storage: sqlfs: save memory when sql_fs_ftruncate() extends a file

There is no need to actually allocate a buffer filled with zeroes in
sql_fs_ftruncate(). Instead, update write_block_partial() so t

storage: sqlfs: save memory when sql_fs_ftruncate() extends a file

There is no need to actually allocate a buffer filled with zeroes in
sql_fs_ftruncate(). Instead, update write_block_partial() so that a
NULL data pointer means all null bytes. This eliminates a large (4K)
temporary allocation.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

rpmb: move rpmb_mutex to fs layer

In rpmb_fs_write(), if other session write RPMB between read_fat() and
tee_rpmb_write(), it may write to the same address. So move rpmb_mutex
to fs layer for concur

rpmb: move rpmb_mutex to fs layer

In rpmb_fs_write(), if other session write RPMB between read_fat() and
tee_rpmb_write(), it may write to the same address. So move rpmb_mutex
to fs layer for concurrency scenarios.

Signed-off-by: Lijianhui (Airbak) <airbak.li@hisilicon.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: init FS key manager late

Switches to service_init_late() to initialize FS key manager as it
depends on the tee_cryp_init service init call.

Reviewed-by: Jerome Forissier <jerome.forissier@lin

core: init FS key manager late

Switches to service_init_late() to initialize FS key manager as it
depends on the tee_cryp_init service init call.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

secure storage: move common RPC code to its own file

The REE and SQL filesystems use similar RPC calls to tee-supplicant,
only with a different command ID. Move the code to a common file.

Signed-of

secure storage: move common RPC code to its own file

The REE and SQL filesystems use similar RPC calls to tee-supplicant,
only with a different command ID. Move the code to a common file.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

secure storage: add SQL filesystem

This commit adds a new container type for trusted storage: SQL FS.
Data are stored in the non-secure world, just like the REE FS
(CFG_REE_FS). But, unlike REE FS w

secure storage: add SQL filesystem

This commit adds a new container type for trusted storage: SQL FS.
Data are stored in the non-secure world, just like the REE FS
(CFG_REE_FS). But, unlike REE FS which manipulates several files for
each secure object, this implementation needs only one container in a
SQLite database per secure object. We rely on the transaction-based
nature of the database to provide atomicity.

A storage identifier is added to the TA API: TEE_STORAGE_PRIVATE_SQL.
Trusted applications can use it to select this filesystem. The value
TEE_STORAGE_PRIVATE defined by GlobalPlatform will also select the
SQL FS if all other implementations are disabled.

This feature is enabled with CFG_SQL_FS=y. It depends on SQL support
in tee-supplicant [1].

[1] https://github.com/OP-TEE/optee_client/pull/50

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jerome Forissier <jerome.forissier@linaro.org> (HiKey)
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

secure storage: make sure we don't try to delete a NULL file

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David Brown

secure storage: make sure we don't try to delete a NULL file

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

secure storage: add flag TEE_FS_S_IXUSR and use it

This flag should logically be set on directories so that they can be
traversed.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Revi

secure storage: add flag TEE_FS_S_IXUSR and use it

This flag should logically be set on directories so that they can be
traversed.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

secure storage: use absolute paths

Update the functions that create file and directory paths so that they
always output a leading slash, meaning an absolute path in the
underlying filesystem. In add

secure storage: use absolute paths

Update the functions that create file and directory paths so that they
always output a leading slash, meaning an absolute path in the
underlying filesystem. In addition to being cleaner, this can avoid
path manipulations in the lower-level code. For instance, code using
libsqlfs in tee-supplicant can use the path as-is. It does not make a
difference with code that would prepend a more complex path anyway.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

secure storage: move TEE_FS_MODE_* constants out of tee_fs_defs.h

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David B

secure storage: move TEE_FS_MODE_* constants out of tee_fs_defs.h

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>
Reviewed-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: review assert and panic traces

Replace few "{ EMSG(...); panic(); }" with "panic(...);".

Disable file/line/func debug traces in panic() logs when
CFG_TEE_CORE_DEBUG is disable.

Change __asse

core: review assert and panic traces

Replace few "{ EMSG(...); panic(); }" with "panic(...);".

Disable file/line/func debug traces in panic() logs when
CFG_TEE_CORE_DEBUG is disable.

Change __assert_log() uses EMSG_RAW() to no pollute trace with
__assert_log() internals (duplicated file/line/func traces).

Change assert() to use a low/high verbosity mode upon
CFG_TEE_CORE_DEBUG as panic() does.

Change assert() to also trace the C function where assertion failed.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jen.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (QEMU)

show more ...

core: remove TEE_ASSERT()

TEE_ASSERT() can be confusing regarding assert() as assert() can
be disabled through NDEBUG while TEE_ASSERT() can't.
Instead one should explicitly implement "if (cond) { p

core: remove TEE_ASSERT()

TEE_ASSERT() can be confusing regarding assert() as assert() can
be disabled through NDEBUG while TEE_ASSERT() can't.
Instead one should explicitly implement "if (cond) { panic(); }"

This patch removes several inclusions on tee_common_unpg.h as it
used to define TEE_ASSERT() that has been removed.

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jen.wiklander@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (QEMU)

show more ...

assert/panic: fix misuse of assert/panic

Currently implementation of macro assert() does not expand to a
no-op when NDEBUG is defined. This will be done in a later change.
Before that, fix misuses o

assert/panic: fix misuse of assert/panic

Currently implementation of macro assert() does not expand to a
no-op when NDEBUG is defined. This will be done in a later change.
Before that, fix misuses of assert() and TEE_ASSERT():
- Correct misplaced assert() that should panic() whatever NDEBUG.
- Correct misplaced TEE_ASSERT() that should simply assert().

Also cleanup many inclusions of "assert.h" and few calls of assert().

Signed-off-by: Jens Wiklander <jen.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (QEMU)

show more ...

storage: rpmb: call tee_fs_generate_fek() to generate FEK

The File Encryption Key is generated randomly but not encrypted by the
key manager before being written to the RPMB FAT. In other words, we

storage: rpmb: call tee_fs_generate_fek() to generate FEK

The File Encryption Key is generated randomly but not encrypted by the
key manager before being written to the RPMB FAT. In other words, we
consider that the RNG outputs an already encrypted key.
For consistency, call tee_fs_generate_fek() instead.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>

show more ...

storage: encrypt the FEK with a TA-specific key

The File Encryption Key is now encrypted with a Trusted application
Storage Key (TSK) rather than directly with the Secure Storage Key.
The TSK is der

storage: encrypt the FEK with a TA-specific key

The File Encryption Key is now encrypted with a Trusted application
Storage Key (TSK) rather than directly with the Secure Storage Key.
The TSK is derived from the SSK and the TA UUID. This improves
isolation between TAs, and makes it impossible to read the data of a
TA from another TA after manually moving files in the REE filesystem
for instance.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: David Brown <david.brown@linaro.org>

show more ...

storage: return TEE_ERROR_ITEM_NOT_FOUND when storage ID is unknown

As per the GP specification for functions TEE_OpenPersistentObject(),
TEE_CreatePersistentObject() and TEE_StartPersitetntObjectEn

storage: return TEE_ERROR_ITEM_NOT_FOUND when storage ID is unknown

As per the GP specification for functions TEE_OpenPersistentObject(),
TEE_CreatePersistentObject() and TEE_StartPersitetntObjectEnumerator(),
return TEE_ERROR_ITEM_NOT_FOUND when the storage ID is invalid instead
of TEE_ERROR_STORAGE_NOT_AVAILABLE.

Note:
The code modified in this commit cannot currently be reached because
libutee rejects invalid storage IDs with TEE_ERROR_ITEM_NOT_FOUND
already. But a patch is on the way [1] that will remove this user-mode
test, so fix the bug before it can happen.

[1] https://github.com/OP-TEE/optee_os/pull/938

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: fix race to allocate secure buffer

Fixes race to allocate secure buffer for TA to TA communication.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander

core: fix race to allocate secure buffer

Fixes race to allocate secure buffer for TA to TA communication.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_fs_generate_fek(): return BAD_PARAMETERS when size is invalid

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

core: struct tee_ta_session: remove calling_sess

Removes calling_sess from struct tee_ta_session as the information is
available via link_tsd instead.

Reviewed-by: Joakim Bech <joakim.bech@linaro.o

core: struct tee_ta_session: remove calling_sess

Removes calling_sess from struct tee_ta_session as the information is
available via link_tsd instead.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: replace tee_ta_set_current_session()

Replace tee_ta_set_current_session() with tee_ta_push_current_session()
and tee_ta_pop_current_session() to set and restore the current session
in a stack

core: replace tee_ta_set_current_session()

Replace tee_ta_set_current_session() with tee_ta_push_current_session()
and tee_ta_pop_current_session() to set and restore the current session
in a stack like fashion.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: update tee_svc_copy_{to,from}_user

Removes the sess parameter to tee_svc_copy_to_user(),
tee_svc_copy_from_user() and tee_svc_copy_kaddr_to_uref() as it's always
passed as either NULL or curre

core: update tee_svc_copy_{to,from}_user

Removes the sess parameter to tee_svc_copy_to_user(),
tee_svc_copy_from_user() and tee_svc_copy_kaddr_to_uref() as it's always
passed as either NULL or current session.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: use register_phys_mem() in pcsc driver

Uses register_phys_mem() in pcsc driver to make sure the required
physical addresses are mapped.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signe

core: use register_phys_mem() in pcsc driver

Uses register_phys_mem() in pcsc driver to make sure the required
physical addresses are mapped.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_obj_attr_to_binary: fix short buffer check

Fixes short buffer check at end of tee_obj_attr_to_binary().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jens Wiklander <je

tee_obj_attr_to_binary: fix short buffer check

Fixes short buffer check at end of tee_obj_attr_to_binary().

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Jens Wiklander <jens.wiklander@linaro.org> (QEMU)
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_obj_attr_to_binary: fix undefined behavior with data == NULL

To query the size needed for some attribute, one may set data to NULL
and pass the address of an uninitialized buffer as data_len.
In

tee_obj_attr_to_binary: fix undefined behavior with data == NULL

To query the size needed for some attribute, one may set data to NULL
and pass the address of an uninitialized buffer as data_len.
In this case, *data_len should not be read but only written to.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

RPMB: rpmb_fs_read: return 0 if position is after end of file

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

RPMB: rpmb_fs_read: don't forget to increment file position

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>