xref: /optee_os/core/tee/tee_svc.c (revision ec219598580570ffaec6472e3b0394ac4c5abfa8)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <kernel/tee_common_otp.h>
28 #include <kernel/tee_common.h>
29 #include <kernel/tee_compat.h>
30 #include <tee_api_types.h>
31 #include <kernel/tee_ta_manager.h>
32 #include <utee_types.h>
33 #include <tee/tee_svc.h>
34 #include <mm/tee_mmu.h>
35 #include <mm/tee_mm.h>
36 #include <kernel/tee_rpc.h>
37 #include <kernel/tee_rpc_types.h>
38 #include <kernel/tee_time.h>
39 
40 #include <user_ta_header.h>
41 #include <kernel/tee_core_trace.h>
42 #include <kernel/tee_kta_trace.h>
43 #include <kernel/chip_services.h>
44 #include <tee/tee_hash.h>
45 #include <tee_ltc_wrapper.h>
46 
47 
48 void tee_svc_sys_log(const void *buf, size_t len)
49 {
50 	char *kbuf;
51 
52 	if (len == 0)
53 		return;
54 
55 	kbuf = malloc(len);
56 	if (kbuf == NULL)
57 		return;
58 	*kbuf = '\0';
59 
60 	/* log as Info/Raw traces */
61 	if (tee_svc_copy_from_user(NULL, kbuf, buf, len) == TEE_SUCCESS)
62 		ATAMSG_RAW("%s", kbuf);
63 
64 	free(kbuf);
65 }
66 
67 void tee_svc_sys_panic(uint32_t code)
68 {
69 	struct tee_ta_session *sess;
70 
71 	if (tee_ta_get_current_session(&sess) == TEE_SUCCESS) {
72 		EMSG("Set session 0x%x to panicked", sess);
73 		sess->ctx->panicked = 1;
74 		sess->ctx->panic_code = code;
75 
76 		{
77 			/*
78 			 * Force panicking. This memory error will be trapped by
79 			 * the error exception handler myErrorHandler()
80 			 */
81 			EMSG("Following 'DTLB exception in bundle'");
82 			EMSG("   is generated with code %d", code);
83 			int *p = 0;
84 			*p = 1;
85 		}
86 	} else {
87 		DMSG("Panic called from unknown TA");
88 	}
89 }
90 
91 uint32_t tee_svc_sys_dummy(uint32_t *a)
92 {
93 	DMSG("tee_svc_sys_dummy: a 0x%x", (unsigned int)a);
94 	return 0;
95 }
96 
97 uint32_t tee_svc_sys_dummy_7args(uint32_t a1, uint32_t a2, uint32_t a3,
98 				 uint32_t a4, uint32_t a5, uint32_t a6,
99 				 uint32_t a7)
100 {
101 	DMSG("tee_svc_sys_dummy_7args: 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, %x, %x\n",
102 	     a1, a2, a3, a4, a5, a6, a7);
103 	return 0;
104 }
105 
106 uint32_t tee_svc_sys_nocall(void)
107 {
108 	DMSG("No syscall");
109 	return 0x1;
110 }
111 
112 TEE_Result tee_svc_sys_get_property(uint32_t prop, tee_uaddr_t buf, size_t blen)
113 {
114 	static const char api_vers[] = "1.0";
115 	static const char descr[] = "Version N.N";
116 	/*
117 	 * Value 100 means:
118 	 * System time based on REE-controlled timers. Can be tampered by the
119 	 * REE.  The implementation must still guarantee that the system time
120 	 * is monotonous, i.e., successive calls to TEE_GetSystemTime must
121 	 * return increasing values of the system time.
122 	 */
123 	static const uint32_t sys_time_prot_lvl = 100;
124 	static const uint32_t ta_time_prot_lvl = 100;
125 	struct tee_ta_session *sess;
126 	TEE_Result res;
127 
128 	res = tee_ta_get_current_session(&sess);
129 	if (res != TEE_SUCCESS)
130 		return res;
131 
132 	switch (prop) {
133 	case UTEE_PROP_TEE_API_VERSION:
134 		if (blen < sizeof(api_vers))
135 			return TEE_ERROR_SHORT_BUFFER;
136 		return tee_svc_copy_to_user(sess, (void *)buf, api_vers,
137 					    sizeof(api_vers));
138 
139 	case UTEE_PROP_TEE_DESCR:
140 		if (blen < sizeof(descr))
141 			return TEE_ERROR_SHORT_BUFFER;
142 		return tee_svc_copy_to_user(sess, (void *)buf, descr,
143 					    sizeof(descr));
144 
145 	case UTEE_PROP_TEE_DEV_ID:
146 		{
147 			TEE_UUID uuid;
148 			const size_t nslen = 4;
149 			uint8_t data[4 +
150 				     FVR_DIE_ID_NUM_REGS * sizeof(uint32_t)] = {
151 			    'S', 'T', 'E', 'E' };
152 
153 			if (blen < sizeof(uuid))
154 				return TEE_ERROR_SHORT_BUFFER;
155 
156 			if (tee_otp_get_die_id
157 					(data + nslen, sizeof(data) - nslen))
158 				return TEE_ERROR_BAD_STATE;
159 
160 			res = tee_hash_createdigest(
161 					TEE_ALG_SHA256,
162 					data, sizeof(data),
163 					(uint8_t *)&uuid, sizeof(uuid));
164 			if (res != TEE_SUCCESS)
165 				return TEE_ERROR_BAD_STATE;
166 
167 			/*
168 			 * Changes the random value into and UUID as specifiec
169 			 * in RFC 4122. The magic values are from the example
170 			 * code in the RFC.
171 			 *
172 			 * TEE_UUID is defined slightly different from the RFC,
173 			 * but close enough for our purpose.
174 			 */
175 
176 			uuid.timeHiAndVersion &= 0x0fff;
177 			uuid.timeHiAndVersion |= 5 << 12;
178 
179 			/* uuid.clock_seq_hi_and_reserved in the RFC */
180 			uuid.clockSeqAndNode[0] &= 0x3f;
181 			uuid.clockSeqAndNode[0] |= 0x80;
182 
183 			return tee_svc_copy_to_user(sess, (void *)buf, &uuid,
184 						    sizeof(TEE_UUID));
185 		}
186 
187 	case UTEE_PROP_TEE_SYS_TIME_PROT_LEVEL:
188 		if (blen < sizeof(sys_time_prot_lvl))
189 			return TEE_ERROR_SHORT_BUFFER;
190 		return tee_svc_copy_to_user(sess, (void *)buf,
191 					    &sys_time_prot_lvl,
192 					    sizeof(sys_time_prot_lvl));
193 
194 	case UTEE_PROP_TEE_TA_TIME_PROT_LEVEL:
195 		if (blen < sizeof(ta_time_prot_lvl))
196 			return TEE_ERROR_SHORT_BUFFER;
197 		return tee_svc_copy_to_user(sess, (void *)buf,
198 					    &ta_time_prot_lvl,
199 					    sizeof(ta_time_prot_lvl));
200 
201 	case UTEE_PROP_TEE_ARITH_MAX_BIG_INT_SIZE:
202 		{
203 			uint32_t v = LTC_MAX_BITS_PER_VARIABLE / 2;
204 
205 			if (blen < sizeof(v))
206 				return TEE_ERROR_SHORT_BUFFER;
207 
208 			return tee_svc_copy_to_user(sess, (void *)buf, &v,
209 						    sizeof(v));
210 		}
211 
212 	case UTEE_PROP_CLIENT_ID:
213 		{
214 			if (blen < sizeof(TEE_Identity))
215 				return TEE_ERROR_SHORT_BUFFER;
216 
217 			return tee_svc_copy_to_user(sess, (void *)buf,
218 						    &sess->clnt_id,
219 						    sizeof(TEE_Identity));
220 		}
221 	case UTEE_PROP_TA_APP_ID:
222 		{
223 			if (blen < sizeof(TEE_UUID))
224 				return TEE_ERROR_SHORT_BUFFER;
225 
226 			return tee_svc_copy_to_user(sess, (void *)buf,
227 						    &sess->ctx->head->uuid,
228 						    sizeof(TEE_UUID));
229 		}
230 
231 	default:
232 		break;
233 	}
234 	return TEE_ERROR_NOT_IMPLEMENTED;
235 }
236 
237 /*
238  * TA invokes some TA with parameter.
239  * If some parameters are memory references:
240  * - either the memref is inside TA private RAM: TA is not allowed to expose
241  *   its private RAM: use a temporary memory buffer and copy the data.
242  * - or the memref is not in the TA private RAM:
243  *   - if the memref was mapped to the TA, TA is allowed to expose it.
244  *   - if so, converts memref virtual address into a physical address.
245  */
246 static TEE_Result tee_svc_copy_param(struct tee_ta_session *sess,
247 				     struct tee_ta_session *called_sess,
248 				     uint32_t param_types,
249 				     TEE_Param params[TEE_NUM_PARAMS],
250 				     struct tee_ta_param *param,
251 				     tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
252 				     tee_mm_entry_t **mm)
253 {
254 	size_t n;
255 	TEE_Result res;
256 	size_t req_mem = 0;
257 	size_t s;
258 	uint8_t *dst = 0;
259 	tee_paddr_t dst_pa, src_pa = 0;
260 	bool ta_private_memref[TEE_NUM_PARAMS];
261 
262 	param->types = param_types;
263 	if (params == NULL) {
264 		if (param->types != 0)
265 			return TEE_ERROR_BAD_PARAMETERS;
266 		memset(param->params, 0, sizeof(param->params));
267 	} else {
268 		tee_svc_copy_from_user(sess, param->params, params,
269 				       sizeof(param->params));
270 	}
271 
272 	if ((called_sess != NULL) &&
273 		(called_sess->ctx->static_ta == NULL) &&
274 		(called_sess->ctx->flags & TA_FLAG_USER_MODE) == 0) {
275 		/*
276 		 * kernel TA, borrow the mapping of the calling
277 		 * during this call.
278 		 */
279 		called_sess->calling_sess = sess;
280 		return TEE_SUCCESS;
281 	}
282 
283 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
284 
285 		ta_private_memref[n] = false;
286 
287 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
288 		case TEE_PARAM_TYPE_MEMREF_INPUT:
289 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
290 		case TEE_PARAM_TYPE_MEMREF_INOUT:
291 			if (param->params[n].memref.buffer == NULL) {
292 				if (param->params[n].memref.size != 0)
293 					return TEE_ERROR_BAD_PARAMETERS;
294 				break;
295 			}
296 			/* uTA cannot expose its private memory */
297 			if (tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
298 				    (uintptr_t)param->params[n].memref.buffer,
299 				    param->params[n].memref.size)) {
300 
301 				s = TEE_ROUNDUP(param->params[n].memref.size,
302 						sizeof(uint32_t));
303 				/* Check overflow */
304 				if (req_mem + s < req_mem)
305 					return TEE_ERROR_BAD_PARAMETERS;
306 				req_mem += s;
307 				ta_private_memref[n] = true;
308 				break;
309 			}
310 			if (!tee_mmu_is_vbuf_outside_ta_private(sess->ctx,
311 				    (uintptr_t)param->params[n].memref.buffer,
312 				    param->params[n].memref.size))
313 				return TEE_ERROR_BAD_PARAMETERS;
314 
315 			if (tee_mmu_user_va2pa(sess->ctx,
316 					(void *)param->params[n].memref.buffer,
317 					(void **)&src_pa) != TEE_SUCCESS)
318 				return TEE_ERROR_BAD_PARAMETERS;
319 
320 			param->param_attr[n] = tee_mmu_user_get_cache_attr(
321 				sess->ctx,
322 				(void *)param->params[n].memref.buffer);
323 
324 			param->params[n].memref.buffer = (void *)src_pa;
325 			break;
326 
327 		default:
328 			break;
329 		}
330 	}
331 
332 	if (req_mem == 0)
333 		return TEE_SUCCESS;
334 
335 	/* Allocate section in secure DDR */
336 	*mm = tee_mm_alloc(&tee_mm_sec_ddr, req_mem);
337 	if (*mm == NULL) {
338 		DMSG("tee_mm_alloc TEE_ERROR_GENERIC");
339 		return TEE_ERROR_GENERIC;
340 	}
341 
342 	/* Get the virtual address for the section in secure DDR */
343 	res = tee_mmu_kmap(tee_mm_get_smem(*mm), req_mem, &dst);
344 	if (res != TEE_SUCCESS)
345 		return res;
346 	dst_pa = tee_mm_get_smem(*mm);
347 
348 	for (n = 0; n < 4; n++) {
349 
350 		if (ta_private_memref[n] == false)
351 			continue;
352 
353 		s = TEE_ROUNDUP(param->params[n].memref.size, sizeof(uint32_t));
354 
355 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
356 		case TEE_PARAM_TYPE_MEMREF_INPUT:
357 		case TEE_PARAM_TYPE_MEMREF_INOUT:
358 			if (param->params[n].memref.buffer != NULL) {
359 				res = tee_svc_copy_from_user(sess, dst,
360 							     param->params[n].
361 							     memref.buffer,
362 							     param->params[n].
363 							     memref.size);
364 				if (res != TEE_SUCCESS)
365 					return res;
366 
367 				param->param_attr[n] =
368 					tee_mmu_kmap_get_cache_attr(dst);
369 				param->params[n].memref.buffer = (void *)dst_pa;
370 				tmp_buf_pa[n] = dst_pa;
371 				dst += s;
372 				dst_pa += s;
373 			}
374 			break;
375 
376 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
377 			if (param->params[n].memref.buffer != NULL) {
378 				param->param_attr[n] =
379 					tee_mmu_kmap_get_cache_attr(dst);
380 				param->params[n].memref.buffer = (void *)dst_pa;
381 				tmp_buf_pa[n] = dst_pa;
382 				dst += s;
383 				dst_pa += s;
384 			}
385 			break;
386 
387 		default:
388 			continue;
389 		}
390 	}
391 
392 	tee_mmu_kunmap(dst, req_mem);
393 
394 	return TEE_SUCCESS;
395 }
396 
397 /*
398  * Back from execution of service: update parameters passed from TA:
399  * If some parameters were memory references:
400  * - either the memref was temporary: copy back data and update size
401  * - or it was the original TA memref: update only the size value.
402  */
403 static TEE_Result tee_svc_update_out_param(
404 		struct tee_ta_session *sess,
405 		struct tee_ta_session *called_sess,
406 		struct tee_ta_param *param,
407 		tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
408 		TEE_Param params[TEE_NUM_PARAMS])
409 {
410 	size_t n;
411 	bool have_private_mem_map = (called_sess == NULL) ||
412 		(called_sess->ctx->static_ta != NULL) ||
413 		((called_sess->ctx->flags & TA_FLAG_USER_MODE) != 0);
414 
415 	tee_ta_set_current_session(sess);
416 
417 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
418 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
419 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
420 		case TEE_PARAM_TYPE_MEMREF_INOUT:
421 
422 			/* outside TA private => memref is valid, update size */
423 			if (!tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
424 					(uintptr_t)params[n].memref.buffer,
425 					param->params[n].memref.size)) {
426 				params[n].memref.size =
427 					param->params[n].memref.size;
428 				break;
429 			}
430 
431 			/*
432 			 * If we called a kernel TA the parameters are in shared
433 			 * memory and no copy is needed.
434 			 */
435 			if (have_private_mem_map &&
436 			    param->params[n].memref.size <=
437 			    params[n].memref.size) {
438 				uint8_t *src = 0;
439 				TEE_Result res;
440 
441 				/* FIXME: TA_RAM is already mapped ! */
442 				res = tee_mmu_kmap(tmp_buf_pa[n],
443 					param->params[n].memref.size, &src);
444 				if (res != TEE_SUCCESS)
445 					return TEE_ERROR_GENERIC;
446 
447 				res = tee_svc_copy_to_user(sess,
448 							 params[n].memref.
449 							 buffer, src,
450 							 param->params[n].
451 							 memref.size);
452 				if (res != TEE_SUCCESS)
453 					return res;
454 				tee_mmu_kunmap(src,
455 					       param->params[n].memref.size);
456 
457 			}
458 			params[n].memref.size = param->params[n].memref.size;
459 			break;
460 
461 		case TEE_PARAM_TYPE_VALUE_OUTPUT:
462 		case TEE_PARAM_TYPE_VALUE_INOUT:
463 			params[n].value = param->params[n].value;
464 			break;
465 
466 		default:
467 			continue;
468 		}
469 	}
470 
471 	return TEE_SUCCESS;
472 }
473 
474 /* Called when a TA calls an OpenSession on another TA */
475 TEE_Result tee_svc_open_ta_session(const TEE_UUID *dest,
476 				   uint32_t cancel_req_to, uint32_t param_types,
477 				   TEE_Param params[4],
478 				   TEE_TASessionHandle *ta_sess,
479 				   uint32_t *ret_orig)
480 {
481 	TEE_Result res;
482 	uint32_t ret_o = TEE_ORIGIN_TEE;
483 	struct tee_ta_session *s = NULL;
484 	struct tee_ta_session *sess;
485 	tee_mm_entry_t *mm_param = NULL;
486 
487 	TEE_UUID *uuid = malloc(sizeof(TEE_UUID));
488 	struct tee_ta_param *param = malloc(sizeof(struct tee_ta_param));
489 	TEE_Identity *clnt_id = malloc(sizeof(TEE_Identity));
490 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
491 
492 	if (uuid == NULL || param == NULL || clnt_id == NULL) {
493 		res = TEE_ERROR_OUT_OF_MEMORY;
494 		goto out_free_only;
495 	}
496 
497 	memset(param, 0, sizeof(struct tee_ta_param));
498 
499 	res = tee_ta_get_current_session(&sess);
500 	if (res != TEE_SUCCESS)
501 		goto out_free_only;
502 
503 	res = tee_svc_copy_from_user(sess, uuid, dest, sizeof(TEE_UUID));
504 	if (res != TEE_SUCCESS)
505 		goto function_exit;
506 
507 	clnt_id->login = TEE_LOGIN_TRUSTED_APP;
508 	memcpy(&clnt_id->uuid, &sess->ctx->head->uuid, sizeof(TEE_UUID));
509 
510 	res = tee_svc_copy_param(sess, NULL, param_types, params, param,
511 				 tmp_buf_pa, &mm_param);
512 	if (res != TEE_SUCCESS)
513 		goto function_exit;
514 
515 	/*
516 	 * Find session of a multi session TA or a static TA
517 	 * In such a case, there is no need to ask the supplicant for the TA
518 	 * code
519 	 */
520 	res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions, uuid,
521 				  NULL, clnt_id, cancel_req_to, param);
522 
523 	if (ret_o != TEE_ORIGIN_TEE || res != TEE_ERROR_ITEM_NOT_FOUND)
524 		goto function_exit;
525 
526 	if (ret_o == TEE_ORIGIN_TEE && res == TEE_ERROR_ITEM_NOT_FOUND) {
527 		kta_signed_header_t *ta = NULL;
528 		struct tee_ta_nwumap lp;
529 
530 		/* Load TA */
531 		res = tee_ta_rpc_load(uuid, &ta, &lp, &ret_o);
532 		if (res != TEE_SUCCESS)
533 			goto function_exit;
534 
535 		res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions,
536 					  uuid, ta, clnt_id, cancel_req_to,
537 					  param);
538 		if (res != TEE_SUCCESS)
539 			goto function_exit;
540 
541 		s->ctx->nwumap = lp;
542 	}
543 
544 	res = tee_svc_update_out_param(sess, NULL, param, tmp_buf_pa, params);
545 	if (res != TEE_SUCCESS)
546 		goto function_exit;
547 
548 function_exit:
549 	tee_ta_set_current_session(sess);
550 
551 	if (mm_param != NULL) {
552 		TEE_Result res2;
553 		void *va = 0;
554 
555 		res2 =
556 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
557 		if (res2 == TEE_SUCCESS)
558 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
559 	}
560 	tee_mm_free(mm_param);
561 	tee_svc_copy_to_user(sess, ta_sess, &s, sizeof(s));
562 	tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
563 
564 out_free_only:
565 	free(param);
566 	free(uuid);
567 	free(clnt_id);
568 	return res;
569 }
570 
571 TEE_Result tee_svc_close_ta_session(TEE_TASessionHandle ta_sess)
572 {
573 	TEE_Result res;
574 	struct tee_ta_session *sess;
575 
576 	res = tee_ta_get_current_session(&sess);
577 	if (res != TEE_SUCCESS)
578 		return res;
579 
580 	tee_ta_set_current_session(NULL);
581 
582 	res =
583 	    tee_ta_close_session((uint32_t)ta_sess, &sess->ctx->open_sessions);
584 	tee_ta_set_current_session(sess);
585 	return res;
586 }
587 
588 TEE_Result tee_svc_invoke_ta_command(TEE_TASessionHandle ta_sess,
589 				     uint32_t cancel_req_to, uint32_t cmd_id,
590 				     uint32_t param_types, TEE_Param params[4],
591 				     uint32_t *ret_orig)
592 {
593 	TEE_Result res;
594 	uint32_t ret_o = TEE_ORIGIN_TEE;
595 	struct tee_ta_param param = { 0 };
596 	TEE_Identity clnt_id;
597 	struct tee_ta_session *sess;
598 	struct tee_ta_session *called_sess = (struct tee_ta_session *)ta_sess;
599 	tee_mm_entry_t *mm_param = NULL;
600 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
601 
602 	res = tee_ta_get_current_session(&sess);
603 	if (res != TEE_SUCCESS)
604 		return res;
605 
606 	res =
607 	    tee_ta_verify_session_pointer(called_sess,
608 					  &sess->ctx->open_sessions);
609 	if (res != TEE_SUCCESS)
610 		return res;
611 
612 	res = tee_svc_copy_param(sess, called_sess, param_types, params,
613 				 &param, tmp_buf_pa, &mm_param);
614 	if (res != TEE_SUCCESS)
615 		goto function_exit;
616 
617 	res =
618 	    tee_ta_invoke_command(&ret_o, called_sess, &clnt_id, cancel_req_to,
619 				  cmd_id, &param);
620 	if (res != TEE_SUCCESS)
621 		goto function_exit;
622 
623 	res = tee_svc_update_out_param(sess, called_sess, &param, tmp_buf_pa,
624 				       params);
625 	if (res != TEE_SUCCESS)
626 		goto function_exit;
627 
628 function_exit:
629 	tee_ta_set_current_session(sess);
630 	called_sess->calling_sess = NULL; /* clear eventual borrowed mapping */
631 
632 	if (mm_param != NULL) {
633 		TEE_Result res2;
634 		void *va = 0;
635 
636 		res2 =
637 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
638 		if (res2 == TEE_SUCCESS)
639 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
640 	}
641 	tee_mm_free(mm_param);
642 	if (ret_orig)
643 		tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
644 	return res;
645 }
646 
647 TEE_Result tee_svc_check_access_rights(uint32_t flags, const void *buf,
648 				       size_t len)
649 {
650 	TEE_Result res;
651 	struct tee_ta_session *s;
652 
653 	res = tee_ta_get_current_session(&s);
654 	if (res != TEE_SUCCESS)
655 		return res;
656 
657 	return tee_mmu_check_access_rights(s->ctx, flags, (tee_uaddr_t)buf,
658 					   len);
659 }
660 
661 TEE_Result tee_svc_copy_from_user(struct tee_ta_session *sess, void *kaddr,
662 				  const void *uaddr, size_t len)
663 {
664 	TEE_Result res;
665 	struct tee_ta_session *s;
666 
667 	if (sess == NULL) {
668 		res = tee_ta_get_current_session(&s);
669 		if (res != TEE_SUCCESS)
670 			return res;
671 	} else {
672 		s = sess;
673 		tee_ta_set_current_session(s);
674 	}
675 	res =
676 	    tee_mmu_check_access_rights(s->ctx,
677 					TEE_MEMORY_ACCESS_READ |
678 					TEE_MEMORY_ACCESS_ANY_OWNER,
679 					(tee_uaddr_t)uaddr, len);
680 	if (res != TEE_SUCCESS)
681 		return res;
682 
683 	memcpy(kaddr, uaddr, len);
684 	return TEE_SUCCESS;
685 }
686 
687 TEE_Result tee_svc_copy_to_user(struct tee_ta_session *sess, void *uaddr,
688 				const void *kaddr, size_t len)
689 {
690 	TEE_Result res;
691 	struct tee_ta_session *s;
692 
693 	if (sess == NULL) {
694 		res = tee_ta_get_current_session(&s);
695 		if (res != TEE_SUCCESS)
696 			return res;
697 	} else {
698 		s = sess;
699 		tee_ta_set_current_session(s);
700 	}
701 
702 	res =
703 	    tee_mmu_check_access_rights(s->ctx,
704 					TEE_MEMORY_ACCESS_WRITE |
705 					TEE_MEMORY_ACCESS_ANY_OWNER,
706 					(tee_uaddr_t)uaddr, len);
707 	if (res != TEE_SUCCESS)
708 		return res;
709 
710 	memcpy(uaddr, kaddr, len);
711 	return TEE_SUCCESS;
712 }
713 
714 static bool session_is_cancelled(struct tee_ta_session *s, TEE_Time *curr_time)
715 {
716 	TEE_Time current_time;
717 
718 	if (s->cancel_mask)
719 		return false;
720 
721 	if (s->cancel)
722 		return true;
723 
724 	if (s->cancel_time.seconds == UINT32_MAX)
725 		return false;
726 
727 	if (curr_time != NULL)
728 		current_time = *curr_time;
729 	else if (tee_time_get_sys_time(&current_time) != TEE_SUCCESS)
730 		return false;
731 
732 	if (current_time.seconds > s->cancel_time.seconds ||
733 	    (current_time.seconds == s->cancel_time.seconds &&
734 	     current_time.millis >= s->cancel_time.millis)) {
735 		return true;
736 	}
737 
738 	return false;
739 }
740 
741 TEE_Result tee_svc_get_cancellation_flag(bool *cancel)
742 {
743 	TEE_Result res;
744 	struct tee_ta_session *s = NULL;
745 	bool c;
746 
747 	res = tee_ta_get_current_session(&s);
748 	if (res != TEE_SUCCESS)
749 		return res;
750 
751 	c = session_is_cancelled(s, NULL);
752 
753 	return tee_svc_copy_to_user(s, cancel, &c, sizeof(c));
754 }
755 
756 TEE_Result tee_svc_unmask_cancellation(bool *old_mask)
757 {
758 	TEE_Result res;
759 	struct tee_ta_session *s = NULL;
760 	bool m;
761 
762 	res = tee_ta_get_current_session(&s);
763 	if (res != TEE_SUCCESS)
764 		return res;
765 
766 	m = s->cancel_mask;
767 	s->cancel_mask = false;
768 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
769 }
770 
771 TEE_Result tee_svc_mask_cancellation(bool *old_mask)
772 {
773 	TEE_Result res;
774 	struct tee_ta_session *s = NULL;
775 	bool m;
776 
777 	res = tee_ta_get_current_session(&s);
778 	if (res != TEE_SUCCESS)
779 		return res;
780 
781 	m = s->cancel_mask;
782 	s->cancel_mask = true;
783 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
784 }
785 
786 TEE_Result tee_svc_wait(uint32_t timeout)
787 {
788 	TEE_Result res = TEE_SUCCESS;
789 	uint32_t mytime = 0;
790 	struct tee_ta_session *s;
791 	TEE_Time base_time;
792 	TEE_Time current_time;
793 
794 	res = tee_ta_get_current_session(&s);
795 	if (res != TEE_SUCCESS)
796 		return res;
797 
798 	res = tee_time_get_sys_time(&base_time);
799 	if (res != TEE_SUCCESS)
800 		return res;
801 
802 	while (true) {
803 		res = tee_time_get_sys_time(&current_time);
804 		if (res != TEE_SUCCESS)
805 			return res;
806 
807 		if (session_is_cancelled(s, &current_time))
808 			return TEE_ERROR_CANCEL;
809 
810 		mytime = (current_time.seconds - base_time.seconds) * 1000 +
811 		    (int)current_time.millis - (int)base_time.millis;
812 		if (mytime >= timeout)
813 			return TEE_SUCCESS;
814 
815 		tee_wait_specific(timeout - mytime);
816 	}
817 
818 	return res;
819 }
820 
821 TEE_Result tee_svc_get_time(enum utee_time_category cat, TEE_Time *mytime)
822 {
823 	TEE_Result res, res2;
824 	struct tee_ta_session *s = NULL;
825 	TEE_Time t;
826 
827 	res = tee_ta_get_current_session(&s);
828 	if (res != TEE_SUCCESS)
829 		return res;
830 
831 	switch (cat) {
832 	case UTEE_TIME_CAT_SYSTEM:
833 		res = tee_time_get_sys_time(&t);
834 		break;
835 	case UTEE_TIME_CAT_TA_PERSISTENT:
836 		res =
837 		    tee_time_get_ta_time((const void *)&s->ctx->head->uuid, &t);
838 		break;
839 	case UTEE_TIME_CAT_REE:
840 		res = tee_time_get_ree_time(&t);
841 		break;
842 	default:
843 		res = TEE_ERROR_BAD_PARAMETERS;
844 		break;
845 	}
846 
847 	if (res == TEE_SUCCESS || res == TEE_ERROR_OVERFLOW) {
848 		res2 = tee_svc_copy_to_user(s, mytime, &t, sizeof(t));
849 		if (res2 != TEE_SUCCESS)
850 			res = res2;
851 	}
852 
853 	return res;
854 }
855 
856 TEE_Result tee_svc_set_ta_time(const TEE_Time *mytime)
857 {
858 	TEE_Result res;
859 	struct tee_ta_session *s = NULL;
860 	TEE_Time t;
861 
862 	res = tee_ta_get_current_session(&s);
863 	if (res != TEE_SUCCESS)
864 		return res;
865 
866 	res = tee_svc_copy_from_user(s, &t, mytime, sizeof(t));
867 	if (res != TEE_SUCCESS)
868 		return res;
869 
870 	return tee_time_set_ta_time((const void *)&s->ctx->head->uuid, &t);
871 }
872