qseecom: Add NULL pointer check in qseecom_ioctl

NULL pointer check is added to the qseecom driver in qseecom_ioctl,
which is required to validate the data pointer before executing any
other code from ioctl's.

Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Rename & unifiy some enum definitions.

Move the key management enum values into unified enum
Rename RPMB related enum definitions as per existing pattern.

Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Fix QSEECOM_IOCTL_UNLOAD_EXTERNAL_ELF_REQ kernel crash

Fixes the kernel crash occuring with IOCTL_UNLOAD_EXTERNAL_ELF_REQ
ioctl by adding unavailable client type to qseecom_client_handle_type
enum, which is required in the driver during qseecom_release().

Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Check for invalid registration of secapp region

Check the validity of response result field returned by QSEE
when issuing a request to register the secure app region
information.

Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Add frequency scaling in send_service_cmd()

Addes DFAB and SFAB bus frequency scaling in qseecom send_service
command function. This is required for RPMB listener services

Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Add new IOCTLs to support secure UI feature

User space sends the buffer to TZ to use it for secure UI features.
Buffer shall be protected based on the use case, two APIs are
introduced to support this feature.

- QSEECOM_IOCTL_SEND_MODFD_RESP: is called to modify the listener
response data with physical address replaced at a mentioned offset,
so as to be usable by TZ. Option to protect &/ unprotect the buffer
is provided from user space (based on use case).

- QSEECOM_IOCTL_UNPROTECT_BUF: is called to explicitly unprotect the
protected buffer (use case specific).

Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Validate inputs from user space

Validate send_cmd, send_modfd_cmd and send_mdfd_resp
input parameters: cmd and response pointers and buffer
lengths and offsets  issued to modify data.

Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Remove debug messages

Remove unnecessary debug  messages.

Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Check for case where listener service is not found

When listerner service is not in the list of registered listeners,
the resulting ptr will a NULL. Check for this case of NULL ptr
to indicate missing listener service.

Signed-off-by: Mona Hossain <mhossain@codeaurora.org>
Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Copy userspace buffer into kernel space before dereferencing

ION memory is used for user space to kernel space data passing.
This is directly accessible in kernel. But, if the IOCTL is called
from user space without using User space library, then data might
be pointing to some other memory location, in which case, it would
not be possible to dereference this location in kernel & hence it
would be accessing invalid memory.

Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Fix error handling path in receive_req()

This patch fixes the error handling path in receive_req() function
called from userspace. Issue seen if user is calling the receive_req
function without calling the listener registration. qseecom_find_svc()
should return NULL if there are no services found.

Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Fix issues with qssecom_remove/exit APIs

Clean-up the qseecom_remove() function by removing the null pointer
dereference. Change the logic by removing the unnecessary code and
also modified the qseecom_exit() function with proper calls.

Signed-off-by: AnilKumar Chimata <anilc@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Check input buffer from IOCTL

IOCTL messages come with pointers to buffer, check these
buffer pointers prior to accessing it.

Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Update and sync with CAF

Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: increase load app timer delay

double load app timer delay to 4000ms

Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Validate the pointer returned by ion_import_dma_buf

Do a "IS_ERR_OR_NULL" check for the return value of
ion_import_dma_buf.

Signed-off-by: Hariprasad Dhalinarasimha <hnamgund@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: update clock ref count when bus scaling timer is running

when there are multiple enable/dislable clock operations, ce clock
ref count is not updated correctly when the timer to disable clock
is running. Specifically, the ref count is not decreased when the
old operation is finished and then we reset clock for the new enable
clock. Thus, the ce clock is not disabled after all operation are
completed due to incorrect clk ref count. We make a change to
decrease clock reference count before reset timer, when the timer
is running, then clock is disabled when all ce clock operations
finish and the timer expires.

Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: change qseecom bus scaling timer operation

To ensure ce clock is not disabled before tz operation is completed,
we delete the old timer when tz side operation begins, and then add
a new timer after tz operation is completed.

Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Ensure CE clk is managed properly

Clk access ref count is not updated correctly when issuing a
request that requires enabling clk. this results in leaving the
clk on during regular operation resulting in failure of the
device to go into low power mode.

Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
qseecom: Validate pointer offset in qseecom_send_modfd_cmd

Validate cmd_req_buf pointer offset in qseecom_send_modfy_cmd, and
make sure cmd buffer address to be within shared bufffer.

Signed-off-by: Zhen Kong <zkong@codeaurora.org>
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>