xref: /optee_os/core/tee/tee_svc.c (revision ffe040395b13924a8bfb106002a3512c0f1024c6)
1 /*
2  * Copyright (c) 2014, STMicroelectronics International N.V.
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions are met:
7  *
8  * 1. Redistributions of source code must retain the above copyright notice,
9  * this list of conditions and the following disclaimer.
10  *
11  * 2. Redistributions in binary form must reproduce the above copyright notice,
12  * this list of conditions and the following disclaimer in the documentation
13  * and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
16  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
17  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
18  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
19  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
20  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
21  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
22  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
23  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
24  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
25  * POSSIBILITY OF SUCH DAMAGE.
26  */
27 #include <kernel/util.h>
28 #include <kernel/tee_common_otp.h>
29 #include <kernel/tee_common.h>
30 #include <kernel/tee_compat.h>
31 #include <tee_api_types.h>
32 #include <kernel/tee_ta_manager.h>
33 #include <utee_types.h>
34 #include <tee/tee_svc.h>
35 #include <tee/tee_cryp_utl.h>
36 #include <mm/tee_mmu.h>
37 #include <mm/tee_mm.h>
38 #include <kernel/tee_rpc.h>
39 #include <kernel/tee_rpc_types.h>
40 #include <kernel/tee_time.h>
41 
42 #include <user_ta_header.h>
43 #include <kernel/tee_core_trace.h>
44 #include <kernel/tee_kta_trace.h>
45 #include <kernel/chip_services.h>
46 
47 void tee_svc_sys_log(const void *buf, size_t len)
48 {
49 	char *kbuf;
50 
51 	if (len == 0)
52 		return;
53 
54 	kbuf = malloc(len);
55 	if (kbuf == NULL)
56 		return;
57 	*kbuf = '\0';
58 
59 	/* log as Info/Raw traces */
60 	if (tee_svc_copy_from_user(NULL, kbuf, buf, len) == TEE_SUCCESS)
61 		ATAMSG_RAW("%s", kbuf);
62 
63 	free(kbuf);
64 }
65 
66 void tee_svc_sys_panic(uint32_t code)
67 {
68 	struct tee_ta_session *sess;
69 
70 	if (tee_ta_get_current_session(&sess) == TEE_SUCCESS) {
71 		EMSG("Set session %p to panicked", (void *)sess);
72 		sess->ctx->panicked = 1;
73 		sess->ctx->panic_code = code;
74 
75 		{
76 			int *p = 0;
77 
78 			/*
79 			 * Force panicking. This memory error will be trapped by
80 			 * the error exception handler myErrorHandler()
81 			 */
82 			EMSG("Following 'DTLB exception in bundle'");
83 			EMSG("   is generated with code %d", code);
84 			*p = 1;
85 		}
86 	} else {
87 		DMSG("Panic called from unknown TA");
88 	}
89 }
90 
91 TEE_Result tee_svc_reserved(void)
92 {
93 	return TEE_ERROR_GENERIC;
94 }
95 
96 uint32_t tee_svc_sys_dummy(uint32_t *a __unused)
97 {
98 	DMSG("tee_svc_sys_dummy: a 0x%x", (unsigned int)a);
99 	return 0;
100 }
101 
102 uint32_t tee_svc_sys_dummy_7args(uint32_t a1 __unused, uint32_t a2 __unused,
103 				uint32_t a3 __unused, uint32_t a4 __unused,
104 				uint32_t a5 __unused, uint32_t a6 __unused,
105 				uint32_t a7 __unused)
106 {
107 	DMSG("tee_svc_sys_dummy_7args: 0x%x, 0x%x, 0x%x, 0x%x, 0x%x, %x, %x\n",
108 	     a1, a2, a3, a4, a5, a6, a7);
109 	return 0;
110 }
111 
112 uint32_t tee_svc_sys_nocall(void)
113 {
114 	DMSG("No syscall");
115 	return 0x1;
116 }
117 
118 TEE_Result tee_svc_sys_get_property(uint32_t prop, tee_uaddr_t buf, size_t blen)
119 {
120 	static const char api_vers[] = "1.0";
121 	static const char descr[] = "Version N.N";
122 	/*
123 	 * Value 100 means:
124 	 * System time based on REE-controlled timers. Can be tampered by the
125 	 * REE.  The implementation must still guarantee that the system time
126 	 * is monotonous, i.e., successive calls to TEE_GetSystemTime must
127 	 * return increasing values of the system time.
128 	 */
129 	static const uint32_t sys_time_prot_lvl = 100;
130 	static const uint32_t ta_time_prot_lvl = 100;
131 	struct tee_ta_session *sess;
132 	TEE_Result res;
133 
134 	res = tee_ta_get_current_session(&sess);
135 	if (res != TEE_SUCCESS)
136 		return res;
137 
138 	switch (prop) {
139 	case UTEE_PROP_TEE_API_VERSION:
140 		if (blen < sizeof(api_vers))
141 			return TEE_ERROR_SHORT_BUFFER;
142 		return tee_svc_copy_to_user(sess, (void *)buf, api_vers,
143 					    sizeof(api_vers));
144 
145 	case UTEE_PROP_TEE_DESCR:
146 		if (blen < sizeof(descr))
147 			return TEE_ERROR_SHORT_BUFFER;
148 		return tee_svc_copy_to_user(sess, (void *)buf, descr,
149 					    sizeof(descr));
150 
151 	case UTEE_PROP_TEE_DEV_ID:
152 		{
153 			TEE_UUID uuid;
154 			const size_t nslen = 4;
155 			uint8_t data[4 +
156 				     FVR_DIE_ID_NUM_REGS * sizeof(uint32_t)] = {
157 			    'S', 'T', 'E', 'E' };
158 
159 			if (blen < sizeof(uuid))
160 				return TEE_ERROR_SHORT_BUFFER;
161 
162 			if (tee_otp_get_die_id
163 					(data + nslen, sizeof(data) - nslen))
164 				return TEE_ERROR_BAD_STATE;
165 
166 			res = tee_hash_createdigest(TEE_ALG_SHA256, data,
167 						    sizeof(data),
168 						    (uint8_t *)&uuid,
169 						    sizeof(uuid));
170 			if (res != TEE_SUCCESS)
171 				return TEE_ERROR_BAD_STATE;
172 
173 			/*
174 			 * Changes the random value into and UUID as specifiec
175 			 * in RFC 4122. The magic values are from the example
176 			 * code in the RFC.
177 			 *
178 			 * TEE_UUID is defined slightly different from the RFC,
179 			 * but close enough for our purpose.
180 			 */
181 
182 			uuid.timeHiAndVersion &= 0x0fff;
183 			uuid.timeHiAndVersion |= 5 << 12;
184 
185 			/* uuid.clock_seq_hi_and_reserved in the RFC */
186 			uuid.clockSeqAndNode[0] &= 0x3f;
187 			uuid.clockSeqAndNode[0] |= 0x80;
188 
189 			return tee_svc_copy_to_user(sess, (void *)buf, &uuid,
190 						    sizeof(TEE_UUID));
191 		}
192 
193 	case UTEE_PROP_TEE_SYS_TIME_PROT_LEVEL:
194 		if (blen < sizeof(sys_time_prot_lvl))
195 			return TEE_ERROR_SHORT_BUFFER;
196 		return tee_svc_copy_to_user(sess, (void *)buf,
197 					    &sys_time_prot_lvl,
198 					    sizeof(sys_time_prot_lvl));
199 
200 	case UTEE_PROP_TEE_TA_TIME_PROT_LEVEL:
201 		if (blen < sizeof(ta_time_prot_lvl))
202 			return TEE_ERROR_SHORT_BUFFER;
203 		return tee_svc_copy_to_user(sess, (void *)buf,
204 					    &ta_time_prot_lvl,
205 					    sizeof(ta_time_prot_lvl));
206 
207 	case UTEE_PROP_CLIENT_ID:
208 		{
209 			if (blen < sizeof(TEE_Identity))
210 				return TEE_ERROR_SHORT_BUFFER;
211 
212 			return tee_svc_copy_to_user(sess, (void *)buf,
213 						    &sess->clnt_id,
214 						    sizeof(TEE_Identity));
215 		}
216 	case UTEE_PROP_TA_APP_ID:
217 		{
218 			if (blen < sizeof(TEE_UUID))
219 				return TEE_ERROR_SHORT_BUFFER;
220 
221 			return tee_svc_copy_to_user(sess, (void *)buf,
222 						    &sess->ctx->head->uuid,
223 						    sizeof(TEE_UUID));
224 		}
225 
226 	default:
227 		break;
228 	}
229 	return TEE_ERROR_NOT_IMPLEMENTED;
230 }
231 
232 /*
233  * TA invokes some TA with parameter.
234  * If some parameters are memory references:
235  * - either the memref is inside TA private RAM: TA is not allowed to expose
236  *   its private RAM: use a temporary memory buffer and copy the data.
237  * - or the memref is not in the TA private RAM:
238  *   - if the memref was mapped to the TA, TA is allowed to expose it.
239  *   - if so, converts memref virtual address into a physical address.
240  */
241 static TEE_Result tee_svc_copy_param(struct tee_ta_session *sess,
242 				     struct tee_ta_session *called_sess,
243 				     uint32_t param_types,
244 				     TEE_Param callee_params[TEE_NUM_PARAMS],
245 				     struct tee_ta_param *param,
246 				     tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
247 				     tee_mm_entry_t **mm)
248 {
249 	size_t n;
250 	TEE_Result res;
251 	size_t req_mem = 0;
252 	size_t s;
253 	uint8_t *dst = 0;
254 	tee_paddr_t dst_pa, src_pa = 0;
255 	bool ta_private_memref[TEE_NUM_PARAMS];
256 
257 	/* fill 'param' input struct with caller params description buffer */
258 	param->types = param_types;
259 	if (!callee_params) {
260 		if (param->types != 0)
261 			return TEE_ERROR_BAD_PARAMETERS;
262 		memset(param->params, 0, sizeof(param->params));
263 	} else {
264 		tee_svc_copy_from_user(sess, param->params, callee_params,
265 				       sizeof(param->params));
266 	}
267 
268 	if ((called_sess != NULL) &&
269 		(called_sess->ctx->static_ta == NULL) &&
270 		(called_sess->ctx->flags & TA_FLAG_USER_MODE) == 0) {
271 		/*
272 		 * kernel TA, borrow the mapping of the calling
273 		 * during this call.
274 		 */
275 		called_sess->calling_sess = sess;
276 		return TEE_SUCCESS;
277 	}
278 
279 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
280 
281 		ta_private_memref[n] = false;
282 
283 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
284 		case TEE_PARAM_TYPE_MEMREF_INPUT:
285 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
286 		case TEE_PARAM_TYPE_MEMREF_INOUT:
287 			if (param->params[n].memref.buffer == NULL) {
288 				if (param->params[n].memref.size != 0)
289 					return TEE_ERROR_BAD_PARAMETERS;
290 				break;
291 			}
292 			/* uTA cannot expose its private memory */
293 			if (tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
294 				    param->params[n].memref.buffer,
295 				    param->params[n].memref.size)) {
296 
297 				s = ROUNDUP(param->params[n].memref.size,
298 						sizeof(uint32_t));
299 				/* Check overflow */
300 				if (req_mem + s < req_mem)
301 					return TEE_ERROR_BAD_PARAMETERS;
302 				req_mem += s;
303 				ta_private_memref[n] = true;
304 				break;
305 			}
306 			if (tee_mmu_is_vbuf_intersect_ta_private(sess->ctx,
307 				    param->params[n].memref.buffer,
308 				    param->params[n].memref.size))
309 				return TEE_ERROR_BAD_PARAMETERS;
310 
311 			if (tee_mmu_user_va2pa(sess->ctx,
312 					(void *)param->params[n].memref.buffer,
313 					&src_pa) != TEE_SUCCESS)
314 				return TEE_ERROR_BAD_PARAMETERS;
315 
316 			param->param_attr[n] = tee_mmu_user_get_cache_attr(
317 				sess->ctx,
318 				(void *)param->params[n].memref.buffer);
319 
320 			param->params[n].memref.buffer = (void *)src_pa;
321 			break;
322 
323 		default:
324 			break;
325 		}
326 	}
327 
328 	if (req_mem == 0)
329 		return TEE_SUCCESS;
330 
331 	/* Allocate section in secure DDR */
332 	*mm = tee_mm_alloc(&tee_mm_sec_ddr, req_mem);
333 	if (*mm == NULL) {
334 		DMSG("tee_mm_alloc TEE_ERROR_GENERIC");
335 		return TEE_ERROR_GENERIC;
336 	}
337 
338 	/* Get the virtual address for the section in secure DDR */
339 	res = tee_mmu_kmap(tee_mm_get_smem(*mm), req_mem, &dst);
340 	if (res != TEE_SUCCESS)
341 		return res;
342 	dst_pa = tee_mm_get_smem(*mm);
343 
344 	for (n = 0; n < 4; n++) {
345 
346 		if (ta_private_memref[n] == false)
347 			continue;
348 
349 		s = ROUNDUP(param->params[n].memref.size, sizeof(uint32_t));
350 
351 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
352 		case TEE_PARAM_TYPE_MEMREF_INPUT:
353 		case TEE_PARAM_TYPE_MEMREF_INOUT:
354 			if (param->params[n].memref.buffer != NULL) {
355 				res = tee_svc_copy_from_user(sess, dst,
356 						param->params[n].memref.buffer,
357 						param->params[n].memref.size);
358 				if (res != TEE_SUCCESS)
359 					return res;
360 				param->param_attr[n] =
361 					tee_mmu_kmap_get_cache_attr(dst);
362 				param->params[n].memref.buffer = (void *)dst_pa;
363 				tmp_buf_pa[n] = dst_pa;
364 				dst += s;
365 				dst_pa += s;
366 			}
367 			break;
368 
369 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
370 			if (param->params[n].memref.buffer != NULL) {
371 				param->param_attr[n] =
372 					tee_mmu_kmap_get_cache_attr(dst);
373 				param->params[n].memref.buffer = (void *)dst_pa;
374 				tmp_buf_pa[n] = dst_pa;
375 				dst += s;
376 				dst_pa += s;
377 			}
378 			break;
379 
380 		default:
381 			continue;
382 		}
383 	}
384 
385 	tee_mmu_kunmap(dst, req_mem);
386 
387 	return TEE_SUCCESS;
388 }
389 
390 /*
391  * Back from execution of service: update parameters passed from TA:
392  * If some parameters were memory references:
393  * - either the memref was temporary: copy back data and update size
394  * - or it was the original TA memref: update only the size value.
395  */
396 static TEE_Result tee_svc_update_out_param(
397 		struct tee_ta_session *sess,
398 		struct tee_ta_session *called_sess,
399 		struct tee_ta_param *param,
400 		tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS],
401 		TEE_Param callee_params[TEE_NUM_PARAMS])
402 {
403 	size_t n;
404 	bool have_private_mem_map = (called_sess == NULL) ||
405 		(called_sess->ctx->static_ta != NULL) ||
406 		((called_sess->ctx->flags & TA_FLAG_USER_MODE) != 0);
407 
408 	tee_ta_set_current_session(sess);
409 
410 	for (n = 0; n < TEE_NUM_PARAMS; n++) {
411 		switch (TEE_PARAM_TYPE_GET(param->types, n)) {
412 		case TEE_PARAM_TYPE_MEMREF_OUTPUT:
413 		case TEE_PARAM_TYPE_MEMREF_INOUT:
414 
415 			/* outside TA private => memref is valid, update size */
416 			if (!tee_mmu_is_vbuf_inside_ta_private(sess->ctx,
417 					callee_params[n].memref.buffer,
418 					param->params[n].memref.size)) {
419 				callee_params[n].memref.size =
420 					param->params[n].memref.size;
421 				break;
422 			}
423 
424 			/*
425 			 * If we called a kernel TA the parameters are in shared
426 			 * memory and no copy is needed.
427 			 */
428 			if (have_private_mem_map &&
429 			    param->params[n].memref.size <=
430 			    callee_params[n].memref.size) {
431 				uint8_t *src = 0;
432 				TEE_Result res;
433 
434 				/* FIXME: TA_RAM is already mapped ! */
435 				res = tee_mmu_kmap(tmp_buf_pa[n],
436 					param->params[n].memref.size, &src);
437 				if (res != TEE_SUCCESS)
438 					return TEE_ERROR_GENERIC;
439 
440 				res = tee_svc_copy_to_user(sess,
441 							 callee_params[n].memref.
442 							 buffer, src,
443 							 param->params[n].
444 							 memref.size);
445 				if (res != TEE_SUCCESS)
446 					return res;
447 				tee_mmu_kunmap(src,
448 					       param->params[n].memref.size);
449 
450 			}
451 			callee_params[n].memref.size = param->params[n].memref.size;
452 			break;
453 
454 		case TEE_PARAM_TYPE_VALUE_OUTPUT:
455 		case TEE_PARAM_TYPE_VALUE_INOUT:
456 			callee_params[n].value = param->params[n].value;
457 			break;
458 
459 		default:
460 			continue;
461 		}
462 	}
463 
464 	return TEE_SUCCESS;
465 }
466 
467 /* Called when a TA calls an OpenSession on another TA */
468 TEE_Result tee_svc_open_ta_session(const TEE_UUID *dest,
469 				   uint32_t cancel_req_to, uint32_t param_types,
470 				   TEE_Param params[4],
471 				   TEE_TASessionHandle *ta_sess,
472 				   uint32_t *ret_orig)
473 {
474 	TEE_Result res;
475 	uint32_t ret_o = TEE_ORIGIN_TEE;
476 	struct tee_ta_session *s = NULL;
477 	struct tee_ta_session *sess;
478 	tee_mm_entry_t *mm_param = NULL;
479 
480 	TEE_UUID *uuid = malloc(sizeof(TEE_UUID));
481 	struct tee_ta_param *param = malloc(sizeof(struct tee_ta_param));
482 	TEE_Identity *clnt_id = malloc(sizeof(TEE_Identity));
483 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
484 
485 	if (uuid == NULL || param == NULL || clnt_id == NULL) {
486 		res = TEE_ERROR_OUT_OF_MEMORY;
487 		goto out_free_only;
488 	}
489 
490 	memset(param, 0, sizeof(struct tee_ta_param));
491 
492 	res = tee_ta_get_current_session(&sess);
493 	if (res != TEE_SUCCESS)
494 		goto out_free_only;
495 
496 	res = tee_svc_copy_from_user(sess, uuid, dest, sizeof(TEE_UUID));
497 	if (res != TEE_SUCCESS)
498 		goto function_exit;
499 
500 	clnt_id->login = TEE_LOGIN_TRUSTED_APP;
501 	memcpy(&clnt_id->uuid, &sess->ctx->head->uuid, sizeof(TEE_UUID));
502 
503 	res = tee_svc_copy_param(sess, NULL, param_types, params, param,
504 				 tmp_buf_pa, &mm_param);
505 	if (res != TEE_SUCCESS)
506 		goto function_exit;
507 
508 	/*
509 	 * Find session of a multi session TA or a static TA
510 	 * In such a case, there is no need to ask the supplicant for the TA
511 	 * code
512 	 */
513 	res = tee_ta_open_session(&ret_o, &s, &sess->ctx->open_sessions, uuid,
514 				  clnt_id, cancel_req_to, param);
515 	if (res != TEE_SUCCESS)
516 		goto function_exit;
517 
518 	res = tee_svc_update_out_param(sess, NULL, param, tmp_buf_pa, params);
519 
520 function_exit:
521 	tee_ta_set_current_session(sess);
522 
523 	if (mm_param != NULL) {
524 		TEE_Result res2;
525 		void *va = 0;
526 
527 		res2 =
528 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
529 		if (res2 == TEE_SUCCESS)
530 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
531 	}
532 	tee_mm_free(mm_param);
533 	tee_svc_copy_to_user(sess, ta_sess, &s, sizeof(s));
534 	tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
535 
536 out_free_only:
537 	free(param);
538 	free(uuid);
539 	free(clnt_id);
540 	return res;
541 }
542 
543 TEE_Result tee_svc_close_ta_session(TEE_TASessionHandle ta_sess)
544 {
545 	TEE_Result res;
546 	struct tee_ta_session *sess;
547 
548 	res = tee_ta_get_current_session(&sess);
549 	if (res != TEE_SUCCESS)
550 		return res;
551 
552 	tee_ta_set_current_session(NULL);
553 
554 	res =
555 	    tee_ta_close_session((uint32_t)ta_sess, &sess->ctx->open_sessions);
556 	tee_ta_set_current_session(sess);
557 	return res;
558 }
559 
560 TEE_Result tee_svc_invoke_ta_command(TEE_TASessionHandle ta_sess,
561 				     uint32_t cancel_req_to, uint32_t cmd_id,
562 				     uint32_t param_types, TEE_Param params[4],
563 				     uint32_t *ret_orig)
564 {
565 	TEE_Result res;
566 	uint32_t ret_o = TEE_ORIGIN_TEE;
567 	struct tee_ta_param param = { 0 };
568 	struct tee_ta_session *sess;
569 	struct tee_ta_session *called_sess = (struct tee_ta_session *)ta_sess;
570 	tee_mm_entry_t *mm_param = NULL;
571 	tee_paddr_t tmp_buf_pa[TEE_NUM_PARAMS];
572 
573 	res = tee_ta_get_current_session(&sess);
574 	if (res != TEE_SUCCESS)
575 		return res;
576 
577 	res =
578 	    tee_ta_verify_session_pointer(called_sess,
579 					  &sess->ctx->open_sessions);
580 	if (res != TEE_SUCCESS)
581 		return res;
582 
583 	res = tee_svc_copy_param(sess, called_sess, param_types, params,
584 				 &param, tmp_buf_pa, &mm_param);
585 	if (res != TEE_SUCCESS)
586 		goto function_exit;
587 
588 	res =
589 	    tee_ta_invoke_command(&ret_o, called_sess, cancel_req_to,
590 				  cmd_id, &param);
591 	if (res != TEE_SUCCESS)
592 		goto function_exit;
593 
594 	res = tee_svc_update_out_param(sess, called_sess, &param, tmp_buf_pa,
595 				       params);
596 	if (res != TEE_SUCCESS)
597 		goto function_exit;
598 
599 function_exit:
600 	tee_ta_set_current_session(sess);
601 	called_sess->calling_sess = NULL; /* clear eventual borrowed mapping */
602 
603 	if (mm_param != NULL) {
604 		TEE_Result res2;
605 		void *va = 0;
606 
607 		res2 =
608 		    tee_mmu_kmap_pa2va((void *)tee_mm_get_smem(mm_param), &va);
609 		if (res2 == TEE_SUCCESS)
610 			tee_mmu_kunmap(va, tee_mm_get_bytes(mm_param));
611 	}
612 	tee_mm_free(mm_param);
613 	if (ret_orig)
614 		tee_svc_copy_to_user(sess, ret_orig, &ret_o, sizeof(ret_o));
615 	return res;
616 }
617 
618 TEE_Result tee_svc_check_access_rights(uint32_t flags, const void *buf,
619 				       size_t len)
620 {
621 	TEE_Result res;
622 	struct tee_ta_session *s;
623 
624 	res = tee_ta_get_current_session(&s);
625 	if (res != TEE_SUCCESS)
626 		return res;
627 
628 	return tee_mmu_check_access_rights(s->ctx, flags, (tee_uaddr_t)buf,
629 					   len);
630 }
631 
632 TEE_Result tee_svc_copy_from_user(struct tee_ta_session *sess, void *kaddr,
633 				  const void *uaddr, size_t len)
634 {
635 	TEE_Result res;
636 	struct tee_ta_session *s;
637 
638 	if (sess == NULL) {
639 		res = tee_ta_get_current_session(&s);
640 		if (res != TEE_SUCCESS)
641 			return res;
642 	} else {
643 		s = sess;
644 		tee_ta_set_current_session(s);
645 	}
646 	res =
647 	    tee_mmu_check_access_rights(s->ctx,
648 					TEE_MEMORY_ACCESS_READ |
649 					TEE_MEMORY_ACCESS_ANY_OWNER,
650 					(tee_uaddr_t)uaddr, len);
651 	if (res != TEE_SUCCESS)
652 		return res;
653 
654 	memcpy(kaddr, uaddr, len);
655 	return TEE_SUCCESS;
656 }
657 
658 TEE_Result tee_svc_copy_to_user(struct tee_ta_session *sess, void *uaddr,
659 				const void *kaddr, size_t len)
660 {
661 	TEE_Result res;
662 	struct tee_ta_session *s;
663 
664 	if (sess == NULL) {
665 		res = tee_ta_get_current_session(&s);
666 		if (res != TEE_SUCCESS)
667 			return res;
668 	} else {
669 		s = sess;
670 		tee_ta_set_current_session(s);
671 	}
672 
673 	res =
674 	    tee_mmu_check_access_rights(s->ctx,
675 					TEE_MEMORY_ACCESS_WRITE |
676 					TEE_MEMORY_ACCESS_ANY_OWNER,
677 					(tee_uaddr_t)uaddr, len);
678 	if (res != TEE_SUCCESS)
679 		return res;
680 
681 	memcpy(uaddr, kaddr, len);
682 	return TEE_SUCCESS;
683 }
684 
685 static bool session_is_cancelled(struct tee_ta_session *s, TEE_Time *curr_time)
686 {
687 	TEE_Time current_time;
688 
689 	if (s->cancel_mask)
690 		return false;
691 
692 	if (s->cancel)
693 		return true;
694 
695 	if (s->cancel_time.seconds == UINT32_MAX)
696 		return false;
697 
698 	if (curr_time != NULL)
699 		current_time = *curr_time;
700 	else if (tee_time_get_sys_time(&current_time) != TEE_SUCCESS)
701 		return false;
702 
703 	if (current_time.seconds > s->cancel_time.seconds ||
704 	    (current_time.seconds == s->cancel_time.seconds &&
705 	     current_time.millis >= s->cancel_time.millis)) {
706 		return true;
707 	}
708 
709 	return false;
710 }
711 
712 TEE_Result tee_svc_get_cancellation_flag(bool *cancel)
713 {
714 	TEE_Result res;
715 	struct tee_ta_session *s = NULL;
716 	bool c;
717 
718 	res = tee_ta_get_current_session(&s);
719 	if (res != TEE_SUCCESS)
720 		return res;
721 
722 	c = session_is_cancelled(s, NULL);
723 
724 	return tee_svc_copy_to_user(s, cancel, &c, sizeof(c));
725 }
726 
727 TEE_Result tee_svc_unmask_cancellation(bool *old_mask)
728 {
729 	TEE_Result res;
730 	struct tee_ta_session *s = NULL;
731 	bool m;
732 
733 	res = tee_ta_get_current_session(&s);
734 	if (res != TEE_SUCCESS)
735 		return res;
736 
737 	m = s->cancel_mask;
738 	s->cancel_mask = false;
739 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
740 }
741 
742 TEE_Result tee_svc_mask_cancellation(bool *old_mask)
743 {
744 	TEE_Result res;
745 	struct tee_ta_session *s = NULL;
746 	bool m;
747 
748 	res = tee_ta_get_current_session(&s);
749 	if (res != TEE_SUCCESS)
750 		return res;
751 
752 	m = s->cancel_mask;
753 	s->cancel_mask = true;
754 	return tee_svc_copy_to_user(s, old_mask, &m, sizeof(m));
755 }
756 
757 TEE_Result tee_svc_wait(uint32_t timeout)
758 {
759 	TEE_Result res = TEE_SUCCESS;
760 	uint32_t mytime = 0;
761 	struct tee_ta_session *s;
762 	TEE_Time base_time;
763 	TEE_Time current_time;
764 
765 	res = tee_ta_get_current_session(&s);
766 	if (res != TEE_SUCCESS)
767 		return res;
768 
769 	res = tee_time_get_sys_time(&base_time);
770 	if (res != TEE_SUCCESS)
771 		return res;
772 
773 	while (true) {
774 		res = tee_time_get_sys_time(&current_time);
775 		if (res != TEE_SUCCESS)
776 			return res;
777 
778 		if (session_is_cancelled(s, &current_time))
779 			return TEE_ERROR_CANCEL;
780 
781 		mytime = (current_time.seconds - base_time.seconds) * 1000 +
782 		    (int)current_time.millis - (int)base_time.millis;
783 		if (mytime >= timeout)
784 			return TEE_SUCCESS;
785 
786 		tee_time_wait(timeout - mytime);
787 	}
788 
789 	return res;
790 }
791 
792 TEE_Result tee_svc_get_time(enum utee_time_category cat, TEE_Time *mytime)
793 {
794 	TEE_Result res, res2;
795 	struct tee_ta_session *s = NULL;
796 	TEE_Time t;
797 
798 	res = tee_ta_get_current_session(&s);
799 	if (res != TEE_SUCCESS)
800 		return res;
801 
802 	switch (cat) {
803 	case UTEE_TIME_CAT_SYSTEM:
804 		res = tee_time_get_sys_time(&t);
805 		break;
806 	case UTEE_TIME_CAT_TA_PERSISTENT:
807 		res =
808 		    tee_time_get_ta_time((const void *)&s->ctx->head->uuid, &t);
809 		break;
810 	case UTEE_TIME_CAT_REE:
811 		res = tee_time_get_ree_time(&t);
812 		break;
813 	default:
814 		res = TEE_ERROR_BAD_PARAMETERS;
815 		break;
816 	}
817 
818 	if (res == TEE_SUCCESS || res == TEE_ERROR_OVERFLOW) {
819 		res2 = tee_svc_copy_to_user(s, mytime, &t, sizeof(t));
820 		if (res2 != TEE_SUCCESS)
821 			res = res2;
822 	}
823 
824 	return res;
825 }
826 
827 TEE_Result tee_svc_set_ta_time(const TEE_Time *mytime)
828 {
829 	TEE_Result res;
830 	struct tee_ta_session *s = NULL;
831 	TEE_Time t;
832 
833 	res = tee_ta_get_current_session(&s);
834 	if (res != TEE_SUCCESS)
835 		return res;
836 
837 	res = tee_svc_copy_from_user(s, &t, mytime, sizeof(t));
838 	if (res != TEE_SUCCESS)
839 		return res;
840 
841 	return tee_time_set_ta_time((const void *)&s->ctx->head->uuid, &t);
842 }
843