QCOMTEE needs to distinguish between object invocations arriving from kernel clients and user-space clients in order to correctly marshal UBUF parameters and decide whether certain operations should be permitted.
Introduce an enum tee_object_invoke_origin to allow clients to indicate the context of the TEE object invocation, and add a kernel_ctx flag to the QCOMTEE context so the TEE back-end can track it.
Reviewed-by: Sumit Garg sumit.garg@oss.qualcomm.com Signed-off-by: Harshal Dev harshal.dev@oss.qualcomm.com --- drivers/tee/qcomtee/call.c | 12 +++++++++--- drivers/tee/qcomtee/qcomtee_object.h | 8 ++++++-- drivers/tee/tee_core.c | 3 ++- include/linux/tee_core.h | 8 +++++++- 4 files changed, 24 insertions(+), 7 deletions(-)
diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c index 4a597eeaf174..3de54af45719 100644 --- a/drivers/tee/qcomtee/call.c +++ b/drivers/tee/qcomtee/call.c @@ -388,20 +388,26 @@ static int qcomtee_root_object_check(u32 op, struct tee_param *params, * @ctx: TEE context. * @arg: ioctl arguments. * @params: parameters for the object. + * @origin: origin of the object invocation (kernel or user-space). * * Return: On success, returns 0; on failure, returns < 0. */ static int qcomtee_object_invoke(struct tee_context *ctx, struct tee_ioctl_object_invoke_arg *arg, - struct tee_param *params) + struct tee_param *params, + enum tee_object_invoke_origin origin) { struct qcomtee_context_data *ctxdata = ctx->data; struct qcomtee_object *object; + bool kernel_ctx = false; int i, ret, result;
if (qcomtee_params_check(params, arg->num_params)) return -EINVAL;
+ if (origin == TEE_OBJECT_INVOKE_KERNEL) + kernel_ctx = true; + /* First, handle reserved operations: */ if (arg->op == QCOMTEE_MSG_OBJECT_OP_RELEASE) { del_qtee_object(arg->id, ctxdata); @@ -411,7 +417,7 @@ static int qcomtee_object_invoke(struct tee_context *ctx,
/* Otherwise, invoke a QTEE object: */ struct qcomtee_object_invoke_ctx *oic __free(kfree) = - qcomtee_object_invoke_ctx_alloc(ctx); + qcomtee_object_invoke_ctx_alloc(ctx, kernel_ctx); if (!oic) return -ENOMEM;
@@ -648,7 +654,7 @@ static void qcomtee_get_qtee_feature_list(struct tee_context *ctx, u32 id, int result;
struct qcomtee_object_invoke_ctx *oic __free(kfree) = - qcomtee_object_invoke_ctx_alloc(ctx); + qcomtee_object_invoke_ctx_alloc(ctx, true); if (!oic) return;
diff --git a/drivers/tee/qcomtee/qcomtee_object.h b/drivers/tee/qcomtee/qcomtee_object.h index d5de02dcef3b..5f40617361fc 100644 --- a/drivers/tee/qcomtee/qcomtee_object.h +++ b/drivers/tee/qcomtee/qcomtee_object.h @@ -147,6 +147,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args) * struct qcomtee_object_invoke_ctx - QTEE context for object invocation. * @ctx: TEE context for this invocation. * @flags: flags for the invocation context. + * @kernel_ctx: flag that indicates this context is owned by a kernel client. * @errno: error code for the invocation. * @object: current object invoked in this callback context. * @u: array of arguments for the current invocation (+1 for ending arg). @@ -159,6 +160,7 @@ static inline int qcomtee_args_len(struct qcomtee_arg *args) struct qcomtee_object_invoke_ctx { struct tee_context *ctx; unsigned long flags; + bool kernel_ctx; int errno;
struct qcomtee_object *object; @@ -173,13 +175,15 @@ struct qcomtee_object_invoke_ctx { };
static inline struct qcomtee_object_invoke_ctx * -qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx) +qcomtee_object_invoke_ctx_alloc(struct tee_context *ctx, bool kernel_ctx) { struct qcomtee_object_invoke_ctx *oic;
oic = kzalloc_obj(*oic); - if (oic) + if (oic) { oic->ctx = ctx; + oic->kernel_ctx = kernel_ctx; + } return oic; }
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 1aac50c7c1de..30901390149c 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -701,7 +701,8 @@ static int tee_ioctl_object_invoke(struct tee_context *ctx, goto out; }
- rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params); + rc = ctx->teedev->desc->ops->object_invoke_func(ctx, &arg, params, + TEE_OBJECT_INVOKE_USERSPACE); if (rc) goto out;
diff --git a/include/linux/tee_core.h b/include/linux/tee_core.h index f993d5118edd..bcb5418d6fdc 100644 --- a/include/linux/tee_core.h +++ b/include/linux/tee_core.h @@ -73,6 +73,11 @@ struct tee_device { struct tee_shm_pool *pool; };
+enum tee_object_invoke_origin { + TEE_OBJECT_INVOKE_USERSPACE, + TEE_OBJECT_INVOKE_KERNEL, +}; + /** * struct tee_driver_ops - driver operations vtable * @get_version: returns version of driver @@ -117,7 +122,8 @@ struct tee_driver_ops { struct tee_param *param); int (*object_invoke_func)(struct tee_context *ctx, struct tee_ioctl_object_invoke_arg *arg, - struct tee_param *param); + struct tee_param *param, + enum tee_object_invoke_origin origin); int (*cancel_req)(struct tee_context *ctx, u32 cancel_id, u32 session); int (*supp_recv)(struct tee_context *ctx, u32 *func, u32 *num_params, struct tee_param *param);