ * @optee: main service struct
+ */
+void optee_disable_shm_cache(struct optee *optee)
+{
+ struct optee_call_waiter w;
+
+ /* We need to retry until secure world isn't busy. */
+ optee_cq_wait_init(&optee->call_queue, &w);
+ while (true) {
+ union {
+ struct arm_smccc_res smccc;
+ struct optee_smc_disable_shm_cache_result result;
+ } res;
+
+ optee->invoke_fn(OPTEE_SMC_DISABLE_SHM_CACHE, 0, 0, 0, 0, 0, 0,
+ 0, &res.smccc);
+ if (res.result.status == OPTEE_SMC_RETURN_ENOTAVAIL)
+ break; /* All shm's freed */
+ if (res.result.status == OPTEE_SMC_RETURN_OK) {
+ struct tee_shm *shm;
+
+ shm = reg_pair_to_ptr(res.result.shm_upper32,
+ res.result.shm_lower32);
+ tee_shm_free(shm);
+ } else {
+ optee_cq_wait_for_completion(&optee->call_queue, &w);
+ }
+ }
+ optee_cq_wait_final(&optee->call_queue, &w);
+}
+
+#define PAGELIST_ENTRIES_PER_PAGE \
+ ((OPTEE_MSG_NONCONTIG_PAGE_SIZE / sizeof(u64)) - 1)
+
+/**
+ * optee_fill_pages_list() - write list of user pages to given shared
+ * buffer.
+ *
+ * @dst: page-aligned buffer where list of pages will be stored
+ * @pages: array of pages that represents shared buffer
+ * @num_pages: number of entries in @pages
+ * @page_offset: offset of user buffer from page start
+ *
+ * @dst should be big enough to hold list of user page addresses and
+ * links to the next pages of buffer
+ */
+void optee_fill_pages_list(u64 *dst, struct page **pages, int num_pages,
+ size_t page_offset)
+{
+ int n = 0;
+ phys_addr_t optee_page;
+ /*
+ * Refer to OPTEE_MSG_ATTR_NONCONTIG description in optee_msg.h
+ * for details.
+ */
+ struct {
+ u64 pages_list[PAGELIST_ENTRIES_PER_PAGE];
+ u64 next_page_data;
+ } *pages_data;
+
+ /*
+ * Currently OP-TEE uses 4k page size and it does not looks
+ * like this will change in the future. On other hand, there are
+ * no know ARM architectures with page size < 4k.
+ * Thus the next built assert looks redundant. But the following
+ * code heavily relies on this assumption, so it is better be
+ * safe than sorry.
+ */
+ BUILD_BUG_ON(PAGE_SIZE < OPTEE_MSG_NONCONTIG_PAGE_SIZE);
+
+ pages_data = (void *)dst;
+ /*
+ * If linux page is bigger than 4k, and user buffer offset is
+ * larger than 4k/8k/12k/etc this will skip first 4k pages,
+ * because they bear no value data for OP-TEE.
+ */
+ optee_page = page_to_phys(*pages) +
+ round_down(page_offset, OPTEE_MSG_NONCONTIG_PAGE_SIZE);
+
+ while (true) {
+ pages_data->pages_list[n++] = optee_page;
+
+ if (n == PAGELIST_ENTRIES_PER_PAGE) {
+ pages_data->next_page_data =
+ virt_to_phys(pages_data + 1);
+ pages_data++;
+ n = 0;
+ }
+
+ optee_page += OPTEE_MSG_NONCONTIG_PAGE_SIZE;
+ if (!(optee_page & ~PAGE_MASK)) {
+ if (!--num_pages)
+ break;
+ pages++;
+ optee_page = page_to_phys(*pages);
+ }
+ }
+}
+
+/*
+ * The final entry in each pagelist page is a pointer to the next
+ * pagelist page.
+ */
+static size_t get_pages_list_size(size_t num_entries)
+{
+ int pages = DIV_ROUND_UP(num_entries, PAGELIST_ENTRIES_PER_PAGE);
+
+ return pages * OPTEE_MSG_NONCONTIG_PAGE_SIZE;
+}
+
+u64 *optee_allocate_pages_list(size_t num_entries)
+{
+ return alloc_pages_exact(get_pages_list_size(num_entries), GFP_KERNEL);
+}
+
+void optee_free_pages_list(void *list, size_t num_entries)
+{
+ free_pages_exact(list, get_pages_list_size(num_entries));
+}
+
+static bool is_normal_memory(pgprot_t p)
+{
+#if defined(CONFIG_ARM)
+ return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
+#elif defined(CONFIG_ARM64)
+ return (pgprot_val(p) & PTE_ATTRINDX_MASK) == PTE_ATTRINDX(MT_NORMAL);
+#else
+#error "Unuspported architecture"
+#endif
+}
+
+static int __check_mem_type(struct vm_area_struct *vma, unsigned long end)
+{
+ while (vma && is_normal_memory(vma->vm_page_prot)) {
+ if (vma->vm_end >= end)
+ return 0;
+ vma = vma->vm_next;
+ }
+
+ return -EINVAL;
+}
+
+static int check_mem_type(unsigned long start, size_t num_pages)
+{
+ struct mm_struct *mm = current->mm;
+ int rc;
+
+ down_read(&mm->mmap_sem);
+ rc = __check_mem_type(find_vma(mm, start),
+ start + num_pages * PAGE_SIZE);
+ up_read(&mm->mmap_sem);
+
+ return rc;
+}
+
+int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm,
+ struct page **pages, size_t num_pages,
+ unsigned long start)
+{
+ struct tee_shm *shm_arg = NULL;
+ struct optee_msg_arg *msg_arg;
+ u64 *pages_list;
+ phys_addr_t msg_parg;
+ int rc;
+
+ if (!num_pages)
+ return -EINVAL;
+
+ rc = check_mem_type(start, num_pages);
+ if (rc)
+ return rc;
+
+ pages_list = optee_allocate_pages_list(num_pages);
+ if (!pages_list)
+ return -ENOMEM;
+
+ shm_arg = get_msg_arg(ctx, 1, &msg_arg, &msg_parg);
+ if (IS_ERR(shm_arg)) {
+ rc = PTR_ERR(shm_arg);
+ goto out;
+ }
+
+ optee_fill_pages_list(pages_list, pages, num_pages,
+ tee_shm_get_page_offset(shm));
+
+ msg_arg->cmd = OPTEE_MSG_CMD_REGISTER_SHM;
+ msg_arg->params->attr = OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT |
+ OPTEE_MSG_ATTR_NONCONTIG;
+ msg_arg->params->u.tmem.shm_ref = (unsigned long)shm;
+ msg_arg->params->u.tmem.size = tee_shm_get_size(shm);
+ /*
+ * In the least bits of msg_arg->params->u.tmem.buf_ptr we
+ * store buffer offset from 4k page, as described in OP-TEE ABI.
+ */
+ msg_arg->params->u.tmem.buf_ptr = virt_to_phys(pages_list) |
+ (tee_shm_get_page_offset(shm) & (OPTEE_MSG_NONCONTIG_PAGE_SIZE - 1));
+
+ if (optee_do_call_with_arg(ctx, msg_parg) ||
+ msg_arg->ret != TEEC_SUCCESS)
+ rc = -EINVAL;
+
+ tee_shm_free(shm_arg);
+out:
+ optee_free_pages_list(pages_list, num_pages);
+ return rc;
+}
+
+int optee_shm_unregister(struct tee_context *ctx, struct tee_shm *shm)
+{
+ struct tee_shm *shm_arg;
+ struct optee_msg_arg *msg_arg;
+ phys_addr_t msg_parg;
+ int rc = 0;
+
+ shm_arg = get_msg_arg(ctx, 1, &msg_arg, &msg_parg);
+ if (IS_ERR(shm_arg))
+ return PTR_ERR(shm_arg);
+
+ msg_arg->cmd = OPTEE_MSG_CMD_UNREGISTER_SHM;
+
+ msg_arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_RMEM_INPUT;
+ msg_arg->params[0].u.rmem.shm_ref = (unsigned long)shm;
+
+ if (optee_do_call_with_arg(ctx, msg_parg) ||
+ msg_arg->ret != TEEC_SUCCESS)
+ rc = -EINVAL;
+ tee_shm_free(shm_arg);
+ return rc;
+}
+
+int optee_shm_register_supp(struct tee_context *ctx, struct tee_shm *shm,
+ struct page **pages, size_t num_pages,
+ unsigned long start)
+{
+ /*
+ * We don't want to register supplicant memory in OP-TEE.
+ * Instead information about it will be passed in RPC code.
+ */
+ return check_mem_type(start, num_pages);
+}
+
+int optee_shm_unregister_supp(struct tee_context *ctx, struct tee_shm *shm)
+{
+ return 0;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/core.c b/src/kernel/linux/v4.19/drivers/tee/optee/core.c
new file mode 100644
index 0000000..2f254f9
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/core.c
@@ -0,0 +1,730 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/arm-smccc.h>
+#include <linux/errno.h>
+#include <linux/io.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/tee_drv.h>
+#include <linux/types.h>
+#include <linux/uaccess.h>
+#include "optee_private.h"
+#include "optee_smc.h"
+#include "shm_pool.h"
+
+#define DRIVER_NAME "optee"
+
+#define OPTEE_SHM_NUM_PRIV_PAGES CONFIG_OPTEE_SHM_NUM_PRIV_PAGES
+
+/**
+ * optee_from_msg_param() - convert from OPTEE_MSG parameters to
+ * struct tee_param
+ * @params: subsystem internal parameter representation
+ * @num_params: number of elements in the parameter arrays
+ * @msg_params: OPTEE_MSG parameters
+ * Returns 0 on success or <0 on failure
+ */
+int optee_from_msg_param(struct tee_param *params, size_t num_params,
+ const struct optee_msg_param *msg_params)
+{
+ int rc;
+ size_t n;
+ struct tee_shm *shm;
+ phys_addr_t pa;
+
+ for (n = 0; n < num_params; n++) {
+ struct tee_param *p = params + n;
+ const struct optee_msg_param *mp = msg_params + n;
+ u32 attr = mp->attr & OPTEE_MSG_ATTR_TYPE_MASK;
+
+ switch (attr) {
+ case OPTEE_MSG_ATTR_TYPE_NONE:
+ p->attr = TEE_IOCTL_PARAM_ATTR_TYPE_NONE;
+ memset(&p->u, 0, sizeof(p->u));
+ break;
+ case OPTEE_MSG_ATTR_TYPE_VALUE_INPUT:
+ case OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT:
+ case OPTEE_MSG_ATTR_TYPE_VALUE_INOUT:
+ p->attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT +
+ attr - OPTEE_MSG_ATTR_TYPE_VALUE_INPUT;
+ p->u.value.a = mp->u.value.a;
+ p->u.value.b = mp->u.value.b;
+ p->u.value.c = mp->u.value.c;
+ break;
+ case OPTEE_MSG_ATTR_TYPE_TMEM_INPUT:
+ case OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT:
+ case OPTEE_MSG_ATTR_TYPE_TMEM_INOUT:
+ p->attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT +
+ attr - OPTEE_MSG_ATTR_TYPE_TMEM_INPUT;
+ p->u.memref.size = mp->u.tmem.size;
+ shm = (struct tee_shm *)(unsigned long)
+ mp->u.tmem.shm_ref;
+ if (!shm) {
+ p->u.memref.shm_offs = 0;
+ p->u.memref.shm = NULL;
+ break;
+ }
+ rc = tee_shm_get_pa(shm, 0, &pa);
+ if (rc)
+ return rc;
+ p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa;
+ p->u.memref.shm = shm;
+
+ /* Check that the memref is covered by the shm object */
+ if (p->u.memref.size) {
+ size_t o = p->u.memref.shm_offs +
+ p->u.memref.size - 1;
+
+ rc = tee_shm_get_pa(shm, o, NULL);
+ if (rc)
+ return rc;
+ }
+ break;
+ case OPTEE_MSG_ATTR_TYPE_RMEM_INPUT:
+ case OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT:
+ case OPTEE_MSG_ATTR_TYPE_RMEM_INOUT:
+ p->attr = TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT +
+ attr - OPTEE_MSG_ATTR_TYPE_RMEM_INPUT;
+ p->u.memref.size = mp->u.rmem.size;
+ shm = (struct tee_shm *)(unsigned long)
+ mp->u.rmem.shm_ref;
+
+ if (!shm) {
+ p->u.memref.shm_offs = 0;
+ p->u.memref.shm = NULL;
+ break;
+ }
+ p->u.memref.shm_offs = mp->u.rmem.offs;
+ p->u.memref.shm = shm;
+
+ break;
+
+ default:
+ return -EINVAL;
+ }
+ }
+ return 0;
+}
+
+static int to_msg_param_tmp_mem(struct optee_msg_param *mp,
+ const struct tee_param *p)
+{
+ int rc;
+ phys_addr_t pa;
+
+ mp->attr = OPTEE_MSG_ATTR_TYPE_TMEM_INPUT + p->attr -
+ TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT;
+
+ mp->u.tmem.shm_ref = (unsigned long)p->u.memref.shm;
+ mp->u.tmem.size = p->u.memref.size;
+
+ if (!p->u.memref.shm) {
+ mp->u.tmem.buf_ptr = 0;
+ return 0;
+ }
+
+ rc = tee_shm_get_pa(p->u.memref.shm, p->u.memref.shm_offs, &pa);
+ if (rc)
+ return rc;
+
+ mp->u.tmem.buf_ptr = pa;
+ mp->attr |= OPTEE_MSG_ATTR_CACHE_PREDEFINED <<
+ OPTEE_MSG_ATTR_CACHE_SHIFT;
+
+ return 0;
+}
+
+static int to_msg_param_reg_mem(struct optee_msg_param *mp,
+ const struct tee_param *p)
+{
+ mp->attr = OPTEE_MSG_ATTR_TYPE_RMEM_INPUT + p->attr -
+ TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT;
+
+ mp->u.rmem.shm_ref = (unsigned long)p->u.memref.shm;
+ mp->u.rmem.size = p->u.memref.size;
+ mp->u.rmem.offs = p->u.memref.shm_offs;
+ return 0;
+}
+
+/**
+ * optee_to_msg_param() - convert from struct tee_params to OPTEE_MSG parameters
+ * @msg_params: OPTEE_MSG parameters
+ * @num_params: number of elements in the parameter arrays
+ * @params: subsystem itnernal parameter representation
+ * Returns 0 on success or <0 on failure
+ */
+int optee_to_msg_param(struct optee_msg_param *msg_params, size_t num_params,
+ const struct tee_param *params)
+{
+ int rc;
+ size_t n;
+
+ for (n = 0; n < num_params; n++) {
+ const struct tee_param *p = params + n;
+ struct optee_msg_param *mp = msg_params + n;
+
+ switch (p->attr) {
+ case TEE_IOCTL_PARAM_ATTR_TYPE_NONE:
+ mp->attr = TEE_IOCTL_PARAM_ATTR_TYPE_NONE;
+ memset(&mp->u, 0, sizeof(mp->u));
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
+ mp->attr = OPTEE_MSG_ATTR_TYPE_VALUE_INPUT + p->attr -
+ TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
+ mp->u.value.a = p->u.value.a;
+ mp->u.value.b = p->u.value.b;
+ mp->u.value.c = p->u.value.c;
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
+ if (tee_shm_is_registered(p->u.memref.shm))
+ rc = to_msg_param_reg_mem(mp, p);
+ else
+ rc = to_msg_param_tmp_mem(mp, p);
+ if (rc)
+ return rc;
+ break;
+ default:
+ return -EINVAL;
+ }
+ }
+ return 0;
+}
+
+static void optee_get_version(struct tee_device *teedev,
+ struct tee_ioctl_version_data *vers)
+{
+ struct tee_ioctl_version_data v = {
+ .impl_id = TEE_IMPL_ID_OPTEE,
+ .impl_caps = TEE_OPTEE_CAP_TZ,
+ .gen_caps = TEE_GEN_CAP_GP,
+ };
+ struct optee *optee = tee_get_drvdata(teedev);
+
+ if (optee->sec_caps & OPTEE_SMC_SEC_CAP_DYNAMIC_SHM)
+ v.gen_caps |= TEE_GEN_CAP_REG_MEM;
+ *vers = v;
+}
+
+static int optee_open(struct tee_context *ctx)
+{
+ struct optee_context_data *ctxdata;
+ struct tee_device *teedev = ctx->teedev;
+ struct optee *optee = tee_get_drvdata(teedev);
+
+ ctxdata = kzalloc(sizeof(*ctxdata), GFP_KERNEL);
+ if (!ctxdata)
+ return -ENOMEM;
+
+ if (teedev == optee->supp_teedev) {
+ bool busy = true;
+
+ mutex_lock(&optee->supp.mutex);
+ if (!optee->supp.ctx) {
+ busy = false;
+ optee->supp.ctx = ctx;
+ }
+ mutex_unlock(&optee->supp.mutex);
+ if (busy) {
+ kfree(ctxdata);
+ return -EBUSY;
+ }
+ }
+
+ mutex_init(&ctxdata->mutex);
+ INIT_LIST_HEAD(&ctxdata->sess_list);
+
+ ctx->data = ctxdata;
+ return 0;
+}
+
+static void optee_release(struct tee_context *ctx)
+{
+ struct optee_context_data *ctxdata = ctx->data;
+ struct tee_device *teedev = ctx->teedev;
+ struct optee *optee = tee_get_drvdata(teedev);
+ struct tee_shm *shm;
+ struct optee_msg_arg *arg = NULL;
+ phys_addr_t parg;
+ struct optee_session *sess;
+ struct optee_session *sess_tmp;
+
+ if (!ctxdata)
+ return;
+
+ shm = tee_shm_alloc(ctx, sizeof(struct optee_msg_arg), TEE_SHM_MAPPED);
+ if (!IS_ERR(shm)) {
+ arg = tee_shm_get_va(shm, 0);
+ /*
+ * If va2pa fails for some reason, we can't call into
+ * secure world, only free the memory. Secure OS will leak
+ * sessions and finally refuse more sessions, but we will
+ * at least let normal world reclaim its memory.
+ */
+ if (!IS_ERR(arg))
+ if (tee_shm_va2pa(shm, arg, &parg))
+ arg = NULL; /* prevent usage of parg below */
+ }
+
+ list_for_each_entry_safe(sess, sess_tmp, &ctxdata->sess_list,
+ list_node) {
+ list_del(&sess->list_node);
+ if (!IS_ERR_OR_NULL(arg)) {
+ memset(arg, 0, sizeof(*arg));
+ arg->cmd = OPTEE_MSG_CMD_CLOSE_SESSION;
+ arg->session = sess->session_id;
+ optee_do_call_with_arg(ctx, parg);
+ }
+ kfree(sess);
+ }
+ kfree(ctxdata);
+
+ if (!IS_ERR(shm))
+ tee_shm_free(shm);
+
+ ctx->data = NULL;
+
+ if (teedev == optee->supp_teedev)
+ optee_supp_release(&optee->supp);
+}
+
+static const struct tee_driver_ops optee_ops = {
+ .get_version = optee_get_version,
+ .open = optee_open,
+ .release = optee_release,
+ .open_session = optee_open_session,
+ .close_session = optee_close_session,
+ .invoke_func = optee_invoke_func,
+ .cancel_req = optee_cancel_req,
+ .shm_register = optee_shm_register,
+ .shm_unregister = optee_shm_unregister,
+};
+
+static const struct tee_desc optee_desc = {
+ .name = DRIVER_NAME "-clnt",
+ .ops = &optee_ops,
+ .owner = THIS_MODULE,
+};
+
+static const struct tee_driver_ops optee_supp_ops = {
+ .get_version = optee_get_version,
+ .open = optee_open,
+ .release = optee_release,
+ .supp_recv = optee_supp_recv,
+ .supp_send = optee_supp_send,
+ .shm_register = optee_shm_register_supp,
+ .shm_unregister = optee_shm_unregister_supp,
+};
+
+static const struct tee_desc optee_supp_desc = {
+ .name = DRIVER_NAME "-supp",
+ .ops = &optee_supp_ops,
+ .owner = THIS_MODULE,
+ .flags = TEE_DESC_PRIVILEGED,
+};
+
+static bool optee_msg_api_uid_is_optee_api(optee_invoke_fn *invoke_fn)
+{
+ struct arm_smccc_res res;
+
+ invoke_fn(OPTEE_SMC_CALLS_UID, 0, 0, 0, 0, 0, 0, 0, &res);
+
+ if (res.a0 == OPTEE_MSG_UID_0 && res.a1 == OPTEE_MSG_UID_1 &&
+ res.a2 == OPTEE_MSG_UID_2 && res.a3 == OPTEE_MSG_UID_3)
+ return true;
+ return false;
+}
+
+static void optee_msg_get_os_revision(optee_invoke_fn *invoke_fn)
+{
+ union {
+ struct arm_smccc_res smccc;
+ struct optee_smc_call_get_os_revision_result result;
+ } res = {
+ .result = {
+ .build_id = 0
+ }
+ };
+
+ invoke_fn(OPTEE_SMC_CALL_GET_OS_REVISION, 0, 0, 0, 0, 0, 0, 0,
+ &res.smccc);
+
+ if (res.result.build_id)
+ pr_info("revision %lu.%lu (%08lx)", res.result.major,
+ res.result.minor, res.result.build_id);
+ else
+ pr_info("revision %lu.%lu", res.result.major, res.result.minor);
+}
+
+static bool optee_msg_api_revision_is_compatible(optee_invoke_fn *invoke_fn)
+{
+ union {
+ struct arm_smccc_res smccc;
+ struct optee_smc_calls_revision_result result;
+ } res;
+
+ invoke_fn(OPTEE_SMC_CALLS_REVISION, 0, 0, 0, 0, 0, 0, 0, &res.smccc);
+
+ if (res.result.major == OPTEE_MSG_REVISION_MAJOR &&
+ (int)res.result.minor >= OPTEE_MSG_REVISION_MINOR)
+ return true;
+ return false;
+}
+
+static bool optee_msg_exchange_capabilities(optee_invoke_fn *invoke_fn,
+ u32 *sec_caps)
+{
+ union {
+ struct arm_smccc_res smccc;
+ struct optee_smc_exchange_capabilities_result result;
+ } res;
+ u32 a1 = 0;
+
+ /*
+ * TODO This isn't enough to tell if it's UP system (from kernel
+ * point of view) or not, is_smp() returns the the information
+ * needed, but can't be called directly from here.
+ */
+ if (!IS_ENABLED(CONFIG_SMP) || nr_cpu_ids == 1)
+ a1 |= OPTEE_SMC_NSEC_CAP_UNIPROCESSOR;
+
+ invoke_fn(OPTEE_SMC_EXCHANGE_CAPABILITIES, a1, 0, 0, 0, 0, 0, 0,
+ &res.smccc);
+
+ if (res.result.status != OPTEE_SMC_RETURN_OK)
+ return false;
+
+ *sec_caps = res.result.capabilities;
+ return true;
+}
+
+static struct tee_shm_pool *
+optee_config_shm_memremap(optee_invoke_fn *invoke_fn, void **memremaped_shm,
+ u32 sec_caps)
+{
+ union {
+ struct arm_smccc_res smccc;
+ struct optee_smc_get_shm_config_result result;
+ } res;
+ unsigned long vaddr;
+ phys_addr_t paddr;
+ size_t size;
+ phys_addr_t begin;
+ phys_addr_t end;
+ void *va;
+ struct tee_shm_pool_mgr *priv_mgr;
+ struct tee_shm_pool_mgr *dmabuf_mgr;
+ void *rc;
+
+ invoke_fn(OPTEE_SMC_GET_SHM_CONFIG, 0, 0, 0, 0, 0, 0, 0, &res.smccc);
+ if (res.result.status != OPTEE_SMC_RETURN_OK) {
+ pr_info("shm service not available\n");
+ return ERR_PTR(-ENOENT);
+ }
+
+ if (res.result.settings != OPTEE_SMC_SHM_CACHED) {
+ pr_err("only normal cached shared memory supported\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ begin = roundup(res.result.start, PAGE_SIZE);
+ end = rounddown(res.result.start + res.result.size, PAGE_SIZE);
+ paddr = begin;
+ size = end - begin;
+
+ if (size < 2 * OPTEE_SHM_NUM_PRIV_PAGES * PAGE_SIZE) {
+ pr_err("too small shared memory area\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ va = memremap(paddr, size, MEMREMAP_WB);
+ if (!va) {
+ pr_err("shared memory ioremap failed\n");
+ return ERR_PTR(-EINVAL);
+ }
+ vaddr = (unsigned long)va;
+
+ /*
+ * If OP-TEE can work with unregistered SHM, we will use own pool
+ * for private shm
+ */
+ if (sec_caps & OPTEE_SMC_SEC_CAP_DYNAMIC_SHM) {
+ rc = optee_shm_pool_alloc_pages();
+ if (IS_ERR(rc))
+ goto err_memunmap;
+ priv_mgr = rc;
+ } else {
+ const size_t sz = OPTEE_SHM_NUM_PRIV_PAGES * PAGE_SIZE;
+
+ rc = tee_shm_pool_mgr_alloc_res_mem(vaddr, paddr, sz,
+ 3 /* 8 bytes aligned */);
+ if (IS_ERR(rc))
+ goto err_memunmap;
+ priv_mgr = rc;
+
+ vaddr += sz;
+ paddr += sz;
+ size -= sz;
+ }
+
+ rc = tee_shm_pool_mgr_alloc_res_mem(vaddr, paddr, size, PAGE_SHIFT);
+ if (IS_ERR(rc))
+ goto err_free_priv_mgr;
+ dmabuf_mgr = rc;
+
+ rc = tee_shm_pool_alloc(priv_mgr, dmabuf_mgr);
+ if (IS_ERR(rc))
+ goto err_free_dmabuf_mgr;
+
+ *memremaped_shm = va;
+
+ return rc;
+
+err_free_dmabuf_mgr:
+ tee_shm_pool_mgr_destroy(dmabuf_mgr);
+err_free_priv_mgr:
+ tee_shm_pool_mgr_destroy(priv_mgr);
+err_memunmap:
+ memunmap(va);
+ return rc;
+}
+
+/* Simple wrapper functions to be able to use a function pointer */
+static void optee_smccc_smc(unsigned long a0, unsigned long a1,
+ unsigned long a2, unsigned long a3,
+ unsigned long a4, unsigned long a5,
+ unsigned long a6, unsigned long a7,
+ struct arm_smccc_res *res)
+{
+ arm_smccc_smc(a0, a1, a2, a3, a4, a5, a6, a7, res);
+}
+
+static void optee_smccc_hvc(unsigned long a0, unsigned long a1,
+ unsigned long a2, unsigned long a3,
+ unsigned long a4, unsigned long a5,
+ unsigned long a6, unsigned long a7,
+ struct arm_smccc_res *res)
+{
+ arm_smccc_hvc(a0, a1, a2, a3, a4, a5, a6, a7, res);
+}
+
+static optee_invoke_fn *get_invoke_func(struct device_node *np)
+{
+ const char *method;
+
+ pr_info("probing for conduit method from DT.\n");
+
+ if (of_property_read_string(np, "method", &method)) {
+ pr_warn("missing \"method\" property\n");
+ return ERR_PTR(-ENXIO);
+ }
+
+ if (!strcmp("hvc", method))
+ return optee_smccc_hvc;
+ else if (!strcmp("smc", method))
+ return optee_smccc_smc;
+
+ pr_warn("invalid \"method\" property: %s\n", method);
+ return ERR_PTR(-EINVAL);
+}
+
+static struct optee *optee_probe(struct device_node *np)
+{
+ optee_invoke_fn *invoke_fn;
+ struct tee_shm_pool *pool;
+ struct optee *optee = NULL;
+ void *memremaped_shm = NULL;
+ struct tee_device *teedev;
+ u32 sec_caps;
+ int rc;
+
+ invoke_fn = get_invoke_func(np);
+ if (IS_ERR(invoke_fn))
+ return (void *)invoke_fn;
+
+ if (!optee_msg_api_uid_is_optee_api(invoke_fn)) {
+ pr_warn("api uid mismatch\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ optee_msg_get_os_revision(invoke_fn);
+
+ if (!optee_msg_api_revision_is_compatible(invoke_fn)) {
+ pr_warn("api revision mismatch\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ if (!optee_msg_exchange_capabilities(invoke_fn, &sec_caps)) {
+ pr_warn("capabilities mismatch\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ /*
+ * We have no other option for shared memory, if secure world
+ * doesn't have any reserved memory we can use we can't continue.
+ */
+ if (!(sec_caps & OPTEE_SMC_SEC_CAP_HAVE_RESERVED_SHM))
+ return ERR_PTR(-EINVAL);
+
+ pool = optee_config_shm_memremap(invoke_fn, &memremaped_shm, sec_caps);
+ if (IS_ERR(pool))
+ return (void *)pool;
+
+ optee = kzalloc(sizeof(*optee), GFP_KERNEL);
+ if (!optee) {
+ rc = -ENOMEM;
+ goto err;
+ }
+
+ optee->invoke_fn = invoke_fn;
+ optee->sec_caps = sec_caps;
+
+ teedev = tee_device_alloc(&optee_desc, NULL, pool, optee);
+ if (IS_ERR(teedev)) {
+ rc = PTR_ERR(teedev);
+ goto err;
+ }
+ optee->teedev = teedev;
+
+ teedev = tee_device_alloc(&optee_supp_desc, NULL, pool, optee);
+ if (IS_ERR(teedev)) {
+ rc = PTR_ERR(teedev);
+ goto err;
+ }
+ optee->supp_teedev = teedev;
+
+ rc = tee_device_register(optee->teedev);
+ if (rc)
+ goto err;
+
+ rc = tee_device_register(optee->supp_teedev);
+ if (rc)
+ goto err;
+
+ mutex_init(&optee->call_queue.mutex);
+ INIT_LIST_HEAD(&optee->call_queue.waiters);
+ optee_wait_queue_init(&optee->wait_queue);
+ optee_supp_init(&optee->supp);
+ optee->memremaped_shm = memremaped_shm;
+ optee->pool = pool;
+
+ optee_enable_shm_cache(optee);
+
+ pr_info("initialized driver\n");
+ return optee;
+err:
+ if (optee) {
+ /*
+ * tee_device_unregister() is safe to call even if the
+ * devices hasn't been registered with
+ * tee_device_register() yet.
+ */
+ tee_device_unregister(optee->supp_teedev);
+ tee_device_unregister(optee->teedev);
+ kfree(optee);
+ }
+ if (pool)
+ tee_shm_pool_free(pool);
+ if (memremaped_shm)
+ memunmap(memremaped_shm);
+ return ERR_PTR(rc);
+}
+
+static void optee_remove(struct optee *optee)
+{
+ /*
+ * Ask OP-TEE to free all cached shared memory objects to decrease
+ * reference counters and also avoid wild pointers in secure world
+ * into the old shared memory range.
+ */
+ optee_disable_shm_cache(optee);
+
+ /*
+ * The two devices has to be unregistered before we can free the
+ * other resources.
+ */
+ tee_device_unregister(optee->supp_teedev);
+ tee_device_unregister(optee->teedev);
+
+ tee_shm_pool_free(optee->pool);
+ if (optee->memremaped_shm)
+ memunmap(optee->memremaped_shm);
+ optee_wait_queue_exit(&optee->wait_queue);
+ optee_supp_uninit(&optee->supp);
+ mutex_destroy(&optee->call_queue.mutex);
+
+ kfree(optee);
+}
+
+static const struct of_device_id optee_match[] = {
+ { .compatible = "linaro,optee-tz" },
+ {},
+};
+
+static struct optee *optee_svc;
+
+static int __init optee_driver_init(void)
+{
+ struct device_node *fw_np;
+ struct device_node *np;
+ struct optee *optee;
+
+ /* Node is supposed to be below /firmware */
+ fw_np = of_find_node_by_name(NULL, "firmware");
+ if (!fw_np)
+ return -ENODEV;
+
+ np = of_find_matching_node(fw_np, optee_match);
+ if (!np || !of_device_is_available(np)) {
+ of_node_put(np);
+ return -ENODEV;
+ }
+
+ optee = optee_probe(np);
+ of_node_put(np);
+
+ if (IS_ERR(optee))
+ return PTR_ERR(optee);
+
+ optee_svc = optee;
+
+ return 0;
+}
+module_init(optee_driver_init);
+
+static void __exit optee_driver_exit(void)
+{
+ struct optee *optee = optee_svc;
+
+ optee_svc = NULL;
+ if (optee)
+ optee_remove(optee);
+}
+module_exit(optee_driver_exit);
+
+MODULE_AUTHOR("Linaro");
+MODULE_DESCRIPTION("OP-TEE driver");
+MODULE_SUPPORTED_DEVICE("");
+MODULE_VERSION("1.0");
+MODULE_LICENSE("GPL v2");
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/optee_msg.h b/src/kernel/linux/v4.19/drivers/tee/optee/optee_msg.h
new file mode 100644
index 0000000..3050490
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/optee_msg.h
@@ -0,0 +1,444 @@
+/*
+ * Copyright (c) 2015-2016, Linaro Limited
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef _OPTEE_MSG_H
+#define _OPTEE_MSG_H
+
+#include <linux/bitops.h>
+#include <linux/types.h>
+
+/*
+ * This file defines the OP-TEE message protocol used to communicate
+ * with an instance of OP-TEE running in secure world.
+ *
+ * This file is divided into three sections.
+ * 1. Formatting of messages.
+ * 2. Requests from normal world
+ * 3. Requests from secure world, Remote Procedure Call (RPC), handled by
+ * tee-supplicant.
+ */
+
+/*****************************************************************************
+ * Part 1 - formatting of messages
+ *****************************************************************************/
+
+#define OPTEE_MSG_ATTR_TYPE_NONE 0x0
+#define OPTEE_MSG_ATTR_TYPE_VALUE_INPUT 0x1
+#define OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT 0x2
+#define OPTEE_MSG_ATTR_TYPE_VALUE_INOUT 0x3
+#define OPTEE_MSG_ATTR_TYPE_RMEM_INPUT 0x5
+#define OPTEE_MSG_ATTR_TYPE_RMEM_OUTPUT 0x6
+#define OPTEE_MSG_ATTR_TYPE_RMEM_INOUT 0x7
+#define OPTEE_MSG_ATTR_TYPE_TMEM_INPUT 0x9
+#define OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT 0xa
+#define OPTEE_MSG_ATTR_TYPE_TMEM_INOUT 0xb
+
+#define OPTEE_MSG_ATTR_TYPE_MASK GENMASK(7, 0)
+
+/*
+ * Meta parameter to be absorbed by the Secure OS and not passed
+ * to the Trusted Application.
+ *
+ * Currently only used with OPTEE_MSG_CMD_OPEN_SESSION.
+ */
+#define OPTEE_MSG_ATTR_META BIT(8)
+
+/*
+ * Pointer to a list of pages used to register user-defined SHM buffer.
+ * Used with OPTEE_MSG_ATTR_TYPE_TMEM_*.
+ * buf_ptr should point to the beginning of the buffer. Buffer will contain
+ * list of page addresses. OP-TEE core can reconstruct contiguous buffer from
+ * that page addresses list. Page addresses are stored as 64 bit values.
+ * Last entry on a page should point to the next page of buffer.
+ * Every entry in buffer should point to a 4k page beginning (12 least
+ * significant bits must be equal to zero).
+ *
+ * 12 least significant bints of optee_msg_param.u.tmem.buf_ptr should hold page
+ * offset of the user buffer.
+ *
+ * So, entries should be placed like members of this structure:
+ *
+ * struct page_data {
+ * uint64_t pages_array[OPTEE_MSG_NONCONTIG_PAGE_SIZE/sizeof(uint64_t) - 1];
+ * uint64_t next_page_data;
+ * };
+ *
+ * Structure is designed to exactly fit into the page size
+ * OPTEE_MSG_NONCONTIG_PAGE_SIZE which is a standard 4KB page.
+ *
+ * The size of 4KB is chosen because this is the smallest page size for ARM
+ * architectures. If REE uses larger pages, it should divide them to 4KB ones.
+ */
+#define OPTEE_MSG_ATTR_NONCONTIG BIT(9)
+
+/*
+ * Memory attributes for caching passed with temp memrefs. The actual value
+ * used is defined outside the message protocol with the exception of
+ * OPTEE_MSG_ATTR_CACHE_PREDEFINED which means the attributes already
+ * defined for the memory range should be used. If optee_smc.h is used as
+ * bearer of this protocol OPTEE_SMC_SHM_* is used for values.
+ */
+#define OPTEE_MSG_ATTR_CACHE_SHIFT 16
+#define OPTEE_MSG_ATTR_CACHE_MASK GENMASK(2, 0)
+#define OPTEE_MSG_ATTR_CACHE_PREDEFINED 0
+
+/*
+ * Same values as TEE_LOGIN_* from TEE Internal API
+ */
+#define OPTEE_MSG_LOGIN_PUBLIC 0x00000000
+#define OPTEE_MSG_LOGIN_USER 0x00000001
+#define OPTEE_MSG_LOGIN_GROUP 0x00000002
+#define OPTEE_MSG_LOGIN_APPLICATION 0x00000004
+#define OPTEE_MSG_LOGIN_APPLICATION_USER 0x00000005
+#define OPTEE_MSG_LOGIN_APPLICATION_GROUP 0x00000006
+
+/*
+ * Page size used in non-contiguous buffer entries
+ */
+#define OPTEE_MSG_NONCONTIG_PAGE_SIZE 4096
+
+/**
+ * struct optee_msg_param_tmem - temporary memory reference parameter
+ * @buf_ptr: Address of the buffer
+ * @size: Size of the buffer
+ * @shm_ref: Temporary shared memory reference, pointer to a struct tee_shm
+ *
+ * Secure and normal world communicates pointers as physical address
+ * instead of the virtual address. This is because secure and normal world
+ * have completely independent memory mapping. Normal world can even have a
+ * hypervisor which need to translate the guest physical address (AKA IPA
+ * in ARM documentation) to a real physical address before passing the
+ * structure to secure world.
+ */
+struct optee_msg_param_tmem {
+ u64 buf_ptr;
+ u64 size;
+ u64 shm_ref;
+};
+
+/**
+ * struct optee_msg_param_rmem - registered memory reference parameter
+ * @offs: Offset into shared memory reference
+ * @size: Size of the buffer
+ * @shm_ref: Shared memory reference, pointer to a struct tee_shm
+ */
+struct optee_msg_param_rmem {
+ u64 offs;
+ u64 size;
+ u64 shm_ref;
+};
+
+/**
+ * struct optee_msg_param_value - opaque value parameter
+ *
+ * Value parameters are passed unchecked between normal and secure world.
+ */
+struct optee_msg_param_value {
+ u64 a;
+ u64 b;
+ u64 c;
+};
+
+/**
+ * struct optee_msg_param - parameter used together with struct optee_msg_arg
+ * @attr: attributes
+ * @tmem: parameter by temporary memory reference
+ * @rmem: parameter by registered memory reference
+ * @value: parameter by opaque value
+ *
+ * @attr & OPTEE_MSG_ATTR_TYPE_MASK indicates if tmem, rmem or value is used in
+ * the union. OPTEE_MSG_ATTR_TYPE_VALUE_* indicates value,
+ * OPTEE_MSG_ATTR_TYPE_TMEM_* indicates @tmem and
+ * OPTEE_MSG_ATTR_TYPE_RMEM_* indicates @rmem,
+ * OPTEE_MSG_ATTR_TYPE_NONE indicates that none of the members are used.
+ */
+struct optee_msg_param {
+ u64 attr;
+ union {
+ struct optee_msg_param_tmem tmem;
+ struct optee_msg_param_rmem rmem;
+ struct optee_msg_param_value value;
+ } u;
+};
+
+/**
+ * struct optee_msg_arg - call argument
+ * @cmd: Command, one of OPTEE_MSG_CMD_* or OPTEE_MSG_RPC_CMD_*
+ * @func: Trusted Application function, specific to the Trusted Application,
+ * used if cmd == OPTEE_MSG_CMD_INVOKE_COMMAND
+ * @session: In parameter for all OPTEE_MSG_CMD_* except
+ * OPTEE_MSG_CMD_OPEN_SESSION where it's an output parameter instead
+ * @cancel_id: Cancellation id, a unique value to identify this request
+ * @ret: return value
+ * @ret_origin: origin of the return value
+ * @num_params: number of parameters supplied to the OS Command
+ * @params: the parameters supplied to the OS Command
+ *
+ * All normal calls to Trusted OS uses this struct. If cmd requires further
+ * information than what these field holds it can be passed as a parameter
+ * tagged as meta (setting the OPTEE_MSG_ATTR_META bit in corresponding
+ * attrs field). All parameters tagged as meta has to come first.
+ *
+ * Temp memref parameters can be fragmented if supported by the Trusted OS
+ * (when optee_smc.h is bearer of this protocol this is indicated with
+ * OPTEE_SMC_SEC_CAP_UNREGISTERED_SHM). If a logical memref parameter is
+ * fragmented then has all but the last fragment the
+ * OPTEE_MSG_ATTR_FRAGMENT bit set in attrs. Even if a memref is fragmented
+ * it will still be presented as a single logical memref to the Trusted
+ * Application.
+ */
+struct optee_msg_arg {
+ u32 cmd;
+ u32 func;
+ u32 session;
+ u32 cancel_id;
+ u32 pad;
+ u32 ret;
+ u32 ret_origin;
+ u32 num_params;
+
+ /* num_params tells the actual number of element in params */
+ struct optee_msg_param params[0];
+};
+
+/**
+ * OPTEE_MSG_GET_ARG_SIZE - return size of struct optee_msg_arg
+ *
+ * @num_params: Number of parameters embedded in the struct optee_msg_arg
+ *
+ * Returns the size of the struct optee_msg_arg together with the number
+ * of embedded parameters.
+ */
+#define OPTEE_MSG_GET_ARG_SIZE(num_params) \
+ (sizeof(struct optee_msg_arg) + \
+ sizeof(struct optee_msg_param) * (num_params))
+
+/*****************************************************************************
+ * Part 2 - requests from normal world
+ *****************************************************************************/
+
+/*
+ * Return the following UID if using API specified in this file without
+ * further extensions:
+ * 384fb3e0-e7f8-11e3-af63-0002a5d5c51b.
+ * Represented in 4 32-bit words in OPTEE_MSG_UID_0, OPTEE_MSG_UID_1,
+ * OPTEE_MSG_UID_2, OPTEE_MSG_UID_3.
+ */
+#define OPTEE_MSG_UID_0 0x384fb3e0
+#define OPTEE_MSG_UID_1 0xe7f811e3
+#define OPTEE_MSG_UID_2 0xaf630002
+#define OPTEE_MSG_UID_3 0xa5d5c51b
+#define OPTEE_MSG_FUNCID_CALLS_UID 0xFF01
+
+/*
+ * Returns 2.0 if using API specified in this file without further
+ * extensions. Represented in 2 32-bit words in OPTEE_MSG_REVISION_MAJOR
+ * and OPTEE_MSG_REVISION_MINOR
+ */
+#define OPTEE_MSG_REVISION_MAJOR 2
+#define OPTEE_MSG_REVISION_MINOR 0
+#define OPTEE_MSG_FUNCID_CALLS_REVISION 0xFF03
+
+/*
+ * Get UUID of Trusted OS.
+ *
+ * Used by non-secure world to figure out which Trusted OS is installed.
+ * Note that returned UUID is the UUID of the Trusted OS, not of the API.
+ *
+ * Returns UUID in 4 32-bit words in the same way as
+ * OPTEE_MSG_FUNCID_CALLS_UID described above.
+ */
+#define OPTEE_MSG_OS_OPTEE_UUID_0 0x486178e0
+#define OPTEE_MSG_OS_OPTEE_UUID_1 0xe7f811e3
+#define OPTEE_MSG_OS_OPTEE_UUID_2 0xbc5e0002
+#define OPTEE_MSG_OS_OPTEE_UUID_3 0xa5d5c51b
+#define OPTEE_MSG_FUNCID_GET_OS_UUID 0x0000
+
+/*
+ * Get revision of Trusted OS.
+ *
+ * Used by non-secure world to figure out which version of the Trusted OS
+ * is installed. Note that the returned revision is the revision of the
+ * Trusted OS, not of the API.
+ *
+ * Returns revision in 2 32-bit words in the same way as
+ * OPTEE_MSG_CALLS_REVISION described above.
+ */
+#define OPTEE_MSG_FUNCID_GET_OS_REVISION 0x0001
+
+/*
+ * Do a secure call with struct optee_msg_arg as argument
+ * The OPTEE_MSG_CMD_* below defines what goes in struct optee_msg_arg::cmd
+ *
+ * OPTEE_MSG_CMD_OPEN_SESSION opens a session to a Trusted Application.
+ * The first two parameters are tagged as meta, holding two value
+ * parameters to pass the following information:
+ * param[0].u.value.a-b uuid of Trusted Application
+ * param[1].u.value.a-b uuid of Client
+ * param[1].u.value.c Login class of client OPTEE_MSG_LOGIN_*
+ *
+ * OPTEE_MSG_CMD_INVOKE_COMMAND invokes a command a previously opened
+ * session to a Trusted Application. struct optee_msg_arg::func is Trusted
+ * Application function, specific to the Trusted Application.
+ *
+ * OPTEE_MSG_CMD_CLOSE_SESSION closes a previously opened session to
+ * Trusted Application.
+ *
+ * OPTEE_MSG_CMD_CANCEL cancels a currently invoked command.
+ *
+ * OPTEE_MSG_CMD_REGISTER_SHM registers a shared memory reference. The
+ * information is passed as:
+ * [in] param[0].attr OPTEE_MSG_ATTR_TYPE_TMEM_INPUT
+ * [| OPTEE_MSG_ATTR_FRAGMENT]
+ * [in] param[0].u.tmem.buf_ptr physical address (of first fragment)
+ * [in] param[0].u.tmem.size size (of first fragment)
+ * [in] param[0].u.tmem.shm_ref holds shared memory reference
+ * ...
+ * The shared memory can optionally be fragmented, temp memrefs can follow
+ * each other with all but the last with the OPTEE_MSG_ATTR_FRAGMENT bit set.
+ *
+ * OPTEE_MSG_CMD_UNREGISTER_SHM unregisteres a previously registered shared
+ * memory reference. The information is passed as:
+ * [in] param[0].attr OPTEE_MSG_ATTR_TYPE_RMEM_INPUT
+ * [in] param[0].u.rmem.shm_ref holds shared memory reference
+ * [in] param[0].u.rmem.offs 0
+ * [in] param[0].u.rmem.size 0
+ */
+#define OPTEE_MSG_CMD_OPEN_SESSION 0
+#define OPTEE_MSG_CMD_INVOKE_COMMAND 1
+#define OPTEE_MSG_CMD_CLOSE_SESSION 2
+#define OPTEE_MSG_CMD_CANCEL 3
+#define OPTEE_MSG_CMD_REGISTER_SHM 4
+#define OPTEE_MSG_CMD_UNREGISTER_SHM 5
+#define OPTEE_MSG_FUNCID_CALL_WITH_ARG 0x0004
+
+/*****************************************************************************
+ * Part 3 - Requests from secure world, RPC
+ *****************************************************************************/
+
+/*
+ * All RPC is done with a struct optee_msg_arg as bearer of information,
+ * struct optee_msg_arg::arg holds values defined by OPTEE_MSG_RPC_CMD_* below
+ *
+ * RPC communication with tee-supplicant is reversed compared to normal
+ * client communication desribed above. The supplicant receives requests
+ * and sends responses.
+ */
+
+/*
+ * Load a TA into memory, defined in tee-supplicant
+ */
+#define OPTEE_MSG_RPC_CMD_LOAD_TA 0
+
+/*
+ * Reserved
+ */
+#define OPTEE_MSG_RPC_CMD_RPMB 1
+
+/*
+ * File system access, defined in tee-supplicant
+ */
+#define OPTEE_MSG_RPC_CMD_FS 2
+
+/*
+ * Get time
+ *
+ * Returns number of seconds and nano seconds since the Epoch,
+ * 1970-01-01 00:00:00 +0000 (UTC).
+ *
+ * [out] param[0].u.value.a Number of seconds
+ * [out] param[0].u.value.b Number of nano seconds.
+ */
+#define OPTEE_MSG_RPC_CMD_GET_TIME 3
+
+/*
+ * Wait queue primitive, helper for secure world to implement a wait queue.
+ *
+ * If secure world need to wait for a secure world mutex it issues a sleep
+ * request instead of spinning in secure world. Conversely is a wakeup
+ * request issued when a secure world mutex with a thread waiting thread is
+ * unlocked.
+ *
+ * Waiting on a key
+ * [in] param[0].u.value.a OPTEE_MSG_RPC_WAIT_QUEUE_SLEEP
+ * [in] param[0].u.value.b wait key
+ *
+ * Waking up a key
+ * [in] param[0].u.value.a OPTEE_MSG_RPC_WAIT_QUEUE_WAKEUP
+ * [in] param[0].u.value.b wakeup key
+ */
+#define OPTEE_MSG_RPC_CMD_WAIT_QUEUE 4
+#define OPTEE_MSG_RPC_WAIT_QUEUE_SLEEP 0
+#define OPTEE_MSG_RPC_WAIT_QUEUE_WAKEUP 1
+
+/*
+ * Suspend execution
+ *
+ * [in] param[0].value .a number of milliseconds to suspend
+ */
+#define OPTEE_MSG_RPC_CMD_SUSPEND 5
+
+/*
+ * Allocate a piece of shared memory
+ *
+ * Shared memory can optionally be fragmented, to support that additional
+ * spare param entries are allocated to make room for eventual fragments.
+ * The spare param entries has .attr = OPTEE_MSG_ATTR_TYPE_NONE when
+ * unused. All returned temp memrefs except the last should have the
+ * OPTEE_MSG_ATTR_FRAGMENT bit set in the attr field.
+ *
+ * [in] param[0].u.value.a type of memory one of
+ * OPTEE_MSG_RPC_SHM_TYPE_* below
+ * [in] param[0].u.value.b requested size
+ * [in] param[0].u.value.c required alignment
+ *
+ * [out] param[0].u.tmem.buf_ptr physical address (of first fragment)
+ * [out] param[0].u.tmem.size size (of first fragment)
+ * [out] param[0].u.tmem.shm_ref shared memory reference
+ * ...
+ * [out] param[n].u.tmem.buf_ptr physical address
+ * [out] param[n].u.tmem.size size
+ * [out] param[n].u.tmem.shm_ref shared memory reference (same value
+ * as in param[n-1].u.tmem.shm_ref)
+ */
+#define OPTEE_MSG_RPC_CMD_SHM_ALLOC 6
+/* Memory that can be shared with a non-secure user space application */
+#define OPTEE_MSG_RPC_SHM_TYPE_APPL 0
+/* Memory only shared with non-secure kernel */
+#define OPTEE_MSG_RPC_SHM_TYPE_KERNEL 1
+
+/*
+ * Free shared memory previously allocated with OPTEE_MSG_RPC_CMD_SHM_ALLOC
+ *
+ * [in] param[0].u.value.a type of memory one of
+ * OPTEE_MSG_RPC_SHM_TYPE_* above
+ * [in] param[0].u.value.b value of shared memory reference
+ * returned in param[0].u.tmem.shm_ref
+ * above
+ */
+#define OPTEE_MSG_RPC_CMD_SHM_FREE 7
+
+#endif /* _OPTEE_MSG_H */
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/optee_private.h b/src/kernel/linux/v4.19/drivers/tee/optee/optee_private.h
new file mode 100644
index 0000000..35e7938
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/optee_private.h
@@ -0,0 +1,199 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef OPTEE_PRIVATE_H
+#define OPTEE_PRIVATE_H
+
+#include <linux/arm-smccc.h>
+#include <linux/semaphore.h>
+#include <linux/tee_drv.h>
+#include <linux/types.h>
+#include "optee_msg.h"
+
+#define OPTEE_MAX_ARG_SIZE 1024
+
+/* Some Global Platform error codes used in this driver */
+#define TEEC_SUCCESS 0x00000000
+#define TEEC_ERROR_BAD_PARAMETERS 0xFFFF0006
+#define TEEC_ERROR_COMMUNICATION 0xFFFF000E
+#define TEEC_ERROR_OUT_OF_MEMORY 0xFFFF000C
+
+#define TEEC_ORIGIN_COMMS 0x00000002
+
+typedef void (optee_invoke_fn)(unsigned long, unsigned long, unsigned long,
+ unsigned long, unsigned long, unsigned long,
+ unsigned long, unsigned long,
+ struct arm_smccc_res *);
+
+struct optee_call_queue {
+ /* Serializes access to this struct */
+ struct mutex mutex;
+ struct list_head waiters;
+};
+
+struct optee_wait_queue {
+ /* Serializes access to this struct */
+ struct mutex mu;
+ struct list_head db;
+};
+
+/**
+ * struct optee_supp - supplicant synchronization struct
+ * @ctx the context of current connected supplicant.
+ * if !NULL the supplicant device is available for use,
+ * else busy
+ * @mutex: held while accessing content of this struct
+ * @req_id: current request id if supplicant is doing synchronous
+ * communication, else -1
+ * @reqs: queued request not yet retrieved by supplicant
+ * @idr: IDR holding all requests currently being processed
+ * by supplicant
+ * @reqs_c: completion used by supplicant when waiting for a
+ * request to be queued.
+ */
+struct optee_supp {
+ /* Serializes access to this struct */
+ struct mutex mutex;
+ struct tee_context *ctx;
+
+ int req_id;
+ struct list_head reqs;
+ struct idr idr;
+ struct completion reqs_c;
+};
+
+/**
+ * struct optee - main service struct
+ * @supp_teedev: supplicant device
+ * @teedev: client device
+ * @invoke_fn: function to issue smc or hvc
+ * @call_queue: queue of threads waiting to call @invoke_fn
+ * @wait_queue: queue of threads from secure world waiting for a
+ * secure world sync object
+ * @supp: supplicant synchronization struct for RPC to supplicant
+ * @pool: shared memory pool
+ * @memremaped_shm virtual address of memory in shared memory pool
+ * @sec_caps: secure world capabilities defined by
+ * OPTEE_SMC_SEC_CAP_* in optee_smc.h
+ */
+struct optee {
+ struct tee_device *supp_teedev;
+ struct tee_device *teedev;
+ optee_invoke_fn *invoke_fn;
+ struct optee_call_queue call_queue;
+ struct optee_wait_queue wait_queue;
+ struct optee_supp supp;
+ struct tee_shm_pool *pool;
+ void *memremaped_shm;
+ u32 sec_caps;
+};
+
+struct optee_session {
+ struct list_head list_node;
+ u32 session_id;
+};
+
+struct optee_context_data {
+ /* Serializes access to this struct */
+ struct mutex mutex;
+ struct list_head sess_list;
+};
+
+struct optee_rpc_param {
+ u32 a0;
+ u32 a1;
+ u32 a2;
+ u32 a3;
+ u32 a4;
+ u32 a5;
+ u32 a6;
+ u32 a7;
+};
+
+/* Holds context that is preserved during one STD call */
+struct optee_call_ctx {
+ /* information about pages list used in last allocation */
+ void *pages_list;
+ size_t num_entries;
+};
+
+void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,
+ struct optee_call_ctx *call_ctx);
+void optee_rpc_finalize_call(struct optee_call_ctx *call_ctx);
+
+void optee_wait_queue_init(struct optee_wait_queue *wq);
+void optee_wait_queue_exit(struct optee_wait_queue *wq);
+
+u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
+ struct tee_param *param);
+
+int optee_supp_read(struct tee_context *ctx, void __user *buf, size_t len);
+int optee_supp_write(struct tee_context *ctx, void __user *buf, size_t len);
+void optee_supp_init(struct optee_supp *supp);
+void optee_supp_uninit(struct optee_supp *supp);
+void optee_supp_release(struct optee_supp *supp);
+
+int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params,
+ struct tee_param *param);
+int optee_supp_send(struct tee_context *ctx, u32 ret, u32 num_params,
+ struct tee_param *param);
+
+u32 optee_do_call_with_arg(struct tee_context *ctx, phys_addr_t parg);
+int optee_open_session(struct tee_context *ctx,
+ struct tee_ioctl_open_session_arg *arg,
+ struct tee_param *param);
+int optee_close_session(struct tee_context *ctx, u32 session);
+int optee_invoke_func(struct tee_context *ctx, struct tee_ioctl_invoke_arg *arg,
+ struct tee_param *param);
+int optee_cancel_req(struct tee_context *ctx, u32 cancel_id, u32 session);
+
+void optee_enable_shm_cache(struct optee *optee);
+void optee_disable_shm_cache(struct optee *optee);
+
+int optee_shm_register(struct tee_context *ctx, struct tee_shm *shm,
+ struct page **pages, size_t num_pages,
+ unsigned long start);
+int optee_shm_unregister(struct tee_context *ctx, struct tee_shm *shm);
+
+int optee_shm_register_supp(struct tee_context *ctx, struct tee_shm *shm,
+ struct page **pages, size_t num_pages,
+ unsigned long start);
+int optee_shm_unregister_supp(struct tee_context *ctx, struct tee_shm *shm);
+
+int optee_from_msg_param(struct tee_param *params, size_t num_params,
+ const struct optee_msg_param *msg_params);
+int optee_to_msg_param(struct optee_msg_param *msg_params, size_t num_params,
+ const struct tee_param *params);
+
+u64 *optee_allocate_pages_list(size_t num_entries);
+void optee_free_pages_list(void *array, size_t num_entries);
+void optee_fill_pages_list(u64 *dst, struct page **pages, int num_pages,
+ size_t page_offset);
+
+/*
+ * Small helpers
+ */
+
+static inline void *reg_pair_to_ptr(u32 reg0, u32 reg1)
+{
+ return (void *)(unsigned long)(((u64)reg0 << 32) | reg1);
+}
+
+static inline void reg_pair_from_64(u32 *reg0, u32 *reg1, u64 val)
+{
+ *reg0 = val >> 32;
+ *reg1 = val;
+}
+
+#endif /*OPTEE_PRIVATE_H*/
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/optee_smc.h b/src/kernel/linux/v4.19/drivers/tee/optee/optee_smc.h
new file mode 100644
index 0000000..bbf0cf0
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/optee_smc.h
@@ -0,0 +1,465 @@
+/*
+ * Copyright (c) 2015-2016, Linaro Limited
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef OPTEE_SMC_H
+#define OPTEE_SMC_H
+
+#include <linux/arm-smccc.h>
+#include <linux/bitops.h>
+
+#define OPTEE_SMC_STD_CALL_VAL(func_num) \
+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_STD_CALL, ARM_SMCCC_SMC_32, \
+ ARM_SMCCC_OWNER_TRUSTED_OS, (func_num))
+#define OPTEE_SMC_FAST_CALL_VAL(func_num) \
+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, \
+ ARM_SMCCC_OWNER_TRUSTED_OS, (func_num))
+
+/*
+ * Function specified by SMC Calling convention.
+ */
+#define OPTEE_SMC_FUNCID_CALLS_COUNT 0xFF00
+#define OPTEE_SMC_CALLS_COUNT \
+ ARM_SMCCC_CALL_VAL(OPTEE_SMC_FAST_CALL, SMCCC_SMC_32, \
+ SMCCC_OWNER_TRUSTED_OS_END, \
+ OPTEE_SMC_FUNCID_CALLS_COUNT)
+
+/*
+ * Normal cached memory (write-back), shareable for SMP systems and not
+ * shareable for UP systems.
+ */
+#define OPTEE_SMC_SHM_CACHED 1
+
+/*
+ * a0..a7 is used as register names in the descriptions below, on arm32
+ * that translates to r0..r7 and on arm64 to w0..w7. In both cases it's
+ * 32-bit registers.
+ */
+
+/*
+ * Function specified by SMC Calling convention
+ *
+ * Return one of the following UIDs if using API specified in this file
+ * without further extentions:
+ * 65cb6b93-af0c-4617-8ed6-644a8d1140f8
+ * see also OPTEE_SMC_UID_* in optee_msg.h
+ */
+#define OPTEE_SMC_FUNCID_CALLS_UID OPTEE_MSG_FUNCID_CALLS_UID
+#define OPTEE_SMC_CALLS_UID \
+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, \
+ ARM_SMCCC_OWNER_TRUSTED_OS_END, \
+ OPTEE_SMC_FUNCID_CALLS_UID)
+
+/*
+ * Function specified by SMC Calling convention
+ *
+ * Returns 2.0 if using API specified in this file without further extentions.
+ * see also OPTEE_MSG_REVISION_* in optee_msg.h
+ */
+#define OPTEE_SMC_FUNCID_CALLS_REVISION OPTEE_MSG_FUNCID_CALLS_REVISION
+#define OPTEE_SMC_CALLS_REVISION \
+ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, ARM_SMCCC_SMC_32, \
+ ARM_SMCCC_OWNER_TRUSTED_OS_END, \
+ OPTEE_SMC_FUNCID_CALLS_REVISION)
+
+struct optee_smc_calls_revision_result {
+ unsigned long major;
+ unsigned long minor;
+ unsigned long reserved0;
+ unsigned long reserved1;
+};
+
+/*
+ * Get UUID of Trusted OS.
+ *
+ * Used by non-secure world to figure out which Trusted OS is installed.
+ * Note that returned UUID is the UUID of the Trusted OS, not of the API.
+ *
+ * Returns UUID in a0-4 in the same way as OPTEE_SMC_CALLS_UID
+ * described above.
+ */
+#define OPTEE_SMC_FUNCID_GET_OS_UUID OPTEE_MSG_FUNCID_GET_OS_UUID
+#define OPTEE_SMC_CALL_GET_OS_UUID \
+ OPTEE_SMC_FAST_CALL_VAL(OPTEE_SMC_FUNCID_GET_OS_UUID)
+
+/*
+ * Get revision of Trusted OS.
+ *
+ * Used by non-secure world to figure out which version of the Trusted OS
+ * is installed. Note that the returned revision is the revision of the
+ * Trusted OS, not of the API.
+ *
+ * Returns revision in a0-1 in the same way as OPTEE_SMC_CALLS_REVISION
+ * described above. May optionally return a 32-bit build identifier in a2,
+ * with zero meaning unspecified.
+ */
+#define OPTEE_SMC_FUNCID_GET_OS_REVISION OPTEE_MSG_FUNCID_GET_OS_REVISION
+#define OPTEE_SMC_CALL_GET_OS_REVISION \
+ OPTEE_SMC_FAST_CALL_VAL(OPTEE_SMC_FUNCID_GET_OS_REVISION)
+
+struct optee_smc_call_get_os_revision_result {
+ unsigned long major;
+ unsigned long minor;
+ unsigned long build_id;
+ unsigned long reserved1;
+};
+
+/*
+ * Call with struct optee_msg_arg as argument
+ *
+ * Call register usage:
+ * a0 SMC Function ID, OPTEE_SMC*CALL_WITH_ARG
+ * a1 Upper 32bit of a 64bit physical pointer to a struct optee_msg_arg
+ * a2 Lower 32bit of a 64bit physical pointer to a struct optee_msg_arg
+ * a3 Cache settings, not used if physical pointer is in a predefined shared
+ * memory area else per OPTEE_SMC_SHM_*
+ * a4-6 Not used
+ * a7 Hypervisor Client ID register
+ *
+ * Normal return register usage:
+ * a0 Return value, OPTEE_SMC_RETURN_*
+ * a1-3 Not used
+ * a4-7 Preserved
+ *
+ * OPTEE_SMC_RETURN_ETHREAD_LIMIT return register usage:
+ * a0 Return value, OPTEE_SMC_RETURN_ETHREAD_LIMIT
+ * a1-3 Preserved
+ * a4-7 Preserved
+ *
+ * RPC return register usage:
+ * a0 Return value, OPTEE_SMC_RETURN_IS_RPC(val)
+ * a1-2 RPC parameters
+ * a3-7 Resume information, must be preserved
+ *
+ * Possible return values:
+ * OPTEE_SMC_RETURN_UNKNOWN_FUNCTION Trusted OS does not recognize this
+ * function.
+ * OPTEE_SMC_RETURN_OK Call completed, result updated in
+ * the previously supplied struct
+ * optee_msg_arg.
+ * OPTEE_SMC_RETURN_ETHREAD_LIMIT Number of Trusted OS threads exceeded,
+ * try again later.
+ * OPTEE_SMC_RETURN_EBADADDR Bad physcial pointer to struct
+ * optee_msg_arg.
+ * OPTEE_SMC_RETURN_EBADCMD Bad/unknown cmd in struct optee_msg_arg
+ * OPTEE_SMC_RETURN_IS_RPC() Call suspended by RPC call to normal
+ * world.
+ */
+#define OPTEE_SMC_FUNCID_CALL_WITH_ARG OPTEE_MSG_FUNCID_CALL_WITH_ARG
+#define OPTEE_SMC_CALL_WITH_ARG \
+ OPTEE_SMC_STD_CALL_VAL(OPTEE_SMC_FUNCID_CALL_WITH_ARG)
+
+/*
+ * Get Shared Memory Config
+ *
+ * Returns the Secure/Non-secure shared memory config.
+ *
+ * Call register usage:
+ * a0 SMC Function ID, OPTEE_SMC_GET_SHM_CONFIG
+ * a1-6 Not used
+ * a7 Hypervisor Client ID register
+ *
+ * Have config return register usage:
+ * a0 OPTEE_SMC_RETURN_OK
+ * a1 Physical address of start of SHM
+ * a2 Size of of SHM
+ * a3 Cache settings of memory, as defined by the
+ * OPTEE_SMC_SHM_* values above
+ * a4-7 Preserved
+ *
+ * Not available register usage:
+ * a0 OPTEE_SMC_RETURN_ENOTAVAIL
+ * a1-3 Not used
+ * a4-7 Preserved
+ */
+#define OPTEE_SMC_FUNCID_GET_SHM_CONFIG 7
+#define OPTEE_SMC_GET_SHM_CONFIG \
+ OPTEE_SMC_FAST_CALL_VAL(OPTEE_SMC_FUNCID_GET_SHM_CONFIG)
+
+struct optee_smc_get_shm_config_result {
+ unsigned long status;
+ unsigned long start;
+ unsigned long size;
+ unsigned long settings;
+};
+
+/*
+ * Exchanges capabilities between normal world and secure world
+ *
+ * Call register usage:
+ * a0 SMC Function ID, OPTEE_SMC_EXCHANGE_CAPABILITIES
+ * a1 bitfield of normal world capabilities OPTEE_SMC_NSEC_CAP_*
+ * a2-6 Not used
+ * a7 Hypervisor Client ID register
+ *
+ * Normal return register usage:
+ * a0 OPTEE_SMC_RETURN_OK
+ * a1 bitfield of secure world capabilities OPTEE_SMC_SEC_CAP_*
+ * a2-7 Preserved
+ *
+ * Error return register usage:
+ * a0 OPTEE_SMC_RETURN_ENOTAVAIL, can't use the capabilities from normal world
+ * a1 bitfield of secure world capabilities OPTEE_SMC_SEC_CAP_*
+ * a2-7 Preserved
+ */
+/* Normal world works as a uniprocessor system */
+#define OPTEE_SMC_NSEC_CAP_UNIPROCESSOR BIT(0)
+/* Secure world has reserved shared memory for normal world to use */
+#define OPTEE_SMC_SEC_CAP_HAVE_RESERVED_SHM BIT(0)
+/* Secure world can communicate via previously unregistered shared memory */
+#define OPTEE_SMC_SEC_CAP_UNREGISTERED_SHM BIT(1)
+
+/*
+ * Secure world supports commands "register/unregister shared memory",
+ * secure world accepts command buffers located in any parts of non-secure RAM
+ */
+#define OPTEE_SMC_SEC_CAP_DYNAMIC_SHM BIT(2)
+
+#define OPTEE_SMC_FUNCID_EXCHANGE_CAPABILITIES 9
+#define OPTEE_SMC_EXCHANGE_CAPABILITIES \
+ OPTEE_SMC_FAST_CALL_VAL(OPTEE_SMC_FUNCID_EXCHANGE_CAPABILITIES)
+
+struct optee_smc_exchange_capabilities_result {
+ unsigned long status;
+ unsigned long capabilities;
+ unsigned long reserved0;
+ unsigned long reserved1;
+};
+
+/*
+ * Disable and empties cache of shared memory objects
+ *
+ * Secure world can cache frequently used shared memory objects, for
+ * example objects used as RPC arguments. When secure world is idle this
+ * function returns one shared memory reference to free. To disable the
+ * cache and free all cached objects this function has to be called until
+ * it returns OPTEE_SMC_RETURN_ENOTAVAIL.
+ *
+ * Call register usage:
+ * a0 SMC Function ID, OPTEE_SMC_DISABLE_SHM_CACHE
+ * a1-6 Not used
+ * a7 Hypervisor Client ID register
+ *
+ * Normal return register usage:
+ * a0 OPTEE_SMC_RETURN_OK
+ * a1 Upper 32bit of a 64bit Shared memory cookie
+ * a2 Lower 32bit of a 64bit Shared memory cookie
+ * a3-7 Preserved
+ *
+ * Cache empty return register usage:
+ * a0 OPTEE_SMC_RETURN_ENOTAVAIL
+ * a1-7 Preserved
+ *
+ * Not idle return register usage:
+ * a0 OPTEE_SMC_RETURN_EBUSY
+ * a1-7 Preserved
+ */
+#define OPTEE_SMC_FUNCID_DISABLE_SHM_CACHE 10
+#define OPTEE_SMC_DISABLE_SHM_CACHE \
+ OPTEE_SMC_FAST_CALL_VAL(OPTEE_SMC_FUNCID_DISABLE_SHM_CACHE)
+
+struct optee_smc_disable_shm_cache_result {
+ unsigned long status;
+ unsigned long shm_upper32;
+ unsigned long shm_lower32;
+ unsigned long reserved0;
+};
+
+/*
+ * Enable cache of shared memory objects
+ *
+ * Secure world can cache frequently used shared memory objects, for
+ * example objects used as RPC arguments. When secure world is idle this
+ * function returns OPTEE_SMC_RETURN_OK and the cache is enabled. If
+ * secure world isn't idle OPTEE_SMC_RETURN_EBUSY is returned.
+ *
+ * Call register usage:
+ * a0 SMC Function ID, OPTEE_SMC_ENABLE_SHM_CACHE
+ * a1-6 Not used
+ * a7 Hypervisor Client ID register
+ *
+ * Normal return register usage:
+ * a0 OPTEE_SMC_RETURN_OK
+ * a1-7 Preserved
+ *
+ * Not idle return register usage:
+ * a0 OPTEE_SMC_RETURN_EBUSY
+ * a1-7 Preserved
+ */
+#define OPTEE_SMC_FUNCID_ENABLE_SHM_CACHE 11
+#define OPTEE_SMC_ENABLE_SHM_CACHE \
+ OPTEE_SMC_FAST_CALL_VAL(OPTEE_SMC_FUNCID_ENABLE_SHM_CACHE)
+
+/*
+ * Resume from RPC (for example after processing a foreign interrupt)
+ *
+ * Call register usage:
+ * a0 SMC Function ID, OPTEE_SMC_CALL_RETURN_FROM_RPC
+ * a1-3 Value of a1-3 when OPTEE_SMC_CALL_WITH_ARG returned
+ * OPTEE_SMC_RETURN_RPC in a0
+ *
+ * Return register usage is the same as for OPTEE_SMC_*CALL_WITH_ARG above.
+ *
+ * Possible return values
+ * OPTEE_SMC_RETURN_UNKNOWN_FUNCTION Trusted OS does not recognize this
+ * function.
+ * OPTEE_SMC_RETURN_OK Original call completed, result
+ * updated in the previously supplied.
+ * struct optee_msg_arg
+ * OPTEE_SMC_RETURN_RPC Call suspended by RPC call to normal
+ * world.
+ * OPTEE_SMC_RETURN_ERESUME Resume failed, the opaque resume
+ * information was corrupt.
+ */
+#define OPTEE_SMC_FUNCID_RETURN_FROM_RPC 3
+#define OPTEE_SMC_CALL_RETURN_FROM_RPC \
+ OPTEE_SMC_STD_CALL_VAL(OPTEE_SMC_FUNCID_RETURN_FROM_RPC)
+
+#define OPTEE_SMC_RETURN_RPC_PREFIX_MASK 0xFFFF0000
+#define OPTEE_SMC_RETURN_RPC_PREFIX 0xFFFF0000
+#define OPTEE_SMC_RETURN_RPC_FUNC_MASK 0x0000FFFF
+
+#define OPTEE_SMC_RETURN_GET_RPC_FUNC(ret) \
+ ((ret) & OPTEE_SMC_RETURN_RPC_FUNC_MASK)
+
+#define OPTEE_SMC_RPC_VAL(func) ((func) | OPTEE_SMC_RETURN_RPC_PREFIX)
+
+/*
+ * Allocate memory for RPC parameter passing. The memory is used to hold a
+ * struct optee_msg_arg.
+ *
+ * "Call" register usage:
+ * a0 This value, OPTEE_SMC_RETURN_RPC_ALLOC
+ * a1 Size in bytes of required argument memory
+ * a2 Not used
+ * a3 Resume information, must be preserved
+ * a4-5 Not used
+ * a6-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * a0 SMC Function ID, OPTEE_SMC_CALL_RETURN_FROM_RPC.
+ * a1 Upper 32bits of 64bit physical pointer to allocated
+ * memory, (a1 == 0 && a2 == 0) if size was 0 or if memory can't
+ * be allocated.
+ * a2 Lower 32bits of 64bit physical pointer to allocated
+ * memory, (a1 == 0 && a2 == 0) if size was 0 or if memory can't
+ * be allocated
+ * a3 Preserved
+ * a4 Upper 32bits of 64bit Shared memory cookie used when freeing
+ * the memory or doing an RPC
+ * a5 Lower 32bits of 64bit Shared memory cookie used when freeing
+ * the memory or doing an RPC
+ * a6-7 Preserved
+ */
+#define OPTEE_SMC_RPC_FUNC_ALLOC 0
+#define OPTEE_SMC_RETURN_RPC_ALLOC \
+ OPTEE_SMC_RPC_VAL(OPTEE_SMC_RPC_FUNC_ALLOC)
+
+/*
+ * Free memory previously allocated by OPTEE_SMC_RETURN_RPC_ALLOC
+ *
+ * "Call" register usage:
+ * a0 This value, OPTEE_SMC_RETURN_RPC_FREE
+ * a1 Upper 32bits of 64bit shared memory cookie belonging to this
+ * argument memory
+ * a2 Lower 32bits of 64bit shared memory cookie belonging to this
+ * argument memory
+ * a3-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * a0 SMC Function ID, OPTEE_SMC_CALL_RETURN_FROM_RPC.
+ * a1-2 Not used
+ * a3-7 Preserved
+ */
+#define OPTEE_SMC_RPC_FUNC_FREE 2
+#define OPTEE_SMC_RETURN_RPC_FREE \
+ OPTEE_SMC_RPC_VAL(OPTEE_SMC_RPC_FUNC_FREE)
+
+/*
+ * Deliver foreign interrupt to normal world.
+ *
+ * "Call" register usage:
+ * a0 OPTEE_SMC_RETURN_RPC_FOREIGN_INTR
+ * a1-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * a0 SMC Function ID, OPTEE_SMC_CALL_RETURN_FROM_RPC.
+ * a1-7 Preserved
+ */
+#define OPTEE_SMC_RPC_FUNC_FOREIGN_INTR 4
+#define OPTEE_SMC_RETURN_RPC_FOREIGN_INTR \
+ OPTEE_SMC_RPC_VAL(OPTEE_SMC_RPC_FUNC_FOREIGN_INTR)
+
+/*
+ * Do an RPC request. The supplied struct optee_msg_arg tells which
+ * request to do and the parameters for the request. The following fields
+ * are used (the rest are unused):
+ * - cmd the Request ID
+ * - ret return value of the request, filled in by normal world
+ * - num_params number of parameters for the request
+ * - params the parameters
+ * - param_attrs attributes of the parameters
+ *
+ * "Call" register usage:
+ * a0 OPTEE_SMC_RETURN_RPC_CMD
+ * a1 Upper 32bit of a 64bit Shared memory cookie holding a
+ * struct optee_msg_arg, must be preserved, only the data should
+ * be updated
+ * a2 Lower 32bit of a 64bit Shared memory cookie holding a
+ * struct optee_msg_arg, must be preserved, only the data should
+ * be updated
+ * a3-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * a0 SMC Function ID, OPTEE_SMC_CALL_RETURN_FROM_RPC.
+ * a1-2 Not used
+ * a3-7 Preserved
+ */
+#define OPTEE_SMC_RPC_FUNC_CMD 5
+#define OPTEE_SMC_RETURN_RPC_CMD \
+ OPTEE_SMC_RPC_VAL(OPTEE_SMC_RPC_FUNC_CMD)
+
+/* Returned in a0 */
+#define OPTEE_SMC_RETURN_UNKNOWN_FUNCTION 0xFFFFFFFF
+
+/* Returned in a0 only from Trusted OS functions */
+#define OPTEE_SMC_RETURN_OK 0x0
+#define OPTEE_SMC_RETURN_ETHREAD_LIMIT 0x1
+#define OPTEE_SMC_RETURN_EBUSY 0x2
+#define OPTEE_SMC_RETURN_ERESUME 0x3
+#define OPTEE_SMC_RETURN_EBADADDR 0x4
+#define OPTEE_SMC_RETURN_EBADCMD 0x5
+#define OPTEE_SMC_RETURN_ENOMEM 0x6
+#define OPTEE_SMC_RETURN_ENOTAVAIL 0x7
+#define OPTEE_SMC_RETURN_IS_RPC(ret) __optee_smc_return_is_rpc((ret))
+
+static inline bool __optee_smc_return_is_rpc(u32 ret)
+{
+ return ret != OPTEE_SMC_RETURN_UNKNOWN_FUNCTION &&
+ (ret & OPTEE_SMC_RETURN_RPC_PREFIX_MASK) ==
+ OPTEE_SMC_RETURN_RPC_PREFIX;
+}
+
+#endif /* OPTEE_SMC_H */
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/rpc.c b/src/kernel/linux/v4.19/drivers/tee/optee/rpc.c
new file mode 100644
index 0000000..b45c73d
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/rpc.c
@@ -0,0 +1,452 @@
+/*
+ * Copyright (c) 2015-2016, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/delay.h>
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/tee_drv.h>
+#include "optee_private.h"
+#include "optee_smc.h"
+
+struct wq_entry {
+ struct list_head link;
+ struct completion c;
+ u32 key;
+};
+
+void optee_wait_queue_init(struct optee_wait_queue *priv)
+{
+ mutex_init(&priv->mu);
+ INIT_LIST_HEAD(&priv->db);
+}
+
+void optee_wait_queue_exit(struct optee_wait_queue *priv)
+{
+ mutex_destroy(&priv->mu);
+}
+
+static void handle_rpc_func_cmd_get_time(struct optee_msg_arg *arg)
+{
+ struct timespec64 ts;
+
+ if (arg->num_params != 1)
+ goto bad;
+ if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) !=
+ OPTEE_MSG_ATTR_TYPE_VALUE_OUTPUT)
+ goto bad;
+
+ ktime_get_real_ts64(&ts);
+ arg->params[0].u.value.a = ts.tv_sec;
+ arg->params[0].u.value.b = ts.tv_nsec;
+
+ arg->ret = TEEC_SUCCESS;
+ return;
+bad:
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+}
+
+static struct wq_entry *wq_entry_get(struct optee_wait_queue *wq, u32 key)
+{
+ struct wq_entry *w;
+
+ mutex_lock(&wq->mu);
+
+ list_for_each_entry(w, &wq->db, link)
+ if (w->key == key)
+ goto out;
+
+ w = kmalloc(sizeof(*w), GFP_KERNEL);
+ if (w) {
+ init_completion(&w->c);
+ w->key = key;
+ list_add_tail(&w->link, &wq->db);
+ }
+out:
+ mutex_unlock(&wq->mu);
+ return w;
+}
+
+static void wq_sleep(struct optee_wait_queue *wq, u32 key)
+{
+ struct wq_entry *w = wq_entry_get(wq, key);
+
+ if (w) {
+ wait_for_completion(&w->c);
+ mutex_lock(&wq->mu);
+ list_del(&w->link);
+ mutex_unlock(&wq->mu);
+ kfree(w);
+ }
+}
+
+static void wq_wakeup(struct optee_wait_queue *wq, u32 key)
+{
+ struct wq_entry *w = wq_entry_get(wq, key);
+
+ if (w)
+ complete(&w->c);
+}
+
+static void handle_rpc_func_cmd_wq(struct optee *optee,
+ struct optee_msg_arg *arg)
+{
+ if (arg->num_params != 1)
+ goto bad;
+
+ if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) !=
+ OPTEE_MSG_ATTR_TYPE_VALUE_INPUT)
+ goto bad;
+
+ switch (arg->params[0].u.value.a) {
+ case OPTEE_MSG_RPC_WAIT_QUEUE_SLEEP:
+ wq_sleep(&optee->wait_queue, arg->params[0].u.value.b);
+ break;
+ case OPTEE_MSG_RPC_WAIT_QUEUE_WAKEUP:
+ wq_wakeup(&optee->wait_queue, arg->params[0].u.value.b);
+ break;
+ default:
+ goto bad;
+ }
+
+ arg->ret = TEEC_SUCCESS;
+ return;
+bad:
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+}
+
+static void handle_rpc_func_cmd_wait(struct optee_msg_arg *arg)
+{
+ u32 msec_to_wait;
+
+ if (arg->num_params != 1)
+ goto bad;
+
+ if ((arg->params[0].attr & OPTEE_MSG_ATTR_TYPE_MASK) !=
+ OPTEE_MSG_ATTR_TYPE_VALUE_INPUT)
+ goto bad;
+
+ msec_to_wait = arg->params[0].u.value.a;
+
+ /* Go to interruptible sleep */
+ msleep_interruptible(msec_to_wait);
+
+ arg->ret = TEEC_SUCCESS;
+ return;
+bad:
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+}
+
+static void handle_rpc_supp_cmd(struct tee_context *ctx,
+ struct optee_msg_arg *arg)
+{
+ struct tee_param *params;
+
+ arg->ret_origin = TEEC_ORIGIN_COMMS;
+
+ params = kmalloc_array(arg->num_params, sizeof(struct tee_param),
+ GFP_KERNEL);
+ if (!params) {
+ arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
+ return;
+ }
+
+ if (optee_from_msg_param(params, arg->num_params, arg->params)) {
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ goto out;
+ }
+
+ arg->ret = optee_supp_thrd_req(ctx, arg->cmd, arg->num_params, params);
+
+ if (optee_to_msg_param(arg->params, arg->num_params, params))
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+out:
+ kfree(params);
+}
+
+static struct tee_shm *cmd_alloc_suppl(struct tee_context *ctx, size_t sz)
+{
+ u32 ret;
+ struct tee_param param;
+ struct optee *optee = tee_get_drvdata(ctx->teedev);
+ struct tee_shm *shm;
+
+ param.attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT;
+ param.u.value.a = OPTEE_MSG_RPC_SHM_TYPE_APPL;
+ param.u.value.b = sz;
+ param.u.value.c = 0;
+
+ ret = optee_supp_thrd_req(ctx, OPTEE_MSG_RPC_CMD_SHM_ALLOC, 1, ¶m);
+ if (ret)
+ return ERR_PTR(-ENOMEM);
+
+ mutex_lock(&optee->supp.mutex);
+ /* Increases count as secure world doesn't have a reference */
+ shm = tee_shm_get_from_id(optee->supp.ctx, param.u.value.c);
+ mutex_unlock(&optee->supp.mutex);
+ return shm;
+}
+
+static void handle_rpc_func_cmd_shm_alloc(struct tee_context *ctx,
+ struct optee_msg_arg *arg,
+ struct optee_call_ctx *call_ctx)
+{
+ phys_addr_t pa;
+ struct tee_shm *shm;
+ size_t sz;
+ size_t n;
+
+ arg->ret_origin = TEEC_ORIGIN_COMMS;
+
+ if (!arg->num_params ||
+ arg->params[0].attr != OPTEE_MSG_ATTR_TYPE_VALUE_INPUT) {
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ return;
+ }
+
+ for (n = 1; n < arg->num_params; n++) {
+ if (arg->params[n].attr != OPTEE_MSG_ATTR_TYPE_NONE) {
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ return;
+ }
+ }
+
+ sz = arg->params[0].u.value.b;
+ switch (arg->params[0].u.value.a) {
+ case OPTEE_MSG_RPC_SHM_TYPE_APPL:
+ shm = cmd_alloc_suppl(ctx, sz);
+ break;
+ case OPTEE_MSG_RPC_SHM_TYPE_KERNEL:
+ shm = tee_shm_alloc(ctx, sz, TEE_SHM_MAPPED);
+ break;
+ default:
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ return;
+ }
+
+ if (IS_ERR(shm)) {
+ arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
+ return;
+ }
+
+ if (tee_shm_get_pa(shm, 0, &pa)) {
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ goto bad;
+ }
+
+ sz = tee_shm_get_size(shm);
+
+ if (tee_shm_is_registered(shm)) {
+ struct page **pages;
+ u64 *pages_list;
+ size_t page_num;
+
+ pages = tee_shm_get_pages(shm, &page_num);
+ if (!pages || !page_num) {
+ arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
+ goto bad;
+ }
+
+ pages_list = optee_allocate_pages_list(page_num);
+ if (!pages_list) {
+ arg->ret = TEEC_ERROR_OUT_OF_MEMORY;
+ goto bad;
+ }
+
+ call_ctx->pages_list = pages_list;
+ call_ctx->num_entries = page_num;
+
+ arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT |
+ OPTEE_MSG_ATTR_NONCONTIG;
+ /*
+ * In the least bits of u.tmem.buf_ptr we store buffer offset
+ * from 4k page, as described in OP-TEE ABI.
+ */
+ arg->params[0].u.tmem.buf_ptr = virt_to_phys(pages_list) |
+ (tee_shm_get_page_offset(shm) &
+ (OPTEE_MSG_NONCONTIG_PAGE_SIZE - 1));
+ arg->params[0].u.tmem.size = tee_shm_get_size(shm);
+ arg->params[0].u.tmem.shm_ref = (unsigned long)shm;
+
+ optee_fill_pages_list(pages_list, pages, page_num,
+ tee_shm_get_page_offset(shm));
+ } else {
+ arg->params[0].attr = OPTEE_MSG_ATTR_TYPE_TMEM_OUTPUT;
+ arg->params[0].u.tmem.buf_ptr = pa;
+ arg->params[0].u.tmem.size = sz;
+ arg->params[0].u.tmem.shm_ref = (unsigned long)shm;
+ }
+
+ arg->ret = TEEC_SUCCESS;
+ return;
+bad:
+ tee_shm_free(shm);
+}
+
+static void cmd_free_suppl(struct tee_context *ctx, struct tee_shm *shm)
+{
+ struct tee_param param;
+
+ param.attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT;
+ param.u.value.a = OPTEE_MSG_RPC_SHM_TYPE_APPL;
+ param.u.value.b = tee_shm_get_id(shm);
+ param.u.value.c = 0;
+
+ /*
+ * Match the tee_shm_get_from_id() in cmd_alloc_suppl() as secure
+ * world has released its reference.
+ *
+ * It's better to do this before sending the request to supplicant
+ * as we'd like to let the process doing the initial allocation to
+ * do release the last reference too in order to avoid stacking
+ * many pending fput() on the client process. This could otherwise
+ * happen if secure world does many allocate and free in a single
+ * invoke.
+ */
+ tee_shm_put(shm);
+
+ optee_supp_thrd_req(ctx, OPTEE_MSG_RPC_CMD_SHM_FREE, 1, ¶m);
+}
+
+static void handle_rpc_func_cmd_shm_free(struct tee_context *ctx,
+ struct optee_msg_arg *arg)
+{
+ struct tee_shm *shm;
+
+ arg->ret_origin = TEEC_ORIGIN_COMMS;
+
+ if (arg->num_params != 1 ||
+ arg->params[0].attr != OPTEE_MSG_ATTR_TYPE_VALUE_INPUT) {
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ return;
+ }
+
+ shm = (struct tee_shm *)(unsigned long)arg->params[0].u.value.b;
+ switch (arg->params[0].u.value.a) {
+ case OPTEE_MSG_RPC_SHM_TYPE_APPL:
+ cmd_free_suppl(ctx, shm);
+ break;
+ case OPTEE_MSG_RPC_SHM_TYPE_KERNEL:
+ tee_shm_free(shm);
+ break;
+ default:
+ arg->ret = TEEC_ERROR_BAD_PARAMETERS;
+ }
+ arg->ret = TEEC_SUCCESS;
+}
+
+static void free_pages_list(struct optee_call_ctx *call_ctx)
+{
+ if (call_ctx->pages_list) {
+ optee_free_pages_list(call_ctx->pages_list,
+ call_ctx->num_entries);
+ call_ctx->pages_list = NULL;
+ call_ctx->num_entries = 0;
+ }
+}
+
+void optee_rpc_finalize_call(struct optee_call_ctx *call_ctx)
+{
+ free_pages_list(call_ctx);
+}
+
+static void handle_rpc_func_cmd(struct tee_context *ctx, struct optee *optee,
+ struct tee_shm *shm,
+ struct optee_call_ctx *call_ctx)
+{
+ struct optee_msg_arg *arg;
+
+ arg = tee_shm_get_va(shm, 0);
+ if (IS_ERR(arg)) {
+ pr_err("%s: tee_shm_get_va %p failed\n", __func__, shm);
+ return;
+ }
+
+ switch (arg->cmd) {
+ case OPTEE_MSG_RPC_CMD_GET_TIME:
+ handle_rpc_func_cmd_get_time(arg);
+ break;
+ case OPTEE_MSG_RPC_CMD_WAIT_QUEUE:
+ handle_rpc_func_cmd_wq(optee, arg);
+ break;
+ case OPTEE_MSG_RPC_CMD_SUSPEND:
+ handle_rpc_func_cmd_wait(arg);
+ break;
+ case OPTEE_MSG_RPC_CMD_SHM_ALLOC:
+ free_pages_list(call_ctx);
+ handle_rpc_func_cmd_shm_alloc(ctx, arg, call_ctx);
+ break;
+ case OPTEE_MSG_RPC_CMD_SHM_FREE:
+ handle_rpc_func_cmd_shm_free(ctx, arg);
+ break;
+ default:
+ handle_rpc_supp_cmd(ctx, arg);
+ }
+}
+
+/**
+ * optee_handle_rpc() - handle RPC from secure world
+ * @ctx: context doing the RPC
+ * @param: value of registers for the RPC
+ * @call_ctx: call context. Preserved during one OP-TEE invocation
+ *
+ * Result of RPC is written back into @param.
+ */
+void optee_handle_rpc(struct tee_context *ctx, struct optee_rpc_param *param,
+ struct optee_call_ctx *call_ctx)
+{
+ struct tee_device *teedev = ctx->teedev;
+ struct optee *optee = tee_get_drvdata(teedev);
+ struct tee_shm *shm;
+ phys_addr_t pa;
+
+ switch (OPTEE_SMC_RETURN_GET_RPC_FUNC(param->a0)) {
+ case OPTEE_SMC_RPC_FUNC_ALLOC:
+ shm = tee_shm_alloc(ctx, param->a1, TEE_SHM_MAPPED);
+ if (!IS_ERR(shm) && !tee_shm_get_pa(shm, 0, &pa)) {
+ reg_pair_from_64(¶m->a1, ¶m->a2, pa);
+ reg_pair_from_64(¶m->a4, ¶m->a5,
+ (unsigned long)shm);
+ } else {
+ param->a1 = 0;
+ param->a2 = 0;
+ param->a4 = 0;
+ param->a5 = 0;
+ }
+ break;
+ case OPTEE_SMC_RPC_FUNC_FREE:
+ shm = reg_pair_to_ptr(param->a1, param->a2);
+ tee_shm_free(shm);
+ break;
+ case OPTEE_SMC_RPC_FUNC_FOREIGN_INTR:
+ /*
+ * A foreign interrupt was raised while secure world was
+ * executing, since they are handled in Linux a dummy RPC is
+ * performed to let Linux take the interrupt through the normal
+ * vector.
+ */
+ break;
+ case OPTEE_SMC_RPC_FUNC_CMD:
+ shm = reg_pair_to_ptr(param->a1, param->a2);
+ handle_rpc_func_cmd(ctx, optee, shm, call_ctx);
+ break;
+ default:
+ pr_warn("Unknown RPC func 0x%x\n",
+ (u32)OPTEE_SMC_RETURN_GET_RPC_FUNC(param->a0));
+ break;
+ }
+
+ param->a0 = OPTEE_SMC_CALL_RETURN_FROM_RPC;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/shm_pool.c b/src/kernel/linux/v4.19/drivers/tee/optee/shm_pool.c
new file mode 100644
index 0000000..4939781
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/shm_pool.c
@@ -0,0 +1,75 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ * Copyright (c) 2017, EPAM Systems
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/device.h>
+#include <linux/dma-buf.h>
+#include <linux/genalloc.h>
+#include <linux/slab.h>
+#include <linux/tee_drv.h>
+#include "optee_private.h"
+#include "optee_smc.h"
+#include "shm_pool.h"
+
+static int pool_op_alloc(struct tee_shm_pool_mgr *poolm,
+ struct tee_shm *shm, size_t size)
+{
+ unsigned int order = get_order(size);
+ struct page *page;
+
+ page = alloc_pages(GFP_KERNEL | __GFP_ZERO, order);
+ if (!page)
+ return -ENOMEM;
+
+ shm->kaddr = page_address(page);
+ shm->paddr = page_to_phys(page);
+ shm->size = PAGE_SIZE << order;
+
+ return 0;
+}
+
+static void pool_op_free(struct tee_shm_pool_mgr *poolm,
+ struct tee_shm *shm)
+{
+ free_pages((unsigned long)shm->kaddr, get_order(shm->size));
+ shm->kaddr = NULL;
+}
+
+static void pool_op_destroy_poolmgr(struct tee_shm_pool_mgr *poolm)
+{
+ kfree(poolm);
+}
+
+static const struct tee_shm_pool_mgr_ops pool_ops = {
+ .alloc = pool_op_alloc,
+ .free = pool_op_free,
+ .destroy_poolmgr = pool_op_destroy_poolmgr,
+};
+
+/**
+ * optee_shm_pool_alloc_pages() - create page-based allocator pool
+ *
+ * This pool is used when OP-TEE supports dymanic SHM. In this case
+ * command buffers and such are allocated from kernel's own memory.
+ */
+struct tee_shm_pool_mgr *optee_shm_pool_alloc_pages(void)
+{
+ struct tee_shm_pool_mgr *mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
+
+ if (!mgr)
+ return ERR_PTR(-ENOMEM);
+
+ mgr->ops = &pool_ops;
+
+ return mgr;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/shm_pool.h b/src/kernel/linux/v4.19/drivers/tee/optee/shm_pool.h
new file mode 100644
index 0000000..4e753c3
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/shm_pool.h
@@ -0,0 +1,23 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ * Copyright (c) 2016, EPAM Systems
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#ifndef SHM_POOL_H
+#define SHM_POOL_H
+
+#include <linux/tee_drv.h>
+
+struct tee_shm_pool_mgr *optee_shm_pool_alloc_pages(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/optee/supp.c b/src/kernel/linux/v4.19/drivers/tee/optee/supp.c
new file mode 100644
index 0000000..43626e1
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/optee/supp.c
@@ -0,0 +1,383 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/device.h>
+#include <linux/slab.h>
+#include <linux/uaccess.h>
+#include "optee_private.h"
+
+struct optee_supp_req {
+ struct list_head link;
+
+ bool in_queue;
+ u32 func;
+ u32 ret;
+ size_t num_params;
+ struct tee_param *param;
+
+ struct completion c;
+};
+
+void optee_supp_init(struct optee_supp *supp)
+{
+ memset(supp, 0, sizeof(*supp));
+ mutex_init(&supp->mutex);
+ init_completion(&supp->reqs_c);
+ idr_init(&supp->idr);
+ INIT_LIST_HEAD(&supp->reqs);
+ supp->req_id = -1;
+}
+
+void optee_supp_uninit(struct optee_supp *supp)
+{
+ mutex_destroy(&supp->mutex);
+ idr_destroy(&supp->idr);
+}
+
+void optee_supp_release(struct optee_supp *supp)
+{
+ int id;
+ struct optee_supp_req *req;
+ struct optee_supp_req *req_tmp;
+
+ mutex_lock(&supp->mutex);
+
+ /* Abort all request retrieved by supplicant */
+ idr_for_each_entry(&supp->idr, req, id) {
+ idr_remove(&supp->idr, id);
+ req->ret = TEEC_ERROR_COMMUNICATION;
+ complete(&req->c);
+ }
+
+ /* Abort all queued requests */
+ list_for_each_entry_safe(req, req_tmp, &supp->reqs, link) {
+ list_del(&req->link);
+ req->in_queue = false;
+ req->ret = TEEC_ERROR_COMMUNICATION;
+ complete(&req->c);
+ }
+
+ supp->ctx = NULL;
+ supp->req_id = -1;
+
+ mutex_unlock(&supp->mutex);
+}
+
+/**
+ * optee_supp_thrd_req() - request service from supplicant
+ * @ctx: context doing the request
+ * @func: function requested
+ * @num_params: number of elements in @param array
+ * @param: parameters for function
+ *
+ * Returns result of operation to be passed to secure world
+ */
+u32 optee_supp_thrd_req(struct tee_context *ctx, u32 func, size_t num_params,
+ struct tee_param *param)
+
+{
+ struct optee *optee = tee_get_drvdata(ctx->teedev);
+ struct optee_supp *supp = &optee->supp;
+ struct optee_supp_req *req = kzalloc(sizeof(*req), GFP_KERNEL);
+ bool interruptable;
+ u32 ret;
+
+ if (!req)
+ return TEEC_ERROR_OUT_OF_MEMORY;
+
+ init_completion(&req->c);
+ req->func = func;
+ req->num_params = num_params;
+ req->param = param;
+
+ /* Insert the request in the request list */
+ mutex_lock(&supp->mutex);
+ list_add_tail(&req->link, &supp->reqs);
+ req->in_queue = true;
+ mutex_unlock(&supp->mutex);
+
+ /* Tell an eventual waiter there's a new request */
+ complete(&supp->reqs_c);
+
+ /*
+ * Wait for supplicant to process and return result, once we've
+ * returned from wait_for_completion(&req->c) successfully we have
+ * exclusive access again.
+ */
+ while (wait_for_completion_interruptible(&req->c)) {
+ mutex_lock(&supp->mutex);
+ interruptable = !supp->ctx;
+ if (interruptable) {
+ /*
+ * There's no supplicant available and since the
+ * supp->mutex currently is held none can
+ * become available until the mutex released
+ * again.
+ *
+ * Interrupting an RPC to supplicant is only
+ * allowed as a way of slightly improving the user
+ * experience in case the supplicant hasn't been
+ * started yet. During normal operation the supplicant
+ * will serve all requests in a timely manner and
+ * interrupting then wouldn't make sense.
+ */
+ if (req->in_queue) {
+ list_del(&req->link);
+ req->in_queue = false;
+ }
+ }
+ mutex_unlock(&supp->mutex);
+
+ if (interruptable) {
+ req->ret = TEEC_ERROR_COMMUNICATION;
+ break;
+ }
+ }
+
+ ret = req->ret;
+ kfree(req);
+
+ return ret;
+}
+
+static struct optee_supp_req *supp_pop_entry(struct optee_supp *supp,
+ int num_params, int *id)
+{
+ struct optee_supp_req *req;
+
+ if (supp->req_id != -1) {
+ /*
+ * Supplicant should not mix synchronous and asnynchronous
+ * requests.
+ */
+ return ERR_PTR(-EINVAL);
+ }
+
+ if (list_empty(&supp->reqs))
+ return NULL;
+
+ req = list_first_entry(&supp->reqs, struct optee_supp_req, link);
+
+ if (num_params < req->num_params) {
+ /* Not enough room for parameters */
+ return ERR_PTR(-EINVAL);
+ }
+
+ *id = idr_alloc(&supp->idr, req, 1, 0, GFP_KERNEL);
+ if (*id < 0)
+ return ERR_PTR(-ENOMEM);
+
+ list_del(&req->link);
+ req->in_queue = false;
+
+ return req;
+}
+
+static int supp_check_recv_params(size_t num_params, struct tee_param *params,
+ size_t *num_meta)
+{
+ size_t n;
+
+ if (!num_params)
+ return -EINVAL;
+
+ /*
+ * If there's memrefs we need to decrease those as they where
+ * increased earlier and we'll even refuse to accept any below.
+ */
+ for (n = 0; n < num_params; n++)
+ if (tee_param_is_memref(params + n) && params[n].u.memref.shm)
+ tee_shm_put(params[n].u.memref.shm);
+
+ /*
+ * We only expect parameters as TEE_IOCTL_PARAM_ATTR_TYPE_NONE with
+ * or without the TEE_IOCTL_PARAM_ATTR_META bit set.
+ */
+ for (n = 0; n < num_params; n++)
+ if (params[n].attr &&
+ params[n].attr != TEE_IOCTL_PARAM_ATTR_META)
+ return -EINVAL;
+
+ /* At most we'll need one meta parameter so no need to check for more */
+ if (params->attr == TEE_IOCTL_PARAM_ATTR_META)
+ *num_meta = 1;
+ else
+ *num_meta = 0;
+
+ return 0;
+}
+
+/**
+ * optee_supp_recv() - receive request for supplicant
+ * @ctx: context receiving the request
+ * @func: requested function in supplicant
+ * @num_params: number of elements allocated in @param, updated with number
+ * used elements
+ * @param: space for parameters for @func
+ *
+ * Returns 0 on success or <0 on failure
+ */
+int optee_supp_recv(struct tee_context *ctx, u32 *func, u32 *num_params,
+ struct tee_param *param)
+{
+ struct tee_device *teedev = ctx->teedev;
+ struct optee *optee = tee_get_drvdata(teedev);
+ struct optee_supp *supp = &optee->supp;
+ struct optee_supp_req *req = NULL;
+ int id;
+ size_t num_meta;
+ int rc;
+
+ rc = supp_check_recv_params(*num_params, param, &num_meta);
+ if (rc)
+ return rc;
+
+ while (true) {
+ mutex_lock(&supp->mutex);
+ req = supp_pop_entry(supp, *num_params - num_meta, &id);
+ mutex_unlock(&supp->mutex);
+
+ if (req) {
+ if (IS_ERR(req))
+ return PTR_ERR(req);
+ break;
+ }
+
+ /*
+ * If we didn't get a request we'll block in
+ * wait_for_completion() to avoid needless spinning.
+ *
+ * This is where supplicant will be hanging most of
+ * the time, let's make this interruptable so we
+ * can easily restart supplicant if needed.
+ */
+ if (wait_for_completion_interruptible(&supp->reqs_c))
+ return -ERESTARTSYS;
+ }
+
+ if (num_meta) {
+ /*
+ * tee-supplicant support meta parameters -> requsts can be
+ * processed asynchronously.
+ */
+ param->attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT |
+ TEE_IOCTL_PARAM_ATTR_META;
+ param->u.value.a = id;
+ param->u.value.b = 0;
+ param->u.value.c = 0;
+ } else {
+ mutex_lock(&supp->mutex);
+ supp->req_id = id;
+ mutex_unlock(&supp->mutex);
+ }
+
+ *func = req->func;
+ *num_params = req->num_params + num_meta;
+ memcpy(param + num_meta, req->param,
+ sizeof(struct tee_param) * req->num_params);
+
+ return 0;
+}
+
+static struct optee_supp_req *supp_pop_req(struct optee_supp *supp,
+ size_t num_params,
+ struct tee_param *param,
+ size_t *num_meta)
+{
+ struct optee_supp_req *req;
+ int id;
+ size_t nm;
+ const u32 attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT |
+ TEE_IOCTL_PARAM_ATTR_META;
+
+ if (!num_params)
+ return ERR_PTR(-EINVAL);
+
+ if (supp->req_id == -1) {
+ if (param->attr != attr)
+ return ERR_PTR(-EINVAL);
+ id = param->u.value.a;
+ nm = 1;
+ } else {
+ id = supp->req_id;
+ nm = 0;
+ }
+
+ req = idr_find(&supp->idr, id);
+ if (!req)
+ return ERR_PTR(-ENOENT);
+
+ if ((num_params - nm) != req->num_params)
+ return ERR_PTR(-EINVAL);
+
+ idr_remove(&supp->idr, id);
+ supp->req_id = -1;
+ *num_meta = nm;
+
+ return req;
+}
+
+/**
+ * optee_supp_send() - send result of request from supplicant
+ * @ctx: context sending result
+ * @ret: return value of request
+ * @num_params: number of parameters returned
+ * @param: returned parameters
+ *
+ * Returns 0 on success or <0 on failure.
+ */
+int optee_supp_send(struct tee_context *ctx, u32 ret, u32 num_params,
+ struct tee_param *param)
+{
+ struct tee_device *teedev = ctx->teedev;
+ struct optee *optee = tee_get_drvdata(teedev);
+ struct optee_supp *supp = &optee->supp;
+ struct optee_supp_req *req;
+ size_t n;
+ size_t num_meta;
+
+ mutex_lock(&supp->mutex);
+ req = supp_pop_req(supp, num_params, param, &num_meta);
+ mutex_unlock(&supp->mutex);
+
+ if (IS_ERR(req)) {
+ /* Something is wrong, let supplicant restart. */
+ return PTR_ERR(req);
+ }
+
+ /* Update out and in/out parameters */
+ for (n = 0; n < req->num_params; n++) {
+ struct tee_param *p = req->param + n;
+
+ switch (p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
+ p->u.value.a = param[n + num_meta].u.value.a;
+ p->u.value.b = param[n + num_meta].u.value.b;
+ p->u.value.c = param[n + num_meta].u.value.c;
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
+ p->u.memref.size = param[n + num_meta].u.memref.size;
+ break;
+ default:
+ break;
+ }
+ }
+ req->ret = ret;
+
+ /* Let the requesting thread continue */
+ complete(&req->c);
+
+ return 0;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tee_core.c b/src/kernel/linux/v4.19/drivers/tee/tee_core.c
new file mode 100644
index 0000000..dd46b75
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tee_core.c
@@ -0,0 +1,964 @@
+/*
+ * Copyright (c) 2015-2016, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+
+#define pr_fmt(fmt) "%s: " fmt, __func__
+
+#include <linux/cdev.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/idr.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/tee_drv.h>
+#include <linux/uaccess.h>
+#include "tee_private.h"
+
+#define TEE_NUM_DEVICES 32
+
+#define TEE_IOCTL_PARAM_SIZE(x) (sizeof(struct tee_param) * (x))
+
+/*
+ * Unprivileged devices in the lower half range and privileged devices in
+ * the upper half range.
+ */
+static DECLARE_BITMAP(dev_mask, TEE_NUM_DEVICES);
+static DEFINE_SPINLOCK(driver_lock);
+
+static struct class *tee_class;
+static dev_t tee_devt;
+
+static int tee_open(struct inode *inode, struct file *filp)
+{
+ int rc;
+ struct tee_device *teedev;
+ struct tee_context *ctx;
+
+ teedev = container_of(inode->i_cdev, struct tee_device, cdev);
+ if (!tee_device_get(teedev))
+ return -EINVAL;
+
+ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
+ if (!ctx) {
+ rc = -ENOMEM;
+ goto err;
+ }
+
+ kref_init(&ctx->refcount);
+ ctx->teedev = teedev;
+ INIT_LIST_HEAD(&ctx->list_shm);
+ filp->private_data = ctx;
+ rc = teedev->desc->ops->open(ctx);
+ if (rc)
+ goto err;
+
+ return 0;
+err:
+ kfree(ctx);
+ tee_device_put(teedev);
+ return rc;
+}
+
+void teedev_ctx_get(struct tee_context *ctx)
+{
+ if (ctx->releasing)
+ return;
+
+ kref_get(&ctx->refcount);
+}
+
+static void teedev_ctx_release(struct kref *ref)
+{
+ struct tee_context *ctx = container_of(ref, struct tee_context,
+ refcount);
+ ctx->releasing = true;
+ ctx->teedev->desc->ops->release(ctx);
+ kfree(ctx);
+}
+
+void teedev_ctx_put(struct tee_context *ctx)
+{
+ if (ctx->releasing)
+ return;
+
+ kref_put(&ctx->refcount, teedev_ctx_release);
+}
+
+static void teedev_close_context(struct tee_context *ctx)
+{
+ tee_device_put(ctx->teedev);
+ teedev_ctx_put(ctx);
+}
+
+static int tee_release(struct inode *inode, struct file *filp)
+{
+ teedev_close_context(filp->private_data);
+ return 0;
+}
+
+static int tee_ioctl_version(struct tee_context *ctx,
+ struct tee_ioctl_version_data __user *uvers)
+{
+ struct tee_ioctl_version_data vers;
+
+ ctx->teedev->desc->ops->get_version(ctx->teedev, &vers);
+
+ if (ctx->teedev->desc->flags & TEE_DESC_PRIVILEGED)
+ vers.gen_caps |= TEE_GEN_CAP_PRIVILEGED;
+
+ if (copy_to_user(uvers, &vers, sizeof(vers)))
+ return -EFAULT;
+
+ return 0;
+}
+
+static int tee_ioctl_shm_alloc(struct tee_context *ctx,
+ struct tee_ioctl_shm_alloc_data __user *udata)
+{
+ long ret;
+ struct tee_ioctl_shm_alloc_data data;
+ struct tee_shm *shm;
+
+ if (copy_from_user(&data, udata, sizeof(data)))
+ return -EFAULT;
+
+ /* Currently no input flags are supported */
+ if (data.flags)
+ return -EINVAL;
+
+ shm = tee_shm_alloc(ctx, data.size, TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
+ if (IS_ERR(shm))
+ return PTR_ERR(shm);
+
+ data.id = shm->id;
+ data.flags = shm->flags;
+ data.size = shm->size;
+
+ if (copy_to_user(udata, &data, sizeof(data)))
+ ret = -EFAULT;
+ else
+ ret = tee_shm_get_fd(shm);
+
+ /*
+ * When user space closes the file descriptor the shared memory
+ * should be freed or if tee_shm_get_fd() failed then it will
+ * be freed immediately.
+ */
+ tee_shm_put(shm);
+ return ret;
+}
+
+static int
+tee_ioctl_shm_register(struct tee_context *ctx,
+ struct tee_ioctl_shm_register_data __user *udata)
+{
+ long ret;
+ struct tee_ioctl_shm_register_data data;
+ struct tee_shm *shm;
+
+ if (copy_from_user(&data, udata, sizeof(data)))
+ return -EFAULT;
+
+ /* Currently no input flags are supported */
+ if (data.flags)
+ return -EINVAL;
+
+ shm = tee_shm_register(ctx, data.addr, data.length,
+ TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED);
+ if (IS_ERR(shm))
+ return PTR_ERR(shm);
+
+ data.id = shm->id;
+ data.flags = shm->flags;
+ data.length = shm->size;
+
+ if (copy_to_user(udata, &data, sizeof(data)))
+ ret = -EFAULT;
+ else
+ ret = tee_shm_get_fd(shm);
+ /*
+ * When user space closes the file descriptor the shared memory
+ * should be freed or if tee_shm_get_fd() failed then it will
+ * be freed immediately.
+ */
+ tee_shm_put(shm);
+ return ret;
+}
+
+static int params_from_user(struct tee_context *ctx, struct tee_param *params,
+ size_t num_params,
+ struct tee_ioctl_param __user *uparams)
+{
+ size_t n;
+
+ for (n = 0; n < num_params; n++) {
+ struct tee_shm *shm;
+ struct tee_ioctl_param ip;
+
+ if (copy_from_user(&ip, uparams + n, sizeof(ip)))
+ return -EFAULT;
+
+ /* All unused attribute bits has to be zero */
+ if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK)
+ return -EINVAL;
+
+ params[n].attr = ip.attr;
+ switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
+ case TEE_IOCTL_PARAM_ATTR_TYPE_NONE:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
+ params[n].u.value.a = ip.a;
+ params[n].u.value.b = ip.b;
+ params[n].u.value.c = ip.c;
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
+ /*
+ * If we fail to get a pointer to a shared memory
+ * object (and increase the ref count) from an
+ * identifier we return an error. All pointers that
+ * has been added in params have an increased ref
+ * count. It's the callers responibility to do
+ * tee_shm_put() on all resolved pointers.
+ */
+ shm = tee_shm_get_from_id(ctx, ip.c);
+ if (IS_ERR(shm))
+ return PTR_ERR(shm);
+
+ /*
+ * Ensure offset + size does not overflow offset
+ * and does not overflow the size of the referred
+ * shared memory object.
+ */
+ if ((ip.a + ip.b) < ip.a ||
+ (ip.a + ip.b) > shm->size) {
+ tee_shm_put(shm);
+ return -EINVAL;
+ }
+
+ params[n].u.memref.shm_offs = ip.a;
+ params[n].u.memref.size = ip.b;
+ params[n].u.memref.shm = shm;
+ break;
+ default:
+ /* Unknown attribute */
+ return -EINVAL;
+ }
+ }
+ return 0;
+}
+
+static int params_to_user(struct tee_ioctl_param __user *uparams,
+ size_t num_params, struct tee_param *params)
+{
+ size_t n;
+
+ for (n = 0; n < num_params; n++) {
+ struct tee_ioctl_param __user *up = uparams + n;
+ struct tee_param *p = params + n;
+
+ switch (p->attr) {
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
+ if (put_user(p->u.value.a, &up->a) ||
+ put_user(p->u.value.b, &up->b) ||
+ put_user(p->u.value.c, &up->c))
+ return -EFAULT;
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
+ if (put_user((u64)p->u.memref.size, &up->b))
+ return -EFAULT;
+ default:
+ break;
+ }
+ }
+ return 0;
+}
+
+static int tee_ioctl_open_session(struct tee_context *ctx,
+ struct tee_ioctl_buf_data __user *ubuf)
+{
+ int rc;
+ size_t n;
+ struct tee_ioctl_buf_data buf;
+ struct tee_ioctl_open_session_arg __user *uarg;
+ struct tee_ioctl_open_session_arg arg;
+ struct tee_ioctl_param __user *uparams = NULL;
+ struct tee_param *params = NULL;
+ bool have_session = false;
+
+ if (!ctx->teedev->desc->ops->open_session)
+ return -EINVAL;
+
+ if (copy_from_user(&buf, ubuf, sizeof(buf)))
+ return -EFAULT;
+
+ if (buf.buf_len > TEE_MAX_ARG_SIZE ||
+ buf.buf_len < sizeof(struct tee_ioctl_open_session_arg))
+ return -EINVAL;
+
+ uarg = u64_to_user_ptr(buf.buf_ptr);
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+ if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
+ return -EINVAL;
+
+ if (arg.num_params) {
+ params = kcalloc(arg.num_params, sizeof(struct tee_param),
+ GFP_KERNEL);
+ if (!params)
+ return -ENOMEM;
+ uparams = uarg->params;
+ rc = params_from_user(ctx, params, arg.num_params, uparams);
+ if (rc)
+ goto out;
+ }
+
+ rc = ctx->teedev->desc->ops->open_session(ctx, &arg, params);
+ if (rc)
+ goto out;
+ have_session = true;
+
+ if (put_user(arg.session, &uarg->session) ||
+ put_user(arg.ret, &uarg->ret) ||
+ put_user(arg.ret_origin, &uarg->ret_origin)) {
+ rc = -EFAULT;
+ goto out;
+ }
+ rc = params_to_user(uparams, arg.num_params, params);
+out:
+ /*
+ * If we've succeeded to open the session but failed to communicate
+ * it back to user space, close the session again to avoid leakage.
+ */
+ if (rc && have_session && ctx->teedev->desc->ops->close_session)
+ ctx->teedev->desc->ops->close_session(ctx, arg.session);
+
+ if (params) {
+ /* Decrease ref count for all valid shared memory pointers */
+ for (n = 0; n < arg.num_params; n++)
+ if (tee_param_is_memref(params + n) &&
+ params[n].u.memref.shm)
+ tee_shm_put(params[n].u.memref.shm);
+ kfree(params);
+ }
+
+ return rc;
+}
+
+static int tee_ioctl_invoke(struct tee_context *ctx,
+ struct tee_ioctl_buf_data __user *ubuf)
+{
+ int rc;
+ size_t n;
+ struct tee_ioctl_buf_data buf;
+ struct tee_ioctl_invoke_arg __user *uarg;
+ struct tee_ioctl_invoke_arg arg;
+ struct tee_ioctl_param __user *uparams = NULL;
+ struct tee_param *params = NULL;
+
+ if (!ctx->teedev->desc->ops->invoke_func)
+ return -EINVAL;
+
+ if (copy_from_user(&buf, ubuf, sizeof(buf)))
+ return -EFAULT;
+
+ if (buf.buf_len > TEE_MAX_ARG_SIZE ||
+ buf.buf_len < sizeof(struct tee_ioctl_invoke_arg))
+ return -EINVAL;
+
+ uarg = u64_to_user_ptr(buf.buf_ptr);
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+ if (sizeof(arg) + TEE_IOCTL_PARAM_SIZE(arg.num_params) != buf.buf_len)
+ return -EINVAL;
+
+ if (arg.num_params) {
+ params = kcalloc(arg.num_params, sizeof(struct tee_param),
+ GFP_KERNEL);
+ if (!params)
+ return -ENOMEM;
+ uparams = uarg->params;
+ rc = params_from_user(ctx, params, arg.num_params, uparams);
+ if (rc)
+ goto out;
+ }
+
+ rc = ctx->teedev->desc->ops->invoke_func(ctx, &arg, params);
+ if (rc)
+ goto out;
+
+ if (put_user(arg.ret, &uarg->ret) ||
+ put_user(arg.ret_origin, &uarg->ret_origin)) {
+ rc = -EFAULT;
+ goto out;
+ }
+ rc = params_to_user(uparams, arg.num_params, params);
+out:
+ if (params) {
+ /* Decrease ref count for all valid shared memory pointers */
+ for (n = 0; n < arg.num_params; n++)
+ if (tee_param_is_memref(params + n) &&
+ params[n].u.memref.shm)
+ tee_shm_put(params[n].u.memref.shm);
+ kfree(params);
+ }
+ return rc;
+}
+
+static int tee_ioctl_cancel(struct tee_context *ctx,
+ struct tee_ioctl_cancel_arg __user *uarg)
+{
+ struct tee_ioctl_cancel_arg arg;
+
+ if (!ctx->teedev->desc->ops->cancel_req)
+ return -EINVAL;
+
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+ return ctx->teedev->desc->ops->cancel_req(ctx, arg.cancel_id,
+ arg.session);
+}
+
+static int
+tee_ioctl_close_session(struct tee_context *ctx,
+ struct tee_ioctl_close_session_arg __user *uarg)
+{
+ struct tee_ioctl_close_session_arg arg;
+
+ if (!ctx->teedev->desc->ops->close_session)
+ return -EINVAL;
+
+ if (copy_from_user(&arg, uarg, sizeof(arg)))
+ return -EFAULT;
+
+ return ctx->teedev->desc->ops->close_session(ctx, arg.session);
+}
+
+static int params_to_supp(struct tee_context *ctx,
+ struct tee_ioctl_param __user *uparams,
+ size_t num_params, struct tee_param *params)
+{
+ size_t n;
+
+ for (n = 0; n < num_params; n++) {
+ struct tee_ioctl_param ip;
+ struct tee_param *p = params + n;
+
+ ip.attr = p->attr;
+ switch (p->attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
+ ip.a = p->u.value.a;
+ ip.b = p->u.value.b;
+ ip.c = p->u.value.c;
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
+ ip.b = p->u.memref.size;
+ if (!p->u.memref.shm) {
+ ip.a = 0;
+ ip.c = (u64)-1; /* invalid shm id */
+ break;
+ }
+ ip.a = p->u.memref.shm_offs;
+ ip.c = p->u.memref.shm->id;
+ break;
+ default:
+ ip.a = 0;
+ ip.b = 0;
+ ip.c = 0;
+ break;
+ }
+
+ if (copy_to_user(uparams + n, &ip, sizeof(ip)))
+ return -EFAULT;
+ }
+
+ return 0;
+}
+
+static int tee_ioctl_supp_recv(struct tee_context *ctx,
+ struct tee_ioctl_buf_data __user *ubuf)
+{
+ int rc;
+ struct tee_ioctl_buf_data buf;
+ struct tee_iocl_supp_recv_arg __user *uarg;
+ struct tee_param *params;
+ u32 num_params;
+ u32 func;
+
+ if (!ctx->teedev->desc->ops->supp_recv)
+ return -EINVAL;
+
+ if (copy_from_user(&buf, ubuf, sizeof(buf)))
+ return -EFAULT;
+
+ if (buf.buf_len > TEE_MAX_ARG_SIZE ||
+ buf.buf_len < sizeof(struct tee_iocl_supp_recv_arg))
+ return -EINVAL;
+
+ uarg = u64_to_user_ptr(buf.buf_ptr);
+ if (get_user(num_params, &uarg->num_params))
+ return -EFAULT;
+
+ if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) != buf.buf_len)
+ return -EINVAL;
+
+ params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
+ if (!params)
+ return -ENOMEM;
+
+ rc = params_from_user(ctx, params, num_params, uarg->params);
+ if (rc)
+ goto out;
+
+ rc = ctx->teedev->desc->ops->supp_recv(ctx, &func, &num_params, params);
+ if (rc)
+ goto out;
+
+ if (put_user(func, &uarg->func) ||
+ put_user(num_params, &uarg->num_params)) {
+ rc = -EFAULT;
+ goto out;
+ }
+
+ rc = params_to_supp(ctx, uarg->params, num_params, params);
+out:
+ kfree(params);
+ return rc;
+}
+
+static int params_from_supp(struct tee_param *params, size_t num_params,
+ struct tee_ioctl_param __user *uparams)
+{
+ size_t n;
+
+ for (n = 0; n < num_params; n++) {
+ struct tee_param *p = params + n;
+ struct tee_ioctl_param ip;
+
+ if (copy_from_user(&ip, uparams + n, sizeof(ip)))
+ return -EFAULT;
+
+ /* All unused attribute bits has to be zero */
+ if (ip.attr & ~TEE_IOCTL_PARAM_ATTR_MASK)
+ return -EINVAL;
+
+ p->attr = ip.attr;
+ switch (ip.attr & TEE_IOCTL_PARAM_ATTR_TYPE_MASK) {
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INOUT:
+ /* Only out and in/out values can be updated */
+ p->u.value.a = ip.a;
+ p->u.value.b = ip.b;
+ p->u.value.c = ip.c;
+ break;
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
+ /*
+ * Only the size of the memref can be updated.
+ * Since we don't have access to the original
+ * parameters here, only store the supplied size.
+ * The driver will copy the updated size into the
+ * original parameters.
+ */
+ p->u.memref.shm = NULL;
+ p->u.memref.shm_offs = 0;
+ p->u.memref.size = ip.b;
+ break;
+ default:
+ memset(&p->u, 0, sizeof(p->u));
+ break;
+ }
+ }
+ return 0;
+}
+
+static int tee_ioctl_supp_send(struct tee_context *ctx,
+ struct tee_ioctl_buf_data __user *ubuf)
+{
+ long rc;
+ struct tee_ioctl_buf_data buf;
+ struct tee_iocl_supp_send_arg __user *uarg;
+ struct tee_param *params;
+ u32 num_params;
+ u32 ret;
+
+ /* Not valid for this driver */
+ if (!ctx->teedev->desc->ops->supp_send)
+ return -EINVAL;
+
+ if (copy_from_user(&buf, ubuf, sizeof(buf)))
+ return -EFAULT;
+
+ if (buf.buf_len > TEE_MAX_ARG_SIZE ||
+ buf.buf_len < sizeof(struct tee_iocl_supp_send_arg))
+ return -EINVAL;
+
+ uarg = u64_to_user_ptr(buf.buf_ptr);
+ if (get_user(ret, &uarg->ret) ||
+ get_user(num_params, &uarg->num_params))
+ return -EFAULT;
+
+ if (sizeof(*uarg) + TEE_IOCTL_PARAM_SIZE(num_params) > buf.buf_len)
+ return -EINVAL;
+
+ params = kcalloc(num_params, sizeof(struct tee_param), GFP_KERNEL);
+ if (!params)
+ return -ENOMEM;
+
+ rc = params_from_supp(params, num_params, uarg->params);
+ if (rc)
+ goto out;
+
+ rc = ctx->teedev->desc->ops->supp_send(ctx, ret, num_params, params);
+out:
+ kfree(params);
+ return rc;
+}
+
+static long tee_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+{
+ struct tee_context *ctx = filp->private_data;
+ void __user *uarg = (void __user *)arg;
+
+ switch (cmd) {
+ case TEE_IOC_VERSION:
+ return tee_ioctl_version(ctx, uarg);
+ case TEE_IOC_SHM_ALLOC:
+ return tee_ioctl_shm_alloc(ctx, uarg);
+ case TEE_IOC_SHM_REGISTER:
+ return tee_ioctl_shm_register(ctx, uarg);
+ case TEE_IOC_OPEN_SESSION:
+ return tee_ioctl_open_session(ctx, uarg);
+ case TEE_IOC_INVOKE:
+ return tee_ioctl_invoke(ctx, uarg);
+ case TEE_IOC_CANCEL:
+ return tee_ioctl_cancel(ctx, uarg);
+ case TEE_IOC_CLOSE_SESSION:
+ return tee_ioctl_close_session(ctx, uarg);
+ case TEE_IOC_SUPPL_RECV:
+ return tee_ioctl_supp_recv(ctx, uarg);
+ case TEE_IOC_SUPPL_SEND:
+ return tee_ioctl_supp_send(ctx, uarg);
+ default:
+ return -EINVAL;
+ }
+}
+
+static const struct file_operations tee_fops = {
+ .owner = THIS_MODULE,
+ .open = tee_open,
+ .release = tee_release,
+ .unlocked_ioctl = tee_ioctl,
+ .compat_ioctl = tee_ioctl,
+};
+
+static void tee_release_device(struct device *dev)
+{
+ struct tee_device *teedev = container_of(dev, struct tee_device, dev);
+
+ spin_lock(&driver_lock);
+ clear_bit(teedev->id, dev_mask);
+ spin_unlock(&driver_lock);
+ mutex_destroy(&teedev->mutex);
+ idr_destroy(&teedev->idr);
+ kfree(teedev);
+}
+
+/**
+ * tee_device_alloc() - Allocate a new struct tee_device instance
+ * @teedesc: Descriptor for this driver
+ * @dev: Parent device for this device
+ * @pool: Shared memory pool, NULL if not used
+ * @driver_data: Private driver data for this device
+ *
+ * Allocates a new struct tee_device instance. The device is
+ * removed by tee_device_unregister().
+ *
+ * @returns a pointer to a 'struct tee_device' or an ERR_PTR on failure
+ */
+struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
+ struct device *dev,
+ struct tee_shm_pool *pool,
+ void *driver_data)
+{
+ struct tee_device *teedev;
+ void *ret;
+ int rc, max_id;
+ int offs = 0;
+
+ if (!teedesc || !teedesc->name || !teedesc->ops ||
+ !teedesc->ops->get_version || !teedesc->ops->open ||
+ !teedesc->ops->release || !pool)
+ return ERR_PTR(-EINVAL);
+
+ teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
+ if (!teedev) {
+ ret = ERR_PTR(-ENOMEM);
+ goto err;
+ }
+
+ max_id = TEE_NUM_DEVICES / 2;
+
+ if (teedesc->flags & TEE_DESC_PRIVILEGED) {
+ offs = TEE_NUM_DEVICES / 2;
+ max_id = TEE_NUM_DEVICES;
+ }
+
+ spin_lock(&driver_lock);
+ teedev->id = find_next_zero_bit(dev_mask, max_id, offs);
+ if (teedev->id < max_id)
+ set_bit(teedev->id, dev_mask);
+ spin_unlock(&driver_lock);
+
+ if (teedev->id >= max_id) {
+ ret = ERR_PTR(-ENOMEM);
+ goto err;
+ }
+
+ snprintf(teedev->name, sizeof(teedev->name), "tee%s%d",
+ teedesc->flags & TEE_DESC_PRIVILEGED ? "priv" : "",
+ teedev->id - offs);
+
+ teedev->dev.class = tee_class;
+ teedev->dev.release = tee_release_device;
+ teedev->dev.parent = dev;
+
+ teedev->dev.devt = MKDEV(MAJOR(tee_devt), teedev->id);
+
+ rc = dev_set_name(&teedev->dev, "%s", teedev->name);
+ if (rc) {
+ ret = ERR_PTR(rc);
+ goto err_devt;
+ }
+
+ cdev_init(&teedev->cdev, &tee_fops);
+ teedev->cdev.owner = teedesc->owner;
+ teedev->cdev.kobj.parent = &teedev->dev.kobj;
+
+ dev_set_drvdata(&teedev->dev, driver_data);
+ device_initialize(&teedev->dev);
+
+ /* 1 as tee_device_unregister() does one final tee_device_put() */
+ teedev->num_users = 1;
+ init_completion(&teedev->c_no_users);
+ mutex_init(&teedev->mutex);
+ idr_init(&teedev->idr);
+
+ teedev->desc = teedesc;
+ teedev->pool = pool;
+
+ return teedev;
+err_devt:
+ unregister_chrdev_region(teedev->dev.devt, 1);
+err:
+ pr_err("could not register %s driver\n",
+ teedesc->flags & TEE_DESC_PRIVILEGED ? "privileged" : "client");
+ if (teedev && teedev->id < TEE_NUM_DEVICES) {
+ spin_lock(&driver_lock);
+ clear_bit(teedev->id, dev_mask);
+ spin_unlock(&driver_lock);
+ }
+ kfree(teedev);
+ return ret;
+}
+EXPORT_SYMBOL_GPL(tee_device_alloc);
+
+static ssize_t implementation_id_show(struct device *dev,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee_device *teedev = container_of(dev, struct tee_device, dev);
+ struct tee_ioctl_version_data vers;
+
+ teedev->desc->ops->get_version(teedev, &vers);
+ return scnprintf(buf, PAGE_SIZE, "%d\n", vers.impl_id);
+}
+static DEVICE_ATTR_RO(implementation_id);
+
+static struct attribute *tee_dev_attrs[] = {
+ &dev_attr_implementation_id.attr,
+ NULL
+};
+
+static const struct attribute_group tee_dev_group = {
+ .attrs = tee_dev_attrs,
+};
+
+/**
+ * tee_device_register() - Registers a TEE device
+ * @teedev: Device to register
+ *
+ * tee_device_unregister() need to be called to remove the @teedev if
+ * this function fails.
+ *
+ * @returns < 0 on failure
+ */
+int tee_device_register(struct tee_device *teedev)
+{
+ int rc;
+
+ if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) {
+ dev_err(&teedev->dev, "attempt to register twice\n");
+ return -EINVAL;
+ }
+
+ rc = cdev_add(&teedev->cdev, teedev->dev.devt, 1);
+ if (rc) {
+ dev_err(&teedev->dev,
+ "unable to cdev_add() %s, major %d, minor %d, err=%d\n",
+ teedev->name, MAJOR(teedev->dev.devt),
+ MINOR(teedev->dev.devt), rc);
+ return rc;
+ }
+
+ rc = device_add(&teedev->dev);
+ if (rc) {
+ dev_err(&teedev->dev,
+ "unable to device_add() %s, major %d, minor %d, err=%d\n",
+ teedev->name, MAJOR(teedev->dev.devt),
+ MINOR(teedev->dev.devt), rc);
+ goto err_device_add;
+ }
+
+ rc = sysfs_create_group(&teedev->dev.kobj, &tee_dev_group);
+ if (rc) {
+ dev_err(&teedev->dev,
+ "failed to create sysfs attributes, err=%d\n", rc);
+ goto err_sysfs_create_group;
+ }
+
+ teedev->flags |= TEE_DEVICE_FLAG_REGISTERED;
+ return 0;
+
+err_sysfs_create_group:
+ device_del(&teedev->dev);
+err_device_add:
+ cdev_del(&teedev->cdev);
+ return rc;
+}
+EXPORT_SYMBOL_GPL(tee_device_register);
+
+void tee_device_put(struct tee_device *teedev)
+{
+ mutex_lock(&teedev->mutex);
+ /* Shouldn't put in this state */
+ if (!WARN_ON(!teedev->desc)) {
+ teedev->num_users--;
+ if (!teedev->num_users) {
+ teedev->desc = NULL;
+ complete(&teedev->c_no_users);
+ }
+ }
+ mutex_unlock(&teedev->mutex);
+}
+
+bool tee_device_get(struct tee_device *teedev)
+{
+ mutex_lock(&teedev->mutex);
+ if (!teedev->desc) {
+ mutex_unlock(&teedev->mutex);
+ return false;
+ }
+ teedev->num_users++;
+ mutex_unlock(&teedev->mutex);
+ return true;
+}
+
+/**
+ * tee_device_unregister() - Removes a TEE device
+ * @teedev: Device to unregister
+ *
+ * This function should be called to remove the @teedev even if
+ * tee_device_register() hasn't been called yet. Does nothing if
+ * @teedev is NULL.
+ */
+void tee_device_unregister(struct tee_device *teedev)
+{
+ if (!teedev)
+ return;
+
+ if (teedev->flags & TEE_DEVICE_FLAG_REGISTERED) {
+ sysfs_remove_group(&teedev->dev.kobj, &tee_dev_group);
+ cdev_del(&teedev->cdev);
+ device_del(&teedev->dev);
+ }
+
+ tee_device_put(teedev);
+ wait_for_completion(&teedev->c_no_users);
+
+ /*
+ * No need to take a mutex any longer now since teedev->desc was
+ * set to NULL before teedev->c_no_users was completed.
+ */
+
+ teedev->pool = NULL;
+
+ put_device(&teedev->dev);
+}
+EXPORT_SYMBOL_GPL(tee_device_unregister);
+
+/**
+ * tee_get_drvdata() - Return driver_data pointer
+ * @teedev: Device containing the driver_data pointer
+ * @returns the driver_data pointer supplied to tee_register().
+ */
+void *tee_get_drvdata(struct tee_device *teedev)
+{
+ return dev_get_drvdata(&teedev->dev);
+}
+EXPORT_SYMBOL_GPL(tee_get_drvdata);
+
+static int __init tee_init(void)
+{
+ int rc;
+
+ tee_class = class_create(THIS_MODULE, "tee");
+ if (IS_ERR(tee_class)) {
+ pr_err("couldn't create class\n");
+ return PTR_ERR(tee_class);
+ }
+
+ rc = alloc_chrdev_region(&tee_devt, 0, TEE_NUM_DEVICES, "tee");
+ if (rc) {
+ pr_err("failed to allocate char dev region\n");
+ class_destroy(tee_class);
+ tee_class = NULL;
+ }
+
+ return rc;
+}
+
+static void __exit tee_exit(void)
+{
+ class_destroy(tee_class);
+ tee_class = NULL;
+ unregister_chrdev_region(tee_devt, TEE_NUM_DEVICES);
+}
+
+subsys_initcall(tee_init);
+module_exit(tee_exit);
+
+MODULE_AUTHOR("Linaro");
+MODULE_DESCRIPTION("TEE Driver");
+MODULE_VERSION("1.0");
+MODULE_LICENSE("GPL v2");
diff --git a/src/kernel/linux/v4.19/drivers/tee/tee_private.h b/src/kernel/linux/v4.19/drivers/tee/tee_private.h
new file mode 100644
index 0000000..85d99d6
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tee_private.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2015-2016, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+#ifndef TEE_PRIVATE_H
+#define TEE_PRIVATE_H
+
+#include <linux/cdev.h>
+#include <linux/completion.h>
+#include <linux/device.h>
+#include <linux/kref.h>
+#include <linux/mutex.h>
+#include <linux/types.h>
+
+/**
+ * struct tee_shm_pool - shared memory pool
+ * @private_mgr: pool manager for shared memory only between kernel
+ * and secure world
+ * @dma_buf_mgr: pool manager for shared memory exported to user space
+ */
+struct tee_shm_pool {
+ struct tee_shm_pool_mgr *private_mgr;
+ struct tee_shm_pool_mgr *dma_buf_mgr;
+};
+
+#define TEE_DEVICE_FLAG_REGISTERED 0x1
+#define TEE_MAX_DEV_NAME_LEN 32
+
+/**
+ * struct tee_device - TEE Device representation
+ * @name: name of device
+ * @desc: description of device
+ * @id: unique id of device
+ * @flags: represented by TEE_DEVICE_FLAG_REGISTERED above
+ * @dev: embedded basic device structure
+ * @cdev: embedded cdev
+ * @num_users: number of active users of this device
+ * @c_no_user: completion used when unregistering the device
+ * @mutex: mutex protecting @num_users and @idr
+ * @idr: register of shared memory object allocated on this device
+ * @pool: shared memory pool
+ */
+struct tee_device {
+ char name[TEE_MAX_DEV_NAME_LEN];
+ const struct tee_desc *desc;
+ int id;
+ unsigned int flags;
+
+ struct device dev;
+ struct cdev cdev;
+
+ size_t num_users;
+ struct completion c_no_users;
+ struct mutex mutex; /* protects num_users and idr */
+
+ struct idr idr;
+ struct tee_shm_pool *pool;
+};
+
+int tee_shm_init(void);
+
+int tee_shm_get_fd(struct tee_shm *shm);
+
+bool tee_device_get(struct tee_device *teedev);
+void tee_device_put(struct tee_device *teedev);
+
+void teedev_ctx_get(struct tee_context *ctx);
+void teedev_ctx_put(struct tee_context *ctx);
+
+#endif /*TEE_PRIVATE_H*/
diff --git a/src/kernel/linux/v4.19/drivers/tee/tee_shm.c b/src/kernel/linux/v4.19/drivers/tee/tee_shm.c
new file mode 100644
index 0000000..8e7b52a
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tee_shm.c
@@ -0,0 +1,506 @@
+/*
+ * Copyright (c) 2015-2016, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/device.h>
+#include <linux/dma-buf.h>
+#include <linux/fdtable.h>
+#include <linux/idr.h>
+#include <linux/sched.h>
+#include <linux/slab.h>
+#include <linux/tee_drv.h>
+#include "tee_private.h"
+
+static void tee_shm_release(struct tee_shm *shm)
+{
+ struct tee_device *teedev = shm->teedev;
+
+ mutex_lock(&teedev->mutex);
+ idr_remove(&teedev->idr, shm->id);
+ if (shm->ctx)
+ list_del(&shm->link);
+ mutex_unlock(&teedev->mutex);
+
+ if (shm->flags & TEE_SHM_POOL) {
+ struct tee_shm_pool_mgr *poolm;
+
+ if (shm->flags & TEE_SHM_DMA_BUF)
+ poolm = teedev->pool->dma_buf_mgr;
+ else
+ poolm = teedev->pool->private_mgr;
+
+ poolm->ops->free(poolm, shm);
+ } else if (shm->flags & TEE_SHM_REGISTER) {
+ size_t n;
+ int rc = teedev->desc->ops->shm_unregister(shm->ctx, shm);
+
+ if (rc)
+ dev_err(teedev->dev.parent,
+ "unregister shm %p failed: %d", shm, rc);
+
+ for (n = 0; n < shm->num_pages; n++)
+ put_page(shm->pages[n]);
+
+ kfree(shm->pages);
+ }
+
+ if (shm->ctx)
+ teedev_ctx_put(shm->ctx);
+
+ kfree(shm);
+
+ tee_device_put(teedev);
+}
+
+static struct sg_table *tee_shm_op_map_dma_buf(struct dma_buf_attachment
+ *attach, enum dma_data_direction dir)
+{
+ return NULL;
+}
+
+static void tee_shm_op_unmap_dma_buf(struct dma_buf_attachment *attach,
+ struct sg_table *table,
+ enum dma_data_direction dir)
+{
+}
+
+static void tee_shm_op_release(struct dma_buf *dmabuf)
+{
+ struct tee_shm *shm = dmabuf->priv;
+
+ tee_shm_release(shm);
+}
+
+static void *tee_shm_op_map(struct dma_buf *dmabuf, unsigned long pgnum)
+{
+ return NULL;
+}
+
+static int tee_shm_op_mmap(struct dma_buf *dmabuf, struct vm_area_struct *vma)
+{
+ struct tee_shm *shm = dmabuf->priv;
+ size_t size = vma->vm_end - vma->vm_start;
+
+ /* Refuse sharing shared memory provided by application */
+ if (shm->flags & TEE_SHM_REGISTER)
+ return -EINVAL;
+
+ return remap_pfn_range(vma, vma->vm_start, shm->paddr >> PAGE_SHIFT,
+ size, vma->vm_page_prot);
+}
+
+static const struct dma_buf_ops tee_shm_dma_buf_ops = {
+ .map_dma_buf = tee_shm_op_map_dma_buf,
+ .unmap_dma_buf = tee_shm_op_unmap_dma_buf,
+ .release = tee_shm_op_release,
+ .map = tee_shm_op_map,
+ .mmap = tee_shm_op_mmap,
+};
+
+static struct tee_shm *__tee_shm_alloc(struct tee_context *ctx,
+ struct tee_device *teedev,
+ size_t size, u32 flags)
+{
+ struct tee_shm_pool_mgr *poolm = NULL;
+ struct tee_shm *shm;
+ void *ret;
+ int rc;
+
+ if (ctx && ctx->teedev != teedev) {
+ dev_err(teedev->dev.parent, "ctx and teedev mismatch\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ if (!(flags & TEE_SHM_MAPPED)) {
+ dev_err(teedev->dev.parent,
+ "only mapped allocations supported\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ if ((flags & ~(TEE_SHM_MAPPED | TEE_SHM_DMA_BUF))) {
+ dev_err(teedev->dev.parent, "invalid shm flags 0x%x", flags);
+ return ERR_PTR(-EINVAL);
+ }
+
+ if (!tee_device_get(teedev))
+ return ERR_PTR(-EINVAL);
+
+ if (!teedev->pool) {
+ /* teedev has been detached from driver */
+ ret = ERR_PTR(-EINVAL);
+ goto err_dev_put;
+ }
+
+ shm = kzalloc(sizeof(*shm), GFP_KERNEL);
+ if (!shm) {
+ ret = ERR_PTR(-ENOMEM);
+ goto err_dev_put;
+ }
+
+ shm->flags = flags | TEE_SHM_POOL;
+ shm->teedev = teedev;
+ shm->ctx = ctx;
+ if (flags & TEE_SHM_DMA_BUF)
+ poolm = teedev->pool->dma_buf_mgr;
+ else
+ poolm = teedev->pool->private_mgr;
+
+ rc = poolm->ops->alloc(poolm, shm, size);
+ if (rc) {
+ ret = ERR_PTR(rc);
+ goto err_kfree;
+ }
+
+ mutex_lock(&teedev->mutex);
+ shm->id = idr_alloc(&teedev->idr, shm, 1, 0, GFP_KERNEL);
+ mutex_unlock(&teedev->mutex);
+ if (shm->id < 0) {
+ ret = ERR_PTR(shm->id);
+ goto err_pool_free;
+ }
+
+ if (flags & TEE_SHM_DMA_BUF) {
+ DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+
+ exp_info.ops = &tee_shm_dma_buf_ops;
+ exp_info.size = shm->size;
+ exp_info.flags = O_RDWR;
+ exp_info.priv = shm;
+
+ shm->dmabuf = dma_buf_export(&exp_info);
+ if (IS_ERR(shm->dmabuf)) {
+ ret = ERR_CAST(shm->dmabuf);
+ goto err_rem;
+ }
+ }
+
+ if (ctx) {
+ teedev_ctx_get(ctx);
+ mutex_lock(&teedev->mutex);
+ list_add_tail(&shm->link, &ctx->list_shm);
+ mutex_unlock(&teedev->mutex);
+ }
+
+ return shm;
+err_rem:
+ mutex_lock(&teedev->mutex);
+ idr_remove(&teedev->idr, shm->id);
+ mutex_unlock(&teedev->mutex);
+err_pool_free:
+ poolm->ops->free(poolm, shm);
+err_kfree:
+ kfree(shm);
+err_dev_put:
+ tee_device_put(teedev);
+ return ret;
+}
+
+/**
+ * tee_shm_alloc() - Allocate shared memory
+ * @ctx: Context that allocates the shared memory
+ * @size: Requested size of shared memory
+ * @flags: Flags setting properties for the requested shared memory.
+ *
+ * Memory allocated as global shared memory is automatically freed when the
+ * TEE file pointer is closed. The @flags field uses the bits defined by
+ * TEE_SHM_* in <linux/tee_drv.h>. TEE_SHM_MAPPED must currently always be
+ * set. If TEE_SHM_DMA_BUF global shared memory will be allocated and
+ * associated with a dma-buf handle, else driver private memory.
+ */
+struct tee_shm *tee_shm_alloc(struct tee_context *ctx, size_t size, u32 flags)
+{
+ return __tee_shm_alloc(ctx, ctx->teedev, size, flags);
+}
+EXPORT_SYMBOL_GPL(tee_shm_alloc);
+
+struct tee_shm *tee_shm_priv_alloc(struct tee_device *teedev, size_t size)
+{
+ return __tee_shm_alloc(NULL, teedev, size, TEE_SHM_MAPPED);
+}
+EXPORT_SYMBOL_GPL(tee_shm_priv_alloc);
+
+struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
+ size_t length, u32 flags)
+{
+ struct tee_device *teedev = ctx->teedev;
+ const u32 req_flags = TEE_SHM_DMA_BUF | TEE_SHM_USER_MAPPED;
+ struct tee_shm *shm;
+ void *ret;
+ int rc;
+ int num_pages;
+ unsigned long start;
+
+ if (flags != req_flags)
+ return ERR_PTR(-ENOTSUPP);
+
+ if (!tee_device_get(teedev))
+ return ERR_PTR(-EINVAL);
+
+ if (!teedev->desc->ops->shm_register ||
+ !teedev->desc->ops->shm_unregister) {
+ tee_device_put(teedev);
+ return ERR_PTR(-ENOTSUPP);
+ }
+
+ teedev_ctx_get(ctx);
+
+ shm = kzalloc(sizeof(*shm), GFP_KERNEL);
+ if (!shm) {
+ ret = ERR_PTR(-ENOMEM);
+ goto err;
+ }
+
+ shm->flags = flags | TEE_SHM_REGISTER;
+ shm->teedev = teedev;
+ shm->ctx = ctx;
+ shm->id = -1;
+ addr = untagged_addr(addr);
+ start = rounddown(addr, PAGE_SIZE);
+ shm->offset = addr - start;
+ shm->size = length;
+ num_pages = (roundup(addr + length, PAGE_SIZE) - start) / PAGE_SIZE;
+ shm->pages = kcalloc(num_pages, sizeof(*shm->pages), GFP_KERNEL);
+ if (!shm->pages) {
+ ret = ERR_PTR(-ENOMEM);
+ goto err;
+ }
+
+ rc = get_user_pages_fast(start, num_pages, 1, shm->pages);
+ if (rc > 0)
+ shm->num_pages = rc;
+ if (rc != num_pages) {
+ if (rc >= 0)
+ rc = -ENOMEM;
+ ret = ERR_PTR(rc);
+ goto err;
+ }
+
+ mutex_lock(&teedev->mutex);
+ shm->id = idr_alloc(&teedev->idr, shm, 1, 0, GFP_KERNEL);
+ mutex_unlock(&teedev->mutex);
+
+ if (shm->id < 0) {
+ ret = ERR_PTR(shm->id);
+ goto err;
+ }
+
+ rc = teedev->desc->ops->shm_register(ctx, shm, shm->pages,
+ shm->num_pages, start);
+ if (rc) {
+ ret = ERR_PTR(rc);
+ goto err;
+ }
+
+ if (flags & TEE_SHM_DMA_BUF) {
+ DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+
+ exp_info.ops = &tee_shm_dma_buf_ops;
+ exp_info.size = shm->size;
+ exp_info.flags = O_RDWR;
+ exp_info.priv = shm;
+
+ shm->dmabuf = dma_buf_export(&exp_info);
+ if (IS_ERR(shm->dmabuf)) {
+ ret = ERR_CAST(shm->dmabuf);
+ teedev->desc->ops->shm_unregister(ctx, shm);
+ goto err;
+ }
+ }
+
+ mutex_lock(&teedev->mutex);
+ list_add_tail(&shm->link, &ctx->list_shm);
+ mutex_unlock(&teedev->mutex);
+
+ return shm;
+err:
+ if (shm) {
+ size_t n;
+
+ if (shm->id >= 0) {
+ mutex_lock(&teedev->mutex);
+ idr_remove(&teedev->idr, shm->id);
+ mutex_unlock(&teedev->mutex);
+ }
+ if (shm->pages) {
+ for (n = 0; n < shm->num_pages; n++)
+ put_page(shm->pages[n]);
+ kfree(shm->pages);
+ }
+ }
+ kfree(shm);
+ teedev_ctx_put(ctx);
+ tee_device_put(teedev);
+ return ret;
+}
+EXPORT_SYMBOL_GPL(tee_shm_register);
+
+/**
+ * tee_shm_get_fd() - Increase reference count and return file descriptor
+ * @shm: Shared memory handle
+ * @returns user space file descriptor to shared memory
+ */
+int tee_shm_get_fd(struct tee_shm *shm)
+{
+ int fd;
+
+ if (!(shm->flags & TEE_SHM_DMA_BUF))
+ return -EINVAL;
+
+ get_dma_buf(shm->dmabuf);
+ fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
+ if (fd < 0)
+ dma_buf_put(shm->dmabuf);
+ return fd;
+}
+
+/**
+ * tee_shm_free() - Free shared memory
+ * @shm: Handle to shared memory to free
+ */
+void tee_shm_free(struct tee_shm *shm)
+{
+ /*
+ * dma_buf_put() decreases the dmabuf reference counter and will
+ * call tee_shm_release() when the last reference is gone.
+ *
+ * In the case of driver private memory we call tee_shm_release
+ * directly instead as it doesn't have a reference counter.
+ */
+ if (shm->flags & TEE_SHM_DMA_BUF)
+ dma_buf_put(shm->dmabuf);
+ else
+ tee_shm_release(shm);
+}
+EXPORT_SYMBOL_GPL(tee_shm_free);
+
+/**
+ * tee_shm_va2pa() - Get physical address of a virtual address
+ * @shm: Shared memory handle
+ * @va: Virtual address to tranlsate
+ * @pa: Returned physical address
+ * @returns 0 on success and < 0 on failure
+ */
+int tee_shm_va2pa(struct tee_shm *shm, void *va, phys_addr_t *pa)
+{
+ if (!(shm->flags & TEE_SHM_MAPPED))
+ return -EINVAL;
+ /* Check that we're in the range of the shm */
+ if ((char *)va < (char *)shm->kaddr)
+ return -EINVAL;
+ if ((char *)va >= ((char *)shm->kaddr + shm->size))
+ return -EINVAL;
+
+ return tee_shm_get_pa(
+ shm, (unsigned long)va - (unsigned long)shm->kaddr, pa);
+}
+EXPORT_SYMBOL_GPL(tee_shm_va2pa);
+
+/**
+ * tee_shm_pa2va() - Get virtual address of a physical address
+ * @shm: Shared memory handle
+ * @pa: Physical address to tranlsate
+ * @va: Returned virtual address
+ * @returns 0 on success and < 0 on failure
+ */
+int tee_shm_pa2va(struct tee_shm *shm, phys_addr_t pa, void **va)
+{
+ if (!(shm->flags & TEE_SHM_MAPPED))
+ return -EINVAL;
+ /* Check that we're in the range of the shm */
+ if (pa < shm->paddr)
+ return -EINVAL;
+ if (pa >= (shm->paddr + shm->size))
+ return -EINVAL;
+
+ if (va) {
+ void *v = tee_shm_get_va(shm, pa - shm->paddr);
+
+ if (IS_ERR(v))
+ return PTR_ERR(v);
+ *va = v;
+ }
+ return 0;
+}
+EXPORT_SYMBOL_GPL(tee_shm_pa2va);
+
+/**
+ * tee_shm_get_va() - Get virtual address of a shared memory plus an offset
+ * @shm: Shared memory handle
+ * @offs: Offset from start of this shared memory
+ * @returns virtual address of the shared memory + offs if offs is within
+ * the bounds of this shared memory, else an ERR_PTR
+ */
+void *tee_shm_get_va(struct tee_shm *shm, size_t offs)
+{
+ if (!(shm->flags & TEE_SHM_MAPPED))
+ return ERR_PTR(-EINVAL);
+ if (offs >= shm->size)
+ return ERR_PTR(-EINVAL);
+ return (char *)shm->kaddr + offs;
+}
+EXPORT_SYMBOL_GPL(tee_shm_get_va);
+
+/**
+ * tee_shm_get_pa() - Get physical address of a shared memory plus an offset
+ * @shm: Shared memory handle
+ * @offs: Offset from start of this shared memory
+ * @pa: Physical address to return
+ * @returns 0 if offs is within the bounds of this shared memory, else an
+ * error code.
+ */
+int tee_shm_get_pa(struct tee_shm *shm, size_t offs, phys_addr_t *pa)
+{
+ if (offs >= shm->size)
+ return -EINVAL;
+ if (pa)
+ *pa = shm->paddr + offs;
+ return 0;
+}
+EXPORT_SYMBOL_GPL(tee_shm_get_pa);
+
+/**
+ * tee_shm_get_from_id() - Find shared memory object and increase reference
+ * count
+ * @ctx: Context owning the shared memory
+ * @id: Id of shared memory object
+ * @returns a pointer to 'struct tee_shm' on success or an ERR_PTR on failure
+ */
+struct tee_shm *tee_shm_get_from_id(struct tee_context *ctx, int id)
+{
+ struct tee_device *teedev;
+ struct tee_shm *shm;
+
+ if (!ctx)
+ return ERR_PTR(-EINVAL);
+
+ teedev = ctx->teedev;
+ mutex_lock(&teedev->mutex);
+ shm = idr_find(&teedev->idr, id);
+ if (!shm || shm->ctx != ctx)
+ shm = ERR_PTR(-EINVAL);
+ else if (shm->flags & TEE_SHM_DMA_BUF)
+ get_dma_buf(shm->dmabuf);
+ mutex_unlock(&teedev->mutex);
+ return shm;
+}
+EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
+
+/**
+ * tee_shm_put() - Decrease reference count on a shared memory handle
+ * @shm: Shared memory handle
+ */
+void tee_shm_put(struct tee_shm *shm)
+{
+ if (shm->flags & TEE_SHM_DMA_BUF)
+ dma_buf_put(shm->dmabuf);
+}
+EXPORT_SYMBOL_GPL(tee_shm_put);
diff --git a/src/kernel/linux/v4.19/drivers/tee/tee_shm_pool.c b/src/kernel/linux/v4.19/drivers/tee/tee_shm_pool.c
new file mode 100644
index 0000000..e6d4b9e
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tee_shm_pool.c
@@ -0,0 +1,195 @@
+/*
+ * Copyright (c) 2015, Linaro Limited
+ *
+ * This software is licensed under the terms of the GNU General Public
+ * License version 2, as published by the Free Software Foundation, and
+ * may be copied, distributed, and modified under those terms.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ */
+#include <linux/device.h>
+#include <linux/dma-buf.h>
+#include <linux/genalloc.h>
+#include <linux/slab.h>
+#include <linux/tee_drv.h>
+#include "tee_private.h"
+
+static int pool_op_gen_alloc(struct tee_shm_pool_mgr *poolm,
+ struct tee_shm *shm, size_t size)
+{
+ unsigned long va;
+ struct gen_pool *genpool = poolm->private_data;
+ size_t s = roundup(size, 1 << genpool->min_alloc_order);
+
+ va = gen_pool_alloc(genpool, s);
+ if (!va)
+ return -ENOMEM;
+
+ memset((void *)va, 0, s);
+ shm->kaddr = (void *)va;
+ shm->paddr = gen_pool_virt_to_phys(genpool, va);
+ shm->size = s;
+ return 0;
+}
+
+static void pool_op_gen_free(struct tee_shm_pool_mgr *poolm,
+ struct tee_shm *shm)
+{
+ gen_pool_free(poolm->private_data, (unsigned long)shm->kaddr,
+ shm->size);
+ shm->kaddr = NULL;
+}
+
+static void pool_op_gen_destroy_poolmgr(struct tee_shm_pool_mgr *poolm)
+{
+ gen_pool_destroy(poolm->private_data);
+ kfree(poolm);
+}
+
+static const struct tee_shm_pool_mgr_ops pool_ops_generic = {
+ .alloc = pool_op_gen_alloc,
+ .free = pool_op_gen_free,
+ .destroy_poolmgr = pool_op_gen_destroy_poolmgr,
+};
+
+/**
+ * tee_shm_pool_alloc_res_mem() - Create a shared memory pool from reserved
+ * memory range
+ * @priv_info: Information for driver private shared memory pool
+ * @dmabuf_info: Information for dma-buf shared memory pool
+ *
+ * Start and end of pools will must be page aligned.
+ *
+ * Allocation with the flag TEE_SHM_DMA_BUF set will use the range supplied
+ * in @dmabuf, others will use the range provided by @priv.
+ *
+ * @returns pointer to a 'struct tee_shm_pool' or an ERR_PTR on failure.
+ */
+struct tee_shm_pool *
+tee_shm_pool_alloc_res_mem(struct tee_shm_pool_mem_info *priv_info,
+ struct tee_shm_pool_mem_info *dmabuf_info)
+{
+ struct tee_shm_pool_mgr *priv_mgr;
+ struct tee_shm_pool_mgr *dmabuf_mgr;
+ void *rc;
+
+ /*
+ * Create the pool for driver private shared memory
+ */
+ rc = tee_shm_pool_mgr_alloc_res_mem(priv_info->vaddr, priv_info->paddr,
+ priv_info->size,
+ 3 /* 8 byte aligned */);
+ if (IS_ERR(rc))
+ return rc;
+ priv_mgr = rc;
+
+ /*
+ * Create the pool for dma_buf shared memory
+ */
+ rc = tee_shm_pool_mgr_alloc_res_mem(dmabuf_info->vaddr,
+ dmabuf_info->paddr,
+ dmabuf_info->size, PAGE_SHIFT);
+ if (IS_ERR(rc))
+ goto err_free_priv_mgr;
+ dmabuf_mgr = rc;
+
+ rc = tee_shm_pool_alloc(priv_mgr, dmabuf_mgr);
+ if (IS_ERR(rc))
+ goto err_free_dmabuf_mgr;
+
+ return rc;
+
+err_free_dmabuf_mgr:
+ tee_shm_pool_mgr_destroy(dmabuf_mgr);
+err_free_priv_mgr:
+ tee_shm_pool_mgr_destroy(priv_mgr);
+
+ return rc;
+}
+EXPORT_SYMBOL_GPL(tee_shm_pool_alloc_res_mem);
+
+struct tee_shm_pool_mgr *tee_shm_pool_mgr_alloc_res_mem(unsigned long vaddr,
+ phys_addr_t paddr,
+ size_t size,
+ int min_alloc_order)
+{
+ const size_t page_mask = PAGE_SIZE - 1;
+ struct tee_shm_pool_mgr *mgr;
+ int rc;
+
+ /* Start and end must be page aligned */
+ if (vaddr & page_mask || paddr & page_mask || size & page_mask)
+ return ERR_PTR(-EINVAL);
+
+ mgr = kzalloc(sizeof(*mgr), GFP_KERNEL);
+ if (!mgr)
+ return ERR_PTR(-ENOMEM);
+
+ mgr->private_data = gen_pool_create(min_alloc_order, -1);
+ if (!mgr->private_data) {
+ rc = -ENOMEM;
+ goto err;
+ }
+
+ gen_pool_set_algo(mgr->private_data, gen_pool_best_fit, NULL);
+ rc = gen_pool_add_virt(mgr->private_data, vaddr, paddr, size, -1);
+ if (rc) {
+ gen_pool_destroy(mgr->private_data);
+ goto err;
+ }
+
+ mgr->ops = &pool_ops_generic;
+
+ return mgr;
+err:
+ kfree(mgr);
+
+ return ERR_PTR(rc);
+}
+EXPORT_SYMBOL_GPL(tee_shm_pool_mgr_alloc_res_mem);
+
+static bool check_mgr_ops(struct tee_shm_pool_mgr *mgr)
+{
+ return mgr && mgr->ops && mgr->ops->alloc && mgr->ops->free &&
+ mgr->ops->destroy_poolmgr;
+}
+
+struct tee_shm_pool *tee_shm_pool_alloc(struct tee_shm_pool_mgr *priv_mgr,
+ struct tee_shm_pool_mgr *dmabuf_mgr)
+{
+ struct tee_shm_pool *pool;
+
+ if (!check_mgr_ops(priv_mgr) || !check_mgr_ops(dmabuf_mgr))
+ return ERR_PTR(-EINVAL);
+
+ pool = kzalloc(sizeof(*pool), GFP_KERNEL);
+ if (!pool)
+ return ERR_PTR(-ENOMEM);
+
+ pool->private_mgr = priv_mgr;
+ pool->dma_buf_mgr = dmabuf_mgr;
+
+ return pool;
+}
+EXPORT_SYMBOL_GPL(tee_shm_pool_alloc);
+
+/**
+ * tee_shm_pool_free() - Free a shared memory pool
+ * @pool: The shared memory pool to free
+ *
+ * There must be no remaining shared memory allocated from this pool when
+ * this function is called.
+ */
+void tee_shm_pool_free(struct tee_shm_pool *pool)
+{
+ if (pool->private_mgr)
+ tee_shm_pool_mgr_destroy(pool->private_mgr);
+ if (pool->dma_buf_mgr)
+ tee_shm_pool_mgr_destroy(pool->dma_buf_mgr);
+ kfree(pool);
+}
+EXPORT_SYMBOL_GPL(tee_shm_pool_free);
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/Kconfig b/src/kernel/linux/v4.19/drivers/tee/tkcore/Kconfig
new file mode 100644
index 0000000..bc64008
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/Kconfig
@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2015-2019 TrustKernel Incorporated
+
+config TRUSTKERNEL_TEE_SUPPORT
+ bool "TrustKernel Trusted Execution Environment Support"
+ default n
+ help
+ Enable the support of TrustKernel TEE drivers.
+ All Trustkernel related functions will depend on this option.
+ Say Y if you would like yo enable this feature.
+ If unsure, say N.
+
+config TRUSTKERNEL_TEE_FP_SUPPORT
+ bool "TrustKernel Trusted Execution Environment Finger Print Support"
+ depends on TRUSTKERNEL_TEE_SUPPORT
+ default n
+ help
+ Enable TrustKernel TEE clock management mechanism.
+ This feature allows TEE OS to manage clock already
+ used by Linux.
+ Say Y if you would like yo enable this feature.
+ If unsure, say Y.
+
+config TRUSTKERNEL_TEE_RPMB_SUPPORT
+ bool "TrustKernel Trusted Execution Environment RPMB Support"
+ depends on TRUSTKERNEL_TEE_SUPPORT
+ default n
+ help
+ Enable the access of Replay Protected Memory Block
+ region for Trustkernel TEE.
+ Say Y if you would like yo enable this feature.
+ If unsure, say Y.
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/Makefile b/src/kernel/linux/v4.19/drivers/tee/tkcore/Makefile
new file mode 100644
index 0000000..6e645cf
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/Makefile
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2015-2019 TrustKernel Incorporated
+
+obj-$(CONFIG_TRUSTKERNEL_TEE_SUPPORT) += core/
+obj-$(CONFIG_TRUSTKERNEL_TEE_SUPPORT) += armtz/
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/Makefile b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/Makefile
new file mode 100644
index 0000000..d3cb173
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/Makefile
@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2015-2019 TrustKernel Incorporated
+
+ifneq ($(strip $(M)),)
+ obj-m += tkcore_drv.o
+else
+ obj-y += tkcore_drv.o
+endif
+
+M ?= $(srctree)/drivers/tee/tkcore
+
+ccflags-y += -I$(M)/include/arm_common
+ccflags-y += -I$(M)/include/linux
+ccflags-y += -I$(M)/include
+ccflags-y += -I$(M)/core
+
+ifeq ($(CONFIG_TRUSTKERNEL_TEE_RPMB_SUPPORT),y)
+ccflags-y += -DRPMB_SUPPORT
+endif
+
+tkcore_drv-objs:= \
+ tee_tz_drv.o \
+ tee_smc_xfer.o \
+ tee_mem.o \
+ handle.o
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/handle.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/handle.c
new file mode 100644
index 0000000..2c029dc
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/handle.c
@@ -0,0 +1,80 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/slab.h>
+#include <linux/string.h>
+#include "handle.h"
+
+/*
+ * Define the initial capacity of the database. It should be a low number
+ * multiple of 2 since some databases a likely to only use a few handles.
+ * Since the algorithm is to doubles up when growing it shouldn't cause a
+ * noticeable overhead on large databases.
+ */
+#define HANDLE_DB_INITIAL_MAX_PTRS 4
+
+void handle_db_destroy(struct handle_db *db)
+{
+ if (db) {
+ kfree(db->ptrs);
+ db->ptrs = NULL;
+ db->max_ptrs = 0;
+ }
+}
+
+int handle_get(struct handle_db *db, void *ptr)
+{
+ unsigned int n;
+ void *p;
+ unsigned int new_max_ptrs;
+
+ if (!db || !ptr)
+ return -1;
+
+ /* Try to find an empty location */
+ for (n = 0; n < db->max_ptrs; n++) {
+ if (!db->ptrs[n]) {
+ db->ptrs[n] = ptr;
+ return n;
+ }
+ }
+
+ /* No location available, grow the ptrs array */
+ if (db->max_ptrs)
+ new_max_ptrs = db->max_ptrs * 2;
+ else
+ new_max_ptrs = HANDLE_DB_INITIAL_MAX_PTRS;
+ p = krealloc(db->ptrs, new_max_ptrs * sizeof(void *), GFP_KERNEL);
+ if (!p)
+ return -1;
+ db->ptrs = p;
+ memset(db->ptrs + db->max_ptrs, 0,
+ (new_max_ptrs - db->max_ptrs) * sizeof(void *));
+ db->max_ptrs = new_max_ptrs;
+
+ /* Since n stopped at db->max_ptrs there is an empty location there */
+ db->ptrs[n] = ptr;
+ return n;
+}
+
+void *handle_put(struct handle_db *db, int handle)
+{
+ void *p;
+
+ if (!db || handle < 0 || (unsigned int) handle >= db->max_ptrs)
+ return NULL;
+
+ p = db->ptrs[handle];
+ db->ptrs[handle] = NULL;
+ return p;
+}
+
+void *handle_lookup(struct handle_db *db, int handle)
+{
+ if (!db || handle < 0 || (unsigned int) handle >= db->max_ptrs)
+ return NULL;
+
+ return db->ptrs[handle];
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/handle.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/handle.h
new file mode 100644
index 0000000..cdf8715
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/handle.h
@@ -0,0 +1,45 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_HANDLE_H
+#define TEE_HANDLE_H
+
+struct handle_db {
+ void **ptrs;
+ unsigned int max_ptrs;
+};
+
+#define HANDLE_DB_INITIALIZER { NULL, 0 }
+
+/*
+ * Frees all internal data structures of the database, but does not free
+ * the db pointer. The database is safe to reuse after it's destroyed, it
+ * just be empty again.
+ */
+void handle_db_destroy(struct handle_db *db);
+
+/*
+ * Allocates a new handle and assigns the supplied pointer to it,
+ * ptr must not be NULL.
+ * The function returns
+ * >= 0 on success and
+ * -1 on failure
+ */
+int handle_get(struct handle_db *db, void *ptr);
+
+/*
+ * Deallocates a handle. Returns the associated pointer of the handle
+ * the the handle was valid or NULL if it's invalid.
+ */
+void *handle_put(struct handle_db *db, int handle);
+
+/*
+ * Returns the associated pointer of the handle if the handle is a valid
+ * handle.
+ * Returns NULL on failure.
+ */
+void *handle_lookup(struct handle_db *db, int handle);
+
+#endif /*HANDLE_H*/
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_mem.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_mem.c
new file mode 100644
index 0000000..0a14d45
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_mem.c
@@ -0,0 +1,615 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/slab.h>
+
+#include "tee_mem.h"
+
+#define _DUMP_INFO_ALLOCATOR 0
+#define USE_DEVM_ALLOC 1
+
+#ifndef USE_DEVM_ALLOC
+#define _KMALLOC(s, f) kmalloc(s, f)
+#define _KFREE(a) kfree(a)
+#else
+#define _KMALLOC(s, f) devm_kzalloc(dev, s, f)
+#define _KFREE(a) devm_kfree(dev, a)
+#endif
+
+/**
+ * \struct mem_chunk
+ * \brief Elementary descriptor of an allocated memory block
+ *
+ * \param node Node for linked list
+ * \param counter Reference counter
+ * (0 indicates that the block is not used/freed)
+ * \param size Total size in bytes
+ * \param paddr Physical base address
+ *
+ * Elementary memory block definition
+ */
+struct mem_chunk {
+ struct list_head node;
+ uint32_t counter;
+ size_t size;
+ unsigned long paddr;
+};
+
+/**
+ * \struct shm_pool
+ * \brief Main structure to describe a shared memory pool
+ *
+ * \param size Total size in bytes of the associated memory region
+ * \param vaddr Logical base address
+ * \param paddr Physical base address
+ * \param used Total size in bytes of the used memory
+ * \param mchunks List head for handle the elementary memory blocks
+ *
+ * Shared memory pool structure definition
+ */
+struct shm_pool {
+ struct mutex lock;
+ size_t size; /* Size of pool/heap memory segment */
+ size_t used; /* Number of bytes allocated */
+ void *vaddr; /* Associated Virtual address */
+ unsigned long paddr; /* Associated Physical address */
+ bool cached; /* true if pool is cacheable */
+ struct list_head mchunks; /* Head of memory chunk/block list */
+};
+
+#define __CALCULATE_RATIO_MEM_USED(a) (((a->used)*100)/(a->size))
+
+/**
+ * \brief Dumps the information of the shared memory pool
+ *
+ * \param pool Pointer on the pool
+ * \param detailforced Flag to force the log for the detailed information
+ *
+ * Dump/log the meta data of the shared memory pool on the standard output.
+ *
+ */
+void tee_shm_pool_dump(struct device *dev, struct shm_pool *pool, bool forced)
+{
+ struct mem_chunk *chunk;
+
+ if (WARN_ON(!dev || !pool))
+ return;
+
+ pr_info(
+ "%s() poolH(0x%p) pAddr=0x%p vAddr=0x%p size=%zu used=%zu(%zu%%)\n",
+ __func__,
+ (void *) pool,
+ (void *) pool->paddr,
+ (void *) pool->vaddr,
+ pool->size, pool->used, __CALCULATE_RATIO_MEM_USED(pool));
+
+ if ((pool->used != 0) || (forced == true)) {
+ pr_info(" \\ HEAD next:[0x%p] prev:[0x%p]\n",
+ (void *)pool->mchunks.next,
+ (void *)pool->mchunks.prev);
+
+ pr_info(
+ " |-[@] next prev pAddr size refCount\n");
+
+ list_for_each_entry(chunk, &pool->mchunks, node) {
+ pr_info(" | [0x%p] 0x%p 0x%p 0x%p %08zu %d\n",
+ (void *)chunk,
+ (void *)chunk->node.next,
+ (void *)chunk->node.prev,
+ (void *)chunk->paddr,
+ chunk->size, chunk->counter);
+ }
+ }
+}
+
+bool tee_shm_pool_is_cached(struct shm_pool *pool)
+{
+ return pool->cached;
+}
+
+void tee_shm_pool_set_cached(struct shm_pool *pool)
+{
+ pool->cached = true;
+}
+
+/**
+ * \brief Creates and returns a new shared memory pool manager structure
+ *
+ * \param shm_size Size of the associated memory chunk
+ * \param shm_vaddr Virtual/logical base address
+ * \param shm_paddr Physical base address
+ *
+ * \return Reference of the created shared memory pool manager
+ *
+ * Create and initialize a shared memory pool manager.
+ * The description of the memory region (shm_size, shm_vaddr, shm_paddr)
+ * which is passed should be a physically AND virtually contiguous
+ * (no check is performed by the function).
+ * If a error is detected returned pool is NULL.
+ */
+struct shm_pool *tee_shm_pool_create(struct device *dev, size_t shm_size,
+ void *shm_vaddr, unsigned long shm_paddr)
+{
+ struct mem_chunk *chunk = NULL;
+ struct shm_pool *pool = NULL;
+
+ if (WARN_ON(!dev))
+ goto alloc_failed;
+
+ /* Alloc and initialize the shm_pool structure */
+ pool = _KMALLOC(sizeof(struct shm_pool), GFP_KERNEL);
+ if (!pool) {
+ pr_err("kmalloc <struct shm_pool> failed\n");
+ goto alloc_failed;
+ }
+ memset(pool, 0, sizeof(*pool));
+ mutex_init(&pool->lock);
+ mutex_lock(&pool->lock);
+
+ INIT_LIST_HEAD(&(pool->mchunks));
+ pool->size = shm_size;
+ pool->vaddr = shm_vaddr;
+ pool->paddr = shm_paddr;
+
+ /* Create the initial elementary memory chunk */
+ /* which handles the whole memory region */
+ chunk = _KMALLOC(sizeof(struct mem_chunk), GFP_KERNEL);
+ if (!chunk) {
+ pr_err("kmalloc <struct MemChunk> failed\n");
+ goto alloc_failed;
+ }
+ memset(chunk, 0, sizeof(*chunk));
+ chunk->paddr = shm_paddr;
+ chunk->size = shm_size;
+
+ /* Adds the new entry immediately after the list head */
+ list_add(&(chunk->node), &(pool->mchunks));
+
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 0)
+ tee_shm_pool_dump(dev, pool, true);
+#endif
+
+ mutex_unlock(&pool->lock);
+ return pool;
+
+alloc_failed:
+ if (chunk)
+ _KFREE(chunk);
+
+ if (pool)
+ _KFREE(pool);
+
+ return NULL;
+}
+
+/**
+ * Local helper function to check that the physical address is valid
+ */
+static inline int is_valid_paddr(struct shm_pool *pool, unsigned long paddr)
+{
+ return (paddr >= pool->paddr && paddr < (pool->paddr + pool->size));
+}
+
+/**
+ * Local helper function to check that the virtual address is valid
+ */
+static inline int is_valid_vaddr(struct shm_pool *pool, void *vaddr)
+{
+ return (vaddr >= pool->vaddr && vaddr < (pool->vaddr + pool->size));
+}
+
+/**
+ * \brief Destroy the shared memory pool manager
+ *
+ * \param pool Pointer on the pool
+ *
+ * Destroy a memory pool manager
+ *
+ */
+void tee_shm_pool_destroy(struct device *dev, struct shm_pool *pool)
+{
+ struct mem_chunk *chunk;
+
+ if (WARN_ON(!dev || !pool))
+ return;
+
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 0)
+ tee_shm_pool_dump(dev, pool, true);
+#endif
+
+ tee_shm_pool_reset(dev, pool);
+
+ chunk = list_first_entry(&pool->mchunks, struct mem_chunk, node);
+
+ _KFREE(chunk);
+ _KFREE(pool);
+
+}
+
+/**
+ * \brief Free all reserved chunk if any, and set pool at it initial state
+ *
+ * \param pool Pointer on the pool
+ *
+ */
+void tee_shm_pool_reset(struct device *dev, struct shm_pool *pool)
+{
+ struct mem_chunk *chunk;
+ struct mem_chunk *tmp;
+ struct mem_chunk *first = NULL;
+
+ if (WARN_ON(!dev || !pool))
+ return;
+
+ mutex_lock(&pool->lock);
+
+ list_for_each_entry_safe(chunk, tmp, &pool->mchunks, node) {
+ if (first != NULL) {
+ pr_err("Free lost chunkH=0x%p\n", (void *)chunk);
+ list_del(&chunk->node);
+ _KFREE(chunk);
+ } else
+ first = chunk;
+ }
+
+ first->counter = 0;
+ first->paddr = pool->paddr;
+ first->size = pool->size;
+ pool->used = 0;
+
+ mutex_unlock(&pool->lock);
+}
+
+/**
+ * \brief Return the logical address
+ *
+ * \param pool Pointer on the pool
+ * \param paddr Physical address
+ *
+ * \return Virtual/logical address
+ *
+ * Return the associated virtual/logical address. The address should be inside
+ * the range of addresses managed by the shm pool.
+ *
+ */
+void *tee_shm_pool_p2v(struct device *dev, struct shm_pool *pool,
+ unsigned long paddr)
+{
+ unsigned long offset;
+ void *p;
+
+ if (WARN_ON(!dev || !pool))
+ return NULL;
+
+ mutex_lock(&pool->lock);
+ if (!is_valid_paddr(pool, paddr)) {
+ mutex_unlock(&pool->lock);
+ pr_err("%s() paddr=0x%p not in the shm pool\n",
+ __func__,
+ (void *) paddr);
+ return NULL;
+ }
+
+ offset = paddr - pool->paddr;
+ p = (void *)((unsigned long)pool->vaddr + offset);
+
+ mutex_unlock(&pool->lock);
+
+ return p;
+}
+
+/**
+ * \brief Return the physical address
+ *
+ * \param pool Pointer on the pool
+ * \param vaddr Logical/Virtual address
+ *
+ * \return Physical address
+ *
+ * Return the associated physical address. The address should be inside
+ * the range of addresses managed by the pool.
+ *
+ */
+unsigned long tee_shm_pool_v2p(struct device *dev, struct shm_pool *pool,
+ void *vaddr)
+{
+ unsigned long offset, p;
+
+ if (WARN_ON(!dev || !pool))
+ return 0UL;
+
+ mutex_lock(&pool->lock);
+ if (!is_valid_vaddr(pool, vaddr)) {
+ pr_err("%s() vaddr=0x%p not in shm pool\n",
+ __func__, (void *) vaddr);
+ mutex_unlock(&pool->lock);
+ return 0UL;
+ }
+
+ offset = vaddr - pool->vaddr;
+ p = pool->paddr + offset;
+
+ mutex_unlock(&pool->lock);
+ return p;
+}
+
+/**
+ * \brief Allocate a new block of memory
+ *
+ * \param pool Pointer on the pool
+ * \param size Expected size (in byte)
+ * \param alignment Alignment constraint (in byte)
+ *
+ * \return Physical base address of the allocated block
+ *
+ * Allocate a memory chunk inside the memory region managed by the pool.
+ *
+ */
+unsigned long tkcore_shm_pool_alloc(struct device *dev,
+ struct shm_pool *pool,
+ size_t size, size_t alignment)
+{
+ struct mem_chunk *chunk;
+ struct mem_chunk *betterchunk = NULL;
+ struct mem_chunk *prev_chunk = NULL;
+ struct mem_chunk *next_chunk = NULL;
+ unsigned long begAddr;
+ unsigned long endAddr;
+
+ if (WARN_ON(!dev || !pool))
+ return 0UL;
+
+ /* Align on cache line of the target */
+ /* \todo(jmd) Should be defined by a global target specific parameter */
+ /* size = (size + (32-1)) & ~(32-1) */
+
+ if (ALIGN(size, 0x20) < size)
+ goto failed_out;
+
+ if (alignment == 0)
+ alignment = 1;
+
+ size = ALIGN(size, 0x20);
+
+ alignment = ALIGN(alignment, 0x20);
+
+ if (size > (pool->size - pool->used))
+ goto failed_out;
+
+ mutex_lock(&pool->lock);
+
+ /**
+ * Algorithm: Smallest waste (best fit):
+ * We choose the block that has the
+ * smallest waste. In other words we choose
+ * the block so that
+ * size(b) - size is as small as possible.
+ */
+ list_for_each_entry(chunk, &pool->mchunks, node) {
+ if (chunk->counter == 0) { /* Free chunk */
+ begAddr = ALIGN(chunk->paddr, alignment);
+ endAddr = begAddr + size;
+
+ if (begAddr >= chunk->paddr
+ && endAddr <= (chunk->paddr + chunk->size)
+ && (betterchunk == NULL
+ /* Always split smaller block */
+ || chunk->size < betterchunk->size))
+ betterchunk = chunk;
+ }
+ }
+
+ /**
+ * Update the linked list
+ */
+ if (betterchunk != NULL) {
+ prev_chunk = _KMALLOC(sizeof(struct mem_chunk), GFP_KERNEL);
+ next_chunk = _KMALLOC(sizeof(struct mem_chunk), GFP_KERNEL);
+
+ if ((!prev_chunk) || (!next_chunk))
+ goto failed_out_unlock;
+
+ begAddr = ALIGN(betterchunk->paddr, alignment);
+ endAddr = begAddr + size;
+
+ if (betterchunk->paddr < begAddr) {
+ /* memory between begin of chunk and begin
+ * of created memory => create a free chunk
+ */
+ prev_chunk->counter = 0;
+ prev_chunk->paddr = betterchunk->paddr;
+ prev_chunk->size = begAddr - betterchunk->paddr;
+
+ betterchunk->paddr = begAddr;
+ betterchunk->size -= prev_chunk->size;
+
+ list_add_tail(&(prev_chunk->node),
+ &(betterchunk->node));
+ prev_chunk = NULL;
+ } else
+ _KFREE(prev_chunk);
+
+ if (betterchunk->paddr + betterchunk->size > endAddr) {
+ /* memory between end of chunk and end of
+ * created memory => create a free chunk
+ */
+ next_chunk->counter = 0;
+ next_chunk->paddr = endAddr;
+ next_chunk->size = betterchunk->size - size;
+
+ betterchunk->size = size;
+
+ list_add(&(next_chunk->node), &(betterchunk->node));
+ next_chunk = NULL;
+ } else
+ _KFREE(next_chunk);
+
+ betterchunk->counter = 1;
+ pool->used += size;
+
+ mutex_unlock(&pool->lock);
+
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 1)
+ tee_shm_pool_dump(dev, pool, false);
+#endif
+
+ return betterchunk->paddr;
+ }
+
+failed_out_unlock:
+ mutex_unlock(&pool->lock);
+failed_out:
+ if (prev_chunk)
+ _KFREE(prev_chunk);
+ if (next_chunk)
+ _KFREE(next_chunk);
+
+ pr_err(
+ "%s() FAILED, size=0x%zx, align=0x%zx free=%zu\n",
+ __func__, size, alignment, pool->size - pool->used);
+
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 1)
+ tee_shm_pool_dump(dev, pool, true);
+#endif
+
+ return 0UL;
+}
+
+/**
+ * \brief Release a allocated block of memory
+ *
+ * \param pool Pointer on the pool
+ * \param paddr Physical @ of the block which must be released
+ * \param size Reference to return the size of the block
+ *
+ * Free a allocated memory block inside
+ * the memory region managed by the pool.
+ *
+ */
+int tkcore_shm_pool_free(struct device *dev, struct shm_pool *pool,
+ unsigned long paddr, size_t *size)
+{
+ struct mem_chunk *chunk;
+
+ if (WARN_ON(!dev || !pool))
+ return -EINVAL;
+
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 1)
+ tee_shm_pool_dump(dev, pool, false);
+#endif
+
+ mutex_lock(&pool->lock);
+
+ if (!is_valid_paddr(pool, paddr))
+ goto out_failed;
+
+ list_for_each_entry(chunk, &pool->mchunks, node) {
+ if (chunk->paddr == paddr) {
+ if (size != NULL)
+ *size = chunk->size;
+
+ if (chunk->counter == 0) {
+ pr_warn(
+ "< %s() WARNING, paddr=0x%p already released\n",
+ __func__, (void *) paddr);
+ return -EINVAL;
+ } else if (--chunk->counter == 0) {
+
+ pool->used -= chunk->size;
+
+ /* Merge with previous */
+ if (chunk->node.prev != &pool->mchunks) {
+ struct mem_chunk *prev =
+ list_entry(chunk->node.prev,
+ struct mem_chunk, node);
+ if (prev->counter == 0) {
+ prev->size += chunk->size;
+ list_del(&chunk->node);
+ _KFREE(chunk);
+ chunk = prev;
+ }
+ }
+ /* Merge with next */
+ if (chunk->node.next != &pool->mchunks) {
+ struct mem_chunk *next =
+ list_entry(chunk->node.next,
+ struct mem_chunk, node);
+ if (next->counter == 0) {
+ chunk->size += next->size;
+ list_del(&next->node);
+ _KFREE(next);
+ }
+ }
+ mutex_unlock(&pool->lock);
+
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 1)
+ tee_shm_pool_dump(dev, pool, false);
+#endif
+ return 0;
+
+ } else {
+ mutex_unlock(&pool->lock);
+ return 1;
+ }
+ }
+ }
+
+out_failed:
+ mutex_unlock(&pool->lock);
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 1)
+ tee_shm_pool_dump(dev, pool, false);
+#endif
+ pr_err(
+ "< %s() FAILED, pAddr=0x%p not found\n",
+ __func__, (void *) paddr);
+ return -EINVAL;
+}
+
+/**
+ * \brief Increase the reference count of the memory chunk
+ *
+ * \param pool Pointer on the pool
+ * \param paddr Physical address
+ *
+ * \return true if successful (false otherwise)
+ *
+ * Increment the reference count of the allocated block of memory.
+ * paddr should a valid address returned by the tkcore_shm_pool_alloc().
+ *
+ */
+bool tee_shm_pool_incref(struct device *dev, struct shm_pool *pool,
+ unsigned long paddr)
+{
+ struct mem_chunk *chunk;
+
+ if (WARN_ON(!dev || !pool))
+ return false;
+
+ mutex_lock(&pool->lock);
+
+ if (!is_valid_paddr(pool, paddr))
+ goto out_failed;
+
+ list_for_each_entry(chunk, &pool->mchunks, node) {
+ if (chunk->paddr == paddr) {
+ chunk->counter++;
+
+#if defined(_DUMP_INFO_ALLOCATOR) && (_DUMP_INFO_ALLOCATOR > 0)
+ tee_shm_pool_dump(dev, pool, false);
+#endif
+ mutex_unlock(&pool->lock);
+ return true;
+ }
+ }
+
+out_failed:
+ mutex_unlock(&pool->lock);
+
+ pr_err(
+ "%s() FAILED, pAddr=%p is not a valid @\n",
+ __func__, (void *) paddr);
+
+ return false;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_mem.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_mem.h
new file mode 100644
index 0000000..5924c9d
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_mem.h
@@ -0,0 +1,42 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_MEM_H
+#define TEE_MEM_H
+
+#include <linux/types.h>
+#include <linux/device.h>
+
+struct shm_pool;
+
+struct shm_pool *tee_shm_pool_create(struct device *dev, size_t shm_size,
+ void *shm_vaddr, unsigned long shm_paddr);
+
+void tee_shm_pool_destroy(struct device *dev, struct shm_pool *pool);
+
+void *tee_shm_pool_p2v(struct device *dev, struct shm_pool *pool,
+ unsigned long paddr);
+
+unsigned long tee_shm_pool_v2p(struct device *dev, struct shm_pool *pool,
+ void *vaddr);
+
+unsigned long tkcore_shm_pool_alloc(struct device *dev,
+ struct shm_pool *pool, size_t size, size_t alignment);
+
+int tkcore_shm_pool_free(struct device *dev, struct shm_pool *pool,
+ unsigned long paddr, size_t *size);
+
+bool tee_shm_pool_incref(struct device *dev, struct shm_pool *pool,
+ unsigned long paddr);
+
+void tee_shm_pool_dump(struct device *dev, struct shm_pool *pool, bool forced);
+
+void tee_shm_pool_reset(struct device *dev, struct shm_pool *pool);
+
+bool tee_shm_pool_is_cached(struct shm_pool *pool);
+
+void tee_shm_pool_set_cached(struct shm_pool *pool);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_smc_xfer.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_smc_xfer.c
new file mode 100644
index 0000000..2b99773
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_smc_xfer.c
@@ -0,0 +1,235 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/spinlock.h>
+#include <linux/wait.h>
+#include <linux/semaphore.h>
+#include <linux/slab.h>
+#include <linux/notifier.h>
+#include <linux/cpu.h>
+#include <linux/list.h>
+#include <linux/atomic.h>
+#include <linux/hrtimer.h>
+#include <linux/ktime.h>
+
+#include <linux/version.h>
+
+#include <linux/tee_clkmgr.h>
+
+#include <tee_kernel_lowlevel_api.h>
+#include <arm_common/teesmc.h>
+
+struct tee_smc_xfer_ctl {
+ /* number of cmds that are not
+ * processed by `tee_smc_daemon` kthreads
+ */
+ atomic_t nr_unbound_cmds;
+ /* guarantee the mutual-exlusiveness of smc */
+ struct mutex xfer_lock;
+
+ /* cmds that wait for
+ * available TEE thread slots
+ */
+ atomic_t nr_waiting_cmds;
+ struct completion smc_comp;
+
+ /* statistics information */
+ s64 max_smc_time;
+ s64 max_cmd_time;
+
+};
+
+static struct tee_smc_xfer_ctl tee_smc_xfer_ctl;
+
+static inline void trace_tee_smc(struct tee_smc_xfer_ctl *ctl, int rv,
+ s64 time_start, s64 time_end)
+{
+ s64 duration = time_end - time_start;
+
+ if (duration > 1000000LL) {
+ pr_warn("WARNING SMC[0x%x] %sDURATION %lld us\n", rv,
+ rv == TEESMC_RPC_FUNC_IRQ ? "IRQ " : "", duration);
+ }
+
+ /* we needn't handle concurrency here. */
+ if (duration > ctl->max_smc_time)
+ ctl->max_smc_time = duration;
+}
+
+static inline void trace_tee_smc_done(struct tee_smc_xfer_ctl *ctl,
+ s64 time_start,
+ s64 time_end)
+{
+ s64 duration = time_end - time_start;
+
+ if (duration > ctl->max_cmd_time)
+ ctl->max_cmd_time = duration;
+}
+
+/* return 0 for nonpreempt rpc, 1 for others */
+static int handle_nonpreempt_rpc(struct smc_param *p)
+{
+ uint32_t func_id = TEESMC_RETURN_GET_RPC_FUNC(p->a0);
+
+ /* for compatibility with legacy tee-os which
+ * does not support clkmgr
+ */
+ if (func_id == T6SMC_RPC_CLKMGR_LEGACY_CMD) {
+ p->a1 = tee_clkmgr_handle(p->a1, p->a2);
+ return 0;
+ }
+
+ if (func_id != T6SMC_RPC_NONPREEMPT_CMD)
+ return 1;
+
+ switch (T6SMC_RPC_NONPREEMPT_GET_FUNC(p->a0)) {
+ case T6SMC_RPC_CLKMGR_CMD:
+ /* compatible with old interface */
+ p->a1 = tee_clkmgr_handle(p->a1,
+ (p->a1 & TEE_CLKMGR_TOKEN_NOT_LEGACY) ?
+ p->a2 : (p->a2 | TEE_CLKMGR_OP_ENABLE));
+ break;
+
+ default:
+ pr_err("Unknown non-preempt rpc cmd: 0x%llx\n",
+ (unsigned long long) p->a0);
+ }
+
+ return 0;
+}
+
+static void tee_smc_work(struct tee_smc_xfer_ctl *ctl, struct smc_param *p)
+{
+ s64 start, end;
+
+
+ u64 rv = p->a0 == TEESMC32_FASTCALL_WITH_ARG ?
+ TEESMC32_FASTCALL_RETURN_FROM_RPC :
+ TEESMC32_CALL_RETURN_FROM_RPC;
+
+ /* we need to place atomic_inc ahead of xfer_lock
+ * in order that an smc-execution thread can
+ * see other pending commands without releasing
+ * xfer_lock
+ */
+ atomic_inc(&ctl->nr_unbound_cmds);
+
+ mutex_lock(&ctl->xfer_lock);
+
+ start = ktime_to_us(ktime_get());
+
+ while (1) {
+
+ s64 a = ktime_to_us(ktime_get()), b;
+
+ tee_smc_call(p);
+
+ b = ktime_to_us(ktime_get());
+ trace_tee_smc(ctl, TEESMC_RETURN_GET_RPC_FUNC(p->a0), a, b);
+
+ if (!TEESMC_RETURN_IS_RPC(p->a0))
+ goto smc_return;
+
+ if (handle_nonpreempt_rpc(p)) {
+ if (TEESMC_RETURN_GET_RPC_FUNC(p->a0)
+ != TEESMC_RPC_FUNC_IRQ)
+ goto smc_return;
+ }
+ p->a0 = rv;
+ }
+
+smc_return:
+
+ atomic_dec(&ctl->nr_unbound_cmds);
+
+ mutex_unlock(&ctl->xfer_lock);
+
+ end = ktime_to_us(ktime_get());
+
+ trace_tee_smc_done(ctl, start, end);
+}
+
+
+static inline void __smc_xfer(struct tee_smc_xfer_ctl *ctl, struct smc_param *p)
+{
+ tee_smc_work(ctl, p);
+}
+
+static int platform_bl_init(struct tee_smc_xfer_ctl *ctl)
+{
+ return 0;
+}
+
+static void platform_bl_deinit(struct tee_smc_xfer_ctl *ctl) { }
+
+static void xfer_enqueue_waiters(struct tee_smc_xfer_ctl *ctl)
+{
+ /*TODO handle too long time of waiting */
+ atomic_inc(&ctl->nr_waiting_cmds);
+ wait_for_completion(&ctl->smc_comp);
+}
+
+static void xfer_dequeue_waiters(struct tee_smc_xfer_ctl *ctl)
+{
+ if (atomic_dec_if_positive(&ctl->nr_waiting_cmds) >= 0)
+ complete(&ctl->smc_comp);
+}
+
+void __call_tee(struct smc_param *p)
+{
+ /* NOTE!!! we remove the e_lock_teez(ptee) here !!!! */
+#ifdef ARM64
+ uint64_t orig_a0 = p->a0;
+#else
+ uint32_t orig_a0 = p->a0;
+#endif
+ for (;;) {
+ __smc_xfer(&tee_smc_xfer_ctl, p);
+ if (p->a0 == TEESMC_RETURN_ETHREAD_LIMIT) {
+ xfer_enqueue_waiters(&tee_smc_xfer_ctl);
+ p->a0 = orig_a0;
+ } else {
+ if (!TEESMC_RETURN_IS_RPC(p->a0))
+ xfer_dequeue_waiters(&tee_smc_xfer_ctl);
+ break;
+ }
+ }
+}
+
+inline void smc_xfer(struct smc_param *p)
+{
+ __smc_xfer(&tee_smc_xfer_ctl, p);
+}
+
+int tee_init_smc_xfer(void)
+{
+ int r;
+ struct tee_smc_xfer_ctl *ctl = &tee_smc_xfer_ctl;
+
+ atomic_set(&ctl->nr_unbound_cmds, 0);
+ mutex_init(&ctl->xfer_lock);
+
+ atomic_set(&ctl->nr_waiting_cmds, 0);
+ init_completion(&ctl->smc_comp);
+
+ ctl->max_smc_time = 0LL;
+ ctl->max_cmd_time = 0LL;
+
+ r = platform_bl_init(ctl);
+ if (r < 0)
+ goto err;
+
+ return 0;
+
+err:
+ return r;
+}
+
+void tee_exit_smc_xfer(void)
+{
+ struct tee_smc_xfer_ctl *ctl = &tee_smc_xfer_ctl;
+
+ platform_bl_deinit(ctl);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_smc_xfer.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_smc_xfer.h
new file mode 100644
index 0000000..30a2d00
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_smc_xfer.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_SMC_XFER_H
+#define TEE_SMC_XFER_H
+
+struct smc_param;
+
+void smc_xfer(struct smc_param *p);
+void __call_tee(struct smc_param *p);
+
+int tee_init_smc_xfer(void);
+void tee_exit_smc_xfer(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_drv.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_drv.c
new file mode 100644
index 0000000..8230ae9
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_drv.c
@@ -0,0 +1,1316 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/module.h>
+#include <linux/mod_devicetable.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
+#include <linux/sched.h>
+#include <linux/jiffies.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#include <linux/init.h>
+
+#include <linux/tee_core.h>
+#include <linux/tee_ioc.h>
+
+#include <tee_shm.h>
+#include <tee_supp_com.h>
+#include <tee_wait_queue.h>
+
+#include <arm_common/teesmc.h>
+#include <arm_common/teesmc_st.h>
+
+#include "asm/io.h"
+#include "tee_mem.h"
+#include "tee_tz_op.h"
+#include "tee_tz_priv.h"
+#include "handle.h"
+#include "tee_smc_xfer.h"
+
+#include "tee_procfs.h"
+#include "pm.h"
+
+#define _TEE_TZ_NAME "tkcoredrv"
+#define DEV (ptee->tee->dev)
+
+/* #define TEE_STRESS_OUTERCACHE_FLUSH */
+
+/* magic config: bit 1 is set, Secure TEE shall handler NSec IRQs */
+#define SEC_ROM_NO_FLAG_MASK 0x0000
+#define SEC_ROM_IRQ_ENABLE_MASK 0x0001
+#define SEC_ROM_DEFAULT SEC_ROM_IRQ_ENABLE_MASK
+#define TEE_RETURN_BUSY 0x3
+#define ALLOC_ALIGN SZ_4K
+
+#define CAPABLE(tee) !(tee->conf & TEE_CONF_FW_NOT_CAPABLE)
+
+static struct tee_tz *tee_tz;
+
+static struct handle_db shm_handle_db = HANDLE_DB_INITIALIZER;
+
+/*******************************************************************
+ * Calling TEE
+ *******************************************************************/
+
+static void handle_rpc_func_cmd_wait_queue(struct tee_tz *ptee,
+ struct teesmc32_arg *arg32)
+{
+ struct teesmc32_param *params;
+
+ if (arg32->num_params != 2)
+ goto bad;
+
+ params = TEESMC32_GET_PARAMS(arg32);
+
+ if ((params[0].attr & TEESMC_ATTR_TYPE_MASK) !=
+ TEESMC_ATTR_TYPE_VALUE_INPUT)
+ goto bad;
+ if ((params[1].attr & TEESMC_ATTR_TYPE_MASK) !=
+ TEESMC_ATTR_TYPE_NONE)
+ goto bad;
+
+ switch (arg32->cmd) {
+ case TEE_RPC_WAIT_QUEUE_SLEEP:
+ tee_wait_queue_sleep(DEV, &ptee->wait_queue,
+ params[0].u.value.a);
+ break;
+ case TEE_RPC_WAIT_QUEUE_WAKEUP:
+ tee_wait_queue_wakeup(DEV, &ptee->wait_queue,
+ params[0].u.value.a);
+ break;
+ default:
+ goto bad;
+ }
+
+ arg32->ret = TEEC_SUCCESS;
+ return;
+bad:
+ arg32->ret = TEEC_ERROR_BAD_PARAMETERS;
+}
+
+
+
+static void handle_rpc_func_cmd_wait(struct teesmc32_arg *arg32)
+{
+ struct teesmc32_param *params;
+ u32 msec_to_wait;
+
+ if (arg32->num_params != 1)
+ goto bad;
+
+ params = TEESMC32_GET_PARAMS(arg32);
+ msec_to_wait = params[0].u.value.a;
+
+ /* set task's state to interruptible sleep */
+ set_current_state(TASK_INTERRUPTIBLE);
+
+ /* take a nap */
+ schedule_timeout(msecs_to_jiffies(msec_to_wait));
+
+ arg32->ret = TEEC_SUCCESS;
+ return;
+bad:
+ arg32->ret = TEEC_ERROR_BAD_PARAMETERS;
+}
+
+static void handle_rpc_func_cmd_to_supplicant(struct tee_tz *ptee,
+ struct teesmc32_arg *arg32)
+{
+ struct teesmc32_param *params;
+ struct tee_rpc_invoke inv;
+ size_t n;
+ uint32_t ret;
+
+ if (arg32->num_params > TEE_RPC_BUFFER_NUMBER) {
+ arg32->ret = TEEC_ERROR_GENERIC;
+ return;
+ }
+
+ params = TEESMC32_GET_PARAMS(arg32);
+
+ memset(&inv, 0, sizeof(inv));
+ inv.cmd = arg32->cmd;
+ /*
+ * Set a suitable error code in case teed
+ * ignores the request.
+ */
+ inv.res = TEEC_ERROR_NOT_IMPLEMENTED;
+ inv.nbr_bf = arg32->num_params;
+ for (n = 0; n < arg32->num_params; n++) {
+ switch (params[n].attr & TEESMC_ATTR_TYPE_MASK) {
+ case TEESMC_ATTR_TYPE_VALUE_INPUT:
+ case TEESMC_ATTR_TYPE_VALUE_INOUT:
+ inv.cmds[n].fd = (int)params[n].u.value.a;
+ /* Fall through */
+ case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
+ inv.cmds[n].type = TEE_RPC_VALUE;
+ break;
+ case TEESMC_ATTR_TYPE_MEMREF_INPUT:
+ case TEESMC_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEESMC_ATTR_TYPE_MEMREF_INOUT:
+ inv.cmds[n].buffer =
+ (void *)(uintptr_t)params[n].u.memref.buf_ptr;
+ inv.cmds[n].size = params[n].u.memref.size;
+ inv.cmds[n].type = TEE_RPC_BUFFER;
+ break;
+ default:
+ arg32->ret = TEEC_ERROR_GENERIC;
+ return;
+ }
+ }
+
+ ret = tee_supp_cmd(ptee->tee, TEE_RPC_ICMD_INVOKE,
+ &inv, sizeof(inv));
+ if (ret == TEEC_RPC_OK)
+ arg32->ret = inv.res;
+
+ for (n = 0; n < arg32->num_params; n++) {
+ switch (params[n].attr & TEESMC_ATTR_TYPE_MASK) {
+ case TEESMC_ATTR_TYPE_MEMREF_OUTPUT:
+ case TEESMC_ATTR_TYPE_MEMREF_INOUT:
+ /*
+ * Allow teed to assign a new pointer
+ * to an out-buffer. Needed when the
+ * teed allocates a new buffer, for
+ * instance when loading a TA.
+ */
+ params[n].u.memref.buf_ptr =
+ (uint32_t)(uintptr_t)inv.cmds[n].buffer;
+ params[n].u.memref.size = inv.cmds[n].size;
+ break;
+ case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
+ case TEESMC_ATTR_TYPE_VALUE_INOUT:
+ params[n].u.value.a = inv.cmds[n].fd;
+ break;
+ default:
+ break;
+ }
+ }
+}
+
+#ifdef RPMB_SUPPORT
+
+#include "linux/tee_rpmb.h"
+
+/*
+ * Need to be in consistency with
+ * struct rpmb_req {...} defined in
+ * tee/core/arch/arm/tee/tee_rpmb.c
+ */
+struct tee_rpmb_cmd {
+ uint16_t cmd;
+ uint16_t dev_id;
+ uint32_t req_nr;
+ uint32_t resp_nr;
+};
+
+int rpmb_exec(void *req)
+{
+ return tkcore_emmc_rpmb_execute((struct tkcore_rpmb_request *) req);
+}
+
+#endif
+
+static void handle_rpmb_cmd(struct tee_tz *ptee,
+ struct teesmc32_arg *arg32)
+{
+#ifdef RPMB_SUPPORT
+ uint32_t req_size, resp_size;
+ struct teesmc32_param *params;
+
+ uint8_t *data_frame;
+ struct tee_rpmb_cmd *rpmb_req;
+ struct tkcore_rpmb_request teec_rpmb_req;
+ void *resp;
+
+ if (arg32->num_params != TEE_RPMB_BUFFER_NUMBER) {
+ arg32->ret = TEEC_ERROR_BAD_PARAMETERS;
+ return;
+ }
+
+ params = TEESMC32_GET_PARAMS(arg32);
+
+ if (((params[0].attr & TEESMC_ATTR_TYPE_MASK)
+ != TEESMC_ATTR_TYPE_MEMREF_INPUT) ||
+ ((params[1].attr & TEESMC_ATTR_TYPE_MASK)
+ != TEESMC_ATTR_TYPE_MEMREF_OUTPUT)) {
+ arg32->ret = TEEC_ERROR_GENERIC;
+ return;
+ }
+
+
+ rpmb_req = (struct tee_rpmb_cmd *) tee_shm_pool_p2v(
+ ptee->tee->dev,
+ ptee->shm_pool,
+ params[0].u.memref.buf_ptr);
+
+ if (rpmb_req == NULL) {
+ pr_err("Bad RPC request buffer 0x%x.\n",
+ params[0].u.memref.buf_ptr);
+ arg32->ret = TEEC_ERROR_GENERIC;
+ return;
+ }
+
+ resp = tee_shm_pool_p2v(
+ ptee->tee->dev,
+ ptee->shm_pool,
+ params[1].u.memref.buf_ptr);
+
+ if (resp == NULL) {
+ pr_err("Bad RPC response buffer 0x%x.\n",
+ params[1].u.memref.buf_ptr);
+ arg32->ret = TEEC_ERROR_GENERIC;
+ return;
+ }
+
+ if (rpmb_req->cmd != TEE_RPMB_GET_DEV_INFO) {
+ int r;
+ uint32_t frm_size;
+
+ req_size = rpmb_req->req_nr * 512;
+ resp_size = rpmb_req->resp_nr * 512;
+ frm_size = req_size > resp_size ? req_size : resp_size;
+
+ if (frm_size & (511)) {
+ pr_err("bad RPMB frame size 0x%x\n", frm_size);
+ arg32->ret = TEEC_ERROR_BAD_PARAMETERS;
+ return;
+ }
+
+ teec_rpmb_req.type = rpmb_req->cmd;
+ teec_rpmb_req.blk_cnt = frm_size / 512;
+ /* not used by emmc_rpmb driver */
+ teec_rpmb_req.addr = (uint16_t) 0;
+
+ teec_rpmb_req.data_frame = data_frame = kmalloc(
+ frm_size,
+ GFP_KERNEL);
+
+ if (teec_rpmb_req.data_frame == NULL) {
+ arg32->ret = TEEC_ERROR_OUT_OF_MEMORY;
+ return;
+ }
+
+ memcpy(data_frame,
+ ((uint8_t *) rpmb_req) + sizeof(struct tee_rpmb_cmd),
+ req_size);
+ r = tkcore_stay_awake(rpmb_exec, (void *) &teec_rpmb_req);
+
+ if (r != 0) {
+ pr_err("Bad rpmb_exec: %d\n", r);
+ arg32->ret = (uint32_t) r;
+ } else {
+ arg32->ret = TEEC_SUCCESS;
+ memcpy(resp, data_frame, resp_size);
+ }
+
+ kfree(data_frame);
+ } else {
+ struct tee_rpmb_dev_info *dev_info;
+
+ teec_rpmb_req.type = rpmb_req->cmd;
+ teec_rpmb_req.blk_cnt = 1;
+ /* not used by emmc_rpmb driver */
+ teec_rpmb_req.addr = (uint16_t) 0;
+ teec_rpmb_req.data_frame = (uint8_t *) resp;
+
+ dev_info = (struct tee_rpmb_dev_info *) resp;
+
+ dev_info->ret_code =
+ (uint8_t) tkcore_emmc_rpmb_execute(&teec_rpmb_req);
+
+ arg32->ret = TEEC_SUCCESS;
+ }
+
+#else
+ arg32->ret = TEEC_ERROR_NOT_IMPLEMENTED;
+#endif
+}
+
+
+static void handle_rpc_func_cmd(struct tee_tz *ptee, u32 parg32)
+{
+ struct teesmc32_arg *arg32;
+
+ arg32 = tee_shm_pool_p2v(DEV, ptee->shm_pool, parg32);
+ if (!arg32)
+ return;
+
+ switch (arg32->cmd) {
+ case TEE_RPC_WAIT_QUEUE_SLEEP:
+ case TEE_RPC_WAIT_QUEUE_WAKEUP:
+ handle_rpc_func_cmd_wait_queue(ptee, arg32);
+ break;
+ case TEE_RPC_WAIT:
+ handle_rpc_func_cmd_wait(arg32);
+ break;
+ case TEE_RPC_RPMB_CMD:
+ handle_rpmb_cmd(ptee, arg32);
+ break;
+ default:
+ handle_rpc_func_cmd_to_supplicant(ptee, arg32);
+ }
+}
+
+static struct tee_shm *handle_rpc_alloc(struct tee_tz *ptee, size_t size)
+{
+ struct tee_rpc_alloc rpc_alloc;
+
+ memset((void *) &rpc_alloc, 0, sizeof(struct tee_rpc_alloc));
+
+ rpc_alloc.size = size;
+ tee_supp_cmd(ptee->tee, TEE_RPC_ICMD_ALLOCATE,
+ &rpc_alloc, sizeof(rpc_alloc));
+ return rpc_alloc.shm;
+}
+
+static void handle_rpc_free(struct tee_tz *ptee, struct tee_shm *shm)
+{
+ struct tee_rpc_free rpc_free;
+
+ if (!shm)
+ return;
+ rpc_free.shm = shm;
+ tee_supp_cmd(ptee->tee, TEE_RPC_ICMD_FREE, &rpc_free, sizeof(rpc_free));
+}
+
+static u32 handle_rpc(struct tee_tz *ptee, struct smc_param *param)
+{
+ struct tee_shm *shm;
+ int cookie;
+
+ switch (TEESMC_RETURN_GET_RPC_FUNC(param->a0)) {
+ case TEESMC_RPC_FUNC_ALLOC_ARG:
+ param->a1 =
+ tkcore_shm_pool_alloc(DEV,
+ ptee->shm_pool, param->a1, 4);
+
+ break;
+ case TEESMC_RPC_FUNC_ALLOC_PAYLOAD:
+ /* Can't support payload shared memory with this interface */
+ param->a2 = 0;
+ break;
+ case TEESMC_RPC_FUNC_FREE_ARG:
+ tkcore_shm_pool_free(DEV, ptee->shm_pool, param->a1, 0);
+ break;
+ case TEESMC_RPC_FUNC_FREE_PAYLOAD:
+ /* Can't support payload shared memory with this interface */
+ break;
+ case TEESMC_ST_RPC_FUNC_ALLOC_PAYLOAD:
+ shm = handle_rpc_alloc(ptee, param->a1);
+ if (IS_ERR_OR_NULL(shm)) {
+ param->a1 = 0;
+ break;
+ }
+ cookie = handle_get(&shm_handle_db, shm);
+ if (cookie < 0) {
+ handle_rpc_free(ptee, shm);
+ param->a1 = 0;
+ break;
+ }
+ param->a1 = shm->resv.paddr;
+ param->a2 = cookie;
+ break;
+ case TEESMC_ST_RPC_FUNC_FREE_PAYLOAD:
+ shm = handle_put(&shm_handle_db, param->a1);
+ handle_rpc_free(ptee, shm);
+ break;
+ case TEESMC_RPC_FUNC_CMD:
+ handle_rpc_func_cmd(ptee, param->a1);
+ break;
+ default:
+ pr_warn("Unknown RPC func 0x%x\n",
+ (u32) TEESMC_RETURN_GET_RPC_FUNC(param->a0));
+ break;
+ }
+
+ /* TODO refine this piece of logic. the irq status
+ * can no longer determine whether it's a fastcall
+ * or not
+ */
+ if (irqs_disabled())
+ return TEESMC32_FASTCALL_RETURN_FROM_RPC;
+ else
+ return TEESMC32_CALL_RETURN_FROM_RPC;
+}
+
+static void call_tee(struct tee_tz *ptee, uintptr_t parg32,
+ struct teesmc32_arg *arg32, u32 funcid)
+{
+ u32 ret;
+
+ struct smc_param param = {
+ .a1 = parg32,
+ };
+
+ for (;;) {
+ param.a0 = funcid;
+ __call_tee(¶m);
+
+ if (!TEESMC_RETURN_IS_RPC(param.a0))
+ break;
+
+ funcid = handle_rpc(ptee, ¶m);
+ }
+
+ ret = param.a0;
+
+ if (unlikely(ret != TEESMC_RETURN_OK &&
+ ret != TEESMC_RETURN_UNKNOWN_FUNCTION)) {
+ arg32->ret = TEEC_ERROR_COMMUNICATION;
+ arg32->ret_origin = TEEC_ORIGIN_COMMS;
+ }
+}
+
+static inline void stdcall_tee(struct tee_tz *ptee, uintptr_t parg32,
+ struct teesmc32_arg *arg32)
+{
+ call_tee(ptee, parg32, arg32, TEESMC32_CALL_WITH_ARG);
+}
+
+static inline void fastcall_tee(struct tee_tz *ptee, uintptr_t parg32,
+ struct teesmc32_arg *arg32)
+{
+ call_tee(ptee, parg32, arg32, TEESMC32_FASTCALL_WITH_ARG);
+}
+
+/*******************************************************************
+ * TEE service invoke formating
+ *******************************************************************/
+
+/* allocate tee service argument buffer and return virtual address */
+static void *alloc_tee_arg(struct tee_tz *ptee, unsigned long *p, size_t l)
+{
+ void *vaddr;
+
+ WARN_ON(!CAPABLE(ptee->tee));
+
+ if ((p == NULL) || (l == 0))
+ return NULL;
+
+ /* assume a 4 bytes aligned is sufficient */
+ *p = tkcore_shm_pool_alloc(DEV, ptee->shm_pool, l, ALLOC_ALIGN);
+ if (*p == 0)
+ return NULL;
+
+ vaddr = tee_shm_pool_p2v(DEV, ptee->shm_pool, *p);
+
+
+ return vaddr;
+}
+
+/* free tee service argument buffer (from its physical address) */
+static void free_tee_arg(struct tee_tz *ptee, unsigned long p)
+{
+ WARN_ON(!CAPABLE(ptee->tee));
+
+ if (p)
+ tkcore_shm_pool_free(DEV, ptee->shm_pool, p, 0);
+
+}
+
+static uint32_t get_cache_attrs(struct tee_tz *ptee)
+{
+ if (tee_shm_pool_is_cached(ptee->shm_pool))
+ return TEESMC_ATTR_CACHE_DEFAULT << TEESMC_ATTR_CACHE_SHIFT;
+ else
+ return TEESMC_ATTR_CACHE_NONCACHE << TEESMC_ATTR_CACHE_SHIFT;
+}
+
+static uint32_t param_type_teec2teesmc(uint8_t type)
+{
+ switch (type) {
+ case TEEC_NONE:
+ return TEESMC_ATTR_TYPE_NONE;
+ case TEEC_VALUE_INPUT:
+ return TEESMC_ATTR_TYPE_VALUE_INPUT;
+ case TEEC_VALUE_OUTPUT:
+ return TEESMC_ATTR_TYPE_VALUE_OUTPUT;
+ case TEEC_VALUE_INOUT:
+ return TEESMC_ATTR_TYPE_VALUE_INOUT;
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ return TEESMC_ATTR_TYPE_MEMREF_INPUT;
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ return TEESMC_ATTR_TYPE_MEMREF_OUTPUT;
+ case TEEC_MEMREF_WHOLE:
+ case TEEC_MEMREF_TEMP_INOUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ return TEESMC_ATTR_TYPE_MEMREF_INOUT;
+ default:
+ WARN_ON(true);
+ return 0;
+ }
+}
+
+static void set_params(struct tee_tz *ptee,
+ struct teesmc32_param params32[TEEC_CONFIG_PAYLOAD_REF_COUNT],
+ uint32_t param_types,
+ struct tee_data *data)
+{
+ size_t n;
+ struct tee_shm *shm;
+ struct TEEC_Value *value;
+
+ for (n = 0; n < TEEC_CONFIG_PAYLOAD_REF_COUNT; n++) {
+ uint32_t type = TEEC_PARAM_TYPE_GET(param_types, n);
+
+ params32[n].attr = param_type_teec2teesmc(type);
+ if (params32[n].attr == TEESMC_ATTR_TYPE_NONE)
+ continue;
+ if (params32[n].attr < TEESMC_ATTR_TYPE_MEMREF_INPUT) {
+ value = (struct TEEC_Value *)&data->params[n];
+ params32[n].u.value.a = value->a;
+ params32[n].u.value.b = value->b;
+ continue;
+ }
+ shm = data->params[n].shm;
+ params32[n].attr |= get_cache_attrs(ptee);
+ params32[n].u.memref.buf_ptr = shm->resv.paddr;
+ params32[n].u.memref.size = shm->size_req;
+ }
+}
+
+static void get_params(struct tee_data *data,
+ struct teesmc32_param params32[TEEC_CONFIG_PAYLOAD_REF_COUNT])
+{
+ size_t n;
+ struct tee_shm *shm;
+ struct TEEC_Value *value;
+
+ for (n = 0; n < TEEC_CONFIG_PAYLOAD_REF_COUNT; n++) {
+ if (params32[n].attr == TEESMC_ATTR_TYPE_NONE)
+ continue;
+ if (params32[n].attr < TEESMC_ATTR_TYPE_MEMREF_INPUT) {
+ value = &data->params[n].value;
+ value->a = params32[n].u.value.a;
+ value->b = params32[n].u.value.b;
+ continue;
+ }
+ shm = data->params[n].shm;
+ shm->size_req = params32[n].u.memref.size;
+ }
+}
+
+/*
+ * tee_open_session - invoke TEE to open a GP TEE session
+ */
+static int tz_open(struct tee_session *sess, struct tee_cmd *cmd)
+{
+ struct tee *tee;
+ struct tee_tz *ptee;
+ int ret = 0;
+
+ struct teesmc32_arg *arg32;
+ struct teesmc32_param *params32;
+ struct teesmc_meta_open_session *meta;
+ uintptr_t parg32;
+ uintptr_t pmeta;
+ size_t num_meta = 1;
+ uint8_t *ta;
+ struct TEEC_UUID *uuid;
+
+ WARN_ON(!sess->ctx->tee);
+ WARN_ON(!sess->ctx->tee->priv);
+ tee = sess->ctx->tee;
+ ptee = tee->priv;
+
+ if (cmd->uuid)
+ uuid = cmd->uuid->resv.kaddr;
+ else
+ uuid = NULL;
+
+ if (!CAPABLE(ptee->tee)) {
+ pr_err("tkcoredrv: %s: not capable\n", __func__);
+ return -EBUSY;
+ }
+
+ /* case ta binary is inside the open request */
+ ta = NULL;
+ if (cmd->ta)
+ ta = cmd->ta->resv.kaddr;
+ if (ta)
+ num_meta++;
+
+ arg32 = alloc_tee_arg(ptee, &parg32,
+ TEESMC32_GET_ARG_SIZE(
+ TEEC_CONFIG_PAYLOAD_REF_COUNT + num_meta));
+ meta = alloc_tee_arg(ptee, &pmeta, sizeof(*meta));
+
+ if ((arg32 == NULL) || (meta == NULL)) {
+ free_tee_arg(ptee, parg32);
+ free_tee_arg(ptee, pmeta);
+ return -ENOMEM;
+ }
+
+ memset(arg32, 0, sizeof(*arg32));
+ memset(meta, 0, sizeof(*meta));
+ arg32->num_params = TEEC_CONFIG_PAYLOAD_REF_COUNT + num_meta;
+ params32 = TEESMC32_GET_PARAMS(arg32);
+
+ arg32->cmd = TEESMC_CMD_OPEN_SESSION;
+
+ params32[0].u.memref.buf_ptr = pmeta;
+ params32[0].u.memref.size = sizeof(*meta);
+ params32[0].attr = TEESMC_ATTR_TYPE_MEMREF_INPUT |
+ TEESMC_ATTR_META | get_cache_attrs(ptee);
+
+ if (ta) {
+ params32[1].u.memref.buf_ptr =
+ tee_shm_pool_v2p(DEV, ptee->shm_pool,
+ cmd->ta->resv.kaddr);
+ params32[1].u.memref.size = cmd->ta->size_req;
+ params32[1].attr = TEESMC_ATTR_TYPE_MEMREF_INPUT |
+ TEESMC_ATTR_META | get_cache_attrs(ptee);
+ }
+
+ if (uuid != NULL)
+ memcpy(meta->uuid, uuid, TEESMC_UUID_LEN);
+ meta->clnt_login = 0; /* FIXME: is this reliable ? used ? */
+
+ params32 += num_meta;
+ set_params(ptee, params32, cmd->param.type, &cmd->param);
+
+ stdcall_tee(ptee, parg32, arg32);
+
+ get_params(&cmd->param, params32);
+
+ if (arg32->ret != TEEC_ERROR_COMMUNICATION) {
+ sess->sessid = arg32->session;
+ cmd->err = arg32->ret;
+ cmd->origin = arg32->ret_origin;
+ } else
+ ret = -EBUSY;
+
+ free_tee_arg(ptee, parg32);
+ free_tee_arg(ptee, pmeta);
+
+ return ret;
+}
+
+/*
+ * tee_invoke_command - invoke TEE to invoke a GP TEE command
+ */
+static int tz_invoke(struct tee_session *sess, struct tee_cmd *cmd)
+{
+ struct tee *tee;
+ struct tee_tz *ptee;
+ int ret = 0;
+
+ struct teesmc32_arg *arg32;
+ uintptr_t parg32;
+ struct teesmc32_param *params32;
+
+ WARN_ON(!sess->ctx->tee);
+ WARN_ON(!sess->ctx->tee->priv);
+ tee = sess->ctx->tee;
+ ptee = tee->priv;
+
+ if (!CAPABLE(tee)) {
+ pr_err("tkcoredrv: %s: not capable\n", __func__);
+ return -EBUSY;
+ }
+
+ arg32 = (typeof(arg32))alloc_tee_arg(ptee, &parg32,
+ TEESMC32_GET_ARG_SIZE(TEEC_CONFIG_PAYLOAD_REF_COUNT));
+ if (!arg32) {
+ free_tee_arg(ptee, parg32);
+ return TEEC_ERROR_OUT_OF_MEMORY;
+ }
+
+ memset(arg32, 0, sizeof(*arg32));
+ arg32->num_params = TEEC_CONFIG_PAYLOAD_REF_COUNT;
+ params32 = TEESMC32_GET_PARAMS(arg32);
+
+ arg32->cmd = TEESMC_CMD_INVOKE_COMMAND;
+ arg32->session = sess->sessid;
+ arg32->ta_func = cmd->cmd;
+
+ set_params(ptee, params32, cmd->param.type, &cmd->param);
+
+ stdcall_tee(ptee, parg32, arg32);
+
+ get_params(&cmd->param, params32);
+
+ if (arg32->ret != TEEC_ERROR_COMMUNICATION) {
+ cmd->err = arg32->ret;
+ cmd->origin = arg32->ret_origin;
+ } else
+ ret = -EBUSY;
+
+ free_tee_arg(ptee, parg32);
+
+ return ret;
+}
+
+/*
+ * tee_cancel_command - invoke TEE to cancel a GP TEE command
+ */
+static int tz_cancel(struct tee_session *sess, struct tee_cmd *cmd)
+{
+ struct tee *tee;
+ struct tee_tz *ptee;
+ int ret = 0;
+
+ struct teesmc32_arg *arg32;
+ uintptr_t parg32;
+
+ WARN_ON(!sess->ctx->tee);
+ WARN_ON(!sess->ctx->tee->priv);
+ tee = sess->ctx->tee;
+ ptee = tee->priv;
+
+
+ arg32 = alloc_tee_arg(ptee, &parg32, TEESMC32_GET_ARG_SIZE(0));
+ if (arg32 == NULL) {
+ free_tee_arg(ptee, parg32);
+ return TEEC_ERROR_OUT_OF_MEMORY;
+ }
+
+ memset(arg32, 0, sizeof(*arg32));
+ arg32->cmd = TEESMC_CMD_CANCEL;
+ arg32->session = sess->sessid;
+
+ fastcall_tee(ptee, parg32, arg32);
+
+ if (arg32->ret == TEEC_ERROR_COMMUNICATION)
+ ret = -EBUSY;
+
+ free_tee_arg(ptee, parg32);
+
+ return ret;
+}
+
+/*
+ * tee_close_session - invoke TEE to close a GP TEE session
+ */
+static int tz_close(struct tee_session *sess)
+{
+ struct tee *tee;
+ struct tee_tz *ptee;
+ int ret = 0;
+
+ struct teesmc32_arg *arg32;
+ uintptr_t parg32;
+
+ WARN_ON(!sess->ctx->tee);
+ WARN_ON(!sess->ctx->tee->priv);
+ tee = sess->ctx->tee;
+ ptee = tee->priv;
+
+
+ if (!CAPABLE(tee)) {
+ pr_err("tkcoredrv: %s: not capable\n", __func__);
+ return -EBUSY;
+ }
+
+ arg32 = alloc_tee_arg(ptee, &parg32, TEESMC32_GET_ARG_SIZE(0));
+ if (arg32 == NULL) {
+ pr_err("tkcoredrv: failed to allocate tee arg\n");
+ free_tee_arg(ptee, parg32);
+ return TEEC_ERROR_OUT_OF_MEMORY;
+ }
+
+ memset(arg32, 0, sizeof(*arg32));
+ arg32->cmd = TEESMC_CMD_CLOSE_SESSION;
+ arg32->session = sess->sessid;
+
+ stdcall_tee(ptee, parg32, arg32);
+
+ if (arg32->ret == TEEC_ERROR_COMMUNICATION)
+ ret = -EBUSY;
+
+ free_tee_arg(ptee, parg32);
+
+ return ret;
+}
+
+static struct tee_shm *tz_alloc(struct tee *tee, size_t size, uint32_t flags)
+{
+ struct tee_shm *shm = NULL;
+ struct tee_tz *ptee;
+ size_t size_aligned;
+
+ WARN_ON(!tee->priv);
+ ptee = tee->priv;
+
+
+ size_aligned = ((size / SZ_4K) + 1) * SZ_4K;
+ if (unlikely(size_aligned == 0)) {
+ pr_err("requested size too big\n");
+ return NULL;
+ }
+
+ shm = devm_kzalloc(tee->dev, sizeof(struct tee_shm), GFP_KERNEL);
+ if (!shm)
+ return ERR_PTR(-ENOMEM);
+
+ shm->size_alloc = ((size / SZ_4K) + 1) * SZ_4K;
+ shm->size_req = size;
+
+ shm->resv.paddr = tkcore_shm_pool_alloc(tee->dev, ptee->shm_pool,
+ shm->size_alloc, ALLOC_ALIGN);
+ if (!shm->resv.paddr) {
+ pr_err("tkcoredrv: %s cannot alloc memory, size 0x%lx\n",
+ __func__, (unsigned long) shm->size_alloc);
+ devm_kfree(tee->dev, shm);
+ return ERR_PTR(-ENOMEM);
+ }
+ shm->resv.kaddr =
+ tee_shm_pool_p2v(tee->dev, ptee->shm_pool, shm->resv.paddr);
+ if (!shm->resv.kaddr) {
+ pr_err("tkcoredrv: %s: p2v(%p)=0\n",
+ __func__,
+ (void *) (unsigned long) shm->resv.paddr);
+ tkcore_shm_pool_free(tee->dev,
+ ptee->shm_pool, shm->resv.paddr, NULL);
+ devm_kfree(tee->dev, shm);
+ return ERR_PTR(-EFAULT);
+ }
+ shm->flags = flags;
+ if (ptee->shm_cached)
+ shm->flags |= TEE_SHM_CACHED;
+
+ return shm;
+}
+
+static void tz_free(struct tee_shm *shm)
+{
+ size_t size;
+ int ret;
+ struct tee *tee;
+ struct tee_tz *ptee;
+
+ WARN_ON(!shm->tee);
+ WARN_ON(!shm->tee->priv);
+ tee = shm->tee;
+ ptee = tee->priv;
+
+
+ ret = tkcore_shm_pool_free(tee->dev, ptee->shm_pool,
+ shm->resv.paddr, &size);
+ if (!ret) {
+ devm_kfree(tee->dev, shm);
+ shm = NULL;
+ }
+}
+
+static int tz_shm_inc_ref(struct tee_shm *shm)
+{
+ struct tee *tee;
+ struct tee_tz *ptee;
+
+ WARN_ON(!shm->tee);
+ WARN_ON(!shm->tee->priv);
+ tee = shm->tee;
+ ptee = tee->priv;
+
+ return tee_shm_pool_incref(tee->dev, ptee->shm_pool, shm->resv.paddr);
+}
+
+#ifdef CONFIG_OUTER_CACHE
+/*
+ * Synchronised outer cache maintenance support
+ */
+#ifndef CONFIG_ARM_TZ_SUPPORT
+/* weak outer_tz_mutex in case not supported by kernel */
+bool __weak outer_tz_mutex(unsigned long *p)
+{
+ if (p != NULL)
+ return false;
+ return true;
+}
+#endif
+
+/* register_outercache_mutex - Negotiate/Disable outer cache shared mutex */
+static int register_outercache_mutex(struct tee_tz *ptee, bool reg)
+{
+ unsigned long *vaddr = NULL;
+ int ret = 0;
+ struct smc_param param;
+ uintptr_t paddr = 0;
+
+ WARN_ON(!CAPABLE(ptee->tee));
+
+ if ((reg == true) && (ptee->tz_outer_cache_mutex != NULL)) {
+ pr_err("outer cache shared mutex already registered\n");
+ return -EINVAL;
+ }
+ if ((reg == false) && (ptee->tz_outer_cache_mutex == NULL))
+ return 0;
+
+ if (reg == false) {
+ vaddr = ptee->tz_outer_cache_mutex;
+ ptee->tz_outer_cache_mutex = NULL;
+ goto out;
+ }
+
+ memset(¶m, 0, sizeof(param));
+ param.a0 = TEESMC32_ST_FASTCALL_L2CC_MUTEX;
+ param.a1 = TEESMC_ST_L2CC_MUTEX_GET_ADDR;
+ smc_xfer(¶m);
+
+ if (param.a0 != TEESMC_RETURN_OK) {
+ pr_err("no TZ l2cc mutex service supported\n");
+ goto out;
+ }
+ paddr = param.a2;
+
+ vaddr = tee_map_cached_shm(paddr, sizeof(u32));
+ if (vaddr == NULL) {
+ pr_err("TZ l2cc mutex disabled: ioremap failed\n");
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ if (outer_tz_mutex(vaddr) == false) {
+ pr_err("TZ l2cc mutex disabled: outer cache refused\n");
+ goto out;
+ }
+
+ memset(¶m, 0, sizeof(param));
+ param.a0 = TEESMC32_ST_FASTCALL_L2CC_MUTEX;
+ param.a1 = TEESMC_ST_L2CC_MUTEX_ENABLE;
+ smc_xfer(¶m);
+
+ if (param.a0 != TEESMC_RETURN_OK) {
+ pr_warn("TZ l2cc mutex disabled: TZ enable failed\n");
+ goto out;
+ }
+ ptee->tz_outer_cache_mutex = vaddr;
+
+out:
+ if (ptee->tz_outer_cache_mutex == NULL) {
+ memset(¶m, 0, sizeof(param));
+ param.a0 = TEESMC32_ST_FASTCALL_L2CC_MUTEX;
+ param.a1 = TEESMC_ST_L2CC_MUTEX_DISABLE;
+ smc_xfer(¶m);
+ outer_tz_mutex(NULL);
+ if (vaddr)
+ iounmap(vaddr);
+
+ }
+
+ return ret;
+}
+#endif
+
+/* configure_shm - Negotiate Shared Memory configuration with teetz. */
+static int configure_shm(struct tee_tz *ptee)
+{
+ struct smc_param param = { 0 };
+ size_t shm_size = -1;
+ int ret = 0;
+
+ WARN_ON(!CAPABLE(ptee->tee));
+
+ param.a0 = TEESMC32_ST_FASTCALL_GET_SHM_CONFIG;
+ smc_xfer(¶m);
+
+ if (param.a0 != TEESMC_RETURN_OK) {
+ pr_err("shm service not available: 0x%x",
+ (uint) param.a0);
+ ret = -EINVAL;
+ goto out;
+ }
+
+ ptee->shm_paddr = param.a1;
+ shm_size = param.a2;
+ ptee->shm_cached = (bool)param.a3;
+
+ if (ptee->shm_cached)
+ ptee->shm_vaddr = tee_map_cached_shm(ptee->shm_paddr, shm_size);
+ else
+ ptee->shm_vaddr = ioremap_nocache(ptee->shm_paddr, shm_size);
+
+ if (ptee->shm_vaddr == NULL) {
+ pr_err("shm ioremap failed\n");
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ ptee->shm_pool = tee_shm_pool_create(DEV, shm_size,
+ ptee->shm_vaddr, ptee->shm_paddr);
+
+ if (!ptee->shm_pool) {
+ pr_err("shm pool creation failed (%zu)", shm_size);
+ ret = -EINVAL;
+ goto out;
+ }
+
+ if (ptee->shm_cached)
+ tee_shm_pool_set_cached(ptee->shm_pool);
+out:
+ return ret;
+}
+
+static int tz_start(struct tee *tee)
+{
+ struct tee_tz *ptee;
+ int ret;
+
+ WARN_ON(!tee || !tee->priv);
+
+ if (!CAPABLE(tee)) {
+ pr_err("not capable\n");
+ return -EBUSY;
+ }
+
+ ptee = tee->priv;
+ WARN_ON(ptee->started);
+ ptee->started = true;
+
+ ret = configure_shm(ptee);
+ if (ret)
+ goto exit;
+
+#ifdef CONFIG_MEDIATEK_SOLUTION
+ {
+#define TKCORE_GET_ROOT_OF_TRUST_INFO 0xBF000202
+ struct smc_param param = { 0 };
+
+ /* tell tos to get root of trust
+ *
+ * we are not insterested in the
+ * return value. the availability
+ * of RoT will affect the behavior of
+ * other trust apps anyhow
+ */
+
+ param.a0 = TKCORE_GET_ROOT_OF_TRUST_INFO;
+ smc_xfer(¶m);
+ }
+#endif
+
+#ifdef CONFIG_OUTER_CACHE
+ ret = register_outercache_mutex(ptee, true);
+ if (ret)
+ goto exit;
+#endif
+
+exit:
+ if (ret)
+ ptee->started = false;
+
+ return ret;
+}
+
+static int tz_stop(struct tee *tee)
+{
+ struct tee_tz *ptee;
+
+ WARN_ON(!tee || !tee->priv);
+
+ ptee = tee->priv;
+
+ if (!CAPABLE(tee)) {
+ pr_err("tee: bad state\n");
+ return -EBUSY;
+ }
+
+#ifdef CONFIG_OUTER_CACHE
+ register_outercache_mutex(ptee, false);
+#endif
+ tee_shm_pool_destroy(tee->dev, ptee->shm_pool);
+ iounmap(ptee->shm_vaddr);
+ ptee->started = false;
+
+ return 0;
+}
+
+static void __tee_smc_call(struct smc_param *p)
+{
+ tee_smc_call(p);
+}
+
+/******************************************************************************/
+
+const struct tee_ops tee_tz_fops = {
+ .type = "tz",
+ .owner = THIS_MODULE,
+ .start = tz_start,
+ .stop = tz_stop,
+ .invoke = tz_invoke,
+ .cancel = tz_cancel,
+ .open = tz_open,
+ .close = tz_close,
+ .alloc = tz_alloc,
+ .free = tz_free,
+ .shm_inc_ref = tz_shm_inc_ref,
+
+ .call_tee = smc_xfer,
+ .raw_call_tee = __tee_smc_call,
+};
+
+static int tz_tee_init(struct platform_device *pdev)
+{
+ int ret = 0;
+
+ struct tee *tee = platform_get_drvdata(pdev);
+ struct tee_tz *ptee = tee->priv;
+
+ tee_tz = ptee;
+
+ ptee->started = false;
+
+ tee_wait_queue_init(&ptee->wait_queue);
+
+ if (ret) {
+ pr_err("dev=%s, Secure failed (%d)\n",
+ tee->name, ret);
+ }
+
+ return ret;
+}
+
+static void tz_tee_deinit(struct platform_device *pdev)
+{
+ struct tee *tee = platform_get_drvdata(pdev);
+ struct tee_tz *ptee = tee->priv;
+
+ if (!CAPABLE(tee))
+ return;
+
+ tee_wait_queue_exit(&ptee->wait_queue);
+}
+
+static int tz_tee_probe(struct platform_device *pdev)
+{
+ int ret = 0;
+ struct device *dev = &pdev->dev;
+ struct tee *tee;
+ struct tee_tz *ptee;
+
+ tee = tee_core_alloc(dev, _TEE_TZ_NAME, pdev->id, &tee_tz_fops,
+ sizeof(struct tee_tz));
+ if (!tee)
+ return -ENOMEM;
+
+ ptee = tee->priv;
+ ptee->tee = tee;
+
+ platform_set_drvdata(pdev, tee);
+
+ ret = tz_tee_init(pdev);
+ if (ret)
+ goto bail0;
+
+ ret = tee_core_add(tee);
+ if (ret)
+ goto bail1;
+
+ ret = __tee_get(tee);
+ if (ret) {
+ tz_tee_deinit(pdev);
+ tee_core_del(tee);
+
+ return ret;
+ }
+
+ return 0;
+
+bail1:
+ tz_tee_deinit(pdev);
+bail0:
+ tee_core_free(tee);
+ return ret;
+}
+
+static int tz_tee_remove(struct platform_device *pdev)
+{
+ struct tee *tee = platform_get_drvdata(pdev);
+
+ tz_tee_deinit(pdev);
+ tee_core_del(tee);
+ return 0;
+}
+
+static const struct of_device_id tz_tee_match[] = {
+ {
+ .compatible = "trustkernel,tzdrv",
+ },
+ {},
+};
+
+static struct platform_driver tz_tee_driver = {
+ .probe = tz_tee_probe,
+ .remove = tz_tee_remove,
+
+ .driver = {
+ .name = "tzdrv",
+ .owner = THIS_MODULE,
+ .of_match_table = tz_tee_match,
+ },
+};
+
+static struct platform_device tz_0_plt_device = {
+ .name = "tzdrv",
+ .id = 0,
+ .dev = {
+ /* .platform_data = tz_0_tee_data,*/
+ },
+};
+
+static int __init tee_tz_init(void)
+{
+ int rc;
+
+ pr_info("TrustKernel TEE Driver initialization\n");
+
+ rc = tee_init_smc_xfer();
+ if (rc < 0)
+ return rc;
+
+ rc = platform_device_register(&tz_0_plt_device);
+ if (rc < 0) {
+ pr_err(
+ "failed to register the platform devices 0 (rc=%d)\n",
+ rc);
+ goto err0;
+ }
+
+ rc = platform_driver_register(&tz_tee_driver);
+ if (rc < 0) {
+ pr_err("failed to probe the platform driver (rc=%d)\n",
+ rc);
+ goto err1;
+ }
+
+ return 0;
+
+err1:
+ platform_device_unregister(&tz_0_plt_device);
+err0:
+ tee_exit_smc_xfer();
+
+ return rc;
+}
+
+static void __exit tee_tz_exit(void)
+{
+ pr_info("TrustKernel TEE Driver Release\n");
+
+ platform_device_unregister(&tz_0_plt_device);
+ platform_driver_unregister(&tz_tee_driver);
+
+ tee_exit_smc_xfer();
+}
+
+#ifndef MODULE
+rootfs_initcall(tee_tz_init);
+#else
+module_init(tee_tz_init);
+#endif
+module_exit(tee_tz_exit);
+
+MODULE_AUTHOR("TrustKernel");
+MODULE_DESCRIPTION("TrustKernel TKCore TZ driver");
+MODULE_SUPPORTED_DEVICE("");
+MODULE_LICENSE("GPL");
+MODULE_VERSION("1.0");
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_op.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_op.h
new file mode 100644
index 0000000..9e38cde
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_op.h
@@ -0,0 +1,263 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef __TEE_ARMV7_OP_H__
+#define __TEE_ARMV7_OP_H__
+
+enum t_issw_service_id {
+ /*
+ * ("SSAPI_PRE_INIT_SERV")
+ */
+ SSAPI_PRE_INIT_SERV = 1,
+
+ /*
+ * ("SSAPI_POST_SPEEDUP_INIT_SERV")
+ * Reserved, Not used
+ */
+ SSAPI_POST_SPEEDUP_INIT_SERV = 2,
+
+ /*
+ * ("SSAPI_ISSW_IMPORT_SERV")
+ */
+ SSAPI_ISSW_IMPORT_SERV = 3,
+
+ /*
+ * ("SSAPI_RET_FROM_INT_SERV")
+ */
+ SSAPI_RET_FROM_INT_SERV = 4,
+
+ /*
+ * ("SSAPI_RET_FROM_RPC_SERV")
+ */
+ SSAPI_RET_FROM_RPC_SERV = 5,
+
+ /*
+ * "ISSWAPI_ISSW_EXECUTE_SERV" is linked to ROM code
+ * ("SSAPI_ISSW_EXECUTE_SERV")
+ */
+ ISSWAPI_ISSW_EXECUTE_SERV = 6,
+ ISSWAPI_PROT_APPL_MSG_SEND = 0x10000000,
+ ISSWAPI_EXTERNAL_CODE_CHECK = 0x10000001,
+ ISSWAPI_SECURE_LOAD = 0x10000002,
+ ISSWAPI_ISSW_REIMPORT_PUB_KEYS = 0x10000003,
+
+ /* Accessible only on request */
+ ISSWAPI_WRITE_L2CC = 0x10000004,
+ ISSWAPI_WRITE_CP15_SCTLR = 0x10000005,
+ ISSWAPI_READ_CP15_SCTLR = 0x10000006,
+ ISSWAPI_WRITE_CP15_ACTLR = 0x10000007,
+ ISSWAPI_READ_CP15_ACTLR = 0x10000008,
+ ISSWAPI_WRITE_CP15_DIAGR = 0x10000009,
+ ISSWAPI_READ_CP15_DIAGR = 0x1000000A,
+
+ ISSWAPI_EXECUTE_TA = 0x11000001,
+ ISSWAPI_CLOSE_TA = 0x11000002,
+ ISSWAPI_FLUSH_BOOT_CODE = 0x11000003,
+ /* Generic, restricted to be used by u-boot */
+ ISSWAPI_VERIFY_SIGNED_HEADER = 0x11000005,
+ ISSWAPI_VERIFY_HASH = 0x11000006,
+ /* 8500 only, restricted to be used by u-boot */
+ ISSWAPI_GET_RT_FLAGS = 0x11000007,
+
+ /* For TEE Client API 1.0 */
+ ISSWAPI_TEEC_OPEN_SESSION = 0x11000008,
+ ISSWAPI_TEEC_CLOSE_SESSION = 0x11000009,
+ ISSWAPI_TEEC_INVOKE_COMMAND = 0x1100000a,
+ ISSWAPI_REGISTER_RPC = 0x1100000b, /* this is NOT a GP TEE API ! */
+ ISSWAPI_SET_SEC_DDR = 0x1100000c, /* this is NOT a GP TEE API ! */
+ ISSWAPI_TEEC_CANCEL_COMMAND = 0x1100000d,
+ ISSWAPI_TEEC_REGISTER_MEMORY = 0x1100000e,
+ ISSWAPI_TEEC_UNREGISTER_MEMORY = 0x1100000f,
+
+ /* Internal command */
+ ISSWAPI_TEE_DEINIT_CPU = 0x11000010,
+ ISSWAPI_TEE_CRASH_CPU = 0x11000011,
+ ISSWAPI_TEE_SET_CORE_TRACE_LEVEL = 0x11000012,
+ ISSWAPI_TEE_GET_CORE_TRACE_LEVEL = 0x11000013,
+ ISSWAPI_TEE_SET_TA_TRACE_LEVEL = 0x11000014,
+ ISSWAPI_TEE_GET_TA_TRACE_LEVEL = 0x11000015,
+ ISSWAPI_TEE_GET_CORE_STATUS = 0x11000016,
+ ISSWAPI_TEE_FLUSH_CACHE = 0x11000017,
+
+ ISSWAPI_REGISTER_DEF_SHM = 0x11000020,
+ ISSWAPI_UNREGISTER_DEF_SHM = 0x11000021,
+ ISSWAPI_REGISTER_IRQFWD = 0x11000022,
+ ISSWAPI_UNREGISTER_IRQFWD = 0x11000023,
+ ISSWAPI_GET_SHM_START = 0x11000024,
+ ISSWAPI_GET_SHM_SIZE = 0x11000025,
+ ISSWAPI_GET_SHM_CACHED = 0x11000026,
+
+ ISSWAPI_ENABLE_L2CC_MUTEX = 0x20000000,
+ ISSWAPI_DISABLE_L2CC_MUTEX = 0x20000001,
+ ISSWAPI_GET_L2CC_MUTEX = 0x20000002,
+ ISSWAPI_SET_L2CC_MUTEX = 0x20000003,
+
+ ISSWAPI_LOAD_TEE = 0x20000004,
+
+};
+
+/*
+ * tee_msg_send - generic part of the msg sent to the TEE
+ */
+struct tee_msg_send {
+ unsigned int service;
+};
+
+/*
+ * tee_msg_recv - default strcutre of TEE service output message
+ */
+struct tee_msg_recv {
+ int duration;
+ uint32_t res;
+ uint32_t origin;
+};
+
+/*
+ * tee_register_irqfwd_xxx - (un)register callback for interrupt forwarding
+ */
+struct tee_register_irqfwd_send {
+ struct tee_msg_send header;
+ struct {
+ unsigned long cb;
+ } data;
+};
+struct tee_register_irqfwd_recv {
+ struct tee_msg_recv header;
+};
+
+/*
+ * tee_get_l2cc_mutex - input/output argument structures
+ */
+struct tee_get_l2cc_mutex_send {
+ struct tee_msg_send header;
+};
+struct tee_get_l2cc_mutex_recv {
+ struct tee_msg_recv header;
+ struct {
+ unsigned long paddr;
+ } data;
+};
+
+/**
+ * struct tee_identity - Represents the identity of the client
+ * @login: Login id
+ * @uuid: UUID as defined above
+ */
+struct tee_identity {
+ uint32_t login;
+ struct TEEC_UUID uuid;
+};
+
+/*
+ * tee_open_session_data - input arg structure for TEE open session service
+ */
+struct tee_open_session_data {
+ struct ta_signed_header_t *ta;
+ struct TEEC_UUID uuid;
+ uint32_t param_types;
+ struct TEEC_Value params[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+ struct tee_identity client_id;
+ uint32_t params_flags[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+};
+
+/*
+ * tee_open_session_send - input arg msg for TEE open session service
+ */
+struct tee_open_session_send {
+ struct tee_msg_send header;
+ struct tee_open_session_data data;
+};
+
+/*
+ * tee_open_session_recv - output arg structure for TEE open session service
+ */
+struct tee_open_session_recv {
+ struct tee_msg_recv header;
+ uint32_t sess;
+ struct TEEC_Value params[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+};
+
+/*
+ * tee_invoke_command_data - input arg structure for TEE invoke cmd service
+ */
+struct tee_invoke_command_data {
+ uint32_t sess;
+ uint32_t cmd;
+ uint32_t param_types;
+ struct TEEC_Value params[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+ uint32_t params_flags[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+};
+
+struct tee_invoke_command_send {
+ struct tee_msg_send header;
+ struct tee_invoke_command_data data;
+};
+
+/*
+ * tee_invoke_command_recv - output arg structure for TEE invoke cmd service
+ */
+struct tee_invoke_command_recv {
+ struct tee_msg_recv header;
+ struct TEEC_Value params[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+};
+
+/*
+ * tee_cancel_command_data - input arg structure for TEE cancel service
+ */
+struct tee_cancel_command_data {
+ uint32_t sess;
+};
+
+/*
+ * tee_cancel_command_send - input msg structure for TEE cancel service
+ */
+struct tee_cancel_command_send {
+ struct tee_msg_send header;
+ struct tee_cancel_command_data data;
+};
+
+/*
+ * tee_close_session_data - input arg structure for TEE close session service
+ */
+struct tee_close_session_data {
+ uint32_t sess;
+};
+
+/*
+ * tee_close_session_send - input arg msg for TEE close session service
+ */
+struct tee_close_session_send {
+ struct tee_msg_send header;
+ struct tee_close_session_data data;
+};
+
+/*
+ * tee_register_rpc_send_data - input arg structure for TEE register rpc service
+ */
+struct tee_register_rpc_send_data {
+ uint32_t fnk;
+ uint32_t bf;
+ uint32_t nbr_bf;
+};
+
+/*
+ * tee_register_rpc_send - input msg structure for TEE register rpc service
+ */
+struct tee_register_rpc_send {
+ struct tee_msg_send header;
+ struct tee_register_rpc_send_data data;
+};
+
+/*
+ * tee_core_status_out - output arg structure for TEE status service
+ */
+#define TEEC_STATUS_MSG_SIZE 80
+
+struct tee_core_status_out {
+ struct tee_msg_recv header;
+ char raw[TEEC_STATUS_MSG_SIZE];
+};
+
+#endif /* __TEE_ARMV7_OP_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_priv.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_priv.h
new file mode 100644
index 0000000..d0111fa
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/armtz/tee_tz_priv.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef __TEE_TZ_PRIV__
+#define __TEE_TZ_PRIV__
+
+#include <linux/tee_kernel_lowlevel_api.h>
+
+struct tee;
+struct shm_pool;
+struct tee_rpc_bf;
+
+struct tee_tz {
+ bool started;
+ struct tee *tee;
+ unsigned long shm_paddr;
+ void *shm_vaddr;
+ struct shm_pool *shm_pool;
+ void *tz_outer_cache_mutex;
+ struct tee_rpc_bf *rpc_buffers;
+ bool shm_cached;
+ struct tee_wait_queue_private wait_queue;
+};
+
+#endif /* __TEE_TZ_PRIV__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/Makefile b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/Makefile
new file mode 100644
index 0000000..50916ce
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/Makefile
@@ -0,0 +1,32 @@
+# SPDX-License-Identifier: GPL-2.0
+# Copyright (c) 2015-2019 TrustKernel Incorporated
+
+ifneq ($(strip $(M)),)
+ obj-m += tkcore.o
+else
+ obj-y += tkcore.o
+endif
+
+M ?=$(srctree)/drivers/tee/tkcore
+
+#ccflags-y+=-Werror
+ccflags-y += -I$(M)/include/linux
+ccflags-y += -I$(M)/include
+ccflags-y += -I$(M)
+
+tkcore-objs:= \
+ tee_core.o \
+ tee_context.o \
+ tee_session.o \
+ tee_shm.o \
+ tee_supp_com.o \
+ tee_sysfs.o \
+ tee_kernel_api.o \
+ tee_wait_queue.o \
+ tee_tui.o \
+ tee_tui_hal.o \
+ tee_procfs.o \
+ tee_ta_mgmt.o \
+ tee_clkmgr.o \
+ tee_fp.o \
+ pm.o \
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/pm.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/pm.c
new file mode 100644
index 0000000..91fdc6e
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/pm.c
@@ -0,0 +1,130 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/wait.h>
+#include <linux/freezer.h>
+#include <linux/suspend.h>
+
+#include <linux/atomic.h>
+
+#include "pm.h"
+
+/* tee_wakeup_cnt == 0 means currently
+ * the system is in idle state, without
+ * wakeup source or suspend request.
+ * wakeup source > 0 means there are outgoing
+ * commands which stop the system from suspending.
+ * wakeup source == -1 means the system is now
+ * preparing for suspend or suspending
+ */
+static atomic_t tee_wakeup_cnt = ATOMIC_INIT(0);
+
+static DECLARE_WAIT_QUEUE_HEAD(suspend_done);
+static DECLARE_WAIT_QUEUE_HEAD(awake_done);
+
+static void tee_keep_awake(void)
+{
+ while (atomic_inc_unless_negative(&tee_wakeup_cnt) == 0)
+ wait_event_freezable(suspend_done,
+ atomic_read(&tee_wakeup_cnt) >= 0);
+}
+
+static void tee_cancel_awake(void)
+{
+ if (atomic_dec_and_test(&tee_wakeup_cnt)) {
+ /* wake_up() implies a memory barrier */
+ wake_up(&awake_done);
+ }
+}
+
+static void tee_prepare_suspend(void)
+{
+ int r;
+
+ while ((r = atomic_read(&tee_wakeup_cnt)) >= 0) {
+ if (atomic_cmpxchg(&tee_wakeup_cnt, 0, -1) == 0)
+ return;
+ /* wait_event() implies a memory barrier */
+ wait_event(awake_done, atomic_read(&tee_wakeup_cnt) == 0);
+ }
+
+ pr_warn("tee_wakeup_cnt unexpected value: %d\n", r);
+}
+
+#ifdef CONFIG_TRUSTKERNEL_TEE_RPMB_SUPPORT
+#include "linux/tee_rpmb.h"
+#endif
+
+static void tee_post_suspend(void)
+{
+ /* we do not need to use atomic instruction here,
+ * because there is one single suspend source.
+ */
+ atomic_set(&tee_wakeup_cnt, atomic_read(&tee_wakeup_cnt) + 1);
+ wake_up(&suspend_done);
+}
+
+static int tee_pm_suspend_notifier(struct notifier_block *nb,
+ unsigned long event, void *dummy)
+{
+ switch (event) {
+ case PM_SUSPEND_PREPARE:
+ tee_prepare_suspend();
+
+#ifdef CONFIG_TRUSTKERNEL_TEE_RPMB_SUPPORT
+ {
+ struct tkcore_rpmb_request rq = {
+ .type = TEE_RPMB_SWITCH_NORMAL
+ };
+ tkcore_emmc_rpmb_execute(&rq);
+ }
+#endif
+ break;
+ case PM_POST_SUSPEND:
+ tee_post_suspend();
+ break;
+ default:
+ break;
+ }
+
+ return NOTIFY_OK;
+}
+
+static struct notifier_block tz_pm_notifier = {
+ .notifier_call = tee_pm_suspend_notifier,
+};
+
+int tkcore_stay_awake(void *fn, void *data)
+{
+ int r;
+
+ tee_keep_awake();
+ r = ((int (*) (void *)) fn) (data);
+ tee_cancel_awake();
+
+ return r;
+}
+
+int tkcore_tee_pm_init(void)
+{
+ int r;
+
+ r = register_pm_notifier(&tz_pm_notifier);
+ if (r) {
+ pr_err("failed to register pm notifier: %d\n", r);
+ return r;
+ }
+
+ return 0;
+}
+
+void tkcore_tee_pm_exit(void)
+{
+ int r;
+
+ r = unregister_pm_notifier(&tz_pm_notifier);
+ if (r)
+ pr_err("failed to unregister_pm_notifier: %d\n", r);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/pm.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/pm.h
new file mode 100644
index 0000000..750e5f8
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/pm.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TKCORE_PM_H
+#define TKCORE_PM_H
+
+int tkcore_stay_awake(void *fn, void *data);
+
+int tkcore_tee_pm_init(void);
+
+void tkcore_tee_pm_exit(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_clkmgr.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_clkmgr.c
new file mode 100644
index 0000000..a37d772
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_clkmgr.c
@@ -0,0 +1,175 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/kernel.h>
+#include <linux/compiler.h>
+#include <linux/errno.h>
+#include <linux/string.h>
+
+#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+
+#include <linux/tee_clkmgr.h>
+#include <linux/tee_client_api.h>
+
+#include "tee_clkmgr_priv.h"
+
+struct clkmgr_handle {
+ uint32_t token;
+ void *e, *d;
+ const void *p0, *p1, *p2;
+ size_t argnum;
+ struct list_head le;
+};
+
+/* sync with tee-os */
+enum tee_clkmgr_type {
+ TEE_CLKMGR_TYPE_SPI = 0,
+ TEE_CLKMGR_TYPE_I2C,
+ TEE_CLKMGR_TYPE_I2C_DMA
+};
+
+static const char * const clkid[] = {
+ [TEE_CLKMGR_TYPE_SPI] = "spi",
+ [TEE_CLKMGR_TYPE_I2C] = "i2c",
+ [TEE_CLKMGR_TYPE_I2C_DMA] = "i2c-dma",
+};
+
+static LIST_HEAD(clk_list);
+static DEFINE_SPINLOCK(clk_list_lock);
+
+/* called inside list_lock */
+static struct clkmgr_handle *get_clkmgr_handle(uint32_t token)
+{
+ struct clkmgr_handle *h;
+
+ list_for_each_entry(h, &clk_list, le) {
+ if (h->token == token)
+ return h;
+ }
+
+ return NULL;
+}
+
+int tee_clkmgr_handle(uint32_t token, uint32_t op)
+{
+ struct clkmgr_handle *ph, h;
+ void *fn;
+
+ spin_lock(&clk_list_lock);
+
+ ph = get_clkmgr_handle(token | TEE_CLKMGR_TOKEN_NOT_LEGACY);
+ if (ph == NULL) {
+ pr_err("invalid token %u\n", token);
+ spin_unlock(&clk_list_lock);
+ return TEEC_ERROR_ITEM_NOT_FOUND;
+ }
+
+ memcpy(&h, ph, sizeof(h));
+
+ spin_unlock(&clk_list_lock);
+
+ fn = (op & TEE_CLKMGR_OP_ENABLE) ? h.e : h.d;
+
+ if (h.argnum == 0) {
+ ((void (*)(void)) fn) ();
+ } else if (h.argnum == 1) {
+ ((void (*)(const void *)) fn) (h.p0);
+ } else if (h.argnum == 2) {
+ ((void (*)(const void *, const void *)) fn) (h.p0, h.p1);
+ } else if (h.argnum == 3) {
+ ((void (*) (const void *, const void *, const void *)) fn)
+ (h.p0, h.p1, h.p2);
+ } else {
+ pr_err("unsupported token %u argnum %zu\n",
+ h.token, h.argnum);
+ return TEEC_ERROR_NOT_SUPPORTED;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL(tee_clkmgr_handle);
+
+int tee_clkmgr_register(const char *clkname, int id, void *e, void *d,
+ void *p0, void *p1, void *p2, size_t argnum)
+{
+ size_t n;
+
+ struct clkmgr_handle *h, *w;
+
+ pr_info("tkcoredrv: clkname=%s id=%d\n",
+ clkname, id);
+
+ if (argnum > 3) {
+ pr_err("does not support argnum %zu\n", argnum);
+ return -EINVAL;
+ }
+
+ for (n = 0; n < ARRAY_SIZE(clkid); n++) {
+ if (clkid[n] && strcmp(clkname, clkid[n]) == 0)
+ break;
+ }
+
+ if (n == ARRAY_SIZE(clkid)) {
+ pr_err("invalid clkname %s\n", clkname);
+ return -EINVAL;
+ }
+
+ if ((id << TEE_CLKMGR_TOKEN_ID_SHIFT) &
+ (TEE_CLKMGR_TOKEN_TYPE_MASK << TEE_CLKMGR_TOKEN_TYPE_SHIFT)) {
+ pr_err("%s-%d: invalid id\n", clkname, id);
+ return -EINVAL;
+ }
+
+ h = kmalloc(sizeof(struct clkmgr_handle), GFP_KERNEL);
+ if (h == NULL)
+ return -ENOMEM;
+
+ h->token = TEE_CLKMGR_TOKEN((uint32_t) n, (uint32_t) id);
+ h->e = e;
+ h->d = d;
+ h->p0 = p0;
+ h->p1 = p1;
+ h->p2 = p2;
+ h->argnum = argnum;
+
+ spin_lock(&clk_list_lock);
+
+ /* check for duplication */
+ list_for_each_entry(w, &clk_list, le) {
+ if (w->token == h->token) {
+ pr_err("clk 0x%x already registered\n",
+ h->token);
+ spin_unlock(&clk_list_lock);
+ return -EINVAL;
+ }
+ }
+
+ list_add(&(h->le), &clk_list);
+ spin_unlock(&clk_list_lock);
+
+ return 0;
+}
+EXPORT_SYMBOL(tee_clkmgr_register);
+
+int tee_clkmgr_init(void)
+{
+ return 0;
+}
+
+void tee_clkmgr_exit(void)
+{
+ struct clkmgr_handle *h, *n;
+
+ spin_lock(&clk_list_lock);
+
+ list_for_each_entry_safe(h, n, &clk_list, le) {
+ list_del(&(h->le));
+ kfree(h);
+ }
+
+ spin_unlock(&clk_list_lock);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_clkmgr_priv.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_clkmgr_priv.h
new file mode 100644
index 0000000..b6b0f5f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_clkmgr_priv.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_CLKMGR_PRIV_H
+#define TEE_CLKMGR_PRIV_H
+
+int tee_clkmgr_init(void);
+void tee_clkmgr_exit(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_context.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_context.c
new file mode 100644
index 0000000..77eccc7
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_context.c
@@ -0,0 +1,295 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/types.h>
+#include <linux/file.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+#include <linux/sched.h>
+
+#include "tee_shm.h"
+#include "tee_core_priv.h"
+
+/**
+ * tee_context_dump - Dump in a buffer the information (ctx, sess & shm)
+ * associated to a tee.
+ */
+int tee_context_dump(struct tee *tee, char *buff, size_t len)
+{
+ struct list_head *ptr_ctx, *ptr_sess, *ptr_shm;
+ struct tee_context *ctx;
+ struct tee_session *sess;
+ struct tee_shm *shm;
+ int i = -1;
+ int j = 0;
+
+ int pos = 0;
+
+ WARN_ON(!tee);
+
+ if (len < 80 || list_empty(&tee->list_ctx))
+ return 0;
+
+ mutex_lock(&tee->lock);
+
+ list_for_each(ptr_ctx, &tee->list_ctx) {
+ ctx = list_entry(ptr_ctx, struct tee_context, entry);
+ ++i;
+
+ pos += sprintf(buff + pos,
+ "[%02d] ctx=%p (refcount=%d) (usr=%d)",
+ i, ctx,
+ (int)kref_read(&ctx->refcount),
+ ctx->usr_client);
+ pos += sprintf(buff + pos, "name=\"%s\" (tgid=%d)\n",
+ ctx->name,
+ ctx->tgid);
+ if ((len - pos) < 80) {
+ pos = 0;
+ goto out;
+ }
+
+ if (list_empty(&ctx->list_sess))
+ continue;
+
+ j = 0;
+ list_for_each(ptr_sess, &ctx->list_sess) {
+ sess = list_entry(ptr_sess,
+ struct tee_session,
+ entry);
+
+ pos += sprintf(buff + pos,
+ "[%02d.%d] sess=%p sessid=%08x\n",
+ i, j, sess,
+ sess->sessid);
+
+ if ((len - pos) < 80) {
+ pos = 0;
+ goto out;
+ }
+ }
+
+ if (list_empty(&ctx->list_shm))
+ continue;
+
+ j = 0;
+ list_for_each(ptr_shm, &ctx->list_shm) {
+ shm = list_entry(ptr_shm, struct tee_shm, entry);
+
+ pos += sprintf(buff + pos,
+ "[%02d.%d] shm=%p paddr=%p kaddr=%p",
+ i, j, shm,
+ &shm->resv.paddr,
+ shm->resv.kaddr);
+ pos += sprintf(buff + pos,
+ " s=%zu(%zu)\n",
+ shm->size_req,
+ shm->size_alloc);
+ if ((len - pos) < 80) {
+ pos = 0;
+ goto out;
+ }
+
+ j++;
+ }
+ }
+
+out:
+ mutex_unlock(&tee->lock);
+ return pos;
+}
+
+/**
+ * tee_context_create - Allocate and create a new context.
+ * Reference on the back-end is requested.
+ */
+struct tee_context *tee_context_create(struct tee *tee)
+{
+ int ret;
+ struct tee_context *ctx;
+
+
+ ctx = devm_kzalloc(_DEV(tee), sizeof(struct tee_context), GFP_KERNEL);
+ if (!ctx) {
+ ctx = ERR_PTR(-ENOMEM);
+ pr_err("tee_context allocation failed\n");
+ return ctx;
+ }
+
+ kref_init(&ctx->refcount);
+ INIT_LIST_HEAD(&ctx->list_sess);
+ INIT_LIST_HEAD(&ctx->list_shm);
+
+ ctx->tee = tee;
+ snprintf(ctx->name, sizeof(ctx->name), "%s", current->comm);
+ ctx->tgid = current->tgid;
+
+ ret = tee_get(tee);
+ if (ret) {
+ devm_kfree(_DEV(tee), ctx);
+ return ERR_PTR(ret);
+ }
+
+ mutex_lock(&tee->lock);
+ tee_inc_stats(&tee->stats[TEE_STATS_CONTEXT_IDX]);
+ list_add_tail(&ctx->entry, &tee->list_ctx);
+ mutex_unlock(&tee->lock);
+
+
+ return ctx;
+}
+
+/**
+ * _tee_context_do_release - Final function to release
+ * and free a context.
+ */
+static void _tee_context_do_release(struct kref *kref)
+{
+ struct tee_context *ctx;
+ struct tee *tee;
+
+ ctx = container_of(kref, struct tee_context, refcount);
+
+ WARN_ON(!ctx || !ctx->tee);
+
+ tee = ctx->tee;
+
+
+ tee_dec_stats(&tee->stats[TEE_STATS_CONTEXT_IDX]);
+ list_del(&ctx->entry);
+
+ devm_kfree(_DEV(tee), ctx);
+ tee_put(tee);
+
+}
+
+/**
+ * tee_context_get - Increase the reference count of
+ * the context.
+ */
+void tee_context_get(struct tee_context *ctx)
+{
+ WARN_ON(!ctx || !ctx->tee);
+
+ kref_get(&ctx->refcount);
+}
+
+static int is_in_list(struct tee *tee, struct list_head *entry)
+{
+ int present = 1;
+
+ if ((entry->next == LIST_POISON1) && (entry->prev == LIST_POISON2))
+ present = 0;
+ return present;
+}
+
+/**
+ * tee_context_put - Decreases the reference count of
+ * the context. If 0, the final
+ * release function is called.
+ */
+void tee_context_put(struct tee_context *ctx)
+{
+ struct tee_context *_ctx = ctx;
+ struct tee *tee;
+
+ (void) _ctx;
+ WARN_ON(!ctx || !ctx->tee);
+ tee = ctx->tee;
+
+ if (!is_in_list(tee, &ctx->entry))
+ return;
+
+ kref_put(&ctx->refcount, _tee_context_do_release);
+}
+
+/**
+ * tee_context_destroy - Request to destroy a context.
+ */
+void tee_context_destroy(struct tee_context *ctx)
+{
+ struct tee *tee;
+
+ if (!ctx || !ctx->tee)
+ return;
+
+ tee = ctx->tee;
+
+
+ mutex_lock(&tee->lock);
+ tee_context_put(ctx);
+ mutex_unlock(&tee->lock);
+}
+
+int tee_context_copy_from_client(const struct tee_context *ctx,
+ void *dest, const void *src, size_t size)
+{
+ int res = 0;
+
+ if (dest && src && (size > 0)) {
+ if (ctx->usr_client)
+ res = copy_from_user(dest, src, size);
+ else
+ memcpy(dest, src, size);
+ }
+ return res;
+}
+
+struct tee_shm *tee_context_alloc_shm_tmp(struct tee_context *ctx,
+ size_t size, const void *src,
+ int type)
+{
+ struct tee_shm *shm;
+
+ type &= (TEEC_MEM_INPUT | TEEC_MEM_OUTPUT);
+
+ shm = tkcore_alloc_shm(ctx->tee, size,
+ TEE_SHM_MAPPED | TEE_SHM_TEMP | type);
+ if (IS_ERR_OR_NULL(shm)) {
+ pr_err("buffer allocation failed (%ld)\n",
+ PTR_ERR(shm));
+ return shm;
+ }
+
+ shm->ctx = ctx;
+
+ if (type & TEEC_MEM_INPUT) {
+ if (tee_context_copy_from_client(ctx,
+ shm->resv.kaddr, src, size)) {
+ pr_err(
+ "tee_context_copy_from_client failed\n");
+ tkcore_shm_free(shm);
+ shm = NULL;
+ }
+ }
+ return shm;
+}
+
+struct tee_shm *tee_context_create_tmpref_buffer(struct tee_context *ctx,
+ size_t size,
+ const void *buffer, int type)
+{
+ struct tee_shm *shm = NULL;
+ int flags;
+
+ switch (type) {
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ flags = TEEC_MEM_OUTPUT;
+ break;
+ case TEEC_MEMREF_TEMP_INPUT:
+ flags = TEEC_MEM_INPUT;
+ break;
+ case TEEC_MEMREF_TEMP_INOUT:
+ flags = TEEC_MEM_INPUT | TEEC_MEM_OUTPUT;
+ break;
+ default:
+ flags = 0;
+ WARN_ON(1);
+ }
+ shm = tee_context_alloc_shm_tmp(ctx, size, buffer, flags);
+ return shm;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_core.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_core.c
new file mode 100644
index 0000000..1444be4
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_core.c
@@ -0,0 +1,958 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/types.h>
+#include <linux/slab.h>
+#include <linux/cdev.h>
+#include <linux/idr.h>
+#include <linux/platform_device.h>
+#include <linux/device.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/uaccess.h>
+#include <asm-generic/ioctl.h>
+#include <linux/sched.h>
+#include <linux/version.h>
+
+#include "linux/tee_core.h"
+#include "linux/tee_ioc.h"
+#include <linux/tee_client_api.h>
+
+#include "tee_core_priv.h"
+#include "tee_sysfs.h"
+#include "tee_shm.h"
+#include "tee_supp_com.h"
+#include "tee_tui.h"
+
+#include "tee_ta_mgmt.h"
+#include "tee_procfs.h"
+
+#include "tee_fp_priv.h"
+#include "tee_clkmgr_priv.h"
+
+#include "pm.h"
+
+static uint32_t nsdrv_feature_flags;
+
+#if defined(CONFIG_ARM)
+
+#include <asm/mach/map.h>
+#include <linux/io.h>
+
+void *__arm_ioremap(unsigned long phys_addr, size_t size, unsigned int mtype)
+{
+ phys_addr_t last_addr;
+ unsigned long offset = phys_addr & ~PAGE_MASK;
+ unsigned long pfn = __phys_to_pfn(phys_addr);
+
+ last_addr = phys_addr + size - 1;
+ if (!size || last_addr < phys_addr)
+ return NULL;
+
+ return __arm_ioremap_pfn(pfn, offset, size, mtype);
+}
+
+#endif
+void *tee_map_cached_shm(unsigned long pa, size_t len)
+{
+#if defined(CONFIG_ARM64)
+ return ioremap_cache(pa, len);
+#elif defined(CONFIG_ARM)
+ return __arm_ioremap(pa, len, MT_MEMORY_RW);
+#else
+#error "tee_map_cached_shm() not implemented for this platform"
+#endif
+}
+EXPORT_SYMBOL(tee_map_cached_shm);
+
+void tee_unmap_cached_shm(void *va)
+{
+ iounmap(va);
+}
+EXPORT_SYMBOL(tee_unmap_cached_shm);
+
+#define _TEE_CORE_FW_VER "1:0.1"
+
+static char *_tee_supp_app_name = "teed";
+
+/* Store the class misc reference */
+static struct class *misc_class;
+
+static int device_match(struct device *device, const void *devname)
+{
+ int ret;
+ struct tee *tee = dev_get_drvdata(device);
+
+ WARN_ON(!tee);
+
+ /*
+ * It shall always return
+ * 0 if tee is a null
+ * ptr
+ */
+ if (tee == NULL)
+ return 0;
+
+ ret = strncmp(devname,
+ tee->name, sizeof(tee->name));
+ return ret == 0;
+}
+
+/*
+ * For the kernel api.
+ * Get a reference on a device tee from the device needed
+ */
+struct tee *tee_get_tee(const char *devname)
+{
+ struct device *device;
+
+ if (!devname)
+ return NULL;
+ device = class_find_device(misc_class, NULL,
+ (void *) devname, device_match);
+ if (!device) {
+ pr_err("can't find device [%s]\n",
+ devname);
+ return NULL;
+ }
+
+ return dev_get_drvdata(device);
+}
+
+void tee_inc_stats(struct tee_stats_entry *entry)
+{
+ entry->count++;
+ if (entry->count > entry->max)
+ entry->max = entry->count;
+}
+
+void tee_dec_stats(struct tee_stats_entry *entry)
+{
+ entry->count--;
+}
+
+int __tee_get(struct tee *tee)
+{
+ int ret = 0;
+ int v;
+
+ WARN_ON(!tee);
+
+ v = atomic_inc_return(&tee->refcount);
+ if (v == 1) {
+ WARN_ON(!try_module_get(tee->ops->owner));
+ get_device(tee->dev);
+
+ if (tee->ops->start)
+ ret = tee->ops->start(tee);
+
+ if (ret) {
+ pr_err("%s::start() failed, err=0x%x\n",
+ tee->name, ret);
+ put_device(tee->dev);
+ module_put(tee->ops->owner);
+ atomic_dec(&tee->refcount);
+ }
+ } else {
+ dev_warn(_DEV(tee), "Unexpected tee->refcount: 0x%x\n", v);
+ return -1;
+ }
+
+ return ret;
+}
+EXPORT_SYMBOL(__tee_get);
+
+
+/**
+ * tee_get - increases refcount of the tee
+ * @tee: [in] tee to increase refcount of
+ *
+ * @note: If tee.ops.start() callback function is available,
+ * it is called when refcount is equal at 1.
+ */
+int tee_get(struct tee *tee)
+{
+ int ret = 0;
+
+ WARN_ON(!tee);
+
+ if (atomic_inc_return(&tee->refcount) == 1) {
+ pr_warn("unexpected refcount 1\n");
+ } else {
+ int count = (int) atomic_read(&tee->refcount);
+
+ if (count > tee->max_refcount)
+ tee->max_refcount = count;
+ }
+ return ret;
+}
+
+/**
+ * tee_put - decreases refcount of the tee
+ * @tee: [in] tee to reduce refcount of
+ *
+ * @note: If tee.ops.stop() callback function is available,
+ * it is called when refcount is equal at 0.
+ */
+int tee_put(struct tee *tee)
+{
+ int ret = 0;
+ int count;
+
+ WARN_ON(!tee);
+
+ if (atomic_dec_and_test(&tee->refcount)) {
+ pr_warn("unexpected refcount: 0\n");
+ /*
+ * tee should never be stopped
+ */
+ }
+
+ count = (int)atomic_read(&tee->refcount);
+ return ret;
+}
+
+static int tee_supp_open(struct tee *tee)
+{
+ int ret = 0;
+
+ WARN_ON(!tee->rpc);
+
+ if (strncmp(_tee_supp_app_name, current->comm,
+ strlen(_tee_supp_app_name)) == 0) {
+ if (atomic_add_return(1, &tee->rpc->used) > 1) {
+ ret = -EBUSY;
+ pr_err("Only one teed is allowed\n");
+ atomic_sub(1, &tee->rpc->used);
+ }
+ }
+
+ return ret;
+}
+
+static void tee_supp_release(struct tee *tee)
+{
+ WARN_ON(!tee->rpc);
+
+ if ((atomic_read(&tee->rpc->used) == 1) &&
+ (strncmp(_tee_supp_app_name, current->comm,
+ strlen(_tee_supp_app_name)) == 0))
+ atomic_sub(1, &tee->rpc->used);
+}
+
+static int tee_ctx_open(struct inode *inode, struct file *filp)
+{
+ struct tee_context *ctx;
+ struct tee *tee;
+ int ret;
+
+ tee = container_of(filp->private_data, struct tee, miscdev);
+
+ WARN_ON(!tee);
+ WARN_ON(tee->miscdev.minor != iminor(inode));
+
+ ret = tee_supp_open(tee);
+ if (ret)
+ return ret;
+
+ ctx = tee_context_create(tee);
+ if (IS_ERR_OR_NULL(ctx))
+ return PTR_ERR(ctx);
+
+ ctx->usr_client = 1;
+ filp->private_data = ctx;
+
+ return 0;
+}
+
+static int tee_ctx_release(struct inode *inode, struct file *filp)
+{
+ struct tee_context *ctx = filp->private_data;
+ struct tee *tee;
+
+ if (!ctx)
+ return -EINVAL;
+
+ WARN_ON(!ctx->tee);
+ tee = ctx->tee;
+ WARN_ON(tee->miscdev.minor != iminor(inode));
+
+ tee_context_destroy(ctx);
+ tee_supp_release(tee);
+
+ return 0;
+}
+
+static int tee_do_create_session(struct tee_context *ctx,
+ struct tee_cmd_io __user *u_cmd)
+{
+ int ret = -EINVAL;
+ struct tee_cmd_io k_cmd;
+ struct tee *tee;
+
+ tee = ctx->tee;
+ WARN_ON(!ctx->usr_client);
+
+
+ if (copy_from_user(&k_cmd, (void *)u_cmd, sizeof(struct tee_cmd_io))) {
+ pr_err("create_session: copy_from_user failed\n");
+ goto exit;
+ }
+
+ if (k_cmd.fd_sess > 0) {
+ pr_err("invalid fd_sess %d\n", k_cmd.fd_sess);
+ goto exit;
+ }
+
+ if ((k_cmd.op == NULL) || (k_cmd.uuid == NULL) ||
+ ((k_cmd.data != NULL) && (k_cmd.data_size == 0)) ||
+ ((k_cmd.data == NULL) && (k_cmd.data_size != 0))) {
+ pr_err("op or/and data parameters are not valid\n");
+ goto exit;
+ }
+
+ ret = tee_session_create_fd(ctx, &k_cmd);
+ put_user(k_cmd.err, &u_cmd->err);
+ put_user(k_cmd.origin, &u_cmd->origin);
+ if (ret)
+ goto exit;
+
+ put_user(k_cmd.fd_sess, &u_cmd->fd_sess);
+
+exit:
+ return ret;
+}
+
+static int tee_do_shm_alloc_perm(struct tee_context *ctx,
+ struct tee_shm_io __user *u_shm)
+{
+ int ret = -EINVAL;
+ struct tee_shm_io k_shm;
+ struct tee *tee = ctx->tee;
+
+ (void) tee;
+
+ if (copy_from_user(&k_shm, (void *)u_shm, sizeof(struct tee_shm_io))) {
+ pr_err("shm_alloc_perm: copy_from_user failed\n");
+ goto exit;
+ }
+
+ ret = tee_shm_alloc_io_perm(ctx, &k_shm);
+ if (ret)
+ goto exit;
+
+ put_user(k_shm.paddr, &u_shm->paddr);
+ put_user(k_shm.fd_shm, &u_shm->fd_shm);
+ put_user(k_shm.flags, &u_shm->flags);
+
+exit:
+ return ret;
+}
+
+static int tee_do_shm_alloc(struct tee_context *ctx,
+ struct tee_shm_io __user *u_shm)
+{
+ int ret = -EINVAL;
+ struct tee_shm_io k_shm;
+ struct tee *tee = ctx->tee;
+
+ WARN_ON(!ctx->usr_client);
+
+
+ if (copy_from_user(&k_shm, (void *)u_shm, sizeof(struct tee_shm_io))) {
+ pr_err("copy_from_user failed\n");
+ goto exit;
+ }
+
+ if ((k_shm.buffer != NULL) || (k_shm.fd_shm != 0) ||
+ ((k_shm.flags & tee->shm_flags) == 0) ||
+ (k_shm.registered != 0)) {
+ pr_err(
+ "shm parameters are not valid %p %d %08x %08x %d\n",
+ (void *) k_shm.buffer,
+ k_shm.fd_shm,
+ (unsigned int) k_shm.flags,
+ (unsigned int) tee->shm_flags,
+ k_shm.registered);
+ goto exit;
+ }
+
+ ret = tee_shm_alloc_io(ctx, &k_shm);
+ if (ret)
+ goto exit;
+
+ put_user(k_shm.fd_shm, &u_shm->fd_shm);
+ put_user(k_shm.flags, &u_shm->flags);
+
+exit:
+ return ret;
+}
+
+static int tee_do_get_fd_for_rpc_shm(struct tee_context *ctx,
+ struct tee_shm_io __user *u_shm)
+{
+ int ret = -EINVAL;
+ struct tee_shm_io k_shm;
+ struct tee *tee = ctx->tee;
+
+
+ WARN_ON(!ctx->usr_client);
+
+ if (copy_from_user(&k_shm, (void *)u_shm, sizeof(struct tee_shm_io))) {
+ pr_err("copy_from_user failed\n");
+ goto exit;
+ }
+
+ if (k_shm.registered != 0) {
+ pr_err("expecting shm to be unregistered\n");
+ goto exit;
+ }
+
+ if ((k_shm.buffer == NULL) || (k_shm.size == 0) ||
+ (k_shm.fd_shm != 0)) {
+ pr_err("Invalid shm param. buffer: %p size: %u fd: %d\n",
+ k_shm.buffer, k_shm.size, k_shm.fd_shm);
+ goto exit;
+ }
+
+ if ((k_shm.flags & ~(tee->shm_flags)) ||
+ ((k_shm.flags & tee->shm_flags) == 0)) {
+ pr_err(
+ "Invalid shm flags: 0x%x expecting to be within 0x%x\n",
+ k_shm.flags, tee->shm_flags);
+ goto exit;
+ }
+
+ ret = tee_shm_fd_for_rpc(ctx, &k_shm);
+ if (ret)
+ goto exit;
+
+ put_user(k_shm.fd_shm, &u_shm->fd_shm);
+
+exit:
+
+ return ret;
+}
+
+static int tee_tui_notify(uint32_t arg)
+{
+ if (teec_notify_event(arg))
+ return 0;
+
+ return -EINVAL;
+}
+
+static int tee_tui_wait(uint32_t __user *u_arg)
+{
+ int r;
+ uint32_t cmd_id;
+
+ r = teec_wait_cmd(&cmd_id);
+ if (r)
+ return r;
+
+ if (copy_to_user(u_arg, &cmd_id, sizeof(cmd_id)))
+ return -EFAULT;
+
+ return 0;
+}
+
+static long tee_internal_ioctl(struct tee_context *ctx,
+ unsigned int cmd,
+ void __user *u_arg)
+{
+ int ret = -EINVAL;
+
+ switch (cmd) {
+ case TEE_OPEN_SESSION_IOC:
+ ret = tee_do_create_session(ctx,
+ (struct tee_cmd_io __user *) u_arg);
+ break;
+
+ case TEE_ALLOC_SHM_PERM_IOC:
+ ret = tee_do_shm_alloc_perm(ctx,
+ (struct tee_shm_io __user *) u_arg);
+ break;
+
+ case TEE_ALLOC_SHM_IOC:
+ ret = tee_do_shm_alloc(ctx,
+ (struct tee_shm_io __user *) u_arg);
+ break;
+
+ case TEE_GET_FD_FOR_RPC_SHM_IOC:
+ ret = tee_do_get_fd_for_rpc_shm(ctx,
+ (struct tee_shm_io __user *) u_arg);
+ break;
+
+ case TEE_TUI_NOTIFY_IOC:
+ ret = tee_tui_notify(
+ (uint32_t) (unsigned long) u_arg);
+ break;
+
+ case TEE_TUI_WAITCMD_IOC:
+ ret = tee_tui_wait(
+ (uint32_t __user *) u_arg);
+ break;
+
+ case TEE_INSTALL_TA_IOC:
+ ret = tee_install_sp_ta(ctx, u_arg);
+ break;
+
+ case TEE_INSTALL_TA_RESP_IOC:
+ ret = tee_install_sp_ta_response(
+ ctx, u_arg);
+ break;
+
+ case TEE_DELETE_TA_IOC:
+ ret = tee_delete_sp_ta(ctx, u_arg);
+ break;
+
+ case TEE_QUERY_DRV_FEATURE_IOC:
+ if (u_arg) {
+ pr_info("tkcoredrv: nsdrv feature = 0x%x\n",
+ nsdrv_feature_flags);
+ if (copy_to_user(u_arg, &nsdrv_feature_flags,
+ sizeof(nsdrv_feature_flags))) {
+ ret = -EFAULT;
+ }
+ } else
+ ret = -EINVAL;
+
+ break;
+
+ default:
+ pr_err("internal_ioctl: Unknown command: %u\n", cmd);
+ ret = -EINVAL;
+ }
+
+ return ret;
+}
+
+#ifdef CONFIG_COMPAT
+
+static int convert_compat_tee_shm(struct TEEC_SharedMemory __user *shm)
+{
+ if (unlikely(put_user(0, ((uint32_t __user *) &(shm->buffer)) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0, ((uint32_t __user *) &(shm->size)) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0, ((uint32_t __user *) &(shm->d.fd)) + 1)))
+ return -EFAULT;
+
+ return 0;
+}
+
+static int convert_compat_tee_param(union TEEC_Parameter __user *p,
+ uint32_t type)
+{
+ struct TEEC_SharedMemory __user *p_shm;
+
+ switch (type) {
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+
+ if (unlikely(put_user(0,
+ ((uint32_t __user *) &(p->tmpref.buffer)) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0,
+ ((uint32_t __user *) &(p->tmpref.size)) + 1)))
+ return -EFAULT;
+
+ break;
+
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ case TEEC_MEMREF_WHOLE:
+
+ if (unlikely(put_user(0,
+ ((uint32_t __user *) &(p->memref.parent)) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0,
+ ((uint32_t __user *) &(p->memref.size)) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0,
+ ((uint32_t __user *) &(p->memref.offset)) + 1)))
+ return -EFAULT;
+
+ if ((copy_from_user(&p_shm, &p->memref.parent,
+ sizeof(p_shm))))
+ return -EFAULT;
+
+ if (p_shm == NULL)
+ break;
+
+ if (convert_compat_tee_shm(p_shm))
+ return -EFAULT;
+
+ break;
+
+ default:
+ break;
+ }
+
+ return 0;
+}
+
+int convert_compat_tee_cmd(struct tee_cmd_io __user *u_cmd)
+{
+ uint32_t i;
+ struct TEEC_Operation __user *p_op;
+ uint32_t paramTypes;
+
+ if (u_cmd == NULL)
+ return -EINVAL;
+
+ if (unlikely(put_user(0, ((uint32_t __user *) &u_cmd->uuid) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0, ((uint32_t __user *) &u_cmd->data) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0, ((uint32_t __user *) &u_cmd->op) + 1)))
+ return -EFAULT;
+
+ if (copy_from_user(&p_op, &u_cmd->op, sizeof(p_op)))
+ return -EFAULT;
+
+ if (p_op == NULL)
+ return -EINVAL;
+
+ if (copy_from_user(¶mTypes, (uint32_t __user *) &p_op->paramTypes,
+ sizeof(p_op->paramTypes)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0, ((uint32_t __user *) &p_op->session) + 1)))
+ return -EFAULT;
+
+ for (i = 0; i < TEEC_CONFIG_PAYLOAD_REF_COUNT; i++) {
+ if (convert_compat_tee_param(&p_op->params[i],
+ TEEC_PARAM_TYPE_GET(paramTypes, i))) {
+ pr_err("bad param %u\n", i);
+ return -EFAULT;
+ }
+ }
+
+ return 0;
+}
+
+int convert_compat_tee_shm_io(struct tee_shm_io __user *shm_io)
+{
+ if (shm_io == NULL)
+ return -EINVAL;
+
+ if (unlikely(put_user(0, ((uint32_t __user *) &shm_io->buffer) + 1)))
+ return -EFAULT;
+
+ return 0;
+}
+
+int convert_compat_tee_spta_inst(struct tee_spta_inst_desc __user *spta)
+{
+ if (spta == NULL)
+ return -EINVAL;
+
+ if (unlikely(put_user(0,
+ ((uint32_t __user *) &spta->ta_binary) + 1)))
+ return -EFAULT;
+
+ if (unlikely(put_user(0,
+ ((uint32_t __user *) &spta->response_len) + 1)))
+ return -EFAULT;
+
+ return 0;
+}
+
+static long tee_compat_ioctl(struct file *filp, unsigned int cmd,
+ unsigned long arg)
+{
+ struct tee_context *ctx = filp->private_data;
+ void __user *u_arg;
+
+ WARN_ON(!ctx);
+ WARN_ON(!ctx->tee);
+
+ if (is_compat_task())
+ u_arg = compat_ptr(arg);
+ else
+ u_arg = (void __user *)arg;
+
+ switch (cmd) {
+ case TEE_OPEN_SESSION_IOC:
+ if (convert_compat_tee_cmd((struct tee_cmd_io __user *) u_arg))
+ return -EFAULT;
+ break;
+
+ case TEE_ALLOC_SHM_PERM_IOC:
+ case TEE_ALLOC_SHM_IOC:
+ case TEE_GET_FD_FOR_RPC_SHM_IOC:
+ if (convert_compat_tee_shm_io(
+ (struct tee_shm_io __user *) u_arg))
+ return -EFAULT;
+ break;
+
+ case TEE_INSTALL_TA_IOC:
+ if (convert_compat_tee_spta_inst(
+ (struct tee_spta_inst_desc __user *) u_arg))
+ return -EFAULT;
+ break;
+
+ default:
+ break;
+ }
+
+ return tee_internal_ioctl(ctx, cmd, u_arg);
+}
+#endif
+
+static long tee_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+{
+ struct tee_context *ctx = filp->private_data;
+
+ WARN_ON(!ctx);
+ WARN_ON(!ctx->tee);
+
+ return tee_internal_ioctl(ctx, cmd, (void __user *) arg);
+}
+
+const struct file_operations tee_fops = {
+ .owner = THIS_MODULE,
+ .read = tee_supp_read,
+ .write = tee_supp_write,
+ .open = tee_ctx_open,
+ .release = tee_ctx_release,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = tee_compat_ioctl,
+#endif
+ .unlocked_ioctl = tee_ioctl
+};
+
+static void tee_plt_device_release(struct device *dev)
+{
+ (void) dev;
+}
+
+static spinlock_t tee_idr_lock;
+static struct idr tee_idr;
+
+/* let caller to guarantee tee
+ * and id are not NULL. using lock to protect
+ */
+int tee_core_alloc_uuid(void *ptr)
+{
+ int r;
+
+ idr_preload(GFP_KERNEL);
+
+ spin_lock(&tee_idr_lock);
+ r = idr_alloc(&tee_idr, ptr, 1, 0, GFP_NOWAIT);
+ if (r < 0)
+ pr_err("Bad alloc tee_uuid. rv: %d\n",
+ r);
+ spin_unlock(&tee_idr_lock);
+
+ idr_preload_end();
+
+ return r;
+}
+
+void *tee_core_uuid2ptr(int id)
+{
+ return idr_find(&tee_idr, id);
+}
+
+/* let caller to guarantee tee
+ *and id are not NULL
+ */
+void tee_core_free_uuid(int id)
+{
+ idr_remove(&tee_idr, id);
+}
+
+struct tee *tee_core_alloc(struct device *dev, char *name, int id,
+ const struct tee_ops *ops, size_t len)
+{
+ struct tee *tee;
+
+ if (!dev || !name || !ops ||
+ !ops->open || !ops->close || !ops->alloc || !ops->free)
+ return NULL;
+
+ tee = devm_kzalloc(dev, sizeof(struct tee) + len, GFP_KERNEL);
+ if (!tee) {
+ tee = NULL;
+ pr_err("core_alloc: kzalloc failed\n");
+ return tee;
+ }
+
+ if (!dev->release)
+ dev->release = tee_plt_device_release;
+
+ tee->dev = dev;
+ tee->id = id;
+ tee->ops = ops;
+ tee->priv = &tee[1];
+
+ snprintf(tee->name, sizeof(tee->name), "%s", name);
+ pr_info("TEE core: Alloc the misc device \"%s\" (id=%d)\n",
+ tee->name, tee->id);
+
+ tee->miscdev.parent = dev;
+ tee->miscdev.minor = MISC_DYNAMIC_MINOR;
+ tee->miscdev.name = tee->name;
+ tee->miscdev.fops = &tee_fops;
+
+ mutex_init(&tee->lock);
+ atomic_set(&tee->refcount, 0);
+ INIT_LIST_HEAD(&tee->list_ctx);
+ INIT_LIST_HEAD(&tee->list_rpc_shm);
+
+ tee->state = TEE_OFFLINE;
+ tee->shm_flags = TEEC_MEM_INPUT | TEEC_MEM_OUTPUT | TEEC_MEM_NONSECURE;
+ tee->test = 0;
+
+ if ((tee_supp_init(tee))) {
+ devm_kfree(dev, tee);
+ return NULL;
+ }
+
+ return tee;
+}
+EXPORT_SYMBOL(tee_core_alloc);
+
+int tee_core_free(struct tee *tee)
+{
+ if (tee) {
+ tee_supp_deinit(tee);
+ devm_kfree(tee->dev, tee);
+ }
+ return 0;
+}
+EXPORT_SYMBOL(tee_core_free);
+
+int tee_core_add(struct tee *tee)
+{
+ int rc = 0;
+
+ if (!tee)
+ return -EINVAL;
+
+ rc = misc_register(&tee->miscdev);
+ if (rc != 0) {
+ pr_err("misc_register() failed with ret = %d\n",
+ rc);
+ return rc;
+ }
+
+ dev_set_drvdata(tee->miscdev.this_device, tee);
+
+ rc = tee_init_procfs(tee);
+ if (rc) {
+ misc_deregister(&tee->miscdev);
+ return rc;
+ }
+
+ rc = tee_init_sysfs(tee);
+ if (rc) {
+ misc_deregister(&tee->miscdev);
+ return rc;
+ }
+
+ /* Register a static reference on the class misc
+ * to allow finding device by class
+ */
+ WARN_ON(!tee->miscdev.this_device->class);
+
+ if (misc_class)
+ WARN_ON(misc_class != tee->miscdev.this_device->class);
+ else
+ misc_class = tee->miscdev.this_device->class;
+
+ pr_info(
+ "TKCore misc: Register the misc device \"%s\" (id=%d,minor=%d)\n",
+ dev_name(tee->miscdev.this_device), tee->id,
+ tee->miscdev.minor);
+
+ return rc;
+}
+EXPORT_SYMBOL(tee_core_add);
+
+int tee_core_del(struct tee *tee)
+{
+ if (tee) {
+ pr_info(
+ "TEE Core: Destroy the misc device \"%s\" (id=%d)\n",
+ dev_name(tee->miscdev.this_device), tee->id);
+
+ tee_cleanup_sysfs(tee);
+
+ if (tee->miscdev.minor != MISC_DYNAMIC_MINOR) {
+ pr_info(
+ "TEE Core: Deregister the misc device \"%s\" (id=%d)\n",
+ dev_name(tee->miscdev.this_device), tee->id);
+ misc_deregister(&tee->miscdev);
+ }
+ }
+
+ tee_core_free(tee);
+
+ return 0;
+}
+EXPORT_SYMBOL(tee_core_del);
+
+static int __init tee_core_init(void)
+{
+ int r;
+
+ pr_info("\nTEE Core Framework initialization (ver %s)\n",
+ _TEE_CORE_FW_VER);
+
+ r = tkcore_tee_pm_init();
+ if (r) {
+ pr_err("tkcore_tee_pm_init() failed with %d\n", r);
+ return r;
+ }
+
+ spin_lock_init(&tee_idr_lock);
+ idr_init(&tee_idr);
+
+ tee_fp_init();
+ tee_clkmgr_init();
+ tee_ta_mgmt_init();
+
+ return 0;
+}
+
+static void __exit tee_core_exit(void)
+{
+ pr_info("TEE Core Framework unregistered\n");
+
+ tkcore_tee_pm_exit();
+
+ tee_clkmgr_exit();
+ tee_fp_exit();
+}
+
+#ifndef MODULE
+rootfs_initcall(tee_core_init);
+#else
+module_init(tee_core_init);
+#endif
+module_exit(tee_core_exit);
+
+MODULE_AUTHOR("TrustKernel");
+MODULE_DESCRIPTION("TrustKernel TKCore TEEC v1.0");
+MODULE_SUPPORTED_DEVICE("");
+MODULE_VERSION(_TEE_CORE_FW_VER);
+MODULE_LICENSE("GPL");
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_core_priv.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_core_priv.h
new file mode 100644
index 0000000..0a752d5
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_core_priv.h
@@ -0,0 +1,59 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef __TEE_CORE_PRIV_H__
+#define __TEE_CORE_PRIV_H__
+
+#include "linux/tee_core.h"
+#include "linux/tee_ioc.h"
+
+/* from tee_core_module.c */
+int tee_get(struct tee *tee);
+int tee_put(struct tee *tee);
+
+void tee_inc_stats(struct tee_stats_entry *entry);
+void tee_dec_stats(struct tee_stats_entry *entry);
+
+/* from tee_context.c */
+int tee_context_dump(struct tee *tee, char *buff, size_t len);
+
+struct tee_context *tee_context_create(struct tee *tee);
+void tee_context_destroy(struct tee_context *ctx);
+
+void tee_context_get(struct tee_context *ctx);
+void tee_context_put(struct tee_context *ctx);
+
+struct tee_shm *tee_context_create_tmpref_buffer(struct tee_context *ctx,
+ size_t size,
+ const void *buffer, int type);
+struct tee_shm *tee_context_alloc_shm_tmp(struct tee_context *ctx, size_t size,
+ const void *data, int type);
+int tee_context_copy_from_client(const struct tee_context *ctx, void *dest,
+ const void *src, size_t size);
+
+/* from tee_session.c */
+int tee_session_create_fd(struct tee_context *ctx, struct tee_cmd_io *cmd_io);
+struct tee_session *tee_session_create_and_open(struct tee_context *ctx,
+ struct tee_cmd_io *cmd_io);
+int tee_session_close_and_destroy(struct tee_session *sess);
+
+struct tee *tee_get_tee(const char *devname);
+int tee_session_invoke_be(struct tee_session *sess, struct tee_cmd_io *cmd_io);
+
+int tee_core_alloc_uuid(void *ptr);
+void tee_core_free_uuid(int id);
+void *tee_core_uuid2ptr(int id);
+
+#ifdef CONFIG_COMPAT
+
+int convert_compat_tee_cmd(struct tee_cmd_io __user *u_cmd);
+
+int convert_compat_tee_shm_io(struct tee_shm_io __user *shm_io);
+
+int convert_compat_tee_spta_inst(struct tee_spta_inst_desc __user *spta);
+
+#endif
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_fp.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_fp.c
new file mode 100644
index 0000000..ea75537
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_fp.c
@@ -0,0 +1,219 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/errno.h>
+
+#include <linux/tee_fp.h>
+
+#include <tee_kernel_api.h>
+
+#include "tee_fp_priv.h"
+
+static struct TEEC_UUID SENSOR_DETECTOR_TA_UUID = { 0x966d3f7c, 0x04ef, 0x1beb,
+ { 0x08, 0xb7, 0x57, 0xf3, 0x7a, 0x6d, 0x87, 0xf9 } };
+
+#define CMD_READ_CHIPID 0x0
+#define CMD_DISABLE 0x1
+#define CMD_CONFIG_PADSEL 0x2
+
+int tee_spi_cfg_padsel(uint32_t padsel)
+{
+ struct TEEC_Context context;
+ struct TEEC_Session session;
+ struct TEEC_Operation op;
+
+ TEEC_Result r;
+
+ uint32_t returnOrigin;
+
+ pr_info("padsel=0x%x\n", padsel);
+
+ memset(&context, 0, sizeof(context));
+ memset(&session, 0, sizeof(session));
+ memset(&op, 0, sizeof(op));
+
+ r = TEEC_InitializeContext(NULL, &context);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_InitializeContext() failed with 0x%08x\n", r);
+ return r;
+ }
+
+ r = TEEC_OpenSession(
+ &context, &session, &SENSOR_DETECTOR_TA_UUID,
+ TEEC_LOGIN_PUBLIC,
+ NULL, NULL, &returnOrigin);
+
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_OpenSession failed with 0x%x returnOrigun: %u\n",
+ r, returnOrigin);
+ TEEC_FinalizeContext(&context);
+ return r;
+ }
+
+ op.paramTypes = TEEC_PARAM_TYPES(
+ TEEC_VALUE_INPUT,
+ TEEC_NONE,
+ TEEC_NONE,
+ TEEC_NONE);
+
+ op.params[0].value.a = padsel;
+
+ r = TEEC_InvokeCommand(&session, CMD_CONFIG_PADSEL, &op, &returnOrigin);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_InvokeCommand() failed with 0x%08x returnOrigin: %u\n",
+ r, returnOrigin);
+ }
+
+ TEEC_CloseSession(&session);
+ TEEC_FinalizeContext(&context);
+
+ return r;
+}
+EXPORT_SYMBOL(tee_spi_cfg_padsel);
+
+int tee_spi_transfer(void *conf, uint32_t conf_size,
+ void *inbuf, void *outbuf, uint32_t size)
+{
+ struct TEEC_Context context;
+ struct TEEC_Session session;
+ struct TEEC_Operation op;
+
+ TEEC_Result r;
+
+ char *buf;
+ uint32_t returnOrigin;
+
+ pr_info("conf=%p conf_size=%u inbuf=%p outbuf=%p size=%u\n",
+ conf, conf_size, inbuf, outbuf, size);
+
+ if (!conf || !inbuf || !outbuf) {
+ pr_err("Bad parameters NULL buf\n");
+ return -EINVAL;
+ }
+
+ if (size == 0) {
+ pr_err("zero buf size\n");
+ return -EINVAL;
+ }
+
+ memset(&context, 0, sizeof(context));
+ memset(&session, 0, sizeof(session));
+ memset(&op, 0, sizeof(op));
+
+ memcpy(outbuf, inbuf, size);
+
+ r = TEEC_InitializeContext(NULL, &context);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_InitializeContext() failed with 0x%08x\n", r);
+ return r;
+ }
+
+ r = TEEC_OpenSession(
+ &context, &session, &SENSOR_DETECTOR_TA_UUID,
+ TEEC_LOGIN_PUBLIC,
+ NULL, NULL, &returnOrigin);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_OpenSession failed with 0x%x returnOrigun: %u\n",
+ r, returnOrigin);
+ TEEC_FinalizeContext(&context);
+ return r;
+ }
+
+ op.paramTypes = TEEC_PARAM_TYPES(
+ TEEC_MEMREF_TEMP_INPUT,
+ TEEC_MEMREF_TEMP_INOUT,
+ TEEC_NONE,
+ TEEC_NONE);
+
+ op.params[0].tmpref.buffer = conf;
+ op.params[0].tmpref.size = conf_size;
+
+ op.params[1].tmpref.buffer = outbuf;
+ op.params[1].tmpref.size = size;
+
+ buf = outbuf;
+
+ r = TEEC_InvokeCommand(&session, CMD_READ_CHIPID, &op, &returnOrigin);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_InvokeCommand() failed with 0x%08x returnOrigin: %u\n",
+ r, returnOrigin);
+ }
+
+ TEEC_CloseSession(&session);
+ TEEC_FinalizeContext(&context);
+
+ return r;
+}
+EXPORT_SYMBOL(tee_spi_transfer);
+
+int tee_spi_transfer_disable(void)
+{
+ struct TEEC_Context context;
+ struct TEEC_Session session;
+ struct TEEC_Operation op;
+
+ TEEC_Result r;
+
+ uint32_t returnOrigin;
+
+ memset(&context, 0, sizeof(context));
+ memset(&session, 0, sizeof(session));
+ memset(&op, 0, sizeof(op));
+
+ r = TEEC_InitializeContext(NULL, &context);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_InitializeContext() failed with 0x%08x\n", r);
+ return r;
+ }
+
+ r = TEEC_OpenSession(
+ &context, &session, &SENSOR_DETECTOR_TA_UUID,
+ TEEC_LOGIN_PUBLIC,
+ NULL, NULL, &returnOrigin);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_OpenSession failed with 0x%x returnOrigun: %u\n",
+ r, returnOrigin);
+ TEEC_FinalizeContext(&context);
+ return r;
+ }
+
+ op.paramTypes = TEEC_PARAM_TYPES(
+ TEEC_NONE,
+ TEEC_NONE,
+ TEEC_NONE,
+ TEEC_NONE);
+
+ r = TEEC_InvokeCommand(&session, CMD_DISABLE, &op, &returnOrigin);
+ if (r != TEEC_SUCCESS) {
+ pr_err(
+ "TEEC_InvokeCommand() failed with 0x%08x returnOrigin: %u\n",
+ r, returnOrigin);
+ }
+
+ TEEC_CloseSession(&session);
+ TEEC_FinalizeContext(&context);
+
+ return r;
+}
+EXPORT_SYMBOL(tee_spi_transfer_disable);
+
+int tee_fp_init(void)
+{
+ return 0;
+}
+
+void tee_fp_exit(void)
+{
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_fp_priv.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_fp_priv.h
new file mode 100644
index 0000000..ee9de5f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_fp_priv.h
@@ -0,0 +1,12 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_FP_PRIV_H
+#define TEE_FP_PRIV_H
+
+int tee_fp_init(void);
+void tee_fp_exit(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_kernel_api.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_kernel_api.c
new file mode 100644
index 0000000..a2285a6
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_kernel_api.c
@@ -0,0 +1,332 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/module.h>
+#include <linux/device.h>
+#include <linux/miscdevice.h>
+#include <linux/io.h>
+#include <linux/vmalloc.h>
+
+#include "linux/tee_kernel_api.h"
+#include "linux/tee_core.h"
+#include "linux/tee_ioc.h"
+
+#include "tee_core_priv.h"
+#include "tee_shm.h"
+#include "tee_supp_com.h"
+
+#define TEE_TZ_DEVICE_NAME "tkcoredrv"
+
+static void reset_tee_cmd(struct tee_cmd_io *cmd)
+{
+ memset(cmd, 0, sizeof(struct tee_cmd_io));
+ cmd->fd_sess = -1;
+ cmd->cmd = 0;
+ cmd->uuid = NULL;
+ cmd->origin = TEEC_ORIGIN_API;
+ cmd->err = TEEC_SUCCESS;
+ cmd->data = NULL;
+ cmd->data_size = 0;
+ cmd->op = NULL;
+}
+
+TEEC_Result TEEC_InitializeContext(const char *name,
+ struct TEEC_Context *context)
+{
+ struct tee *tee;
+ struct tee_context *ctx;
+
+ if (!context)
+ return TEEC_ERROR_BAD_PARAMETERS;
+
+ context->fd = 0;
+
+ if (name == NULL)
+ strncpy(context->devname, TEE_TZ_DEVICE_NAME,
+ sizeof(context->devname));
+ else
+ strncpy(context->devname, name, sizeof(context->devname));
+
+ tee = tee_get_tee(context->devname);
+ if (!tee) {
+ pr_err("can't get device [%s]\n", name);
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ ctx = tee_context_create(tee);
+ if (IS_ERR_OR_NULL(ctx)) {
+ pr_err("ctx is NULL\n");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ ctx->usr_client = 0;
+
+ context->fd = tee_core_alloc_uuid(ctx);
+ if (context->fd < 0) {
+
+ if (context->fd == -ENOSPC || context->fd == -ENOMEM)
+ return TEEC_ERROR_OUT_OF_MEMORY;
+
+ if (context->fd == -EINVAL) {
+ pr_err("context->fd is invalid\n");
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ return TEEC_ERROR_GENERIC;
+ }
+
+ return TEEC_SUCCESS;
+}
+EXPORT_SYMBOL(TEEC_InitializeContext);
+
+void TEEC_FinalizeContext(struct TEEC_Context *context)
+{
+ struct tee_context *ctx;
+
+ if (!context || !context->fd) {
+ pr_err("can't release context %p:[%s]\n",
+ context, strnlen(context->devname, 256) < 256 ?
+ context->devname : "[invalid]");
+ return;
+ }
+
+ ctx = tee_core_uuid2ptr(context->fd);
+ if (ctx == NULL) {
+ pr_err("bad context->fd %d provided\n",
+ context->fd);
+ return;
+ }
+
+ tee_core_free_uuid(context->fd);
+ tee_context_destroy(ctx);
+}
+EXPORT_SYMBOL(TEEC_FinalizeContext);
+
+TEEC_Result TEEC_OpenSession(struct TEEC_Context *context,
+ struct TEEC_Session *session,
+ const struct TEEC_UUID *destination,
+ uint32_t connectionMethod,
+ const void *connectionData,
+ struct TEEC_Operation *operation,
+ uint32_t *return_origin)
+{
+ struct TEEC_Operation dummy_op;
+ struct tee_cmd_io cmd;
+ struct tee_session *sess;
+ struct tee_context *ctx;
+ uint32_t error_origin;
+
+ if (!operation) {
+ /*
+ * The code here exist because Global Platform API states that
+ * it is allowed to give operation as a NULL pointer.
+ * In kernel and secure world we in most cases don't want
+ * this to be NULL, hence we use this dummy operation when
+ * a client doesn't provide any operation.
+ */
+ memset(&dummy_op, 0, sizeof(struct TEEC_Operation));
+ operation = &dummy_op;
+ }
+
+ if (!context || !session || !destination || !operation)
+ return TEEC_ERROR_BAD_PARAMETERS;
+
+ session->fd = 0;
+
+ ctx = tee_core_uuid2ptr(context->fd);
+ if (ctx == NULL) {
+ pr_err("bad context_fd %d provided\n",
+ context->fd);
+ if (return_origin)
+ *return_origin = TEEC_ORIGIN_COMMS;
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ reset_tee_cmd(&cmd);
+ cmd.op = operation;
+ cmd.uuid = (struct TEEC_UUID *) destination;
+
+ sess = tee_session_create_and_open(ctx, &cmd);
+ if (IS_ERR_OR_NULL(sess)) {
+ if (cmd.origin)
+ error_origin = cmd.origin;
+ else
+ error_origin = TEEC_ORIGIN_COMMS;
+
+ if (return_origin)
+ *return_origin = error_origin;
+
+ if (cmd.err)
+ return cmd.err;
+ else
+ return TEEC_ERROR_COMMUNICATION;
+ } else {
+ error_origin = cmd.origin;
+ session->fd = tee_core_alloc_uuid(sess);
+ if (session->fd < 0) {
+
+ /* since we failed to alloc uuid, we need
+ * to close this session
+ */
+
+ tee_session_close_and_destroy(sess);
+
+ error_origin = TEEC_ORIGIN_COMMS;
+
+ if (return_origin)
+ *return_origin = error_origin;
+
+ if (session->fd == -ENOSPC || session->fd == -ENOMEM)
+ return TEEC_ERROR_OUT_OF_MEMORY;
+ if (session->fd == -EINVAL)
+ return TEEC_ERROR_BAD_PARAMETERS;
+
+ return TEEC_ERROR_GENERIC;
+ }
+
+ if (return_origin)
+ *return_origin = error_origin;
+
+ return cmd.err;
+ }
+}
+EXPORT_SYMBOL(TEEC_OpenSession);
+
+void TEEC_CloseSession(struct TEEC_Session *session)
+{
+ if (session && session->fd) {
+ struct tee_session *sess = tee_core_uuid2ptr(session->fd);
+
+ if (sess == NULL) {
+ pr_err("bad session_id %d provided\n",
+ session->fd);
+ return;
+ }
+
+ tee_core_free_uuid(session->fd);
+
+ tee_session_close_and_destroy(sess);
+ }
+}
+EXPORT_SYMBOL(TEEC_CloseSession);
+
+TEEC_Result TEEC_InvokeCommand(struct TEEC_Session *session,
+ uint32_t commandID,
+ struct TEEC_Operation *operation,
+ uint32_t *return_origin)
+{
+ int ret = 0;
+ struct tee_cmd_io cmd;
+ struct tee_session *sess;
+ uint32_t error_origin;
+ struct TEEC_Operation dummy_op;
+
+ if (!session || !session->fd)
+ return TEEC_ERROR_BAD_PARAMETERS;
+
+ if (!operation) {
+ memset(&dummy_op, 0, sizeof(struct TEEC_Operation));
+ operation = &dummy_op;
+ }
+
+ sess = tee_core_uuid2ptr(session->fd);
+ if (sess == NULL) {
+ pr_err("bad session_fd %d provided\n",
+ session->fd);
+ if (return_origin)
+ *return_origin = TEEC_ORIGIN_COMMS;
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+ reset_tee_cmd(&cmd);
+ cmd.cmd = commandID;
+ cmd.op = operation;
+
+ ret = tee_session_invoke_be(sess, &cmd);
+ if (ret) {
+ if (cmd.origin)
+ error_origin = cmd.origin;
+ else
+ error_origin = TEEC_ORIGIN_COMMS;
+
+ if (return_origin)
+ *return_origin = error_origin;
+
+ if (cmd.err)
+ return cmd.err;
+ else
+ return TEEC_ERROR_COMMUNICATION;
+ } else {
+ if (return_origin)
+ *return_origin = cmd.origin;
+ return cmd.err;
+ }
+}
+EXPORT_SYMBOL(TEEC_InvokeCommand);
+
+TEEC_Result TEEC_RegisterSharedMemory(struct TEEC_Context *context,
+ struct TEEC_SharedMemory *sharedMem)
+{
+ if (!sharedMem)
+ return TEEC_ERROR_BAD_PARAMETERS;
+
+ sharedMem->registered = 1;
+ sharedMem->d.fd = 0;
+ return TEEC_SUCCESS;
+}
+EXPORT_SYMBOL(TEEC_RegisterSharedMemory);
+
+TEEC_Result TEEC_AllocateSharedMemory(struct TEEC_Context *context,
+ struct TEEC_SharedMemory *shared_memory)
+{
+ struct tee_shm_io shm_io;
+ int ret;
+ struct tee_shm *shm;
+ struct tee_context *ctx;
+
+ if (!context || !context->fd || !shared_memory)
+ return TEEC_ERROR_BAD_PARAMETERS;
+
+ shm_io.size = shared_memory->size;
+ shm_io.flags = shared_memory->flags | TEEC_MEM_KAPI;
+
+ ctx = tee_core_uuid2ptr(context->fd);
+ if (ctx == NULL) {
+ pr_err("Invalid fd %d for tee context\n",
+ context->fd);
+ return TEEC_ERROR_BAD_PARAMETERS;
+ }
+
+ ret = tee_shm_alloc_io(ctx, &shm_io);
+ if (ret) {
+ pr_err("tee_shm_alloc_io(%zd) failed\n",
+ shared_memory->size);
+ return TEEC_ERROR_OUT_OF_MEMORY;
+ }
+
+ shared_memory->registered = 0;
+ shared_memory->flags = shm_io.flags;
+ shared_memory->d.fd = shm_io.fd_shm;
+
+ shm = (struct tee_shm *)(long)shm_io.fd_shm;
+ shared_memory->buffer = shm->resv.kaddr;
+
+ return TEEC_SUCCESS;
+}
+EXPORT_SYMBOL(TEEC_AllocateSharedMemory);
+
+void TEEC_ReleaseSharedMemory(struct TEEC_SharedMemory *shared_memory)
+{
+ struct tee_shm *shm;
+
+ if (!shared_memory || shared_memory->registered)
+ return;
+
+ shm = (struct tee_shm *)(long)shared_memory->d.fd;
+ tee_shm_free_io(shm);
+
+ shared_memory->buffer = NULL;
+ shared_memory->d.fd = 0;
+}
+EXPORT_SYMBOL(TEEC_ReleaseSharedMemory);
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_procfs.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_procfs.c
new file mode 100644
index 0000000..7319912
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_procfs.c
@@ -0,0 +1,1030 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/uaccess.h>
+#include <linux/poll.h>
+#include <linux/proc_fs.h>
+#include <linux/interrupt.h>
+#include <linux/mutex.h>
+#include <linux/rwsem.h>
+#include <linux/jiffies.h>
+#include <linux/kthread.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+
+#include <asm/barrier.h>
+
+#include <linux/tee_core.h>
+#include <linux/tee_kernel_lowlevel_api.h>
+
+#include <arm_common/teesmc_st.h>
+#include <arm_common/teesmc.h>
+
+#include "tee_procfs.h"
+#include "tee_core_priv.h"
+
+#ifdef CONFIG_OF
+#include <linux/of_irq.h>
+#endif
+
+#define PROC_DBG(fmt, ...) do {} while (0)
+
+struct tkcore_trace {
+ int level;
+ const int idx;
+ const char *desc;
+};
+
+#define xstr(s) str(s)
+#define str(s) #s
+
+#define TKCORE_DEFINE_TRACE(__x, __idx) \
+ { \
+ .level = 0, \
+ .idx = __idx, \
+ .desc = xstr(__x) \
+ }
+
+#define TEE_LOG_TIMEOUT_MS (500)
+
+static struct mutex trace_mutex;
+
+struct proc_dir_entry *tee_proc_dir;
+
+struct proc_dir_entry *tee_proc_log_file;
+struct proc_dir_entry *tee_proc_trace;
+
+struct proc_dir_entry *tee_proc_drv_version;
+struct proc_dir_entry *tee_proc_tee_version;
+struct proc_dir_entry *tee_proc_teed_version;
+
+union tee_log_ctrl {
+ struct {
+ unsigned int tee_buf_addr;
+ unsigned int tee_buf_size;
+ unsigned int tee_write_pos;
+ unsigned int tee_read_pos;
+
+ unsigned int tee_buf_unread_size;
+
+ unsigned int tee_irq_count;
+ unsigned int tee_reader_alive;
+
+ unsigned int tee_write_seq;
+ unsigned int tee_read_seq;
+ } info;
+ unsigned char data[TEE_LOG_CTL_BUF_SIZE];
+};
+
+struct klog {
+ /* shm for log ctl */
+ union tee_log_ctrl *log_ctl;
+
+ /* tee ringbuffer for log */
+ char *tee_rb;
+ /* tee ring buffer length */
+ uint32_t tee_rb_len;
+
+ /*
+ * whether write_pos
+ * has restarted from
+ * one
+ */
+ bool overwrite;
+ /*
+ * served as notifier
+ * when there's new
+ * log
+ */
+ wait_queue_head_t wq;
+
+ struct task_struct *ts;
+
+ /*
+ * irq for tee to notify
+ * nsdrv to fetch log
+ */
+ int notify_irq;
+};
+
+struct ulog {
+ /*
+ * local read sequence,
+ * only updated by user
+ * apps open this proc
+ * entry
+ */
+ uint32_t rseq;
+
+ /*
+ * buffer containing
+ * temporary str to
+ * pass to CA
+ */
+ const char *tmpbuf;
+
+ /*
+ * ptr to global
+ * klog
+ */
+ struct klog *klog;
+
+};
+
+static struct klog klog;
+
+static inline bool rb_overrun(uint32_t rseq,
+ uint32_t wseq,
+ uint32_t rb_len)
+{
+ return wseq - rseq > rb_len;
+}
+
+static size_t ulog_rb(struct klog *klog,
+ struct ulog *ulog,
+ char __user *buf,
+ size_t count)
+{
+ size_t len = 0;
+ uint32_t wseq;
+
+ union tee_log_ctrl *log_ctl = klog->log_ctl;
+
+ static const char ulog_flag_intr[] =
+ "------ interrupted\n";
+
+ wseq = READ_ONCE(log_ctl->info.tee_write_seq);
+
+ while ((len != count) && ((ulog->rseq != wseq) ||
+ (ulog->tmpbuf && ulog->tmpbuf[0] != '\0'))) {
+ size_t copy_len;
+ unsigned long n;
+
+ if (ulog->tmpbuf == NULL) {
+ if (rb_overrun(ulog->rseq, wseq,
+ klog->tee_rb_len)) {
+ ulog->tmpbuf = ulog_flag_intr;
+ }
+ } else if (ulog->tmpbuf[0] == '\0') {
+ if (klog->overwrite ||
+ wseq >= klog->tee_rb_len) {
+ ulog->rseq = wseq - klog->tee_rb_len;
+ } else {
+ ulog->rseq = 0;
+ }
+ ulog->tmpbuf = NULL;
+ }
+
+ if (ulog->tmpbuf) {
+ size_t tmpbuf_len;
+ const char *tmpbuf;
+
+ tmpbuf = ulog->tmpbuf;
+ tmpbuf_len = strlen(tmpbuf);
+
+ copy_len = (uint32_t) min(tmpbuf_len, count - len);
+ n = copy_to_user(&buf[len], tmpbuf, copy_len);
+
+ if (copy_len == n) {
+ pr_warn("tkcoredrv: failed to copy flag to user");
+ return len;
+ }
+
+ ulog->tmpbuf = &tmpbuf[copy_len - n];
+ len += (copy_len - n);
+ } else {
+ copy_len = min((uint32_t) (count - len),
+ min(klog->tee_rb_len -
+ ulog->rseq % klog->tee_rb_len,
+ wseq - ulog->rseq));
+ n = copy_to_user(&buf[len],
+ &klog->tee_rb[ulog->rseq % klog->tee_rb_len],
+ copy_len);
+ if (copy_len == n) {
+ pr_warn("tkcoredrv: failed to copy klog to user\n");
+ return len;
+ }
+
+ ulog->rseq += (copy_len - n);
+ len += (copy_len - n);
+ }
+
+ wseq = READ_ONCE(log_ctl->info.tee_write_seq);
+ }
+
+ return len;
+}
+
+static ssize_t tee_log_read(struct file *file, char __user *buf,
+ size_t count, loff_t *pos)
+{
+ ssize_t ret;
+ struct ulog *ulog;
+ struct klog *klog;
+
+ if (file == NULL || buf == NULL || pos == NULL)
+ return -EINVAL;
+
+ ulog = (struct ulog *) file->private_data;
+ if (ulog == NULL) {
+ pr_warn("tkcoredrv: file not open correctly\n");
+ return -EINVAL;
+ }
+
+ klog = ulog->klog;
+
+ if (file->f_flags & O_NONBLOCK) {
+ /*
+ * currently nonblock file is
+ * not supported, since
+ * we might need to enter
+ * wait queue
+ */
+ return -EAGAIN;
+ }
+
+ if (ulog->tmpbuf == NULL) {
+ long r;
+
+ do {
+ r = wait_event_interruptible_timeout(klog->wq,
+ ulog->rseq !=
+ READ_ONCE(klog->log_ctl->info.tee_write_seq),
+ msecs_to_jiffies(TEE_LOG_TIMEOUT_MS));
+
+ } while (!r);
+
+ if (r < 0) {
+ /*
+ * woke up due to signal, e.g.
+ * calling program terminated
+ * by CTRL-C
+ */
+ return -EINTR;
+ }
+ }
+
+ ret = ulog_rb(klog, ulog, buf, count);
+ *pos += ret;
+
+ return ret;
+}
+
+int tee_log_open(struct inode *inode, struct file *file)
+{
+ int ret;
+ struct ulog *ulog;
+
+ static const char ulog_flag_begin[] =
+ "------ beginning of tee\n";
+
+ ulog = kmalloc(
+ sizeof(struct ulog),
+ GFP_KERNEL);
+ if (ulog == NULL)
+ return -ENOMEM;
+
+ ulog->tmpbuf = ulog_flag_begin;
+ ulog->klog = &klog;
+
+ ret = nonseekable_open(inode, file);
+
+ if (unlikely(ret)) {
+ kfree(ulog);
+
+ pr_warn("tkcoredrv: open file failed with %d\n", ret);
+ return ret;
+ }
+
+ file->private_data = (void *) ulog;
+
+ return 0;
+}
+
+int tee_log_release(struct inode *inode, struct file *file)
+{
+ kfree(file->private_data);
+ return 0;
+}
+
+static const struct file_operations log_tee_ops = {
+ .read = tee_log_read,
+ .open = tee_log_open,
+ .release = tee_log_release,
+};
+
+/* Guarantee the idx defined here is consistent with TEE */
+struct tkcore_trace tkcore_traces[] = {
+ TKCORE_DEFINE_TRACE(ree_fs, 0),
+ TKCORE_DEFINE_TRACE(enc_fs, 1),
+ TKCORE_DEFINE_TRACE(rpmb_blk, 2),
+ TKCORE_DEFINE_TRACE(rpmb_fs, 3),
+ TKCORE_DEFINE_TRACE(ta_mgmt, 4),
+ TKCORE_DEFINE_TRACE(tee_comm, 5),
+ TKCORE_DEFINE_TRACE(tee_boot, 6),
+ TKCORE_DEFINE_TRACE(core_mm, 7),
+ TKCORE_DEFINE_TRACE(uart_print, 8),
+ TKCORE_DEFINE_TRACE(htfat, 9),
+ TKCORE_DEFINE_TRACE(spi, 10),
+};
+
+#define NTRACES ARRAY_SIZE(tkcore_traces)
+
+static int tee_trace_open(struct inode *inode, struct file *filp)
+{
+ int ret;
+
+ mutex_lock(&trace_mutex);
+
+
+ ret = nonseekable_open(inode, filp);
+ if (unlikely(ret)) {
+ mutex_unlock(&trace_mutex);
+ return ret;
+ }
+
+ filp->f_pos = 0UL;
+ filp->private_data = PDE_DATA(inode);
+
+ return 0;
+}
+
+#define TRACE_BUF_SIZE 128
+
+static char trace_buf[TRACE_BUF_SIZE + 1];
+
+static ssize_t tee_trace_read(struct file *file, char __user *buf, size_t count,
+ loff_t *pos)
+{
+ size_t i;
+ ssize_t r;
+
+ char *p = trace_buf;
+
+ loff_t __pos;
+
+ size_t len = count > TRACE_BUF_SIZE - 1 ? TRACE_BUF_SIZE - 1 : count;
+
+ if (buf == NULL)
+ return -EINVAL;
+
+ for (i = 0; i < NTRACES; i++) {
+ int l = snprintf(p, trace_buf + len - p, "%s %d ",
+ tkcore_traces[i].desc, tkcore_traces[i].level);
+
+ if (l <= 0)
+ return -EINVAL;
+
+ p += l;
+ }
+
+ *p++ = '\n';
+
+ if (pos == NULL)
+ __pos = 0;
+ else
+ __pos = *pos;
+
+ if (__pos >= p - trace_buf)
+ return 0;
+
+ r = copy_to_user(buf, trace_buf, (p - trace_buf) - __pos);
+
+ if (r < 0)
+ return r;
+
+ *pos += ((p - trace_buf) - __pos) - r;
+
+ return ((p - trace_buf) - __pos) - r;
+}
+
+static ssize_t tee_trace_write(struct file *filp, const char __user *buf,
+ size_t count, loff_t *pos)
+{
+ char *p;
+ ssize_t r;
+ uint32_t level;
+ size_t i, len = count > TRACE_BUF_SIZE ? TRACE_BUF_SIZE : count;
+
+ struct smc_param param = { 0 };
+
+ struct tee *tee = filp->private_data;
+
+ if (tee == NULL) {
+ pr_warn("bad proc fp\n");
+ return -EINVAL;
+ }
+
+ (void) pos;
+
+ PROC_DBG("Count %lu Actual Count %lu\n", count, len);
+
+ r = copy_from_user(trace_buf, buf, len);
+ if (r < 0)
+ return r;
+
+ len = len - r;
+ trace_buf[len] = '\0';
+
+ PROC_DBG("Buffer: %s\n", trace_buf);
+
+ p = strchr(trace_buf, '=');
+ if (p == NULL) {
+ PROC_DBG("Expecting format: <trace_item>=<loglevel>[0|1]\n");
+ return -EINVAL;
+ }
+
+ *p = '\0';
+
+ r = kstrtouint(p + 1, 10, &level);
+ if (r < 0) {
+ PROC_DBG("Expecting format: <trace_item>=<loglevel>[0|1]\n");
+ return r;
+ }
+
+ for (i = 0; i < NTRACES; i++) {
+ if (strcmp(tkcore_traces[i].desc, trace_buf) == 0) {
+ param.a0 = TKCORE_FASTCALL_TRACE_CONFIG;
+ param.a1 = tkcore_traces[i].idx;
+ param.a2 = level;
+
+ if (tkcore_traces[i].level != level) {
+ tee->ops->call_tee(¶m);
+
+ PROC_DBG("TRACE_CONFIG return value: 0x%x\n",
+ param.a0);
+
+ if (param.a0 == TEESMC_RETURN_OK) {
+ tkcore_traces[i].level = level;
+ return len;
+ }
+
+ pr_warn(
+ "trace config Failed with 0x%llx\n",
+ (uint64_t) param.a0);
+
+ return -EINVAL;
+ }
+
+ PROC_DBG("Request level same with current level: %d\n",
+ tkcore_traces[i].level);
+
+ return len;
+ }
+ }
+
+ PROC_DBG("Can't find a matching trace_item\n");
+
+ return -EINVAL;
+}
+
+static int tee_trace_release(struct inode *inode, struct file *file)
+{
+ mutex_unlock(&trace_mutex);
+
+ return 0;
+}
+
+static const struct file_operations log_tee_trace_ops = {
+ .read = tee_trace_read,
+ .write = tee_trace_write,
+ .open = tee_trace_open,
+ .release = tee_trace_release
+};
+
+#include <version.h>
+
+static ssize_t copy_to_user_str(char __user *buf, ssize_t count, loff_t *pos,
+ const char *version)
+{
+ ssize_t r;
+ size_t cnt;
+ loff_t __pos;
+
+ __pos = *pos;
+ if (__pos > strlen(version) + 1) {
+ pr_warn("invalid pos: %lld len: %zu\n",
+ __pos, strlen(version));
+ return -EINVAL;
+ }
+
+ cnt = count < strlen(version) + 1 - __pos ?
+ count : strlen(version) + 1 - __pos;
+
+ r = copy_to_user(buf, version + __pos, cnt);
+
+ if (r < 0)
+ return r;
+
+ *pos += cnt - r;
+
+ return cnt - r;
+}
+
+static int tee_version_major, tee_version_minor;
+
+static ssize_t tee_version_read(struct file *file, char __user *buf,
+ size_t count, loff_t *pos)
+{
+ char tee_version[20];
+
+ if (buf == NULL || pos == NULL)
+ return -EINVAL;
+
+ snprintf(tee_version, sizeof(tee_version),
+ "0.%d.%d-gp\n", tee_version_major, tee_version_minor);
+
+ return copy_to_user_str(buf, count, pos, tee_version);
+}
+
+static const struct file_operations tee_version_ops = {
+ .read = tee_version_read,
+ .write = NULL,
+ .open = NULL,
+ .release = NULL
+};
+
+
+static ssize_t drv_version_read(struct file *file, char __user *buf,
+ size_t count, loff_t *pos)
+{
+ if (buf == NULL || pos == NULL)
+ return -EINVAL;
+
+ return copy_to_user_str(buf, count, pos, tkcore_nsdrv_version);
+}
+
+static const struct file_operations drv_version_ops = {
+ .read = drv_version_read,
+ .write = NULL,
+ .open = NULL,
+ .release = NULL
+};
+
+#define TEED_VERSION_SIZE 50
+char teed_version[TEED_VERSION_SIZE + 1] = "unknown\n";
+
+static ssize_t teed_version_read(struct file *file, char __user *buf,
+ size_t count, loff_t *pos)
+{
+ if (buf == NULL || pos == NULL)
+ return -EINVAL;
+
+ return copy_to_user_str(buf, count, pos, teed_version);
+}
+
+static ssize_t teed_version_write(struct file *filp, const char __user *buf,
+ size_t count, loff_t *pos)
+{
+ ssize_t r;
+
+ if (count > TEED_VERSION_SIZE)
+ return -ENOMEM;
+
+ r = copy_from_user(teed_version, buf, count);
+ if (r < 0)
+ return r;
+
+ teed_version[count + 1] = '\0';
+
+ return count;
+}
+
+static const struct file_operations teed_version_ops = {
+ .read = teed_version_read,
+ .write = teed_version_write,
+ .open = NULL,
+ .release = NULL
+};
+
+static void remove_entry(void)
+{
+ proc_remove(tee_proc_dir);
+
+ tee_proc_dir = NULL;
+ tee_proc_log_file = NULL;
+ tee_proc_trace = NULL;
+ tee_proc_drv_version = NULL;
+ tee_proc_tee_version = NULL;
+}
+
+static int create_entry(struct tee *tee)
+{
+
+ tee_proc_dir = proc_mkdir("tkcore", NULL);
+ if (tee_proc_dir == NULL) {
+ pr_err("proc_mkdir tkcore failed\n");
+ return -1;
+ }
+
+ tee_proc_log_file = proc_create_data("tkcore_log",
+ 0444, tee_proc_dir, &log_tee_ops, (void *) tee);
+
+ if (tee_proc_log_file == NULL) {
+ pr_err("proc_create failed\n");
+ goto err;
+ }
+
+ tee_proc_trace = proc_create_data("tkcore_trace",
+ 0444, tee_proc_dir,
+ &log_tee_trace_ops, (void *) tee);
+
+ if (tee_proc_trace == NULL) {
+ pr_err("proc_create tkcore_trace failed\n");
+ goto err;
+ }
+
+ tee_proc_drv_version = proc_create_data(
+ "tkcore_drv_version",
+ 0444, tee_proc_dir,
+ &drv_version_ops, (void *) tee);
+
+ if (tee_proc_drv_version == NULL) {
+ pr_err("proc_create tkcore_drv_version failed\n");
+ goto err;
+ }
+
+ tee_proc_tee_version = proc_create_data("tkcore_os_version",
+ 0444, tee_proc_dir,
+ &tee_version_ops, (void *) tee);
+
+ if (tee_proc_tee_version == NULL) {
+ pr_err("proc_create tkcore_os_version failed\n");
+ goto err;
+ }
+
+ tee_proc_teed_version = proc_create_data("tkcore_teed_version",
+ 0666, tee_proc_dir, &teed_version_ops, (void *) tee);
+
+ if (tee_proc_teed_version == NULL) {
+ pr_err("proc_create tkcore_teed_version failed\n");
+ goto err;
+ }
+
+ return 0;
+
+err:
+ remove_entry();
+ return -1;
+}
+
+static irqreturn_t tkcore_log_irq_handler(int irq, void *dev_id)
+{
+ wake_up_all(&(klog.wq));
+ return IRQ_HANDLED;
+}
+
+#define LINE_LENGTH 120U
+
+static void log_rb(struct klog *klog)
+{
+ char *p;
+ uint32_t rseq, wseq;
+
+ const char tail[] = "<...>";
+ char line[LINE_LENGTH + sizeof(tail) + 1];
+
+ union tee_log_ctrl *log_ctl = klog->log_ctl;
+ char *rb = klog->tee_rb;
+
+ strcpy(&line[LINE_LENGTH], tail);
+
+ rseq = log_ctl->info.tee_read_seq;
+ wseq = READ_ONCE(log_ctl->info.tee_write_seq);
+
+ p = line;
+
+ do {
+ uint32_t copy_len, i, k;
+
+ if (rb_overrun(rseq, wseq, klog->tee_rb_len)) {
+ pr_info("---- interrupted\n");
+ rseq = log_ctl->info.tee_read_seq =
+ wseq - klog->tee_rb_len;
+ }
+
+ k = rseq % klog->tee_rb_len;
+
+ copy_len = min(LINE_LENGTH - (uint32_t) (p - line),
+ min(wseq - rseq, klog->tee_rb_len - k));
+
+ for (i = 0; i < copy_len &&
+ rb[k + i] != '\n' && rb[k + i] != '\0';
+ i++, p++) {
+ *p = rb[k + i];
+ }
+
+ rseq += i;
+
+ if (i != copy_len) {
+ /*
+ * find an '\n' in buffer
+ * we skip it
+ */
+ ++rseq;
+ *p = '\0';
+ }
+
+ if (((i == copy_len) && (p - line == LINE_LENGTH))
+ || (i != copy_len)) {
+ pr_info("%s\n", line);
+ p = line;
+ log_ctl->info.tee_read_seq = rseq;
+ }
+
+ wseq = READ_ONCE(log_ctl->info.tee_write_seq);
+ if (wseq >= klog->tee_rb_len)
+ klog->overwrite = true;
+ } while (rseq != wseq);
+}
+
+static int logd(void *args)
+{
+ struct klog *klog = (struct klog *) args;
+ union tee_log_ctrl *log_ctl = klog->log_ctl;
+
+ ++log_ctl->info.tee_reader_alive;
+
+ while (!kthread_should_stop()) {
+ /*
+ * a memory barrier is implied by
+ * wait_event_interruptible_timeout(..)
+ */
+ if (wait_event_interruptible_timeout(klog->wq,
+ log_ctl->info.tee_read_seq !=
+ READ_ONCE(log_ctl->info.tee_write_seq),
+ msecs_to_jiffies(TEE_LOG_TIMEOUT_MS)) <= 0) {
+ /*
+ * interrupted /
+ * timeout and condition
+ * evaluated to false
+ */
+
+ continue;
+ }
+
+ log_rb(klog);
+ }
+
+ --log_ctl->info.tee_reader_alive;
+ return 0;
+}
+
+static int register_klog_irq(struct klog *klog)
+{
+ int r;
+ int irq_num;
+
+#ifdef CONFIG_OF
+ struct device_node *node;
+
+ node = of_find_compatible_node(NULL, NULL,
+ "trustkernel,tkcore");
+ if (node) {
+ irq_num = irq_of_parse_and_map(node, 0);
+ } else {
+ pr_err("tkcoredrv: node not found\n");
+ irq_num = -1;
+ }
+#else
+ irq_num = TEE_LOG_IRQ;
+#endif
+
+ if (irq_num < 0) {
+ pr_warn("tkcoredrv: unknown tee_log_irq id\n");
+ return -1;
+ }
+
+ pr_info("tkcoredrv: tee_log_irq id = %d\n",
+ irq_num);
+
+ r = request_irq(irq_num,
+ (irq_handler_t) tkcore_log_irq_handler,
+ IRQF_TRIGGER_RISING,
+ "tee_log_irq", NULL);
+
+ if (r != 0) {
+ pr_err("tkcoredrv: failed to register klog_irq with %d\n",
+ r);
+ return -1;
+ }
+
+ klog->notify_irq = irq_num;
+
+ return 0;
+}
+
+static int init_tos_version(struct tee *tee)
+{
+ struct smc_param param;
+
+ memset(¶m, 0, sizeof(param));
+
+ /* get os revision */
+ param.a0 = TEESMC32_CALL_GET_OS_REVISION;
+ tee->ops->raw_call_tee(¶m);
+
+ tee_version_major = param.a0;
+ tee_version_minor = param.a1;
+
+ pr_info("tkcoreos-rev: 0.%d.%d-gp\n",
+ tee_version_major, tee_version_minor);
+
+ return 0;
+}
+
+static int init_klog_shm_args(struct tee *tee,
+ unsigned long *shm_pa,
+ unsigned int *shm_len)
+{
+ struct smc_param param;
+
+ unsigned long pa;
+ unsigned int len;
+
+ if (shm_pa == NULL || shm_len == NULL)
+ return -1;
+
+ memset(¶m, 0, sizeof(param));
+
+ param.a0 = TEESMC32_ST_FASTCALL_GET_LOGM_CONFIG;
+ tee->ops->raw_call_tee(¶m);
+
+ if (param.a0 != TEESMC_RETURN_OK) {
+ pr_err("Log service not available: 0x%x",
+ (uint) param.a0);
+ return -1;
+ }
+
+ pa = param.a1;
+ len = param.a2;
+
+ if (len <= TEE_LOG_CTL_BUF_SIZE) {
+ pr_err("tkcoredrv: invalid shm_len: %u\n",
+ len);
+ return -1;
+ }
+
+ if ((pa & (PAGE_SIZE - 1)) ||
+ (len & (PAGE_SIZE - 1))) {
+ pr_err("tkcoredrv: invalid klog args\n");
+ pr_err("tkcoredrv: pa=0x%lx len=0x%x\n",
+ pa, len);
+ return -1;
+ }
+
+ *shm_pa = pa;
+ *shm_len = len;
+
+ return 0;
+}
+
+static int init_klog_shm(struct klog *klog,
+ unsigned long shm_pa,
+ unsigned int shm_len)
+{
+ char *rb;
+ uint32_t rb_len;
+ union tee_log_ctrl *log_ctl;
+
+ log_ctl = tee_map_cached_shm(shm_pa,
+ shm_len);
+
+ if (log_ctl == NULL) {
+ pr_err("tkcoredrv: failed to map shm\n");
+ pr_err("tkcoredrv: pa=0x%lx len=%u\n",
+ shm_pa, shm_len);
+ return -1;
+ }
+
+ rb = (char *) log_ctl + TEE_LOG_CTL_BUF_SIZE;
+ rb_len = log_ctl->info.tee_buf_size;
+
+ if (rb_len != shm_len - TEE_LOG_CTL_BUF_SIZE) {
+ pr_err("tkcoredrv:Unexpected shm length: %u\n",
+ shm_len);
+ tee_unmap_cached_shm(log_ctl);
+ return -1;
+ }
+
+ log_ctl->info.tee_reader_alive = 0;
+
+ klog->log_ctl = log_ctl;
+
+ klog->tee_rb = rb;
+ klog->tee_rb_len = rb_len;
+
+ return 0;
+}
+
+static int init_klog(struct klog *klog, struct tee *tee)
+{
+ unsigned long shm_pa;
+ unsigned int shm_len;
+
+ BUILD_BUG_ON(sizeof(union tee_log_ctrl)
+ != TEE_LOG_CTL_BUF_SIZE);
+
+ if (init_klog_shm_args(tee, &shm_pa,
+ &shm_len) < 0) {
+ return -1;
+ }
+
+ if (init_klog_shm(klog,
+ shm_pa,
+ shm_len) < 0) {
+ return -1;
+ }
+
+ klog->overwrite = false;
+
+ init_waitqueue_head(&klog->wq);
+
+ if (register_klog_irq(klog) < 0)
+ goto err_unmap_shm;
+
+
+ klog->ts = kthread_run(logd,
+ (void *) klog, "tee-log");
+ if (klog->ts == NULL) {
+ pr_err("tkcoredrv: Failed to create kthread\n");
+ goto err_free_irq;
+ }
+
+ return 0;
+
+err_free_irq:
+ if (klog->notify_irq > 0)
+ free_irq(klog->notify_irq, NULL);
+
+err_unmap_shm:
+ tee_unmap_cached_shm(klog->log_ctl);
+
+ memset(klog, 0, sizeof(*klog));
+ /*
+ * set notify_irq to
+ * un-initialized state
+ */
+ klog->notify_irq = -1;
+
+ return -1;
+}
+
+/* TODO wait for kthread logwq
+ * to exit
+ */
+static void free_klog(struct klog *klog)
+{
+ if (klog->notify_irq > 0) {
+ free_irq(klog->notify_irq, NULL);
+ klog->notify_irq = -1;
+ }
+
+ kthread_stop(klog->ts);
+ klog->ts = NULL;
+
+ /*
+ * wake up all waiters
+ * in wq, since we're
+ * about to leave
+ */
+ wake_up_all(&(klog->wq));
+
+ /*
+ * we don't unmap klog->tee_rb,
+ * because it's not
+ * quite easy to check whether
+ * all user process using
+ * procfs has finished
+ */
+}
+
+int tee_init_procfs(struct tee *tee)
+{
+ mutex_init(&trace_mutex);
+
+ init_tos_version(tee);
+
+ if (create_entry(tee) < 0)
+ return -1;
+
+ if (init_klog(&klog, tee) < 0)
+ goto out_remove_entry;
+
+ return 0;
+
+out_remove_entry:
+ remove_entry();
+
+ return -1;
+}
+
+void tee_exit_procfs(void)
+{
+ remove_entry();
+ free_klog(&klog);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_procfs.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_procfs.h
new file mode 100644
index 0000000..9f4cac3
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_procfs.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef __TEE_PROCFS_H__
+#define __TEE_PROCFS_H__
+
+#define TEE_LOG_IRQ 280
+
+#define TEE_LOG_CTL_BUF_SIZE 256
+
+#define TEE_LOG_SIGNAL_THRESHOLD_SIZE 1024
+
+#define TEE_CRASH_MAGIC_NO 0xdeadbeef
+
+struct tee;
+
+int tee_init_procfs(struct tee *tee);
+void tee_exit_procfs(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_session.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_session.c
new file mode 100644
index 0000000..cfa87de
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_session.c
@@ -0,0 +1,947 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/types.h>
+#include <linux/file.h>
+#include <linux/atomic.h>
+#include <linux/uaccess.h>
+#include <linux/anon_inodes.h>
+#include <linux/fs.h>
+
+#include "tee_shm.h"
+#include "tee_core_priv.h"
+#include "tee_tui_hal.h"
+
+static int _init_tee_cmd(struct tee_session *sess, struct tee_cmd_io *cmd_io,
+ struct tee_cmd *cmd);
+static void _update_client_tee_cmd(struct tee_session *sess,
+ struct tee_cmd_io *cmd_io,
+ struct tee_cmd *cmd);
+static void _release_tee_cmd(struct tee_session *sess, struct tee_cmd *cmd);
+
+/******************************************************************************/
+
+static inline bool flag_set(int val, int flags)
+{
+ return (val & flags) == flags;
+}
+
+static inline bool is_mapped_temp(int flags)
+{
+ return flag_set(flags, TEE_SHM_MAPPED | TEE_SHM_TEMP);
+}
+
+/******************************************************************************/
+static int tee_copy_from_user(struct tee_context *ctx, void *to, void *from,
+ size_t size)
+{
+ if ((!to) || (!from) || (!size))
+ return 0;
+
+ if (ctx->usr_client)
+ return copy_from_user(to, from, size);
+
+ memcpy(to, from, size);
+ return 0;
+}
+
+static int tee_copy_to_user(struct tee_context *ctx, void *to, void *from,
+ size_t size)
+{
+ if ((!to) || (!from) || (!size))
+ return 0;
+
+ if (ctx->usr_client)
+ return copy_to_user(to, from, size);
+
+ memcpy(to, from, size);
+ return 0;
+}
+
+/* Defined as macro to let the put_user macro see the types */
+#define tee_put_user(ctx, from, to) \
+ do { \
+ if ((ctx)->usr_client) \
+ put_user(from, to); \
+ else \
+ *to = from; \
+ } while (0)
+
+static inline int tee_session_is_opened(struct tee_session *sess)
+{
+ if (sess && sess->sessid)
+ return (sess->sessid != 0);
+ return 0;
+}
+
+static int tee_session_open_be(struct tee_session *sess,
+ struct tee_cmd_io *cmd_io)
+{
+ int ret = -EINVAL;
+ struct tee *tee;
+ struct tee_cmd cmd;
+
+ WARN_ON(!sess || !sess->ctx || !sess->ctx->tee);
+
+ tee = sess->ctx->tee;
+
+
+ sess->sessid = 0;
+ ret = _init_tee_cmd(sess, cmd_io, &cmd);
+ if (ret) {
+ pr_err(
+ "init tee command failed with 0x%08x\n",
+ ret);
+ goto out;
+ }
+
+ ret = tee->ops->open(sess, &cmd);
+ if (ret == 0)
+ _update_client_tee_cmd(sess, cmd_io, &cmd);
+ else {
+ /* propagate the reason of the error */
+ cmd_io->origin = cmd.origin;
+ cmd_io->err = cmd.err;
+ }
+
+out:
+ _release_tee_cmd(sess, &cmd);
+ return ret;
+}
+
+int tee_session_invoke_be(struct tee_session *sess, struct tee_cmd_io *cmd_io)
+{
+ int ret = -EINVAL;
+ struct tee *tee;
+ struct tee_cmd cmd;
+
+ WARN_ON(!sess || !sess->ctx || !sess->ctx->tee);
+
+ tee = sess->ctx->tee;
+
+ ret = _init_tee_cmd(sess, cmd_io, &cmd);
+ if (ret)
+ goto out;
+
+ ret = tee->ops->invoke(sess, &cmd);
+ if (!ret)
+ _update_client_tee_cmd(sess, cmd_io, &cmd);
+ else {
+ /* propagate the reason of the error */
+ cmd_io->origin = cmd.origin;
+ cmd_io->err = cmd.err;
+ }
+
+out:
+ _release_tee_cmd(sess, &cmd);
+ return ret;
+}
+
+static int tee_session_close_be(struct tee_session *sess)
+{
+ int ret = -EINVAL;
+ struct tee *tee;
+
+ WARN_ON(!sess || !sess->ctx || !sess->ctx->tee);
+
+ tee = sess->ctx->tee;
+
+
+ ret = tee->ops->close(sess);
+ sess->sessid = 0;
+
+ return ret;
+}
+
+static int tee_session_cancel_be(struct tee_session *sess,
+ struct tee_cmd_io *cmd_io)
+{
+ int ret = -EINVAL;
+ struct tee *tee;
+ struct tee_cmd cmd;
+
+ WARN_ON(!sess || !sess->ctx || !sess->ctx->tee);
+
+ tee = sess->ctx->tee;
+
+
+ ret = _init_tee_cmd(sess, cmd_io, &cmd);
+ if (ret)
+ goto out;
+
+ ret = tee->ops->cancel(sess, &cmd);
+
+out:
+ _release_tee_cmd(sess, &cmd);
+ return ret;
+}
+
+static int tee_do_invoke_command(struct tee_session *sess,
+ struct tee_cmd_io __user *u_cmd)
+{
+ int ret = -EINVAL;
+ struct tee *tee;
+ struct tee_cmd_io k_cmd;
+ struct tee_context *ctx;
+
+ WARN_ON(!sess->ctx);
+ WARN_ON(!sess->ctx->tee);
+ ctx = sess->ctx;
+ tee = sess->ctx->tee;
+
+ WARN_ON(!sess->sessid);
+
+ if (tee_copy_from_user
+ (ctx, &k_cmd, (void *)u_cmd, sizeof(struct tee_cmd_io))) {
+ pr_err("tee_copy_from_user failed\n");
+ goto exit;
+ }
+
+ if ((k_cmd.op == NULL) || (k_cmd.uuid != NULL) ||
+ (k_cmd.data != NULL) || (k_cmd.data_size != 0)) {
+ pr_err(
+ "op or/and data parameters are not valid\n");
+ goto exit;
+ }
+
+ ret = tee_session_invoke_be(sess, &k_cmd);
+ if (ret)
+ pr_err("tee_invoke_command failed with %d\n", ret);
+
+ tee_put_user(ctx, k_cmd.err, &u_cmd->err);
+ tee_put_user(ctx, k_cmd.origin, &u_cmd->origin);
+
+exit:
+ return ret;
+}
+
+static int tee_do_cancel_cmd(struct tee_session *sess,
+ struct tee_cmd_io __user *u_cmd)
+{
+ int ret = -EINVAL;
+ struct tee *tee;
+ struct tee_cmd_io k_cmd;
+ struct tee_context *ctx;
+
+ WARN_ON(!sess->ctx);
+ WARN_ON(!sess->ctx->tee);
+ ctx = sess->ctx;
+ tee = sess->ctx->tee;
+
+
+ WARN_ON(!sess->sessid);
+
+ if (tee_copy_from_user
+ (ctx, &k_cmd, (void *)u_cmd, sizeof(struct tee_cmd_io))) {
+ pr_err("cancel_cmd: tee_copy_from_user failed\n");
+ goto exit;
+ }
+
+ if ((k_cmd.op == NULL) || (k_cmd.uuid != NULL) ||
+ (k_cmd.data != NULL) || (k_cmd.data_size != 0)) {
+ pr_err("op or/and data parameters are not valid\n");
+ goto exit;
+ }
+
+ ret = tee_session_cancel_be(sess, &k_cmd);
+ if (ret)
+ pr_err("tee_invoke_command failed\n");
+
+ tee_put_user(ctx, k_cmd.err, &u_cmd->err);
+ tee_put_user(ctx, k_cmd.origin, &u_cmd->origin);
+
+exit:
+ return ret;
+}
+
+static int tee_do_kernel_cancel_cmd(struct tee_session *sess,
+ struct tee_cmd_io *k_cmd)
+{
+ int ret = -EINVAL;
+ struct tee *tee;
+ struct tee_context *ctx;
+ struct tee_cmd cmd;
+
+ WARN_ON(!sess->ctx);
+ WARN_ON(!sess->ctx->tee);
+ ctx = sess->ctx;
+ tee = sess->ctx->tee;
+
+
+ WARN_ON(!sess->sessid);
+
+ if ((k_cmd == NULL || k_cmd->op == NULL) || (k_cmd->uuid != NULL) ||
+ (k_cmd->data != NULL) || (k_cmd->data_size != 0)) {
+ pr_err(
+ "op or/and data parameters are not valid\n");
+ goto exit;
+ }
+
+ cmd.cmd = k_cmd->cmd;
+ cmd.origin = TEEC_ORIGIN_TEE;
+ cmd.err = TEEC_ERROR_BAD_PARAMETERS;
+
+ cmd.param.type_original = 0;
+
+ ret = tee->ops->cancel(sess, &cmd);
+
+ if (ret)
+ pr_err("tee_cancel failed\n");
+
+exit:
+ return ret;
+}
+
+DECLARE_COMPLETION(io_comp);
+static int flag_tui_obj;
+
+struct tui_obj {
+ struct tee_cmd_io op;
+ struct tee_session *sess;
+ uint32_t cmd_id;
+ uint32_t status;
+ struct mutex lock;
+} g_tui_obj;
+
+static uint32_t send_cmd_to_user(uint32_t command_id)
+{
+ uint32_t ret = 0;
+
+ g_tui_obj.cmd_id = command_id;
+ complete(&io_comp);
+
+ return ret;
+}
+
+bool teec_notify_event(uint32_t event_type)
+{
+ bool ret = false;
+
+ /* Cancel the TUI session if exists */
+ if (g_tui_obj.status)
+ ret = tee_do_kernel_cancel_cmd(g_tui_obj.sess, &g_tui_obj.op);
+
+ return ret;
+}
+EXPORT_SYMBOL(teec_notify_event);
+
+int teec_wait_cmd(uint32_t *cmd_id)
+{
+ /* Wait for signal from DCI handler */
+ wait_for_completion(&io_comp);
+#ifdef INIT_COMPLETION
+ INIT_COMPLETION(io_comp);
+#else
+ io_comp.done = 0;
+#endif
+
+ *cmd_id = g_tui_obj.cmd_id;
+ return 0;
+}
+EXPORT_SYMBOL(teec_wait_cmd);
+
+static long tee_session_internal_ioctl(struct tee_session *sess,
+ unsigned int cmd, unsigned long arg)
+{
+ int ret;
+ struct tee *tee;
+
+ tee = sess->ctx->tee;
+
+
+ switch (cmd) {
+ case TEE_INVOKE_COMMAND_IOC:
+ ret = tee_do_invoke_command(sess,
+ (struct tee_cmd_io __user *) arg);
+ break;
+ case TEE_REQUEST_CANCELLATION_IOC:
+ ret = tee_do_cancel_cmd(sess,
+ (struct tee_cmd_io __user *) arg);
+ break;
+ case TEE_TUI_OPEN_SESSION_IOC:
+ pr_debug("TEE_TUI_OPEN_SESSION_IOC.\n");
+ if (flag_tui_obj == 0) {
+ mutex_init(&g_tui_obj.lock);
+ flag_tui_obj = 1;
+ }
+ mutex_lock(&g_tui_obj.lock);
+ if (g_tui_obj.status != 0 ||
+ (struct tee_cmd_io __user *)arg == NULL) {
+ ret = -EBUSY;
+ mutex_unlock(&g_tui_obj.lock);
+ pr_warn(
+ "TEE_TUI_OPEN_SESSION_IOC: tui busy or invalid argument\n");
+ break;
+ }
+ if (tee_copy_from_user(sess->ctx, &g_tui_obj.op, (void *)arg,
+ sizeof(struct tee_cmd_io))) {
+ ret = -EINVAL;
+ mutex_unlock(&g_tui_obj.lock);
+ break;
+ }
+ /* reset part of op */
+ g_tui_obj.op.uuid = NULL;
+ g_tui_obj.op.data = NULL;
+ g_tui_obj.op.data_size = 0;
+
+ g_tui_obj.sess = sess;
+ g_tui_obj.status = 1;
+ mutex_unlock(&g_tui_obj.lock);
+ /* Start android TUI activity */
+ ret = send_cmd_to_user(TEEC_TUI_CMD_START_ACTIVITY);
+ if (ret != 0) {
+ mutex_lock(&g_tui_obj.lock);
+ g_tui_obj.status = 0;
+ mutex_unlock(&g_tui_obj.lock);
+ break;
+ }
+ /* Deactivate linux UI drivers */
+ ret = hal_tui_deactivate();
+ if (ret != 0) {
+ mutex_lock(&g_tui_obj.lock);
+ g_tui_obj.status = 0;
+ mutex_unlock(&g_tui_obj.lock);
+ send_cmd_to_user(TEEC_TUI_CMD_STOP_ACTIVITY);
+ break;
+ }
+ break;
+ case TEE_TUI_CLOSE_SESSION_IOC:
+ pr_debug(
+ "TEE_TUI_CLOSE_SESSION_IOC.\n");
+ if (flag_tui_obj == 0) {
+ mutex_init(&g_tui_obj.lock);
+ flag_tui_obj = 1;
+ }
+ mutex_lock(&g_tui_obj.lock);
+ g_tui_obj.status = 0;
+ mutex_unlock(&g_tui_obj.lock);
+ /* Activate linux UI drivers */
+ ret = hal_tui_activate();
+ /* Stop android TUI activity */
+ ret = send_cmd_to_user(TEEC_TUI_CMD_STOP_ACTIVITY);
+ break;
+ default:
+ ret = -EINVAL;
+ break;
+ }
+
+
+ return ret;
+}
+
+static long tee_session_ioctl(struct file *filp, unsigned int cmd,
+ unsigned long arg)
+{
+ struct tee_session *sess = filp->private_data;
+
+ WARN_ON(!sess || !sess->ctx || !sess->ctx->tee);
+
+ return tee_session_internal_ioctl(sess, cmd, arg);
+}
+
+#ifdef CONFIG_COMPAT
+
+static long tee_session_compat_ioctl(struct file *filp, unsigned int cmd,
+ unsigned long arg)
+{
+ struct tee_session *sess = filp->private_data;
+
+ WARN_ON(!sess || !sess->ctx || !sess->ctx->tee);
+
+ switch (cmd) {
+ case TEE_INVOKE_COMMAND_IOC:
+ case TEE_REQUEST_CANCELLATION_IOC:
+ case TEE_TUI_OPEN_SESSION_IOC:
+ if (convert_compat_tee_cmd((struct tee_cmd_io __user *) arg))
+ return -EFAULT;
+ break;
+ default:
+ break;
+ }
+
+ return tee_session_internal_ioctl(sess, cmd, arg);
+}
+
+#endif
+
+static int tee_session_release(struct inode *inode, struct file *filp)
+{
+ struct tee_session *sess = filp->private_data;
+ int ret = 0;
+ struct tee *tee;
+
+ WARN_ON(!sess || !sess->ctx || !sess->ctx->tee);
+ tee = sess->ctx->tee;
+
+ ret = tee_session_close_and_destroy(sess);
+ return ret;
+}
+
+const struct file_operations tee_session_fops = {
+ .owner = THIS_MODULE,
+#ifdef CONFIG_COMPAT
+ .compat_ioctl = tee_session_compat_ioctl,
+#endif
+ .unlocked_ioctl = tee_session_ioctl,
+ .release = tee_session_release,
+};
+
+int tee_session_close_and_destroy(struct tee_session *sess)
+{
+ int ret;
+ struct tee *tee;
+ struct tee_context *ctx;
+
+ if (!sess || !sess->ctx || !sess->ctx->tee)
+ return -EINVAL;
+
+ ctx = sess->ctx;
+ tee = ctx->tee;
+
+
+ if (!tee_session_is_opened(sess))
+ return -EINVAL;
+
+ ret = tee_session_close_be(sess);
+
+ mutex_lock(&tee->lock);
+ tee_dec_stats(&tee->stats[TEE_STATS_SESSION_IDX]);
+ list_del(&sess->entry);
+
+ devm_kfree(_DEV(tee), sess);
+ tee_context_put(ctx);
+ tee_put(tee);
+ mutex_unlock(&tee->lock);
+
+ return ret;
+}
+
+struct tee_session *tee_session_create_and_open(struct tee_context *ctx,
+ struct tee_cmd_io *cmd_io)
+{
+ int ret = 0;
+ struct tee_session *sess;
+ struct tee *tee;
+
+ WARN_ON(!ctx->tee);
+
+ tee = ctx->tee;
+
+ ret = tee_get(tee);
+ if (ret)
+ return ERR_PTR(-EBUSY);
+
+ sess = devm_kzalloc(_DEV(tee), sizeof(struct tee_session), GFP_KERNEL);
+ if (!sess) {
+ tee_put(tee);
+ return ERR_PTR(-ENOMEM);
+ }
+
+ tee_context_get(ctx);
+ sess->ctx = ctx;
+
+ ret = tee_session_open_be(sess, cmd_io);
+ mutex_lock(&tee->lock);
+ if (ret || !sess->sessid || cmd_io->err) {
+ pr_err(
+ "ERROR ret=%d (err=0x%08x, org=%d, sessid=0x%08x)\n",
+ ret, cmd_io->err,
+ cmd_io->origin, sess->sessid);
+ tee_put(tee);
+ tee_context_put(ctx);
+ devm_kfree(_DEV(tee), sess);
+ mutex_unlock(&tee->lock);
+ if (ret)
+ return ERR_PTR(ret);
+ else
+ return NULL;
+ }
+
+ tee_inc_stats(&tee->stats[TEE_STATS_SESSION_IDX]);
+ list_add_tail(&sess->entry, &ctx->list_sess);
+ mutex_unlock(&tee->lock);
+
+ return sess;
+}
+
+int tee_session_create_fd(struct tee_context *ctx, struct tee_cmd_io *cmd_io)
+{
+ int ret;
+ struct tee_session *sess;
+ struct tee *tee = ctx->tee;
+
+ (void) tee;
+
+ WARN_ON(cmd_io->fd_sess > 0);
+
+
+ sess = tee_session_create_and_open(ctx, cmd_io);
+ if (IS_ERR_OR_NULL(sess)) {
+ ret = PTR_ERR(sess);
+ pr_warn(
+ "ERROR can't create the session (ret=%d, err=0x%08x, org=%d)\n",
+ ret, cmd_io->err, cmd_io->origin);
+ cmd_io->fd_sess = -1;
+ goto out;
+ }
+
+ /* Retrieve a fd */
+ cmd_io->fd_sess = -1;
+ ret = anon_inode_getfd("tee_session",
+ &tee_session_fops, sess, O_CLOEXEC);
+ if (ret < 0) {
+ pr_err("ERROR can't get a fd (ret=%d)\n",
+ ret);
+ tee_session_close_and_destroy(sess);
+ goto out;
+ }
+ cmd_io->fd_sess = ret;
+ ret = 0;
+
+out:
+ return ret;
+}
+
+static bool tee_session_is_supported_type(struct tee_session *sess, int type)
+{
+ switch (type) {
+ case TEEC_NONE:
+ case TEEC_VALUE_INPUT:
+ case TEEC_VALUE_OUTPUT:
+ case TEEC_VALUE_INOUT:
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ case TEEC_MEMREF_WHOLE:
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ return true;
+ default:
+ pr_err("type is invalid (type %02x)\n", type);
+ return false;
+ }
+}
+
+static int to_memref_type(int flags)
+{
+ if (flag_set(flags, TEEC_MEM_INPUT | TEEC_MEM_OUTPUT))
+ return TEEC_MEMREF_TEMP_INOUT;
+
+ if (flag_set(flags, TEEC_MEM_INPUT))
+ return TEEC_MEMREF_TEMP_INPUT;
+
+ if (flag_set(flags, TEEC_MEM_OUTPUT))
+ return TEEC_MEMREF_TEMP_OUTPUT;
+
+ pr_warn("tkcoredrv: %s: bad flags=%x\n", __func__, flags);
+ return 0;
+}
+
+static int _init_tee_cmd(struct tee_session *sess, struct tee_cmd_io *cmd_io,
+ struct tee_cmd *cmd)
+{
+ int ret = -EINVAL;
+ int idx;
+ struct TEEC_Operation op;
+ struct tee_data *param = &cmd->param;
+ struct tee *tee;
+ struct tee_context *ctx;
+
+ WARN_ON(!sess->ctx);
+ WARN_ON(!sess->ctx->tee);
+ ctx = sess->ctx;
+ tee = sess->ctx->tee;
+
+
+ memset(cmd, 0, sizeof(struct tee_cmd));
+
+ cmd->cmd = cmd_io->cmd;
+ cmd->origin = TEEC_ORIGIN_TEE;
+ cmd->err = TEEC_ERROR_BAD_PARAMETERS;
+ cmd_io->origin = cmd->origin;
+ cmd_io->err = cmd->err;
+
+ if (tee_context_copy_from_client(ctx, &op, cmd_io->op, sizeof(op)))
+ goto out;
+
+ cmd->param.type_original = op.paramTypes;
+
+ for (idx = 0; idx < TEEC_CONFIG_PAYLOAD_REF_COUNT; ++idx) {
+ uint32_t offset = 0;
+ uint32_t size = 0;
+ int type = TEEC_PARAM_TYPE_GET(op.paramTypes, idx);
+
+ switch (type) {
+ case TEEC_NONE:
+ break;
+
+ case TEEC_VALUE_INPUT:
+ case TEEC_VALUE_OUTPUT:
+ case TEEC_VALUE_INOUT:
+ param->params[idx].value = op.params[idx].value;
+ break;
+
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ param->params[idx].shm =
+ tee_context_create_tmpref_buffer(
+ ctx, op.params[idx].tmpref.size,
+ op.params[idx].tmpref.buffer,
+ type);
+ if (IS_ERR_OR_NULL(param->params[idx].shm))
+ goto out;
+
+ break;
+
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ case TEEC_MEMREF_WHOLE:
+ if (tee_copy_from_user(ctx, ¶m->c_shm[idx],
+ op.params[idx].memref.parent,
+ sizeof(param->c_shm[idx])))
+ goto out;
+
+ if (type == TEEC_MEMREF_WHOLE) {
+ offset = 0;
+ size = param->c_shm[idx].size;
+ } else { /* for PARTIAL, check the size */
+ offset = op.params[idx].memref.offset;
+ size = op.params[idx].memref.size;
+ if (param->c_shm[idx].size < size + offset) {
+ pr_err(
+ "A PARTIAL parameter is bigger than the parent %zd < %d + %d\n",
+ param->c_shm[idx].size, size,
+ offset);
+ goto out;
+ }
+ }
+
+ type = to_memref_type(param->c_shm[idx].flags);
+ if (type == 0)
+ goto out;
+
+ param->params[idx].shm = tkcore_shm_get(ctx,
+ ¶m->c_shm[idx], size, offset);
+
+ if (IS_ERR_OR_NULL(param->params[idx].shm)) {
+ param->params[idx].shm =
+ tee_context_create_tmpref_buffer(
+ ctx, size,
+ param->c_shm[idx].buffer
+ + offset, type);
+
+ if (IS_ERR_OR_NULL(param->params[idx].shm))
+ goto out;
+ }
+
+ break;
+ default:
+ WARN_ON(1);
+ }
+
+ param->type |= (type << (idx * 4));
+ }
+
+ if (cmd_io->uuid != NULL) {
+ cmd->uuid = tee_context_alloc_shm_tmp(sess->ctx,
+ sizeof(*cmd_io->uuid), cmd_io->uuid, TEEC_MEM_INPUT);
+ if (IS_ERR_OR_NULL(cmd->uuid)) {
+ ret = -EINVAL;
+ goto out;
+ }
+ }
+
+ ret = 0;
+
+out:
+ if (ret)
+ _release_tee_cmd(sess, cmd);
+
+ return ret;
+}
+
+static void _update_client_tee_cmd(struct tee_session *sess,
+ struct tee_cmd_io *cmd_io,
+ struct tee_cmd *cmd)
+{
+ int idx;
+ struct tee_context *ctx;
+ struct TEEC_Operation tmp_op;
+
+ WARN_ON(!cmd_io);
+ WARN_ON(!cmd_io->op);
+ WARN_ON(!cmd);
+ WARN_ON(!sess->ctx);
+ ctx = sess->ctx;
+
+
+ cmd_io->origin = cmd->origin;
+ cmd_io->err = cmd->err;
+
+ if (tee_context_copy_from_client(ctx,
+ &tmp_op, cmd_io->op, sizeof(tmp_op))) {
+ pr_err("Failed to copy op from client\n");
+ return;
+ }
+
+ if (cmd->param.type_original == TEEC_PARAM_TYPES(TEEC_NONE,
+ TEEC_NONE, TEEC_NONE, TEEC_NONE))
+ return;
+
+ for (idx = 0; idx < TEEC_CONFIG_PAYLOAD_REF_COUNT; ++idx) {
+ int type = TEEC_PARAM_TYPE_GET(cmd->param.type_original, idx);
+ int offset = 0;
+ size_t size;
+ size_t size_new;
+ struct TEEC_SharedMemory *parent;
+
+ WARN_ON(!tee_session_is_supported_type(sess, type));
+ switch (type) {
+ case TEEC_NONE:
+ case TEEC_VALUE_INPUT:
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ break;
+ case TEEC_VALUE_OUTPUT:
+ case TEEC_VALUE_INOUT:
+ if (tee_copy_to_user
+ (ctx, &cmd_io->op->params[idx].value,
+ &cmd->param.params[idx].value,
+ sizeof(tmp_op.params[idx].value))) {
+
+ pr_err(
+ "can't update %d result to user\n",
+ idx);
+ }
+ break;
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ /* Returned updated size */
+ size_new = cmd->param.params[idx].shm->size_req;
+ if (size_new !=
+ tmp_op.params[idx].tmpref.size) {
+ tee_put_user(ctx, size_new,
+ &cmd_io->op->params[idx].tmpref.size);
+ }
+
+ /* ensure we do not exceed the shared buffer length */
+ if (size_new > tmp_op.params[idx].tmpref.size) {
+ pr_err(
+ " *** Wrong returned size from %d:%zd > %zd\n",
+ idx, size_new,
+ tmp_op.params[idx].tmpref.size);
+ } else if (tee_copy_to_user
+ (ctx,
+ tmp_op.params[idx].tmpref.buffer,
+ cmd->param.params[idx].shm->resv.kaddr,
+ size_new)) {
+ pr_err(
+ "can't update %d result to user\n",
+ idx);
+ }
+ break;
+
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ case TEEC_MEMREF_WHOLE:
+ parent = &cmd->param.c_shm[idx];
+ if (type == TEEC_MEMREF_WHOLE) {
+ offset = 0;
+ size = parent->size;
+ } else {
+ offset = tmp_op.params[idx].memref.offset;
+ size = tmp_op.params[idx].memref.size;
+ }
+
+ /* Returned updated size */
+ size_new = cmd->param.params[idx].shm->size_req;
+ tee_put_user(ctx, size_new,
+ &cmd_io->op->params[idx].memref.size);
+
+ /*
+ * If we allocated a tmpref buffer,
+ * copy back data to the user buffer
+ */
+ if (is_mapped_temp(cmd->param.params[idx].shm->flags)) {
+ if (parent->buffer &&
+ offset + size_new <= parent->size) {
+ if (tee_copy_to_user(ctx,
+ parent->buffer + offset,
+ cmd->param.params[idx].shm
+ ->resv.kaddr,
+ size_new)) {
+ pr_err(
+ "can't update %d data to user\n",
+ idx);
+ }
+ }
+ }
+ break;
+ default:
+ WARN_ON(1);
+ }
+ }
+
+}
+
+static void _release_tee_cmd(struct tee_session *sess, struct tee_cmd *cmd)
+{
+ int idx;
+ struct tee_context *ctx;
+
+ WARN_ON(!cmd);
+ WARN_ON(!sess);
+ WARN_ON(!sess->ctx);
+ WARN_ON(!sess->ctx->tee);
+
+ ctx = sess->ctx;
+
+
+ tkcore_shm_free(cmd->uuid);
+
+ if (cmd->param.type_original == TEEC_PARAM_TYPES(TEEC_NONE,
+ TEEC_NONE, TEEC_NONE, TEEC_NONE))
+ goto out;
+
+ for (idx = 0; idx < TEEC_CONFIG_PAYLOAD_REF_COUNT; ++idx) {
+ int type = TEEC_PARAM_TYPE_GET(cmd->param.type_original, idx);
+ struct tee_shm *shm;
+
+ switch (type) {
+ case TEEC_NONE:
+ case TEEC_VALUE_INPUT:
+ case TEEC_VALUE_OUTPUT:
+ case TEEC_VALUE_INOUT:
+ break;
+ case TEEC_MEMREF_TEMP_INPUT:
+ case TEEC_MEMREF_TEMP_OUTPUT:
+ case TEEC_MEMREF_TEMP_INOUT:
+ case TEEC_MEMREF_WHOLE:
+ case TEEC_MEMREF_PARTIAL_INPUT:
+ case TEEC_MEMREF_PARTIAL_OUTPUT:
+ case TEEC_MEMREF_PARTIAL_INOUT:
+ if (IS_ERR_OR_NULL(cmd->param.params[idx].shm))
+ break;
+
+ shm = cmd->param.params[idx].shm;
+
+ if (is_mapped_temp(shm->flags))
+ tkcore_shm_free(shm);
+ else
+ tkcore_shm_put(ctx, shm);
+ break;
+ default:
+ WARN_ON(1);
+ }
+ }
+
+out:
+ memset(cmd, 0, sizeof(struct tee_cmd));
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_shm.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_shm.c
new file mode 100644
index 0000000..ceb3000
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_shm.c
@@ -0,0 +1,884 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/dma-buf.h>
+#include <linux/hugetlb.h>
+#include <linux/version.h>
+#include <linux/anon_inodes.h>
+
+#include <linux/sched.h>
+#include <linux/mm.h>
+
+#include "tee_core_priv.h"
+#include "tee_shm.h"
+
+struct tee_shm_attach {
+ struct sg_table sgt;
+ enum dma_data_direction dir;
+ bool is_mapped;
+};
+
+static struct tee_shm *tee_shm_alloc_static(struct tee *tee, size_t size,
+ uint32_t flags)
+{
+ struct tee_shm *shm;
+ unsigned long pfn;
+ unsigned int nr_pages;
+ struct page *page;
+ int ret;
+
+ shm = tee->ops->alloc(tee, size, flags);
+ if (IS_ERR_OR_NULL(shm)) {
+ pr_err("allocation failed (s=%d,flags=0x%08x) err=%ld\n",
+ (int) size, flags, PTR_ERR(shm));
+ goto exit;
+ }
+
+ pfn = shm->resv.paddr >> PAGE_SHIFT;
+ page = pfn_to_page(pfn);
+ if (IS_ERR_OR_NULL(page)) {
+ pr_err("pfn_to_page(%lx) failed\n", pfn);
+ tee->ops->free(shm);
+ return (struct tee_shm *) page;
+ }
+
+ /* Only one page of contiguous physical memory */
+ nr_pages = 1;
+
+ ret = sg_alloc_table_from_pages(&shm->resv.sgt, &page,
+ nr_pages, 0,
+ nr_pages * PAGE_SIZE, GFP_KERNEL);
+ if (ret) {
+ pr_err("sg_alloc_table_from_pages() failed\n");
+ tee->ops->free(shm);
+ shm = ERR_PTR(ret);
+ }
+
+exit:
+ return shm;
+}
+
+static struct tee_shm *tee_shm_alloc_ns(struct tee *tee, size_t size,
+ uint32_t flags)
+{
+ size_t i, nr_pages;
+ struct page **pages;
+
+ struct tee_shm *shm;
+
+ if (size == 0) {
+ pr_warn("invalid size %zu flags 0x%x\n",
+ size, flags);
+ return NULL;
+ }
+
+ shm = kzalloc(sizeof(struct tee_shm), GFP_KERNEL);
+ if (shm == NULL) {
+ shm = NULL;
+ pr_err("bad kmalloc tee_shm: %zu\n",
+ sizeof(struct tee_shm));
+ return shm;
+ }
+
+ shm->ns.token = tee_core_alloc_uuid(shm);
+ if (shm->ns.token <= 0) {
+ pr_err("failed to alloc idr for shm\n");
+ kfree(shm);
+ return NULL;
+ }
+
+ /* FIXME whether it's correct? */
+ nr_pages = ((size - 1) >> PAGE_SHIFT) + 1;
+
+ pages = kcalloc(nr_pages, sizeof(struct page *), GFP_KERNEL);
+ if (pages == NULL)
+ goto err_free_pagelist;
+
+ for (i = 0; i < nr_pages; i++) {
+ pages[i] = alloc_page(GFP_KERNEL);
+ if (pages[i] == NULL) {
+ pr_err("bad alloc page %zu\n", i);
+ goto err_free_pages;
+ }
+ }
+
+ shm->ns.pages = pages;
+ shm->ns.nr_pages = (size_t) nr_pages;
+
+ atomic_set(&shm->ns.ref, 1);
+
+ shm->size_req = size;
+ shm->size_alloc = nr_pages << PAGE_SHIFT;
+
+ shm->flags = flags;
+
+ return shm;
+
+err_free_pages:
+ for (i = 0; i < nr_pages; i++) {
+ if (pages[i] == NULL)
+ break;
+
+ __free_page(pages[i]);
+ }
+
+err_free_pagelist:
+ kfree(pages);
+
+ tee_core_free_uuid(shm->ns.token);
+
+ kfree(shm);
+
+ return NULL;
+}
+
+void tee_shm_free_ns(struct tee_shm *shm)
+{
+ size_t i;
+
+ if (atomic_dec_return(&shm->ns.ref) != 0)
+ return;
+
+ for (i = 0; i < shm->ns.nr_pages; i++)
+ __free_page(shm->ns.pages[i]);
+
+ kfree(shm->ns.pages);
+
+ tee_core_free_uuid(shm->ns.token);
+
+ kfree(shm);
+}
+
+struct tee_shm *tkcore_alloc_shm(struct tee *tee, size_t size, uint32_t flags)
+{
+ struct tee_shm *shm;
+
+ if ((shm_test_nonsecure(flags)))
+ shm = tee_shm_alloc_ns(tee, size, flags);
+ else
+ shm = tee_shm_alloc_static(tee, size, flags);
+
+ if (IS_ERR_OR_NULL(shm))
+ goto exit;
+
+ shm->tee = tee;
+
+exit:
+ return shm;
+}
+
+void tkcore_shm_free(struct tee_shm *shm)
+{
+ struct tee *tee;
+
+ if (IS_ERR_OR_NULL(shm))
+ return;
+
+ tee = shm->tee;
+
+ if (tee == NULL) {
+ pr_warn("tkcoredrv: %s(): NULL tee\n",
+ __func__);
+ return;
+ }
+ if (shm->tee == NULL) {
+ pr_warn("tkcoredrv: %s(): invalid shm\n", __func__);
+ return;
+ }
+
+ if (shm_test_nonsecure(shm->flags))
+ tee_shm_free_ns(shm);
+ else {
+ sg_free_table(&shm->resv.sgt);
+ shm->tee->ops->free(shm);
+ }
+}
+
+static int __tee_shm_attach_dma_buf(struct dma_buf *dmabuf,
+ struct dma_buf_attachment *attach)
+{
+ struct tee_shm_attach *tee_shm_attach;
+ struct tee_shm *shm;
+ struct tee *tee;
+
+ shm = dmabuf->priv;
+ tee = shm->tee;
+
+
+ tee_shm_attach = devm_kzalloc(_DEV(tee),
+ sizeof(*tee_shm_attach), GFP_KERNEL);
+ if (!tee_shm_attach)
+ return -ENOMEM;
+
+ tee_shm_attach->dir = DMA_NONE;
+ attach->priv = tee_shm_attach;
+
+ return 0;
+}
+
+static void __tee_shm_detach_dma_buf(struct dma_buf *dmabuf,
+ struct dma_buf_attachment *attach)
+{
+ struct tee_shm_attach *tee_shm_attach = attach->priv;
+ struct sg_table *sgt;
+ struct tee_shm *shm;
+ struct tee *tee;
+
+ shm = dmabuf->priv;
+ tee = shm->tee;
+
+
+ if (!tee_shm_attach) {
+ pr_err("No shm attached with this dmabuf context");
+ return;
+ }
+
+ sgt = &tee_shm_attach->sgt;
+
+ if (tee_shm_attach->dir != DMA_NONE)
+ dma_unmap_sg(attach->dev, sgt->sgl, sgt->nents,
+ tee_shm_attach->dir);
+
+ sg_free_table(sgt);
+ devm_kfree(_DEV(tee), tee_shm_attach);
+ attach->priv = NULL;
+}
+
+static struct sg_table *__tee_shm_dma_buf_map_dma_buf(
+ struct dma_buf_attachment *attach, enum dma_data_direction dir)
+{
+ struct tee_shm_attach *tee_shm_attach = attach->priv;
+ struct tee_shm *tee_shm = attach->dmabuf->priv;
+ struct sg_table *sgt = NULL;
+ struct scatterlist *rd, *wr;
+ unsigned int i;
+ int nents, ret;
+ struct tee *tee;
+
+ tee = tee_shm->tee;
+
+
+ /* just return current sgt if already requested. */
+ if (tee_shm_attach->dir == dir && tee_shm_attach->is_mapped)
+ return &tee_shm_attach->sgt;
+
+ sgt = &tee_shm_attach->sgt;
+
+ ret = sg_alloc_table(sgt, tee_shm->resv.sgt.orig_nents, GFP_KERNEL);
+ if (ret) {
+ pr_err("failed to alloc sgt.\n");
+ return ERR_PTR(-ENOMEM);
+ }
+
+ rd = tee_shm->resv.sgt.sgl;
+ wr = sgt->sgl;
+ for (i = 0; i < sgt->orig_nents; ++i) {
+ sg_set_page(wr, sg_page(rd), rd->length, rd->offset);
+ rd = sg_next(rd);
+ wr = sg_next(wr);
+ }
+
+ if (dir != DMA_NONE) {
+ nents = dma_map_sg(attach->dev, sgt->sgl, sgt->orig_nents, dir);
+ if (!nents) {
+ pr_err("failed to map sgl with iommu.\n");
+ sg_free_table(sgt);
+ sgt = ERR_PTR(-EIO);
+ goto err_unlock;
+ }
+ }
+
+ tee_shm_attach->is_mapped = true;
+ tee_shm_attach->dir = dir;
+ attach->priv = tee_shm_attach;
+
+err_unlock:
+ return sgt;
+}
+
+static void __tee_shm_dma_buf_unmap_dma_buf(struct dma_buf_attachment *attach,
+ struct sg_table *table,
+ enum dma_data_direction dir)
+{
+}
+
+static void __tee_shm_dma_buf_release(struct dma_buf *dmabuf)
+{
+ struct tee_shm *shm = dmabuf->priv;
+ struct tee_context *ctx;
+ struct tee *tee;
+
+ tee = shm->ctx->tee;
+
+
+ ctx = shm->ctx;
+
+ tee_shm_free_io(shm);
+}
+
+static int __tee_shm_dma_buf_mmap(struct dma_buf *dmabuf,
+ struct vm_area_struct *vma)
+{
+ struct tee_shm *shm = dmabuf->priv;
+ size_t size = vma->vm_end - vma->vm_start;
+ struct tee *tee;
+ int ret;
+ pgprot_t prot;
+ unsigned long pfn;
+
+ tee = shm->ctx->tee;
+
+ pfn = shm->resv.paddr >> PAGE_SHIFT;
+
+
+ if (shm->flags & TEE_SHM_CACHED)
+ prot = vma->vm_page_prot;
+ else
+ prot = pgprot_noncached(vma->vm_page_prot);
+
+ ret =
+ remap_pfn_range(vma, vma->vm_start, pfn, size, prot);
+ if (!ret)
+ vma->vm_private_data = (void *)shm;
+
+ return ret;
+}
+
+static void *map_stub(struct dma_buf *dmabuf, unsigned long length)
+{
+ (void) dmabuf;
+ (void) length;
+
+ return NULL;
+}
+
+static const struct dma_buf_ops tee_static_shm_dma_buf_ops = {
+ .attach = __tee_shm_attach_dma_buf,
+ .detach = __tee_shm_detach_dma_buf,
+ .map_dma_buf = __tee_shm_dma_buf_map_dma_buf,
+ .unmap_dma_buf = __tee_shm_dma_buf_unmap_dma_buf,
+ .release = __tee_shm_dma_buf_release,
+ .mmap = __tee_shm_dma_buf_mmap,
+
+ .map = map_stub,
+};
+
+static int tee_static_shm_export(struct tee *tee, struct tee_shm *shm,
+ int *export)
+{
+ struct dma_buf *dmabuf;
+ int ret = 0;
+
+#if defined(DEFINE_DMA_BUF_EXPORT_INFO)
+ DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+#endif
+
+ if (shm_test_nonsecure(shm->flags)) {
+ pr_err(
+ "cannot export dmabuf for nonsecure buf flags: 0x%x\n",
+ shm->flags);
+ return -EINVAL;
+ }
+
+ /* Temporary fix to support both older and newer kernel versions. */
+#if defined(DEFINE_DMA_BUF_EXPORT_INFO)
+ exp_info.priv = shm;
+ exp_info.ops = &tee_static_shm_dma_buf_ops;
+ exp_info.size = shm->size_alloc;
+ exp_info.flags = O_RDWR;
+
+ dmabuf = dma_buf_export(&exp_info);
+#else
+ dmabuf = dma_buf_export(shm, &tee_static_shm_dma_buf_ops,
+ shm->size_alloc, O_RDWR, NULL);
+#endif
+ if (IS_ERR_OR_NULL(dmabuf)) {
+ pr_err("dmabuf: couldn't export buffer (%ld)\n",
+ PTR_ERR(dmabuf));
+ ret = -EINVAL;
+ goto out;
+ }
+
+ *export = dma_buf_fd(dmabuf, O_CLOEXEC);
+out:
+ return ret;
+}
+
+static int __tee_ns_shm_vma_fault(struct vm_fault *vmf)
+{
+ struct vm_area_struct *vma = vmf->vma;
+ struct tee_shm *shm = (struct tee_shm *) vma->vm_private_data;
+ struct page *page;
+
+ if (vmf->pgoff >= shm->ns.nr_pages)
+ return VM_FAULT_ERROR;
+
+ page = shm->ns.pages[vmf->pgoff];
+ get_page(page);
+
+ vmf->page = page;
+ return 0;
+}
+
+static const struct vm_operations_struct tee_ns_shm_vm_ops = {
+ /* .close = __tee_ns_shm_vma_close, */
+ .fault = __tee_ns_shm_vma_fault,
+};
+
+static int __tee_ns_shm_release(struct inode *inode, struct file *filp)
+{
+ struct tee_shm *shm = filp->private_data;
+
+ tee_shm_free_io(shm);
+ return 0;
+}
+
+static int __tee_ns_shm_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+ vma->vm_ops = &tee_ns_shm_vm_ops;
+ vma->vm_private_data = filp->private_data;
+
+ return 0;
+}
+
+static const struct file_operations tee_ns_shm_fops = {
+ .release = __tee_ns_shm_release,
+ .mmap = __tee_ns_shm_mmap,
+};
+
+static int tee_ns_shm_export(struct tee *tee, struct tee_shm *shm, int *export)
+{
+ int fd;
+
+ if (!shm_test_nonsecure(shm->flags)) {
+ pr_err("cannot export for static buf flags: 0x%x\n",
+ shm->flags);
+ return -EINVAL;
+ }
+
+ fd = anon_inode_getfd("tz_ns_shm", &tee_ns_shm_fops,
+ (void *) shm, O_RDWR | O_CLOEXEC);
+ if (fd < 0) {
+ pr_err("anon_inode_getfd() failed with %d\n", fd);
+ return fd;
+ }
+
+ *export = fd;
+ return 0;
+}
+
+/* called inside tee->lock */
+static int tee_ns_shm_inc_ref(struct tee_shm *shm)
+{
+ /* check old value, if old value < 1, then do not inc ref.
+ * actually this part of logic is already protected by tee->lock
+ */
+ atomic_inc(&shm->ns.ref);
+ return 0;
+}
+
+struct tee_shm *tee_shm_alloc_from_rpc(struct tee *tee, size_t size,
+ uint32_t extra_flags)
+{
+ struct tee_shm *shm;
+
+
+ mutex_lock(&tee->lock);
+ shm = tkcore_alloc_shm(tee, size,
+ TEE_SHM_TEMP | TEE_SHM_FROM_RPC | extra_flags);
+ if (IS_ERR_OR_NULL(shm)) {
+ pr_err("buffer allocation failed (%ld)\n",
+ PTR_ERR(shm));
+ goto out;
+ }
+
+ tee_inc_stats(&tee->stats[TEE_STATS_SHM_IDX]);
+ list_add_tail(&shm->entry, &tee->list_rpc_shm);
+
+ shm->ctx = NULL;
+
+out:
+ mutex_unlock(&tee->lock);
+ return shm;
+}
+
+void tee_shm_free_from_rpc(struct tee_shm *shm)
+{
+ struct tee *tee;
+
+ if (shm == NULL)
+ return;
+
+ tee = shm->tee;
+ mutex_lock(&tee->lock);
+
+ if (shm->ctx == NULL) {
+ tee_dec_stats(&shm->tee->stats[TEE_STATS_SHM_IDX]);
+ list_del(&shm->entry);
+ }
+
+ tkcore_shm_free(shm);
+ mutex_unlock(&tee->lock);
+}
+
+/* Buffer allocated by rpc from fw and to be accessed by the user
+ * Not need to be registered as it is not allocated by the user
+ */
+int tee_shm_fd_for_rpc(struct tee_context *ctx, struct tee_shm_io *shm_io)
+{
+ struct tee_shm *shm = NULL;
+ struct tee *tee = ctx->tee;
+ int ret;
+ struct list_head *pshm;
+
+
+ shm_io->fd_shm = 0;
+
+ mutex_lock(&tee->lock);
+
+ if (!list_empty(&tee->list_rpc_shm)) {
+ list_for_each(pshm, &tee->list_rpc_shm) {
+ shm = list_entry(pshm, struct tee_shm, entry);
+ if (shm_test_nonsecure(shm_io->flags)) {
+ if ((void *)(unsigned long) shm->ns.token
+ == shm_io->buffer)
+ goto found;
+ } else {
+ if ((void *)(unsigned long) shm->resv.paddr
+ == shm_io->buffer)
+ goto found;
+ }
+ }
+ }
+
+ pr_err("Can't find shm for %p\n", shm_io->buffer);
+ ret = -ENOMEM;
+ goto out;
+
+found:
+
+ if (shm_test_nonsecure(shm_io->flags))
+ ret = tee_ns_shm_export(tee, shm, &shm_io->fd_shm);
+ else
+ ret = tee_static_shm_export(tee, shm, &shm_io->fd_shm);
+
+ if (ret) {
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ shm->ctx = ctx;
+ list_move(&shm->entry, &ctx->list_shm);
+
+ shm->dev = get_device(_DEV(tee));
+ ret = tee_get(tee);
+ WARN_ON(ret);
+ tee_context_get(ctx);
+
+ if (shm_test_nonsecure(shm_io->flags)) {
+ /*FIXME check for return value */
+ tee_ns_shm_inc_ref(shm);
+ } else
+ WARN_ON(!tee->ops->shm_inc_ref(shm));
+out:
+ mutex_unlock(&tee->lock);
+ return ret;
+}
+
+int tee_shm_alloc_io_perm(struct tee_context *ctx, struct tee_shm_io *shm_io)
+{
+ struct tee_shm *shm;
+ struct tee *tee = ctx->tee;
+ int ret;
+
+
+ if (shm_test_nonsecure(shm_io->flags)) {
+ pr_err("permanent shm cannot be nonsecure\n");
+ return -EINVAL;
+ }
+
+ if (ctx->usr_client)
+ shm_io->fd_shm = 0;
+
+ mutex_lock(&tee->lock);
+ shm = tkcore_alloc_shm(tee, shm_io->size, shm_io->flags);
+ if (IS_ERR_OR_NULL(shm)) {
+ pr_err("buffer allocation failed (%ld)\n",
+ PTR_ERR(shm));
+ ret = PTR_ERR(shm);
+ goto out;
+ }
+
+ if (ctx->usr_client) {
+ ret = tee_static_shm_export(tee, shm, &shm_io->fd_shm);
+ if (ret) {
+ tkcore_shm_free(shm);
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ shm->flags |= TEEC_MEM_DMABUF;
+ }
+
+ shm_io->paddr = (void *)(unsigned long) shm->resv.paddr;
+
+ shm->ctx = ctx;
+ shm->dev = get_device(_DEV(tee));
+ ret = tee_get(tee);
+ WARN_ON(ret);
+ tee_context_get(ctx);
+
+ tee_inc_stats(&tee->stats[TEE_STATS_SHM_IDX]);
+ list_add_tail(&shm->entry, &ctx->list_shm);
+out:
+ mutex_unlock(&tee->lock);
+ return ret;
+}
+
+int tee_shm_alloc_io(struct tee_context *ctx, struct tee_shm_io *shm_io)
+{
+ struct tee_shm *shm;
+ struct tee *tee = ctx->tee;
+ int ret;
+
+
+ if (ctx->usr_client)
+ shm_io->fd_shm = 0;
+
+ mutex_lock(&tee->lock);
+ shm = tkcore_alloc_shm(tee, shm_io->size, shm_io->flags);
+ if (IS_ERR_OR_NULL(shm)) {
+ pr_err("buffer allocation failed (%ld)\n",
+ PTR_ERR(shm));
+ ret = PTR_ERR(shm);
+ goto out;
+ }
+
+ if (ctx->usr_client) {
+ if (shm_test_nonsecure(shm_io->flags))
+ ret = tee_ns_shm_export(tee, shm, &shm_io->fd_shm);
+ else
+ ret = tee_static_shm_export(tee, shm, &shm_io->fd_shm);
+
+ if (ret) {
+ tkcore_shm_free(shm);
+ ret = -ENOMEM;
+ goto out;
+ }
+
+ shm->flags |= TEEC_MEM_DMABUF;
+ }
+
+ shm->ctx = ctx;
+ shm->dev = get_device(_DEV(tee));
+ ret = tee_get(tee);
+ WARN_ON(ret); /* tee_core_get must not issue */
+ tee_context_get(ctx);
+
+ tee_inc_stats(&tee->stats[TEE_STATS_SHM_IDX]);
+ list_add_tail(&shm->entry, &ctx->list_shm);
+out:
+ mutex_unlock(&tee->lock);
+ return ret;
+}
+
+void tee_shm_free_io(struct tee_shm *shm)
+{
+ struct tee_context *ctx = shm->ctx;
+ struct tee *tee = ctx->tee;
+ struct device *dev = shm->dev;
+
+ mutex_lock(&ctx->tee->lock);
+ tee_dec_stats(&tee->stats[TEE_STATS_SHM_IDX]);
+ list_del(&shm->entry);
+
+ tkcore_shm_free(shm);
+ tee_put(ctx->tee);
+ tee_context_put(ctx);
+ if (dev)
+ put_device(dev);
+ mutex_unlock(&tee->lock);
+}
+
+static int tee_shm_db_get(struct tee *tee, struct tee_shm *shm, int fd,
+ unsigned int flags, size_t size, int offset)
+{
+ struct tee_shm_dma_buf *sdb;
+ struct dma_buf *dma_buf;
+ int ret = 0;
+
+ dma_buf = dma_buf_get(fd);
+ if (IS_ERR(dma_buf)) {
+ ret = PTR_ERR(dma_buf);
+ goto exit;
+ }
+
+ sdb = kzalloc(sizeof(*sdb), GFP_KERNEL);
+ if (IS_ERR_OR_NULL(sdb)) {
+ pr_err("can't alloc tee_shm_dma_buf\n");
+ ret = PTR_ERR(sdb);
+ goto buf_put;
+ }
+ shm->resv.sdb = sdb;
+
+ if (dma_buf->size < size + offset) {
+ pr_err("dma_buf too small %zd < %zd + %d\n",
+ dma_buf->size, size, offset);
+ ret = -EINVAL;
+ goto free_sdb;
+ }
+
+ sdb->attach = dma_buf_attach(dma_buf, _DEV(tee));
+ if (IS_ERR_OR_NULL(sdb->attach)) {
+ ret = PTR_ERR(sdb->attach);
+ goto free_sdb;
+ }
+
+ sdb->sgt = dma_buf_map_attachment(sdb->attach, DMA_NONE);
+ if (IS_ERR_OR_NULL(sdb->sgt)) {
+ ret = PTR_ERR(sdb->sgt);
+ goto buf_detach;
+ }
+
+ if (sg_nents(sdb->sgt->sgl) != 1) {
+ ret = -EINVAL;
+ goto buf_unmap;
+ }
+
+ shm->resv.paddr = sg_phys(sdb->sgt->sgl) + offset;
+ if (dma_buf->ops->attach == __tee_shm_attach_dma_buf)
+ sdb->tee_allocated = true;
+ else
+ sdb->tee_allocated = false;
+
+ shm->flags |= TEEC_MEM_DMABUF;
+
+ goto exit;
+
+buf_unmap:
+ dma_buf_unmap_attachment(sdb->attach, sdb->sgt, DMA_NONE);
+buf_detach:
+ dma_buf_detach(dma_buf, sdb->attach);
+free_sdb:
+ kfree(sdb);
+buf_put:
+ dma_buf_put(dma_buf);
+exit:
+ return ret;
+}
+
+struct tee_shm *tkcore_shm_get(struct tee_context *ctx,
+ struct TEEC_SharedMemory *c_shm,
+ size_t size, int offset)
+{
+ struct tee_shm *shm;
+ struct tee *tee = ctx->tee;
+ int ret;
+
+ if (shm_test_nonsecure(c_shm->flags)) {
+ pr_err("invalid shared memory flags: 0x%x\n",
+ c_shm->flags);
+ return NULL;
+ }
+
+ mutex_lock(&tee->lock);
+ shm = kzalloc(sizeof(*shm), GFP_KERNEL);
+ if (IS_ERR_OR_NULL(shm)) {
+ pr_err("can't alloc tee_shm\n");
+ ret = -ENOMEM;
+ goto err;
+ }
+
+ shm->ctx = ctx;
+ shm->tee = tee;
+ shm->dev = _DEV(tee);
+ shm->flags = c_shm->flags | TEE_SHM_MEMREF;
+ shm->size_req = size;
+ shm->size_alloc = 0;
+
+ if (c_shm->flags & TEEC_MEM_KAPI) {
+ struct tee_shm *kc_shm = (struct tee_shm *)c_shm->d.ptr;
+
+ if (!kc_shm) {
+ pr_err("kapi fd null\n");
+ ret = -EINVAL;
+ goto err;
+ }
+ shm->resv.paddr = kc_shm->resv.paddr;
+
+ if (kc_shm->size_alloc < size + offset) {
+ pr_err("kapi buff too small %zd < %zd + %d\n",
+ kc_shm->size_alloc, size, offset);
+ ret = -EINVAL;
+ goto err;
+ }
+
+ } else if (c_shm->d.fd) {
+ ret = tee_shm_db_get(tee, shm,
+ c_shm->d.fd, c_shm->flags, size, offset);
+ if (ret)
+ goto err;
+ } else if (!c_shm->buffer) {
+ pr_debug("null buffer, pass 'as is'\n");
+ } else {
+ ret = -EINVAL;
+ goto err;
+ }
+
+ mutex_unlock(&tee->lock);
+ return shm;
+
+err:
+ kfree(shm);
+ mutex_unlock(&tee->lock);
+ return ERR_PTR(ret);
+}
+
+void tkcore_shm_put(struct tee_context *ctx, struct tee_shm *shm)
+{
+ struct tee *tee;
+
+ WARN_ON(!ctx);
+ if (!ctx)
+ return;
+
+ tee = ctx->tee;
+ WARN_ON(!tee);
+ if (!tee)
+ return;
+
+ WARN_ON(!shm);
+ if (!shm)
+ return;
+
+ WARN_ON(!(shm->flags & TEE_SHM_MEMREF));
+
+ if (shm_test_nonsecure(shm->flags)) {
+ pr_warn("invalid shared memory flags: 0x%x\n",
+ shm->flags);
+ return;
+ }
+
+ mutex_lock(&tee->lock);
+ if (shm->flags & TEEC_MEM_DMABUF) {
+ struct tee_shm_dma_buf *sdb;
+ struct dma_buf *dma_buf;
+
+ sdb = shm->resv.sdb;
+ dma_buf = sdb->attach->dmabuf;
+
+ dma_buf_unmap_attachment(sdb->attach, sdb->sgt, DMA_NONE);
+ dma_buf_detach(dma_buf, sdb->attach);
+ dma_buf_put(dma_buf);
+
+ kfree(sdb);
+ sdb = 0;
+ }
+
+ kfree(shm);
+ mutex_unlock(&tee->lock);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_shm.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_shm.h
new file mode 100644
index 0000000..9c48ba0
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_shm.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef __TEE_SHM_H__
+#define __TEE_SHM_H__
+
+#include <linux/tee_client_api.h>
+
+struct tee_context;
+struct tee_shm;
+struct tee_shm_io;
+struct tee;
+
+static inline int shm_test_nonsecure(uint32_t flags)
+{
+ return flags & TEEC_MEM_NONSECURE;
+}
+
+int tee_shm_alloc_io(struct tee_context *ctx, struct tee_shm_io *shm_io);
+void tee_shm_free_io(struct tee_shm *shm);
+
+int tee_shm_fd_for_rpc(struct tee_context *ctx, struct tee_shm_io *shm_io);
+
+int tee_shm_alloc_io_perm(struct tee_context *ctx, struct tee_shm_io *shm_io);
+
+struct tee_shm *tkcore_alloc_shm(struct tee *tee, size_t size, uint32_t flags);
+void tkcore_shm_free(struct tee_shm *shm);
+
+struct tee_shm *tkcore_shm_get(struct tee_context *ctx,
+ struct TEEC_SharedMemory *c_shm,
+ size_t size, int offset);
+void tkcore_shm_put(struct tee_context *ctx, struct tee_shm *shm);
+
+#endif /* __TEE_SHM_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_supp_com.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_supp_com.c
new file mode 100644
index 0000000..4d333a6
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_supp_com.c
@@ -0,0 +1,276 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/kernel.h>
+#include <linux/fs.h>
+#include <linux/mutex.h>
+#include <linux/miscdevice.h>
+#include <linux/uaccess.h>
+#include <linux/anon_inodes.h>
+#include <linux/semaphore.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/device.h>
+
+#include "tee_shm.h"
+#include "tee_core.h"
+#include "tee_supp_com.h"
+
+enum teec_rpc_result tee_supp_cmd(struct tee *tee,
+ uint32_t id, void *data, size_t datalen)
+{
+ struct tee_rpc *rpc = tee->rpc;
+ enum teec_rpc_result res = TEEC_RPC_FAIL;
+ size_t size;
+ struct task_struct *task = current;
+
+ (void) task;
+
+ if (id == TEE_RPC_ICMD_INVOKE) {
+ if (atomic_read(&rpc->used) == 0) {
+ pr_err("teed not ready. id=0x%x\n", id);
+ goto out;
+ }
+ }
+
+ switch (id) {
+ case TEE_RPC_ICMD_ALLOCATE:
+ {
+ struct tee_rpc_alloc *alloc;
+ struct tee_shm *shmint;
+
+ alloc = (struct tee_rpc_alloc *)data;
+ size = alloc->size;
+ memset(alloc, 0, sizeof(struct tee_rpc_alloc));
+ shmint = tee_shm_alloc_from_rpc(tee, size, 0U);
+ if (IS_ERR_OR_NULL(shmint))
+ break;
+
+ alloc->size = size;
+ alloc->data = (void *) (unsigned long)
+ shmint->resv.paddr;
+ alloc->shm = shmint;
+ res = TEEC_RPC_OK;
+
+ break;
+ }
+ case TEE_RPC_ICMD_FREE:
+ {
+ struct tee_rpc_free *free;
+
+ free = (struct tee_rpc_free *)data;
+ tee_shm_free_from_rpc(free->shm);
+ res = TEEC_RPC_OK;
+ break;
+ }
+ case TEE_RPC_ICMD_INVOKE:
+ {
+ if (sizeof(rpc->commToUser) < datalen)
+ break;
+
+ /*
+ * Other threads blocks here until we've copied our
+ * answer from the teed
+ */
+ mutex_lock(&rpc->thrd_mutex);
+
+ mutex_lock(&rpc->outsync);
+ rpc->res = 0;
+ memcpy(&rpc->commToUser, data, datalen);
+ mutex_unlock(&rpc->outsync);
+
+ up(&rpc->datatouser);
+
+ down(&rpc->datafromuser);
+
+ mutex_lock(&rpc->insync);
+ memcpy(data, &rpc->commFromUser, datalen);
+ mutex_unlock(&rpc->insync);
+
+ res = rpc->res;
+ mutex_unlock(&rpc->thrd_mutex);
+
+ break;
+ }
+ default:
+ /* not supported */
+ break;
+ }
+
+out:
+
+ return res;
+}
+EXPORT_SYMBOL(tee_supp_cmd);
+
+ssize_t tee_supp_read(struct file *filp, char __user *buffer,
+ size_t length, loff_t *offset)
+{
+ struct tee_context *ctx = (struct tee_context *)(filp->private_data);
+ struct tee *tee;
+ struct tee_rpc *rpc;
+ struct task_struct *task = current;
+ int ret;
+
+ (void) task;
+
+ if (ctx == NULL ||
+ ctx->tee == NULL ||
+ ctx->tee->dev == NULL ||
+ ctx->tee->rpc == NULL) {
+ pr_err("invalid context\n");
+ return -EINVAL;
+ }
+
+ tee = ctx->tee;
+
+ rpc = tee->rpc;
+
+ if (atomic_read(&rpc->used) == 0) {
+ pr_err("teed application not ready\n");
+ ret = -EPERM;
+ goto out;
+ }
+
+ if (down_interruptible(&rpc->datatouser))
+ return -ERESTARTSYS;
+
+ mutex_lock(&rpc->outsync);
+
+ ret =
+ sizeof(rpc->commToUser) - sizeof(rpc->commToUser.cmds) +
+ sizeof(rpc->commToUser.cmds[0]) * rpc->commToUser.nbr_bf;
+ if (length < ret) {
+ ret = -EINVAL;
+ } else {
+ if (copy_to_user(buffer, &rpc->commToUser, ret)) {
+ pr_err("copy_to_user(comm) failed!\n");
+ ret = -EINVAL;
+ }
+ }
+
+ mutex_unlock(&rpc->outsync);
+
+out:
+ return ret;
+}
+
+ssize_t tee_supp_write(struct file *filp, const char __user *buffer,
+ size_t length, loff_t *offset)
+{
+ struct tee_context *ctx = (struct tee_context *) (filp->private_data);
+ struct tee *tee;
+ struct tee_rpc *rpc;
+ struct task_struct *task = current;
+ int ret = 0;
+
+ (void) task;
+
+ if (ctx == NULL || ctx->tee == NULL || ctx->tee->rpc == NULL) {
+ pr_err("Invalid ctx\n");
+ return -EINVAL;
+ }
+
+ tee = ctx->tee;
+ rpc = tee->rpc;
+
+ if (atomic_read(&rpc->used) == 0) {
+ pr_err("teed not ready\n");
+ goto out;
+ }
+
+ if (length > 0 && length < sizeof(rpc->commFromUser)) {
+ uint32_t i;
+ unsigned long r;
+
+ mutex_lock(&rpc->insync);
+
+ r = copy_from_user(&rpc->commFromUser, buffer, length);
+ if (r) {
+ pr_err("copy_from_user(comm) failed: %lu\n", r);
+ rpc->res = -EINVAL;
+ mutex_unlock(&rpc->insync);
+ up(&rpc->datafromuser);
+
+ ret = -EINVAL;
+ goto out;
+ }
+
+ /* Translate virtual address of caller into physical address */
+ for (i = 0; i < rpc->commFromUser.nbr_bf; i++) {
+ uint32_t type = rpc->commFromUser.cmds[i].type;
+ void *buffer = rpc->commFromUser.cmds[i].buffer;
+
+ if (type != TEE_RPC_BUFFER || buffer == NULL)
+ continue;
+
+ if (type & TEE_RPC_BUFFER_NONSECURE) {
+ } else {
+ struct tee_shm *shm;
+ struct vm_area_struct *vma = find_vma(
+ current->mm, (unsigned long) buffer);
+
+ if (vma == NULL)
+ continue;
+
+ shm = vma->vm_private_data;
+
+ if (shm == NULL) {
+ pr_err(
+ "Invalid vma->vm_private_data [%s:%d:%d]\n",
+ current->comm,
+ current->tgid,
+ current->pid);
+
+ rpc->res = -EINVAL;
+ mutex_unlock(&rpc->insync);
+ up(&rpc->datafromuser);
+
+ ret = -EINVAL;
+ goto out;
+ }
+
+ rpc->commFromUser.cmds[i].buffer =
+ (void *) (unsigned long)
+ shm->resv.paddr;
+ }
+ }
+
+ rpc->res = 0;
+ mutex_unlock(&rpc->insync);
+ up(&rpc->datafromuser);
+ ret = length;
+ }
+
+out:
+ return ret;
+}
+
+int tee_supp_init(struct tee *tee)
+{
+ struct tee_rpc *rpc;
+
+ rpc = devm_kzalloc(tee->dev, sizeof(struct tee_rpc), GFP_KERNEL);
+ if (rpc == NULL)
+ return -ENOMEM;
+
+ rpc->datafromuser = (struct semaphore)
+ __SEMAPHORE_INITIALIZER(rpc->datafromuser, 0);
+ rpc->datatouser = (struct semaphore)
+ __SEMAPHORE_INITIALIZER(rpc->datatouser, 0);
+ mutex_init(&rpc->thrd_mutex);
+ mutex_init(&rpc->outsync);
+ mutex_init(&rpc->insync);
+ atomic_set(&rpc->used, 0);
+ tee->rpc = rpc;
+
+ return 0;
+}
+
+void tee_supp_deinit(struct tee *tee)
+{
+ devm_kfree(tee->dev, tee->rpc);
+ tee->rpc = NULL;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_supp_com.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_supp_com.h
new file mode 100644
index 0000000..906d4de
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_supp_com.h
@@ -0,0 +1,116 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_SUPP_COMM_H
+#define TEE_SUPP_COMM_H
+
+#define TEE_RPMB_BUFFER_NUMBER 2
+
+#define TEE_RPC_ICMD_ALLOCATE 0x1001
+#define TEE_RPC_ICMD_FREE 0x1002
+#define TEE_RPC_ICMD_INVOKE 0x1003
+
+#define TEE_RPC_NBR_BUFF 1
+#define TEE_RPC_DATA_SIZE 64
+#define TEE_RPC_BUFFER_NUMBER 5
+
+#define TEE_RPC_STATE_IDLE 0x00
+#define TEE_RPC_STATE_ACTIVE 0x01
+
+/* Be Consistent with teed (user space) */
+#define TEE_RPC_BUFFER 0x00000001
+#define TEE_RPC_VALUE 0x00000002
+#define TEE_RPC_BUFFER_NONSECURE 0x00040000
+
+#define TEE_RPC_LOAD_TA 0x10000001
+
+#define TEE_RPC_RPMB_CMD 0x1000000A
+
+#define TEE_RPC_INSTALL_TA 0x10000013
+#define TEE_RPC_DELETE_TA 0x10000014
+#define TEE_RPC_INSTALL_TA_RESP 0x10000015
+
+#define TEE_RPC_INSTALL_SYS_TA 0x10000020
+/*
+ * Handled within the driver only
+ * Be CONSISTENT with tkcore-os (secure space)
+ */
+#define TEE_RPC_WAIT_QUEUE_SLEEP 0x20000001
+#define TEE_RPC_WAIT_QUEUE_WAKEUP 0x20000002
+#define TEE_RPC_WAIT 0x30000000
+
+#include <linux/semaphore.h>
+
+/**
+ * struct tee_rpc_bf - Contains definition of the tee com buffer
+ * @state: Buffer state
+ * @data: Command data
+ */
+struct tee_rpc_bf {
+ uint32_t state;
+ uint8_t data[TEE_RPC_DATA_SIZE];
+};
+
+struct tee_rpc_alloc {
+ uint32_t size; /* size of block */
+ void *data; /* pointer to data */
+ void *shm; /* pointer to an opaque data, being shm structure */
+};
+
+struct tee_rpc_free {
+ void *shm; /* pointer to an opaque data, being shm structure */
+};
+
+struct tee_rpc_cmd {
+ union {
+ void *buffer;
+ uint64_t padding_buf;
+ };
+ uint32_t size;
+ uint32_t type;
+ int fd;
+ int reserved;
+};
+
+struct tee_rpc_invoke {
+ uint32_t cmd;
+ uint32_t res;
+ uint32_t nbr_bf;
+ uint32_t reserved;
+ struct tee_rpc_cmd cmds[TEE_RPC_BUFFER_NUMBER];
+};
+
+struct tee_rpc {
+ struct tee_rpc_invoke commToUser;
+ struct tee_rpc_invoke commFromUser;
+ struct semaphore datatouser;
+ struct semaphore datafromuser;
+ struct mutex thrd_mutex; /* Block the thread to wait for supp answer */
+ struct mutex outsync; /* Out sync mutex */
+ struct mutex insync; /* In sync mutex */
+ atomic_t used;
+ int res;
+};
+
+enum teec_rpc_result {
+ TEEC_RPC_OK,
+ TEEC_RPC_FAIL
+};
+
+struct tee;
+
+int tee_supp_init(struct tee *tee);
+void tee_supp_deinit(struct tee *tee);
+
+enum teec_rpc_result tee_supp_cmd(struct tee *tee,
+ uint32_t id, void *data, size_t datalen);
+
+ssize_t tee_supp_read(struct file *filp, char __user *buffer,
+ size_t length, loff_t *offset);
+
+ssize_t tee_supp_write(struct file *filp, const char __user *buffer,
+ size_t length, loff_t *offset);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_sysfs.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_sysfs.c
new file mode 100644
index 0000000..7a578f5
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_sysfs.c
@@ -0,0 +1,196 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/stat.h>
+#include <linux/atomic.h>
+#include <asm/page.h>
+
+#include "tee_core_priv.h"
+
+static ssize_t dump_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+ int len;
+ char *tmp_buf;
+
+ tmp_buf = kzalloc(PAGE_SIZE, GFP_KERNEL);
+ if (!tmp_buf)
+ return -ENOMEM;
+
+ len = tee_context_dump(tee, tmp_buf, PAGE_SIZE - 128);
+
+ if (len > 0)
+ len = snprintf(buf, PAGE_SIZE, "%s", tmp_buf);
+ kfree(tmp_buf);
+
+ return len;
+}
+
+static ssize_t stat_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ return snprintf(buf, PAGE_SIZE, "%d/%d %d/%d %d/%d %d/%d\n",
+ atomic_read(&tee->refcount),
+ tee->max_refcount,
+ tee->stats[TEE_STATS_CONTEXT_IDX].count,
+ tee->stats[TEE_STATS_CONTEXT_IDX].max,
+ tee->stats[TEE_STATS_SESSION_IDX].count,
+ tee->stats[TEE_STATS_SESSION_IDX].max,
+ tee->stats[TEE_STATS_SHM_IDX].count,
+ tee->stats[TEE_STATS_SHM_IDX].max);
+}
+
+static ssize_t info_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ return snprintf(buf, PAGE_SIZE, "%s iminor=%d dev=\"%s\" state=%d\n",
+ dev_name(tee->dev), tee->miscdev.minor,
+ dev_name(tee->miscdev.this_device), tee->state);
+}
+
+static ssize_t name_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ return snprintf(buf, PAGE_SIZE, "%s\n", tee->name);
+}
+
+static ssize_t type_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ return snprintf(buf, PAGE_SIZE, "%s\n", tee->ops->type);
+}
+
+static ssize_t refcount_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ return snprintf(buf, PAGE_SIZE, "%d\n", atomic_read(&tee->refcount));
+}
+
+static ssize_t conf_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ return snprintf(buf, PAGE_SIZE, "0x%08x\n", tee->conf);
+}
+
+static ssize_t test_show(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ return snprintf(buf, PAGE_SIZE, "%08X\n", tee->test);
+}
+
+static ssize_t test_store(struct device *device,
+ struct device_attribute *attr, const char *buf,
+ size_t count)
+{
+ struct tee *tee = dev_get_drvdata(device);
+ unsigned long val;
+ int status;
+
+ status = kstrtoul(buf, 0, &val);
+ if (status)
+ return status;
+
+ if ((tee->conf & TEE_CONF_TEST_MODE) == TEE_CONF_TEST_MODE)
+ tee->test = val;
+
+ return count;
+}
+
+/*
+ * A state-to-string lookup table, for exposing a human readable state
+ * via sysfs. Always keep in sync with enum tee_state
+ */
+static const char *const tee_state_string[] = {
+ "offline",
+ "online",
+ "suspended",
+ "running",
+ "crashed",
+ "invalid",
+};
+
+static ssize_t tee_show_state(struct device *device,
+ struct device_attribute *attr, char *buf)
+{
+ struct tee *tee = dev_get_drvdata(device);
+
+ int state = tee->state > TEE_LAST ? TEE_LAST : tee->state;
+
+ return snprintf(buf, PAGE_SIZE, "%s (%d)\n", tee_state_string[state],
+ tee->state);
+}
+
+static struct device_attribute device_attrs[] = {
+ __ATTR_RO(dump),
+ __ATTR_RO(stat),
+ __ATTR_RO(info),
+ __ATTR(test, (0660), test_show, test_store),
+ __ATTR(state, 0444, tee_show_state, NULL),
+ __ATTR(name, 0444, name_show, NULL),
+ __ATTR(refcount, 0444, refcount_show, NULL),
+ __ATTR(type, 0444, type_show, NULL),
+ __ATTR(conf, 0444, conf_show, NULL),
+};
+
+int tee_init_sysfs(struct tee *tee)
+{
+ int i, error = 0;
+
+ if (!tee)
+ return -EINVAL;
+
+ if (dev_get_drvdata(tee->miscdev.this_device) != tee) {
+ pr_err("drvdata is not valid\n");
+ return -ENODEV;
+ }
+
+ for (i = 0; i < ARRAY_SIZE(device_attrs); i++) {
+ error = device_create_file(tee->miscdev.this_device,
+ &device_attrs[i]);
+ if (error) {
+ pr_err("bad device_create_file(): %d\n",
+ error);
+ break;
+ }
+ }
+
+ if (error) {
+ while (--i >= 0) {
+ device_remove_file(
+ tee->miscdev.this_device,
+ &device_attrs[i]);
+ }
+ }
+
+ return error;
+}
+
+void tee_cleanup_sysfs(struct tee *tee)
+{
+ int i;
+
+ if (!tee)
+ return;
+
+ for (i = 0; i < ARRAY_SIZE(device_attrs); i++)
+ device_remove_file(tee->miscdev.this_device, &device_attrs[i]);
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_sysfs.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_sysfs.h
new file mode 100644
index 0000000..93bc9a7
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_sysfs.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef __TEE_SYSFS_H__
+#define __TEE_SYSFS_H__
+
+struct tee;
+
+int tee_init_sysfs(struct tee *tee);
+void tee_cleanup_sysfs(struct tee *tee);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_ta_mgmt.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_ta_mgmt.c
new file mode 100644
index 0000000..6d7a87e
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_ta_mgmt.c
@@ -0,0 +1,279 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/vmalloc.h>
+#include <linux/uaccess.h>
+#include <linux/errno.h>
+#include <linux/mm.h>
+
+#include <linux/tee_ioc.h>
+#include "tee_core.h"
+
+#include "tee_ta_mgmt.h"
+#include "tee_shm.h"
+#include "tee_supp_com.h"
+
+struct completion event_inst_ta;
+static struct mutex mutex_inst_ta;
+
+int tee_install_sp_ta(struct tee_context *ctx,
+ void __user *__tee_spta_inst_desc)
+{
+ struct tee *tee;
+
+ struct tee_shm *shm_in = NULL;
+ struct tee_shm *shm_out = NULL;
+
+ struct tee_rpc_invoke request;
+ struct tee_spta_inst_desc ta;
+
+ uint32_t response_len = 0;
+ uint32_t response_msg_len = 0;
+
+ int ret = 0;
+
+ if (ctx == NULL || __tee_spta_inst_desc == NULL) {
+ pr_err("invalid param\n");
+ return -EINVAL;
+ }
+
+ tee = ctx->tee;
+
+ if (copy_from_user(&ta, (void *) __tee_spta_inst_desc,
+ sizeof(struct tee_spta_inst_desc))) {
+ pr_err("copy_from_user tee_spta_inst_desc failed\n");
+ return -EINVAL;
+ }
+
+ if (ta.ta_size < 4)
+ return -EINVAL;
+
+ shm_in = tee_shm_alloc_from_rpc(tee, ta.ta_size, 0);
+ if (IS_ERR_OR_NULL(shm_in)) {
+ pr_err("failed to alloc shm_in\n");
+ return -ENOMEM;
+ }
+
+ shm_out = tee_shm_alloc_from_rpc(tee, ta.ta_size, 0);
+ if (IS_ERR_OR_NULL(shm_out)) {
+ pr_err("failed to alloc shm_out\n");
+ tee_shm_free_from_rpc(shm_in);
+ return -ENOMEM;
+ }
+
+ if (copy_from_user(shm_in->resv.kaddr, (void *) ta.ta_binary,
+ ta.ta_size)) {
+ pr_err("copy ta_binary failed\n");
+ ret = -EINVAL;
+ goto exit;
+ }
+
+ memset(&request, 0, sizeof(struct tee_rpc_invoke));
+
+ request.cmd = TEE_RPC_INSTALL_TA;
+ request.nbr_bf = 2;
+
+ request.cmds[0].buffer = (void *) (unsigned long) shm_in->resv.paddr;
+ request.cmds[0].size = shm_in->size_req;
+
+ request.cmds[1].buffer = (void *) (unsigned long) shm_out->resv.paddr;
+ request.cmds[1].size = shm_out->size_req;
+
+ mutex_lock(&mutex_inst_ta);
+
+ ret = tee_supp_cmd(ctx->tee, TEE_RPC_ICMD_INVOKE,
+ &request, sizeof(struct tee_rpc_invoke));
+
+ if (ret == 0)
+ ret = request.res;
+
+ if (ret) {
+ pr_err(
+ "TA install command failed to start with %d\n", ret);
+ goto exit;
+ }
+
+ wait_for_completion(&event_inst_ta);
+
+ mutex_unlock(&mutex_inst_ta);
+
+/*
+ * response_msg format：
+ * +----------------------------------+
+ * | TEE_Result | resp_msg_len | resp_msg_json | ta_bin_len | ta_bin |
+ */
+
+ memcpy(&ret, (void *) shm_out->resv.kaddr, 4);
+ if (ret) {
+ pr_err("install TA failed with 0x%x\n", ret);
+ goto exit;
+ }
+
+ memcpy(&response_msg_len, (uint8_t *) shm_out->resv.kaddr + 4, 4);
+ if (ta.ta_size - 4 < response_msg_len) {
+ pr_err(
+ "unexpected response msg len: %u total_size: %u\n",
+ ta.ta_size, response_msg_len);
+ ret = -E2BIG;
+ goto exit;
+ }
+
+ /* response_msg_len + sizeof(response_msg_len) + sizeof(TEE_Result */
+ response_len = response_msg_len + 4 + 4;
+
+ ret = copy_to_user((void __user *) ta.ta_binary,
+ (void *) shm_out->resv.kaddr, response_len);
+ if (ret) {
+ pr_err("copy response buffer failed with %d\n", ret);
+ ret = ret < 0 ? ret : -EAGAIN;
+ goto exit;
+ }
+
+ put_user(response_len, (uint32_t __user *) ta.response_len);
+
+exit:
+ tee_shm_free_from_rpc(shm_in);
+ tee_shm_free_from_rpc(shm_out);
+
+ return ret;
+}
+
+int tee_install_sp_ta_response(struct tee_context *ctx, void __user *u_arg)
+{
+ complete(&event_inst_ta);
+ return 0;
+}
+
+int tee_delete_sp_ta(struct tee_context *ctx, void __user *uuid)
+{
+ int ret = 0;
+ struct tee *tee;
+ struct tee_rpc_invoke request;
+ struct tee_shm *shm_uuid;
+
+ if (ctx == NULL || uuid == NULL) {
+ pr_err("invalid param\n");
+ return -EINVAL;
+ }
+
+ tee = ctx->tee;
+
+ shm_uuid = tee_shm_alloc_from_rpc(tee, sizeof(struct TEEC_UUID), 0);
+ if (IS_ERR_OR_NULL(shm_uuid)) {
+ pr_err("failed to alloc shm uuid\n");
+ return -ENOMEM;
+ }
+
+ if (copy_from_user(shm_uuid->resv.kaddr,
+ uuid, sizeof(struct TEEC_UUID))) {
+ pr_err("TEEC_UUID copy_from_user failed\n");
+ ret = -EINVAL;
+ goto exit;
+ }
+
+ memset(&request, 0, sizeof(struct tee_rpc_invoke));
+
+ request.cmd = TEE_RPC_DELETE_TA;
+ request.nbr_bf = 1;
+ request.cmds[0].buffer = (void *) (unsigned long) shm_uuid->resv.paddr;
+ request.cmds[0].size = shm_uuid->size_req;
+
+ ret = tee_supp_cmd(tee, TEE_RPC_ICMD_INVOKE, &request, sizeof(request));
+ if (ret) {
+ pr_err("start delete_ta failed with %d\n", ret);
+ goto exit;
+ }
+
+ ret = request.res;
+ if (ret)
+ pr_err("delete_ta failed with 0x%x\n", ret);
+
+exit:
+ tee_shm_free_from_rpc(shm_uuid);
+ return ret;
+}
+
+int tee_install_sys_ta(struct tee *tee, void __user *u_arg)
+{
+ int r;
+ void *shm_kva;
+ unsigned long left;
+
+ struct TEEC_UUID uuid;
+ struct tee_rpc_invoke inv;
+ struct tee_shm *shm;
+
+ struct tee_ta_inst_desc ta_inst_desc;
+
+ if ((copy_from_user(&ta_inst_desc, u_arg,
+ sizeof(struct tee_ta_inst_desc)))) {
+ return -EFAULT;
+ }
+
+ if (copy_from_user(&uuid, ta_inst_desc.uuid, sizeof(struct TEEC_UUID)))
+ return -EFAULT;
+
+ shm = tee_shm_alloc_from_rpc(tee, sizeof(struct TEEC_UUID) +
+ sizeof(uint32_t) + ta_inst_desc.ta_buf_size,
+ TEEC_MEM_NONSECURE);
+
+ if (shm == NULL)
+ return -ENOMEM;
+
+ shm_kva = vmap(shm->ns.pages, shm->ns.nr_pages, VM_MAP, PAGE_KERNEL);
+ if (shm_kva == NULL) {
+ pr_err("failed to vmap %zu pages\n",
+ shm->ns.nr_pages);
+ r = -ENOMEM;
+ goto exit;
+ }
+
+ memcpy(shm_kva, &uuid, sizeof(struct TEEC_UUID));
+ memcpy((char *) shm_kva + sizeof(struct TEEC_UUID),
+ &ta_inst_desc.ta_buf_size, sizeof(uint32_t));
+
+ left = copy_from_user(
+ (char *) shm_kva + sizeof(struct TEEC_UUID) + sizeof(uint32_t),
+ ta_inst_desc.ta_buf,
+ ta_inst_desc.ta_buf_size);
+
+ if (left) {
+ pr_err("copy_from_user failed size %x return: %lu\n",
+ ta_inst_desc.ta_buf_size, left);
+ vunmap(shm_kva);
+ r = -EFAULT;
+ goto exit;
+ }
+
+ vunmap(shm_kva);
+
+ memset(&inv, 0, sizeof(inv));
+
+ inv.cmd = TEE_RPC_INSTALL_SYS_TA;
+ inv.res = TEEC_ERROR_NOT_IMPLEMENTED;
+ inv.nbr_bf = 1;
+
+ inv.cmds[0].buffer = (void *) (unsigned long) shm->ns.token;
+ inv.cmds[0].type = TEE_RPC_BUFFER | TEE_RPC_BUFFER_NONSECURE;
+ inv.cmds[0].size = shm->size_req;
+
+ r = tee_supp_cmd(tee, TEE_RPC_ICMD_INVOKE, &inv, sizeof(inv));
+ if (r)
+ pr_err("install_sys_ta failed with %d\n", r);
+ else
+ r = inv.res;
+
+exit:
+ tee_shm_free_from_rpc(shm);
+
+ return r;
+}
+
+int tee_ta_mgmt_init(void)
+{
+ mutex_init(&mutex_inst_ta);
+ init_completion(&event_inst_ta);
+ return 0;
+}
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_ta_mgmt.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_ta_mgmt.h
new file mode 100644
index 0000000..86d6cc4
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_ta_mgmt.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_TA_MGMT_H
+#define TEE_TA_MGMT_H
+
+struct tee;
+struct tee_context;
+
+int tee_ta_mgmt_init(void);
+
+int tee_install_sp_ta(struct tee_context *ctx, void __user *ta_spta_inst_desc);
+int tee_install_sp_ta_response(struct tee_context *ctx, void __user *u_arg);
+int tee_delete_sp_ta(struct tee_context *ctx, void __user *uuid);
+
+int tee_install_sys_ta(struct tee *tee, void __user *u_arg);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui.c
new file mode 100644
index 0000000..f48f89a
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui.c
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/module.h>
+#include <linux/spinlock.h>
+
+#include "tee_tui.h"
+
+static int trustedui_mode = TRUSTEDUI_MODE_OFF;
+static int trustedui_blank_counter;
+
+static DEFINE_SPINLOCK(trustedui_lock);
+
+int trustedui_blank_inc(void)
+{
+ unsigned long flags;
+ int newvalue;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ newvalue = ++trustedui_blank_counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return newvalue;
+}
+EXPORT_SYMBOL(trustedui_blank_inc);
+
+int trustedui_blank_dec(void)
+{
+ unsigned long flags;
+ int newvalue;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ newvalue = --trustedui_blank_counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return newvalue;
+}
+EXPORT_SYMBOL(trustedui_blank_dec);
+
+int trustedui_blank_get_counter(void)
+{
+ unsigned long flags;
+ int newvalue;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ newvalue = trustedui_blank_counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return newvalue;
+}
+EXPORT_SYMBOL(trustedui_blank_get_counter);
+
+void trustedui_blank_set_counter(int counter)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ trustedui_blank_counter = counter;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+}
+EXPORT_SYMBOL(trustedui_blank_set_counter);
+
+int trustedui_get_current_mode(void)
+{
+ unsigned long flags;
+ int mode;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ mode = trustedui_mode;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return mode;
+}
+EXPORT_SYMBOL(trustedui_get_current_mode);
+
+void trustedui_set_mode(int mode)
+{
+ unsigned long flags;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ trustedui_mode = mode;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+}
+EXPORT_SYMBOL(trustedui_set_mode);
+
+
+int trustedui_set_mask(int mask)
+{
+ unsigned long flags;
+ int mode;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ mode = trustedui_mode |= mask;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return mode;
+}
+EXPORT_SYMBOL(trustedui_set_mask);
+
+int trustedui_clear_mask(int mask)
+{
+ unsigned long flags;
+ int mode;
+
+ spin_lock_irqsave(&trustedui_lock, flags);
+ mode = trustedui_mode &= ~mask;
+ spin_unlock_irqrestore(&trustedui_lock, flags);
+
+ return mode;
+}
+EXPORT_SYMBOL(trustedui_clear_mask);
+
+
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui.h
new file mode 100644
index 0000000..5acdbfa
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui.h
@@ -0,0 +1,36 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef _TEE_TUI_H_
+#define _TEE_TUI_H_
+
+#define TRUSTEDUI_MODE_OFF 0x00
+#define TRUSTEDUI_MODE_ALL 0xff
+#define TRUSTEDUI_MODE_TUI_SESSION 0x01
+#define TRUSTEDUI_MODE_VIDEO_SECURED 0x02
+#define TRUSTEDUI_MODE_INPUT_SECURED 0x04
+
+int teec_wait_cmd(uint32_t *cmd_id);
+bool teec_notify_event(uint32_t event_type);
+
+int trustedui_blank_inc(void);
+int trustedui_blank_dec(void);
+int trustedui_blank_get_counter(void);
+void trustedui_blank_set_counter(int counter);
+
+int trustedui_get_current_mode(void);
+void trustedui_set_mode(int mode);
+int trustedui_set_mask(int mask);
+int trustedui_clear_mask(int mask);
+
+
+/**
+ * Notification ID's for communication Trustlet Connector -> Driver.
+ */
+#define NOT_TUI_NONE 0
+/* NWd system event that closes the current TUI session*/
+#define NOT_TUI_CANCEL_EVENT 1
+
+#endif /* _TEE_TUI_H_ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui_hal.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui_hal.c
new file mode 100644
index 0000000..2aec579
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui_hal.c
@@ -0,0 +1,86 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/types.h>
+#include <linux/device.h>
+#include <linux/fb.h>
+
+#include "tee_tui.h"
+#include "tee_tui_hal.h"
+#include <linux/delay.h>
+
+/**
+ * hal_tui_init() - integrator specific initialization for kernel module
+ *
+ * This function is called when the kernel module is initialized, either at
+ * boot time, if the module is built statically in the kernel, or when the
+ * kernel is dynamically loaded if the module is built as a dynamic kernel
+ * module. This function may be used by the integrator, for instance, to get a
+ * memory pool that will be used to allocate the secure framebuffer and work
+ * buffer for TUI sessions.
+ *
+ * Return: must return 0 on success, or non-zero on error. If the function
+ * returns an error, the module initialization will fail.
+ */
+uint32_t __weak hal_tui_init(void)
+{
+ return 0;
+}
+
+/**
+ * hal_tui_exit() - integrator specific exit code for kernel module
+ *
+ * This function is called when the kernel module exit. It is called when the
+ * kernel module is unloaded, for a dynamic kernel module, and never called for
+ * a module built into the kernel. It can be used to free any resources
+ * allocated by hal_tui_init().
+ */
+void __weak hal_tui_exit(void)
+{
+}
+
+/**
+ * hal_tui_deactivate() - deactivate Normal World display and input
+ *
+ * This function should stop the Normal World display and, if necessary, Normal
+ * World input. It is called when a TUI session is opening, before the Secure
+ * World takes control of display and input.
+ *
+ * Return: must return 0 on success, non-zero otherwise.
+ */
+uint32_t __weak hal_tui_deactivate(void)
+{
+ /* Set linux TUI flag */
+ trustedui_set_mask(TRUSTEDUI_MODE_TUI_SESSION);
+
+ /*TODO: save touch/display state */
+ trustedui_set_mask(TRUSTEDUI_MODE_VIDEO_SECURED|
+ TRUSTEDUI_MODE_INPUT_SECURED);
+
+ return 0;
+}
+
+/**
+ * hal_tui_activate() - restore Normal World display and input after a TUI
+ * session
+ *
+ * This function should enable Normal World display and, if necessary, Normal
+ * World input. It is called after a TUI session, after the Secure World has
+ * released the display and input.
+ *
+ * Return: must return 0 on success, non-zero otherwise.
+ */
+uint32_t __weak hal_tui_activate(void)
+{
+ /* Protect NWd */
+ trustedui_clear_mask(TRUSTEDUI_MODE_VIDEO_SECURED|
+ TRUSTEDUI_MODE_INPUT_SECURED);
+
+ /*TODO: restore touch/display state */
+ trustedui_set_mode(TRUSTEDUI_MODE_OFF);
+
+ return 0;
+}
+
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui_hal.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui_hal.h
new file mode 100644
index 0000000..0947dc3
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_tui_hal.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef _TUI_HAL_H_
+#define _TUI_HAL_H_
+
+#include <linux/types.h>
+
+uint32_t hal_tui_init(void);
+void hal_tui_exit(void);
+uint32_t hal_tui_deactivate(void);
+uint32_t hal_tui_activate(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_wait_queue.c b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_wait_queue.c
new file mode 100644
index 0000000..9ddef3b
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_wait_queue.c
@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#include <linux/types.h>
+#include <linux/completion.h>
+#include <linux/slab.h>
+#include "tee_wait_queue.h"
+
+struct tee_wait_queue {
+ struct list_head link;
+ struct completion comp;
+ u32 key;
+};
+
+void tee_wait_queue_init(struct tee_wait_queue_private *priv)
+{
+ mutex_init(&priv->mu);
+ INIT_LIST_HEAD(&priv->db);
+}
+EXPORT_SYMBOL(tee_wait_queue_init);
+
+void tee_wait_queue_exit(struct tee_wait_queue_private *priv)
+{
+ mutex_destroy(&priv->mu);
+}
+EXPORT_SYMBOL(tee_wait_queue_exit);
+
+static struct tee_wait_queue *tee_wait_queue_get(struct device *dev,
+ struct tee_wait_queue_private *priv, u32 key)
+{
+ struct tee_wait_queue *w;
+
+ mutex_lock(&priv->mu);
+
+ list_for_each_entry(w, &priv->db, link)
+ if (w->key == key)
+ goto out;
+
+ w = kmalloc(sizeof(struct tee_wait_queue), GFP_KERNEL);
+ if (!w)
+ goto out;
+
+ init_completion(&w->comp);
+ w->key = key;
+ list_add_tail(&w->link, &priv->db);
+out:
+ mutex_unlock(&priv->mu);
+ return w;
+}
+
+void tee_wait_queue_sleep(struct device *dev,
+ struct tee_wait_queue_private *priv, u32 key)
+{
+ struct tee_wait_queue *w = tee_wait_queue_get(dev, priv, key);
+
+ if (!w)
+ return;
+
+ wait_for_completion(&w->comp);
+ mutex_lock(&priv->mu);
+ list_del(&w->link);
+ mutex_unlock(&priv->mu);
+ kfree(w);
+}
+EXPORT_SYMBOL(tee_wait_queue_sleep);
+
+void tee_wait_queue_wakeup(struct device *dev,
+ struct tee_wait_queue_private *priv, u32 key)
+{
+ struct tee_wait_queue *w = tee_wait_queue_get(dev, priv, key);
+
+ if (!w)
+ return;
+
+ complete(&w->comp);
+}
+EXPORT_SYMBOL(tee_wait_queue_wakeup);
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_wait_queue.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_wait_queue.h
new file mode 100644
index 0000000..922baf2
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/core/tee_wait_queue.h
@@ -0,0 +1,25 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_WAIT_QUEUE_H
+#define TEE_WAIT_QUEUE_H
+
+#include <linux/mutex.h>
+#include <linux/list.h>
+#include <linux/device.h>
+
+struct tee_wait_queue_private {
+ struct mutex mu;
+ struct list_head db;
+};
+
+void tee_wait_queue_init(struct tee_wait_queue_private *priv);
+void tee_wait_queue_exit(struct tee_wait_queue_private *priv);
+void tee_wait_queue_sleep(struct device *dev,
+ struct tee_wait_queue_private *priv, u32 key);
+void tee_wait_queue_wakeup(struct device *dev,
+ struct tee_wait_queue_private *priv, u32 key);
+
+#endif /*TEE_WAIT_QUEUE_H*/
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/arm_common/teesmc.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/arm_common/teesmc.h
new file mode 100644
index 0000000..0c54326
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/arm_common/teesmc.h
@@ -0,0 +1,710 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEESMC_H
+#define TEESMC_H
+
+#ifndef ASM
+/*
+ * This section depends on uint64_t, uint32_t uint8_t already being
+ * defined. Since this file is used in several different environments
+ * (secure world OS and normal world Linux kernel to start with) where
+ * stdint.h may not be available it's the responsibility of the one
+ * including this file to provide those types.
+ */
+
+/*
+ * Trusted OS SMC interface.
+ *
+ * The SMC interface follows SMC Calling Convention
+ * (ARM_DEN0028A_SMC_Calling_Convention).
+ *
+ * The primary objective of this API is to provide a transport layer on
+ * which a Global Platform compliant TEE interfaces can be deployed. But the
+ * interface can also be used for other implementations.
+ *
+ * This file is divided in two parts.
+ * Part 1 deals with passing parameters to Trusted Applications running in
+ * a trusted OS in secure world.
+ * Part 2 deals with the lower level handling of the SMC.
+ */
+
+/*
+ *******************************************************************************
+ * Part 1 - passing parameters to Trusted Applications
+ *******************************************************************************
+ */
+
+/*
+ * Same values as TEE_PARAM_* from TEE Internal API
+ */
+#define TEESMC_ATTR_TYPE_NONE 0
+#define TEESMC_ATTR_TYPE_VALUE_INPUT 1
+#define TEESMC_ATTR_TYPE_VALUE_OUTPUT 2
+#define TEESMC_ATTR_TYPE_VALUE_INOUT 3
+#define TEESMC_ATTR_TYPE_MEMREF_INPUT 5
+#define TEESMC_ATTR_TYPE_MEMREF_OUTPUT 6
+#define TEESMC_ATTR_TYPE_MEMREF_INOUT 7
+
+#define TEESMC_ATTR_TYPE_MASK 0x7
+
+/*
+ * Meta parameter to be absorbed by the Secure OS and not passed
+ * to the Trusted Application.
+ *
+ * One example of this is a struct teesmc_meta_open_session which
+ * is added to TEESMC{32,64}_CMD_OPEN_SESSION.
+ */
+#define TEESMC_ATTR_META 0x8
+
+/*
+ * Used as an indication from normal world of compatible cache usage.
+ * 'I' stands for inner cache and 'O' for outer cache.
+ */
+#define TEESMC_ATTR_CACHE_I_NONCACHE 0x0
+#define TEESMC_ATTR_CACHE_I_WRITE_THR 0x1
+#define TEESMC_ATTR_CACHE_I_WRITE_BACK 0x2
+#define TEESMC_ATTR_CACHE_O_NONCACHE 0x0
+#define TEESMC_ATTR_CACHE_O_WRITE_THR 0x4
+#define TEESMC_ATTR_CACHE_O_WRITE_BACK 0x8
+
+#define TEESMC_ATTR_CACHE_NONCACHE (TEESMC_ATTR_CACHE_I_NONCACHE | \
+ TEESMC_ATTR_CACHE_O_NONCACHE)
+#define TEESMC_ATTR_CACHE_DEFAULT (TEESMC_ATTR_CACHE_I_WRITE_BACK | \
+ TEESMC_ATTR_CACHE_O_WRITE_BACK)
+
+#define TEESMC_ATTR_CACHE_SHIFT 4
+#define TEESMC_ATTR_CACHE_MASK 0xf
+
+#define TEESMC_CMD_OPEN_SESSION 0
+#define TEESMC_CMD_INVOKE_COMMAND 1
+#define TEESMC_CMD_CLOSE_SESSION 2
+#define TEESMC_CMD_CANCEL 3
+
+/**
+ * struct teesmc32_param_memref - memory reference
+ * @buf_ptr: Address of the buffer
+ * @size: Size of the buffer
+ *
+ * Secure and normal world communicates pointer via physical address instead of
+ * the virtual address with is usually used for pointers. This is because
+ * Secure and normal world has completely independent memory mapping. Normal
+ * world can even have a hypervisor which need to translate the guest
+ * physical address (AKA IPA in ARM lingo) to a real physical address
+ * before passing the structure to secure world.
+ */
+struct teesmc32_param_memref {
+ uint32_t buf_ptr;
+ uint32_t size;
+};
+
+/**
+ * struct teesmc32_param_memref - memory reference
+ * @buf_ptr: Address of the buffer
+ * @size: Size of the buffer
+ *
+ * See description of struct teesmc32_param_memref.
+ */
+struct teesmc64_param_memref {
+ uint64_t buf_ptr;
+ uint64_t size;
+};
+
+/**
+ * struct teesmc32_param_value - values
+ * @a: first value
+ * @b: second value
+ */
+struct teesmc32_param_value {
+ uint32_t a;
+ uint32_t b;
+};
+
+/**
+ * struct teesmc64_param_value - values
+ * @a: first value
+ * @b: second value
+ */
+struct teesmc64_param_value {
+ uint64_t a;
+ uint64_t b;
+};
+
+/**
+ * struct teesmc32_param - parameter
+ * @attr: attributes
+ * @memref: a memory reference
+ * @value: a value
+ *
+ * attr & TEESMC_ATTR_TYPE_MASK indicates if memref or value is used in the
+ * union. TEESMC_ATTR_TYPE_VALUE_* indicates value and
+ * TEESMC_ATTR_TYPE_MEMREF_* indicates memref. TEESMC_ATTR_TYPE_NONE
+ * indicates that none of the members are used.
+ */
+struct teesmc32_param {
+ uint32_t attr;
+ union {
+ struct teesmc32_param_memref memref;
+ struct teesmc32_param_value value;
+ } u;
+};
+
+/**
+ * struct teesmc64_param - parameter
+ * @attr: attributes
+ * @memref: a memory reference
+ * @value: a value
+ *
+ * See description of union teesmc32_param.
+ */
+struct teesmc64_param {
+ uint64_t attr;
+ union {
+ struct teesmc64_param_memref memref;
+ struct teesmc64_param_value value;
+ } u;
+};
+
+/**
+ * struct teesmc32_arg - SMC argument for Trusted OS
+ * @cmd: Command, one of TEESMC_CMD_*
+ * @ta_func: Trusted Application function, specific to the Trusted Application,
+ * used if cmd == TEESMC_CMD_INVOKE_COMMAND
+ * @session: In parameter for all TEESMC_CMD_* except
+ * TEESMC_CMD_OPEN_SESSION where it's an output parameter instead
+ * @ret: return value
+ * @ret_origin: origin of the return value
+ * @num_params: number of parameters supplied to the OS Command
+ * @params: the parameters supplied to the OS Command
+ *
+ * All normal SMC calls to Trusted OS uses this struct. If cmd requires
+ * further information than what these field holds it can be passed as a
+ * parameter tagged as meta (setting the TEESMC_ATTR_META bit in
+ * corresponding param_attrs). This is used for TEESMC_CMD_OPEN_SESSION
+ * to pass a struct teesmc32_meta_open_session which is needed find the
+ * Trusted Application and to indicate the credentials of the client.
+ */
+struct teesmc32_arg {
+ uint32_t cmd;
+ uint32_t ta_func;
+ uint32_t session;
+ uint32_t ret;
+ uint32_t ret_origin;
+ uint32_t num_params;
+ /*
+ * Commented out elements used to visualize the layout dynamic part
+ * of the struct. Note that these fields are not available at all
+ * if num_params == 0.
+ *
+ * params is accessed through the macro TEESMC32_GET_PARAMS
+ */
+
+ /* struct teesmc32_param params[num_params]; */
+};
+
+/**
+ * TEESMC32_GET_PARAMS - return pointer to union teesmc32_param *
+ *
+ * @x: Pointer to a struct teesmc32_arg
+ *
+ * Returns a pointer to the params[] inside a struct teesmc32_arg.
+ */
+#define TEESMC32_GET_PARAMS(x) \
+ (struct teesmc32_param *)(((struct teesmc32_arg *)(x)) + 1)
+
+/**
+ * TEESMC32_GET_ARG_SIZE - return size of struct teesmc32_arg
+ *
+ * @num_params: Number of parameters embedded in the struct teesmc32_arg
+ *
+ * Returns the size of the struct teesmc32_arg together with the number
+ * of embedded parameters.
+ */
+#define TEESMC32_GET_ARG_SIZE(num_params) \
+ (sizeof(struct teesmc32_arg) + \
+ sizeof(struct teesmc32_param) * (num_params))
+
+/**
+ * struct teesmc64_arg - SMC argument for Trusted OS
+ * @cmd: OS Command, one of TEESMC_CMD_*
+ * @ta_func: Trusted Application function, specific to the Trusted Application
+ * @session: In parameter for all TEESMC_CMD_* but
+ * TEESMC_CMD_OPEN_SESSION
+ * @ret: return value
+ * @ret_origin: origin of the return value
+ * @num_params: number of parameters supplied to the OS Command
+ * @params: the parameters supplied to the OS Command
+ *
+ * See description of struct teesmc32_arg.
+ */
+struct teesmc64_arg {
+ uint64_t cmd;
+ uint64_t ta_func;
+ uint64_t session;
+ uint64_t ret;
+ uint64_t ret_origin;
+ uint64_t num_params;
+ /*
+ * Commented out elements used to visualize the layout dynamic part
+ * of the struct. Note that these fields are not available at all
+ * if num_params == 0.
+ *
+ * params is accessed through the macro TEESMC64_GET_PARAMS
+ */
+
+ /* struct teesmc64_param params[num_params]; */
+};
+
+/**
+ * TEESMC64_GET_PARAMS - return pointer to union teesmc64_param *
+ *
+ * @x: Pointer to a struct teesmc64_arg
+ *
+ * Returns a pointer to the params[] inside a struct teesmc64_arg.
+ */
+#define TEESMC64_GET_PARAMS(x) \
+ (struct teesmc64_param *)(((struct teesmc64_arg *)(x)) + 1)
+
+/**
+ * TEESMC64_GET_ARG_SIZE - return size of struct teesmc64_arg
+ *
+ * @num_params: Number of parameters embedded in the struct teesmc64_arg
+ *
+ * Returns the size of the struct teesmc64_arg together with the number
+ * of embedded parameters.
+ */
+#define TEESMC64_GET_ARG_SIZE(num_params) \
+ (sizeof(struct teesmc64_arg) + \
+ sizeof(union teesmc64_param) * (num_params))
+
+#define TEESMC_UUID_LEN 16
+
+/**
+ * struct teesmc_meta_open_session - additional parameters for
+ * TEESMC32_CMD_OPEN_SESSION and
+ * TEESMC64_CMD_OPEN_SESSION
+ * @uuid: UUID of the Trusted Application
+ * @clnt_uuid: UUID of client
+ * @clnt_login: Login class of client, TEE_LOGIN_* if being Global Platform
+ * compliant
+ *
+ * This struct is passed in the first parameter as an input memref tagged
+ * as meta on an TEESMC{32,64}_CMD_OPEN_SESSION cmd. It's important
+ * that it really is the first parameter to make it easy for an eventual
+ * hypervisor to inspect and possibly update clnt_* values.
+ */
+struct teesmc_meta_open_session {
+ uint8_t uuid[TEESMC_UUID_LEN];
+ uint8_t clnt_uuid[TEESMC_UUID_LEN];
+ uint32_t clnt_login;
+};
+
+
+#endif /*!ASM*/
+
+/*
+ *******************************************************************************
+ * Part 2 - low level SMC interaction
+ *******************************************************************************
+ */
+
+#define TEESMC_32 0
+#define TEESMC_64 0x40000000
+#define TEESMC_FAST_CALL 0x80000000
+#define TEESMC_STD_CALL 0
+
+#define TEESMC_OWNER_MASK 0x3F
+#define TEESMC_OWNER_SHIFT 24
+
+#define TEESMC_FUNC_MASK 0xFFFF
+
+#define TEESMC_IS_FAST_CALL(smc_val) ((smc_val) & TEESMC_FAST_CALL)
+#define TEESMC_IS_64(smc_val) ((smc_val) & TEESMC_64)
+#define TEESMC_FUNC_NUM(smc_val) ((smc_val) & TEESMC_FUNC_MASK)
+#define TEESMC_OWNER_NUM(smc_val) (((smc_val) >> TEESMC_OWNER_SHIFT) & \
+ TEESMC_OWNER_MASK)
+
+#define TEESMC_CALL_VAL(type, calling_convention, owner, func_num) \
+ ((type) | (calling_convention) | \
+ (((owner) & TEESMC_OWNER_MASK) << TEESMC_OWNER_SHIFT) |\
+ ((func_num) & TEESMC_FUNC_MASK))
+
+#define TEESMC_OWNER_ARCH 0
+#define TEESMC_OWNER_CPU 1
+#define TEESMC_OWNER_SIP 2
+#define TEESMC_OWNER_OEM 3
+#define TEESMC_OWNER_STANDARD 4
+#define TEESMC_OWNER_TRUSTED_APP 48
+#define TEESMC_OWNER_TRUSTED_OS 50
+
+#define TEESMC_OWNER_TRUSTED_OS_API 63
+
+/*
+ * Function specified by SMC Calling convention.
+ */
+#define TEESMC32_FUNCID_CALLS_COUNT 0xFF00
+#define TEESMC32_CALLS_COUNT \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, \
+ TEESMC_OWNER_TRUSTED_OS_API, \
+ TEESMC32_FUNCID_CALLS_COUNT)
+
+/*
+ * Function specified by SMC Calling convention
+ *
+ * Return one of the following UIDs if using API specified in this file
+ * without further extentions:
+ * 65cb6b93-af0c-4617-8ed6-644a8d1140f8 : Only 32 bit calls are supported
+ * 65cb6b93-af0c-4617-8ed6-644a8d1140f9 : Both 32 and 64 bit calls are supported
+ */
+#define TEESMC_UID_R0 0x65cb6b93
+#define TEESMC_UID_R1 0xaf0c4617
+#define TEESMC_UID_R2 0x8ed6644a
+#define TEESMC_UID32_R3 0x8d1140f8
+#define TEESMC_UID64_R3 0x8d1140f9
+#define TEESMC32_FUNCID_CALLS_UID 0xFF01
+#define TEESMC32_CALLS_UID \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, \
+ TEESMC_OWNER_TRUSTED_OS_API, \
+ TEESMC32_FUNCID_CALLS_UID)
+
+/*
+ * Function specified by SMC Calling convention
+ *
+ * Returns 1.0 if using API specified in this file without further extentions.
+ */
+#define TEESMC_REVISION_MAJOR 1
+#define TEESMC_REVISION_MINOR 0
+#define TEESMC32_FUNCID_CALLS_REVISION 0xFF03
+#define TEESMC32_CALLS_REVISION \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, \
+ TEESMC_OWNER_TRUSTED_OS_API, \
+ TEESMC32_FUNCID_CALLS_REVISION)
+
+/*
+ * Get UUID of Trusted OS.
+ *
+ * Used by non-secure world to figure out which Trusted OS is installed.
+ * Note that returned UUID is the UUID of the Trusted OS, not of the API.
+ *
+ * Returns UUID in r0-4/w0-4 in the same way as TEESMC32_CALLS_UID
+ * described above.
+ */
+#define TEESMC_FUNCID_GET_OS_UUID 0
+#define TEESMC32_CALL_GET_OS_UUID \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_GET_OS_UUID)
+
+/*
+ * Get revision of Trusted OS.
+ *
+ * Used by non-secure world to figure out which version of the Trusted OS
+ * is installed. Note that the returned revision is the revision of the
+ * Trusted OS, not of the API.
+ *
+ * Returns revision in r0-1/w0-1 in the same way as TEESMC32_CALLS_REVISION
+ * described above.
+ */
+#define TEESMC_FUNCID_GET_OS_REVISION 1
+#define TEESMC32_CALL_GET_OS_REVISION \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_GET_OS_REVISION)
+
+
+
+/*
+ * Call with struct teesmc32_arg as argument
+ *
+ * Call register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_WITH_ARG
+ * r1/x1 Physical pointer to a struct teesmc32_arg
+ * r2-6/x2-6 Not used
+ * r7/x7 Hypervisor Client ID register
+ *
+ * Normal return register usage:
+ * r0/x0 Return value, TEESMC_RETURN_*
+ * r1-3/x1-3 Not used
+ * r4-7/x4-7 Preserved
+ *
+ * Ebusy return register usage:
+ * r0/x0 Return value, TEESMC_RETURN_ETHREAD_LIMIT
+ * r1-3/x1-3 Preserved
+ * r4-7/x4-7 Preserved
+ *
+ * RPC return register usage:
+ * r0/x0 Return value, TEESMC_RETURN_IS_RPC(val)
+ * r1-2/x1-2 RPC parameters
+ * r3-7/x3-7 Resume information, must be preserved
+ *
+ * Possible return values:
+ * TEESMC_RETURN_UNKNOWN_FUNCTION Trusted OS does not recognize this
+ * function.
+ * TEESMC_RETURN_OK Call completed, result updated in
+ * the previously supplied struct
+ * teesmc32_arg.
+ * TEESMC_RETURN_ETHREAD_LIMIT Trusted OS out of threads,
+ * try again later.
+ * TEESMC_RETURN_EBADADDR Bad physcial pointer to struct
+ * teesmc32_arg.
+ * TEESMC_RETURN_EBADCMD Bad/unknown cmd in struct teesmc32_arg
+ * TEESMC_RETURN_IS_RPC() Call suspended by RPC call to normal
+ * world.
+ */
+#define TEESMC_FUNCID_CALL_WITH_ARG 2
+#define TEESMC32_CALL_WITH_ARG \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_STD_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_CALL_WITH_ARG)
+/* Same as TEESMC32_CALL_WITH_ARG but a "fast call". */
+#define TEESMC32_FASTCALL_WITH_ARG \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_CALL_WITH_ARG)
+
+/*
+ * Call with struct teesmc64_arg as argument
+ *
+ * See description of TEESMC32_CALL_WITH_ARG above, uses struct
+ * teesmc64_arg in x1 instead.
+ */
+#define TEESMC64_CALL_WITH_ARG \
+ TEESMC_CALL_VAL(TEESMC_64, TEESMC_STD_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_CALL_WITH_ARG)
+/* Same as TEESMC64_CALL_WITH_ARG but a "fast call". */
+#define TEESMC64_FASTCALL_WITH_ARG \
+ TEESMC_CALL_VAL(TEESMC_64, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_CALL_WITH_ARG)
+
+/*
+ * Resume from RPC (for example after processing an IRQ)
+ *
+ * Call register usage:
+ * r0/x0 SMC Function ID,
+ * TEESMC32_CALL_RETURN_FROM_RPC or
+ * TEESMC32_FASTCALL_RETURN_FROM_RPC
+ * r1-3/x1-3 Value of r1-3/x1-3 when TEESMC32_CALL_WITH_ARG returned
+ * TEESMC_RETURN_RPC in r0/x0
+ *
+ * Return register usage is the same as for TEESMC32_CALL_WITH_ARG above.
+ *
+ * Possible return values
+ * TEESMC_RETURN_UNKNOWN_FUNCTION Trusted OS does not recognize this
+ * function.
+ * TEESMC_RETURN_OK Original call completed, result
+ * updated in the previously supplied.
+ * struct teesmc32_arg
+ * TEESMC_RETURN_RPC Call suspended by RPC call to normal
+ * world.
+ * TEESMC_RETURN_ETHREAD_LIMIT Trusted OS out of threads,
+ * try again later.
+ * TEESMC_RETURN_ERESUME Resume failed, the opaque resume
+ * information was corrupt.
+ */
+#define TEESMC_FUNCID_RETURN_FROM_RPC 3
+#define TEESMC32_CALL_RETURN_FROM_RPC \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_STD_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_RETURN_FROM_RPC)
+/* Same as TEESMC32_CALL_RETURN_FROM_RPC but a "fast call". */
+#define TEESMC32_FASTCALL_RETURN_FROM_RPC \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_RETURN_FROM_RPC)
+
+/*
+ * Resume from RPC (for example after processing an IRQ)
+ *
+ * See description of TEESMC32_CALL_RETURN_FROM_RPC above, used when
+ * it's a 64bit call that has returned.
+ */
+#define TEESMC64_CALL_RETURN_FROM_RPC \
+ TEESMC_CALL_VAL(TEESMC_64, TEESMC_STD_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_RETURN_FROM_RPC)
+/* Same as TEESMC64_CALL_RETURN_FROM_RPC but a "fast call". */
+#define TEESMC64_FASTCALL_RETURN_FROM_RPC \
+ TEESMC_CALL_VAL(TEESMC_64, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_RETURN_FROM_RPC)
+
+/*
+ * From secure monitor to Trusted OS, handle FIQ
+ *
+ * A virtual call which is injected by the Secure Monitor when an FIQ is
+ * raised while in normal world (SCR_NS is set). The monitor restores
+ * secure architecture registers and secure EL_SP1 and jumps to previous
+ * secure EL3_ELR. Trusted OS should preserve all general purpose
+ * registers.
+ *
+ * Call register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_HANDLE_FIQ
+ * r1-7/x1-7 Not used, but must be preserved
+ *
+ * Return register usage:
+ * Note used
+ */
+#define TEESMC_FUNCID_CALL_HANDLE_FIQ 0xf000
+#define TEESMC32_CALL_HANDLE_FIQ \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_FUNCID_CALL_HANDLE_FIQ)
+
+#define TEESMC_RETURN_RPC_PREFIX_MASK 0xFFFF0000
+#define TEESMC_RETURN_RPC_PREFIX 0xFFFF0000
+#define TEESMC_RETURN_RPC_FUNC_MASK 0x0000FFFF
+
+#define TEESMC_RETURN_GET_RPC_FUNC(ret) ((ret) & TEESMC_RETURN_RPC_FUNC_MASK)
+
+#define TEESMC_RPC_VAL(func) ((func) | TEESMC_RETURN_RPC_PREFIX)
+
+/*
+ * Allocate argument memory for RPC parameter passing.
+ * Argument memory is used to hold a struct teesmc32_arg.
+ *
+ * "Call" register usage:
+ * r0/x0 This value, TEESMC_RETURN_RPC_ALLOC
+ * r1/x1 Size in bytes of required argument memory
+ * r2-7/x2-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r1/x1 Physical pointer to allocated argument memory, 0 if size
+ * was 0 or if memory can't be allocated
+ * r2-7/x2-7 Preserved
+ */
+#define TEESMC_RPC_FUNC_ALLOC_ARG 0
+#define TEESMC_RETURN_RPC_ALLOC_ARG \
+ TEESMC_RPC_VAL(TEESMC_RPC_FUNC_ALLOC_ARG)
+
+/*
+ * Allocate payload memory for RPC parameter passing.
+ * Payload memory is used to hold the memory referred to by struct
+ * teesmc32_param_memref.
+ *
+ * "Call" register usage:
+ * r0/x0 This value, TEESMC_RETURN_RPC_ALLOC
+ * r1/x1 Size in bytes of required payload memory
+ * r2-7/x2-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r1/x1 Physical pointer to allocated payload memory, 0 if size
+ * was 0 or if memory can't be allocated
+ * r2-7/x2-7 Preserved
+ */
+#define TEESMC_RPC_FUNC_ALLOC_PAYLOAD 1
+#define TEESMC_RETURN_RPC_ALLOC_PAYLOAD \
+ TEESMC_RPC_VAL(TEESMC_RPC_FUNC_ALLOC_PAYLOAD)
+
+/*
+ * Free memory previously allocated by TEESMC_RETURN_RPC_ALLOC_ARG.
+ *
+ * "Call" register usage:
+ * r0/x0 This value, TEESMC_RETURN_RPC_FREE
+ * r1/x1 Physical pointer to previously allocated argument memory
+ * r2-7/x2-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r1/x1 Not used
+ * r2-7/x2-7 Preserved
+ */
+#define TEESMC_RPC_FUNC_FREE_ARG 2
+#define TEESMC_RETURN_RPC_FREE_ARG TEESMC_RPC_VAL(TEESMC_RPC_FUNC_FREE_ARG)
+
+/*
+ * Free memory previously allocated by TEESMC_RETURN_RPC_ALLOC_PAYLOAD.
+ *
+ * "Call" register usage:
+ * r0/x0 This value, TEESMC_RETURN_RPC_FREE
+ * r1/x1 Physical pointer to previously allocated payload memory
+ * r3-7/x3-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r1-2/x1-2 Not used
+ * r3-7/x3-7 Preserved
+ */
+#define TEESMC_RPC_FUNC_FREE_PAYLOAD 3
+#define TEESMC_RETURN_RPC_FREE_PAYLOAD \
+ TEESMC_RPC_VAL(TEESMC_RPC_FUNC_FREE_PAYLOAD)
+
+/*
+ * Deliver an IRQ in normal world.
+ *
+ * "Call" register usage:
+ * r0/x0 TEESMC_RETURN_RPC_IRQ
+ * r1-7/x1-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r1-7/x1-7 Preserved
+ */
+#define TEESMC_RPC_FUNC_IRQ 4
+#define TEESMC_RETURN_RPC_IRQ TEESMC_RPC_VAL(TEESMC_RPC_FUNC_IRQ)
+
+/*
+ * Do an RPC request. The supplied struct teesmc{32,64}_arg tells which
+ * request to do and the parameters for the request. The following fields
+ * are used (the rest are unused):
+ * - cmd the Request ID
+ * - ret return value of the request, filled in by normal world
+ * - num_params number of parameters for the request
+ * - params the parameters
+ * - param_attrs attributes of the parameters
+ *
+ * "Call" register usage:
+ * r0/x0 TEESMC_RETURN_RPC_CMD
+ * r1/x1 Physical pointer to a struct teesmc32_arg if returning from
+ * a AArch32 SMC or a struct teesmc64_arg if returning from a
+ * AArch64 SMC, must be preserved, only the data should
+ * be updated
+ * r2-7/x2-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r1-7/x1-7 Preserved
+ */
+#define TEESMC_RPC_FUNC_CMD 5
+#define TEESMC_RETURN_RPC_CMD TEESMC_RPC_VAL(TEESMC_RPC_FUNC_CMD)
+
+#define T6SMC_RPC_NONPREEMPT_CMD 6
+#define T6SMC_RPC_NONPREEMPT_GET_FUNC(ret) \
+ ((TEESMC_RETURN_GET_RPC_FUNC(ret) >> 8) & 0xff)
+
+#define T6SMC_RETURN_RPC_NONPREEMPT_CMD(cmd) \
+ TEESMC_RPC_VAL(T6SMC_RPC_NONPREEMPT_CMD | (((cmd) & 0xff) << 8))
+
+#define T6SMC_RPC_CLKMGR_CMD 0
+#define T6SMC_RETURN_RPC_CLKMGR_CMD \
+ T6SMC_RETURN_RPC_NONPREEMPT_CMD(T6SMC_RPC_CLKMGR_CMD)
+
+/* not used. for compatible with old tos version */
+#define T6SMC_RPC_CLKMGR_LEGACY_CMD 7
+#define T6SMC_RETURN_RPC_CLKMGR_LEGACY_CMD \
+ TEESMC_RPC_VAL(T6SMC_RPC_CLKMGR_LEGACY_CMD)
+
+/* Returned in r0 */
+#define TEESMC_RETURN_UNKNOWN_FUNCTION 0xFFFFFFFF
+
+/* Returned in r0 only from Trusted OS functions */
+#define TEESMC_RETURN_OK 0x0
+#define TEESMC_RETURN_ETHREAD_LIMIT 0x1
+#define TEESMC_RETURN_ERESUME 0x2
+#define TEESMC_RETURN_EBADADDR 0x3
+#define TEESMC_RETURN_EBADCMD 0x4
+#define TEESMC_RETURN_IS_RPC(ret) \
+ (((ret) & TEESMC_RETURN_RPC_PREFIX_MASK) == TEESMC_RETURN_RPC_PREFIX)
+
+/*
+ * Returned in r1 by Trusted OS functions if r0 = TEESMC_RETURN_RPC
+ */
+#define TEESMC_RPC_REQUEST_IRQ 0x0
+
+#endif /* TEESMC_H */
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/arm_common/teesmc_st.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/arm_common/teesmc_st.h
new file mode 100644
index 0000000..73fd356
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/arm_common/teesmc_st.h
@@ -0,0 +1,149 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEESMC_ST_H
+#define TEESMC_ST_H
+
+#define TEESMC_ST_RETURN_NOTAVAIL 0x5700
+
+/*
+ * Get Shared Memory Config
+ *
+ * Returns the Secure/Non-secure shared memory config.
+ *
+ * Call register usage:
+ * r0 SMC Function ID, TEESMC32_ST_FASTCALL_GET_SHM_CONFIG
+ * r1-6 Not used
+ * r7 Hypervisor Client ID register
+ *
+ * Have config return register usage:
+ * r0 TEESMC_RETURN_OK
+ * r1 Physical address of start of SHM
+ * r2 Size of of SHM
+ * r3 1 if SHM is cached, 0 if uncached.
+ * r4-7 Preserved
+ *
+ * Not available register usage:
+ * r0 TEESMC_ST_RETURN_NOTAVAIL
+ * r1-3 Not used
+ * r4-7 Preserved
+ */
+#define TEESMC_ST_FUNCID_GET_SHM_CONFIG 0x5700
+#define TEESMC32_ST_FASTCALL_GET_SHM_CONFIG \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_ST_FUNCID_GET_SHM_CONFIG)
+
+/*
+ * Get Log Memory Config
+ *
+ * Returns the Secure/Non-secure shared memory config.
+ *
+ * Call register usage:
+ * r0 SMC Function ID, TEESMC32_ST_FASTCALL_GET_LOGM_CONFIG
+ * r1-6 Not used
+ * r7 Hypervisor Client ID register
+ *
+ * Have config return register usage:
+ * r0 TEESMC_RETURN_OK
+ * r1 Physical address of start of LOGM
+ * r2 Size of of SHM
+ * r3 1 if SHM is cached, 0 if uncached.
+ * r4-7 Preserved
+ *
+ * Not available register usage:
+ * r0 TEESMC_ST_RETURN_NOTAVAIL
+ * r1-3 Not used
+ * r4-7 Preserved
+ */
+
+#define TEESMC_ST_FUNCID_GET_LOGM_CONFIG 0x5702
+#define TEESMC32_ST_FASTCALL_GET_LOGM_CONFIG \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_ST_FUNCID_GET_LOGM_CONFIG)
+
+#define TKCORE_FUNCID_TRACE_CONFIG 0x5703
+#define TKCORE_FASTCALL_TRACE_CONFIG \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TKCORE_FUNCID_TRACE_CONFIG)
+
+/*
+ * Configures TZ/NS shared mutex for outer cache maintenance
+ *
+ * Disables, enables usage of outercache mutex.
+ * Returns or sets physical address of outercache mutex.
+ *
+ * Call register usage:
+ * r0 SMC Function ID, TEESMC32_ST_FASTCALL_L2CC_MUTEX
+ * r1 TEESMC_ST_L2CC_MUTEX_GET_ADDR Get physical address of mutex
+ * TEESMC_ST_L2CC_MUTEX_SET_ADDR Set physical address of mutex
+ * TEESMC_ST_L2CC_MUTEX_ENABLE Enable usage of mutex
+ * TEESMC_ST_L2CC_MUTEX_DISABLE Disable usage of mutex
+ * r2 if r1 == TEESMC_ST_L2CC_MUTEX_SET_ADDR, physical address of mutex
+ * r3-6 Not used
+ * r7 Hypervisor Client ID register
+ *
+ * Have config return register usage:
+ * r0 TEESMC_RETURN_OK
+ * r1 Preserved
+ * r2 if r1 == 0, physical address of L2CC mutex
+ * r3-7 Preserved
+ *
+ * Error return register usage:
+ * r0 TEESMC_ST_RETURN_NOTAVAIL Physical address not available
+ * TEESMC_RETURN_EBADADDR Bad supplied physical address
+ * TEESMC_RETURN_EBADCMD Unsupported value in r1
+ * r1-7 Preserved
+ */
+#define TEESMC_ST_L2CC_MUTEX_GET_ADDR 0
+#define TEESMC_ST_L2CC_MUTEX_SET_ADDR 1
+#define TEESMC_ST_L2CC_MUTEX_ENABLE 2
+#define TEESMC_ST_L2CC_MUTEX_DISABLE 3
+#define TEESMC_ST_FUNCID_L2CC_MUTEX 0x5701
+#define TEESMC32_ST_FASTCALL_L2CC_MUTEX \
+ TEESMC_CALL_VAL(TEESMC_32, TEESMC_FAST_CALL, TEESMC_OWNER_TRUSTED_OS, \
+ TEESMC_ST_FUNCID_L2CC_MUTEX)
+
+/*
+ * Allocate payload memory for RPC parameter passing.
+ *
+ * "Call" register usage:
+ * r0/x0 This value, TEESMC_RETURN_ST_RPC_ALLOC_PAYLOAD
+ * r1/x1 Size in bytes of required payload memory
+ * r2/x2 Not used
+ * r3-7/x3-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r1/x1 Physical pointer to allocated payload memory, 0 if size
+ * was 0 or if memory can't be allocated
+ * r2/x2 Shared memory cookie used when freeing the memory
+ * r3-7/x3-7 Preserved
+ */
+#define TEESMC_ST_RPC_FUNC_ALLOC_PAYLOAD 0x5700
+#define TEESMC_RETURN_ST_RPC_ALLOC_PAYLOAD \
+ TEESMC_RPC_VAL(TEESMC_ST_RPC_FUNC_ALLOC_PAYLOAD)
+
+
+/*
+ * Free memory previously allocated by TEESMC_RETURN_ST_RPC_ALLOC_PAYLOAD
+ *
+ * "Call" register usage:
+ * r0/x0 This value, TEESMC_RETURN_ST_RPC_FREE_PAYLOAD
+ * r1/x1 Shared memory cookie belonging to this payload memory
+ * r2-7/x2-7 Resume information, must be preserved
+ *
+ * "Return" register usage:
+ * r0/x0 SMC Function ID, TEESMC32_CALL_RETURN_FROM_RPC if it was an
+ * AArch32 SMC return or TEESMC64_CALL_RETURN_FROM_RPC for
+ * AArch64 SMC return
+ * r2-7/x2-7 Preserved
+ */
+#define TEESMC_ST_RPC_FUNC_FREE_PAYLOAD 0x5701
+#define TEESMC_RETURN_ST_RPC_FREE_PAYLOAD \
+ TEESMC_RPC_VAL(TEESMC_ST_RPC_FUNC_FREE_PAYLOAD)
+
+#endif /*TEESMC_ST_H*/
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_client_api.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_client_api.h
new file mode 100644
index 0000000..70ada52
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_client_api.h
@@ -0,0 +1,161 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_CLIENT_API_H
+#define TEE_CLIENT_API_H
+
+#define TEEC_CONFIG_PAYLOAD_REF_COUNT 4
+
+#define TEEC_CONFIG_SHAREDMEM_MAX_SIZE 0x8000
+
+#define TEEC_NONE 0x00000000
+#define TEEC_VALUE_INPUT 0x00000001
+#define TEEC_VALUE_OUTPUT 0x00000002
+#define TEEC_VALUE_INOUT 0x00000003
+#define TEEC_MEMREF_TEMP_INPUT 0x00000005
+#define TEEC_MEMREF_TEMP_OUTPUT 0x00000006
+#define TEEC_MEMREF_TEMP_INOUT 0x00000007
+#define TEEC_MEMREF_WHOLE 0x0000000C
+#define TEEC_MEMREF_PARTIAL_INPUT 0x0000000D
+#define TEEC_MEMREF_PARTIAL_OUTPUT 0x0000000E
+#define TEEC_MEMREF_PARTIAL_INOUT 0x0000000F
+
+#define TEEC_MEMREF_PERMANENT 0x00000008
+
+#define TEEC_MEM_INPUT 0x00000001
+#define TEEC_MEM_OUTPUT 0x00000002
+#define TEEC_MEM_DMABUF 0x00010000
+#define TEEC_MEM_KAPI 0x00020000
+
+#define TEEC_MEM_NONSECURE 0x00040000
+
+#define TEEC_SUCCESS 0x00000000
+#define TEEC_ERROR_GENERIC 0xFFFF0000
+#define TEEC_ERROR_ACCESS_DENIED 0xFFFF0001
+#define TEEC_ERROR_CANCEL 0xFFFF0002
+#define TEEC_ERROR_ACCESS_CONFLICT 0xFFFF0003
+#define TEEC_ERROR_EXCESS_DATA 0xFFFF0004
+#define TEEC_ERROR_BAD_FORMAT 0xFFFF0005
+#define TEEC_ERROR_BAD_PARAMETERS 0xFFFF0006
+#define TEEC_ERROR_BAD_STATE 0xFFFF0007
+#define TEEC_ERROR_ITEM_NOT_FOUND 0xFFFF0008
+#define TEEC_ERROR_NOT_IMPLEMENTED 0xFFFF0009
+#define TEEC_ERROR_NOT_SUPPORTED 0xFFFF000A
+#define TEEC_ERROR_NO_DATA 0xFFFF000B
+#define TEEC_ERROR_OUT_OF_MEMORY 0xFFFF000C
+#define TEEC_ERROR_BUSY 0xFFFF000D
+#define TEEC_ERROR_COMMUNICATION 0xFFFF000E
+#define TEEC_ERROR_SECURITY 0xFFFF000F
+#define TEEC_ERROR_SHORT_BUFFER 0xFFFF0010
+#define TEEC_ERROR_TARGET_DEAD 0xFFFF3024
+
+#define TEEC_ORIGIN_API 0x00000001
+#define TEEC_ORIGIN_COMMS 0x00000002
+#define TEEC_ORIGIN_TEE 0x00000003
+#define TEEC_ORIGIN_TRUSTED_APP 0x00000004
+
+#define TEEC_LOGIN_PUBLIC 0x00000000
+#define TEEC_LOGIN_USER 0x00000001
+#define TEEC_LOGIN_GROUP 0x00000002
+#define TEEC_LOGIN_APPLICATION 0x00000004
+
+#define TEEC_PARAM_TYPES(p0, p1, p2, p3) \
+ ((p0) | ((p1) << 4) | ((p2) << 8) | ((p3) << 12))
+
+#define TEEC_PARAM_TYPE_GET(p, i)\
+ (((p) >> (i * 4)) & 0xF)
+
+typedef uint32_t TEEC_Result;
+
+struct TEEC_Context {
+ char devname[256];
+ union {
+ struct tee_context *ctx;
+ int fd;
+ };
+};
+
+struct TEEC_UUID {
+ uint32_t timeLow;
+ uint16_t timeMid;
+ uint16_t timeHiAndVersion;
+ uint8_t clockSeqAndNode[8];
+};
+
+struct TEEC_SharedMemory {
+ union {
+ void *buffer;
+ uint64_t padding_ptr;
+ };
+ union {
+ size_t size;
+ uint64_t padding_sz;
+ };
+ uint32_t flags;
+
+ uint32_t reserved;
+ union {
+ int fd;
+ void *ptr;
+ uint64_t padding_d;
+ } d;
+ uint64_t registered;
+};
+
+struct TEEC_TempMemoryReference {
+ union {
+ void *buffer;
+ uint64_t padding_ptr;
+ };
+ union {
+ size_t size;
+ uint64_t padding_sz;
+ };
+};
+
+struct TEEC_RegisteredMemoryReference {
+ union {
+ struct TEEC_SharedMemory *parent;
+ uint64_t padding_ptr;
+ };
+ union {
+ size_t size;
+ uint64_t padding_sz;
+ };
+ union {
+ size_t offset;
+ uint64_t padding_off;
+ };
+};
+
+struct TEEC_Value {
+ uint32_t a;
+ uint32_t b;
+};
+
+union TEEC_Parameter {
+ struct TEEC_TempMemoryReference tmpref;
+ struct TEEC_RegisteredMemoryReference memref;
+ struct TEEC_Value value;
+};
+
+struct TEEC_Session {
+ int fd;
+};
+
+struct TEEC_Operation {
+ uint32_t started;
+ uint32_t paramTypes;
+ union TEEC_Parameter params[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+ /* Implementation-Defined */
+ union {
+ struct TEEC_Session *session;
+ uint64_t padding_ptr;
+ };
+ struct TEEC_SharedMemory memRefs[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+ uint64_t flags;
+};
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_clkmgr.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_clkmgr.h
new file mode 100644
index 0000000..e4be3ac
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_clkmgr.h
@@ -0,0 +1,57 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_CLKMGR_H
+#define TEE_CLKMGR_H
+
+/* TKCORE clk manager framework assumes that
+ * the clock enable/disable operations are
+ * symmetric, that is, a clock enabling operation
+ * requires the same amount of arguments as
+ * the clock disabling operation.
+ *
+ * TKCORE Clk mgr supports at the most 3 arguments
+ * for a clk operation
+ */
+
+int tee_clkmgr_register(const char *clkname, int master_id,
+ void *enable_fn, void *disable_fn,
+ void *p1, void *p2, void *p3, size_t argnum);
+
+#define tee_clkmgr_register0(clkname, id, e, d) \
+ tee_clkmgr_register((clkname), (id), \
+ (void *) (e), (void *) (d), \
+ NULL, NULL, NULL, 0)
+
+#define tee_clkmgr_register1(clkname, id, e, d, p0) \
+ tee_clkmgr_register((clkname), (id), \
+ (void *) (e), (void *) (d), \
+ (void *) (p0), NULL, NULL, 1)
+
+#define tee_clkmgr_register2(clkname, id, e, d, p0, p1)\
+ tee_clkmgr_register((clkname), (id), \
+ (void *) (e), (void *) (d), \
+ (void *) (p0), (void *) (p1), NULL, 2)
+
+#define tee_clkmgr_register3(clkname, id, e, d, p0, p1, p2)\
+ tee_clkmgr_register((clkname), (id), \
+ (void *) (e), (void *) (d), \
+ (void *) (p0), (void *) (p1), (void *) (p2), 3)
+
+#define TEE_CLKMGR_TOKEN_NOT_LEGACY (0x1)
+
+#define TEE_CLKMGR_TOKEN_ID_SHIFT (1)
+#define TEE_CLKMGR_TOKEN_TYPE_MASK (0xffffu)
+#define TEE_CLKMGR_TOKEN_TYPE_SHIFT (16)
+#define TEE_CLKMGR_TOKEN(type, id) \
+ (((type) << TEE_CLKMGR_TOKEN_TYPE_SHIFT) | \
+ ((id) << TEE_CLKMGR_TOKEN_ID_SHIFT) | \
+ TEE_CLKMGR_TOKEN_NOT_LEGACY)
+
+#define TEE_CLKMGR_OP_ENABLE (0x1)
+
+int tee_clkmgr_handle(uint32_t token, uint32_t op);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_core.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_core.h
new file mode 100644
index 0000000..3969e62
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_core.h
@@ -0,0 +1,229 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef __TEE_CORE_DRV_H__
+#define __TEE_CORE_DRV_H__
+
+#include <linux/klist.h>
+#include <linux/device.h>
+#include <linux/file.h>
+#include <linux/cdev.h>
+#include <linux/miscdevice.h>
+#include <linux/types.h>
+#include <linux/atomic.h>
+#include <linux/scatterlist.h>
+
+#include <linux/types.h>
+#include <linux/tee_client_api.h>
+
+#include <linux/err.h>
+#include <linux/sched.h>
+
+struct tee_cmd_io;
+struct tee_shm_io;
+struct tee_rpc;
+
+enum tee_state {
+ TEE_OFFLINE = 0,
+ TEE_ONLINE = 1,
+ TEE_SUSPENDED = 2,
+ TEE_RUNNING = 3,
+ TEE_CRASHED = 4,
+ TEE_LAST = 5,
+};
+
+#define TEE_CONF_TEST_MODE 0x01000000
+#define TEE_CONF_FW_NOT_CAPABLE 0x00000001
+
+struct tee_stats_entry {
+ int count;
+ int max;
+};
+
+#define TEE_STATS_CONTEXT_IDX 0
+#define TEE_STATS_SESSION_IDX 1
+#define TEE_STATS_SHM_IDX 2
+
+#define TEE_MAX_TEE_DEV_NAME (64)
+struct tee {
+ struct klist_node node;
+ char name[TEE_MAX_TEE_DEV_NAME];
+ int id;
+ void *priv;
+ const struct tee_ops *ops;
+ struct device *dev;
+ struct miscdevice miscdev;
+ struct tee_rpc *rpc;
+
+ atomic_t refcount;
+ int max_refcount;
+ struct tee_stats_entry stats[3];
+ struct list_head list_ctx;
+ struct list_head list_rpc_shm;
+ struct mutex lock;
+ unsigned int state;
+ uint32_t shm_flags; /* supported flags for shm allocation */
+ uint32_t conf;
+ uint32_t test;
+};
+
+#define _DEV(tee) (tee->miscdev.this_device)
+
+#define TEE_MAX_CLIENT_NAME (128)
+
+/**
+ * struct tee_context - internal structure to store a TEE context.
+ *
+ * @tee: tee attached to the tee_context
+ * @usr_client: flag to known if the client is user side client
+ * @entry: list of tee_context
+ * @list_sess: list of tee_session that denotes all tee_session attached
+ * @list_shm: list of tee_shm that denotes all tee_shm attached
+ * @refcount: number of objects which reference it (including itself)
+ */
+struct tee_context {
+ struct tee *tee;
+ char name[TEE_MAX_CLIENT_NAME];
+ int tgid;
+ int usr_client;
+ struct list_head entry;
+ struct list_head list_sess;
+ struct list_head list_shm;
+ struct kref refcount;
+};
+
+/**
+ * struct tee_session - internal structure to store a TEE session.
+ *
+ * @entry: list of tee_context
+ * @ctx: tee_context attached to the tee_session
+ * @sessid: session ID returned by the secure world
+ * @priv: exporter specific private data for this buffer object
+ */
+struct tee_session {
+ struct list_head entry;
+ struct tee_context *ctx;
+ uint32_t sessid;
+ void *priv;
+};
+
+struct tee_shm_dma_buf {
+ struct dma_buf_attachment *attach;
+ struct sg_table *sgt;
+ bool tee_allocated;
+};
+
+struct tee_shm_resv {
+ void *kaddr;
+ dma_addr_t paddr;
+ struct sg_table sgt;
+ struct tee_shm_dma_buf *sdb;
+};
+
+struct tee_shm_ns {
+ uint32_t token;
+ struct page **pages;
+ size_t nr_pages;
+ atomic_t ref;
+};
+
+/**
+ * struct tee_shm - internal structure to store a shm object.
+ *
+ * @ctx: tee_context attached to the buffer.
+ * @tee: tee attached to the buffer.
+ * @dev: device attached to the buffer.
+ * @size_req: requested size for the buffer
+ * @size_alloc: effective size of the buffer
+ * @kaddr: kernel address if mapped kernel side
+ * @paddr: physical address
+ * @flags: flags which denote the type of the buffer
+ * @entry: list of tee_shm
+ */
+struct tee_shm {
+ struct list_head entry;
+
+ struct tee_context *ctx;
+ struct tee *tee;
+ struct device *dev;
+
+ size_t size_req;
+ size_t size_alloc;
+
+ uint32_t flags;
+
+ union {
+ struct tee_shm_resv resv;
+ struct tee_shm_ns ns;
+ };
+};
+
+#define TEE_SHM_MAPPED 0x01000000
+#define TEE_SHM_TEMP 0x02000000
+#define TEE_SHM_FROM_RPC 0x04000000
+#define TEE_SHM_REGISTERED 0x08000000
+#define TEE_SHM_MEMREF 0x10000000
+#define TEE_SHM_CACHED 0x20000000
+
+#define TEE_SHM_DRV_PRIV_MASK 0xFF000000
+
+struct tee_data {
+ uint32_t type;
+ uint32_t type_original;
+ struct TEEC_SharedMemory c_shm[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+ union {
+ struct tee_shm *shm;
+ struct TEEC_Value value;
+ } params[TEEC_CONFIG_PAYLOAD_REF_COUNT];
+};
+
+struct tee_cmd {
+ TEEC_Result err;
+ uint32_t origin;
+ uint32_t cmd;
+ struct tee_shm *uuid;
+ struct tee_shm *ta;
+ struct tee_data param;
+};
+
+void *tee_map_cached_shm(unsigned long pa, size_t len);
+void tee_unmap_cached_shm(void *va);
+
+struct tee_shm *tee_shm_alloc_from_rpc(struct tee *tee,
+ size_t size, uint32_t extra_flags);
+void tee_shm_free_from_rpc(struct tee_shm *shm);
+
+int tee_core_add(struct tee *tee);
+int tee_core_del(struct tee *tee);
+
+int __tee_get(struct tee *tee);
+
+struct tee *tee_core_alloc(struct device *dev, char *name, int id,
+ const struct tee_ops *ops, size_t len);
+int tee_core_free(struct tee *tee);
+
+#include <linux/tee_kernel_lowlevel_api.h>
+
+struct tee_ops {
+ struct module *owner;
+ const char *type;
+
+ int (*start)(struct tee *tee);
+ int (*stop)(struct tee *tee);
+ int (*open)(struct tee_session *sess, struct tee_cmd *cmd);
+ int (*close)(struct tee_session *sess);
+ int (*invoke)(struct tee_session *sess, struct tee_cmd *cmd);
+ int (*cancel)(struct tee_session *sess, struct tee_cmd *cmd);
+ struct tee_shm *(*alloc)(struct tee *tee, size_t size,
+ uint32_t flags);
+ void (*free)(struct tee_shm *shm);
+ int (*shm_inc_ref)(struct tee_shm *shm);
+
+ void (*call_tee)(struct smc_param *p);
+ void (*raw_call_tee)(struct smc_param *p);
+};
+
+
+#endif /* __TEE_CORE_DRV_H__ */
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_fp.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_fp.h
new file mode 100644
index 0000000..3522d56
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_fp.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_FP_H
+#define TEE_FP_H
+
+int tee_spi_cfg_padsel(uint32_t padsel);
+
+int tee_spi_transfer(void *conf, uint32_t conf_size, void *inbuf, void *outbuf,
+ uint32_t size);
+
+int tee_spi_transfer_disable(void);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_ioc.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_ioc.h
new file mode 100644
index 0000000..b3cd047f
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_ioc.h
@@ -0,0 +1,141 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef _TEE_IOC_H
+#define _TEE_IOC_H
+
+#include <linux/tee_client_api.h>
+
+#ifndef __KERNEL__
+#define __user
+#endif
+
+/**
+ * struct tee_cmd_io - The command sent to an open tee device.
+ * @err: Error code (as in Global Platform TEE Client API spec)
+ * @origin: Origin for the error code (also from spec).
+ * @cmd: The command to be executed in the trusted application.
+ * @uuid: The uuid for the trusted application.
+ * @data: The trusted application or memory block.
+ * @data_size: The size of the trusted application or memory block.
+ * @op: The cmd payload operation for the trusted application.
+ *
+ * This structure is mainly used in the Linux kernel for communication
+ * with the user space.
+ */
+struct tee_cmd_io {
+ TEEC_Result err;
+ uint32_t origin;
+ uint32_t cmd;
+ int fd_sess;
+ /*
+ * Here fd_sess is 32-bit variable. Since TEEC_Result also is defined as
+ * "uint32_t", this structure is aligned.
+ */
+ union {
+ struct TEEC_UUID __user *uuid;
+ uint64_t padding_uuid;
+ };
+ union {
+ void __user *data;
+ uint64_t padding_data;
+ };
+ union {
+ struct TEEC_Operation __user *op;
+ uint64_t padding_op;
+ };
+ uint32_t data_size;
+ /* use this field to represent
+ * whether there is a difference
+ * in abi
+ */
+ int32_t reserved;
+};
+
+struct tee_shm_io {
+ union {
+ void __user *buffer;
+ void *paddr;
+ uint64_t padding_buf;
+ };
+ uint32_t size;
+ uint32_t flags;
+ /*
+ * Here fd_shm is 32-bit. To be compliant with the convention of file
+ * descriptor definition, fd_shm is defined as "int" type other
+ * than "int32_t". Even though using "int32_t" is more obvious to
+ * indicate that we intend to keep this structure aligned.
+ */
+ int fd_shm;
+ uint32_t registered;
+};
+
+struct tee_ta_inst_desc {
+ union {
+ struct TEEC_UUID __user *uuid;
+ uint64_t pad1;
+ };
+ union {
+ void __user *ta_buf;
+ uint64_t pad2;
+ };
+ uint32_t ta_buf_size;
+ union {
+ uint32_t *resp_size;
+ uint64_t pad3;
+ };
+};
+
+struct tee_spta_inst_desc {
+ union {
+ void *ta_binary;
+ uint64_t padding_buf;
+ };
+ uint32_t ta_size;
+ union {
+ uint32_t *response_len;
+ uint64_t paddind_response_len;
+ };
+};
+
+#define TEE_OPEN_SESSION_IOC \
+ _IOWR('t', 161, struct tee_cmd_io)
+#define TEE_INVOKE_COMMAND_IOC \
+ _IOWR('t', 163, struct tee_cmd_io)
+#define TEE_REQUEST_CANCELLATION_IOC \
+ _IOWR('t', 164, struct tee_cmd_io)
+
+#define TEE_ALLOC_SHM_IOC \
+ _IOWR('t', 165, struct tee_shm_io)
+#define TEE_ALLOC_SHM_PERM_IOC \
+ _IOWR('t', 166, struct tee_shm_io)
+#define TEE_GET_FD_FOR_RPC_SHM_IOC \
+ _IOWR('t', 167, struct tee_shm_io)
+
+#define TEE_TUI_OPEN_SESSION_IOC \
+ _IOWR('t', 168, struct tee_cmd_io)
+#define TEE_TUI_CLOSE_SESSION_IOC \
+ _IOWR('t', 169, struct tee_cmd_io)
+#define TEE_TUI_NOTIFY_IOC \
+ _IOWR('t', 170, uint32_t)
+#define TEE_TUI_WAITCMD_IOC \
+ _IOWR('t', 171, uint32_t)
+
+#define TEE_INSTALL_TA_IOC \
+ _IOWR('t', 174, struct tee_spta_inst_desc)
+#define TEE_INSTALL_TA_RESP_IOC \
+ _IO('t', 175)
+#define TEE_DELETE_TA_IOC \
+ _IOWR('t', 176, struct TEEC_UUID)
+
+#define TEE_QUERY_DRV_FEATURE_IOC \
+ _IOR('t', 183, uint32_t)
+
+/* Command IDs */
+#define TEEC_TUI_CMD_NONE 0
+#define TEEC_TUI_CMD_START_ACTIVITY 1
+#define TEEC_TUI_CMD_STOP_ACTIVITY 2
+
+#endif /* _TEE_IOC_H */
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_kernel_api.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_kernel_api.h
new file mode 100644
index 0000000..be85672
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_kernel_api.h
@@ -0,0 +1,39 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef _TEE_KERNEL_API_H
+#define _TEE_KERNEL_API_H
+
+#include <linux/tee_client_api.h>
+
+TEEC_Result TEEC_InitializeContext(const char *name,
+ struct TEEC_Context *context);
+
+void TEEC_FinalizeContext(struct TEEC_Context *context);
+
+TEEC_Result TEEC_OpenSession(struct TEEC_Context *context,
+ struct TEEC_Session *session,
+ const struct TEEC_UUID *destination,
+ uint32_t connectionMethod,
+ const void *connectionData,
+ struct TEEC_Operation *operation,
+ uint32_t *returnOrigin);
+
+void TEEC_CloseSession(struct TEEC_Session *session);
+
+TEEC_Result TEEC_InvokeCommand(struct TEEC_Session *session,
+ uint32_t commandID,
+ struct TEEC_Operation *operation,
+ uint32_t *returnOrigin);
+
+TEEC_Result TEEC_RegisterSharedMemory(struct TEEC_Context *context,
+ struct TEEC_SharedMemory *sharedMem);
+
+TEEC_Result TEEC_AllocateSharedMemory(struct TEEC_Context *context,
+ struct TEEC_SharedMemory *sharedMem);
+
+void TEEC_ReleaseSharedMemory(struct TEEC_SharedMemory *sharedMemory);
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_kernel_lowlevel_api.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_kernel_lowlevel_api.h
new file mode 100644
index 0000000..53e2836
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_kernel_lowlevel_api.h
@@ -0,0 +1,47 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef _TEE_KERNEL_LOWLEVEL_API_H
+#define _TEE_KERNEL_LOWLEVEL_API_H
+
+#include <linux/arm-smccc.h>
+
+#ifdef CONFIG_ARM
+struct smc_param {
+ uint32_t a0;
+ uint32_t a1;
+ uint32_t a2;
+ uint32_t a3;
+ uint32_t a4;
+ uint32_t a5;
+ uint32_t a6;
+ uint32_t a7;
+};
+#endif
+
+#ifdef CONFIG_ARM64
+struct smc_param {
+ uint64_t a0;
+ uint64_t a1;
+ uint64_t a2;
+ uint64_t a3;
+ uint64_t a4;
+ uint64_t a5;
+ uint64_t a6;
+ uint64_t a7;
+};
+#endif
+
+#define tee_smc_call(p) do {\
+ struct arm_smccc_res res; \
+ arm_smccc_smc(p->a0, p->a1, p->a2, p->a3, \
+ p->a4, p->a5, p->a6, p->a7, &res); \
+ p->a0 = res.a0; \
+ p->a1 = res.a1; \
+ p->a2 = res.a2; \
+ p->a3 = res.a3; \
+ } while (0)
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_pm_sec_call.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_pm_sec_call.h
new file mode 100644
index 0000000..44a95f4
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_pm_sec_call.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_PM_SEC_CALL_H_
+#define TEE_PM_SEC_CALL_H_
+
+#ifdef CONFIG_ARM
+
+#define TKCORE_SET_NS_BOOT_ADDR (0xBF000103U)
+#define TKCORE_PREPARE_CPU_OFF (0xBF000104U)
+#define TKCORE_ERRATA_802022 (0xBF000105U)
+
+#define TKCORE_SET_WDT_KADDR (0xBF000300U)
+
+static void tee_pm_sec_call(u32 cmd, u32 p0, u32 p1, u32 p2)
+{
+ __asm__ __volatile__(
+ ".arch_extension sec\n"
+ "mov r0, %0\n"
+ "mov r1, %1\n"
+ "mov r2, %2\n"
+ "mov r3, %3\n"
+ "smc #0\n" :
+ : "r"(cmd), "r"(p0), "r"(p1), "r"(p2)
+ : "r0", "r1", "r2", "r3", "r4", "r5", "r6", "r7");
+}
+
+#endif
+
+#endif
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_rpmb.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_rpmb.h
new file mode 100644
index 0000000..025c62d
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/include/linux/tee_rpmb.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TEE_RPMB_H
+#define TEE_RPMB_H
+
+struct tkcore_rpmb_request {
+ uint16_t type;
+ uint16_t blk_cnt;
+ uint16_t addr;
+ uint8_t *data_frame;
+};
+
+#define TEE_RPMB_EMMC_CID_SIZE 16
+
+struct tee_rpmb_dev_info {
+ uint8_t cid[TEE_RPMB_EMMC_CID_SIZE];
+ uint8_t rpmb_size_mult;
+ uint8_t rel_wr_sec_c;
+ uint8_t ret_code;
+};
+
+int tkcore_emmc_rpmb_execute(struct tkcore_rpmb_request *req);
+
+#define TEE_RPMB_GET_DEV_INFO 0x10
+#define TEE_RPMB_PROGRAM_KEY 0x11
+#define TEE_RPMB_GET_WRITE_COUNTER 0x12
+#define TEE_RPMB_WRITE_DATA 0x13
+#define TEE_RPMB_READ_DATA 0x14
+#define TEE_RPMB_SWITCH_NORMAL 0x15
+
+#endif
+
diff --git a/src/kernel/linux/v4.19/drivers/tee/tkcore/version.h b/src/kernel/linux/v4.19/drivers/tee/tkcore/version.h
new file mode 100644
index 0000000..4f3a008
--- /dev/null
+++ b/src/kernel/linux/v4.19/drivers/tee/tkcore/version.h
@@ -0,0 +1,11 @@
+/* SPDX-License-Identifier: GPL-2.0
+ *
+ * Copyright (c) 2015-2019 TrustKernel Incorporated
+ */
+
+#ifndef TKCORE_VERSION_H
+#define TKCORE_VERSION_H
+
+static const char tkcore_nsdrv_version[] = "3.4p0\n";
+
+#endif