core: REE FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander

core: REE FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: provide a hash tree for secure storage

Provides a hash tree to be used by REE and SQL FS for the secure storage
implementation.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Sig

core: provide a hash tree for secure storage

Provides a hash tree to be used by REE and SQL FS for the secure storage
implementation.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: provide tee_fs_fek_crypt()

FS key manager provides tee_fs_fek_crypt().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: remove obsolete <tee/tee_fs_defs.h>

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: Add tee_time_busy_wait()

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linar

core: Add tee_time_busy_wait()

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
[jf: rebase on top of master]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

prng: move old implementation to be weak default

The patch replaces the original entropy scheme using system time with
the new api plat_prng_add_jitter_entropy().

The old scheme aimed to get 64 bit

prng: move old implementation to be weak default

The patch replaces the original entropy scheme using system time with
the new api plat_prng_add_jitter_entropy().

The old scheme aimed to get 64 bits of entropy from the current time
expressed in 64 bits in ms each time. Most of this was in fact zeros or
unchanging for >256s. If you call it twice with 1ms, it actually
provides 0 bits of entropy.

The replacement scheme aims to get 2 bits of entropy from the counter,
which typically operates faster than 1MHz, greater than a thousand times
more precision than the old way, each time.

For backwards compatibility, the old scheme is retained as the default
or arches or platforms that did not provide an override to collect
jitter in a better way.

Signed-off-by: Andy Green <andy@warmcat.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

prng: implement CNTPCT-based jitter entropy for all arm arch devices

Tests dumping CNTPCT at the same point in three boots on Hikey
gave the following spread:

0xebff3fdd80daceb5
0xebff3fdd80da4601

prng: implement CNTPCT-based jitter entropy for all arm arch devices

Tests dumping CNTPCT at the same point in three boots on Hikey
gave the following spread:

0xebff3fdd80daceb5
0xebff3fdd80da4601
0xeaff3fdd7edb5dcc

things like eMMC async init from power up, interrupt jitter, branch
prediction misses, peripheral async clock drift, cache fill delays,
and so on accumulate in the counter at better than us resolution,
and make the exact count we reach the dump point differ, even in a
supposedly deterministic boot flow.

There appear to be ~12 bits of real entropy in the initial jitter, by
the time of the sample point which was at OP-TEE entry from a-t-f.

A new general jitter harvesting API is introduced
plat_prng_add_jitter_entropy(). The first time it is called on
PRNG init, 16 bits of CNTPCT are used as seed entropy. Thereafter
only the two LSB of CNTPCT are harvested each time, being provided
as entropy to the PRNG every time it reaches 8 bits.

Signed-off-by: Andy Green <andy@warmcat.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

rename 'static TA' into 'pseudo TA'

This renaming prevents confusion of what is a static TA: static
TAs are NOT Trusted Application operating at OP-TEE core privilege
execution level. There are rath

rename 'static TA' into 'pseudo TA'

This renaming prevents confusion of what is a static TA: static
TAs are NOT Trusted Application operating at OP-TEE core privilege
execution level. There are rather OP-TEE core services that offer
an invocation API based on GP TEE specified invocation API:
open session, invoke command and close session.

This change renames all 'static TA' references into 'pseudo TA'
references.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: RPMB FS: nullify fops when resetting an enumerator

According to the GP spec, TEE_ResetPersistentObjectEnumerator() "resets
an object enumerator handle to its initial state after allocation".
T

core: RPMB FS: nullify fops when resetting an enumerator

According to the GP spec, TEE_ResetPersistentObjectEnumerator() "resets
an object enumerator handle to its initial state after allocation".
Therefore, syscall_storage_reset_enum() should set e->fops = NULL.

This fixes a regression introduced when the FOP interface was reworked.
I'm not simply reverting the return code from TEE_ERROR_GENERIC back to
TEE_ERROR_ITEM_NOT_FOUND, because the new code makes sense and it is
more sane to properly reset the state of the enumerator.

Consequently, tee_svc_close_enum() is updated to accept e->fops == NULL
which is valid when the enum has just been allocated or reset but not
started. We should not return an error status in this case.

Tested on HiKey using xtest with GP tests (all 3 filesystems: REE, SQL,
RPMB).

Fixes: b86c18ecc7d3 ("core: RPMB FS: prepare for new FOP interface")
Fixes: https://github.com/OP-TEE/optee_os/issues/1332
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: bugfix tee_uuid_from_octets()

Fixes undefined behavior (shift out of bounds) in tee_uuid_from_octets().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikland

core: bugfix tee_uuid_from_octets()

Fixes undefined behavior (shift out of bounds) in tee_uuid_from_octets().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

RPMB: fix tee_rpmb_free()

Don't call thread_rpc_free_payload() unless thread_rpc_alloc_payload()
was successful, which is when the physical address is non-zero.

Fixes: https://github.com/OP-TEE/opt

RPMB: fix tee_rpmb_free()

Don't call thread_rpc_free_payload() unless thread_rpc_alloc_payload()
was successful, which is when the physical address is non-zero.

Fixes: https://github.com/OP-TEE/optee_os/issues/1319
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Move definitions from optee_msg.h to optee_msg_supplicant.h

Commands that are specific to tee-supplicant belong in their own file.
This allows optee_msg.h to remain untouched as more supplicant comm

Move definitions from optee_msg.h to optee_msg_supplicant.h

Commands that are specific to tee-supplicant belong in their own file.
This allows optee_msg.h to remain untouched as more supplicant commands
are added. With this change:
- optee_msg.h is used by the driver and OP-TEE OS (note: there are two
slightly different versions of the file adapted to each environment but
they define the same things)
- optee_msg_supplicant.h is used by OP-TEE OS and tee-supplicant

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Rename optee_msg_fs.h to optee_msg_supplicant.h

The file contains the definition of the RPC interface with
tee-supplicant, not limited to filesystem functions.

Signed-off-by: Jerome Forissier <jero

Rename optee_msg_fs.h to optee_msg_supplicant.h

The file contains the definition of the RPC interface with
tee-supplicant, not limited to filesystem functions.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

storage: RPMB: don't try to program the RPMB key by default

Prevent leakage of the RPMB security key by never programming it,
unless a special build option is set (CFG_RPMB_WRITE_KEY=y).

Signed-off

storage: RPMB: don't try to program the RPMB key by default

Prevent leakage of the RPMB security key by never programming it,
unless a special build option is set (CFG_RPMB_WRITE_KEY=y).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add paged secure shared memory

Adds feature to allocate paged secure memory that can be transferred
between TAs as needed.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by

core: add paged secure shared memory

Adds feature to allocate paged secure memory that can be transferred
between TAs as needed.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by Volodymyr Babchuk <vlad.babchuk@gmail.com>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU, Hikey)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: use mobj for user mappings

Replaces the old mm and mm_stack elements with mobj_code and mobj_stack
in user context.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by Vol

core: use mobj for user mappings

Replaces the old mm and mm_stack elements with mobj_code and mobj_stack
in user context.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by Volodymyr Babchuk <vlad.babchuk@gmail.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: introduce MOBJ abstraction

Introduces MOBJ for memory objects, no changes in features except
breaking unsafe-nw-param/mem-multipurpose.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.

core: introduce MOBJ abstraction

Introduces MOBJ for memory objects, no changes in features except
breaking unsafe-nw-param/mem-multipurpose.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by Volodymyr Babchuk <vlad.babchuk@gmail.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: sql_fs_write(): update meta.length only if length has changed

If the data size is not increased as a result of the write operation,
meta.length must not be changed.

Fixes: https://github.com/

core: sql_fs_write(): update meta.length only if length has changed

If the data size is not increased as a result of the write operation,
meta.length must not be changed.

Fixes: https://github.com/OP-TEE/optee_os/issues/1268
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Igor Opaniuk <igor.opaniuk@linaro.org>

show more ...

secure storage: update head message when info->dataSize update

When one invokes TEE_WriteObjectData and write some data
into the secure storage file, the data size of the file
may change, but curren

secure storage: update head message when info->dataSize update

When one invokes TEE_WriteObjectData and write some data
into the secure storage file, the data size of the file
may change, but currently it will not update the head
message in persistent objects. This commit will fix this
problem by updating head message when info->dataSize update.

Signed-off-by: Guanchao Liang <liang.guanchao@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
[Rebase on top of master]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: encode UUID big endian

When encoding a UUID as a sequence of bytes, the spec
(https://www.ietf.org/rfc/rfc4122.txt) says that the u32, and two u16s
should be represented big endian.

Before th

core: encode UUID big endian

When encoding a UUID as a sequence of bytes, the spec
(https://www.ietf.org/rfc/rfc4122.txt) says that the u32, and two u16s
should be represented big endian.

Before this patch OPTEE always treated them natively. With this patch
UUIDs are always converted to/from big endian when communicating with
normal world.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Fixes: https://github.com/OP-TEE/optee_os/issues/858
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

secure storage: change struct tee_fs_file_info member type

In struct tee_fs_file_info, the member length's origin type is size_t,
when NS user is 64 bits, and secure kernel is 32 bits, the type size

secure storage: change struct tee_fs_file_info member type

In struct tee_fs_file_info, the member length's origin type is size_t,
when NS user is 64 bits, and secure kernel is 32 bits, the type size_t
will have different width, which will cause xtest 20022 case fail.
This commit change the member length's type from size_t to uint64_t,
which can keep a fixed width.

Signed-off-by: Guanchao Liang <liang.guanchao@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey)

show more ...

core: protect tee_pobj functions with mutex

The tee_pobj functions can be called concurrently, add a mutex to
protect the internal state.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

core: protect tee_pobj functions with mutex

The tee_pobj functions can be called concurrently, add a mutex to
protect the internal state.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (FVP Base model)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: crypto: avoid undefined bit shifts by a negative amount (-1)

The GET_ATTRIBUTE() and SET_ATTRIBUTE() macros are replaced with static
functions that properly handle the case when the attribute

core: crypto: avoid undefined bit shifts by a negative amount (-1)

The GET_ATTRIBUTE() and SET_ATTRIBUTE() macros are replaced with static
functions that properly handle the case when the attribute is not found.

Fixes: Coverity CID:1378609 CID:1378610 CID:1378611 CID:1378612
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: rename all tee_fs_rpc_new_ functions

Rename all functions with tee_fs_rpc_new_ prefix to use a tee_fs_rpc_
prefix instead now that all the legacy RPC functions are removed.

Reviewed-by: E

core: FS: rename all tee_fs_rpc_new_ functions

Rename all functions with tee_fs_rpc_new_ prefix to use a tee_fs_rpc_
prefix instead now that all the legacy RPC functions are removed.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: remove unused legacy RPC functions

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>