core: remove TEE_ASSERT()

TEE_ASSERT() can be confusing regarding assert() as assert() can
be disabled through NDEBUG while TEE_ASSERT() can't.
Instead one should explicitly implement "if (cond) { p

core: remove TEE_ASSERT()

TEE_ASSERT() can be confusing regarding assert() as assert() can
be disabled through NDEBUG while TEE_ASSERT() can't.
Instead one should explicitly implement "if (cond) { panic(); }"

This patch removes several inclusions on tee_common_unpg.h as it
used to define TEE_ASSERT() that has been removed.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jen.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (QEMU)

show more ...

assert/panic: fix misuse of assert/panic

Currently implementation of macro assert() does not expand to a
no-op when NDEBUG is defined. This will be done in a later change.
Before that, fix misuses o

assert/panic: fix misuse of assert/panic

Currently implementation of macro assert() does not expand to a
no-op when NDEBUG is defined. This will be done in a later change.
Before that, fix misuses of assert() and TEE_ASSERT():
- Correct misplaced assert() that should panic() whatever NDEBUG.
- Correct misplaced TEE_ASSERT() that should simply assert().

Also cleanup many inclusions of "assert.h" and few calls of assert().

Signed-off-by: Jens Wiklander <jen.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (QEMU)

show more ...

storage: rpmb: call tee_fs_generate_fek() to generate FEK

The File Encryption Key is generated randomly but not encrypted by the
key manager before being written to the RPMB FAT. In other words, we

storage: rpmb: call tee_fs_generate_fek() to generate FEK

The File Encryption Key is generated randomly but not encrypted by the
key manager before being written to the RPMB FAT. In other words, we
consider that the RNG outputs an already encrypted key.
For consistency, call tee_fs_generate_fek() instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>

show more ...

storage: encrypt the FEK with a TA-specific key

The File Encryption Key is now encrypted with a Trusted application
Storage Key (TSK) rather than directly with the Secure Storage Key.
The TSK is der

storage: encrypt the FEK with a TA-specific key

The File Encryption Key is now encrypted with a Trusted application
Storage Key (TSK) rather than directly with the Secure Storage Key.
The TSK is derived from the SSK and the TA UUID. This improves
isolation between TAs, and makes it impossible to read the data of a
TA from another TA after manually moving files in the REE filesystem
for instance.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>

show more ...

storage: return TEE_ERROR_ITEM_NOT_FOUND when storage ID is unknown

As per the GP specification for functions TEE_OpenPersistentObject(),
TEE_CreatePersistentObject() and TEE_StartPersitetntObjectEn

storage: return TEE_ERROR_ITEM_NOT_FOUND when storage ID is unknown

As per the GP specification for functions TEE_OpenPersistentObject(),
TEE_CreatePersistentObject() and TEE_StartPersitetntObjectEnumerator(),
return TEE_ERROR_ITEM_NOT_FOUND when the storage ID is invalid instead
of TEE_ERROR_STORAGE_NOT_AVAILABLE.

Note:
The code modified in this commit cannot currently be reached because
libutee rejects invalid storage IDs with TEE_ERROR_ITEM_NOT_FOUND
already. But a patch is on the way [1] that will remove this user-mode
test, so fix the bug before it can happen.

[1] https://github.com/OP-TEE/optee_os/pull/938

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: fix race to allocate secure buffer

Fixes race to allocate secure buffer for TA to TA communication.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander

core: fix race to allocate secure buffer

Fixes race to allocate secure buffer for TA to TA communication.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_fs_generate_fek(): return BAD_PARAMETERS when size is invalid

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

core: struct tee_ta_session: remove calling_sess

Removes calling_sess from struct tee_ta_session as the information is
available via link_tsd instead.

Reviewed-by: Joakim Bech <joakim.bech@linaro.o

core: struct tee_ta_session: remove calling_sess

Removes calling_sess from struct tee_ta_session as the information is
available via link_tsd instead.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: replace tee_ta_set_current_session()

Replace tee_ta_set_current_session() with tee_ta_push_current_session()
and tee_ta_pop_current_session() to set and restore the current session
in a stack

core: replace tee_ta_set_current_session()

Replace tee_ta_set_current_session() with tee_ta_push_current_session()
and tee_ta_pop_current_session() to set and restore the current session
in a stack like fashion.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: update tee_svc_copy_{to,from}_user

Removes the sess parameter to tee_svc_copy_to_user(),
tee_svc_copy_from_user() and tee_svc_copy_kaddr_to_uref() as it's always
passed as either NULL or curre

core: update tee_svc_copy_{to,from}_user

Removes the sess parameter to tee_svc_copy_to_user(),
tee_svc_copy_from_user() and tee_svc_copy_kaddr_to_uref() as it's always
passed as either NULL or current session.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: use register_phys_mem() in pcsc driver

Uses register_phys_mem() in pcsc driver to make sure the required
physical addresses are mapped.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signe

core: use register_phys_mem() in pcsc driver

Uses register_phys_mem() in pcsc driver to make sure the required
physical addresses are mapped.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_obj_attr_to_binary: fix short buffer check

Fixes short buffer check at end of tee_obj_attr_to_binary().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jens Wiklander <je

tee_obj_attr_to_binary: fix short buffer check

Fixes short buffer check at end of tee_obj_attr_to_binary().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_obj_attr_to_binary: fix undefined behavior with data == NULL

To query the size needed for some attribute, one may set data to NULL
and pass the address of an uninitialized buffer as data_len.
In

tee_obj_attr_to_binary: fix undefined behavior with data == NULL

To query the size needed for some attribute, one may set data to NULL
and pass the address of an uninitialized buffer as data_len.
In this case, *data_len should not be read but only written to.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

RPMB: rpmb_fs_read: return 0 if position is after end of file

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

RPMB: rpmb_fs_read: don't forget to increment file position

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

core: fix tee object attribute management

Prior to the patch the attribute management of tee objects occasionally
assumed that the attribute data didn't contain any addresses. This
assumption is inc

core: fix tee object attribute management

Prior to the patch the attribute management of tee objects occasionally
assumed that the attribute data didn't contain any addresses. This
assumption is incorrect for asymmetric key objects. This patch fixes
that by introducing an operation struct for each basic attribute type.

Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix undef behavior in tee_time_ta_set_offs()

Fixes undefined behavior in tee_time_ta_set_offs() when
tee_time_offs is initially NULL.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-

core: fix undef behavior in tee_time_ta_set_offs()

Fixes undefined behavior in tee_time_ta_set_offs() when
tee_time_offs is initially NULL.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU, FVP)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix TEE_ALG_RSASSA_PKCS1_* signing

Signing with the algorithms TEE_ALG_RSASSA_PKCS1_* allows an optional
parameter, salt length. If the salt lengths isn't supplied the default
value should be

core: fix TEE_ALG_RSASSA_PKCS1_* signing

Signing with the algorithms TEE_ALG_RSASSA_PKCS1_* allows an optional
parameter, salt length. If the salt lengths isn't supplied the default
value should be the length of the digest.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Suggested-by: Cedric Chaumont <cedric.chaumont@st.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix attribute size check of transient object

Fixes bad check of attribute size when populating a transient object.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Foriss

core: fix attribute size check of transient object

Fixes bad check of attribute size when populating a transient object.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Change some fs messages to debug

Trying to open a file that doesn't exist, or trying to write to a file
that does exist are part of normal use of a filesystem. Demote these
two messages to debug in

Change some fs messages to debug

Trying to open a file that doesn't exist, or trying to write to a file
that does exist are part of normal use of a filesystem. Demote these
two messages to debug instead of error to avoid flooding the error log
with messages that come from ordinary use.

Signed-off-by: David Brown <david.brown@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Persistent objects: save handle information

When creating a Persistent Object (TEE_CreatePersistentObject)
using an object handle, the information and attributes related
to the handle are saved.

Th

Persistent objects: save handle information

When creating a Persistent Object (TEE_CreatePersistentObject)
using an object handle, the information and attributes related
to the handle are saved.

The information are restored when opening the object
(TEE_OpenPersistentObject)

Fixes #785

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Pascal Brand <pascal.brand@st.com>

show more ...

core: bugfix tee_svc_copy_param()

tee_svc_copy_param() was doing a phys_to_virt() as if the physical
memory was in TEE ram. This patch fixes that by doing the lookup in TA
ram instead.

Reviewed-by:

core: bugfix tee_svc_copy_param()

tee_svc_copy_param() was doing a phys_to_virt() as if the physical
memory was in TEE ram. This patch fixes that by doing the lookup in TA
ram instead.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Tested-by: Pascal Brand <pascal.brand@linaro.org> (STM)
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: remove kmap interface

Removes kmap interface as the secure DDR memory is mapped already.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@li

core: remove kmap interface

Removes kmap interface as the secure DDR memory is mapped already.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: bugfix pcsc driver

Fixes pscs driver to translate base address of register to virtual
address before use to be able to handle non-linear mapping of memory.

Reviewed-by: Jerome Forissier <jero

core: bugfix pcsc driver

Fixes pscs driver to translate base address of register to virtual
address before use to be able to handle non-linear mapping of memory.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: secure storage: dual filesystems support

Adds support for multiple filesystems by keeping a pointer to
tee_file_operations in the tee_pobj and tee_storage_enum structures.

Two identifiers are

core: secure storage: dual filesystems support

Adds support for multiple filesystems by keeping a pointer to
tee_file_operations in the tee_pobj and tee_storage_enum structures.

Two identifiers are added to the API to be used as the storage_id
parameter, so that TAs may dynamically choose the filesystem:
- TEE_STORAGE_PRIVATE_REE (requires CFG_REE_FS=y)
- TEE_STORAGE_PRIVATE_RPMB (requires CFG_RPMB_FS=y)
The value TEE_STORAGE_PRIVATE will select the REE FS if available,
otherwise RPMB. At least one FS has to be enabled at build time. Only
the REE filesystem is enabled by default.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Pascal Brand <pascal.brand@linaro.org>

show more ...