Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF
For drivers that can transfer data to the TEE without using shared
memory from client, it is necessary to receive the user address
directly, bypassing any processing by the TEE subsystem. Introduce
TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT/OUTPUT/INOUT to represent
userspace buffers.
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Harshal Dev <quic_hdev@quicinc.com>
Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
authored by
Amirreza Zarrabi
and committed by
Jens Wiklander
54a53e95
0cbaf65c
+55
-6
+33
drivers/tee/tee_core.c
+33
drivers/tee/tee_core.c
···
494
494
params[n].u.value.b = ip.b;
495
495
params[n].u.value.c = ip.c;
496
496
break;
497
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT:
498
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
499
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
500
+
params[n].u.ubuf.uaddr = u64_to_user_ptr(ip.a);
501
+
params[n].u.ubuf.size = ip.b;
502
+
503
+
if (!access_ok(params[n].u.ubuf.uaddr,
504
+
params[n].u.ubuf.size))
505
+
return -EFAULT;
506
+
507
+
break;
497
508
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
498
509
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
499
510
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
···
536
525
if (put_user(p->u.value.a, &up->a) ||
537
526
put_user(p->u.value.b, &up->b) ||
538
527
put_user(p->u.value.c, &up->c))
528
+
return -EFAULT;
529
+
break;
530
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
531
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
532
+
if (put_user((u64)p->u.ubuf.size, &up->b))
539
533
return -EFAULT;
540
534
break;
541
535
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
···
743
727
ip.b = p->u.value.b;
744
728
ip.c = p->u.value.c;
745
729
break;
730
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT:
731
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
732
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
733
+
ip.a = (__force unsigned long)p->u.ubuf.uaddr;
734
+
ip.b = p->u.ubuf.size;
735
+
ip.c = 0;
736
+
break;
746
737
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
747
738
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
748
739
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
···
851
828
p->u.value.a = ip.a;
852
829
p->u.value.b = ip.b;
853
830
p->u.value.c = ip.c;
831
+
break;
832
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
833
+
case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
834
+
p->u.ubuf.uaddr = u64_to_user_ptr(ip.a);
835
+
p->u.ubuf.size = ip.b;
836
+
837
+
if (!access_ok(params[n].u.ubuf.uaddr,
838
+
params[n].u.ubuf.size))
839
+
return -EFAULT;
840
+
854
841
break;
855
842
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
856
843
case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
+6
include/linux/tee_drv.h
+6
include/linux/tee_drv.h
···
82
82
struct tee_shm *shm;
83
83
};
84
84
85
+
struct tee_param_ubuf {
86
+
void __user *uaddr;
87
+
size_t size;
88
+
};
89
+
85
90
struct tee_param_value {
86
91
u64 a;
87
92
u64 b;
···
97
92
u64 attr;
98
93
union {
99
94
struct tee_param_memref memref;
95
+
struct tee_param_ubuf ubuf;
100
96
struct tee_param_value value;
101
97
} u;
102
98
};
+16
-6
include/uapi/linux/tee.h
+16
-6
include/uapi/linux/tee.h
···
152
152
#define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT 7 /* input and output */
153
153
154
154
/*
155
+
* These defines userspace buffer parameters.
156
+
*/
157
+
#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT 8
158
+
#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT 9
159
+
#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT 10 /* input and output */
160
+
161
+
/*
155
162
* Mask for the type part of the attribute, leaves room for more types
156
163
*/
157
164
#define TEE_IOCTL_PARAM_ATTR_TYPE_MASK 0xff
···
193
186
/**
194
187
* struct tee_ioctl_param - parameter
195
188
* @attr: attributes
196
-
* @a: if a memref, offset into the shared memory object, else a value parameter
197
-
* @b: if a memref, size of the buffer, else a value parameter
189
+
* @a: if a memref, offset into the shared memory object,
190
+
* else if a ubuf, address of the user buffer,
191
+
* else a value parameter
192
+
* @b: if a memref or ubuf, size of the buffer, else a value parameter
198
193
* @c: if a memref, shared memory identifier, else a value parameter
199
194
*
200
-
* @attr & TEE_PARAM_ATTR_TYPE_MASK indicates if memref or value is used in
201
-
* the union. TEE_PARAM_ATTR_TYPE_VALUE_* indicates value and
202
-
* TEE_PARAM_ATTR_TYPE_MEMREF_* indicates memref. TEE_PARAM_ATTR_TYPE_NONE
203
-
* indicates that none of the members are used.
195
+
* @attr & TEE_PARAM_ATTR_TYPE_MASK indicates if memref, ubuf, or value is
196
+
* used in the union. TEE_PARAM_ATTR_TYPE_VALUE_* indicates value,
197
+
* TEE_PARAM_ATTR_TYPE_MEMREF_* indicates memref, and TEE_PARAM_ATTR_TYPE_UBUF_*
198
+
* indicates ubuf. TEE_PARAM_ATTR_TYPE_NONE indicates that none of the members
199
+
* are used.
204
200
*
205
201
* Shared memory is allocated with TEE_IOC_SHM_ALLOC which returns an
206
202
* identifier representing the shared memory object. A memref can reference