xref: /optee_os/core/tee/tee_svc.c (revision b01047730e77127c23a36591643eeb8bb0487d68)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <kernel/tee_common_otp.h>
28 #include <kernel/tee_common.h>
29 #include <kernel/tee_compat.h>
30 #include <tee_api_types.h>
31 #include <kernel/tee_ta_manager.h>
32 #include <utee_types.h>
33 #include <tee/tee_svc.h>
34 #include <mm/tee_mmu.h>
35 #include <mm/tee_mm.h>
36 #include <kernel/tee_rpc.h>
37 #include <kernel/tee_rpc_types.h>
38 #include <kernel/tee_time.h>
39 
40 #include <user_ta_header.h>
41 #include <kernel/tee_core_trace.h>
42 #include <kernel/tee_kta_trace.h>
43 #include <kernel/chip_services.h>
44 #include <tee/tee_hash.h>
45 #include <tee_ltc_wrapper.h>
46 
47 
48 void tee_svc_sys_log(const void *buf, size_t len)
49 {
50 	char *kbuf;
51 
52 	if (len == 0)
53 		return;
54 
55 	kbuf = malloc(len);
56 	if (kbuf == NULL)
57 		return;
58 
59 	/* log as Info/Raw traces */
60 	if (tee_svc_copy_from_user(NULL, kbuf, buf, len) == TEE_SUCCESS)
61 		ATAMSG_RAW("%s", kbuf);
62 
63 	free(kbuf);
64 }
65 
66 void tee_svc_sys_panic(uint32_t code)
67 {
68 	struct tee_ta_session *sess;
69 
70 	if (tee_ta_get_current_session(&sess) == TEE_SUCCESS) {
71 		EMSG("Set session 0x%x to panicked", sess);
72 		sess->ctx->panicked = 1;
73 		sess->ctx->panic_code = code;
74 
75 		{
76 			/*
77 			 * Force panicking. This memory error will be trapped by
78 			 * the error exception handler myErrorHandler()
79 			 */
80 			EMSG("Following 'DTLB exception in bundle'");
81 			EMSG("   is generated with code %d", code);
82 			int *p = 0;
83 			*p = 1;
84 		}
85 	} else {
86 		DMSG("Panic called from unknown TA");
87 	}
88 }
89 
90 uint32_t tee_svc_sys_dummy(uint32_t *a)
91 {
92 	DMSG("tee_svc_sys_dummy: a 0x%x", (unsigned int)a);
93 	return 0;
94 }
95 
96 uint32_t tee_svc_sys_dummy_7args(uint32_t a1, uint32_t a2, uint32_t a3,
97 				 uint32_t a4, uint32_t a5, uint32_t a6,
98 				 uint32_t a7)
99 {
100 	DMSG("tee_svc_sys_dummy_7args: 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, %x, %x\n",
101 	     a1, a2, a3, a4, a5, a6, a7);
102 	return 0;
103 }
104 
105 uint32_t tee_svc_sys_nocall(void)
106 {
107 	DMSG("No syscall");
108 	return 0x1;
109 }
110 
111 TEE_Result tee_svc_sys_get_property(uint32_t prop, tee_uaddr_t buf, size_t blen)
112 {
113 	static const char api_vers[] = "1.0";
114 	static const char descr[] = "Version N.N";
115 	/*
116 	 * Value 100 means:
117 	 * System time based on REE-controlled timers. Can be tampered by the
118 	 * REE.  The implementation must still guarantee that the system time
119 	 * is monotonous, i.e., successive calls to TEE_GetSystemTime must
120 	 * return increasing values of the system time.
121 	 */
122 	static const uint32_t sys_time_prot_lvl = 100;
123 	static const uint32_t ta_time_prot_lvl = 100;
124 	struct tee_ta_session *sess;
125 	TEE_Result res;
126 
127 	res = tee_ta_get_current_session(&sess);
128 	if (res != TEE_SUCCESS)
129 		return res;
130 
131 	switch (prop) {
132 	case UTEE_PROP_TEE_API_VERSION:
133 		if (blen < sizeof(api_vers))
134 			return TEE_ERROR_SHORT_BUFFER;
135 		return tee_svc_copy_to_user(sess, (void *)buf, api_vers,
136 					    sizeof(api_vers));
137 
138 	case UTEE_PROP_TEE_DESCR:
139 		if (blen < sizeof(descr))
140 			return TEE_ERROR_SHORT_BUFFER;
141 		return tee_svc_copy_to_user(sess, (void *)buf, descr,
142 					    sizeof(descr));
143 
144 	case UTEE_PROP_TEE_DEV_ID:
145 		{
146 			TEE_UUID uuid;
147 			const size_t nslen = 4;
148 			uint8_t data[4 +
149 				     FVR_DIE_ID_NUM_REGS * sizeof(uint32_t)] = {
150 			    'S', 'T', 'E', 'E' };
151 
152 			if (blen < sizeof(uuid))
153 				return TEE_ERROR_SHORT_BUFFER;
154 
155 			if (tee_otp_get_die_id
156 					(data + nslen, sizeof(data) - nslen))
157 				return TEE_ERROR_BAD_STATE;
158 
159 			res = tee_hash_createdigest(
160 					TEE_ALG_SHA256,
161 					data, sizeof(data),
162 					(uint8_t *)&uuid, sizeof(uuid));
163 			if (res != TEE_SUCCESS)
164 				return TEE_ERROR_BAD_STATE;
165 
166 			/*
167 			 * Changes the random value into and UUID as specifiec
168 			 * in RFC 4122. The magic values are from the example
169 			 * code in the RFC.
170 			 *
171 			 * TEE_UUID is defined slightly different from the RFC,
172 			 * but close enough for our purpose.
173 			 */
174 
175 			uuid.timeHiAndVersion &= 0x0fff;
176 			uuid.timeHiAndVersion |= 5 << 12;
177 
178 			/* uuid.clock_seq_hi_and_reserved in the RFC */
179 			uuid.clockSeqAndNode[0] &= 0x3f;
180 			uuid.clockSeqAndNode[0] |= 0x80;
181 
182 			return tee_svc_copy_to_user(sess, (void *)buf, &uuid,
183 						    sizeof(TEE_UUID));
184 		}
185 
186 	case UTEE_PROP_TEE_SYS_TIME_PROT_LEVEL:
187 		if (blen < sizeof(sys_time_prot_lvl))
188 			return TEE_ERROR_SHORT_BUFFER;
189 		return tee_svc_copy_to_user(sess, (void *)buf,
190 					    &sys_time_prot_lvl,
191 					    sizeof(sys_time_prot_lvl));
192 
193 	case UTEE_PROP_TEE_TA_TIME_PROT_LEVEL:
194 		if (blen < sizeof(ta_time_prot_lvl))
195 			return TEE_ERROR_SHORT_BUFFER;
196 		return tee_svc_copy_to_user(sess, (void *)buf,
197 					    &ta_time_prot_lvl,
198 					    sizeof(ta_time_prot_lvl));
199 
200 	case UTEE_PROP_TEE_ARITH_MAX_BIG_INT_SIZE:
201 		{
202 			uint32_t v = LTC_MAX_BITS_PER_VARIABLE / 2;
203 
204 			if (blen < sizeof(v))
205 				return TEE_ERROR_SHORT_BUFFER;
206 
207 			return tee_svc_copy_to_user(sess, (void *)buf, &v,
208 						    sizeof(v));
209 		}
210 
211 	case UTEE_PROP_CLIENT_ID:
212 		{
213 			if (blen < sizeof(TEE_Identity))
214 				return TEE_ERROR_SHORT_BUFFER;
215 
216 			return tee_svc_copy_to_user(sess, (void *)buf,
217 						    &sess->clnt_id,
218 						    sizeof(TEE_Identity));
219 		}
220 	case UTEE_PROP_TA_APP_ID:
221 		{
222 			if (blen < sizeof(TEE_UUID))
223 				return TEE_ERROR_SHORT_BUFFER;
224 
225 			return tee_svc_copy_to_user(sess, (void *)buf,
226 						    &sess->ctx->head->uuid,
227 						    sizeof(TEE_UUID));
228 		}
229 
230 	default:
231 		break;
232 	}
233 	return TEE_ERROR_NOT_IMPLEMENTED;
234 }
235 
236 /*
237  * TA invokes some TA with parameter.
238  * If some parameters are memory references:
239  * - either the memref is inside TA private RAM: TA is not allowed to expose
240  *   its private RAM: use a temporary memory buffer and copy the data.
241  * - or the memref is not in the TA private RAM:
242  *   - if the memref was mapped to the TA, TA is allowed to expose it.
243  *   - if so, converts memref virtual address into a physical address.
244  */
245 static TEE_Result tee_svc_copy_param(struct tee_ta_session *sess,
246 				     struct tee_ta_session *called_sess,
247 				     uint32_t param_types,
248 				     TEE_Param params[TEE_NUM_PARAMS],
249 				     struct tee_ta_param *param,
250 				     tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
251 				     tee_mm_entry_t **mm)
252 {
253 	size_t n;
254 	TEE_Result res;
255 	size_t req_mem = 0;
256 	size_t s;
257 	uint8_t *dst = 0;
258 	tee_paddr_t dst_pa, src_pa = 0;
259 	bool ta_private_memref[TEE_NUM_PARAMS];
260 
261 	param->types = param_types;
262 	if (params == NULL) {
263 		if (param->types != 0)
264 			return TEE_ERROR_BAD_PARAMETERS;
265 		memset(param->params, 0, sizeof(param->params));
266 	} else {
267 		tee_svc_copy_from_user(sess, param->params, params,
268 				       sizeof(param->params));
269 	}
270 
271 	if ((called_sess != NULL) &&
272 		(called_sess->ctx->static_ta == NULL) &&
273 		(called_sess->ctx->flags & TA_FLAG_USER_MODE) == 0) {
274 		/*
275 		 * kernel TA, borrow the mapping of the calling
276 		 * during this call.
277 		 */
278 		called_sess->calling_sess = sess;
279 		return TEE_SUCCESS;
280 	}
281 
282 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
283 
284 		ta_private_memref[n] = false;
285 
286 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
287 		case TEE_PARAM_TYPE_MEMREF_INPUT:
288 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
289 		case TEE_PARAM_TYPE_MEMREF_INOUT:
290 			if (param->params[n].memref.buffer == NULL) {
291 				if (param->params[n].memref.size != 0)
292 					return TEE_ERROR_BAD_PARAMETERS;
293 				break;
294 			}
295 			/* uTA cannot expose its private memory */
296 			if (tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
297 				    (uintptr_t)param->params[n].memref.buffer,
298 				    param->params[n].memref.size)) {
299 
300 				s = TEE_ROUNDUP(param->params[n].memref.size,
301 						sizeof(uint32_t));
302 				/* Check overflow */
303 				if (req_mem + s < req_mem)
304 					return TEE_ERROR_BAD_PARAMETERS;
305 				req_mem += s;
306 				ta_private_memref[n] = true;
307 				break;
308 			}
309 			if (!tee_mmu_is_vbuf_outside_ta_private(sess->ctx,
310 				    (uintptr_t)param->params[n].memref.buffer,
311 				    param->params[n].memref.size))
312 				return TEE_ERROR_BAD_PARAMETERS;
313 
314 			if (tee_mmu_user_va2pa(sess->ctx,
315 					(void *)param->params[n].memref.buffer,
316 					(void **)&src_pa) != TEE_SUCCESS)
317 				return TEE_ERROR_BAD_PARAMETERS;
318 
319 			param->param_attr[n] = tee_mmu_user_get_cache_attr(
320 				sess->ctx,
321 				(void *)param->params[n].memref.buffer);
322 
323 			param->params[n].memref.buffer = (void *)src_pa;
324 			break;
325 
326 		default:
327 			break;
328 		}
329 	}
330 
331 	if (req_mem == 0)
332 		return TEE_SUCCESS;
333 
334 	/* Allocate section in secure DDR */
335 	*mm = tee_mm_alloc(&tee_mm_sec_ddr, req_mem);
336 	if (*mm == NULL) {
337 		DMSG("tee_mm_alloc TEE_ERROR_GENERIC");
338 		return TEE_ERROR_GENERIC;
339 	}
340 
341 	/* Get the virtual address for the section in secure DDR */
342 	res = tee_mmu_kmap(tee_mm_get_smem(*mm), req_mem, &dst);
343 	if (res != TEE_SUCCESS)
344 		return res;
345 	dst_pa = tee_mm_get_smem(*mm);
346 
347 	for (n = 0; n < 4; n++) {
348 
349 		if (ta_private_memref[n] == false)
350 			continue;
351 
352 		s = TEE_ROUNDUP(param->params[n].memref.size, sizeof(uint32_t));
353 
354 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
355 		case TEE_PARAM_TYPE_MEMREF_INPUT:
356 		case TEE_PARAM_TYPE_MEMREF_INOUT:
357 			if (param->params[n].memref.buffer != NULL) {
358 				res = tee_svc_copy_from_user(sess, dst,
359 							     param->params[n].
360 							     memref.buffer,
361 							     param->params[n].
362 							     memref.size);
363 				if (res != TEE_SUCCESS)
364 					return res;
365 
366 				param->param_attr[n] =
367 					tee_mmu_kmap_get_cache_attr(dst);
368 				param->params[n].memref.buffer = (void *)dst_pa;
369 				tmp_buf_pa[n] = dst_pa;
370 				dst += s;
371 				dst_pa += s;
372 			}
373 			break;
374 
375 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
376 			if (param->params[n].memref.buffer != NULL) {
377 				param->param_attr[n] =
378 					tee_mmu_kmap_get_cache_attr(dst);
379 				param->params[n].memref.buffer = (void *)dst_pa;
380 				tmp_buf_pa[n] = dst_pa;
381 				dst += s;
382 				dst_pa += s;
383 			}
384 			break;
385 
386 		default:
387 			continue;
388 		}
389 	}
390 
391 	tee_mmu_kunmap(dst, req_mem);
392 
393 	return TEE_SUCCESS;
394 }
395 
396 /*
397  * Back from execution of service: update parameters passed from TA:
398  * If some parameters were memory references:
399  * - either the memref was temporary: copy back data and update size
400  * - or it was the original TA memref: update only the size value.
401  */
402 static TEE_Result tee_svc_update_out_param(
403 		struct tee_ta_session *sess,
404 		struct tee_ta_session *called_sess,
405 		struct tee_ta_param *param,
406 		tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
407 		TEE_Param params[TEE_NUM_PARAMS])
408 {
409 	size_t n;
410 	bool have_private_mem_map = (called_sess == NULL) ||
411 		(called_sess->ctx->static_ta != NULL) ||
412 		((called_sess->ctx->flags & TA_FLAG_USER_MODE) != 0);
413 
414 	tee_ta_set_current_session(sess);
415 
416 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
417 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
418 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
419 		case TEE_PARAM_TYPE_MEMREF_INOUT:
420 
421 			/* outside TA private => memref is valid, update size */
422 			if (!tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
423 					(uintptr_t)params[n].memref.buffer,
424 					param->params[n].memref.size)) {
425 				params[n].memref.size =
426 					param->params[n].memref.size;
427 				break;
428 			}
429 
430 			/*
431 			 * If we called a kernel TA the parameters are in shared
432 			 * memory and no copy is needed.
433 			 */
434 			if (have_private_mem_map &&
435 			    param->params[n].memref.size <=
436 			    params[n].memref.size) {
437 				uint8_t *src = 0;
438 				TEE_Result res;
439 
440 				/* FIXME: TA_RAM is already mapped ! */
441 				res = tee_mmu_kmap(tmp_buf_pa[n],
442 					param->params[n].memref.size, &src);
443 				if (res != TEE_SUCCESS)
444 					return TEE_ERROR_GENERIC;
445 
446 				res = tee_svc_copy_to_user(sess,
447 							 params[n].memref.
448 							 buffer, src,
449 							 param->params[n].
450 							 memref.size);
451 				if (res != TEE_SUCCESS)
452 					return res;
453 				tee_mmu_kunmap(src,
454 					       param->params[n].memref.size);
455 
456 			}
457 			params[n].memref.size = param->params[n].memref.size;
458 			break;
459 
460 		case TEE_PARAM_TYPE_VALUE_OUTPUT:
461 		case TEE_PARAM_TYPE_VALUE_INOUT:
462 			params[n].value = param->params[n].value;
463 			break;
464 
465 		default:
466 			continue;
467 		}
468 	}
469 
470 	return TEE_SUCCESS;
471 }
472 
473 /* Called when a TA calls an OpenSession on another TA */
474 TEE_Result tee_svc_open_ta_session(const TEE_UUID *dest,
475 				   uint32_t cancel_req_to, uint32_t param_types,
476 				   TEE_Param params[4],
477 				   TEE_TASessionHandle *ta_sess,
478 				   uint32_t *ret_orig)
479 {
480 	TEE_Result res;
481 	uint32_t ret_o = TEE_ORIGIN_TEE;
482 	struct tee_ta_session *s = NULL;
483 	struct tee_ta_session *sess;
484 	tee_mm_entry_t *mm_param = NULL;
485 
486 	TEE_UUID *uuid = malloc(sizeof(TEE_UUID));
487 	struct tee_ta_param *param = malloc(sizeof(struct tee_ta_param));
488 	TEE_Identity *clnt_id = malloc(sizeof(TEE_Identity));
489 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
490 
491 	if (uuid == NULL || param == NULL || clnt_id == NULL) {
492 		res = TEE_ERROR_OUT_OF_MEMORY;
493 		goto out_free_only;
494 	}
495 
496 	memset(param, 0, sizeof(struct tee_ta_param));
497 
498 	res = tee_ta_get_current_session(&sess);
499 	if (res != TEE_SUCCESS)
500 		goto out_free_only;
501 
502 	res = tee_svc_copy_from_user(sess, uuid, dest, sizeof(TEE_UUID));
503 	if (res != TEE_SUCCESS)
504 		goto function_exit;
505 
506 	clnt_id->login = TEE_LOGIN_TRUSTED_APP;
507 	memcpy(&clnt_id->uuid, &sess->ctx->head->uuid, sizeof(TEE_UUID));
508 
509 	res = tee_svc_copy_param(sess, NULL, param_types, params, param,
510 				 tmp_buf_pa, &mm_param);
511 	if (res != TEE_SUCCESS)
512 		goto function_exit;
513 
514 	/*
515 	 * Find session of a multi session TA or a static TA
516 	 * In such a case, there is no need to ask the supplicant for the TA
517 	 * code
518 	 */
519 	res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions, uuid,
520 				  NULL, clnt_id, cancel_req_to, param);
521 
522 	if (ret_o != TEE_ORIGIN_TEE || res != TEE_ERROR_ITEM_NOT_FOUND)
523 		goto function_exit;
524 
525 	if (ret_o == TEE_ORIGIN_TEE && res == TEE_ERROR_ITEM_NOT_FOUND) {
526 		kta_signed_header_t *ta = NULL;
527 		struct tee_ta_nwumap lp;
528 
529 		tee_mmu_set_ctx(NULL);
530 
531 		/* Load TA */
532 		res = tee_ta_rpc_load(uuid, &ta, &lp, &ret_o);
533 		if (res != TEE_SUCCESS) {
534 			tee_mmu_set_ctx(sess->ctx);
535 			goto function_exit;
536 		}
537 
538 		res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions,
539 					  uuid, ta, clnt_id, cancel_req_to,
540 					  param);
541 		tee_mmu_set_ctx(sess->ctx);
542 		if (res != TEE_SUCCESS)
543 			goto function_exit;
544 
545 		s->ctx->nwumap = lp;
546 	}
547 
548 	res = tee_svc_update_out_param(sess, NULL, param, tmp_buf_pa, params);
549 	if (res != TEE_SUCCESS)
550 		goto function_exit;
551 
552 function_exit:
553 	tee_ta_set_current_session(sess);
554 
555 	if (mm_param != NULL) {
556 		TEE_Result res2;
557 		void *va = 0;
558 
559 		res2 =
560 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
561 		if (res2 == TEE_SUCCESS)
562 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
563 	}
564 	tee_mm_free(mm_param);
565 	tee_svc_copy_to_user(sess, ta_sess, &s, sizeof(s));
566 	tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
567 
568 out_free_only:
569 	free(param);
570 	free(uuid);
571 	free(clnt_id);
572 	return res;
573 }
574 
575 TEE_Result tee_svc_close_ta_session(TEE_TASessionHandle ta_sess)
576 {
577 	TEE_Result res;
578 	struct tee_ta_session *sess;
579 
580 	res = tee_ta_get_current_session(&sess);
581 	if (res != TEE_SUCCESS)
582 		return res;
583 
584 	tee_ta_set_current_session(NULL);
585 
586 	res =
587 	    tee_ta_close_session((uint32_t)ta_sess, &sess->ctx->open_sessions);
588 	tee_ta_set_current_session(sess);
589 	return res;
590 }
591 
592 TEE_Result tee_svc_invoke_ta_command(TEE_TASessionHandle ta_sess,
593 				     uint32_t cancel_req_to, uint32_t cmd_id,
594 				     uint32_t param_types, TEE_Param params[4],
595 				     uint32_t *ret_orig)
596 {
597 	TEE_Result res;
598 	uint32_t ret_o = TEE_ORIGIN_TEE;
599 	struct tee_ta_param param = { 0 };
600 	TEE_Identity clnt_id;
601 	struct tee_ta_session *sess;
602 	struct tee_ta_session *called_sess = (struct tee_ta_session *)ta_sess;
603 	tee_mm_entry_t *mm_param = NULL;
604 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
605 
606 	res = tee_ta_get_current_session(&sess);
607 	if (res != TEE_SUCCESS)
608 		return res;
609 
610 	res =
611 	    tee_ta_verify_session_pointer(called_sess,
612 					  &sess->ctx->open_sessions);
613 	if (res != TEE_SUCCESS)
614 		return res;
615 
616 	res = tee_svc_copy_param(sess, called_sess, param_types, params,
617 				 &param, tmp_buf_pa, &mm_param);
618 	if (res != TEE_SUCCESS)
619 		goto function_exit;
620 
621 	res =
622 	    tee_ta_invoke_command(&ret_o, called_sess, &clnt_id, cancel_req_to,
623 				  cmd_id, &param);
624 	if (res != TEE_SUCCESS)
625 		goto function_exit;
626 
627 	res = tee_svc_update_out_param(sess, called_sess, &param, tmp_buf_pa,
628 				       params);
629 	if (res != TEE_SUCCESS)
630 		goto function_exit;
631 
632 function_exit:
633 	tee_ta_set_current_session(sess);
634 	called_sess->calling_sess = NULL; /* clear eventual borrowed mapping */
635 
636 	if (mm_param != NULL) {
637 		TEE_Result res2;
638 		void *va = 0;
639 
640 		res2 =
641 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
642 		if (res2 == TEE_SUCCESS)
643 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
644 	}
645 	tee_mm_free(mm_param);
646 	if (ret_orig)
647 		tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
648 	return res;
649 }
650 
651 TEE_Result tee_svc_check_access_rights(uint32_t flags, const void *buf,
652 				       size_t len)
653 {
654 	TEE_Result res;
655 	struct tee_ta_session *s;
656 
657 	res = tee_ta_get_current_session(&s);
658 	if (res != TEE_SUCCESS)
659 		return res;
660 
661 	return tee_mmu_check_access_rights(s->ctx, flags, (tee_uaddr_t)buf,
662 					   len);
663 }
664 
665 TEE_Result tee_svc_copy_from_user(struct tee_ta_session *sess, void *kaddr,
666 				  const void *uaddr, size_t len)
667 {
668 	TEE_Result res;
669 	struct tee_ta_session *s;
670 
671 	if (sess == NULL) {
672 		res = tee_ta_get_current_session(&s);
673 		if (res != TEE_SUCCESS)
674 			return res;
675 	} else {
676 		s = sess;
677 		tee_ta_set_current_session(s);
678 	}
679 	res =
680 	    tee_mmu_check_access_rights(s->ctx,
681 					TEE_MEMORY_ACCESS_READ |
682 					TEE_MEMORY_ACCESS_ANY_OWNER,
683 					(tee_uaddr_t)uaddr, len);
684 	if (res != TEE_SUCCESS)
685 		return res;
686 
687 	memcpy(kaddr, uaddr, len);
688 	return TEE_SUCCESS;
689 }
690 
691 TEE_Result tee_svc_copy_to_user(struct tee_ta_session *sess, void *uaddr,
692 				const void *kaddr, size_t len)
693 {
694 	TEE_Result res;
695 	struct tee_ta_session *s;
696 
697 	if (sess == NULL) {
698 		res = tee_ta_get_current_session(&s);
699 		if (res != TEE_SUCCESS)
700 			return res;
701 	} else {
702 		s = sess;
703 		tee_ta_set_current_session(s);
704 	}
705 
706 	res =
707 	    tee_mmu_check_access_rights(s->ctx,
708 					TEE_MEMORY_ACCESS_WRITE |
709 					TEE_MEMORY_ACCESS_ANY_OWNER,
710 					(tee_uaddr_t)uaddr, len);
711 	if (res != TEE_SUCCESS)
712 		return res;
713 
714 	memcpy(uaddr, kaddr, len);
715 	return TEE_SUCCESS;
716 }
717 
718 static bool session_is_cancelled(struct tee_ta_session *s, TEE_Time *curr_time)
719 {
720 	TEE_Time current_time;
721 
722 	if (s->cancel_mask)
723 		return false;
724 
725 	if (s->cancel)
726 		return true;
727 
728 	if (s->cancel_time.seconds == UINT32_MAX)
729 		return false;
730 
731 	if (curr_time != NULL)
732 		current_time = *curr_time;
733 	else if (tee_time_get_sys_time(&current_time) != TEE_SUCCESS)
734 		return false;
735 
736 	if (current_time.seconds > s->cancel_time.seconds ||
737 	    (current_time.seconds == s->cancel_time.seconds &&
738 	     current_time.millis >= s->cancel_time.millis)) {
739 		return true;
740 	}
741 
742 	return false;
743 }
744 
745 TEE_Result tee_svc_get_cancellation_flag(bool *cancel)
746 {
747 	TEE_Result res;
748 	struct tee_ta_session *s = NULL;
749 	bool c;
750 
751 	res = tee_ta_get_current_session(&s);
752 	if (res != TEE_SUCCESS)
753 		return res;
754 
755 	c = session_is_cancelled(s, NULL);
756 
757 	return tee_svc_copy_to_user(s, cancel, &c, sizeof(c));
758 }
759 
760 TEE_Result tee_svc_unmask_cancellation(bool *old_mask)
761 {
762 	TEE_Result res;
763 	struct tee_ta_session *s = NULL;
764 	bool m;
765 
766 	res = tee_ta_get_current_session(&s);
767 	if (res != TEE_SUCCESS)
768 		return res;
769 
770 	m = s->cancel_mask;
771 	s->cancel_mask = false;
772 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
773 }
774 
775 TEE_Result tee_svc_mask_cancellation(bool *old_mask)
776 {
777 	TEE_Result res;
778 	struct tee_ta_session *s = NULL;
779 	bool m;
780 
781 	res = tee_ta_get_current_session(&s);
782 	if (res != TEE_SUCCESS)
783 		return res;
784 
785 	m = s->cancel_mask;
786 	s->cancel_mask = true;
787 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
788 }
789 
790 TEE_Result tee_svc_wait(uint32_t timeout)
791 {
792 	TEE_Result res = TEE_SUCCESS;
793 	uint32_t mytime = 0;
794 	struct tee_ta_session *s;
795 	TEE_Time base_time;
796 	TEE_Time current_time;
797 
798 	res = tee_ta_get_current_session(&s);
799 	if (res != TEE_SUCCESS)
800 		return res;
801 
802 	res = tee_time_get_sys_time(&base_time);
803 	if (res != TEE_SUCCESS)
804 		return res;
805 
806 	while (true) {
807 		res = tee_time_get_sys_time(&current_time);
808 		if (res != TEE_SUCCESS)
809 			return res;
810 
811 		if (session_is_cancelled(s, &current_time))
812 			return TEE_ERROR_CANCEL;
813 
814 		mytime = (current_time.seconds - base_time.seconds) * 1000 +
815 		    (int)current_time.millis - (int)base_time.millis;
816 		if (mytime >= timeout)
817 			return TEE_SUCCESS;
818 
819 		tee_wait_specific(timeout - mytime);
820 	}
821 
822 	return res;
823 }
824 
825 TEE_Result tee_svc_get_time(enum utee_time_category cat, TEE_Time *mytime)
826 {
827 	TEE_Result res, res2;
828 	struct tee_ta_session *s = NULL;
829 	TEE_Time t;
830 
831 	res = tee_ta_get_current_session(&s);
832 	if (res != TEE_SUCCESS)
833 		return res;
834 
835 	switch (cat) {
836 	case UTEE_TIME_CAT_SYSTEM:
837 		res = tee_time_get_sys_time(&t);
838 		break;
839 	case UTEE_TIME_CAT_TA_PERSISTENT:
840 		res =
841 		    tee_time_get_ta_time((const void *)&s->ctx->head->uuid, &t);
842 		break;
843 	case UTEE_TIME_CAT_REE:
844 		res = tee_time_get_ree_time(&t);
845 		break;
846 	default:
847 		res = TEE_ERROR_BAD_PARAMETERS;
848 		break;
849 	}
850 
851 	if (res == TEE_SUCCESS || res == TEE_ERROR_OVERFLOW) {
852 		res2 = tee_svc_copy_to_user(s, mytime, &t, sizeof(t));
853 		if (res2 != TEE_SUCCESS)
854 			res = res2;
855 	}
856 
857 	return res;
858 }
859 
860 TEE_Result tee_svc_set_ta_time(const TEE_Time *mytime)
861 {
862 	TEE_Result res;
863 	struct tee_ta_session *s = NULL;
864 	TEE_Time t;
865 
866 	res = tee_ta_get_current_session(&s);
867 	if (res != TEE_SUCCESS)
868 		return res;
869 
870 	res = tee_svc_copy_from_user(s, &t, mytime, sizeof(t));
871 	if (res != TEE_SUCCESS)
872 		return res;
873 
874 	return tee_time_set_ta_time((const void *)&s->ctx->head->uuid, &t);
875 }
876