core: tee_svc_copy_param() use ADD_OVERFLOW()

Replaces the integer overflow check in tee_svc_copy_param() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-

core: tee_svc_copy_param() use ADD_OVERFLOW()

Replaces the integer overflow check in tee_svc_copy_param() with
ADD_OVERFLOW()

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: avoid incremental linking with -gc

The AArch64 linkers seems to have occasional problems with incremental
linking (-i) in combination with garbage collect of sections (-gc). The
way we're orga

core: avoid incremental linking with -gc

The AArch64 linkers seems to have occasional problems with incremental
linking (-i) in combination with garbage collect of sections (-gc). The
way we're organizing the layout of the binary used for paging depends on
-gc to build the different dependency trees for unpaged and
initialization code.

The problem in the linker is tracked in
https://bugs.linaro.org/show_bug.cgi?id=3006 and
https://sourceware.org/bugzilla/show_bug.cgi?id=21524

The problem typically manifests itself by:
aarch64-toolchain/gcc-linaro-6.3.1-2017.02-x86_64_aarch64-linux-gnu/bin/aarch64-linux-gnu-ld: BFD (Linaro_Binutils-2017.02) 2.27.0.20161019 assertion fail /home/tcwg-buildslave/workspace/tcwg-make-release/label/docker-trusty-amd64-tcwg-build/target/aarch64-linux-gnu/snapshots/binutils-gdb.git~linaro_binutils-2_27-branch/bfd/elflink.c:8380
core/arch/arm/kernel/link.mk:90: recipe for target 'out/arm-plat-vexpress/core/init.o' failed
make: *** [out/arm-plat-vexpress/core/init.o] Error 1

With this patch we replace the incremental linking with a full link
using a special link script. With a full link we can't have undefined
symbols so some dummy symbols are provided by the link script when some
object files are skipped when reducing the dependency tree. To
completely get rid of those dummy symbols the script that gathers the
sections is replaced by a python script that skips listed sections (if
provided).

In terms of features in the resulting binary, nothing is changed in this
commit.

Reviewed-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: REE_FS: refcount dirfile handle

Introduces a reference counter to keep a dirfile handle open as long as
a file or directory is open. This avoids the frequent open and close of
the dirfile for

core: REE_FS: refcount dirfile handle

Introduces a reference counter to keep a dirfile handle open as long as
a file or directory is open. This avoids the frequent open and close of
the dirfile for operations on an already open file.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU, FVP)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: don't store uuid in dirfile interface

Skips storing pointer to uuid in struct tee_fs_dirfile_dirh.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <

core: FS: don't store uuid in dirfile interface

Skips storing pointer to uuid in struct tee_fs_dirfile_dirh.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove SQL-FS

With recent developments in REE-FS SQL-FS has become redundant. This
patch removes SQL-FS.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissi

Remove SQL-FS

With recent developments in REE-FS SQL-FS has become redundant. This
patch removes SQL-FS.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

crypto: don't check hash size when the main algorithm is ECDSA

syscall_asymm_verify() (and therefore TEE_AsymmetricVerifyDigest())
incorrectly assumes that the hash algorithm is SHA1 when the main
a

crypto: don't check hash size when the main algorithm is ECDSA

syscall_asymm_verify() (and therefore TEE_AsymmetricVerifyDigest())
incorrectly assumes that the hash algorithm is SHA1 when the main
algorithm is ECDSA, and will panic the TA if the hash size is not set
accordingly. This behavior does not comply with the TEE Internal Core
API v1.1, which states:

"Where a hash algorithm is specified in the algorithm, digestLen SHALL
be equal to the digest length of this hash algorithm".

For TEE_ALG_ECDSA_P192, TEE_ALG_ECDSA_P224, TEE_ALG_ECDSA_P256,
TEE_ALG_ECDSA_P384 and TEE_ALG_ECDSA_P521, no hash algorithm is
specified, and so we must not restrict the hash size to any specific
value.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reported-by: Henrik Andersson <Henrik.Andersson@se.bosch.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

show more ...

core: REE FS: use the new dirfile interface

Uses the new dirfile interface to keep track of persistent objects.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carrie

core: REE FS: use the new dirfile interface

Uses the new dirfile interface to keep track of persistent objects.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: key manager takes supplied UUID

The FS key manager takes a supplied UUID instead of extracting it from
current session in order to be more flexible.

Reviewed-by: Jerome Forissier <jerome.

core: FS: key manager takes supplied UUID

The FS key manager takes a supplied UUID instead of extracting it from
current session in order to be more flexible.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: add helpers for tee_fs_dirfile_fileh

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jen

core: FS: add helpers for tee_fs_dirfile_fileh

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: introduce dirfile interface

Introduces the dirfile interface which keeps a list of secure storage
objects. Each object is represented by the UUID of the owning TA, a hash
of the object, an

core: FS: introduce dirfile interface

Introduces the dirfile interface which keeps a list of secure storage
objects. Each object is represented by the UUID of the owning TA, a hash
of the object, and a handle to the name used in normal world to store
the encrypted data of the object.

The interface allows queued atomic updates to avoid difficult races
during creation and renaming of objects.

By keeping the list of the secure object files in a single database the
collected state of the objects can be represented by a single hash or
even a counter. This gives some flexibility when implementing
anti-rollback protection.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: htree: export/import hash of object

The hash-tree can be verified based on a known hash of the root node of
a secure storage object. When syncing the hash tree the hash of the root
node is sto

core: htree: export/import hash of object

The hash-tree can be verified based on a known hash of the root node of
a secure storage object. When syncing the hash tree the hash of the root
node is stored in an external location for further protection.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: remove redundant fields from struct tee_svc_storage_head

Removes the unused/redundant fields magic, head_size, ds_size from
struct tee_svc_storage_head. meta_size is renamed to attr_size t

core: FS: remove redundant fields from struct tee_svc_storage_head

Removes the unused/redundant fields magic, head_size, ds_size from
struct tee_svc_storage_head. meta_size is renamed to attr_size to better
reflect the usage.

The size of the data stream is calculated from the total size of the
file minus attr_size. This makes the header static after it's
initialized.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: let FOP->create() initialize the new file

Moves the code from syscall_storage_obj_create() that does several calls
via the FOP interface into FOP->create() instead. With this all updates
c

core: FS: let FOP->create() initialize the new file

Moves the code from syscall_storage_obj_create() that does several calls
via the FOP interface into FOP->create() instead. With this all updates
can be performed while the mutex is held. This makes the create
operation easier to optimize as each call via the FOP interface is
atomic.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add test case for hash-tree

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@

core: add test case for hash-tree

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: htree: fix undo update

Updates of the hash-tree can be undone by closing the hash-tree before
tee_fs_htree_sync_to_storage() is called.

Before this patch the hash-tree was left in a half

core: FS: htree: fix undo update

Updates of the hash-tree can be undone by closing the hash-tree before
tee_fs_htree_sync_to_storage() is called.

Before this patch the hash-tree was left in a half updated state if
tee_fs_htree_close() was called before tee_fs_htree_sync_to_storage().

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: htree: add rpc final callbacks

Adds rpc final callbacks to struct tee_fs_htree_storage to make the it
possible to isolate the hash tree implementation for test.

Reviewed-by: Etienne Carri

core: FS: htree: add rpc final callbacks

Adds rpc final callbacks to struct tee_fs_htree_storage to make the it
possible to isolate the hash tree implementation for test.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: syscall_storage_reset_enum() must check e->fops before using it

An object enumerator that has just been allocated or reset has its fops
field set to NULL. So, syscall_storage_reset_enum() must

core: syscall_storage_reset_enum() must check e->fops before using it

An object enumerator that has just been allocated or reset has its fops
field set to NULL. So, syscall_storage_reset_enum() must take care of
this.

Fixes: https://github.com/OP-TEE/optee_os/issues/1417
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: replace file name with struct tee_pobj

Replaces the file name with a pointer to corresponding struct tee_pobj
instead in the file operation interface.

Reviewed-by: Jerome Forissier <jerom

core: FS: replace file name with struct tee_pobj

Replaces the file name with a pointer to corresponding struct tee_pobj
instead in the file operation interface.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey, GP)
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260, GP)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: remove fop->seek()

Simplifies file operations interface and implementation by removing the
file operation function pointer seek(). read() and write() takes and
additional position argument

core: FS: remove fop->seek()

Simplifies file operations interface and implementation by removing the
file operation function pointer seek(). read() and write() takes and
additional position argument to avoid keeping track of the position in
the FS layer. The file position was already maintained in parallel in
struct tee_obj.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: remove ta_dir_mutex

Removes the mutex that's supposed to protect directory operations in
secure storage. The mutex is redundant as each FS implementation has
its own internal mutex for all

core: FS: remove ta_dir_mutex

Removes the mutex that's supposed to protect directory operations in
secure storage. The mutex is redundant as each FS implementation has
its own internal mutex for all operations.

Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (FVP)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: SQL FS: bugfix sql_fs_ftruncate_internal()

Fixes uninitialized use of return variable.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklande

core: SQL FS: bugfix sql_fs_ftruncate_internal()

Fixes uninitialized use of return variable.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: fix htree memory leakage

Fixes problem with memory leakage in tee_fs_htree_sync_to_storage()
when the hash tree doesn't need to be synced to storage.

Tested-by: Jens Wiklander <jens.wikla

core: FS: fix htree memory leakage

Fixes problem with memory leakage in tee_fs_htree_sync_to_storage()
when the hash tree doesn't need to be synced to storage.

Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: prng: Don't try to read REE time when it's not possible

The commit referenced below extends entropy gathering to two locations
where it is unfortunately not OK to invoke Normal World through R

core: prng: Don't try to read REE time when it's not possible

The commit referenced below extends entropy gathering to two locations
where it is unfortunately not OK to invoke Normal World through RPC:

1. tee_ltc_prng_init(), because at this point the RPC subsystem has not
yet been initialized,
2. rpc_cmd_nolock(), because doing so would cause recursion and would
be inefficient (doubling the number of RPC calls).

The problem is: if CFG_SECURE_TIME_SOURCE_REE=y and if the platform
does not override plat_prng_add_jitter_entropy(), the function will end
up calling the RPC service where it's not permitted and the TEE will
crash.

This commit introduces plat_prng_add_jitter_entropy_norpc() and
provides a default implementation which does nothing if the time source
is the REE, thus fixing the issue while still allowing platform code to
implement a specific behavior.

Fixes: 82f97f19fe2d ("prng: call plat_prng_add_jitter_entropy() at PRNG init and before NW RPC")
Reported-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

[Review] core: prng: Don't try to read REE time when it's not possible

Remove useless return.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: remove unused FS key manager features

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: SQL FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander

core: SQL FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...