diff --git a/TAs/optee_ta/AuthVars/README.md b/TAs/optee_ta/AuthVars/README.md index 250db49..54a8323 100644 --- a/TAs/optee_ta/AuthVars/README.md +++ b/TAs/optee_ta/AuthVars/README.md @@ -24,6 +24,10 @@ The storage is currently encrypted by OP-TEE using a TA Storage Key (TSK) encryp The UEFI spec describes an authenticated variable store for use with Secure Boot. The TA supports variable reads and writes up to 16KB in size (this is a limitation of the rich OS side driver). This should allow for a reasonable set of Secure Boot keys to be stored. +### Default Variables + +The AuthVar TA can encode a set of default variables at compile time, and place them into NV memory when it first runs. This is useful for forcing a default set of UEFI Secure Boot variables to be active during first boot, and as a protection against RPMB wipes. This can be turned on by setting `CFG_AUTHVARS_DEFAULT_VARS=y`. See [defaultvars/README.md](./defaultvars/README.md) for details on configuring this behavior. + ## Debugging AuthVars ### Clearing Storage diff --git a/TAs/optee_ta/AuthVars/defaultvars/README.md b/TAs/optee_ta/AuthVars/defaultvars/README.md new file mode 100644 index 0000000..a92990a --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/README.md @@ -0,0 +1,70 @@ +# Default Variables + +Setting `CFG_AUTHVARS_DEFAULT_VARS=y` will cause the AuthVars TA to ensure a set of default variables are present during first boot. + +If the TA detects that there is no pre-existing non-volatile storage it will set the default variables as if it received a call from UEFI. The name, GUID, attributes, and binary data of the variables are defined in a JSON file, passed via `CFG_DEFAULT_VARS_JSON=/path/to/vars.json`. + +## JSON File +The JSON file pointed to by `CFG_DEFAULT_VARS_JSON=/path/to/vars.json` defines which variables will be added. + +* **`name:`** ECS-2 encodable string. Since the JSON file is saved as UTF-8 the unicode characters can be placed directly in the string. +* **`bin_path:`** Path to the binary contents of the variable. If the variable is authenticated this binary should include the authentication headers. **If** the path is not absolute, it is taken relative to the AuthVars TA root directory (`MSRSec/TAs/optee_ta/AuthVars`). +* **`guid:`** The variable GUID, must be valid C syntax. May also be one of the well known GUIDs `EFI_IMAGE_SECURITY_DATABASE_GUID` or `EFI_GLOBAL_VARIABLE`. +* **`attributes:`** The attributes the variable should be saved with (from `uefidefs.h`). Must be valid C syntax. + +The variables will be saved into the AuthVar TA in the order they are found in the JSON file. + +```json +{ + "variables": [ + { + "name": "Default Volatile Variable Example / (Supports ECS-2 characters ✍)", + "bin_path": "defaultvars/example.bin", + "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}", + "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS" + } + ] +} +``` + +### Examples +Two examples are included, along with binaries. + +The first example, `defaultvars_example.json`, is included by default if `CFG_DEFAULT_VARS_JSON` is left unset. It adds a single variable (as shown above). + +The second example, `defaultvars_secureboot_example.json` can be used by setting `CFG_DEFAULT_VARS_JSON=defaultvars/defaultvars_secureboot_example.json`. This example automatically enables secure boot using **NON-SECURE** keys from the [TurnkeySecurity](https://github.com/ms-iot/security/tree/master/TurnkeySecurity) repository. They are included for example purposes only. A production image must use newly generated signing keys. + +### Text Encoding of Variable Names +The JSON file **must be `UTF-8` encoded**, as the python script explicitly decodes it as UTF-8. The JSON file may contain *MOST*, **but not all** unicode characters. UEFI uses ECS-2 encoding for its strings, a subset of UTF-16. ECS-2 does not allow 4-byte characters to be stored, so no UTF-16 surrogate pairs. Valid ECS-2 values are: `[0x0000, 0xd800] ∪ [0xdfff, 0xffff]`. The python script used to compile the variables will check the validity of the encoding for each character. + + +## Compilation +At compilation time `defaultvars.py` runs, taking the JSON file found at `CFG_DEFAULT_VARS_JSON`, and creating the file `$(sub-dir-out)/defaultvars_encoding.c`. This C file encodes each variable in the JSON file as a set of C variables: +```c +WCHAR var_0_name[] = L"Abcd" "\x1234" "5678"; +GUID var_0_guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}}; +ATTRIBUTES var_0_attributes = "EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS"; +BYTE var_0_bin[] = { 0x0, 0x1, 0x2, 0x3, ... }; + +WCHAR var_2_name[] = L"XYZ" "\x1234" "5678"; +... +``` + +The generated C file also contains the definition for `InitializeDefaultVariables()`, which is defined in `defaultvars.h`, and is called during initialization of the TA in `AuthVarInitStorage()` if and only if there is no pre-existing non-volatile storage pressent (assuming `CFG_DEFAULT_VARS_JSON=y`). + +```c +TEE_Result InitializeDefaultVariables( VOID ) { + TEE_Result res; + + res = SetDefaultVariable(var_0_name, sizeof(var_0_name), var_0_bin, sizeof(var_0_bin), var_0_guid, var_0_attributes); + if (res != TEE_SUCCESS) + return res; + + res = SetDefaultVariable(var_1_name, sizeof(var_1_name), var_1_bin, sizeof(var_1_bin), var_1_guid, var_1_attributes); + if (res != TEE_SUCCESS) + return res; + + DMSG("Done setting 2 default variables"); + return TEE_SUCCESS; +} +``` diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.c b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.c new file mode 100644 index 0000000..272d215 --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.c @@ -0,0 +1,94 @@ +/* The copyright in this software is being made available under the BSD License, + * included below. This software may be subject to other third party and + * contributor rights, including patent rights, and no such rights are granted + * under this license. + * + * Copyright (c) Microsoft Corporation + * + * All rights reserved. + * + * BSD License + * + * Redistribution and use in source and binary forms, with or without modification, + * are permitted provided that the following conditions are met: + * + * Redistributions of source code must retain the above copyright notice, this list + * of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, this + * list of conditions and the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ""AS IS"" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + + +#include + +TEE_Result +SetDefaultVariable( + WCHAR *Name, UINT32 NameSize, BYTE *Bin, UINT32 BinSize, + GUID Guid, ATTRIBUTES Attributes +) +/*++ + + Routine Description: + + Populates and uses a set variable paramteter structure for the + pre-compiled default variables. Called from the autogenerated + file defaultvars_encoding.c (see defaultvars.py). + + Arguments: + + Name - Null terminated WCHAR string with the variable name + + NameSize - Length of the name + + Bin - Pointer to the binary contents of the variable + + BinSize - Size of the binary + + Guid - Variable GUID + + Attributes - Attributes to set the variable with + + Returns: + + TEE_Result + +--*/ +{ + TEE_Result res; + UINT32 totalSize = sizeof(VARIABLE_SET_PARAM) + NameSize + BinSize; + PVARIABLE_SET_PARAM setParam = TEE_Malloc(totalSize, TEE_MALLOC_FILL_ZERO); + + if(!setParam) { + return TEE_ERROR_OUT_OF_MEMORY; + } + + setParam->Size = sizeof(VARIABLE_SET_PARAM); + setParam->NameSize = NameSize; + setParam->VendorGuid = Guid; + setParam->Attributes = Attributes; + setParam->DataSize = BinSize; + setParam->OffsetName = 0; + setParam->OffsetData = NameSize; + + memcpy(&setParam->Payload[0], Name, NameSize); + memcpy(&setParam->Payload[NameSize], Bin, BinSize); + + res = SetVariable(totalSize, setParam); + + TEE_Free(setParam); + + return res; +} \ No newline at end of file diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h new file mode 100644 index 0000000..2ea8ef3 --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.h @@ -0,0 +1,54 @@ +/* The copyright in this software is being made available under the BSD License, + * included below. This software may be subject to other third party and + * contributor rights, including patent rights, and no such rights are granted + * under this license. + * + * Copyright (c) Microsoft Corporation + * + * All rights reserved. + * + * BSD License + * + * Redistribution and use in source and binary forms, with or without modification, + * are permitted provided that the following conditions are met: + * + * Redistributions of source code must retain the above copyright notice, this list + * of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, this + * list of conditions and the following disclaimer in the documentation and/or + * other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS ""AS IS"" + * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE + * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE + * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR + * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; + * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON + * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#pragma once +#include +#include +#include +#include +#include +#include + +/* + * Defined in an autogenerated file, see defaultvars.py. + */ +TEE_Result +InitializeDefaultVariables( + VOID +); + +TEE_Result +SetDefaultVariable( + WCHAR *Name, UINT32 NameSize, BYTE *Bin, UINT32 BinSize, + GUID Guid, ATTRIBUTES Attributes +); \ No newline at end of file diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars.py b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.py new file mode 100644 index 0000000..3212290 --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars.py @@ -0,0 +1,174 @@ +# Copyright (c) Microsoft Corporation. All rights reserved. +# Licensed under the MIT License. +from __future__ import print_function + +import os, sys, json, codecs + +# Reads a utf-8 encoded json file containing default variables, then generates +# a .c file which is responsible for placing those variables into memory when +# the TA first runs (ie has no stored NV state available). +# ex: python defaultvars.py input.json output.c + +# The json file must be utf-8 encoded. +# -- The name field may contain valid unicode characters so long as they can be encoded +# with ECS2 (a subset of utf-16 which does not allow 4 byte merged characters). +# -- The binary path is relative to the TA root (AuthvVars/), or +# absolute (/path/to/file.json). +# -- The guid can be either valid C GUID struct syntax or one of the well known +# GUIDs from uefidefs.h +# -- The attributes are also selected from uefidefs.h. +# +# Example JSON to add a one-time volatile variable: +# { +# "variables": [ +# { +# "name": "ECS2 Variable Name", +# "bin_path": "/path/to/variable.bin", +# "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}", +# < OR > +# "guid": "", +# "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS" +# } +# ] +# } + +def write_header(f, input_file_name): + f.write( +''' +/* Automatically generated file created by defaultvars.py */ +/* Add hard-coded variables to the image by editing %s */ + +#include + +''' % input_file_name) + +# Convert characters to a valid ECS2 encoding. Leave a subset of basic ASCII +# characters alone, but convert anything else to the form \x1234. Each +# character of the form \x1234 is enclosed in quotes: ie "foo / bar" becomes +# L"foo " "\x002f" " bar". The compiler will automatically concatenate the +# strings. Throws an error on any valid utf-16 characters which cannot be +# represented by ECS2. +def convert_to_ecs2_wchar(char): + if ord(char) >= 0xd800 and ord(char) <= 0xdfff: + raise ValueError("Invalid ECS2 encoding (UTF-16 surrogate) for character '%c'" % char) + if ord(char) > 0xffff: + raise ValueError("Invalid ECS2 encoding for character '%c', to large for ECS2" % char) + if ((ord(char) in range(ord('a'), ord('z'))) or + (ord(char) in range(ord('A'), ord('Z'))) or + (ord(char) in range(ord('0'), ord('9'))) or + (ord(char) == ord(' '))): + # Leave very basic characters alone (a-z,A-Z,0-9,' ') + return char + else: + # Generates something of the form: " "\x0123" " for everything else + return (r'" "\x' + ('%04x' % ord(char)) + '" "' ) + +# We could compile unicode strings here, but it is easier to convert to hex +# representation instead of handing escaping everything correctly. Also +# verify we are not encoding any 4 byte characters which ECS2 can't handle. +def format_wchar_string(string): + return 'L"' + ''.join(convert_to_ecs2_wchar(c) for c in string) + '"' + +# Formats data into a valid C array (ie { 0x0, 0x1, 0x2, ...}) +def format_byte_array(bytes): + line_length = 16 + return '{\n\t%s\n}' % (''.join([ + '0x%02x, ' % byte + ('\n\t' if ((i+1) % line_length == 0) else '') + for i, byte in enumerate(bytearray(bytes)) + ])) + +# Generate tupples of the form: +# (name, , guid, attributes) +# from a file containing json data. +def parse_json(json_file): + json_data = json_file.read() + json_data = json.loads(json_data, encoding='utf-8') + vars = list() + for variable in json_data['variables']: + variable_name = variable['name'] + variable_bin_path = variable['bin_path'] + variable_guild = variable['guid'] + variable_attributes = variable['attributes'] + + with open(variable_bin_path, 'rb') as bin_file: + vars.append((format_wchar_string(variable_name), + format_byte_array(bin_file.read()), + variable_guild, + variable_attributes)) + return vars + +# Generates a code chunk for each variable of the form: +# WCHAR var__name[] = L"Abcd" "\x1234" "5678"; +# GUID var__guid = {0x12345678,0x9abc,0xdef0,{0x12,0x34,0x56,0x78,0x9A,0xBC,0xDE,0xF0}}; +# +# GUID var__guid = +# ATTRIBUTES var__attributes = "ATTR1 | ATTR2 | ... "; +# BYTE var__bin[] = { 0x0, 0x1, 0x2, ... }; +def write_variables(f, variables): + for i,var in enumerate(variables): + f.write(('WCHAR var_%d_name[] = ' % i) + var[0] + ";\n") + f.write(('GUID var_%d_guid = ' % i) + var[2] + ";\n") + f.write(('ATTRIBUTES var_%d_attributes = {' % i) + var[3] + "};\n") + f.write(('BYTE var_%d_bin[] = ' % i) + var[1] + ";\n") + f.write('\n') + +# Calls SetDefaultVariable() with variables created with write_variables() for +# a given variable number +def format_setvar_single_call(var_num): + var_name = 'var_%d_name' % var_num + var_name_size = 'sizeof(%s)' % var_name + var_bin = 'var_%d_bin' % var_num + var_bin_size = 'sizeof(%s)' % var_bin + var_guid = 'var_%d_guid' % var_num + var_attributes = 'var_%d_attributes' % var_num + return 'SetDefaultVariable(%s, %s, %s, %s, %s, %s)' % ( + var_name, var_name_size, var_bin, var_bin_size, + var_guid, var_attributes) + +# Fills in the body of InitializeDefaultVariables() with calls to set +# each variable from the json file in the order they are found in the file. +def format_setvar_calls(variables): + return ''.join([ +''' + res = %s; + if (res != TEE_SUCCESS) + return res; +''' % format_setvar_single_call(i) for i,_ in enumerate(variables) + ]) + +# Defines the function InitializeDefaultVariables(), then fills it with a +# a set call for each default variable. +def write_end(f, variables): + f.write(''' +TEE_Result InitializeDefaultVariables( VOID ) { + TEE_Result res; +%s + DMSG("Done setting %d default variables"); + return TEE_SUCCESS; +} +''' % (format_setvar_calls(variables), len(variables)) ) + +num_args = len(sys.argv) +if num_args != 3: + raise ValueError("Expecting 2 arguments (in.json, out.c)") +else: + json_file_in = sys.argv[1] + json_file_in_path = os.path.abspath(json_file_in) + c_file_out = sys.argv[2] + c_file_out_path = os.path.abspath(c_file_out) + +print("defaultvars.py: Checking for variable file at", json_file_in_path) +if not os.path.isfile(json_file_in_path): + raise FileNotFoundError("Could not find input " + str(json_file_in_path)) + +if os.path.isfile(c_file_out_path): + print("defaultvars.py: Clearing output file at", c_file_out_path) + os.remove(c_file_out_path) + +with codecs.open(json_file_in_path, encoding='utf-8', mode='r') as json_file: + variables = parse_json(json_file) + +with open(c_file_out_path, 'w') as c_file: + write_header(c_file, json_file_in_path) + write_variables(c_file, variables) + write_end(c_file, variables) diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json new file mode 100644 index 0000000..30fe0bc --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_example.json @@ -0,0 +1,10 @@ +{ + "variables": [ + { + "name": "Default Volatile Variable Example / (Supports ECS-2 characters ✍)", + "bin_path": "defaultvars/example.bin", + "guid": "{0xe4b297c1, 0x507d, 0x407f, {0xbe,0x4a,0xe9,0x25,0x68,0x69,0x25,0x14}}", + "attributes": "EFI_VARIABLE_APPEND_WRITE | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS" + } + ] +} \ No newline at end of file diff --git a/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json new file mode 100644 index 0000000..a172370 --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/defaultvars_secureboot_example.json @@ -0,0 +1,22 @@ +{ + "variables": [ + { + "name": "db", + "bin_path": "defaultvars/example_db.bin", + "guid": "EFI_IMAGE_SECURITY_DATABASE_GUID", + "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS" + }, + { + "name": "KEK", + "bin_path": "defaultvars/example_KEK.bin", + "guid": "EFI_GLOBAL_VARIABLE", + "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS" + }, + { + "name": "PK", + "bin_path": "defaultvars/example_PK.bin", + "guid": "EFI_GLOBAL_VARIABLE", + "attributes": "EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS" + } + ] +} \ No newline at end of file diff --git a/TAs/optee_ta/AuthVars/defaultvars/example.bin b/TAs/optee_ta/AuthVars/defaultvars/example.bin new file mode 100644 index 0000000..02e40b0 --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/example.bin @@ -0,0 +1 @@ +Default Example Binary diff --git a/TAs/optee_ta/AuthVars/defaultvars/example_KEK.bin b/TAs/optee_ta/AuthVars/defaultvars/example_KEK.bin new file mode 100644 index 0000000..16706ad Binary files /dev/null and b/TAs/optee_ta/AuthVars/defaultvars/example_KEK.bin differ diff --git a/TAs/optee_ta/AuthVars/defaultvars/example_PK.bin b/TAs/optee_ta/AuthVars/defaultvars/example_PK.bin new file mode 100644 index 0000000..85f6354 Binary files /dev/null and b/TAs/optee_ta/AuthVars/defaultvars/example_PK.bin differ diff --git a/TAs/optee_ta/AuthVars/defaultvars/example_db.bin b/TAs/optee_ta/AuthVars/defaultvars/example_db.bin new file mode 100644 index 0000000..3b74d60 Binary files /dev/null and b/TAs/optee_ta/AuthVars/defaultvars/example_db.bin differ diff --git a/TAs/optee_ta/AuthVars/defaultvars/sub.mk b/TAs/optee_ta/AuthVars/defaultvars/sub.mk new file mode 100644 index 0000000..8ffdf4f --- /dev/null +++ b/TAs/optee_ta/AuthVars/defaultvars/sub.mk @@ -0,0 +1,16 @@ +CFG_DEFAULT_VARS_JSON ?= $(sub-dir)/defaultvars_example.json + +DEFAULT_VARS_PATHS := $(shell find $(sub-dir) -name '*.bin') + +srcs-y += defaultvars.c +global-incdirs-y += ./ + +# Make can have trouble tracking updates to binary files outside the tree. +# It is very fast to rebuild the encoding, so just do that every time. +.PHONY: always_rebuild_defaultvars + +gensrcs-y += default_vars +produce-default_vars = defaultvars_encoding.c +depends-default_vars = always_rebuild_defaultvars +recipe-default_vars = python $(sub-dir)/defaultvars.py $(CFG_DEFAULT_VARS_JSON) $(sub-dir-out)/defaultvars_encoding.c +cleanfiles += $(sub-dir-out)/defaultvars_encoding.c \ No newline at end of file diff --git a/TAs/optee_ta/AuthVars/src/varmgmt.c b/TAs/optee_ta/AuthVars/src/varmgmt.c index 86d98d0..f56dd55 100644 --- a/TAs/optee_ta/AuthVars/src/varmgmt.c +++ b/TAs/optee_ta/AuthVars/src/varmgmt.c @@ -32,6 +32,10 @@ */ #include +#ifdef CFG_AUTHVARS_DEFAULT_VARS +#include +#endif + // // Auth Var in-memory storage layout @@ -207,6 +211,27 @@ AuthVarInitStorage( if (status == TEE_ERROR_ITEM_NOT_FOUND) { DMSG("No stored variables found"); +#ifdef CFG_AUTHVARS_DEFAULT_VARS + status = InitializeDefaultVariables(); + if (status != TEE_SUCCESS) { + EMSG("Failed to set default variables"); + // TODO: Make this operation atomic. + + // Ex: Setting default variables {A, B, C, db, kek, pk}. + // If {A, B, C} are set correctly, but setting db fails, the TA + // we be in a bad state. The TA will be 'initialized' since it + // has at least one persistent object available (A, B, and C), + // and will make no further attempts to set db, kek, pk. + // + // This step must be made atomic either by removing the variables, + // or setting a NV flag when done. Setting a flag is probably + // preferable since it will handle both graceful failures and + // premature power cycles. + + // WipeMemory(); + goto Cleanup; + } +#endif status = TEE_SUCCESS; } goto Cleanup; diff --git a/TAs/optee_ta/AuthVars/sub.mk b/TAs/optee_ta/AuthVars/sub.mk index aa39869..c846f68 100644 --- a/TAs/optee_ta/AuthVars/sub.mk +++ b/TAs/optee_ta/AuthVars/sub.mk @@ -51,6 +51,7 @@ clean: clean_lib_symlinks cflags-y += $(AUTHVAR_FLAGS) $(SSL_FLAGS) $(INCLUDE_OVERWRITES) subdirs-y += lib +subdirs-$(CFG_AUTHVARS_DEFAULT_VARS) += defaultvars global-incdirs-y += src/include