xref: /optee_os/core/tee/tee_svc.c (revision 55d3ebe9dc959a77cbd8ef559b3be37215a04bb3)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <kernel/tee_common_otp.h>
28 #include <kernel/tee_common.h>
29 #include <kernel/tee_compat.h>
30 #include <tee_api_types.h>
31 #include <kernel/tee_ta_manager.h>
32 #include <utee_types.h>
33 #include <tee/tee_svc.h>
34 #include <mm/tee_mmu.h>
35 #include <mm/tee_mm.h>
36 #include <kernel/tee_rpc.h>
37 #include <kernel/tee_rpc_types.h>
38 #include <kernel/tee_time.h>
39 
40 #include <user_ta_header.h>
41 #include <kernel/tee_core_trace.h>
42 #include <kernel/tee_kta_trace.h>
43 #include <kernel/chip_services.h>
44 #include <tee/tee_hash.h>
45 
46 
47 void tee_svc_sys_log(const void *buf, size_t len)
48 {
49 	char *kbuf;
50 
51 	if (len == 0)
52 		return;
53 
54 	kbuf = malloc(len);
55 	if (kbuf == NULL)
56 		return;
57 	*kbuf = '\0';
58 
59 	/* log as Info/Raw traces */
60 	if (tee_svc_copy_from_user(NULL, kbuf, buf, len) == TEE_SUCCESS)
61 		ATAMSG_RAW("%s", kbuf);
62 
63 	free(kbuf);
64 }
65 
66 void tee_svc_sys_panic(uint32_t code)
67 {
68 	struct tee_ta_session *sess;
69 
70 	if (tee_ta_get_current_session(&sess) == TEE_SUCCESS) {
71 		EMSG("Set session 0x%x to panicked", sess);
72 		sess->ctx->panicked = 1;
73 		sess->ctx->panic_code = code;
74 
75 		{
76 			/*
77 			 * Force panicking. This memory error will be trapped by
78 			 * the error exception handler myErrorHandler()
79 			 */
80 			EMSG("Following 'DTLB exception in bundle'");
81 			EMSG("   is generated with code %d", code);
82 			int *p = 0;
83 			*p = 1;
84 		}
85 	} else {
86 		DMSG("Panic called from unknown TA");
87 	}
88 }
89 
90 uint32_t tee_svc_sys_dummy(uint32_t *a)
91 {
92 	DMSG("tee_svc_sys_dummy: a 0x%x", (unsigned int)a);
93 	return 0;
94 }
95 
96 uint32_t tee_svc_sys_dummy_7args(uint32_t a1, uint32_t a2, uint32_t a3,
97 				 uint32_t a4, uint32_t a5, uint32_t a6,
98 				 uint32_t a7)
99 {
100 	DMSG("tee_svc_sys_dummy_7args: 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, %x, %x\n",
101 	     a1, a2, a3, a4, a5, a6, a7);
102 	return 0;
103 }
104 
105 uint32_t tee_svc_sys_nocall(void)
106 {
107 	DMSG("No syscall");
108 	return 0x1;
109 }
110 
111 TEE_Result tee_svc_sys_get_property(uint32_t prop, tee_uaddr_t buf, size_t blen)
112 {
113 	static const char api_vers[] = "1.0";
114 	static const char descr[] = "Version N.N";
115 	/*
116 	 * Value 100 means:
117 	 * System time based on REE-controlled timers. Can be tampered by the
118 	 * REE.  The implementation must still guarantee that the system time
119 	 * is monotonous, i.e., successive calls to TEE_GetSystemTime must
120 	 * return increasing values of the system time.
121 	 */
122 	static const uint32_t sys_time_prot_lvl = 100;
123 	static const uint32_t ta_time_prot_lvl = 100;
124 	struct tee_ta_session *sess;
125 	TEE_Result res;
126 
127 	res = tee_ta_get_current_session(&sess);
128 	if (res != TEE_SUCCESS)
129 		return res;
130 
131 	switch (prop) {
132 	case UTEE_PROP_TEE_API_VERSION:
133 		if (blen < sizeof(api_vers))
134 			return TEE_ERROR_SHORT_BUFFER;
135 		return tee_svc_copy_to_user(sess, (void *)buf, api_vers,
136 					    sizeof(api_vers));
137 
138 	case UTEE_PROP_TEE_DESCR:
139 		if (blen < sizeof(descr))
140 			return TEE_ERROR_SHORT_BUFFER;
141 		return tee_svc_copy_to_user(sess, (void *)buf, descr,
142 					    sizeof(descr));
143 
144 	case UTEE_PROP_TEE_DEV_ID:
145 		{
146 			TEE_UUID uuid;
147 			const size_t nslen = 4;
148 			uint8_t data[4 +
149 				     FVR_DIE_ID_NUM_REGS * sizeof(uint32_t)] = {
150 			    'S', 'T', 'E', 'E' };
151 
152 			if (blen < sizeof(uuid))
153 				return TEE_ERROR_SHORT_BUFFER;
154 
155 			if (tee_otp_get_die_id
156 					(data + nslen, sizeof(data) - nslen))
157 				return TEE_ERROR_BAD_STATE;
158 
159 			res = tee_hash_createdigest(
160 					TEE_ALG_SHA256,
161 					data, sizeof(data),
162 					(uint8_t *)&uuid, sizeof(uuid));
163 			if (res != TEE_SUCCESS)
164 				return TEE_ERROR_BAD_STATE;
165 
166 			/*
167 			 * Changes the random value into and UUID as specifiec
168 			 * in RFC 4122. The magic values are from the example
169 			 * code in the RFC.
170 			 *
171 			 * TEE_UUID is defined slightly different from the RFC,
172 			 * but close enough for our purpose.
173 			 */
174 
175 			uuid.timeHiAndVersion &= 0x0fff;
176 			uuid.timeHiAndVersion |= 5 << 12;
177 
178 			/* uuid.clock_seq_hi_and_reserved in the RFC */
179 			uuid.clockSeqAndNode[0] &= 0x3f;
180 			uuid.clockSeqAndNode[0] |= 0x80;
181 
182 			return tee_svc_copy_to_user(sess, (void *)buf, &uuid,
183 						    sizeof(TEE_UUID));
184 		}
185 
186 	case UTEE_PROP_TEE_SYS_TIME_PROT_LEVEL:
187 		if (blen < sizeof(sys_time_prot_lvl))
188 			return TEE_ERROR_SHORT_BUFFER;
189 		return tee_svc_copy_to_user(sess, (void *)buf,
190 					    &sys_time_prot_lvl,
191 					    sizeof(sys_time_prot_lvl));
192 
193 	case UTEE_PROP_TEE_TA_TIME_PROT_LEVEL:
194 		if (blen < sizeof(ta_time_prot_lvl))
195 			return TEE_ERROR_SHORT_BUFFER;
196 		return tee_svc_copy_to_user(sess, (void *)buf,
197 					    &ta_time_prot_lvl,
198 					    sizeof(ta_time_prot_lvl));
199 
200 	case UTEE_PROP_CLIENT_ID:
201 		{
202 			if (blen < sizeof(TEE_Identity))
203 				return TEE_ERROR_SHORT_BUFFER;
204 
205 			return tee_svc_copy_to_user(sess, (void *)buf,
206 						    &sess->clnt_id,
207 						    sizeof(TEE_Identity));
208 		}
209 	case UTEE_PROP_TA_APP_ID:
210 		{
211 			if (blen < sizeof(TEE_UUID))
212 				return TEE_ERROR_SHORT_BUFFER;
213 
214 			return tee_svc_copy_to_user(sess, (void *)buf,
215 						    &sess->ctx->head->uuid,
216 						    sizeof(TEE_UUID));
217 		}
218 
219 	default:
220 		break;
221 	}
222 	return TEE_ERROR_NOT_IMPLEMENTED;
223 }
224 
225 /*
226  * TA invokes some TA with parameter.
227  * If some parameters are memory references:
228  * - either the memref is inside TA private RAM: TA is not allowed to expose
229  *   its private RAM: use a temporary memory buffer and copy the data.
230  * - or the memref is not in the TA private RAM:
231  *   - if the memref was mapped to the TA, TA is allowed to expose it.
232  *   - if so, converts memref virtual address into a physical address.
233  */
234 static TEE_Result tee_svc_copy_param(struct tee_ta_session *sess,
235 				     struct tee_ta_session *called_sess,
236 				     uint32_t param_types,
237 				     TEE_Param params[TEE_NUM_PARAMS],
238 				     struct tee_ta_param *param,
239 				     tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
240 				     tee_mm_entry_t **mm)
241 {
242 	size_t n;
243 	TEE_Result res;
244 	size_t req_mem = 0;
245 	size_t s;
246 	uint8_t *dst = 0;
247 	tee_paddr_t dst_pa, src_pa = 0;
248 	bool ta_private_memref[TEE_NUM_PARAMS];
249 
250 	param->types = param_types;
251 	if (params == NULL) {
252 		if (param->types != 0)
253 			return TEE_ERROR_BAD_PARAMETERS;
254 		memset(param->params, 0, sizeof(param->params));
255 	} else {
256 		tee_svc_copy_from_user(sess, param->params, params,
257 				       sizeof(param->params));
258 	}
259 
260 	if ((called_sess != NULL) &&
261 		(called_sess->ctx->static_ta == NULL) &&
262 		(called_sess->ctx->flags & TA_FLAG_USER_MODE) == 0) {
263 		/*
264 		 * kernel TA, borrow the mapping of the calling
265 		 * during this call.
266 		 */
267 		called_sess->calling_sess = sess;
268 		return TEE_SUCCESS;
269 	}
270 
271 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
272 
273 		ta_private_memref[n] = false;
274 
275 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
276 		case TEE_PARAM_TYPE_MEMREF_INPUT:
277 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
278 		case TEE_PARAM_TYPE_MEMREF_INOUT:
279 			if (param->params[n].memref.buffer == NULL) {
280 				if (param->params[n].memref.size != 0)
281 					return TEE_ERROR_BAD_PARAMETERS;
282 				break;
283 			}
284 			/* uTA cannot expose its private memory */
285 			if (tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
286 				    (uintptr_t)param->params[n].memref.buffer,
287 				    param->params[n].memref.size)) {
288 
289 				s = TEE_ROUNDUP(param->params[n].memref.size,
290 						sizeof(uint32_t));
291 				/* Check overflow */
292 				if (req_mem + s < req_mem)
293 					return TEE_ERROR_BAD_PARAMETERS;
294 				req_mem += s;
295 				ta_private_memref[n] = true;
296 				break;
297 			}
298 			if (!tee_mmu_is_vbuf_outside_ta_private(sess->ctx,
299 				    (uintptr_t)param->params[n].memref.buffer,
300 				    param->params[n].memref.size))
301 				return TEE_ERROR_BAD_PARAMETERS;
302 
303 			if (tee_mmu_user_va2pa(sess->ctx,
304 					(void *)param->params[n].memref.buffer,
305 					(void **)&src_pa) != TEE_SUCCESS)
306 				return TEE_ERROR_BAD_PARAMETERS;
307 
308 			param->param_attr[n] = tee_mmu_user_get_cache_attr(
309 				sess->ctx,
310 				(void *)param->params[n].memref.buffer);
311 
312 			param->params[n].memref.buffer = (void *)src_pa;
313 			break;
314 
315 		default:
316 			break;
317 		}
318 	}
319 
320 	if (req_mem == 0)
321 		return TEE_SUCCESS;
322 
323 	/* Allocate section in secure DDR */
324 	*mm = tee_mm_alloc(&tee_mm_sec_ddr, req_mem);
325 	if (*mm == NULL) {
326 		DMSG("tee_mm_alloc TEE_ERROR_GENERIC");
327 		return TEE_ERROR_GENERIC;
328 	}
329 
330 	/* Get the virtual address for the section in secure DDR */
331 	res = tee_mmu_kmap(tee_mm_get_smem(*mm), req_mem, &dst);
332 	if (res != TEE_SUCCESS)
333 		return res;
334 	dst_pa = tee_mm_get_smem(*mm);
335 
336 	for (n = 0; n < 4; n++) {
337 
338 		if (ta_private_memref[n] == false)
339 			continue;
340 
341 		s = TEE_ROUNDUP(param->params[n].memref.size, sizeof(uint32_t));
342 
343 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
344 		case TEE_PARAM_TYPE_MEMREF_INPUT:
345 		case TEE_PARAM_TYPE_MEMREF_INOUT:
346 			if (param->params[n].memref.buffer != NULL) {
347 				res = tee_svc_copy_from_user(sess, dst,
348 							     param->params[n].
349 							     memref.buffer,
350 							     param->params[n].
351 							     memref.size);
352 				if (res != TEE_SUCCESS)
353 					return res;
354 
355 				param->param_attr[n] =
356 					tee_mmu_kmap_get_cache_attr(dst);
357 				param->params[n].memref.buffer = (void *)dst_pa;
358 				tmp_buf_pa[n] = dst_pa;
359 				dst += s;
360 				dst_pa += s;
361 			}
362 			break;
363 
364 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
365 			if (param->params[n].memref.buffer != NULL) {
366 				param->param_attr[n] =
367 					tee_mmu_kmap_get_cache_attr(dst);
368 				param->params[n].memref.buffer = (void *)dst_pa;
369 				tmp_buf_pa[n] = dst_pa;
370 				dst += s;
371 				dst_pa += s;
372 			}
373 			break;
374 
375 		default:
376 			continue;
377 		}
378 	}
379 
380 	tee_mmu_kunmap(dst, req_mem);
381 
382 	return TEE_SUCCESS;
383 }
384 
385 /*
386  * Back from execution of service: update parameters passed from TA:
387  * If some parameters were memory references:
388  * - either the memref was temporary: copy back data and update size
389  * - or it was the original TA memref: update only the size value.
390  */
391 static TEE_Result tee_svc_update_out_param(
392 		struct tee_ta_session *sess,
393 		struct tee_ta_session *called_sess,
394 		struct tee_ta_param *param,
395 		tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
396 		TEE_Param params[TEE_NUM_PARAMS])
397 {
398 	size_t n;
399 	bool have_private_mem_map = (called_sess == NULL) ||
400 		(called_sess->ctx->static_ta != NULL) ||
401 		((called_sess->ctx->flags & TA_FLAG_USER_MODE) != 0);
402 
403 	tee_ta_set_current_session(sess);
404 
405 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
406 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
407 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
408 		case TEE_PARAM_TYPE_MEMREF_INOUT:
409 
410 			/* outside TA private => memref is valid, update size */
411 			if (!tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
412 					(uintptr_t)params[n].memref.buffer,
413 					param->params[n].memref.size)) {
414 				params[n].memref.size =
415 					param->params[n].memref.size;
416 				break;
417 			}
418 
419 			/*
420 			 * If we called a kernel TA the parameters are in shared
421 			 * memory and no copy is needed.
422 			 */
423 			if (have_private_mem_map &&
424 			    param->params[n].memref.size <=
425 			    params[n].memref.size) {
426 				uint8_t *src = 0;
427 				TEE_Result res;
428 
429 				/* FIXME: TA_RAM is already mapped ! */
430 				res = tee_mmu_kmap(tmp_buf_pa[n],
431 					param->params[n].memref.size, &src);
432 				if (res != TEE_SUCCESS)
433 					return TEE_ERROR_GENERIC;
434 
435 				res = tee_svc_copy_to_user(sess,
436 							 params[n].memref.
437 							 buffer, src,
438 							 param->params[n].
439 							 memref.size);
440 				if (res != TEE_SUCCESS)
441 					return res;
442 				tee_mmu_kunmap(src,
443 					       param->params[n].memref.size);
444 
445 			}
446 			params[n].memref.size = param->params[n].memref.size;
447 			break;
448 
449 		case TEE_PARAM_TYPE_VALUE_OUTPUT:
450 		case TEE_PARAM_TYPE_VALUE_INOUT:
451 			params[n].value = param->params[n].value;
452 			break;
453 
454 		default:
455 			continue;
456 		}
457 	}
458 
459 	return TEE_SUCCESS;
460 }
461 
462 /* Called when a TA calls an OpenSession on another TA */
463 TEE_Result tee_svc_open_ta_session(const TEE_UUID *dest,
464 				   uint32_t cancel_req_to, uint32_t param_types,
465 				   TEE_Param params[4],
466 				   TEE_TASessionHandle *ta_sess,
467 				   uint32_t *ret_orig)
468 {
469 	TEE_Result res;
470 	uint32_t ret_o = TEE_ORIGIN_TEE;
471 	struct tee_ta_session *s = NULL;
472 	struct tee_ta_session *sess;
473 	tee_mm_entry_t *mm_param = NULL;
474 
475 	TEE_UUID *uuid = malloc(sizeof(TEE_UUID));
476 	struct tee_ta_param *param = malloc(sizeof(struct tee_ta_param));
477 	TEE_Identity *clnt_id = malloc(sizeof(TEE_Identity));
478 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
479 
480 	if (uuid == NULL || param == NULL || clnt_id == NULL) {
481 		res = TEE_ERROR_OUT_OF_MEMORY;
482 		goto out_free_only;
483 	}
484 
485 	memset(param, 0, sizeof(struct tee_ta_param));
486 
487 	res = tee_ta_get_current_session(&sess);
488 	if (res != TEE_SUCCESS)
489 		goto out_free_only;
490 
491 	res = tee_svc_copy_from_user(sess, uuid, dest, sizeof(TEE_UUID));
492 	if (res != TEE_SUCCESS)
493 		goto function_exit;
494 
495 	clnt_id->login = TEE_LOGIN_TRUSTED_APP;
496 	memcpy(&clnt_id->uuid, &sess->ctx->head->uuid, sizeof(TEE_UUID));
497 
498 	res = tee_svc_copy_param(sess, NULL, param_types, params, param,
499 				 tmp_buf_pa, &mm_param);
500 	if (res != TEE_SUCCESS)
501 		goto function_exit;
502 
503 	/*
504 	 * Find session of a multi session TA or a static TA
505 	 * In such a case, there is no need to ask the supplicant for the TA
506 	 * code
507 	 */
508 	res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions, uuid,
509 				  clnt_id, cancel_req_to, param);
510 	if (res != TEE_SUCCESS)
511 		goto function_exit;
512 
513 	res = tee_svc_update_out_param(sess, NULL, param, tmp_buf_pa, params);
514 	if (res != TEE_SUCCESS)
515 		goto function_exit;
516 
517 function_exit:
518 	tee_ta_set_current_session(sess);
519 
520 	if (mm_param != NULL) {
521 		TEE_Result res2;
522 		void *va = 0;
523 
524 		res2 =
525 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
526 		if (res2 == TEE_SUCCESS)
527 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
528 	}
529 	tee_mm_free(mm_param);
530 	tee_svc_copy_to_user(sess, ta_sess, &s, sizeof(s));
531 	tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
532 
533 out_free_only:
534 	free(param);
535 	free(uuid);
536 	free(clnt_id);
537 	return res;
538 }
539 
540 TEE_Result tee_svc_close_ta_session(TEE_TASessionHandle ta_sess)
541 {
542 	TEE_Result res;
543 	struct tee_ta_session *sess;
544 
545 	res = tee_ta_get_current_session(&sess);
546 	if (res != TEE_SUCCESS)
547 		return res;
548 
549 	tee_ta_set_current_session(NULL);
550 
551 	res =
552 	    tee_ta_close_session((uint32_t)ta_sess, &sess->ctx->open_sessions);
553 	tee_ta_set_current_session(sess);
554 	return res;
555 }
556 
557 TEE_Result tee_svc_invoke_ta_command(TEE_TASessionHandle ta_sess,
558 				     uint32_t cancel_req_to, uint32_t cmd_id,
559 				     uint32_t param_types, TEE_Param params[4],
560 				     uint32_t *ret_orig)
561 {
562 	TEE_Result res;
563 	uint32_t ret_o = TEE_ORIGIN_TEE;
564 	struct tee_ta_param param = { 0 };
565 	TEE_Identity clnt_id;
566 	struct tee_ta_session *sess;
567 	struct tee_ta_session *called_sess = (struct tee_ta_session *)ta_sess;
568 	tee_mm_entry_t *mm_param = NULL;
569 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
570 
571 	res = tee_ta_get_current_session(&sess);
572 	if (res != TEE_SUCCESS)
573 		return res;
574 
575 	res =
576 	    tee_ta_verify_session_pointer(called_sess,
577 					  &sess->ctx->open_sessions);
578 	if (res != TEE_SUCCESS)
579 		return res;
580 
581 	res = tee_svc_copy_param(sess, called_sess, param_types, params,
582 				 &param, tmp_buf_pa, &mm_param);
583 	if (res != TEE_SUCCESS)
584 		goto function_exit;
585 
586 	res =
587 	    tee_ta_invoke_command(&ret_o, called_sess, &clnt_id, cancel_req_to,
588 				  cmd_id, &param);
589 	if (res != TEE_SUCCESS)
590 		goto function_exit;
591 
592 	res = tee_svc_update_out_param(sess, called_sess, &param, tmp_buf_pa,
593 				       params);
594 	if (res != TEE_SUCCESS)
595 		goto function_exit;
596 
597 function_exit:
598 	tee_ta_set_current_session(sess);
599 	called_sess->calling_sess = NULL; /* clear eventual borrowed mapping */
600 
601 	if (mm_param != NULL) {
602 		TEE_Result res2;
603 		void *va = 0;
604 
605 		res2 =
606 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
607 		if (res2 == TEE_SUCCESS)
608 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
609 	}
610 	tee_mm_free(mm_param);
611 	if (ret_orig)
612 		tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
613 	return res;
614 }
615 
616 TEE_Result tee_svc_check_access_rights(uint32_t flags, const void *buf,
617 				       size_t len)
618 {
619 	TEE_Result res;
620 	struct tee_ta_session *s;
621 
622 	res = tee_ta_get_current_session(&s);
623 	if (res != TEE_SUCCESS)
624 		return res;
625 
626 	return tee_mmu_check_access_rights(s->ctx, flags, (tee_uaddr_t)buf,
627 					   len);
628 }
629 
630 TEE_Result tee_svc_copy_from_user(struct tee_ta_session *sess, void *kaddr,
631 				  const void *uaddr, size_t len)
632 {
633 	TEE_Result res;
634 	struct tee_ta_session *s;
635 
636 	if (sess == NULL) {
637 		res = tee_ta_get_current_session(&s);
638 		if (res != TEE_SUCCESS)
639 			return res;
640 	} else {
641 		s = sess;
642 		tee_ta_set_current_session(s);
643 	}
644 	res =
645 	    tee_mmu_check_access_rights(s->ctx,
646 					TEE_MEMORY_ACCESS_READ |
647 					TEE_MEMORY_ACCESS_ANY_OWNER,
648 					(tee_uaddr_t)uaddr, len);
649 	if (res != TEE_SUCCESS)
650 		return res;
651 
652 	memcpy(kaddr, uaddr, len);
653 	return TEE_SUCCESS;
654 }
655 
656 TEE_Result tee_svc_copy_to_user(struct tee_ta_session *sess, void *uaddr,
657 				const void *kaddr, size_t len)
658 {
659 	TEE_Result res;
660 	struct tee_ta_session *s;
661 
662 	if (sess == NULL) {
663 		res = tee_ta_get_current_session(&s);
664 		if (res != TEE_SUCCESS)
665 			return res;
666 	} else {
667 		s = sess;
668 		tee_ta_set_current_session(s);
669 	}
670 
671 	res =
672 	    tee_mmu_check_access_rights(s->ctx,
673 					TEE_MEMORY_ACCESS_WRITE |
674 					TEE_MEMORY_ACCESS_ANY_OWNER,
675 					(tee_uaddr_t)uaddr, len);
676 	if (res != TEE_SUCCESS)
677 		return res;
678 
679 	memcpy(uaddr, kaddr, len);
680 	return TEE_SUCCESS;
681 }
682 
683 static bool session_is_cancelled(struct tee_ta_session *s, TEE_Time *curr_time)
684 {
685 	TEE_Time current_time;
686 
687 	if (s->cancel_mask)
688 		return false;
689 
690 	if (s->cancel)
691 		return true;
692 
693 	if (s->cancel_time.seconds == UINT32_MAX)
694 		return false;
695 
696 	if (curr_time != NULL)
697 		current_time = *curr_time;
698 	else if (tee_time_get_sys_time(&current_time) != TEE_SUCCESS)
699 		return false;
700 
701 	if (current_time.seconds > s->cancel_time.seconds ||
702 	    (current_time.seconds == s->cancel_time.seconds &&
703 	     current_time.millis >= s->cancel_time.millis)) {
704 		return true;
705 	}
706 
707 	return false;
708 }
709 
710 TEE_Result tee_svc_get_cancellation_flag(bool *cancel)
711 {
712 	TEE_Result res;
713 	struct tee_ta_session *s = NULL;
714 	bool c;
715 
716 	res = tee_ta_get_current_session(&s);
717 	if (res != TEE_SUCCESS)
718 		return res;
719 
720 	c = session_is_cancelled(s, NULL);
721 
722 	return tee_svc_copy_to_user(s, cancel, &c, sizeof(c));
723 }
724 
725 TEE_Result tee_svc_unmask_cancellation(bool *old_mask)
726 {
727 	TEE_Result res;
728 	struct tee_ta_session *s = NULL;
729 	bool m;
730 
731 	res = tee_ta_get_current_session(&s);
732 	if (res != TEE_SUCCESS)
733 		return res;
734 
735 	m = s->cancel_mask;
736 	s->cancel_mask = false;
737 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
738 }
739 
740 TEE_Result tee_svc_mask_cancellation(bool *old_mask)
741 {
742 	TEE_Result res;
743 	struct tee_ta_session *s = NULL;
744 	bool m;
745 
746 	res = tee_ta_get_current_session(&s);
747 	if (res != TEE_SUCCESS)
748 		return res;
749 
750 	m = s->cancel_mask;
751 	s->cancel_mask = true;
752 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
753 }
754 
755 TEE_Result tee_svc_wait(uint32_t timeout)
756 {
757 	TEE_Result res = TEE_SUCCESS;
758 	uint32_t mytime = 0;
759 	struct tee_ta_session *s;
760 	TEE_Time base_time;
761 	TEE_Time current_time;
762 
763 	res = tee_ta_get_current_session(&s);
764 	if (res != TEE_SUCCESS)
765 		return res;
766 
767 	res = tee_time_get_sys_time(&base_time);
768 	if (res != TEE_SUCCESS)
769 		return res;
770 
771 	while (true) {
772 		res = tee_time_get_sys_time(&current_time);
773 		if (res != TEE_SUCCESS)
774 			return res;
775 
776 		if (session_is_cancelled(s, &current_time))
777 			return TEE_ERROR_CANCEL;
778 
779 		mytime = (current_time.seconds - base_time.seconds) * 1000 +
780 		    (int)current_time.millis - (int)base_time.millis;
781 		if (mytime >= timeout)
782 			return TEE_SUCCESS;
783 
784 		tee_wait_specific(timeout - mytime);
785 	}
786 
787 	return res;
788 }
789 
790 TEE_Result tee_svc_get_time(enum utee_time_category cat, TEE_Time *mytime)
791 {
792 	TEE_Result res, res2;
793 	struct tee_ta_session *s = NULL;
794 	TEE_Time t;
795 
796 	res = tee_ta_get_current_session(&s);
797 	if (res != TEE_SUCCESS)
798 		return res;
799 
800 	switch (cat) {
801 	case UTEE_TIME_CAT_SYSTEM:
802 		res = tee_time_get_sys_time(&t);
803 		break;
804 	case UTEE_TIME_CAT_TA_PERSISTENT:
805 		res =
806 		    tee_time_get_ta_time((const void *)&s->ctx->head->uuid, &t);
807 		break;
808 	case UTEE_TIME_CAT_REE:
809 		res = tee_time_get_ree_time(&t);
810 		break;
811 	default:
812 		res = TEE_ERROR_BAD_PARAMETERS;
813 		break;
814 	}
815 
816 	if (res == TEE_SUCCESS || res == TEE_ERROR_OVERFLOW) {
817 		res2 = tee_svc_copy_to_user(s, mytime, &t, sizeof(t));
818 		if (res2 != TEE_SUCCESS)
819 			res = res2;
820 	}
821 
822 	return res;
823 }
824 
825 TEE_Result tee_svc_set_ta_time(const TEE_Time *mytime)
826 {
827 	TEE_Result res;
828 	struct tee_ta_session *s = NULL;
829 	TEE_Time t;
830 
831 	res = tee_ta_get_current_session(&s);
832 	if (res != TEE_SUCCESS)
833 		return res;
834 
835 	res = tee_svc_copy_from_user(s, &t, mytime, sizeof(t));
836 	if (res != TEE_SUCCESS)
837 		return res;
838 
839 	return tee_time_set_ta_time((const void *)&s->ctx->head->uuid, &t);
840 }
841