1 /* 2 * Copyright (c) 2014, STMicroelectronics International N.V. 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions are met: 7 * 8 * 1. Redistributions of source code must retain the above copyright notice, 9 * this list of conditions and the following disclaimer. 10 * 11 * 2. Redistributions in binary form must reproduce the above copyright notice, 12 * this list of conditions and the following disclaimer in the documentation 13 * and/or other materials provided with the distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" 16 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 17 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE 19 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 20 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 21 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 22 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 23 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 24 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 25 * POSSIBILITY OF SUCH DAMAGE. 26 */ 27 28 #include <kernel/mutex.h> 29 #include <kernel/tee_misc.h> 30 #include <kernel/tee_ta_manager.h> 31 #include <mm/tee_mmu.h> 32 #include <string.h> 33 #include <tee_api_defines_extensions.h> 34 #include <tee_api_defines.h> 35 #include <tee/tee_fs.h> 36 #include <tee/tee_obj.h> 37 #include <tee/tee_pobj.h> 38 #include <tee/tee_svc_cryp.h> 39 #include <tee/tee_svc.h> 40 #include <tee/tee_svc_storage.h> 41 #include <trace.h> 42 43 /* 44 * Returns the appropriate tee_file_operations for the specified storage ID. 45 * The value TEE_STORAGE_PRIVATE will select the REE FS if available, otherwise 46 * RPMB. 47 */ 48 static const struct tee_file_operations *file_ops(uint32_t storage_id) 49 { 50 51 switch (storage_id) { 52 case TEE_STORAGE_PRIVATE: 53 #if defined(CFG_REE_FS) 54 return &ree_fs_ops; 55 #elif defined(CFG_RPMB_FS) 56 return &rpmb_fs_ops; 57 #elif defined(CFG_SQL_FS) 58 return &sql_fs_ops; 59 #else 60 #error At least one filesystem must be enabled. 61 #endif 62 #ifdef CFG_REE_FS 63 case TEE_STORAGE_PRIVATE_REE: 64 return &ree_fs_ops; 65 #endif 66 #ifdef CFG_RPMB_FS 67 case TEE_STORAGE_PRIVATE_RPMB: 68 return &rpmb_fs_ops; 69 #endif 70 #ifdef CFG_SQL_FS 71 case TEE_STORAGE_PRIVATE_SQL: 72 return &sql_fs_ops; 73 #endif 74 default: 75 return NULL; 76 } 77 } 78 79 /* SSF (Secure Storage File version 00 */ 80 #define TEE_SVC_STORAGE_MAGIC 0x53534600 81 82 /* Header of GP formated secure storage files */ 83 struct tee_svc_storage_head { 84 uint32_t magic; 85 uint32_t head_size; 86 uint32_t meta_size; 87 uint32_t ds_size; 88 uint32_t keySize; 89 uint32_t maxKeySize; 90 uint32_t objectUsage; 91 uint32_t objectType; 92 uint32_t have_attrs; 93 }; 94 95 struct tee_storage_enum { 96 TAILQ_ENTRY(tee_storage_enum) link; 97 struct tee_fs_dir *dir; 98 const struct tee_file_operations *fops; 99 }; 100 101 static TEE_Result tee_svc_storage_get_enum(struct user_ta_ctx *utc, 102 uint32_t enum_id, 103 struct tee_storage_enum **e_out) 104 { 105 struct tee_storage_enum *e; 106 107 TAILQ_FOREACH(e, &utc->storage_enums, link) { 108 if (enum_id == (vaddr_t)e) { 109 *e_out = e; 110 return TEE_SUCCESS; 111 } 112 } 113 return TEE_ERROR_BAD_PARAMETERS; 114 } 115 116 static TEE_Result tee_svc_close_enum(struct user_ta_ctx *utc, 117 struct tee_storage_enum *e) 118 { 119 if (e == NULL || utc == NULL) 120 return TEE_ERROR_BAD_PARAMETERS; 121 122 TAILQ_REMOVE(&utc->storage_enums, e, link); 123 124 if (e->fops) 125 e->fops->closedir(e->dir); 126 127 e->dir = NULL; 128 e->fops = NULL; 129 130 free(e); 131 132 return TEE_SUCCESS; 133 } 134 135 /* "/TA_uuid/object_id" or "/TA_uuid/.object_id" */ 136 TEE_Result tee_svc_storage_create_filename(void *buf, size_t blen, 137 struct tee_pobj *po, bool transient) 138 { 139 uint8_t *file = buf; 140 uint32_t pos = 0; 141 uint32_t hslen = 1 /* Leading slash */ 142 + TEE_B2HS_HSBUF_SIZE(sizeof(TEE_UUID) + po->obj_id_len) 143 + 1; /* Intermediate slash */ 144 145 /* +1 for the '.' (temporary persistent object) */ 146 if (transient) 147 hslen++; 148 149 if (blen < hslen) 150 return TEE_ERROR_SHORT_BUFFER; 151 152 file[pos++] = '/'; 153 pos += tee_b2hs((uint8_t *)&po->uuid, &file[pos], 154 sizeof(TEE_UUID), hslen); 155 file[pos++] = '/'; 156 157 if (transient) 158 file[pos++] = '.'; 159 160 tee_b2hs(po->obj_id, file + pos, po->obj_id_len, hslen - pos); 161 162 return TEE_SUCCESS; 163 } 164 165 /* "/TA_uuid" */ 166 TEE_Result tee_svc_storage_create_dirname(void *buf, size_t blen, 167 const TEE_UUID *uuid) 168 { 169 uint8_t *dir = buf; 170 uint32_t hslen = TEE_B2HS_HSBUF_SIZE(sizeof(TEE_UUID)) + 1; 171 172 if (blen < hslen) 173 return TEE_ERROR_SHORT_BUFFER; 174 175 dir[0] = '/'; 176 tee_b2hs((uint8_t *)uuid, dir + 1, sizeof(TEE_UUID), hslen); 177 178 return TEE_SUCCESS; 179 } 180 181 static TEE_Result tee_svc_storage_remove_corrupt_obj( 182 struct tee_ta_session *sess, 183 struct tee_obj *o) 184 { 185 o->pobj->fops->remove(o->pobj); 186 tee_obj_close(to_user_ta_ctx(sess->ctx), o); 187 188 return TEE_SUCCESS; 189 } 190 191 static TEE_Result tee_svc_storage_read_head(struct tee_obj *o) 192 { 193 TEE_Result res = TEE_SUCCESS; 194 size_t bytes; 195 struct tee_svc_storage_head head; 196 const struct tee_file_operations *fops = o->pobj->fops; 197 void *attr = NULL; 198 199 assert(!o->fh); 200 res = fops->open(o->pobj, &o->fh); 201 if (res != TEE_SUCCESS) 202 goto exit; 203 204 /* read head */ 205 bytes = sizeof(struct tee_svc_storage_head); 206 res = fops->read(o->fh, 0, &head, &bytes); 207 if (res != TEE_SUCCESS) { 208 if (res == TEE_ERROR_CORRUPT_OBJECT) 209 EMSG("Head corrupt\n"); 210 goto exit; 211 } 212 213 if (bytes != sizeof(struct tee_svc_storage_head)) { 214 res = TEE_ERROR_BAD_FORMAT; 215 goto exit; 216 } 217 218 res = tee_obj_set_type(o, head.objectType, head.maxKeySize); 219 if (res != TEE_SUCCESS) 220 goto exit; 221 222 o->ds_pos = sizeof(struct tee_svc_storage_head) + head.meta_size; 223 if (head.meta_size) { 224 attr = malloc(head.meta_size); 225 if (!attr) { 226 res = TEE_ERROR_OUT_OF_MEMORY; 227 goto exit; 228 } 229 230 /* read meta */ 231 bytes = head.meta_size; 232 res = fops->read(o->fh, sizeof(struct tee_svc_storage_head), 233 attr, &bytes); 234 if (res != TEE_SUCCESS || bytes != head.meta_size) { 235 res = TEE_ERROR_CORRUPT_OBJECT; 236 goto exit; 237 } 238 } 239 240 res = tee_obj_attr_from_binary(o, attr, head.meta_size); 241 if (res != TEE_SUCCESS) 242 goto exit; 243 244 o->info.dataSize = head.ds_size; 245 o->info.keySize = head.keySize; 246 o->info.objectUsage = head.objectUsage; 247 o->info.objectType = head.objectType; 248 o->have_attrs = head.have_attrs; 249 250 exit: 251 free(attr); 252 253 return res; 254 } 255 256 static TEE_Result tee_svc_storage_update_head(struct tee_obj *o, 257 uint32_t ds_size) 258 { 259 size_t pos = offsetof(struct tee_svc_storage_head, ds_size); 260 261 return o->pobj->fops->write(o->fh, pos, &ds_size, sizeof(uint32_t)); 262 } 263 264 static TEE_Result tee_svc_storage_init_file(struct tee_obj *o, 265 struct tee_obj *attr_o, void *data, 266 uint32_t len) 267 { 268 TEE_Result res = TEE_SUCCESS; 269 struct tee_svc_storage_head head; 270 const struct tee_file_operations *fops = o->pobj->fops; 271 void *attr = NULL; 272 size_t attr_size = 0; 273 274 res = fops->create(o->pobj, &o->fh); 275 if (res != TEE_SUCCESS) 276 goto exit; 277 278 if (attr_o) { 279 res = tee_obj_set_type(o, attr_o->info.objectType, 280 attr_o->info.maxKeySize); 281 if (res != TEE_SUCCESS) 282 goto exit; 283 res = tee_obj_attr_copy_from(o, attr_o); 284 if (res != TEE_SUCCESS) 285 goto exit; 286 o->have_attrs = attr_o->have_attrs; 287 o->info.objectUsage = attr_o->info.objectUsage; 288 o->info.keySize = attr_o->info.keySize; 289 res = tee_obj_attr_to_binary(o, NULL, &attr_size); 290 if (res != TEE_SUCCESS) 291 goto exit; 292 if (attr_size) { 293 attr = malloc(attr_size); 294 if (!attr) { 295 res = TEE_ERROR_OUT_OF_MEMORY; 296 goto exit; 297 } 298 res = tee_obj_attr_to_binary(o, attr, &attr_size); 299 if (res != TEE_SUCCESS) 300 goto exit; 301 } 302 } else { 303 res = tee_obj_set_type(o, TEE_TYPE_DATA, 0); 304 if (res != TEE_SUCCESS) 305 goto exit; 306 } 307 308 o->ds_pos = sizeof(struct tee_svc_storage_head) + attr_size; 309 310 /* write head */ 311 head.magic = TEE_SVC_STORAGE_MAGIC; 312 head.head_size = sizeof(struct tee_svc_storage_head); 313 head.meta_size = attr_size; 314 head.ds_size = len; 315 head.keySize = o->info.keySize; 316 head.maxKeySize = o->info.maxKeySize; 317 head.objectUsage = o->info.objectUsage; 318 head.objectType = o->info.objectType; 319 head.have_attrs = o->have_attrs; 320 321 /* write head */ 322 res = fops->write(o->fh, 0, &head, sizeof(struct tee_svc_storage_head)); 323 if (res != TEE_SUCCESS) 324 goto exit; 325 326 /* write meta */ 327 res = fops->write(o->fh, sizeof(struct tee_svc_storage_head), 328 attr, attr_size); 329 if (res != TEE_SUCCESS) 330 goto exit; 331 332 /* write init data */ 333 o->info.dataSize = len; 334 335 /* write data to fs if needed */ 336 if (data && len) 337 res = fops->write(o->fh, o->ds_pos, data, len); 338 339 exit: 340 free(attr); 341 fops->close(&o->fh); 342 343 return res; 344 } 345 346 TEE_Result syscall_storage_obj_open(unsigned long storage_id, void *object_id, 347 size_t object_id_len, unsigned long flags, 348 uint32_t *obj) 349 { 350 TEE_Result res; 351 struct tee_ta_session *sess; 352 struct tee_obj *o = NULL; 353 char *file = NULL; 354 struct tee_pobj *po = NULL; 355 struct user_ta_ctx *utc; 356 const struct tee_file_operations *fops = file_ops(storage_id); 357 size_t attr_size; 358 359 if (!fops) { 360 res = TEE_ERROR_ITEM_NOT_FOUND; 361 goto exit; 362 } 363 364 if (object_id_len > TEE_OBJECT_ID_MAX_LEN) { 365 res = TEE_ERROR_BAD_PARAMETERS; 366 goto exit; 367 } 368 369 res = tee_ta_get_current_session(&sess); 370 if (res != TEE_SUCCESS) 371 goto err; 372 utc = to_user_ta_ctx(sess->ctx); 373 374 res = tee_mmu_check_access_rights(utc, 375 TEE_MEMORY_ACCESS_READ | 376 TEE_MEMORY_ACCESS_ANY_OWNER, 377 (uaddr_t) object_id, 378 object_id_len); 379 if (res != TEE_SUCCESS) 380 goto err; 381 382 res = tee_pobj_get((void *)&sess->ctx->uuid, object_id, 383 object_id_len, flags, false, fops, &po); 384 if (res != TEE_SUCCESS) 385 goto err; 386 387 o = tee_obj_alloc(); 388 if (o == NULL) { 389 tee_pobj_release(po); 390 res = TEE_ERROR_OUT_OF_MEMORY; 391 goto err; 392 } 393 394 o->info.handleFlags = 395 TEE_HANDLE_FLAG_PERSISTENT | TEE_HANDLE_FLAG_INITIALIZED; 396 o->flags = flags; 397 o->pobj = po; 398 tee_obj_add(utc, o); 399 400 res = tee_svc_storage_read_head(o); 401 if (res != TEE_SUCCESS) { 402 if (res == TEE_ERROR_CORRUPT_OBJECT) { 403 EMSG("Object corrupt"); 404 goto err; 405 } 406 goto oclose; 407 } 408 409 res = tee_svc_copy_kaddr_to_uref(obj, o); 410 if (res != TEE_SUCCESS) 411 goto oclose; 412 413 res = tee_obj_attr_to_binary(o, NULL, &attr_size); 414 if (res != TEE_SUCCESS) 415 goto oclose; 416 417 goto exit; 418 419 oclose: 420 tee_obj_close(utc, o); 421 o = NULL; 422 423 err: 424 if (res == TEE_ERROR_NO_DATA || res == TEE_ERROR_BAD_FORMAT) 425 res = TEE_ERROR_CORRUPT_OBJECT; 426 if (res == TEE_ERROR_CORRUPT_OBJECT && o) 427 tee_svc_storage_remove_corrupt_obj(sess, o); 428 429 exit: 430 free(file); 431 file = NULL; 432 return res; 433 } 434 435 TEE_Result syscall_storage_obj_create(unsigned long storage_id, void *object_id, 436 size_t object_id_len, unsigned long flags, 437 unsigned long attr, void *data, size_t len, 438 uint32_t *obj) 439 { 440 TEE_Result res; 441 struct tee_ta_session *sess; 442 struct tee_obj *o = NULL; 443 struct tee_obj *attr_o = NULL; 444 struct tee_pobj *po = NULL; 445 struct user_ta_ctx *utc; 446 const struct tee_file_operations *fops = file_ops(storage_id); 447 size_t attr_size; 448 449 if (!fops) 450 return TEE_ERROR_ITEM_NOT_FOUND; 451 452 if (object_id_len > TEE_OBJECT_ID_MAX_LEN) 453 return TEE_ERROR_BAD_PARAMETERS; 454 455 res = tee_ta_get_current_session(&sess); 456 if (res != TEE_SUCCESS) 457 return res; 458 utc = to_user_ta_ctx(sess->ctx); 459 460 res = tee_mmu_check_access_rights(utc, 461 TEE_MEMORY_ACCESS_READ | 462 TEE_MEMORY_ACCESS_ANY_OWNER, 463 (uaddr_t) object_id, 464 object_id_len); 465 if (res != TEE_SUCCESS) 466 goto err; 467 468 res = tee_pobj_get((void *)&sess->ctx->uuid, object_id, 469 object_id_len, flags, true, fops, &po); 470 if (res != TEE_SUCCESS) 471 goto err; 472 473 /* check rights of the provided buffer */ 474 if (data && len) { 475 res = tee_mmu_check_access_rights(utc, 476 TEE_MEMORY_ACCESS_READ | 477 TEE_MEMORY_ACCESS_ANY_OWNER, 478 (uaddr_t) data, len); 479 480 if (res != TEE_SUCCESS) 481 goto err; 482 } 483 484 o = tee_obj_alloc(); 485 if (o == NULL) { 486 res = TEE_ERROR_OUT_OF_MEMORY; 487 goto err; 488 } 489 490 o->info.handleFlags = 491 TEE_HANDLE_FLAG_PERSISTENT | TEE_HANDLE_FLAG_INITIALIZED; 492 o->flags = flags; 493 o->pobj = po; 494 495 if (attr != TEE_HANDLE_NULL) { 496 res = tee_obj_get(utc, tee_svc_uref_to_vaddr(attr), 497 &attr_o); 498 if (res != TEE_SUCCESS) 499 goto err; 500 } 501 502 res = tee_svc_storage_init_file(o, attr_o, data, len); 503 if (res != TEE_SUCCESS) 504 goto err; 505 506 /* rename temporary persistent object filename */ 507 po->temporary = false; 508 res = fops->rename(po, NULL, !!(flags & TEE_DATA_FLAG_OVERWRITE)); 509 if (res != TEE_SUCCESS) 510 goto rmfile; 511 512 res = fops->open(po, &o->fh); 513 if (res != TEE_SUCCESS) 514 goto err; 515 516 tee_obj_add(utc, o); 517 518 res = tee_svc_copy_kaddr_to_uref(obj, o); 519 if (res != TEE_SUCCESS) 520 goto oclose; 521 522 res = tee_obj_attr_to_binary(o, NULL, &attr_size); 523 if (res != TEE_SUCCESS) 524 goto oclose; 525 526 return TEE_SUCCESS; 527 528 oclose: 529 tee_obj_close(utc, o); 530 return res; 531 532 rmfile: 533 fops->remove(po); 534 535 err: 536 if (res == TEE_ERROR_NO_DATA || res == TEE_ERROR_BAD_FORMAT) 537 res = TEE_ERROR_CORRUPT_OBJECT; 538 if (res == TEE_ERROR_CORRUPT_OBJECT && po) 539 fops->remove(po); 540 if (o) 541 fops->close(&o->fh); 542 if (po) 543 tee_pobj_release(po); 544 free(o); 545 546 return res; 547 } 548 549 TEE_Result syscall_storage_obj_del(unsigned long obj) 550 { 551 TEE_Result res; 552 struct tee_ta_session *sess; 553 struct tee_obj *o; 554 struct user_ta_ctx *utc; 555 556 res = tee_ta_get_current_session(&sess); 557 if (res != TEE_SUCCESS) 558 return res; 559 utc = to_user_ta_ctx(sess->ctx); 560 561 res = tee_obj_get(utc, tee_svc_uref_to_vaddr(obj), &o); 562 if (res != TEE_SUCCESS) 563 return res; 564 565 if (!(o->flags & TEE_DATA_FLAG_ACCESS_WRITE_META)) 566 return TEE_ERROR_ACCESS_CONFLICT; 567 568 if (o->pobj == NULL || o->pobj->obj_id == NULL) 569 return TEE_ERROR_BAD_STATE; 570 571 res = o->pobj->fops->remove(o->pobj); 572 tee_obj_close(utc, o); 573 574 return res; 575 } 576 577 TEE_Result syscall_storage_obj_rename(unsigned long obj, void *object_id, 578 size_t object_id_len) 579 { 580 TEE_Result res; 581 struct tee_ta_session *sess; 582 struct tee_obj *o; 583 struct tee_pobj *po = NULL; 584 char *new_file = NULL; 585 char *old_file = NULL; 586 struct user_ta_ctx *utc; 587 const struct tee_file_operations *fops; 588 589 if (object_id_len > TEE_OBJECT_ID_MAX_LEN) 590 return TEE_ERROR_BAD_PARAMETERS; 591 592 res = tee_ta_get_current_session(&sess); 593 if (res != TEE_SUCCESS) 594 return res; 595 utc = to_user_ta_ctx(sess->ctx); 596 597 res = tee_obj_get(utc, tee_svc_uref_to_vaddr(obj), &o); 598 if (res != TEE_SUCCESS) 599 return res; 600 601 if (!(o->info.handleFlags & TEE_HANDLE_FLAG_PERSISTENT)) { 602 res = TEE_ERROR_BAD_STATE; 603 goto exit; 604 } 605 606 if (!(o->flags & TEE_DATA_FLAG_ACCESS_WRITE_META)) { 607 res = TEE_ERROR_BAD_STATE; 608 goto exit; 609 } 610 611 if (o->pobj == NULL || o->pobj->obj_id == NULL) { 612 res = TEE_ERROR_BAD_STATE; 613 goto exit; 614 } 615 616 res = tee_mmu_check_access_rights(utc, 617 TEE_MEMORY_ACCESS_READ | 618 TEE_MEMORY_ACCESS_ANY_OWNER, 619 (uaddr_t) object_id, object_id_len); 620 if (res != TEE_SUCCESS) 621 goto exit; 622 623 /* reserve dest name */ 624 fops = o->pobj->fops; 625 res = tee_pobj_get((void *)&sess->ctx->uuid, object_id, 626 object_id_len, TEE_DATA_FLAG_ACCESS_WRITE_META, 627 false, fops, &po); 628 if (res != TEE_SUCCESS) 629 goto exit; 630 631 /* move */ 632 res = fops->rename(o->pobj, po, false /* no overwrite */); 633 if (res == TEE_ERROR_GENERIC) 634 goto exit; 635 636 res = tee_pobj_rename(o->pobj, object_id, object_id_len); 637 638 exit: 639 tee_pobj_release(po); 640 641 free(new_file); 642 free(old_file); 643 644 return res; 645 } 646 647 TEE_Result syscall_storage_alloc_enum(uint32_t *obj_enum) 648 { 649 struct tee_storage_enum *e; 650 struct tee_ta_session *sess; 651 TEE_Result res; 652 struct user_ta_ctx *utc; 653 654 if (obj_enum == NULL) 655 return TEE_ERROR_BAD_PARAMETERS; 656 657 res = tee_ta_get_current_session(&sess); 658 if (res != TEE_SUCCESS) 659 return res; 660 utc = to_user_ta_ctx(sess->ctx); 661 662 e = malloc(sizeof(struct tee_storage_enum)); 663 if (e == NULL) 664 return TEE_ERROR_OUT_OF_MEMORY; 665 666 e->dir = NULL; 667 e->fops = NULL; 668 TAILQ_INSERT_TAIL(&utc->storage_enums, e, link); 669 670 return tee_svc_copy_kaddr_to_uref(obj_enum, e); 671 } 672 673 TEE_Result syscall_storage_free_enum(unsigned long obj_enum) 674 { 675 struct tee_storage_enum *e; 676 TEE_Result res; 677 struct tee_ta_session *sess; 678 struct user_ta_ctx *utc; 679 680 res = tee_ta_get_current_session(&sess); 681 if (res != TEE_SUCCESS) 682 return res; 683 utc = to_user_ta_ctx(sess->ctx); 684 685 res = tee_svc_storage_get_enum(utc, 686 tee_svc_uref_to_vaddr(obj_enum), &e); 687 if (res != TEE_SUCCESS) 688 return res; 689 690 return tee_svc_close_enum(utc, e); 691 } 692 693 TEE_Result syscall_storage_reset_enum(unsigned long obj_enum) 694 { 695 struct tee_storage_enum *e; 696 TEE_Result res; 697 struct tee_ta_session *sess; 698 699 res = tee_ta_get_current_session(&sess); 700 if (res != TEE_SUCCESS) 701 return res; 702 703 res = tee_svc_storage_get_enum(to_user_ta_ctx(sess->ctx), 704 tee_svc_uref_to_vaddr(obj_enum), &e); 705 if (res != TEE_SUCCESS) 706 return res; 707 708 e->fops->closedir(e->dir); 709 e->fops = NULL; 710 e->dir = NULL; 711 712 return TEE_SUCCESS; 713 } 714 715 static TEE_Result tee_svc_storage_set_enum(struct tee_fs_dirent *d, 716 const struct tee_file_operations *fops, 717 struct tee_obj *o) 718 { 719 o->info.handleFlags = 720 TEE_HANDLE_FLAG_PERSISTENT | TEE_HANDLE_FLAG_INITIALIZED; 721 o->info.objectUsage = TEE_USAGE_DEFAULT; 722 723 o->pobj->obj_id = malloc(d->oidlen); 724 if (!o->pobj->obj_id) 725 return TEE_ERROR_OUT_OF_MEMORY; 726 727 memcpy(o->pobj->obj_id, d->oid, d->oidlen); 728 o->pobj->obj_id_len = d->oidlen; 729 o->pobj->fops = fops; 730 731 return TEE_SUCCESS; 732 } 733 734 TEE_Result syscall_storage_start_enum(unsigned long obj_enum, 735 unsigned long storage_id) 736 { 737 struct tee_storage_enum *e; 738 TEE_Result res; 739 struct tee_ta_session *sess; 740 const struct tee_file_operations *fops = file_ops(storage_id); 741 742 res = tee_ta_get_current_session(&sess); 743 if (res != TEE_SUCCESS) 744 return res; 745 746 res = tee_svc_storage_get_enum(to_user_ta_ctx(sess->ctx), 747 tee_svc_uref_to_vaddr(obj_enum), &e); 748 if (res != TEE_SUCCESS) 749 return res; 750 751 if (!fops) 752 return TEE_ERROR_ITEM_NOT_FOUND; 753 754 e->fops = fops; 755 assert(!e->dir); 756 return fops->opendir(&sess->ctx->uuid, &e->dir); 757 } 758 759 TEE_Result syscall_storage_next_enum(unsigned long obj_enum, 760 TEE_ObjectInfo *info, void *obj_id, uint64_t *len) 761 { 762 struct tee_storage_enum *e; 763 struct tee_fs_dirent *d; 764 TEE_Result res = TEE_SUCCESS; 765 struct tee_ta_session *sess; 766 struct tee_obj *o = NULL; 767 uint64_t l; 768 struct user_ta_ctx *utc; 769 770 res = tee_ta_get_current_session(&sess); 771 if (res != TEE_SUCCESS) 772 goto exit; 773 utc = to_user_ta_ctx(sess->ctx); 774 775 res = tee_svc_storage_get_enum(utc, 776 tee_svc_uref_to_vaddr(obj_enum), &e); 777 if (res != TEE_SUCCESS) 778 goto exit; 779 780 /* check rights of the provided buffers */ 781 res = tee_mmu_check_access_rights(utc, 782 TEE_MEMORY_ACCESS_WRITE | 783 TEE_MEMORY_ACCESS_ANY_OWNER, 784 (uaddr_t) info, 785 sizeof(TEE_ObjectInfo)); 786 if (res != TEE_SUCCESS) 787 goto exit; 788 789 res = tee_mmu_check_access_rights(utc, 790 TEE_MEMORY_ACCESS_WRITE | 791 TEE_MEMORY_ACCESS_ANY_OWNER, 792 (uaddr_t) obj_id, 793 TEE_OBJECT_ID_MAX_LEN); 794 if (res != TEE_SUCCESS) 795 goto exit; 796 797 if (!e->fops) { 798 res = TEE_ERROR_ITEM_NOT_FOUND; 799 goto exit; 800 } 801 802 res = e->fops->readdir(e->dir, &d); 803 if (res != TEE_SUCCESS) 804 goto exit; 805 806 o = tee_obj_alloc(); 807 if (o == NULL) { 808 res = TEE_ERROR_OUT_OF_MEMORY; 809 goto exit; 810 } 811 o->flags = TEE_DATA_FLAG_SHARE_READ; 812 813 o->pobj = calloc(1, sizeof(struct tee_pobj)); 814 if (!o->pobj) { 815 res = TEE_ERROR_OUT_OF_MEMORY; 816 goto exit; 817 } 818 819 o->pobj->uuid = sess->ctx->uuid; 820 res = tee_svc_storage_set_enum(d, e->fops, o); 821 if (res != TEE_SUCCESS) 822 goto exit; 823 824 res = tee_svc_storage_read_head(o); 825 if (res != TEE_SUCCESS) 826 goto exit; 827 828 memcpy(info, &o->info, sizeof(TEE_ObjectInfo)); 829 memcpy(obj_id, o->pobj->obj_id, o->pobj->obj_id_len); 830 831 l = o->pobj->obj_id_len; 832 res = tee_svc_copy_to_user(len, &l, sizeof(*len)); 833 834 exit: 835 if (o) { 836 if (o->pobj) { 837 o->pobj->fops->close(&o->fh); 838 free(o->pobj->obj_id); 839 } 840 free(o->pobj); 841 tee_obj_free(o); 842 } 843 844 return res; 845 } 846 847 TEE_Result syscall_storage_obj_read(unsigned long obj, void *data, size_t len, 848 uint64_t *count) 849 { 850 TEE_Result res; 851 struct tee_ta_session *sess; 852 struct tee_obj *o; 853 uint64_t u_count; 854 struct user_ta_ctx *utc; 855 size_t bytes; 856 857 res = tee_ta_get_current_session(&sess); 858 if (res != TEE_SUCCESS) 859 goto exit; 860 utc = to_user_ta_ctx(sess->ctx); 861 862 res = tee_obj_get(utc, tee_svc_uref_to_vaddr(obj), &o); 863 if (res != TEE_SUCCESS) 864 goto exit; 865 866 if (!(o->info.handleFlags & TEE_HANDLE_FLAG_PERSISTENT)) { 867 res = TEE_ERROR_BAD_STATE; 868 goto exit; 869 } 870 871 if (!(o->flags & TEE_DATA_FLAG_ACCESS_READ)) { 872 res = TEE_ERROR_ACCESS_CONFLICT; 873 goto exit; 874 } 875 876 /* check rights of the provided buffer */ 877 res = tee_mmu_check_access_rights(utc, 878 TEE_MEMORY_ACCESS_WRITE | 879 TEE_MEMORY_ACCESS_ANY_OWNER, 880 (uaddr_t) data, len); 881 if (res != TEE_SUCCESS) 882 goto exit; 883 884 bytes = len; 885 res = o->pobj->fops->read(o->fh, o->ds_pos + o->info.dataPosition, 886 data, &bytes); 887 if (res != TEE_SUCCESS) { 888 EMSG("Error code=%x\n", (uint32_t)res); 889 if (res == TEE_ERROR_CORRUPT_OBJECT) { 890 EMSG("Object corrupt\n"); 891 tee_svc_storage_remove_corrupt_obj(sess, o); 892 } 893 goto exit; 894 } 895 896 o->info.dataPosition += bytes; 897 898 u_count = bytes; 899 res = tee_svc_copy_to_user(count, &u_count, sizeof(*count)); 900 exit: 901 return res; 902 } 903 904 TEE_Result syscall_storage_obj_write(unsigned long obj, void *data, size_t len) 905 { 906 TEE_Result res; 907 struct tee_ta_session *sess; 908 struct tee_obj *o; 909 struct user_ta_ctx *utc; 910 911 res = tee_ta_get_current_session(&sess); 912 if (res != TEE_SUCCESS) 913 goto exit; 914 utc = to_user_ta_ctx(sess->ctx); 915 916 res = tee_obj_get(utc, tee_svc_uref_to_vaddr(obj), &o); 917 if (res != TEE_SUCCESS) 918 goto exit; 919 920 if (!(o->info.handleFlags & TEE_HANDLE_FLAG_PERSISTENT)) { 921 res = TEE_ERROR_BAD_STATE; 922 goto exit; 923 } 924 925 if (!(o->flags & TEE_DATA_FLAG_ACCESS_WRITE)) { 926 res = TEE_ERROR_ACCESS_CONFLICT; 927 goto exit; 928 } 929 930 /* check rights of the provided buffer */ 931 res = tee_mmu_check_access_rights(utc, 932 TEE_MEMORY_ACCESS_READ | 933 TEE_MEMORY_ACCESS_ANY_OWNER, 934 (uaddr_t) data, len); 935 if (res != TEE_SUCCESS) 936 goto exit; 937 938 res = o->pobj->fops->write(o->fh, o->ds_pos + o->info.dataPosition, 939 data, len); 940 if (res != TEE_SUCCESS) 941 goto exit; 942 943 o->info.dataPosition += len; 944 if (o->info.dataPosition > o->info.dataSize) { 945 res = tee_svc_storage_update_head(o, o->info.dataPosition); 946 if (res != TEE_SUCCESS) 947 goto exit; 948 o->info.dataSize = o->info.dataPosition; 949 } 950 951 exit: 952 return res; 953 } 954 955 TEE_Result syscall_storage_obj_trunc(unsigned long obj, size_t len) 956 { 957 TEE_Result res; 958 struct tee_ta_session *sess; 959 struct tee_obj *o; 960 size_t off; 961 size_t attr_size; 962 963 res = tee_ta_get_current_session(&sess); 964 if (res != TEE_SUCCESS) 965 goto exit; 966 967 res = tee_obj_get(to_user_ta_ctx(sess->ctx), 968 tee_svc_uref_to_vaddr(obj), &o); 969 if (res != TEE_SUCCESS) 970 goto exit; 971 972 if (!(o->info.handleFlags & TEE_HANDLE_FLAG_PERSISTENT)) { 973 res = TEE_ERROR_BAD_STATE; 974 goto exit; 975 } 976 977 if (!(o->flags & TEE_DATA_FLAG_ACCESS_WRITE)) { 978 res = TEE_ERROR_ACCESS_CONFLICT; 979 goto exit; 980 } 981 982 res = tee_obj_attr_to_binary(o, NULL, &attr_size); 983 if (res != TEE_SUCCESS) 984 goto exit; 985 986 off = sizeof(struct tee_svc_storage_head) + attr_size; 987 res = o->pobj->fops->truncate(o->fh, len + off); 988 if (res != TEE_SUCCESS) { 989 if (res == TEE_ERROR_CORRUPT_OBJECT) { 990 EMSG("Object corrupt\n"); 991 res = tee_svc_storage_remove_corrupt_obj(sess, o); 992 if (res != TEE_SUCCESS) 993 goto exit; 994 res = TEE_ERROR_CORRUPT_OBJECT; 995 goto exit; 996 } else 997 res = TEE_ERROR_GENERIC; 998 } 999 1000 exit: 1001 return res; 1002 } 1003 1004 TEE_Result syscall_storage_obj_seek(unsigned long obj, int32_t offset, 1005 unsigned long whence) 1006 { 1007 TEE_Result res; 1008 struct tee_ta_session *sess; 1009 struct tee_obj *o; 1010 size_t attr_size; 1011 tee_fs_off_t new_pos; 1012 1013 res = tee_ta_get_current_session(&sess); 1014 if (res != TEE_SUCCESS) 1015 return res; 1016 1017 res = tee_obj_get(to_user_ta_ctx(sess->ctx), 1018 tee_svc_uref_to_vaddr(obj), &o); 1019 if (res != TEE_SUCCESS) 1020 return res; 1021 1022 if (!(o->info.handleFlags & TEE_HANDLE_FLAG_PERSISTENT)) 1023 return TEE_ERROR_BAD_STATE; 1024 1025 res = tee_obj_attr_to_binary(o, NULL, &attr_size); 1026 if (res != TEE_SUCCESS) 1027 return res; 1028 1029 switch (whence) { 1030 case TEE_DATA_SEEK_SET: 1031 new_pos = offset; 1032 break; 1033 case TEE_DATA_SEEK_CUR: 1034 new_pos = o->info.dataPosition + offset; 1035 break; 1036 case TEE_DATA_SEEK_END: 1037 new_pos = o->info.dataSize + offset; 1038 break; 1039 default: 1040 return TEE_ERROR_BAD_PARAMETERS; 1041 } 1042 1043 if (new_pos < 0) 1044 new_pos = 0; 1045 1046 if (new_pos > TEE_DATA_MAX_POSITION) { 1047 EMSG("Position is beyond TEE_DATA_MAX_POSITION"); 1048 return TEE_ERROR_BAD_PARAMETERS; 1049 } 1050 1051 o->info.dataPosition = new_pos; 1052 1053 return TEE_SUCCESS; 1054 } 1055 1056 void tee_svc_storage_close_all_enum(struct user_ta_ctx *utc) 1057 { 1058 struct tee_storage_enum_head *eh = &utc->storage_enums; 1059 1060 /* disregard return value */ 1061 while (!TAILQ_EMPTY(eh)) 1062 tee_svc_close_enum(utc, TAILQ_FIRST(eh)); 1063 } 1064