qseecom: Fix issues with failure to release client handle

There exists scenarios when qseecom_release is called,
the client handle type is incorrect; hence proper cleanup
is not done with regards to unloading app or cleaning up
memory allocated for the device handle.
This change addresses all cleanup issues related to qseecom
client in qseecom_release call by ensuring the handle type is
set correctly and cleanup is done properly based on client type.

Change-Id: I126aa431ce635ae98100b774e3d92b704635d199
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Validate the incoming length from user space

Check if there is no integer overflow before using req_len and
resp_len (received from user space). If an overflow is detected
then exit the operation.

Change-Id: I0459a6992bb3b280db42be63a275c55fa6105b1c
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Change __copy_from_user to copy_from_user

__copy_from_user does not do address check, so use
copy_from_user instead.

Change-Id: I575c0f3c44b55a521c0d42828988c518c0640a29
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Ensure incoming "app_name" does not corrupt the kernel stack

Printing a string with that does not have null terminated character,
would lead to overflow, as the print continues until it finds a null
terminated character.
Avoid this issue by explicitly assigning a string with null termination.

Change-Id: I9528db2ba046c514d829097d08c09540588bb1a2
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Check for invalid registration of secapp region

Check the validity of response result field returned by QSEE
when issuing a request to register the secure app region
information.

Change-Id: Idc5ee7cf3c0a25ca37f23ef9d1718fdb05af6533
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
qseecom: Add frequency scaling in send_service_cmd()

Addes DFAB and SFAB bus frequency scaling in qseecom send_service
command function. This is required for RPMB listener services

Change-Id: I7496dfafe1fa571de68b30529ee6db49c8200232
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom:  Validate inputs from user space

Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Change-Id: I381836d08aaa48357486fbdc6a122eb5b42bfa0b
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
qseecom: Add checks for API called in IOCTL

Validate the caller is the right type for the IOCTL being
issued and inputs are valid.

Change-Id: Iad71f0f5ed4d53c5d011bd55cdf74ec053d09af5
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Remove debug  messages

Remove unnecessary debug  messages.

Change-Id: Ida80fbc1376f15753f8329c44550b14d8f4de163
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom:  Check for case where listener service is not found

When listerner service is not in the list of registered listeners,
the resulting ptr will a NULL. Check for this case of NULL ptr
to indicate missing listener service.

Change-Id: I0d2c7b01143c40711f71bf434493ac5301314cf2
Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
qseecom: Copy userspace buffer into kernel space before dereferencing

ION memory is used for user space to kernel space data passing.
This is directly accessible in kernel. But, if the IOCTL is called
from user space without using User space library, then data might
be pointing to some other memory location, in which case, it would
not be possible to dereference this location in kernel & hence it
would be accessing invalid memory.

Change-Id: Ic50c76ee8b2a696dbb786fce3a68cdc782e15268
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
qseecom: Fix error handling path in receive_req()

This patch fixes the error handling path in receive_req() function
called from userspace. Issue seen if user is calling the receive_req
function without calling the listener registration. qseecom_find_svc()
should return NULL if there are no services found.

Change-Id: Id51d8f48d7266b5acbc845f7b9ac0068d16b1ede
CRs-fixed: 496927
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: Fix issues with qssecom_remove/exit APIs

Clean-up the qseecom_remove() function by removing the null pointer
dereference. Change the logic by removing the unnecessary code and
also modified the qseecom_exit() function with proper calls.

Change-Id: Ibcca1b3c2c37024661505de2550e202b507703aa
Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
qseecom: Check input buffer from IOCTL

IOCTL messages come with pointers to buffer, check these
buffer pointers prior to accessing it.

Change-Id: Ibd724a35682a6f8e4f6900c8404854a8b55c0c9a
Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>