1 // SPDX-License-Identifier: BSD-2-Clause
2 /*
3 * Copyright (c) 2014, STMicroelectronics International N.V.
4 * Copyright (c) 2020, Linaro Limited
5 */
6
7 #include <compiler.h>
8 #include <kernel/chip_services.h>
9 #include <kernel/pseudo_ta.h>
10 #include <kernel/tee_common.h>
11 #include <kernel/tee_common_otp.h>
12 #include <kernel/tee_ta_manager.h>
13 #include <kernel/tee_time.h>
14 #include <kernel/trace_ta.h>
15 #include <kernel/user_access.h>
16 #include <mm/core_memprot.h>
17 #include <mm/mobj.h>
18 #include <mm/tee_mm.h>
19 #include <mm/vm.h>
20 #include <stdlib_ext.h>
21 #include <tee_api_types.h>
22 #include <tee/tee_cryp_utl.h>
23 #include <tee/tee_svc.h>
24 #include <trace.h>
25 #include <user_ta_header.h>
26 #include <utee_types.h>
27 #include <util.h>
28
29 vaddr_t tee_svc_uref_base;
30
syscall_log(const void * buf __maybe_unused,size_t len __maybe_unused)31 void syscall_log(const void *buf __maybe_unused, size_t len __maybe_unused)
32 {
33 #ifdef CFG_TEE_CORE_TA_TRACE
34 char *kbuf;
35
36 if (len == 0)
37 return;
38
39 kbuf = malloc(len + 1);
40 if (kbuf == NULL)
41 return;
42
43 if (copy_from_user(kbuf, buf, len) == TEE_SUCCESS) {
44 kbuf[len] = '\0';
45 trace_ext_puts(kbuf);
46 }
47
48 free_wipe(kbuf);
49 #endif
50 }
51
syscall_not_supported(void)52 TEE_Result syscall_not_supported(void)
53 {
54 return TEE_ERROR_NOT_SUPPORTED;
55 }
56
57 /* Configuration properties */
58 /* API implementation version */
59 static const char api_vers[] = TO_STR(CFG_TEE_API_VERSION);
60
61 /* Implementation description (implementation-dependent) */
62 static const char descr[] = TO_STR(CFG_TEE_IMPL_DESCR);
63
64 /*
65 * TA persistent time protection level
66 * 100: Persistent time based on an REE-controlled real-time clock
67 * and on the TEE Trusted Storage for the storage of origins (default).
68 * 1000: Persistent time based on a TEE-controlled real-time clock
69 * and the TEE Trusted Storage.
70 * The real-time clock MUST be out of reach of software attacks
71 * from the REE.
72 */
73 static const uint32_t ta_time_prot_lvl = 100;
74
75 /* Elliptic Curve Cryptographic support */
76 #ifdef CFG_CRYPTO_ECC
77 static const bool crypto_ecc_en = 1;
78 #else
79 static const bool crypto_ecc_en;
80 #endif
81
82 /*
83 * Trusted storage anti rollback protection level
84 * 0 (or missing): No antirollback protection (default)
85 * 100: Antirollback enforced at REE level
86 * 1000: Antirollback TEE-controlled hardware
87 */
88 #ifdef CFG_RPMB_FS
89 static const uint32_t ts_antiroll_prot_lvl = 1000;
90 #else
91 static const uint32_t ts_antiroll_prot_lvl;
92 #endif
93
94 /* Trusted OS implementation version */
95 static const char trustedos_impl_version[] = TO_STR(TEE_IMPL_VERSION);
96
97 /* Trusted OS implementation version (binary value) */
98 static const uint32_t trustedos_impl_bin_version; /* 0 by default */
99
100 /* Trusted OS implementation manufacturer name */
101 static const char trustedos_manufacturer[] = TO_STR(CFG_TEE_MANUFACTURER);
102
103 /* Trusted firmware version */
104 static const char fw_impl_version[] = TO_STR(CFG_TEE_FW_IMPL_VERSION);
105
106 /* Trusted firmware version (binary value) */
107 static const uint32_t fw_impl_bin_version; /* 0 by default */
108
109 /* Trusted firmware manufacturer name */
110 static const char fw_manufacturer[] = TO_STR(CFG_TEE_FW_MANUFACTURER);
111
get_prop_tee_dev_id(struct ts_session * sess __unused,void * buf,size_t * blen)112 static TEE_Result get_prop_tee_dev_id(struct ts_session *sess __unused,
113 void *buf, size_t *blen)
114 {
115 TEE_Result res;
116 TEE_UUID uuid;
117 const size_t nslen = 5;
118 uint8_t data[5 + FVR_DIE_ID_NUM_REGS * sizeof(uint32_t)] = {
119 'O', 'P', 'T', 'E', 'E' };
120
121 if (*blen < sizeof(uuid)) {
122 *blen = sizeof(uuid);
123 return TEE_ERROR_SHORT_BUFFER;
124 }
125 *blen = sizeof(uuid);
126
127 if (tee_otp_get_die_id(data + nslen, sizeof(data) - nslen))
128 return TEE_ERROR_BAD_STATE;
129
130 res = tee_hash_createdigest(TEE_ALG_SHA256, data, sizeof(data),
131 (uint8_t *)&uuid, sizeof(uuid));
132 if (res != TEE_SUCCESS)
133 return TEE_ERROR_BAD_STATE;
134
135 /*
136 * Changes the random value into and UUID as specifiec
137 * in RFC 4122. The magic values are from the example
138 * code in the RFC.
139 *
140 * TEE_UUID is defined slightly different from the RFC,
141 * but close enough for our purpose.
142 */
143
144 uuid.timeHiAndVersion &= 0x0fff;
145 uuid.timeHiAndVersion |= 5 << 12;
146
147 /* uuid.clock_seq_hi_and_reserved in the RFC */
148 uuid.clockSeqAndNode[0] &= 0x3f;
149 uuid.clockSeqAndNode[0] |= 0x80;
150
151 return copy_to_user(buf, &uuid, sizeof(TEE_UUID));
152 }
153
154 static TEE_Result
get_prop_tee_sys_time_prot_level(struct ts_session * sess __unused,void * buf,size_t * blen)155 get_prop_tee_sys_time_prot_level(struct ts_session *sess __unused,
156 void *buf, size_t *blen)
157 {
158 uint32_t prot;
159
160 if (*blen < sizeof(prot)) {
161 *blen = sizeof(prot);
162 return TEE_ERROR_SHORT_BUFFER;
163 }
164 *blen = sizeof(prot);
165 prot = tee_time_get_sys_time_protection_level();
166 return copy_to_user(buf, &prot, sizeof(prot));
167 }
168
get_prop_client_id(struct ts_session * sess,void * buf,size_t * blen)169 static TEE_Result get_prop_client_id(struct ts_session *sess,
170 void *buf, size_t *blen)
171 {
172 if (*blen < sizeof(TEE_Identity)) {
173 *blen = sizeof(TEE_Identity);
174 return TEE_ERROR_SHORT_BUFFER;
175 }
176 *blen = sizeof(TEE_Identity);
177 return copy_to_user(buf, &to_ta_session(sess)->clnt_id,
178 sizeof(TEE_Identity));
179 }
180
get_prop_ta_app_id(struct ts_session * sess,void * buf,size_t * blen)181 static TEE_Result get_prop_ta_app_id(struct ts_session *sess,
182 void *buf, size_t *blen)
183 {
184 if (*blen < sizeof(TEE_UUID)) {
185 *blen = sizeof(TEE_UUID);
186 return TEE_ERROR_SHORT_BUFFER;
187 }
188 *blen = sizeof(TEE_UUID);
189 return copy_to_user(buf, &sess->ctx->uuid, sizeof(TEE_UUID));
190 }
191
192 #ifdef CFG_TA_BTI
193 static TEE_Result
get_prop_feat_bti_implemented(struct ts_session * sess __unused,void * buf,size_t * blen)194 get_prop_feat_bti_implemented(struct ts_session *sess __unused, void *buf,
195 size_t *blen)
196 {
197 bool bti_impl = false;
198
199 if (*blen < sizeof(bti_impl)) {
200 *blen = sizeof(bti_impl);
201 return TEE_ERROR_SHORT_BUFFER;
202 }
203 *blen = sizeof(bti_impl);
204 bti_impl = feat_bti_is_implemented();
205
206 return copy_to_user(buf, &bti_impl, sizeof(bti_impl));
207 }
208 #endif
209
210 /* Properties of the set TEE_PROPSET_CURRENT_CLIENT */
211 const struct tee_props tee_propset_client[] = {
212 {
213 .name = "gpd.client.identity",
214 .prop_type = USER_TA_PROP_TYPE_IDENTITY,
215 .get_prop_func = get_prop_client_id
216 },
217 };
218
219 /* Properties of the set TEE_PROPSET_CURRENT_TA */
220 const struct tee_props tee_propset_ta[] = {
221 {
222 .name = "gpd.ta.appID",
223 .prop_type = USER_TA_PROP_TYPE_UUID,
224 .get_prop_func = get_prop_ta_app_id
225 },
226
227 /*
228 * Following properties are processed directly in libutee:
229 * TA_PROP_STR_SINGLE_INSTANCE
230 * TA_PROP_STR_MULTI_SESSION
231 * TA_PROP_STR_KEEP_ALIVE
232 * TA_PROP_STR_DATA_SIZE
233 * TA_PROP_STR_STACK_SIZE
234 * TA_PROP_STR_VERSION
235 * TA_PROP_STR_DESCRIPTION
236 * USER_TA_PROP_TYPE_STRING,
237 * TA_DESCRIPTION
238 */
239 };
240
241 /* Properties of the set TEE_PROPSET_TEE_IMPLEMENTATION */
242 const struct tee_props tee_propset_tee[] = {
243 {
244 .name = "gpd.tee.apiversion",
245 .prop_type = USER_TA_PROP_TYPE_STRING,
246 .data = api_vers,
247 .len = sizeof(api_vers),
248 },
249 {
250 .name = "gpd.tee.description",
251 .prop_type = USER_TA_PROP_TYPE_STRING,
252 .data = descr, .len = sizeof(descr)
253 },
254 {
255 .name = "gpd.tee.deviceID",
256 .prop_type = USER_TA_PROP_TYPE_UUID,
257 .get_prop_func = get_prop_tee_dev_id
258 },
259 {
260 .name = "gpd.tee.systemTime.protectionLevel",
261 .prop_type = USER_TA_PROP_TYPE_U32,
262 .get_prop_func = get_prop_tee_sys_time_prot_level
263 },
264 {
265 .name = "gpd.tee.TAPersistentTime.protectionLevel",
266 .prop_type = USER_TA_PROP_TYPE_U32,
267 .data = &ta_time_prot_lvl,
268 .len = sizeof(ta_time_prot_lvl)
269 },
270 {
271 .name = "gpd.tee.cryptography.ecc",
272 .prop_type = USER_TA_PROP_TYPE_BOOL,
273 .data = &crypto_ecc_en,
274 .len = sizeof(crypto_ecc_en)
275 },
276 {
277 .name = "gpd.tee.trustedStorage.antiRollback.protectionLevel",
278 .prop_type = USER_TA_PROP_TYPE_U32,
279 .data = &ts_antiroll_prot_lvl,
280 .len = sizeof(ts_antiroll_prot_lvl)
281 },
282 {
283 .name = "gpd.tee.trustedos.implementation.version",
284 .prop_type = USER_TA_PROP_TYPE_STRING,
285 .data = trustedos_impl_version,
286 .len = sizeof(trustedos_impl_version)
287 },
288 {
289 .name = "gpd.tee.trustedos.implementation.binaryversion",
290 .prop_type = USER_TA_PROP_TYPE_U32,
291 .data = &trustedos_impl_bin_version,
292 .len = sizeof(trustedos_impl_bin_version)
293 },
294 {
295 .name = "gpd.tee.trustedos.manufacturer",
296 .prop_type = USER_TA_PROP_TYPE_STRING,
297 .data = trustedos_manufacturer,
298 .len = sizeof(trustedos_manufacturer)
299 },
300 {
301 .name = "gpd.tee.firmware.implementation.version",
302 .prop_type = USER_TA_PROP_TYPE_STRING,
303 .data = fw_impl_version,
304 .len = sizeof(fw_impl_version)
305 },
306 {
307 .name = "gpd.tee.firmware.implementation.binaryversion",
308 .prop_type = USER_TA_PROP_TYPE_U32,
309 .data = &fw_impl_bin_version,
310 .len = sizeof(fw_impl_bin_version)
311 },
312 {
313 .name = "gpd.tee.firmware.manufacturer",
314 .prop_type = USER_TA_PROP_TYPE_STRING,
315 .data = fw_manufacturer,
316 .len = sizeof(fw_manufacturer)
317 },
318 #ifdef CFG_TA_BTI
319 {
320 .name = "org.trustedfirmware.optee.cpu.feat_bti_implemented",
321 .prop_type = USER_TA_PROP_TYPE_BOOL,
322 .get_prop_func = get_prop_feat_bti_implemented
323 },
324 #endif
325
326 /*
327 * Following properties are processed directly in libutee:
328 * gpd.tee.arith.maxBigIntSize
329 */
330 };
331
332 __weak const struct tee_vendor_props vendor_props_client;
333 __weak const struct tee_vendor_props vendor_props_ta;
334 __weak const struct tee_vendor_props vendor_props_tee;
335
get_prop_set(unsigned long prop_set,const struct tee_props ** props,size_t * size,const struct tee_props ** vendor_props,size_t * vendor_size)336 static void get_prop_set(unsigned long prop_set,
337 const struct tee_props **props,
338 size_t *size,
339 const struct tee_props **vendor_props,
340 size_t *vendor_size)
341 {
342 if ((TEE_PropSetHandle)prop_set == TEE_PROPSET_CURRENT_CLIENT) {
343 *props = tee_propset_client;
344 *size = ARRAY_SIZE(tee_propset_client);
345 *vendor_props = vendor_props_client.props;
346 *vendor_size = vendor_props_client.len;
347 } else if ((TEE_PropSetHandle)prop_set == TEE_PROPSET_CURRENT_TA) {
348 *props = tee_propset_ta;
349 *size = ARRAY_SIZE(tee_propset_ta);
350 *vendor_props = vendor_props_ta.props;
351 *vendor_size = vendor_props_ta.len;
352 } else if ((TEE_PropSetHandle)prop_set ==
353 TEE_PROPSET_TEE_IMPLEMENTATION) {
354 *props = tee_propset_tee;
355 *size = ARRAY_SIZE(tee_propset_tee);
356 *vendor_props = vendor_props_tee.props;
357 *vendor_size = vendor_props_tee.len;
358 } else {
359 *props = NULL;
360 *size = 0;
361 *vendor_props = NULL;
362 *vendor_size = 0;
363 }
364 }
365
get_prop_struct(unsigned long prop_set,unsigned long index)366 static const struct tee_props *get_prop_struct(unsigned long prop_set,
367 unsigned long index)
368 {
369 const struct tee_props *props;
370 const struct tee_props *vendor_props;
371 size_t size;
372 size_t vendor_size;
373
374 get_prop_set(prop_set, &props, &size, &vendor_props, &vendor_size);
375
376 if (index < size)
377 return &(props[index]);
378 index -= size;
379
380 if (index < vendor_size)
381 return &(vendor_props[index]);
382
383 return NULL;
384 }
385
386 /*
387 * prop_set is part of TEE_PROPSET_xxx
388 * index is the index in the Property Set to retrieve
389 * if name is not NULL, the name of "index" property is returned
390 * if buf is not NULL, the property is returned
391 */
syscall_get_property(unsigned long prop_set,unsigned long index,void * name,uint32_t * name_len,void * buf,uint32_t * blen,uint32_t * prop_type)392 TEE_Result syscall_get_property(unsigned long prop_set,
393 unsigned long index,
394 void *name, uint32_t *name_len,
395 void *buf, uint32_t *blen,
396 uint32_t *prop_type)
397 {
398 struct ts_session *sess = ts_get_current_session();
399 TEE_Result res = TEE_SUCCESS;
400 TEE_Result res2 = TEE_SUCCESS;
401 const struct tee_props *prop = NULL;
402 uint32_t klen = 0;
403 size_t klen_size = 0;
404 uint32_t elen = 0;
405
406 prop = get_prop_struct(prop_set, index);
407 if (!prop)
408 return TEE_ERROR_ITEM_NOT_FOUND;
409
410 /* Get the property type */
411 if (prop_type) {
412 res = copy_to_user(prop_type, &prop->prop_type,
413 sizeof(*prop_type));
414 if (res != TEE_SUCCESS)
415 return res;
416 }
417
418 /* Get the property */
419 if (buf && blen) {
420 res = copy_from_user(&klen, blen, sizeof(klen));
421 if (res != TEE_SUCCESS)
422 return res;
423
424 if (prop->get_prop_func) {
425 klen_size = klen;
426 res = prop->get_prop_func(sess, buf, &klen_size);
427 klen = klen_size;
428 res2 = copy_to_user(blen, &klen, sizeof(*blen));
429 } else {
430 if (klen < prop->len)
431 res = TEE_ERROR_SHORT_BUFFER;
432 else
433 res = copy_to_user(buf, prop->data, prop->len);
434 res2 = copy_to_user(blen, &prop->len, sizeof(*blen));
435 }
436 if (res2 != TEE_SUCCESS)
437 return res2;
438 if (res != TEE_SUCCESS)
439 return res;
440 }
441
442 /* Get the property name */
443 if (name && name_len) {
444 res = copy_from_user(&klen, name_len, sizeof(klen));
445 if (res != TEE_SUCCESS)
446 return res;
447
448 elen = strlen(prop->name) + 1;
449
450 if (klen < elen)
451 res = TEE_ERROR_SHORT_BUFFER;
452 else
453 res = copy_to_user(name, prop->name, elen);
454 res2 = copy_to_user(name_len, &elen, sizeof(*name_len));
455 if (res2 != TEE_SUCCESS)
456 return res2;
457 if (res != TEE_SUCCESS)
458 return res;
459 }
460
461 return res;
462 }
463
464 /*
465 * prop_set is part of TEE_PROPSET_xxx
466 */
syscall_get_property_name_to_index(unsigned long prop_set,void * name,unsigned long name_len,uint32_t * index)467 TEE_Result syscall_get_property_name_to_index(unsigned long prop_set,
468 void *name,
469 unsigned long name_len,
470 uint32_t *index)
471 {
472 TEE_Result res = TEE_SUCCESS;
473 const struct tee_props *props = NULL;
474 size_t size = 0;
475 const struct tee_props *vendor_props = NULL;
476 size_t vendor_size = 0;
477 char *kname = NULL;
478 uint32_t i = 0;
479
480 get_prop_set(prop_set, &props, &size, &vendor_props, &vendor_size);
481 if (!props)
482 return TEE_ERROR_ITEM_NOT_FOUND;
483
484 if (!name || !name_len) {
485 res = TEE_ERROR_BAD_PARAMETERS;
486 goto out;
487 }
488
489 kname = malloc(name_len);
490 if (!kname)
491 return TEE_ERROR_OUT_OF_MEMORY;
492 res = copy_from_user(kname, name, name_len);
493 if (res != TEE_SUCCESS)
494 goto out;
495 kname[name_len - 1] = 0;
496
497 res = TEE_ERROR_ITEM_NOT_FOUND;
498 for (i = 0; i < size; i++) {
499 if (!strcmp(kname, props[i].name)) {
500 res = copy_to_user(index, &i, sizeof(*index));
501 goto out;
502 }
503 }
504 for (i = size; i < size + vendor_size; i++) {
505 if (!strcmp(kname, vendor_props[i - size].name)) {
506 res = copy_to_user(index, &i, sizeof(*index));
507 goto out;
508 }
509 }
510
511 out:
512 free_wipe(kname);
513 return res;
514 }
515
utee_param_to_param(struct user_ta_ctx * utc,struct tee_ta_param * p,struct utee_params * up)516 static TEE_Result utee_param_to_param(struct user_ta_ctx *utc,
517 struct tee_ta_param *p,
518 struct utee_params *up)
519 {
520 size_t n = 0;
521 uint32_t types = up->types;
522
523 p->types = types;
524 for (n = 0; n < TEE_NUM_PARAMS; n++) {
525 uintptr_t a = up->vals[n * 2];
526 size_t b = up->vals[n * 2 + 1];
527 uint32_t flags = TEE_MEMORY_ACCESS_READ |
528 TEE_MEMORY_ACCESS_ANY_OWNER;
529
530 switch (TEE_PARAM_TYPE_GET(types, n)) {
531 case TEE_PARAM_TYPE_MEMREF_OUTPUT:
532 case TEE_PARAM_TYPE_MEMREF_INOUT:
533 flags |= TEE_MEMORY_ACCESS_WRITE;
534 fallthrough;
535 case TEE_PARAM_TYPE_MEMREF_INPUT:
536 p->u[n].mem.offs = a;
537 p->u[n].mem.size = b;
538
539 if (!p->u[n].mem.offs) {
540 /* Allow NULL memrefs if of size 0 */
541 if (p->u[n].mem.size)
542 return TEE_ERROR_BAD_PARAMETERS;
543 p->u[n].mem.mobj = NULL;
544 break;
545 }
546
547 p->u[n].mem.mobj = &mobj_virt;
548
549 if (vm_check_access_rights(&utc->uctx, flags, a, b))
550 return TEE_ERROR_ACCESS_DENIED;
551 break;
552 case TEE_PARAM_TYPE_VALUE_INPUT:
553 case TEE_PARAM_TYPE_VALUE_INOUT:
554 p->u[n].val.a = a;
555 p->u[n].val.b = b;
556 break;
557 default:
558 memset(&p->u[n], 0, sizeof(p->u[n]));
559 break;
560 }
561 }
562
563 return TEE_SUCCESS;
564 }
565
alloc_temp_sec_mem(size_t size,struct mobj ** mobj,uint8_t ** va)566 static TEE_Result alloc_temp_sec_mem(size_t size, struct mobj **mobj,
567 uint8_t **va)
568 {
569 struct mobj *m = NULL;
570 void *v = NULL;
571
572 /* Allocate section in secure DDR */
573 #ifdef CFG_PAGED_USER_TA
574 m = mobj_seccpy_shm_alloc(size);
575 #else
576 m = mobj_mm_alloc(mobj_sec_ddr, size, &tee_mm_sec_ddr);
577 #endif
578 if (!m)
579 return TEE_ERROR_GENERIC;
580
581 v = mobj_get_va(*mobj, 0, size);
582 if (!v) {
583 mobj_put(m);
584 return TEE_ERROR_GENERIC;
585 }
586
587 *mobj = m;
588 *va = v;
589 return TEE_SUCCESS;
590 }
591
592 /*
593 * TA invokes some TA with parameter.
594 * If some parameters are memory references:
595 * - either the memref is inside TA private RAM: TA is not allowed to expose
596 * its private RAM: use a temporary memory buffer and copy the data.
597 * - or the memref is not in the TA private RAM:
598 * - if the memref was mapped to the TA, TA is allowed to expose it.
599 * - if so, converts memref virtual address into a physical address.
600 */
tee_svc_copy_param(struct ts_session * sess,struct ts_session * called_sess,struct utee_params * callee_params,struct tee_ta_param * param,void * tmp_buf_va[TEE_NUM_PARAMS],size_t tmp_buf_size[TEE_NUM_PARAMS],struct mobj ** mobj_tmp)601 static TEE_Result tee_svc_copy_param(struct ts_session *sess,
602 struct ts_session *called_sess,
603 struct utee_params *callee_params,
604 struct tee_ta_param *param,
605 void *tmp_buf_va[TEE_NUM_PARAMS],
606 size_t tmp_buf_size[TEE_NUM_PARAMS],
607 struct mobj **mobj_tmp)
608 {
609 struct user_ta_ctx *utc = to_user_ta_ctx(sess->ctx);
610 bool ta_private_memref[TEE_NUM_PARAMS] = { false, };
611 TEE_Result res = TEE_SUCCESS;
612 size_t dst_offs = 0;
613 size_t req_mem = 0;
614 uint8_t *dst = 0;
615 void *va = NULL;
616 size_t n = 0;
617 size_t s = 0;
618
619 /* fill 'param' input struct with caller params description buffer */
620 if (!callee_params) {
621 memset(param, 0, sizeof(*param));
622 } else {
623 uint32_t flags = TEE_MEMORY_ACCESS_READ |
624 TEE_MEMORY_ACCESS_WRITE |
625 TEE_MEMORY_ACCESS_ANY_OWNER;
626
627 res = vm_check_access_rights(&utc->uctx, flags,
628 (uaddr_t)callee_params,
629 sizeof(struct utee_params));
630 if (res != TEE_SUCCESS)
631 return res;
632 res = utee_param_to_param(utc, param, callee_params);
633 if (res != TEE_SUCCESS)
634 return res;
635 }
636
637 if (called_sess && is_pseudo_ta_ctx(called_sess->ctx)) {
638 /* pseudo TA borrows the mapping of the calling TA */
639 return TEE_SUCCESS;
640 }
641
642 /* All mobj in param are of type MOJB_TYPE_VIRT */
643
644 for (n = 0; n < TEE_NUM_PARAMS; n++) {
645
646 ta_private_memref[n] = false;
647
648 switch (TEE_PARAM_TYPE_GET(param->types, n)) {
649 case TEE_PARAM_TYPE_MEMREF_INPUT:
650 case TEE_PARAM_TYPE_MEMREF_OUTPUT:
651 case TEE_PARAM_TYPE_MEMREF_INOUT:
652 va = (void *)param->u[n].mem.offs;
653 s = param->u[n].mem.size;
654 if (!va) {
655 if (s)
656 return TEE_ERROR_BAD_PARAMETERS;
657 break;
658 }
659 /* uTA cannot expose its private memory */
660 if (vm_buf_is_inside_um_private(&utc->uctx, va, s)) {
661 s = ROUNDUP(s, sizeof(uint32_t));
662 if (ADD_OVERFLOW(req_mem, s, &req_mem))
663 return TEE_ERROR_BAD_PARAMETERS;
664 ta_private_memref[n] = true;
665 break;
666 }
667
668 res = vm_buf_to_mboj_offs(&utc->uctx, va, s,
669 ¶m->u[n].mem.mobj,
670 ¶m->u[n].mem.offs);
671 if (res != TEE_SUCCESS)
672 return res;
673 break;
674 default:
675 break;
676 }
677 }
678
679 if (req_mem == 0)
680 return TEE_SUCCESS;
681
682 res = alloc_temp_sec_mem(req_mem, mobj_tmp, &dst);
683 if (res != TEE_SUCCESS)
684 return res;
685 dst_offs = 0;
686
687 for (n = 0; n < TEE_NUM_PARAMS; n++) {
688
689 if (!ta_private_memref[n])
690 continue;
691
692 s = ROUNDUP(param->u[n].mem.size, sizeof(uint32_t));
693
694 switch (TEE_PARAM_TYPE_GET(param->types, n)) {
695 case TEE_PARAM_TYPE_MEMREF_INPUT:
696 case TEE_PARAM_TYPE_MEMREF_INOUT:
697 va = (void *)param->u[n].mem.offs;
698 if (va) {
699 res = copy_from_user(dst, va,
700 param->u[n].mem.size);
701 if (res != TEE_SUCCESS)
702 return res;
703 param->u[n].mem.offs = dst_offs;
704 param->u[n].mem.mobj = *mobj_tmp;
705 tmp_buf_va[n] = dst;
706 tmp_buf_size[n] = param->u[n].mem.size;
707 dst += s;
708 dst_offs += s;
709 }
710 break;
711
712 case TEE_PARAM_TYPE_MEMREF_OUTPUT:
713 va = (void *)param->u[n].mem.offs;
714 if (va) {
715 param->u[n].mem.offs = dst_offs;
716 param->u[n].mem.mobj = *mobj_tmp;
717 tmp_buf_va[n] = dst;
718 tmp_buf_size[n] = param->u[n].mem.size;
719 dst += s;
720 dst_offs += s;
721 }
722 break;
723
724 default:
725 continue;
726 }
727 }
728
729 return TEE_SUCCESS;
730 }
731
732 /*
733 * Back from execution of service: update parameters passed from TA:
734 * If some parameters were memory references:
735 * - either the memref was temporary: copy back data and update size
736 * - or it was the original TA memref: update only the size value.
737 */
tee_svc_update_out_param(struct tee_ta_param * param,void * tmp_buf_va[TEE_NUM_PARAMS],size_t tmp_buf_size[TEE_NUM_PARAMS],struct utee_params * usr_param)738 static TEE_Result tee_svc_update_out_param(
739 struct tee_ta_param *param,
740 void *tmp_buf_va[TEE_NUM_PARAMS],
741 size_t tmp_buf_size[TEE_NUM_PARAMS],
742 struct utee_params *usr_param)
743 {
744 size_t n;
745 uint64_t *vals = usr_param->vals;
746 size_t sz = 0;
747
748 for (n = 0; n < TEE_NUM_PARAMS; n++) {
749 switch (TEE_PARAM_TYPE_GET(param->types, n)) {
750 case TEE_PARAM_TYPE_MEMREF_OUTPUT:
751 case TEE_PARAM_TYPE_MEMREF_INOUT:
752 /*
753 * Memory copy is only needed if there's a temporary
754 * buffer involved, tmp_buf_va[n] is only update if
755 * a temporary buffer is used. Otherwise only the
756 * size needs to be updated.
757 */
758 sz = param->u[n].mem.size;
759 if (tmp_buf_va[n] && sz <= vals[n * 2 + 1]) {
760 void *src = tmp_buf_va[n];
761 void *dst = (void *)(uintptr_t)vals[n * 2];
762 TEE_Result res = TEE_SUCCESS;
763
764 /*
765 * TA is allowed to return a size larger than
766 * the original size. However, in such cases no
767 * data should be synchronized as per TEE Client
768 * API spec.
769 */
770 if (sz <= tmp_buf_size[n]) {
771 res = copy_to_user(dst, src, sz);
772 if (res != TEE_SUCCESS)
773 return res;
774 }
775 }
776 usr_param->vals[n * 2 + 1] = sz;
777 break;
778
779 case TEE_PARAM_TYPE_VALUE_OUTPUT:
780 case TEE_PARAM_TYPE_VALUE_INOUT:
781 vals[n * 2] = param->u[n].val.a;
782 vals[n * 2 + 1] = param->u[n].val.b;
783 break;
784
785 default:
786 continue;
787 }
788 }
789
790 return TEE_SUCCESS;
791 }
792
793 /* Called when a TA calls an OpenSession on another TA */
syscall_open_ta_session(const TEE_UUID * dest,unsigned long cancel_req_to,struct utee_params * usr_param,uint32_t * ta_sess,uint32_t * ret_orig)794 TEE_Result syscall_open_ta_session(const TEE_UUID *dest,
795 unsigned long cancel_req_to,
796 struct utee_params *usr_param, uint32_t *ta_sess,
797 uint32_t *ret_orig)
798 {
799 struct ts_session *sess = ts_get_current_session();
800 struct user_ta_ctx *utc = to_user_ta_ctx(sess->ctx);
801 TEE_Result res = TEE_SUCCESS;
802 uint32_t ret_o = TEE_ORIGIN_TEE;
803 struct tee_ta_session *s = NULL;
804 struct mobj *mobj_param = NULL;
805 TEE_UUID *uuid = malloc(sizeof(TEE_UUID));
806 struct tee_ta_param *param = malloc(sizeof(struct tee_ta_param));
807 TEE_Identity *clnt_id = malloc(sizeof(TEE_Identity));
808 void *tmp_buf_va[TEE_NUM_PARAMS] = { NULL };
809 size_t tmp_buf_size[TEE_NUM_PARAMS] = { 0 };
810
811 if (uuid == NULL || param == NULL || clnt_id == NULL) {
812 res = TEE_ERROR_OUT_OF_MEMORY;
813 goto out_free_only;
814 }
815
816 memset(param, 0, sizeof(struct tee_ta_param));
817
818 res = copy_from_user_private(uuid, dest, sizeof(TEE_UUID));
819 if (res != TEE_SUCCESS)
820 goto function_exit;
821
822 clnt_id->login = TEE_LOGIN_TRUSTED_APP;
823 memcpy(&clnt_id->uuid, &sess->ctx->uuid, sizeof(TEE_UUID));
824
825 res = tee_svc_copy_param(sess, NULL, usr_param, param, tmp_buf_va,
826 tmp_buf_size, &mobj_param);
827 if (res != TEE_SUCCESS)
828 goto function_exit;
829
830 res = tee_ta_open_session(&ret_o, &s, &utc->open_sessions, uuid,
831 clnt_id, cancel_req_to, param);
832 vm_set_ctx(&utc->ta_ctx.ts_ctx);
833 if (res != TEE_SUCCESS)
834 goto function_exit;
835
836 res = tee_svc_update_out_param(param, tmp_buf_va, tmp_buf_size,
837 usr_param);
838
839 function_exit:
840 mobj_put_wipe(mobj_param);
841 if (res == TEE_SUCCESS)
842 copy_to_user_private(ta_sess, &s->id, sizeof(s->id));
843 copy_to_user_private(ret_orig, &ret_o, sizeof(ret_o));
844
845 out_free_only:
846 free_wipe(param);
847 free_wipe(uuid);
848 free_wipe(clnt_id);
849 return res;
850 }
851
syscall_close_ta_session(unsigned long ta_sess)852 TEE_Result syscall_close_ta_session(unsigned long ta_sess)
853 {
854 struct ts_session *sess = ts_get_current_session();
855 struct user_ta_ctx *utc = to_user_ta_ctx(sess->ctx);
856 TEE_Identity clnt_id = { };
857 struct tee_ta_session *s = NULL;
858
859 s = tee_ta_find_session(ta_sess, &utc->open_sessions);
860
861 clnt_id.login = TEE_LOGIN_TRUSTED_APP;
862 memcpy(&clnt_id.uuid, &sess->ctx->uuid, sizeof(TEE_UUID));
863
864 return tee_ta_close_session(s, &utc->open_sessions, &clnt_id);
865 }
866
syscall_invoke_ta_command(unsigned long ta_sess,unsigned long cancel_req_to,unsigned long cmd_id,struct utee_params * usr_param,uint32_t * ret_orig)867 TEE_Result syscall_invoke_ta_command(unsigned long ta_sess,
868 unsigned long cancel_req_to, unsigned long cmd_id,
869 struct utee_params *usr_param, uint32_t *ret_orig)
870 {
871 struct ts_session *sess = ts_get_current_session();
872 struct user_ta_ctx *utc = to_user_ta_ctx(sess->ctx);
873 TEE_Result res = TEE_SUCCESS;
874 TEE_Result res2 = TEE_SUCCESS;
875 uint32_t ret_o = TEE_ORIGIN_TEE;
876 struct tee_ta_param param = { 0 };
877 TEE_Identity clnt_id = { };
878 struct tee_ta_session *called_sess = NULL;
879 struct mobj *mobj_param = NULL;
880 void *tmp_buf_va[TEE_NUM_PARAMS] = { NULL };
881 size_t tmp_buf_size[TEE_NUM_PARAMS] = { };
882
883 called_sess = tee_ta_get_session((uint32_t)ta_sess, true,
884 &utc->open_sessions);
885 if (!called_sess)
886 return TEE_ERROR_BAD_PARAMETERS;
887
888 clnt_id.login = TEE_LOGIN_TRUSTED_APP;
889 memcpy(&clnt_id.uuid, &sess->ctx->uuid, sizeof(TEE_UUID));
890
891 res = tee_svc_copy_param(sess, &called_sess->ts_sess, usr_param, ¶m,
892 tmp_buf_va, tmp_buf_size, &mobj_param);
893 if (res != TEE_SUCCESS)
894 goto function_exit;
895
896 res = tee_ta_invoke_command(&ret_o, called_sess, &clnt_id,
897 cancel_req_to, cmd_id, ¶m);
898 if (res == TEE_ERROR_TARGET_DEAD)
899 goto function_exit;
900
901 res2 = tee_svc_update_out_param(¶m, tmp_buf_va, tmp_buf_size,
902 usr_param);
903 if (res2 != TEE_SUCCESS) {
904 /*
905 * Spec for TEE_InvokeTACommand() says:
906 * "If the return origin is different from
907 * TEE_ORIGIN_TRUSTED_APP, then the function has failed
908 * before it could reach the destination Trusted
909 * Application."
910 *
911 * But if we can't update params to the caller we have no
912 * choice we need to return some error to indicate that
913 * parameters aren't updated as expected.
914 */
915 ret_o = TEE_ORIGIN_TEE;
916 res = res2;
917 }
918
919 function_exit:
920 tee_ta_put_session(called_sess);
921 mobj_put_wipe(mobj_param);
922 copy_to_user_private(ret_orig, &ret_o, sizeof(ret_o));
923 return res;
924 }
925
syscall_check_access_rights(unsigned long flags,const void * buf,size_t len)926 TEE_Result syscall_check_access_rights(unsigned long flags, const void *buf,
927 size_t len)
928 {
929 struct ts_session *s = ts_get_current_session();
930
931 return vm_check_access_rights(&to_user_ta_ctx(s->ctx)->uctx, flags,
932 (uaddr_t)buf, len);
933 }
934
syscall_get_cancellation_flag(uint32_t * cancel)935 TEE_Result syscall_get_cancellation_flag(uint32_t *cancel)
936 {
937 struct ts_session *s = ts_get_current_session();
938 uint32_t c = 0;
939
940 c = tee_ta_session_is_cancelled(to_ta_session(s), NULL);
941
942 return copy_to_user(cancel, &c, sizeof(c));
943 }
944
syscall_unmask_cancellation(uint32_t * old_mask)945 TEE_Result syscall_unmask_cancellation(uint32_t *old_mask)
946 {
947 struct ts_session *s = ts_get_current_session();
948 struct tee_ta_session *sess = NULL;
949 uint32_t m = 0;
950
951 sess = to_ta_session(s);
952 m = sess->cancel_mask;
953 sess->cancel_mask = false;
954 return copy_to_user(old_mask, &m, sizeof(m));
955 }
956
syscall_mask_cancellation(uint32_t * old_mask)957 TEE_Result syscall_mask_cancellation(uint32_t *old_mask)
958 {
959 struct ts_session *s = ts_get_current_session();
960 struct tee_ta_session *sess = NULL;
961 uint32_t m = 0;
962
963 sess = to_ta_session(s);
964 m = sess->cancel_mask;
965 sess->cancel_mask = true;
966 return copy_to_user(old_mask, &m, sizeof(m));
967 }
968
syscall_wait(unsigned long timeout)969 TEE_Result syscall_wait(unsigned long timeout)
970 {
971 struct ts_session *s = ts_get_current_session();
972 TEE_Result res = TEE_SUCCESS;
973 uint32_t mytime = 0;
974 TEE_Time base_time = { };
975 TEE_Time current_time = { };
976
977 res = tee_time_get_sys_time(&base_time);
978 if (res != TEE_SUCCESS)
979 return res;
980
981 while (true) {
982 res = tee_time_get_sys_time(¤t_time);
983 if (res != TEE_SUCCESS)
984 return res;
985
986 if (tee_ta_session_is_cancelled(to_ta_session(s),
987 ¤t_time))
988 return TEE_ERROR_CANCEL;
989
990 mytime = (current_time.seconds - base_time.seconds) * 1000 +
991 (int)current_time.millis - (int)base_time.millis;
992 if (mytime >= timeout)
993 return TEE_SUCCESS;
994
995 tee_time_wait(timeout - mytime);
996 }
997
998 return res;
999 }
1000
syscall_get_time(unsigned long cat,TEE_Time * mytime)1001 TEE_Result syscall_get_time(unsigned long cat, TEE_Time *mytime)
1002 {
1003 struct ts_session *s = ts_get_current_session();
1004 TEE_Result res = TEE_SUCCESS;
1005 TEE_Result res2 = TEE_SUCCESS;
1006 TEE_Time t = { };
1007
1008 switch (cat) {
1009 case UTEE_TIME_CAT_SYSTEM:
1010 res = tee_time_get_sys_time(&t);
1011 break;
1012 case UTEE_TIME_CAT_TA_PERSISTENT:
1013 res = tee_time_get_ta_time((const void *)&s->ctx->uuid, &t);
1014 break;
1015 case UTEE_TIME_CAT_REE:
1016 res = tee_time_get_ree_time(&t);
1017 break;
1018 default:
1019 res = TEE_ERROR_BAD_PARAMETERS;
1020 break;
1021 }
1022
1023 if (res == TEE_SUCCESS || res == TEE_ERROR_OVERFLOW) {
1024 res2 = copy_to_user_private(mytime, &t, sizeof(t));
1025 if (res2 != TEE_SUCCESS)
1026 res = res2;
1027 }
1028
1029 return res;
1030 }
1031
syscall_set_ta_time(const TEE_Time * mytime)1032 TEE_Result syscall_set_ta_time(const TEE_Time *mytime)
1033 {
1034 struct ts_session *s = ts_get_current_session();
1035 TEE_Result res = TEE_SUCCESS;
1036 TEE_Time t = { };
1037
1038 res = copy_from_user_private(&t, mytime, sizeof(t));
1039 if (res != TEE_SUCCESS)
1040 return res;
1041
1042 return tee_time_set_ta_time((const void *)&s->ctx->uuid, &t);
1043 }
1044