Secstor anti-rollback #1630

jenswi-linaro · 2017-06-22T14:17:40Z

No description provided.

lorc

Hello.
I have spoted some styling issues and one suspicious refcount handling.

lorc · 2017-06-22T15:09:35Z

core/include/tee/fs_dirfile.h

@@ -56,7 +56,7 @@ struct tee_fs_dirfile_fileh {
 * @commit_writes:	commits changes since the file was opened
 */
 struct tee_fs_dirfile_operations {
-	TEE_Result (*open)(bool create, const TEE_UUID *uuid,
+	TEE_Result (*open)(bool create, uint8_t *hash, const TEE_UUID *uuid,


You forgot to update comment above.

I'm sorry, I don't get it. Which comment?

Oh, I'm sorry. That was structure description, not function description. Please ignore this.

lorc · 2017-06-22T15:26:48Z

core/tee/tee_ree_fs.c

+	if (res)
+		return res;
+
+


Remove extra line.

lorc · 2017-06-22T15:43:31Z

core/tee/tee_ree_fs.c

@@ -476,7 +476,7 @@ static TEE_Result get_dirh(struct tee_fs_dirfile_dirh **dirh)
 		}
 	}
 	assert(ree_fs_dirh);
-	ree_fs_dirh_refcount++;
+	assert(ree_fs_dirh_refcount);


Is there any sense in this assert if you increase refcount in the beginning of the function?

The assert is in case it has wrapped.

lorc · 2017-06-22T15:49:27Z

core/tee/tee_ree_fs.c

@@ -462,10 +462,10 @@ static size_t ree_fs_dirh_refcount;

 static TEE_Result get_dirh(struct tee_fs_dirfile_dirh **dirh)
 {
-	if (!ree_fs_dirh_refcount) {
+	ree_fs_dirh_refcount++;


In case of error (at L471), ree_fs_dirh_refcount will not be decreased.

Yes, you're right. I'll fix.

jenswi-linaro · 2017-06-22T18:52:42Z

update

lorc · 2017-06-22T19:11:51Z

You have fixed issue with reference counting, but I'm not sure, if it is right approach.

Now you must call put_dirh() even if get_dirh() has failed. This is not intuitive because you expect that if get failed then there are nothing to put back.

Compare this with malloc/free: you can call free() on NULL if malloc() failed, but you are not obligated to do this.

There are nothing bad with current code, but it can confuse anyone else, who will try to extend it. Actually, it confused me for a moment :)

jenswi-linaro · 2017-06-22T19:21:23Z

Yes, I agree it's a bit confusing. I'll rewrite it.

jforissier

I think the secure storage protection level should be set to 100 when this anti-rollback feature is active.

Also, the documentation needs some minor updates in order to properly reflect these changes:

https://github.com/OP-TEE/optee_os/blame/master/documentation/secure_storage.md#L77-L78
Delete "Future work": https://github.com/OP-TEE/optee_os/blame/master/documentation/secure_storage.md#L226
Maybe add a note in https://github.com/OP-TEE/optee_os/blob/master/documentation/secure_storage_rpmb.md stating that the RPMB FS is used to protect the REE fs from rollback when both are enabled?

jforissier · 2017-06-26T07:27:07Z

core/include/tee/fs_dirfile.h

@@ -69,10 +69,14 @@ struct tee_fs_dirfile_operations {

 /**
 * tee_fs_dirfile_open() - opens a dirfile handle
+ * @create:	true if a new dirfile is to be created, else the dirfile
+ *		is read opened and verified
+ * @hash:	hash of underlaying file


s/underlaying/underlying/

jforissier · 2017-06-26T07:27:34Z

core/include/tee/fs_dirfile.h

@@ -86,8 +90,10 @@ void tee_fs_dirfile_close(struct tee_fs_dirfile_dirh *dirh);
 /**
 * tee_fs_dirfile_commit_writes() - commit updates of dirfile
 * @dirh:	dirfile handle
+ * @hash:	hash of underlaying file is copied here if not NULL


s/underlaying/underlying/

jenswi-linaro · 2017-06-26T09:18:12Z

Update

jenswi-linaro · 2017-06-26T11:27:28Z

Revised {get,put}_dirh() pattern:

Failure from get_dirh() results in *dirh = NULL
put_dirh() with dirh == NULL is ignored

put_dirh() after failing get_dirh() isn't needed, but harmless if done since dirh will be NULL.

jforissier · 2017-06-26T11:34:41Z

Acked-by: Jerome Forissier <[email protected]>

lorc · 2017-06-26T12:08:56Z

I'm not so familiar with tee_fs, to give R-B. But you have my:
Acked-by: Volodymyr Babchuk <[email protected]>

Adds a hash parameter to the dirfile interface. The hash is used in the same way as in the htree interface, that is, used to verify integrity on open and used to get updated hash on writes. Acked-by: Jerome Forissier <[email protected]> Acked-by: Volodymyr Babchuk <[email protected]> Signed-off-by: Jens Wiklander <[email protected]>

REE FS closes the dirfile if returning error from a function that may have changed the content of a secure storage object. This effectively undoes previous operation. Acked-by: Jerome Forissier <[email protected]> Acked-by: Volodymyr Babchuk <[email protected]> Signed-off-by: Jens Wiklander <[email protected]>

Provides tee_rpmb_fs_raw_open() use by OP-TEE OS. Acked-by: Jerome Forissier <[email protected]> Acked-by: Volodymyr Babchuk <[email protected]> Signed-off-by: Jens Wiklander <[email protected]>

jenswi-linaro · 2017-06-27T06:27:50Z

Squashed, rebased and tags applied.

jforissier · 2017-06-27T06:56:19Z

core/tee/tee_svc.c

+#ifdef CFG_RPMB_FS
+static const uint32_t ts_antiroll_prot_lvl = 1000;
+#else
+static const uint32_t ts_antiroll_prot_lvl


Missing ;

REE FS uses RPMB (if available) for storage of dirfile hash. Acked-by: Jerome Forissier <[email protected]> Acked-by: Volodymyr Babchuk <[email protected]> Signed-off-by: Jens Wiklander <[email protected]>

jenswi-linaro · 2017-06-27T07:13:07Z

Sqashed in the missing ";"

jforissier · 2017-06-27T08:02:07Z

Thanks @jenswi-linaro! Now we can tick the "anti-rollback" box on the OP-TEE feature list, that's good.

lorc reviewed Jun 22, 2017

View reviewed changes

jforissier reviewed Jun 26, 2017

View reviewed changes

jenswi-linaro added 3 commits June 27, 2017 08:21

core: RPMB FS: provide tee_rpmb_fs_raw_open()

c42f2e3

Provides tee_rpmb_fs_raw_open() use by OP-TEE OS. Acked-by: Jerome Forissier <[email protected]> Acked-by: Volodymyr Babchuk <[email protected]> Signed-off-by: Jens Wiklander <[email protected]>

jenswi-linaro force-pushed the secstor branch from 8f154bb to 23868d0 Compare June 27, 2017 06:27

jforissier reviewed Jun 27, 2017

View reviewed changes

core: REE FS: use RPMB for hash storage

ff8ba69

REE FS uses RPMB (if available) for storage of dirfile hash. Acked-by: Jerome Forissier <[email protected]> Acked-by: Volodymyr Babchuk <[email protected]> Signed-off-by: Jens Wiklander <[email protected]>

jenswi-linaro force-pushed the secstor branch from 23868d0 to ff8ba69 Compare June 27, 2017 07:12

jforissier merged commit b4b1a20 into OP-TEE:master Jun 27, 2017

jenswi-linaro deleted the secstor branch June 27, 2017 09:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Secstor anti-rollback #1630

Secstor anti-rollback #1630

jenswi-linaro commented Jun 22, 2017

lorc left a comment •

edited

Loading

lorc Jun 22, 2017

jenswi-linaro Jun 22, 2017

lorc Jun 22, 2017

lorc Jun 22, 2017

lorc Jun 22, 2017

jenswi-linaro Jun 22, 2017

lorc Jun 22, 2017

jenswi-linaro Jun 22, 2017

jenswi-linaro commented Jun 22, 2017

lorc commented Jun 22, 2017

jenswi-linaro commented Jun 22, 2017

jforissier left a comment

jforissier Jun 26, 2017

jforissier Jun 26, 2017

jenswi-linaro commented Jun 26, 2017

jenswi-linaro commented Jun 26, 2017

jforissier commented Jun 26, 2017

lorc commented Jun 26, 2017

jenswi-linaro commented Jun 27, 2017

jforissier Jun 27, 2017

jenswi-linaro commented Jun 27, 2017

jforissier commented Jun 27, 2017

Secstor anti-rollback #1630

Secstor anti-rollback #1630

Conversation

jenswi-linaro commented Jun 22, 2017

lorc left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jenswi-linaro commented Jun 22, 2017

lorc commented Jun 22, 2017

jenswi-linaro commented Jun 22, 2017

jforissier left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jenswi-linaro commented Jun 26, 2017

jenswi-linaro commented Jun 26, 2017

jforissier commented Jun 26, 2017

lorc commented Jun 26, 2017

jenswi-linaro commented Jun 27, 2017

Choose a reason for hiding this comment

jenswi-linaro commented Jun 27, 2017

jforissier commented Jun 27, 2017

lorc left a comment •

edited

Loading