Skip to content

Commit

Permalink
[Review] core: add interface to load and decrypt/authenticate user TAs
Browse files Browse the repository at this point in the history
Address Etienne's comments.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
  • Loading branch information
jforissier committed May 9, 2017
1 parent 87038c6 commit e508168
Show file tree
Hide file tree
Showing 4 changed files with 7 additions and 8 deletions.
2 changes: 1 addition & 1 deletion core/arch/arm/include/kernel/user_ta.h
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ static inline TEE_Result tee_ta_init_user_ta_session(
static inline TEE_Result tee_ta_register_ta_store(
const struct user_ta_store_ops *ops __unused)
{
return TEE_SUCCESS;
return TEE_ERROR_NOT_SUPPORTED;
}
#endif

Expand Down
6 changes: 2 additions & 4 deletions core/arch/arm/kernel/ree_fs_ta.c
Original file line number Diff line number Diff line change
Expand Up @@ -153,10 +153,8 @@ static TEE_Result rpc_load(const TEE_UUID *uuid, struct shdr **ta,
return TEE_ERROR_OUT_OF_MEMORY;

*ta = phys_to_virt(phta, MEM_AREA_NSEC_SHM);
if (!*ta) {
res = TEE_ERROR_GENERIC;
goto out;
}
/* We don't expect NULL as thread_rpc_alloc_payload() was successful */
assert(*ta);
*cookie_ta = cta;
*ta_size = params[1].u.tmem.size;

Expand Down
5 changes: 3 additions & 2 deletions core/arch/arm/kernel/user_ta.c
Original file line number Diff line number Diff line change
Expand Up @@ -301,7 +301,7 @@ static TEE_Result ta_load(const TEE_UUID *uuid,
/* check input flags bitmask consistency and save flags */
if ((ta_head->flags & optional_flags) != ta_head->flags ||
(ta_head->flags & mandatory_flags) != mandatory_flags) {
EMSG("TA flag issue: flags=%x optional=%X mandatory=%X",
EMSG("TA flag issue: flags=%x optional=%x mandatory=%x",
ta_head->flags, optional_flags, mandatory_flags);
res = TEE_ERROR_BAD_FORMAT;
goto error_return;
Expand Down Expand Up @@ -480,7 +480,8 @@ static TEE_Result init_session_with_ta_store(const TEE_UUID *uuid,
res = ta_load(uuid, ta_store, &s->ctx);
if (res != TEE_SUCCESS)
return res;
assert(!memcmp(uuid, &s->ctx->uuid, sizeof(TEE_UUID)));
if (memcmp(uuid, &s->ctx->uuid, sizeof(TEE_UUID)));
panic();

This comment has been minimized.

Copy link
@etienne-lms

etienne-lms May 9, 2017

Contributor

Really panic here ? We can reach this case if the REE provides a TA binary that does not contain the requested TA. I think TEE should not panic here, but simply refuse to load the TA. I believe it should not be possible for the REE to make the TEE panicking.
Sorry if I was not that explicit in my previous comment.

return res;
}

Expand Down
2 changes: 1 addition & 1 deletion core/sub.mk
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ subdirs-y += kernel
subdirs-y += tee
subdirs-y += drivers

ifeq ($(CFG_WITH_USER_TA)$(CFG_REE_FS_TA),yy)
ifeq ($(CFG_WITH_USER_TA)-$(CFG_REE_FS_TA),y-y)
gensrcs-y += ta_pub_key
produce-ta_pub_key = ta_pub_key.c
depends-ta_pub_key = $(TA_SIGN_KEY)
Expand Down

0 comments on commit e508168

Please sign in to comment.