xref: /optee_os/core/tee/tee_svc.c (revision c84d070c6a123fa9f1dec3d23ec2c837b4ee3fca)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <util.h>
28 #include <kernel/tee_common_otp.h>
29 #include <kernel/tee_common.h>
30 #include <kernel/tee_compat.h>
31 #include <tee_api_types.h>
32 #include <kernel/tee_ta_manager.h>
33 #include <utee_types.h>
34 #include <tee/tee_svc.h>
35 #include <tee/tee_cryp_utl.h>
36 #include <mm/tee_mmu.h>
37 #include <mm/tee_mm.h>
38 #include <kernel/tee_rpc.h>
39 #include <kernel/tee_rpc_types.h>
40 #include <kernel/tee_time.h>
41 
42 #include <user_ta_header.h>
43 #include <trace.h>
44 #include <kernel/trace_ta.h>
45 #include <kernel/chip_services.h>
46 
47 #if (CFG_TRACE_LEVEL == TRACE_FLOW)
48 void tee_svc_trace_syscall(int num)
49 {
50 	/* #0 is syscall return, not really interesting */
51 	if (num == 0)
52 		return;
53 	FMSG("syscall #%d", num);
54 }
55 #endif
56 
57 void tee_svc_sys_log(const void *buf, size_t len)
58 {
59 	char *kbuf;
60 
61 	if (len == 0)
62 		return;
63 
64 	kbuf = malloc(len);
65 	if (kbuf == NULL)
66 		return;
67 	*kbuf = '\0';
68 
69 	/* log as Info/Raw traces */
70 	if (tee_svc_copy_from_user(NULL, kbuf, buf, len) == TEE_SUCCESS)
71 		TAMSG_RAW("%.*s", (int)len, kbuf);
72 
73 	free(kbuf);
74 }
75 
76 TEE_Result tee_svc_reserved(void)
77 {
78 	return TEE_ERROR_GENERIC;
79 }
80 
81 TEE_Result tee_svc_not_supported(void)
82 {
83 	return TEE_ERROR_NOT_SUPPORTED;
84 }
85 
86 uint32_t tee_svc_sys_dummy(uint32_t *a __unused)
87 {
88 	DMSG("tee_svc_sys_dummy: a 0x%x", (unsigned int)a);
89 	return 0;
90 }
91 
92 uint32_t tee_svc_sys_dummy_7args(uint32_t a1 __unused, uint32_t a2 __unused,
93 				uint32_t a3 __unused, uint32_t a4 __unused,
94 				uint32_t a5 __unused, uint32_t a6 __unused,
95 				uint32_t a7 __unused)
96 {
97 	DMSG("tee_svc_sys_dummy_7args: 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, %x, %x\n",
98 	     a1, a2, a3, a4, a5, a6, a7);
99 	return 0;
100 }
101 
102 uint32_t tee_svc_sys_nocall(void)
103 {
104 	DMSG("No syscall");
105 	return 0x1;
106 }
107 
108 TEE_Result tee_svc_sys_get_property(uint32_t prop, tee_uaddr_t buf, size_t blen)
109 {
110 	static const char api_vers[] = "1.0";
111 	static const char descr[] = "Version N.N";
112 	/*
113 	 * Value 100 means:
114 	 * System time based on REE-controlled timers. Can be tampered by the
115 	 * REE.  The implementation must still guarantee that the system time
116 	 * is monotonous, i.e., successive calls to TEE_GetSystemTime must
117 	 * return increasing values of the system time.
118 	 */
119 	static const uint32_t sys_time_prot_lvl = 100;
120 	static const uint32_t ta_time_prot_lvl = 100;
121 	struct tee_ta_session *sess;
122 	TEE_Result res;
123 
124 	res = tee_ta_get_current_session(&sess);
125 	if (res != TEE_SUCCESS)
126 		return res;
127 
128 	switch (prop) {
129 	case UTEE_PROP_TEE_API_VERSION:
130 		if (blen < sizeof(api_vers))
131 			return TEE_ERROR_SHORT_BUFFER;
132 		return tee_svc_copy_to_user(sess, (void *)buf, api_vers,
133 					    sizeof(api_vers));
134 
135 	case UTEE_PROP_TEE_DESCR:
136 		if (blen < sizeof(descr))
137 			return TEE_ERROR_SHORT_BUFFER;
138 		return tee_svc_copy_to_user(sess, (void *)buf, descr,
139 					    sizeof(descr));
140 
141 	case UTEE_PROP_TEE_DEV_ID:
142 		{
143 			TEE_UUID uuid;
144 			const size_t nslen = 4;
145 			uint8_t data[4 +
146 				     FVR_DIE_ID_NUM_REGS * sizeof(uint32_t)] = {
147 			    'S', 'T', 'E', 'E' };
148 
149 			if (blen < sizeof(uuid))
150 				return TEE_ERROR_SHORT_BUFFER;
151 
152 			if (tee_otp_get_die_id
153 					(data + nslen, sizeof(data) - nslen))
154 				return TEE_ERROR_BAD_STATE;
155 
156 			res = tee_hash_createdigest(TEE_ALG_SHA256, data,
157 						    sizeof(data),
158 						    (uint8_t *)&uuid,
159 						    sizeof(uuid));
160 			if (res != TEE_SUCCESS)
161 				return TEE_ERROR_BAD_STATE;
162 
163 			/*
164 			 * Changes the random value into and UUID as specifiec
165 			 * in RFC 4122. The magic values are from the example
166 			 * code in the RFC.
167 			 *
168 			 * TEE_UUID is defined slightly different from the RFC,
169 			 * but close enough for our purpose.
170 			 */
171 
172 			uuid.timeHiAndVersion &= 0x0fff;
173 			uuid.timeHiAndVersion |= 5 << 12;
174 
175 			/* uuid.clock_seq_hi_and_reserved in the RFC */
176 			uuid.clockSeqAndNode[0] &= 0x3f;
177 			uuid.clockSeqAndNode[0] |= 0x80;
178 
179 			return tee_svc_copy_to_user(sess, (void *)buf, &uuid,
180 						    sizeof(TEE_UUID));
181 		}
182 
183 	case UTEE_PROP_TEE_SYS_TIME_PROT_LEVEL:
184 		if (blen < sizeof(sys_time_prot_lvl))
185 			return TEE_ERROR_SHORT_BUFFER;
186 		return tee_svc_copy_to_user(sess, (void *)buf,
187 					    &sys_time_prot_lvl,
188 					    sizeof(sys_time_prot_lvl));
189 
190 	case UTEE_PROP_TEE_TA_TIME_PROT_LEVEL:
191 		if (blen < sizeof(ta_time_prot_lvl))
192 			return TEE_ERROR_SHORT_BUFFER;
193 		return tee_svc_copy_to_user(sess, (void *)buf,
194 					    &ta_time_prot_lvl,
195 					    sizeof(ta_time_prot_lvl));
196 
197 	case UTEE_PROP_CLIENT_ID:
198 		if (blen < sizeof(TEE_Identity))
199 			return TEE_ERROR_SHORT_BUFFER;
200 
201 		return tee_svc_copy_to_user(sess, (void *)buf,
202 			&sess->clnt_id, sizeof(TEE_Identity));
203 
204 	case UTEE_PROP_TA_APP_ID:
205 		if (blen < sizeof(TEE_UUID))
206 			return TEE_ERROR_SHORT_BUFFER;
207 
208 		return tee_svc_copy_to_user(sess, (void *)buf,
209 			&sess->ctx->head->uuid, sizeof(TEE_UUID));
210 
211 	default:
212 		break;
213 	}
214 	return TEE_ERROR_NOT_IMPLEMENTED;
215 }
216 
217 /*
218  * TA invokes some TA with parameter.
219  * If some parameters are memory references:
220  * - either the memref is inside TA private RAM: TA is not allowed to expose
221  *   its private RAM: use a temporary memory buffer and copy the data.
222  * - or the memref is not in the TA private RAM:
223  *   - if the memref was mapped to the TA, TA is allowed to expose it.
224  *   - if so, converts memref virtual address into a physical address.
225  */
226 static TEE_Result tee_svc_copy_param(struct tee_ta_session *sess,
227 				     struct tee_ta_session *called_sess,
228 				     uint32_t param_types,
229 				     TEE_Param callee_params[TEE_NUM_PARAMS],
230 				     struct tee_ta_param *param,
231 				     tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
232 				     tee_mm_entry_t **mm)
233 {
234 	size_t n;
235 	TEE_Result res;
236 	size_t req_mem = 0;
237 	size_t s;
238 	uint8_t *dst = 0;
239 	tee_paddr_t dst_pa, src_pa = 0;
240 	bool ta_private_memref[TEE_NUM_PARAMS];
241 
242 	/* fill 'param' input struct with caller params description buffer */
243 	param->types = param_types;
244 	if (!callee_params) {
245 		if (param->types != 0)
246 			return TEE_ERROR_BAD_PARAMETERS;
247 		memset(param->params, 0, sizeof(param->params));
248 	} else {
249 		tee_svc_copy_from_user(sess, param->params, callee_params,
250 				       sizeof(param->params));
251 	}
252 
253 	if ((called_sess != NULL) &&
254 		(called_sess->ctx->static_ta == NULL) &&
255 		(called_sess->ctx->flags & TA_FLAG_USER_MODE) == 0) {
256 		/*
257 		 * kernel TA, borrow the mapping of the calling
258 		 * during this call.
259 		 */
260 		called_sess->calling_sess = sess;
261 		return TEE_SUCCESS;
262 	}
263 
264 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
265 
266 		ta_private_memref[n] = false;
267 
268 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
269 		case TEE_PARAM_TYPE_MEMREF_INPUT:
270 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
271 		case TEE_PARAM_TYPE_MEMREF_INOUT:
272 			if (param->params[n].memref.buffer == NULL) {
273 				if (param->params[n].memref.size != 0)
274 					return TEE_ERROR_BAD_PARAMETERS;
275 				break;
276 			}
277 			/* uTA cannot expose its private memory */
278 			if (tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
279 				    param->params[n].memref.buffer,
280 				    param->params[n].memref.size)) {
281 
282 				s = ROUNDUP(param->params[n].memref.size,
283 						sizeof(uint32_t));
284 				/* Check overflow */
285 				if (req_mem + s < req_mem)
286 					return TEE_ERROR_BAD_PARAMETERS;
287 				req_mem += s;
288 				ta_private_memref[n] = true;
289 				break;
290 			}
291 			if (tee_mmu_is_vbuf_intersect_ta_private(sess->ctx,
292 				    param->params[n].memref.buffer,
293 				    param->params[n].memref.size))
294 				return TEE_ERROR_BAD_PARAMETERS;
295 
296 			if (tee_mmu_user_va2pa(sess->ctx,
297 					(void *)param->params[n].memref.buffer,
298 					&src_pa) != TEE_SUCCESS)
299 				return TEE_ERROR_BAD_PARAMETERS;
300 
301 			param->param_attr[n] = tee_mmu_user_get_cache_attr(
302 				sess->ctx,
303 				(void *)param->params[n].memref.buffer);
304 
305 			param->params[n].memref.buffer = (void *)src_pa;
306 			break;
307 
308 		default:
309 			break;
310 		}
311 	}
312 
313 	if (req_mem == 0)
314 		return TEE_SUCCESS;
315 
316 	/* Allocate section in secure DDR */
317 	*mm = tee_mm_alloc(&tee_mm_sec_ddr, req_mem);
318 	if (*mm == NULL) {
319 		DMSG("tee_mm_alloc TEE_ERROR_GENERIC");
320 		return TEE_ERROR_GENERIC;
321 	}
322 
323 	/* Get the virtual address for the section in secure DDR */
324 	res = tee_mmu_kmap(tee_mm_get_smem(*mm), req_mem, &dst);
325 	if (res != TEE_SUCCESS)
326 		return res;
327 	dst_pa = tee_mm_get_smem(*mm);
328 
329 	for (n = 0; n < 4; n++) {
330 
331 		if (ta_private_memref[n] == false)
332 			continue;
333 
334 		s = ROUNDUP(param->params[n].memref.size, sizeof(uint32_t));
335 
336 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
337 		case TEE_PARAM_TYPE_MEMREF_INPUT:
338 		case TEE_PARAM_TYPE_MEMREF_INOUT:
339 			if (param->params[n].memref.buffer != NULL) {
340 				res = tee_svc_copy_from_user(sess, dst,
341 						param->params[n].memref.buffer,
342 						param->params[n].memref.size);
343 				if (res != TEE_SUCCESS)
344 					return res;
345 				param->param_attr[n] =
346 					tee_mmu_kmap_get_cache_attr(dst);
347 				param->params[n].memref.buffer = (void *)dst_pa;
348 				tmp_buf_pa[n] = dst_pa;
349 				dst += s;
350 				dst_pa += s;
351 			}
352 			break;
353 
354 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
355 			if (param->params[n].memref.buffer != NULL) {
356 				param->param_attr[n] =
357 					tee_mmu_kmap_get_cache_attr(dst);
358 				param->params[n].memref.buffer = (void *)dst_pa;
359 				tmp_buf_pa[n] = dst_pa;
360 				dst += s;
361 				dst_pa += s;
362 			}
363 			break;
364 
365 		default:
366 			continue;
367 		}
368 	}
369 
370 	tee_mmu_kunmap(dst, req_mem);
371 
372 	return TEE_SUCCESS;
373 }
374 
375 /*
376  * Back from execution of service: update parameters passed from TA:
377  * If some parameters were memory references:
378  * - either the memref was temporary: copy back data and update size
379  * - or it was the original TA memref: update only the size value.
380  */
381 static TEE_Result tee_svc_update_out_param(
382 		struct tee_ta_session *sess,
383 		struct tee_ta_session *called_sess,
384 		struct tee_ta_param *param,
385 		tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
386 		TEE_Param callee_params[TEE_NUM_PARAMS])
387 {
388 	size_t n;
389 	bool have_private_mem_map = (called_sess == NULL) ||
390 		(called_sess->ctx->static_ta != NULL) ||
391 		((called_sess->ctx->flags & TA_FLAG_USER_MODE) != 0);
392 
393 	tee_ta_set_current_session(sess);
394 
395 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
396 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
397 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
398 		case TEE_PARAM_TYPE_MEMREF_INOUT:
399 
400 			/* outside TA private => memref is valid, update size */
401 			if (!tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
402 					callee_params[n].memref.buffer,
403 					param->params[n].memref.size)) {
404 				callee_params[n].memref.size =
405 					param->params[n].memref.size;
406 				break;
407 			}
408 
409 			/*
410 			 * If we called a kernel TA the parameters are in shared
411 			 * memory and no copy is needed.
412 			 */
413 			if (have_private_mem_map &&
414 			    param->params[n].memref.size <=
415 			    callee_params[n].memref.size) {
416 				uint8_t *src = 0;
417 				TEE_Result res;
418 
419 				/* FIXME: TA_RAM is already mapped ! */
420 				res = tee_mmu_kmap(tmp_buf_pa[n],
421 					param->params[n].memref.size, &src);
422 				if (res != TEE_SUCCESS)
423 					return TEE_ERROR_GENERIC;
424 
425 				res = tee_svc_copy_to_user(sess,
426 							 callee_params[n].memref.
427 							 buffer, src,
428 							 param->params[n].
429 							 memref.size);
430 				if (res != TEE_SUCCESS)
431 					return res;
432 				tee_mmu_kunmap(src,
433 					       param->params[n].memref.size);
434 
435 			}
436 			callee_params[n].memref.size = param->params[n].memref.size;
437 			break;
438 
439 		case TEE_PARAM_TYPE_VALUE_OUTPUT:
440 		case TEE_PARAM_TYPE_VALUE_INOUT:
441 			callee_params[n].value = param->params[n].value;
442 			break;
443 
444 		default:
445 			continue;
446 		}
447 	}
448 
449 	return TEE_SUCCESS;
450 }
451 
452 /* Called when a TA calls an OpenSession on another TA */
453 TEE_Result tee_svc_open_ta_session(const TEE_UUID *dest,
454 				   uint32_t cancel_req_to, uint32_t param_types,
455 				   TEE_Param params[4],
456 				   TEE_TASessionHandle *ta_sess,
457 				   uint32_t *ret_orig)
458 {
459 	TEE_Result res;
460 	uint32_t ret_o = TEE_ORIGIN_TEE;
461 	struct tee_ta_session *s = NULL;
462 	struct tee_ta_session *sess;
463 	tee_mm_entry_t *mm_param = NULL;
464 
465 	TEE_UUID *uuid = malloc(sizeof(TEE_UUID));
466 	struct tee_ta_param *param = malloc(sizeof(struct tee_ta_param));
467 	TEE_Identity *clnt_id = malloc(sizeof(TEE_Identity));
468 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
469 
470 	if (uuid == NULL || param == NULL || clnt_id == NULL) {
471 		res = TEE_ERROR_OUT_OF_MEMORY;
472 		goto out_free_only;
473 	}
474 
475 	memset(param, 0, sizeof(struct tee_ta_param));
476 
477 	res = tee_ta_get_current_session(&sess);
478 	if (res != TEE_SUCCESS)
479 		goto out_free_only;
480 
481 	res = tee_svc_copy_from_user(sess, uuid, dest, sizeof(TEE_UUID));
482 	if (res != TEE_SUCCESS)
483 		goto function_exit;
484 
485 	clnt_id->login = TEE_LOGIN_TRUSTED_APP;
486 	memcpy(&clnt_id->uuid, &sess->ctx->head->uuid, sizeof(TEE_UUID));
487 
488 	res = tee_svc_copy_param(sess, NULL, param_types, params, param,
489 				 tmp_buf_pa, &mm_param);
490 	if (res != TEE_SUCCESS)
491 		goto function_exit;
492 
493 	/*
494 	 * Find session of a multi session TA or a static TA
495 	 * In such a case, there is no need to ask the supplicant for the TA
496 	 * code
497 	 */
498 	res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions, uuid,
499 				  clnt_id, cancel_req_to, param);
500 	if (res != TEE_SUCCESS)
501 		goto function_exit;
502 
503 	res = tee_svc_update_out_param(sess, NULL, param, tmp_buf_pa, params);
504 
505 function_exit:
506 	tee_ta_set_current_session(sess);
507 
508 	if (mm_param != NULL) {
509 		TEE_Result res2;
510 		void *va = 0;
511 
512 		res2 =
513 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
514 		if (res2 == TEE_SUCCESS)
515 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
516 	}
517 	tee_mm_free(mm_param);
518 	tee_svc_copy_to_user(sess, ta_sess, &s, sizeof(s));
519 	tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
520 
521 out_free_only:
522 	free(param);
523 	free(uuid);
524 	free(clnt_id);
525 	return res;
526 }
527 
528 TEE_Result tee_svc_close_ta_session(TEE_TASessionHandle ta_sess)
529 {
530 	TEE_Result res;
531 	struct tee_ta_session *sess;
532 
533 	res = tee_ta_get_current_session(&sess);
534 	if (res != TEE_SUCCESS)
535 		return res;
536 
537 	tee_ta_set_current_session(NULL);
538 
539 	res =
540 	    tee_ta_close_session((uint32_t)ta_sess, &sess->ctx->open_sessions);
541 	tee_ta_set_current_session(sess);
542 	return res;
543 }
544 
545 TEE_Result tee_svc_invoke_ta_command(TEE_TASessionHandle ta_sess,
546 				     uint32_t cancel_req_to, uint32_t cmd_id,
547 				     uint32_t param_types, TEE_Param params[4],
548 				     uint32_t *ret_orig)
549 {
550 	TEE_Result res;
551 	uint32_t ret_o = TEE_ORIGIN_TEE;
552 	struct tee_ta_param param = { 0 };
553 	struct tee_ta_session *sess;
554 	struct tee_ta_session *called_sess = (struct tee_ta_session *)ta_sess;
555 	tee_mm_entry_t *mm_param = NULL;
556 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
557 
558 	res = tee_ta_get_current_session(&sess);
559 	if (res != TEE_SUCCESS)
560 		return res;
561 
562 	res =
563 	    tee_ta_verify_session_pointer(called_sess,
564 					  &sess->ctx->open_sessions);
565 	if (res != TEE_SUCCESS)
566 		return res;
567 
568 	res = tee_svc_copy_param(sess, called_sess, param_types, params,
569 				 &param, tmp_buf_pa, &mm_param);
570 	if (res != TEE_SUCCESS)
571 		goto function_exit;
572 
573 	res =
574 	    tee_ta_invoke_command(&ret_o, called_sess, cancel_req_to,
575 				  cmd_id, &param);
576 	if (res != TEE_SUCCESS)
577 		goto function_exit;
578 
579 	res = tee_svc_update_out_param(sess, called_sess, &param, tmp_buf_pa,
580 				       params);
581 	if (res != TEE_SUCCESS)
582 		goto function_exit;
583 
584 function_exit:
585 	tee_ta_set_current_session(sess);
586 	called_sess->calling_sess = NULL; /* clear eventual borrowed mapping */
587 
588 	if (mm_param != NULL) {
589 		TEE_Result res2;
590 		void *va = 0;
591 
592 		res2 =
593 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
594 		if (res2 == TEE_SUCCESS)
595 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
596 	}
597 	tee_mm_free(mm_param);
598 	if (ret_orig)
599 		tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
600 	return res;
601 }
602 
603 TEE_Result tee_svc_check_access_rights(uint32_t flags, const void *buf,
604 				       size_t len)
605 {
606 	TEE_Result res;
607 	struct tee_ta_session *s;
608 
609 	res = tee_ta_get_current_session(&s);
610 	if (res != TEE_SUCCESS)
611 		return res;
612 
613 	return tee_mmu_check_access_rights(s->ctx, flags, (tee_uaddr_t)buf,
614 					   len);
615 }
616 
617 TEE_Result tee_svc_copy_from_user(struct tee_ta_session *sess, void *kaddr,
618 				  const void *uaddr, size_t len)
619 {
620 	TEE_Result res;
621 	struct tee_ta_session *s;
622 
623 	if (sess == NULL) {
624 		res = tee_ta_get_current_session(&s);
625 		if (res != TEE_SUCCESS)
626 			return res;
627 	} else {
628 		s = sess;
629 		tee_ta_set_current_session(s);
630 	}
631 	res =
632 	    tee_mmu_check_access_rights(s->ctx,
633 					TEE_MEMORY_ACCESS_READ |
634 					TEE_MEMORY_ACCESS_ANY_OWNER,
635 					(tee_uaddr_t)uaddr, len);
636 	if (res != TEE_SUCCESS)
637 		return res;
638 
639 	memcpy(kaddr, uaddr, len);
640 	return TEE_SUCCESS;
641 }
642 
643 TEE_Result tee_svc_copy_to_user(struct tee_ta_session *sess, void *uaddr,
644 				const void *kaddr, size_t len)
645 {
646 	TEE_Result res;
647 	struct tee_ta_session *s;
648 
649 	if (sess == NULL) {
650 		res = tee_ta_get_current_session(&s);
651 		if (res != TEE_SUCCESS)
652 			return res;
653 	} else {
654 		s = sess;
655 		tee_ta_set_current_session(s);
656 	}
657 
658 	res =
659 	    tee_mmu_check_access_rights(s->ctx,
660 					TEE_MEMORY_ACCESS_WRITE |
661 					TEE_MEMORY_ACCESS_ANY_OWNER,
662 					(tee_uaddr_t)uaddr, len);
663 	if (res != TEE_SUCCESS)
664 		return res;
665 
666 	memcpy(uaddr, kaddr, len);
667 	return TEE_SUCCESS;
668 }
669 
670 static bool session_is_cancelled(struct tee_ta_session *s, TEE_Time *curr_time)
671 {
672 	TEE_Time current_time;
673 
674 	if (s->cancel_mask)
675 		return false;
676 
677 	if (s->cancel)
678 		return true;
679 
680 	if (s->cancel_time.seconds == UINT32_MAX)
681 		return false;
682 
683 	if (curr_time != NULL)
684 		current_time = *curr_time;
685 	else if (tee_time_get_sys_time(&current_time) != TEE_SUCCESS)
686 		return false;
687 
688 	if (current_time.seconds > s->cancel_time.seconds ||
689 	    (current_time.seconds == s->cancel_time.seconds &&
690 	     current_time.millis >= s->cancel_time.millis)) {
691 		return true;
692 	}
693 
694 	return false;
695 }
696 
697 TEE_Result tee_svc_get_cancellation_flag(bool *cancel)
698 {
699 	TEE_Result res;
700 	struct tee_ta_session *s = NULL;
701 	bool c;
702 
703 	res = tee_ta_get_current_session(&s);
704 	if (res != TEE_SUCCESS)
705 		return res;
706 
707 	c = session_is_cancelled(s, NULL);
708 
709 	return tee_svc_copy_to_user(s, cancel, &c, sizeof(c));
710 }
711 
712 TEE_Result tee_svc_unmask_cancellation(bool *old_mask)
713 {
714 	TEE_Result res;
715 	struct tee_ta_session *s = NULL;
716 	bool m;
717 
718 	res = tee_ta_get_current_session(&s);
719 	if (res != TEE_SUCCESS)
720 		return res;
721 
722 	m = s->cancel_mask;
723 	s->cancel_mask = false;
724 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
725 }
726 
727 TEE_Result tee_svc_mask_cancellation(bool *old_mask)
728 {
729 	TEE_Result res;
730 	struct tee_ta_session *s = NULL;
731 	bool m;
732 
733 	res = tee_ta_get_current_session(&s);
734 	if (res != TEE_SUCCESS)
735 		return res;
736 
737 	m = s->cancel_mask;
738 	s->cancel_mask = true;
739 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
740 }
741 
742 TEE_Result tee_svc_wait(uint32_t timeout)
743 {
744 	TEE_Result res = TEE_SUCCESS;
745 	uint32_t mytime = 0;
746 	struct tee_ta_session *s;
747 	TEE_Time base_time;
748 	TEE_Time current_time;
749 
750 	res = tee_ta_get_current_session(&s);
751 	if (res != TEE_SUCCESS)
752 		return res;
753 
754 	res = tee_time_get_sys_time(&base_time);
755 	if (res != TEE_SUCCESS)
756 		return res;
757 
758 	while (true) {
759 		res = tee_time_get_sys_time(&current_time);
760 		if (res != TEE_SUCCESS)
761 			return res;
762 
763 		if (session_is_cancelled(s, &current_time))
764 			return TEE_ERROR_CANCEL;
765 
766 		mytime = (current_time.seconds - base_time.seconds) * 1000 +
767 		    (int)current_time.millis - (int)base_time.millis;
768 		if (mytime >= timeout)
769 			return TEE_SUCCESS;
770 
771 		tee_time_wait(timeout - mytime);
772 	}
773 
774 	return res;
775 }
776 
777 TEE_Result tee_svc_get_time(enum utee_time_category cat, TEE_Time *mytime)
778 {
779 	TEE_Result res, res2;
780 	struct tee_ta_session *s = NULL;
781 	TEE_Time t;
782 
783 	res = tee_ta_get_current_session(&s);
784 	if (res != TEE_SUCCESS)
785 		return res;
786 
787 	switch (cat) {
788 	case UTEE_TIME_CAT_SYSTEM:
789 		res = tee_time_get_sys_time(&t);
790 		break;
791 	case UTEE_TIME_CAT_TA_PERSISTENT:
792 		res =
793 		    tee_time_get_ta_time((const void *)&s->ctx->head->uuid, &t);
794 		break;
795 	case UTEE_TIME_CAT_REE:
796 		res = tee_time_get_ree_time(&t);
797 		break;
798 	default:
799 		res = TEE_ERROR_BAD_PARAMETERS;
800 		break;
801 	}
802 
803 	if (res == TEE_SUCCESS || res == TEE_ERROR_OVERFLOW) {
804 		res2 = tee_svc_copy_to_user(s, mytime, &t, sizeof(t));
805 		if (res2 != TEE_SUCCESS)
806 			res = res2;
807 	}
808 
809 	return res;
810 }
811 
812 TEE_Result tee_svc_set_ta_time(const TEE_Time *mytime)
813 {
814 	TEE_Result res;
815 	struct tee_ta_session *s = NULL;
816 	TEE_Time t;
817 
818 	res = tee_ta_get_current_session(&s);
819 	if (res != TEE_SUCCESS)
820 		return res;
821 
822 	res = tee_svc_copy_from_user(s, &t, mytime, sizeof(t));
823 	if (res != TEE_SUCCESS)
824 		return res;
825 
826 	return tee_time_set_ta_time((const void *)&s->ctx->head->uuid, &t);
827 }
828