tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF

For drivers that can transfer data to the TEE without using shared
memory from client, it is necessary to receive the user address
directly, bypassing any processing by the TEE subsystem. Introduce
TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT/OUTPUT/INOUT to represent
userspace buffers.

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Tested-by: Neil Armstrong <neil.armstrong@linaro.org>
Tested-by: Harshal Dev <quic_hdev@quicinc.com>
Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index 5a7fce5b6007809c84b281b5667ca6a9b12d9dba..529738565ebdac8c2d990375094079e7947e7275 100644 (file)
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -494,6 +494,17 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params,
                        params[n].u.value.b = ip.b;
                        params[n].u.value.c = ip.c;
                        break;
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT:
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
+                       params[n].u.ubuf.uaddr = u64_to_user_ptr(ip.a);
+                       params[n].u.ubuf.size = ip.b;
+
+                       if (!access_ok(params[n].u.ubuf.uaddr,
+                                      params[n].u.ubuf.size))
+                               return -EFAULT;
+
+                       break;
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
@@ -527,6 +538,11 @@ static int params_to_user(struct tee_ioctl_param __user *uparams,
                            put_user(p->u.value.c, &up->c))
                                return -EFAULT;
                        break;
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
+                       if (put_user((u64)p->u.ubuf.size, &up->b))
+                               return -EFAULT;
+                       break;
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
                        if (put_user((u64)p->u.memref.size, &up->b))
@@ -727,6 +743,13 @@ static int params_to_supp(struct tee_context *ctx,
                        ip.b = p->u.value.b;
                        ip.c = p->u.value.c;
                        break;
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT:
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
+                       ip.a = (__force unsigned long)p->u.ubuf.uaddr;
+                       ip.b = p->u.ubuf.size;
+                       ip.c = 0;
+                       break;
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
@@ -829,6 +852,16 @@ static int params_from_supp(struct tee_param *params, size_t num_params,
                        p->u.value.b = ip.b;
                        p->u.value.c = ip.c;
                        break;
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT:
+               case TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT:
+                       p->u.ubuf.uaddr = u64_to_user_ptr(ip.a);
+                       p->u.ubuf.size = ip.b;
+
+                       if (!access_ok(params[n].u.ubuf.uaddr,
+                                      params[n].u.ubuf.size))
+                               return -EFAULT;
+
+                       break;
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT:
                case TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT:
                        /*

diff --git a/include/linux/tee_drv.h b/include/linux/tee_drv.h
index 824f1251de60826db588c5dac418252f07b1cbb2..7915e8869cbd190304f3cf4a15733de438b89228 100644 (file)
--- a/include/linux/tee_drv.h
+++ b/include/linux/tee_drv.h
@@ -82,6 +82,11 @@ struct tee_param_memref {
        struct tee_shm *shm;
 };
 
+struct tee_param_ubuf {
+       void __user *uaddr;
+       size_t size;
+};
+
 struct tee_param_value {
        u64 a;
        u64 b;
@@ -92,6 +97,7 @@ struct tee_param {
        u64 attr;
        union {
                struct tee_param_memref memref;
+               struct tee_param_ubuf ubuf;
                struct tee_param_value value;
        } u;
 };

diff --git a/include/uapi/linux/tee.h b/include/uapi/linux/tee.h
index d843cf980d983d8705dbcba3d07d0040b1b3931d..0e3b735dcfca03e6fe245b93883972407e02dfd6 100644 (file)
--- a/include/uapi/linux/tee.h
+++ b/include/uapi/linux/tee.h
@@ -151,6 +151,13 @@ struct tee_ioctl_buf_data {
 #define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_OUTPUT        6
 #define TEE_IOCTL_PARAM_ATTR_TYPE_MEMREF_INOUT 7       /* input and output */
 
+/*
+ * These defines userspace buffer parameters.
+ */
+#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INPUT   8
+#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_OUTPUT  9
+#define TEE_IOCTL_PARAM_ATTR_TYPE_UBUF_INOUT   10      /* input and output */
+
 /*
  * Mask for the type part of the attribute, leaves room for more types
  */
@@ -186,14 +193,17 @@ struct tee_ioctl_buf_data {
 /**
  * struct tee_ioctl_param - parameter
  * @attr: attributes
- * @a: if a memref, offset into the shared memory object, else a value parameter
- * @b: if a memref, size of the buffer, else a value parameter
+ * @a: if a memref, offset into the shared memory object,
+ *     else if a ubuf, address of the user buffer,
+ *     else a value parameter
+ * @b: if a memref or ubuf, size of the buffer, else a value parameter
  * @c: if a memref, shared memory identifier, else a value parameter
  *
- * @attr & TEE_PARAM_ATTR_TYPE_MASK indicates if memref or value is used in
- * the union. TEE_PARAM_ATTR_TYPE_VALUE_* indicates value and
- * TEE_PARAM_ATTR_TYPE_MEMREF_* indicates memref. TEE_PARAM_ATTR_TYPE_NONE
- * indicates that none of the members are used.
+ * @attr & TEE_PARAM_ATTR_TYPE_MASK indicates if memref, ubuf, or value is
+ * used in the union. TEE_PARAM_ATTR_TYPE_VALUE_* indicates value,
+ * TEE_PARAM_ATTR_TYPE_MEMREF_* indicates memref, and TEE_PARAM_ATTR_TYPE_UBUF_*
+ * indicates ubuf. TEE_PARAM_ATTR_TYPE_NONE indicates that none of the members
+ * are used.
  *
  * Shared memory is allocated with TEE_IOC_SHM_ALLOC which returns an
  * identifier representing the shared memory object. A memref can reference