core: FS: htree: add rpc final callbacks

Adds rpc final callbacks to struct tee_fs_htree_storage to make the it
possible to isolate the hash tree implementation for test.

Reviewed-by: Etienne Carri

core: FS: htree: add rpc final callbacks

Adds rpc final callbacks to struct tee_fs_htree_storage to make the it
possible to isolate the hash tree implementation for test.

Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: syscall_storage_reset_enum() must check e->fops before using it

An object enumerator that has just been allocated or reset has its fops
field set to NULL. So, syscall_storage_reset_enum() must

core: syscall_storage_reset_enum() must check e->fops before using it

An object enumerator that has just been allocated or reset has its fops
field set to NULL. So, syscall_storage_reset_enum() must take care of
this.

Fixes: https://github.com/OP-TEE/optee_os/issues/1417
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: replace file name with struct tee_pobj

Replaces the file name with a pointer to corresponding struct tee_pobj
instead in the file operation interface.

Reviewed-by: Jerome Forissier <jerom

core: FS: replace file name with struct tee_pobj

Replaces the file name with a pointer to corresponding struct tee_pobj
instead in the file operation interface.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey, GP)
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260, GP)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: remove fop->seek()

Simplifies file operations interface and implementation by removing the
file operation function pointer seek(). read() and write() takes and
additional position argument

core: FS: remove fop->seek()

Simplifies file operations interface and implementation by removing the
file operation function pointer seek(). read() and write() takes and
additional position argument to avoid keeping track of the position in
the FS layer. The file position was already maintained in parallel in
struct tee_obj.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: remove ta_dir_mutex

Removes the mutex that's supposed to protect directory operations in
secure storage. The mutex is redundant as each FS implementation has
its own internal mutex for all

core: FS: remove ta_dir_mutex

Removes the mutex that's supposed to protect directory operations in
secure storage. The mutex is redundant as each FS implementation has
its own internal mutex for all operations.

Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (b2260)
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (FVP)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: SQL FS: bugfix sql_fs_ftruncate_internal()

Fixes uninitialized use of return variable.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklande

core: SQL FS: bugfix sql_fs_ftruncate_internal()

Fixes uninitialized use of return variable.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: FS: fix htree memory leakage

Fixes problem with memory leakage in tee_fs_htree_sync_to_storage()
when the hash tree doesn't need to be synced to storage.

Tested-by: Jens Wiklander <jens.wikla

core: FS: fix htree memory leakage

Fixes problem with memory leakage in tee_fs_htree_sync_to_storage()
when the hash tree doesn't need to be synced to storage.

Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: prng: Don't try to read REE time when it's not possible

The commit referenced below extends entropy gathering to two locations
where it is unfortunately not OK to invoke Normal World through R

core: prng: Don't try to read REE time when it's not possible

The commit referenced below extends entropy gathering to two locations
where it is unfortunately not OK to invoke Normal World through RPC:

1. tee_ltc_prng_init(), because at this point the RPC subsystem has not
yet been initialized,
2. rpc_cmd_nolock(), because doing so would cause recursion and would
be inefficient (doubling the number of RPC calls).

The problem is: if CFG_SECURE_TIME_SOURCE_REE=y and if the platform
does not override plat_prng_add_jitter_entropy(), the function will end
up calling the RPC service where it's not permitted and the TEE will
crash.

This commit introduces plat_prng_add_jitter_entropy_norpc() and
provides a default implementation which does nothing if the time source
is the REE, thus fixing the issue while still allowing platform code to
implement a specific behavior.

Fixes: 82f97f19fe2d ("prng: call plat_prng_add_jitter_entropy() at PRNG init and before NW RPC")
Reported-by: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

[Review] core: prng: Don't try to read REE time when it's not possible

Remove useless return.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: remove unused FS key manager features

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: SQL FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander

core: SQL FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: REE FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander

core: REE FS: use the new hash tree interface

Uses the new hash tree interface to implement secure storage.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: provide a hash tree for secure storage

Provides a hash tree to be used by REE and SQL FS for the secure storage
implementation.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Sig

core: provide a hash tree for secure storage

Provides a hash tree to be used by REE and SQL FS for the secure storage
implementation.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: provide tee_fs_fek_crypt()

FS key manager provides tee_fs_fek_crypt().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: remove obsolete <tee/tee_fs_defs.h>

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

core: Add tee_time_busy_wait()

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linar

core: Add tee_time_busy_wait()

Signed-off-by: Victor Chong <victor.chong@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
[jf: rebase on top of master]
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

prng: move old implementation to be weak default

The patch replaces the original entropy scheme using system time with
the new api plat_prng_add_jitter_entropy().

The old scheme aimed to get 64 bit

prng: move old implementation to be weak default

The patch replaces the original entropy scheme using system time with
the new api plat_prng_add_jitter_entropy().

The old scheme aimed to get 64 bits of entropy from the current time
expressed in 64 bits in ms each time. Most of this was in fact zeros or
unchanging for >256s. If you call it twice with 1ms, it actually
provides 0 bits of entropy.

The replacement scheme aims to get 2 bits of entropy from the counter,
which typically operates faster than 1MHz, greater than a thousand times
more precision than the old way, each time.

For backwards compatibility, the old scheme is retained as the default
or arches or platforms that did not provide an override to collect
jitter in a better way.

Signed-off-by: Andy Green <andy@warmcat.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

prng: implement CNTPCT-based jitter entropy for all arm arch devices

Tests dumping CNTPCT at the same point in three boots on Hikey
gave the following spread:

0xebff3fdd80daceb5
0xebff3fdd80da4601

prng: implement CNTPCT-based jitter entropy for all arm arch devices

Tests dumping CNTPCT at the same point in three boots on Hikey
gave the following spread:

0xebff3fdd80daceb5
0xebff3fdd80da4601
0xeaff3fdd7edb5dcc

things like eMMC async init from power up, interrupt jitter, branch
prediction misses, peripheral async clock drift, cache fill delays,
and so on accumulate in the counter at better than us resolution,
and make the exact count we reach the dump point differ, even in a
supposedly deterministic boot flow.

There appear to be ~12 bits of real entropy in the initial jitter, by
the time of the sample point which was at OP-TEE entry from a-t-f.

A new general jitter harvesting API is introduced
plat_prng_add_jitter_entropy(). The first time it is called on
PRNG init, 16 bits of CNTPCT are used as seed entropy. Thereafter
only the two LSB of CNTPCT are harvested each time, being provided
as entropy to the PRNG every time it reaches 8 bits.

Signed-off-by: Andy Green <andy@warmcat.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

rename 'static TA' into 'pseudo TA'

This renaming prevents confusion of what is a static TA: static
TAs are NOT Trusted Application operating at OP-TEE core privilege
execution level. There are rath

rename 'static TA' into 'pseudo TA'

This renaming prevents confusion of what is a static TA: static
TAs are NOT Trusted Application operating at OP-TEE core privilege
execution level. There are rather OP-TEE core services that offer
an invocation API based on GP TEE specified invocation API:
open session, invoke command and close session.

This change renames all 'static TA' references into 'pseudo TA'
references.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: RPMB FS: nullify fops when resetting an enumerator

According to the GP spec, TEE_ResetPersistentObjectEnumerator() "resets
an object enumerator handle to its initial state after allocation".
T

core: RPMB FS: nullify fops when resetting an enumerator

According to the GP spec, TEE_ResetPersistentObjectEnumerator() "resets
an object enumerator handle to its initial state after allocation".
Therefore, syscall_storage_reset_enum() should set e->fops = NULL.

This fixes a regression introduced when the FOP interface was reworked.
I'm not simply reverting the return code from TEE_ERROR_GENERIC back to
TEE_ERROR_ITEM_NOT_FOUND, because the new code makes sense and it is
more sane to properly reset the state of the enumerator.

Consequently, tee_svc_close_enum() is updated to accept e->fops == NULL
which is valid when the enum has just been allocated or reset but not
started. We should not return an error status in this case.

Tested on HiKey using xtest with GP tests (all 3 filesystems: REE, SQL,
RPMB).

Fixes: b86c18ecc7d3 ("core: RPMB FS: prepare for new FOP interface")
Fixes: https://github.com/OP-TEE/optee_os/issues/1332
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: bugfix tee_uuid_from_octets()

Fixes undefined behavior (shift out of bounds) in tee_uuid_from_octets().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wikland

core: bugfix tee_uuid_from_octets()

Fixes undefined behavior (shift out of bounds) in tee_uuid_from_octets().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

RPMB: fix tee_rpmb_free()

Don't call thread_rpc_free_payload() unless thread_rpc_alloc_payload()
was successful, which is when the physical address is non-zero.

Fixes: https://github.com/OP-TEE/opt

RPMB: fix tee_rpmb_free()

Don't call thread_rpc_free_payload() unless thread_rpc_alloc_payload()
was successful, which is when the physical address is non-zero.

Fixes: https://github.com/OP-TEE/optee_os/issues/1319
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Move definitions from optee_msg.h to optee_msg_supplicant.h

Commands that are specific to tee-supplicant belong in their own file.
This allows optee_msg.h to remain untouched as more supplicant comm

Move definitions from optee_msg.h to optee_msg_supplicant.h

Commands that are specific to tee-supplicant belong in their own file.
This allows optee_msg.h to remain untouched as more supplicant commands
are added. With this change:
- optee_msg.h is used by the driver and OP-TEE OS (note: there are two
slightly different versions of the file adapted to each environment but
they define the same things)
- optee_msg_supplicant.h is used by OP-TEE OS and tee-supplicant

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Rename optee_msg_fs.h to optee_msg_supplicant.h

The file contains the definition of the RPC interface with
tee-supplicant, not limited to filesystem functions.

Signed-off-by: Jerome Forissier <jero

Rename optee_msg_fs.h to optee_msg_supplicant.h

The file contains the definition of the RPC interface with
tee-supplicant, not limited to filesystem functions.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

storage: RPMB: don't try to program the RPMB key by default

Prevent leakage of the RPMB security key by never programming it,
unless a special build option is set (CFG_RPMB_WRITE_KEY=y).

Signed-off

storage: RPMB: don't try to program the RPMB key by default

Prevent leakage of the RPMB security key by never programming it,
unless a special build option is set (CFG_RPMB_WRITE_KEY=y).

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add paged secure shared memory

Adds feature to allocate paged secure memory that can be transferred
between TAs as needed.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by

core: add paged secure shared memory

Adds feature to allocate paged secure memory that can be transferred
between TAs as needed.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by Volodymyr Babchuk <vlad.babchuk@gmail.com>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU, Hikey)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...