Skip to content

Commit 4f76d0c

Browse files
committed
tz: Fix handling of RPC parameters to supplicant
Also, drop unused and obsolete TEE_RPC_FREE_TA_WITH_FD. Tested on HiKey with 64-bit kernel and both 32-bit and 64-bit TEE Core. Signed-off-by: Jerome Forissier <[email protected]> Reviewed-by: Pascal Brand <[email protected]> Reviewed-by: Jens Wiklander <[email protected]>
1 parent eb40f63 commit 4f76d0c

File tree

2 files changed

+10
-8
lines changed

2 files changed

+10
-8
lines changed

armtz/tee_tz_drv.c

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -189,18 +189,20 @@ static void handle_rpc_func_cmd_to_supplicant(struct tee_tz *ptee,
189189
inv.res = TEEC_ERROR_NOT_IMPLEMENTED;
190190
inv.nbr_bf = arg32->num_params;
191191
for (n = 0; n < arg32->num_params; n++) {
192-
inv.cmds[n].buffer =
193-
(void *)(uintptr_t)params[n].u.memref.buf_ptr;
194-
inv.cmds[n].size = params[n].u.memref.size;
195192
switch (params[n].attr & TEESMC_ATTR_TYPE_MASK) {
196193
case TEESMC_ATTR_TYPE_VALUE_INPUT:
197-
case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
198194
case TEESMC_ATTR_TYPE_VALUE_INOUT:
195+
inv.cmds[n].fd = (int)params[n].u.value.a;
196+
/* Fall through */
197+
case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
199198
inv.cmds[n].type = TEE_RPC_VALUE;
200199
break;
201200
case TEESMC_ATTR_TYPE_MEMREF_INPUT:
202201
case TEESMC_ATTR_TYPE_MEMREF_OUTPUT:
203202
case TEESMC_ATTR_TYPE_MEMREF_INOUT:
203+
inv.cmds[n].buffer =
204+
(void *)(uintptr_t)params[n].u.memref.buf_ptr;
205+
inv.cmds[n].size = params[n].u.memref.size;
204206
inv.cmds[n].type = TEE_RPC_BUFFER;
205207
break;
206208
default:
@@ -216,9 +218,6 @@ static void handle_rpc_func_cmd_to_supplicant(struct tee_tz *ptee,
216218

217219
for (n = 0; n < arg32->num_params; n++) {
218220
switch (params[n].attr & TEESMC_ATTR_TYPE_MASK) {
219-
case TEESMC_ATTR_TYPE_VALUE_INPUT:
220-
case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
221-
case TEESMC_ATTR_TYPE_VALUE_INOUT:
222221
case TEESMC_ATTR_TYPE_MEMREF_OUTPUT:
223222
case TEESMC_ATTR_TYPE_MEMREF_INOUT:
224223
/*
@@ -231,6 +230,10 @@ static void handle_rpc_func_cmd_to_supplicant(struct tee_tz *ptee,
231230
(uint32_t)(uintptr_t)inv.cmds[n].buffer;
232231
params[n].u.memref.size = inv.cmds[n].size;
233232
break;
233+
case TEESMC_ATTR_TYPE_VALUE_OUTPUT:
234+
case TEESMC_ATTR_TYPE_VALUE_INOUT:
235+
params[n].u.value.a = inv.cmds[n].fd;
236+
break;
234237
default:
235238
break;
236239
}

core/tee_supp_com.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828
#define TEE_RPC_BUFFER 0x00000001
2929
#define TEE_RPC_VALUE 0x00000002
3030
#define TEE_RPC_LOAD_TA 0x10000001
31-
#define TEE_RPC_FREE_TA_WITH_FD 0x10000012
3231
/*
3332
* Handled within the driver only
3433
* Keep aligned with optee_os (secure space)

0 commit comments

Comments
 (0)