core: tee_svc.c: allow to pass non-NULL memref of size 0

Allow TAs to pass non-NULL memref of size zero to other TAs by
changing the non-NULL pointer into a NULL one in such a case. GP TEE
Internal

core: tee_svc.c: allow to pass non-NULL memref of size 0

Allow TAs to pass non-NULL memref of size zero to other TAs by
changing the non-NULL pointer into a NULL one in such a case. GP TEE
Internal Core API does not forbid such memref parameter [1] whereas
the previous implementation generated a TEE_ERROR_BAD_PARAMETERS error
code when converting such memref buffer pointer into a physical memory
address.

This change is specifically needed to allow a TA to forward a REE
client memref for which GP TEE Client API explicitly allows such
non-NULL address zero sized memref [2]. It also makes the TA
implementation more flexible when dealing with its own memref.

[1] TEE Internal Core API Specification – Public Release v1.3.1,
§4.9.4 "Operation Parameters in the Internal Client API"
Table 4-15: "Interpretation of params[i] on Entry to Internal Client
API"

[2] TEE Client API Specification v1.0, §4.5.4 TEEC_RegisterSharedMemory,
paragraph "Implementers' Notes"

Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

tree wide: CFG_INSECURE deprecates CFG_WARN_INSECURE

Replaces configuration switch CFG_WARN_INSECURE with CFG_INSECURE
The new name is better because the switch not only warns but also
change the OP

tree wide: CFG_INSECURE deprecates CFG_WARN_INSECURE

Replaces configuration switch CFG_WARN_INSECURE with CFG_INSECURE
The new name is better because the switch not only warns but also
change the OP-TEE core behavior as, for example, allowing absence
of secure storage rollback protection.

Suggested-by: Jérôme Forissier <jerome@forissier.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: remove temp memory allocation for TA invoke

Remove the temporary memory allocation used if a TA invokes another TA
with a private memory buffer. This has not been in used with TAs
compiled sin

core: remove temp memory allocation for TA invoke

Remove the temporary memory allocation used if a TA invokes another TA
with a private memory buffer. This has not been in used with TAs
compiled since commit ef305e54eac8 ("libutee: allocate temp secmem for
invoke") or OP-TEE version 3.6.0.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: use monotonic counter for secure storage without RPMB

If OP-TEE is configured without RPMB (CFG_REE_FS_INTEGRITY_RPMB=n), use
the non-volatile monotonic counter interface instead to protect ag

core: use monotonic counter for secure storage without RPMB

If OP-TEE is configured without RPMB (CFG_REE_FS_INTEGRITY_RPMB=n), use
the non-volatile monotonic counter interface instead to protect against
rollback of the REE FS base secure storage.

If configured without CFG_WARN_INSECURE=y, accept
TEE_ERROR_NOT_IMPLEMENTED error from nv_counter_get_ree_fs() and
nv_counter_incr_ree_fs_to() and warn once to make clear that the
configuration isn't secure.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>
Tested-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

crypto: introduce CFG_CRYPTO_HW_PBKDF2

Add a new configuration flag to support hardware implementation of
PBKDF2.

Signed-off-by: loubaihui <loubaihui1@huawei.com>
Acked-by: Jens Wiklander <jens.wik

crypto: introduce CFG_CRYPTO_HW_PBKDF2

Add a new configuration flag to support hardware implementation of
PBKDF2.

Signed-off-by: loubaihui <loubaihui1@huawei.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: simplify calls to bb_memdup_user_private()

Now that bb_memdup_user_private() supports supplying zero-lenth buffers
remove checks for zero-length buffer before calling
bb_memdup_user_private().

core: simplify calls to bb_memdup_user_private()

Now that bb_memdup_user_private() supports supplying zero-lenth buffers
remove checks for zero-length buffer before calling
bb_memdup_user_private().

Removes calls to memtag_strip_tag() for input buffer to
bb_memdup_user_private() since that's also dealt with internally by that
function.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: simplify utee_param_to_param() with BB_MEMDUP_USER()

Simplifies utee_param_to_param() by using BB_MEMDUP_USER() instead of
bb_alloc() followed by copy_from_user().

Signed-off-by: Jens Wikland

core: simplify utee_param_to_param() with BB_MEMDUP_USER()

Simplifies utee_param_to_param() by using BB_MEMDUP_USER() instead of
bb_alloc() followed by copy_from_user().

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: tee_svc_cryp.c: replace get_used_bits()

Prior to this patch was get_used_bits() called in
tee_svc_cryp_obj_populate_type() to check that a bignum isn't too large.
While the code works it's mor

core: tee_svc_cryp.c: replace get_used_bits()

Prior to this patch was get_used_bits() called in
tee_svc_cryp_obj_populate_type() to check that a bignum isn't too large.
While the code works it's more complicated than necessary. The bignum
has just been imported so the normal bignum functions can be used
directly instead of copying the user space buffer again and feed it to
bit_ffs(). So replace the call to get_used_bits() with a call to
crypto_bignum_num_bits() on the newly imported bignum.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: update ts_store API with user space buffer

Updates the read() function pointer in struct ts_store_ops to take an
user space buffer in addition to the previous core buffer. Core buffers
are nor

core: update ts_store API with user space buffer

Updates the read() function pointer in struct ts_store_ops to take an
user space buffer in addition to the previous core buffer. Core buffers
are normal secure memory while user space buffers should only be accessed
using the user_access.h functions.

The different TA storage implementations are updated accordingly.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: tee: initialize variables in entry_open_session()

Initialize local variables at declaration as specified by the coding
guidelines.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewe

core: tee: initialize variables in entry_open_session()

Initialize local variables at declaration as specified by the coding
guidelines.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee: initialize dirfile_entry objects

Coverity reports many errors where dirfile_entry{} is used
un-initialized.
Resolve these errors by setting these objects to zero on declaration.

Signed-o

core: tee: initialize dirfile_entry objects

Coverity reports many errors where dirfile_entry{} is used
un-initialized.
Resolve these errors by setting these objects to zero on declaration.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee: entry_open_session(): initialize tee_ta_param object

Initialize tee_ta_param{} to zero in entry_open_session() so it can be used
initialized in cleanup_shm_refs() without Coverity error.

core: tee: entry_open_session(): initialize tee_ta_param object

Initialize tee_ta_param{} to zero in entry_open_session() so it can be used
initialized in cleanup_shm_refs() without Coverity error.

Signed-off-by: Clement Faure <clement.faure@nxp.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: update FS storage API with user space buffer

Updates the create(), read(), and write() function pointers in struct
ts_store_ops to take a user space buffer in addition to the previous
core buf

core: update FS storage API with user space buffer

Updates the create(), read(), and write() function pointers in struct
ts_store_ops to take a user space buffer in addition to the previous
core buffer. Core buffers are normal secure memory while user space
buffers should only be accessed using the user_access.h functions.

The different FS storage implementations are updated accordingly.

Note that the RPMB FS storage implementation resorts to using
enter_user_access() and exit_user_access() due to internal complexities.

Fixes: 4e154320e47c ("core: Apply finer-grained PAN")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: syscall_storage_obj_rename(): fix direct user memory access

Fixes a direct user memory access in syscall_storage_obj_rename() which
can lead to a data abort if PAN is enabled.

Fixes: 84f78978

core: syscall_storage_obj_rename(): fix direct user memory access

Fixes a direct user memory access in syscall_storage_obj_rename() which
can lead to a data abort if PAN is enabled.

Fixes: 84f78978974b ("core: use user-access functions for storage svc")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: pta: socket: fix direct user memory access

Replaces direct user memory accesses in the socket PTA with
copy_to_user() and copy_from_user(). This avoids PAN errors when PAN is
active.

Fixes: 4

core: pta: socket: fix direct user memory access

Replaces direct user memory accesses in the socket PTA with
copy_to_user() and copy_from_user(). This avoids PAN errors when PAN is
active.

Fixes: 4e154320e47c ("core: Apply finer-grained PAN")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: add user buffer to tee_invoke_supp_plugin_rpc()

Adds a user buffer to tee_invoke_supp_plugin_rpc() so direct user memory
access can be used when called with a buffer in user memory instead of

core: add user buffer to tee_invoke_supp_plugin_rpc()

Adds a user buffer to tee_invoke_supp_plugin_rpc() so direct user memory
access can be used when called with a buffer in user memory instead of
core memory. tee_invoke_supp_plugin_rpc() can still take a core memory
buffer as an argument if needed.

PTA_SYSTEM_SUPP_PLUGIN_INVOKE in the system PTA is updated to pass the
memref as a user memory buffer instead of a core memory buffer.

This fixes a direct privileged memory access to user space memory.

Fixes: 4e154320e47c ("core: Apply finer-grained PAN")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

crypto: add X448 support

Refer to the X25519 algorithm, add the X448 algorithm framework code.

Signed-off-by: loubaihui <loubaihui1@huawei.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.o

crypto: add X448 support

Refer to the X25519 algorithm, add the X448 algorithm framework code.

Signed-off-by: loubaihui <loubaihui1@huawei.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

crypto: rename struct x25519_keypair

Since X25519 and X448 have the same key pair structure,
so we rename struct x25519_keypair as struct montgomery_keypair.

Signed-off-by: loubaihui <loubaihui1@hu

crypto: rename struct x25519_keypair

Since X25519 and X448 have the same key pair structure,
so we rename struct x25519_keypair as struct montgomery_keypair.

Signed-off-by: loubaihui <loubaihui1@huawei.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: Apply finer-grained PAN

Prior to this commit, the PAN was disabled for most of the time,
within the thread scall handler. After resolving all outstanding
missing unprivileged access functions,

core: Apply finer-grained PAN

Prior to this commit, the PAN was disabled for most of the time,
within the thread scall handler. After resolving all outstanding
missing unprivileged access functions, we can now enable finer-
grained PAN, where the unprivileged access is only allowed inside
handful of special user-access functions.

There are some exceptions where we toggle PAN to allow the OP-TEE
core to access user memory, instead of using user-access functions
or bounce buffers. Those are crypto services and ldelf syscall
handlers. Those are chosen to avoid potential large bounce buffer
allocations.

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: use user-access functions for crypto service

Use user-access functions for crypto service functions, excluding
encryption, decryption and hasn operations, which might require
large bounce buff

core: use user-access functions for crypto service

Use user-access functions for crypto service functions, excluding
encryption, decryption and hasn operations, which might require
large bounce buffer allocations. Besides these operations, user-
access functions are applied for those functions that takes
attributes, IVs, big numbers, and auxiliary data from the user-
space.

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: use user-access functions for storage svc

Use user-access functions within storage service syscalls, mainly to
copy object id from user-spaced buffers.

Signed-off-by: Seonghyun Park <seonghp@

core: use user-access functions for storage svc

Use user-access functions within storage service syscalls, mainly to
copy object id from user-spaced buffers.

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: use user-access functions for passing params

Use user-access functions for parameter-passing between user TA and
the core when calling another TA from a TA and when entering a user
TA.

Signed

core: use user-access functions for passing params

Use user-access functions for parameter-passing between user TA and
the core when calling another TA from a TA and when entering a user
TA.

Signed-off-by: Seonghyun Park <seonghp@amazon.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: crypto_bignum_free(): add indirection and set pointer to NULL

To prevent human mistake, crypto_bignum_free() sets the location of the
bignum pointer to NULL after freeing it.

Signed-off-by: J

core: crypto_bignum_free(): add indirection and set pointer to NULL

To prevent human mistake, crypto_bignum_free() sets the location of the
bignum pointer to NULL after freeing it.

Signed-off-by: Jihwan Park <jihwp@amazon.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: tee_svc_cryp: report RSAES_PKCS1_OAEP_MGF1 bad hash ID

Fixes syscall_asymm_operate() to report inconsistent hash algorithm
specified as attribute for TEE_ALG_RSAES_PKCS1_OAEP_MGF1_* operations

core: tee_svc_cryp: report RSAES_PKCS1_OAEP_MGF1 bad hash ID

Fixes syscall_asymm_operate() to report inconsistent hash algorithm
specified as attribute for TEE_ALG_RSAES_PKCS1_OAEP_MGF1_* operations
as OP-TEE only supports the hash predefined for the request algorithm
TEE_ALG_RSAES_PKCS1_OAEP_MGF1_xxx.

Link: https://github.com/OP-TEE/optee_os/issues/6143
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@foss.st.com>

show more ...

core: crypto: change TEE_AEDecryptFinal() tag param's attribute

Due to tag parameter was passed in from REE side share memory
same as cipher-text source and nonce buffer/parameters.
Then memory acce

core: crypto: change TEE_AEDecryptFinal() tag param's attribute

Due to tag parameter was passed in from REE side share memory
same as cipher-text source and nonce buffer/parameters.
Then memory access sanity-check marks CCM TAG buffer as
ACCESS_DENIED, which triggers user TA panic.

Change tag parameter's attribute from [in] to [inbuf]. This fix is
expected to be addressed in next GP TEE Internal Core API specification.

Link: https://github.com/OP-TEE/optee_os/issues/5946
Signed-off-by: lei zhou <lei.zhou@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...