xref: /optee_os/core/tee/tee_svc.c (revision b5fed1a5386ffb7cc11a822043a7bc229b2fbbb0)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <util.h>
28 #include <kernel/tee_common_otp.h>
29 #include <kernel/tee_common.h>
30 #include <kernel/tee_compat.h>
31 #include <tee_api_types.h>
32 #include <kernel/tee_ta_manager.h>
33 #include <utee_types.h>
34 #include <tee/tee_svc.h>
35 #include <tee/tee_cryp_utl.h>
36 #include <mm/tee_mmu.h>
37 #include <mm/tee_mm.h>
38 #include <kernel/tee_rpc.h>
39 #include <kernel/tee_rpc_types.h>
40 #include <kernel/tee_time.h>
41 
42 #include <user_ta_header.h>
43 #include <trace.h>
44 #include <kernel/trace_ta.h>
45 #include <kernel/chip_services.h>
46 
47 #include <assert.h>
48 
49 vaddr_t tee_svc_uref_base;
50 
51 #if (TRACE_LEVEL == TRACE_FLOW) && defined(CFG_TEE_CORE_TA_TRACE)
52 void tee_svc_trace_syscall(int num)
53 {
54 	/* #0 is syscall return, not really interesting */
55 	if (num == 0)
56 		return;
57 	FMSG("syscall #%d", num);
58 }
59 #endif
60 
61 void syscall_log(const void *buf __unused, size_t len __unused)
62 {
63 #ifdef CFG_TEE_CORE_TA_TRACE
64 	char *kbuf;
65 
66 	if (len == 0)
67 		return;
68 
69 	kbuf = malloc(len);
70 	if (kbuf == NULL)
71 		return;
72 	*kbuf = '\0';
73 
74 	/* log as Info/Raw traces */
75 	if (tee_svc_copy_from_user(NULL, kbuf, buf, len) == TEE_SUCCESS)
76 		TAMSG_RAW("%.*s", (int)len, kbuf);
77 
78 	free(kbuf);
79 #endif
80 }
81 
82 TEE_Result syscall_reserved(void)
83 {
84 	return TEE_ERROR_GENERIC;
85 }
86 
87 TEE_Result syscall_not_supported(void)
88 {
89 	return TEE_ERROR_NOT_SUPPORTED;
90 }
91 
92 uint32_t syscall_dummy(uint32_t *a __unused)
93 {
94 	DMSG("tee_svc_sys_dummy: a 0x%" PRIxVA, (vaddr_t)a);
95 	return 0;
96 }
97 
98 uint32_t syscall_dummy_7args(unsigned long a1 __unused,
99 			unsigned long a2 __unused, unsigned long a3 __unused,
100 			unsigned long a4 __unused, unsigned long a5 __unused,
101 			unsigned long a6 __unused, unsigned long a7 __unused)
102 {
103 	DMSG("tee_svc_sys_dummy_7args: 0x%lx, 0x%lx, 0x%lx, 0x%lx, 0x%lx, %lx, %lx\n",
104 	     a1, a2, a3, a4, a5, a6, a7);
105 	return 0;
106 }
107 
108 uint32_t syscall_nocall(void)
109 {
110 	DMSG("No syscall");
111 	return 0x1;
112 }
113 
114 /* Configuration properties */
115 /* API implementation version */
116 static const char api_vers[] = TO_STR(CFG_TEE_API_VERSION);
117 
118 /* Implementation description (implementation-dependent) */
119 static const char descr[] = TO_STR(CFG_TEE_IMPL_DESCR);
120 
121 /*
122  * TA persistent time protection level
123  * 100: Persistent time based on an REE-controlled real-time clock
124  * and on the TEE Trusted Storage for the storage of origins (default).
125  * 1000: Persistent time based on a TEE-controlled real-time clock
126  * and the TEE Trusted Storage.
127  * The real-time clock MUST be out of reach of software attacks
128  * from the REE.
129  */
130 static const uint32_t ta_time_prot_lvl = 100;
131 
132 /* Elliptic Curve Cryptographic support (false by default) */
133 static const bool crypto_ecc_en;
134 
135 /*
136  * Trusted storage anti rollback protection level
137  * 0 (or missing): No antirollback protection (default)
138  * 100: Antirollback enforced at REE level
139  * 1000: Antirollback TEE-controlled hardware
140  */
141 static const uint32_t ts_antiroll_prot_lvl;
142 
143 /* Trusted OS implementation version */
144 static const char trustedos_impl_version[] = TO_STR(CFG_TEE_IMPL_VERSION);
145 
146 /* Trusted OS implementation version (binary value) */
147 static const uint32_t trustedos_impl_bin_version; /* 0 by default */
148 
149 /* Trusted OS implementation manufacturer name */
150 static const char trustedos_manufacturer[] = TO_STR(CFG_TEE_MANUFACTURER);
151 
152 /* Trusted firmware version */
153 static const char fw_impl_version[] = TO_STR(CFG_TEE_FW_IMPL_VERSION);
154 
155 /* Trusted firmware version (binary value) */
156 static const uint32_t fw_impl_bin_version; /* 0 by default */
157 
158 /* Trusted firmware manufacturer name */
159 static const char fw_manufacturer[] = TO_STR(CFG_TEE_FW_MANUFACTURER);
160 
161 struct tee_props {
162 	const void *data;
163 	const size_t len;
164 };
165 
166 /* Consistent with enum utee_property */
167 const struct tee_props tee_props_lut[] = {
168 	{api_vers, sizeof(api_vers)},
169 	{descr, sizeof(descr)},
170 	{0, 0}, /* dev_id */
171 	{0, 0}, /* system time protection level */
172 	{&ta_time_prot_lvl, sizeof(ta_time_prot_lvl)},
173 	{&crypto_ecc_en, sizeof(crypto_ecc_en)},
174 	{&ts_antiroll_prot_lvl, sizeof(ts_antiroll_prot_lvl)},
175 	{trustedos_impl_version, sizeof(trustedos_impl_version)},
176 	{&trustedos_impl_bin_version,
177 		sizeof(trustedos_impl_bin_version)},
178 	{trustedos_manufacturer, sizeof(trustedos_manufacturer)},
179 	{fw_impl_version, sizeof(fw_impl_version)},
180 	{&fw_impl_bin_version, sizeof(fw_impl_bin_version)},
181 	{fw_manufacturer, sizeof(fw_manufacturer)},
182 	{0, 0}, /* client_id */
183 	{0, 0}, /* ta_app_id */
184 };
185 
186 TEE_Result syscall_get_property(unsigned long prop, void *buf, size_t blen)
187 {
188 	struct tee_ta_session *sess;
189 	TEE_Result res;
190 
191 	if (prop > ARRAY_SIZE(tee_props_lut)-1)
192 		return TEE_ERROR_NOT_IMPLEMENTED;
193 
194 	res = tee_ta_get_current_session(&sess);
195 	if (res != TEE_SUCCESS)
196 		return res;
197 
198 	switch (prop) {
199 	case UTEE_PROP_TEE_DEV_ID:
200 		{
201 			TEE_UUID uuid;
202 			const size_t nslen = 5;
203 			uint8_t data[5 +
204 				     FVR_DIE_ID_NUM_REGS * sizeof(uint32_t)] = {
205 			    'O', 'P', 'T', 'E', 'E' };
206 
207 			if (blen < sizeof(uuid))
208 				return TEE_ERROR_SHORT_BUFFER;
209 
210 			if (tee_otp_get_die_id
211 					(data + nslen, sizeof(data) - nslen))
212 				return TEE_ERROR_BAD_STATE;
213 
214 			res = tee_hash_createdigest(TEE_ALG_SHA256, data,
215 						    sizeof(data),
216 						    (uint8_t *)&uuid,
217 						    sizeof(uuid));
218 			if (res != TEE_SUCCESS)
219 				return TEE_ERROR_BAD_STATE;
220 
221 			/*
222 			 * Changes the random value into and UUID as specifiec
223 			 * in RFC 4122. The magic values are from the example
224 			 * code in the RFC.
225 			 *
226 			 * TEE_UUID is defined slightly different from the RFC,
227 			 * but close enough for our purpose.
228 			 */
229 
230 			uuid.timeHiAndVersion &= 0x0fff;
231 			uuid.timeHiAndVersion |= 5 << 12;
232 
233 			/* uuid.clock_seq_hi_and_reserved in the RFC */
234 			uuid.clockSeqAndNode[0] &= 0x3f;
235 			uuid.clockSeqAndNode[0] |= 0x80;
236 
237 			return tee_svc_copy_to_user(sess, buf, &uuid,
238 						    sizeof(TEE_UUID));
239 		}
240 
241 	case UTEE_PROP_TEE_SYS_TIME_PROT_LEVEL:
242 		{
243 			uint32_t prot;
244 
245 			if (blen < sizeof(prot))
246 				return TEE_ERROR_SHORT_BUFFER;
247 			prot = tee_time_get_sys_time_protection_level();
248 			return tee_svc_copy_to_user(sess, (void *)buf,
249 						    &prot, sizeof(prot));
250 		}
251 
252 	case UTEE_PROP_CLIENT_ID:
253 		if (blen < sizeof(TEE_Identity))
254 			return TEE_ERROR_SHORT_BUFFER;
255 		return tee_svc_copy_to_user(sess, buf, &sess->clnt_id,
256 					    sizeof(TEE_Identity));
257 
258 	case UTEE_PROP_TA_APP_ID:
259 		if (blen < sizeof(TEE_UUID))
260 			return TEE_ERROR_SHORT_BUFFER;
261 		return tee_svc_copy_to_user(sess, buf, &sess->ctx->uuid,
262 					    sizeof(TEE_UUID));
263 	default:
264 		if (blen < tee_props_lut[prop].len)
265 			return TEE_ERROR_SHORT_BUFFER;
266 		return tee_svc_copy_to_user(sess, buf, tee_props_lut[prop].data,
267 					    tee_props_lut[prop].len);
268 	}
269 }
270 
271 static void utee_param_to_param(struct tee_ta_param *p, struct utee_params *up)
272 {
273 	size_t n;
274 	uint32_t types = up->types;
275 
276 	p->types = types;
277 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
278 		uintptr_t a = up->vals[n * 2];
279 		size_t b = up->vals[n * 2 + 1];
280 
281 		switch (TEE_PARAM_TYPE_GET(types, n)) {
282 		case TEE_PARAM_TYPE_MEMREF_INPUT:
283 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
284 		case TEE_PARAM_TYPE_MEMREF_INOUT:
285 			p->params[n].memref.buffer = (void *)a;
286 			p->params[n].memref.size = b;
287 			break;
288 		case TEE_PARAM_TYPE_VALUE_INPUT:
289 		case TEE_PARAM_TYPE_VALUE_INOUT:
290 			p->params[n].value.a = a;
291 			p->params[n].value.b = b;
292 			break;
293 		default:
294 			p->params[n].value.a = 0;
295 			p->params[n].value.b = 0;
296 			break;
297 		}
298 	}
299 }
300 
301 /*
302  * TA invokes some TA with parameter.
303  * If some parameters are memory references:
304  * - either the memref is inside TA private RAM: TA is not allowed to expose
305  *   its private RAM: use a temporary memory buffer and copy the data.
306  * - or the memref is not in the TA private RAM:
307  *   - if the memref was mapped to the TA, TA is allowed to expose it.
308  *   - if so, converts memref virtual address into a physical address.
309  */
310 static TEE_Result tee_svc_copy_param(struct tee_ta_session *sess,
311 				     struct tee_ta_session *called_sess,
312 				     struct utee_params *callee_params,
313 				     struct tee_ta_param *param,
314 				     tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
315 				     tee_mm_entry_t **mm)
316 {
317 	size_t n;
318 	TEE_Result res;
319 	size_t req_mem = 0;
320 	size_t s;
321 	uint8_t *dst = 0;
322 	tee_paddr_t dst_pa, src_pa = 0;
323 	bool ta_private_memref[TEE_NUM_PARAMS];
324 
325 	/* fill 'param' input struct with caller params description buffer */
326 	if (!callee_params) {
327 		memset(param, 0, sizeof(*param));
328 	} else {
329 		res = tee_mmu_check_access_rights(sess->ctx,
330 			TEE_MEMORY_ACCESS_READ | TEE_MEMORY_ACCESS_ANY_OWNER,
331 			(tee_uaddr_t)callee_params, sizeof(struct utee_params));
332 		if (res != TEE_SUCCESS)
333 			return res;
334 		utee_param_to_param(param, callee_params);
335 	}
336 
337 	if ((called_sess != NULL) &&
338 		(called_sess->ctx->static_ta == NULL) &&
339 		(called_sess->ctx->flags & TA_FLAG_USER_MODE) == 0) {
340 		/*
341 		 * kernel TA, borrow the mapping of the calling
342 		 * during this call.
343 		 */
344 		called_sess->calling_sess = sess;
345 		return TEE_SUCCESS;
346 	}
347 
348 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
349 
350 		ta_private_memref[n] = false;
351 
352 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
353 		case TEE_PARAM_TYPE_MEMREF_INPUT:
354 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
355 		case TEE_PARAM_TYPE_MEMREF_INOUT:
356 			if (param->params[n].memref.buffer == NULL) {
357 				if (param->params[n].memref.size != 0)
358 					return TEE_ERROR_BAD_PARAMETERS;
359 				break;
360 			}
361 			/* uTA cannot expose its private memory */
362 			if (tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
363 				    param->params[n].memref.buffer,
364 				    param->params[n].memref.size)) {
365 
366 				s = ROUNDUP(param->params[n].memref.size,
367 						sizeof(uint32_t));
368 				/* Check overflow */
369 				if (req_mem + s < req_mem)
370 					return TEE_ERROR_BAD_PARAMETERS;
371 				req_mem += s;
372 				ta_private_memref[n] = true;
373 				break;
374 			}
375 			if (tee_mmu_is_vbuf_intersect_ta_private(sess->ctx,
376 				    param->params[n].memref.buffer,
377 				    param->params[n].memref.size))
378 				return TEE_ERROR_BAD_PARAMETERS;
379 
380 			if (tee_mmu_user_va2pa(sess->ctx,
381 					(void *)param->params[n].memref.buffer,
382 					&src_pa) != TEE_SUCCESS)
383 				return TEE_ERROR_BAD_PARAMETERS;
384 
385 			param->param_attr[n] = tee_mmu_user_get_cache_attr(
386 				sess->ctx,
387 				(void *)param->params[n].memref.buffer);
388 
389 			param->params[n].memref.buffer = (void *)src_pa;
390 			break;
391 
392 		default:
393 			break;
394 		}
395 	}
396 
397 	if (req_mem == 0)
398 		return TEE_SUCCESS;
399 
400 	/* Allocate section in secure DDR */
401 	*mm = tee_mm_alloc(&tee_mm_sec_ddr, req_mem);
402 	if (*mm == NULL) {
403 		DMSG("tee_mm_alloc TEE_ERROR_GENERIC");
404 		return TEE_ERROR_GENERIC;
405 	}
406 
407 	/* Get the virtual address for the section in secure DDR */
408 	res = tee_mmu_kmap(tee_mm_get_smem(*mm), req_mem, &dst);
409 	if (res != TEE_SUCCESS)
410 		return res;
411 	dst_pa = tee_mm_get_smem(*mm);
412 
413 	for (n = 0; n < 4; n++) {
414 
415 		if (ta_private_memref[n] == false)
416 			continue;
417 
418 		s = ROUNDUP(param->params[n].memref.size, sizeof(uint32_t));
419 
420 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
421 		case TEE_PARAM_TYPE_MEMREF_INPUT:
422 		case TEE_PARAM_TYPE_MEMREF_INOUT:
423 			if (param->params[n].memref.buffer != NULL) {
424 				res = tee_svc_copy_from_user(sess, dst,
425 						param->params[n].memref.buffer,
426 						param->params[n].memref.size);
427 				if (res != TEE_SUCCESS)
428 					return res;
429 				param->param_attr[n] =
430 					tee_mmu_kmap_get_cache_attr(dst);
431 				param->params[n].memref.buffer = (void *)dst_pa;
432 				tmp_buf_pa[n] = dst_pa;
433 				dst += s;
434 				dst_pa += s;
435 			}
436 			break;
437 
438 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
439 			if (param->params[n].memref.buffer != NULL) {
440 				param->param_attr[n] =
441 					tee_mmu_kmap_get_cache_attr(dst);
442 				param->params[n].memref.buffer = (void *)dst_pa;
443 				tmp_buf_pa[n] = dst_pa;
444 				dst += s;
445 				dst_pa += s;
446 			}
447 			break;
448 
449 		default:
450 			continue;
451 		}
452 	}
453 
454 	tee_mmu_kunmap(dst, req_mem);
455 
456 	return TEE_SUCCESS;
457 }
458 
459 /*
460  * Back from execution of service: update parameters passed from TA:
461  * If some parameters were memory references:
462  * - either the memref was temporary: copy back data and update size
463  * - or it was the original TA memref: update only the size value.
464  */
465 static TEE_Result tee_svc_update_out_param(
466 		struct tee_ta_session *sess,
467 		struct tee_ta_session *called_sess,
468 		struct tee_ta_param *param,
469 		tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
470 		struct utee_params *usr_param)
471 {
472 	size_t n;
473 	void *p;
474 	bool have_private_mem_map = (called_sess == NULL) ||
475 		(called_sess->ctx->static_ta != NULL) ||
476 		((called_sess->ctx->flags & TA_FLAG_USER_MODE) != 0);
477 
478 
479 	tee_ta_set_current_session(sess);
480 
481 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
482 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
483 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
484 		case TEE_PARAM_TYPE_MEMREF_INOUT:
485 			p = (void *)(uintptr_t)usr_param->vals[n * 2];
486 
487 			/* outside TA private => memref is valid, update size */
488 			if (!tee_mmu_is_vbuf_inside_ta_private(sess->ctx, p,
489 					param->params[n].memref.size)) {
490 				usr_param->vals[n * 2 + 1] =
491 					param->params[n].memref.size;
492 				break;
493 			}
494 
495 			/*
496 			 * If we called a kernel TA the parameters are in shared
497 			 * memory and no copy is needed.
498 			 */
499 			if (have_private_mem_map &&
500 			    param->params[n].memref.size <=
501 			    usr_param->vals[n * 2 + 1]) {
502 				uint8_t *src = 0;
503 				TEE_Result res;
504 
505 				/* FIXME: TA_RAM is already mapped ! */
506 				res = tee_mmu_kmap(tmp_buf_pa[n],
507 					param->params[n].memref.size, &src);
508 				if (res != TEE_SUCCESS)
509 					return TEE_ERROR_GENERIC;
510 
511 				res = tee_svc_copy_to_user(sess, p, src,
512 						 param->params[n].memref.size);
513 				if (res != TEE_SUCCESS)
514 					return res;
515 				tee_mmu_kunmap(src,
516 					       param->params[n].memref.size);
517 
518 			}
519 			usr_param->vals[n * 2 + 1] =
520 				param->params[n].memref.size;
521 			break;
522 
523 		case TEE_PARAM_TYPE_VALUE_OUTPUT:
524 		case TEE_PARAM_TYPE_VALUE_INOUT:
525 			usr_param->vals[n * 2] = param->params[n].value.a;
526 			usr_param->vals[n * 2 + 1] = param->params[n].value.b;
527 			break;
528 
529 		default:
530 			continue;
531 		}
532 	}
533 
534 	return TEE_SUCCESS;
535 }
536 
537 /* Called when a TA calls an OpenSession on another TA */
538 TEE_Result syscall_open_ta_session(const TEE_UUID *dest,
539 			unsigned long cancel_req_to,
540 			struct utee_params *usr_param, uint32_t *ta_sess,
541 			uint32_t *ret_orig)
542 {
543 	TEE_Result res;
544 	uint32_t ret_o = TEE_ORIGIN_TEE;
545 	struct tee_ta_session *s = NULL;
546 	struct tee_ta_session *sess;
547 	tee_mm_entry_t *mm_param = NULL;
548 	TEE_UUID *uuid = malloc(sizeof(TEE_UUID));
549 	struct tee_ta_param *param = malloc(sizeof(struct tee_ta_param));
550 	TEE_Identity *clnt_id = malloc(sizeof(TEE_Identity));
551 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
552 
553 	if (uuid == NULL || param == NULL || clnt_id == NULL) {
554 		res = TEE_ERROR_OUT_OF_MEMORY;
555 		goto out_free_only;
556 	}
557 
558 	memset(param, 0, sizeof(struct tee_ta_param));
559 
560 	res = tee_ta_get_current_session(&sess);
561 	if (res != TEE_SUCCESS)
562 		goto out_free_only;
563 
564 	res = tee_svc_copy_from_user(sess, uuid, dest, sizeof(TEE_UUID));
565 	if (res != TEE_SUCCESS)
566 		goto function_exit;
567 
568 	clnt_id->login = TEE_LOGIN_TRUSTED_APP;
569 	memcpy(&clnt_id->uuid, &sess->ctx->uuid, sizeof(TEE_UUID));
570 
571 	res = tee_svc_copy_param(sess, NULL, usr_param, param, tmp_buf_pa,
572 				 &mm_param);
573 	if (res != TEE_SUCCESS)
574 		goto function_exit;
575 
576 	/*
577 	 * Find session of a multi session TA or a static TA
578 	 * In such a case, there is no need to ask the supplicant for the TA
579 	 * code
580 	 */
581 	res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions, uuid,
582 				  clnt_id, cancel_req_to, param);
583 	if (res != TEE_SUCCESS)
584 		goto function_exit;
585 
586 	res = tee_svc_update_out_param(sess, NULL, param, tmp_buf_pa,
587 				       usr_param);
588 
589 function_exit:
590 	tee_ta_set_current_session(sess);
591 
592 	if (mm_param != NULL) {
593 		TEE_Result res2;
594 		void *va = 0;
595 
596 		res2 =
597 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
598 		if (res2 == TEE_SUCCESS)
599 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
600 	}
601 	tee_mm_free(mm_param);
602 	if (res == TEE_SUCCESS)
603 		tee_svc_copy_kaddr_to_uref(sess, ta_sess, s);
604 	tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
605 
606 out_free_only:
607 	free(param);
608 	free(uuid);
609 	free(clnt_id);
610 	return res;
611 }
612 
613 TEE_Result syscall_close_ta_session(unsigned long ta_sess)
614 {
615 	TEE_Result res;
616 	struct tee_ta_session *sess;
617 	TEE_Identity clnt_id;
618 	struct tee_ta_session *s = tee_svc_uref_to_kaddr(ta_sess);
619 
620 	res = tee_ta_get_current_session(&sess);
621 	if (res != TEE_SUCCESS)
622 		return res;
623 
624 	clnt_id.login = TEE_LOGIN_TRUSTED_APP;
625 	memcpy(&clnt_id.uuid, &sess->ctx->uuid, sizeof(TEE_UUID));
626 
627 	tee_ta_set_current_session(NULL);
628 	res = tee_ta_close_session(s, &sess->ctx->open_sessions, &clnt_id);
629 	tee_ta_set_current_session(sess);
630 	return res;
631 }
632 
633 TEE_Result syscall_invoke_ta_command(unsigned long ta_sess,
634 			unsigned long cancel_req_to, unsigned long cmd_id,
635 			struct utee_params *usr_param, uint32_t *ret_orig)
636 {
637 	TEE_Result res;
638 	uint32_t ret_o = TEE_ORIGIN_TEE;
639 	struct tee_ta_param param = { 0 };
640 	TEE_Identity clnt_id;
641 	struct tee_ta_session *sess;
642 	struct tee_ta_session *called_sess;
643 	tee_mm_entry_t *mm_param = NULL;
644 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
645 
646 	res = tee_ta_get_current_session(&sess);
647 	if (res != TEE_SUCCESS)
648 		return res;
649 
650 	called_sess = tee_ta_get_session(
651 				(vaddr_t)tee_svc_uref_to_kaddr(ta_sess), true,
652 				&sess->ctx->open_sessions);
653 	if (!called_sess)
654 		return TEE_ERROR_BAD_PARAMETERS;
655 
656 	clnt_id.login = TEE_LOGIN_TRUSTED_APP;
657 	memcpy(&clnt_id.uuid, &sess->ctx->uuid, sizeof(TEE_UUID));
658 
659 	res = tee_svc_copy_param(sess, called_sess, usr_param, &param,
660 				 tmp_buf_pa, &mm_param);
661 	if (res != TEE_SUCCESS)
662 		goto function_exit;
663 
664 	res = tee_ta_invoke_command(&ret_o, called_sess, &clnt_id,
665 				    cancel_req_to, cmd_id, &param);
666 
667 	if (res != TEE_SUCCESS)
668 		goto function_exit;
669 
670 	res = tee_svc_update_out_param(sess, called_sess, &param, tmp_buf_pa,
671 				       usr_param);
672 	if (res != TEE_SUCCESS)
673 		goto function_exit;
674 
675 function_exit:
676 	tee_ta_set_current_session(sess);
677 	called_sess->calling_sess = NULL; /* clear eventual borrowed mapping */
678 	tee_ta_put_session(called_sess);
679 
680 	if (mm_param != NULL) {
681 		TEE_Result res2;
682 		void *va = 0;
683 
684 		res2 =
685 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
686 		if (res2 == TEE_SUCCESS)
687 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
688 	}
689 	tee_mm_free(mm_param);
690 	if (ret_orig)
691 		tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
692 	return res;
693 }
694 
695 TEE_Result syscall_check_access_rights(unsigned long flags, const void *buf,
696 				       size_t len)
697 {
698 	TEE_Result res;
699 	struct tee_ta_session *s;
700 
701 	res = tee_ta_get_current_session(&s);
702 	if (res != TEE_SUCCESS)
703 		return res;
704 
705 	return tee_mmu_check_access_rights(s->ctx, flags, (tee_uaddr_t)buf,
706 					   len);
707 }
708 
709 TEE_Result tee_svc_copy_from_user(struct tee_ta_session *sess, void *kaddr,
710 				  const void *uaddr, size_t len)
711 {
712 	TEE_Result res;
713 	struct tee_ta_session *s;
714 
715 	if (sess == NULL) {
716 		res = tee_ta_get_current_session(&s);
717 		if (res != TEE_SUCCESS)
718 			return res;
719 	} else {
720 		s = sess;
721 		tee_ta_set_current_session(s);
722 	}
723 	res =
724 	    tee_mmu_check_access_rights(s->ctx,
725 					TEE_MEMORY_ACCESS_READ |
726 					TEE_MEMORY_ACCESS_ANY_OWNER,
727 					(tee_uaddr_t)uaddr, len);
728 	if (res != TEE_SUCCESS)
729 		return res;
730 
731 	memcpy(kaddr, uaddr, len);
732 	return TEE_SUCCESS;
733 }
734 
735 TEE_Result tee_svc_copy_to_user(struct tee_ta_session *sess, void *uaddr,
736 				const void *kaddr, size_t len)
737 {
738 	TEE_Result res;
739 	struct tee_ta_session *s;
740 
741 	if (sess == NULL) {
742 		res = tee_ta_get_current_session(&s);
743 		if (res != TEE_SUCCESS)
744 			return res;
745 	} else {
746 		s = sess;
747 		tee_ta_set_current_session(s);
748 	}
749 
750 	res =
751 	    tee_mmu_check_access_rights(s->ctx,
752 					TEE_MEMORY_ACCESS_WRITE |
753 					TEE_MEMORY_ACCESS_ANY_OWNER,
754 					(tee_uaddr_t)uaddr, len);
755 	if (res != TEE_SUCCESS)
756 		return res;
757 
758 	memcpy(uaddr, kaddr, len);
759 	return TEE_SUCCESS;
760 }
761 
762 TEE_Result tee_svc_copy_kaddr_to_uref(struct tee_ta_session *sess,
763 			uint32_t *uref, void *kaddr)
764 {
765 	uint32_t ref = tee_svc_kaddr_to_uref(kaddr);
766 
767 	return tee_svc_copy_to_user(sess, uref, &ref, sizeof(ref));
768 }
769 
770 static bool session_is_cancelled(struct tee_ta_session *s, TEE_Time *curr_time)
771 {
772 	TEE_Time current_time;
773 
774 	if (s->cancel_mask)
775 		return false;
776 
777 	if (s->cancel)
778 		return true;
779 
780 	if (s->cancel_time.seconds == UINT32_MAX)
781 		return false;
782 
783 	if (curr_time != NULL)
784 		current_time = *curr_time;
785 	else if (tee_time_get_sys_time(&current_time) != TEE_SUCCESS)
786 		return false;
787 
788 	if (current_time.seconds > s->cancel_time.seconds ||
789 	    (current_time.seconds == s->cancel_time.seconds &&
790 	     current_time.millis >= s->cancel_time.millis)) {
791 		return true;
792 	}
793 
794 	return false;
795 }
796 
797 TEE_Result syscall_get_cancellation_flag(uint32_t *cancel)
798 {
799 	TEE_Result res;
800 	struct tee_ta_session *s = NULL;
801 	uint32_t c;
802 
803 	res = tee_ta_get_current_session(&s);
804 	if (res != TEE_SUCCESS)
805 		return res;
806 
807 	c = session_is_cancelled(s, NULL);
808 
809 	return tee_svc_copy_to_user(s, cancel, &c, sizeof(c));
810 }
811 
812 TEE_Result syscall_unmask_cancellation(uint32_t *old_mask)
813 {
814 	TEE_Result res;
815 	struct tee_ta_session *s = NULL;
816 	uint32_t m;
817 
818 	res = tee_ta_get_current_session(&s);
819 	if (res != TEE_SUCCESS)
820 		return res;
821 
822 	m = s->cancel_mask;
823 	s->cancel_mask = false;
824 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
825 }
826 
827 TEE_Result syscall_mask_cancellation(uint32_t *old_mask)
828 {
829 	TEE_Result res;
830 	struct tee_ta_session *s = NULL;
831 	uint32_t m;
832 
833 	res = tee_ta_get_current_session(&s);
834 	if (res != TEE_SUCCESS)
835 		return res;
836 
837 	m = s->cancel_mask;
838 	s->cancel_mask = true;
839 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
840 }
841 
842 TEE_Result syscall_wait(unsigned long timeout)
843 {
844 	TEE_Result res = TEE_SUCCESS;
845 	uint32_t mytime = 0;
846 	struct tee_ta_session *s;
847 	TEE_Time base_time;
848 	TEE_Time current_time;
849 
850 	res = tee_ta_get_current_session(&s);
851 	if (res != TEE_SUCCESS)
852 		return res;
853 
854 	res = tee_time_get_sys_time(&base_time);
855 	if (res != TEE_SUCCESS)
856 		return res;
857 
858 	while (true) {
859 		res = tee_time_get_sys_time(&current_time);
860 		if (res != TEE_SUCCESS)
861 			return res;
862 
863 		if (session_is_cancelled(s, &current_time))
864 			return TEE_ERROR_CANCEL;
865 
866 		mytime = (current_time.seconds - base_time.seconds) * 1000 +
867 		    (int)current_time.millis - (int)base_time.millis;
868 		if (mytime >= timeout)
869 			return TEE_SUCCESS;
870 
871 		tee_time_wait(timeout - mytime);
872 	}
873 
874 	return res;
875 }
876 
877 TEE_Result syscall_get_time(unsigned long cat, TEE_Time *mytime)
878 {
879 	TEE_Result res, res2;
880 	struct tee_ta_session *s = NULL;
881 	TEE_Time t;
882 
883 	res = tee_ta_get_current_session(&s);
884 	if (res != TEE_SUCCESS)
885 		return res;
886 
887 	switch (cat) {
888 	case UTEE_TIME_CAT_SYSTEM:
889 		res = tee_time_get_sys_time(&t);
890 		break;
891 	case UTEE_TIME_CAT_TA_PERSISTENT:
892 		res = tee_time_get_ta_time((const void *)&s->ctx->uuid, &t);
893 		break;
894 	case UTEE_TIME_CAT_REE:
895 		res = tee_time_get_ree_time(&t);
896 		break;
897 	default:
898 		res = TEE_ERROR_BAD_PARAMETERS;
899 		break;
900 	}
901 
902 	if (res == TEE_SUCCESS || res == TEE_ERROR_OVERFLOW) {
903 		res2 = tee_svc_copy_to_user(s, mytime, &t, sizeof(t));
904 		if (res2 != TEE_SUCCESS)
905 			res = res2;
906 	}
907 
908 	return res;
909 }
910 
911 TEE_Result syscall_set_ta_time(const TEE_Time *mytime)
912 {
913 	TEE_Result res;
914 	struct tee_ta_session *s = NULL;
915 	TEE_Time t;
916 
917 	res = tee_ta_get_current_session(&s);
918 	if (res != TEE_SUCCESS)
919 		return res;
920 
921 	res = tee_svc_copy_from_user(s, &t, mytime, sizeof(t));
922 	if (res != TEE_SUCCESS)
923 		return res;
924 
925 	return tee_time_set_ta_time((const void *)&s->ctx->uuid, &t);
926 }
927 
928 #ifdef CFG_CACHE_API
929 TEE_Result syscall_cache_operation(void *va, size_t len, unsigned long op)
930 {
931 	TEE_Result res;
932 	struct tee_ta_session *s = NULL;
933 
934 	res = tee_ta_get_current_session(&s);
935 	if (res != TEE_SUCCESS)
936 		return res;
937 
938 	if ((s->ctx->flags & TA_FLAG_CACHE_MAINTENANCE) == 0)
939 		return TEE_ERROR_NOT_SUPPORTED;
940 
941 	return tee_uta_cache_operation(s, op, va, len);
942 }
943 #endif
944