Unify object and attribute size processing

- Some TEE implementations assume different object and attribute size
  units (bits vs. bytes). This commit adds wrappers for affected TEE
  API to simplify size unit switching.

- Remove unused key_bits_size argument from KM_OpenKey().

- Fix improper size unit used in KM_EncryptKey() and
  KM_DecryptKey() (size bits was used for buffer allocation).

- Fix improper key size serialized with encrypted asymmetric key. Size
  in bytes was serialized but bits were expected during
  deserialization.

Change-Id: Icba600c6817e3e880af431ccd09944a3c2b3bcd5

diff --git a/ta/include/internal.h b/ta/include/internal.h
index e1d8757baf4ebb3e8a2b2643fc467e9292344f97..b2d851c67e4cc1ff00bcbdfcfd8023ff99ccd201 100644 (file)
--- a/ta/include/internal.h
+++ b/ta/include/internal.h
@@ -78,8 +78,7 @@ TEE_Result KM_CreateDigestOperation(uint32_t algo, TEE_OperationHandle *oper_hnd
 TEE_Result KM_SaveKey(void *data, size_t data_size, TEE_ObjectHandle key, void *objId,
                                                size_t objId_size);
 
-TEE_Result KM_OpenKey(void *objId, size_t objId_size, uint32_t *key_bits_size,
-                                               TEE_ObjectHandle *hndl);
+TEE_Result KM_OpenKey(void *objId, size_t objId_size, TEE_ObjectHandle *hndl);
 
 TEE_Result KM_ImportKey(TEE_ObjectHandle hndl, uint32_t tee_key_type, void *buffer,
                                                uint32_t *buffer_size);
@@ -96,4 +95,26 @@ TEE_Result KM_GetDataSize(uint32_t *data_size, void *objId, uint32_t objId_size)
 
 void KM_DestroyData(void *objId, uint32_t objId_size);
 
+// Use the 4 functions below to adjust size units (bits vs. bytes) to specific TEE implementation
+static inline uint32_t KM_ObjectSizeBytes(const TEE_ObjectInfo *info)
+{
+       return (info->objectSize + 7)/8;
+}
+
+static inline uint32_t KM_ObjectSizeBits(const TEE_ObjectInfo *info)
+{
+       return info->objectSize;
+}
+
+static inline uint32_t KM_MaxObjectSizeBits(const TEE_ObjectInfo *info)
+{
+       return info->maxObjectSize;
+}
+
+static inline void KM_InitRefAttribute(TEE_Attribute *attr, uint32_t attributeID, void *buffer,
+                                                                       size_t lengthBytes)
+{
+       TEE_InitRefAttribute(attr, attributeID, buffer, lengthBytes);
+}
+
 #endif // __INTERNAL_H__

diff --git a/ta/src/cmd_exec.c b/ta/src/cmd_exec.c
index d04d2da9dbde7b0650aadba079f4b05e06aab22e..3aba01000cc75425de8ee7f99ee51ea6965900db 100644 (file)
--- a/ta/src/cmd_exec.c
+++ b/ta/src/cmd_exec.c
@@ -203,14 +203,6 @@ static uint32_t KM_DigestSizeFromHash(int hash)
        }
 }
 
-static uint32_t KM_SignatureSizeFromKey(TEE_ObjectHandle key)
-{
-       TEE_ObjectInfo info;
-       TEE_GetObjectInfo(key, &info);
-
-       return (info.objectSize + 7) >> 3;
-}
-
 static uint32_t KM_CheckAlgoKeySize(uint32_t type, uint32_t key_size)
 {
        switch (type) {
@@ -508,7 +500,7 @@ static TEE_Result KM_DeserializeAndGetAsymKey(TEE_Param param,
        if (pwdData != NULL) {
                ret = KM_DecryptAsymKey(keyIdData, pwdData, key);
        } else {
-               ret = KM_OpenKey(keyIdData->data, keyIdData->data_size, NULL, key);
+               ret = KM_OpenKey(keyIdData->data, keyIdData->data_size, key);
        }
 
        if (TEE_SUCCESS != ret)
@@ -734,9 +726,9 @@ TEE_Result KM_ExecCmdGenerateDSAKey(TEE_Param param[4])
        }
 
        // generate private key
-       TEE_InitRefAttribute(&dsaParams[0], TEE_ATTR_DSA_PRIME, primeBuf.data, primeBuf.data_size);
-       TEE_InitRefAttribute(&dsaParams[1], TEE_ATTR_DSA_SUBPRIME, subprimeBuf.data, subprimeBuf.data_size);
-       TEE_InitRefAttribute(&dsaParams[2], TEE_ATTR_DSA_BASE, baseBuf.data, baseBuf.data_size);
+       KM_InitRefAttribute(&dsaParams[0], TEE_ATTR_DSA_PRIME, primeBuf.data, primeBuf.data_size);
+       KM_InitRefAttribute(&dsaParams[1], TEE_ATTR_DSA_SUBPRIME, subprimeBuf.data, subprimeBuf.data_size);
+       KM_InitRefAttribute(&dsaParams[2], TEE_ATTR_DSA_BASE, baseBuf.data, baseBuf.data_size);
 
        return KM_GenerateAsymKey(bufferPtr,
                                                        bufferSizeGuard,
@@ -823,7 +815,7 @@ TEE_Result KM_ExecCmdSymmetric(uint32_t commandID, TEE_Param param[4])
        if (pwd_data != NULL) {
                ret = KM_DecryptKey(key_id_data->data, key_id_data->data_size, pwd_data, &key);
        } else {
-               ret = KM_OpenKey(key_id_data->data, key_id_data->data_size, NULL, &key);
+               ret = KM_OpenKey(key_id_data->data, key_id_data->data_size, &key);
        }
 
        if (ret != TEE_SUCCESS) {
@@ -936,7 +928,7 @@ TEE_Result KM_ExecCmdAuth(uint32_t commandID, TEE_Param param[4])
        if (pwd_data != NULL) {
                ret = KM_DecryptKey(key_id_data->data, key_id_data->data_size, pwd_data, &key);
        } else {
-               ret = KM_OpenKey(key_id_data->data, key_id_data->data_size, NULL, &key);
+               ret = KM_OpenKey(key_id_data->data, key_id_data->data_size, &key);
        }
        if (TEE_SUCCESS != ret) {
                goto clean;
@@ -1077,6 +1069,7 @@ TEE_Result KM_ExecCmdSign(TEE_Param param[4])
        TEE_Result ret = TEE_SUCCESS;
        TEE_ObjectHandle key = TEE_HANDLE_NULL;
        TEE_OperationHandle operation = TEE_HANDLE_NULL;
+       TEE_ObjectInfo info;
        KM_SymmetricInput *input = NULL;
        KM_InputData *inputData = NULL;
 
@@ -1115,7 +1108,9 @@ TEE_Result KM_ExecCmdSign(TEE_Param param[4])
                goto clean;
        }
 
-       outSize = KM_SignatureSizeFromKey(key);
+       TEE_GetObjectInfo(key, &info);
+
+       outSize = KM_ObjectSizeBytes(&info);
        out = malloc(outSize);
        if (out == NULL) {
                LOG("Failed to allocate output buffer");

diff --git a/ta/src/internal.c b/ta/src/internal.c
index 37f84d2f67bd73d27f1fc8584de4bf8290778aa2..7bd677ccf03fc7c5487be826a785e631bb680174 100644 (file)
--- a/ta/src/internal.c
+++ b/ta/src/internal.c
@@ -121,7 +121,7 @@ TEE_Result KM_CreateKey(uint32_t tee_key_type, uint32_t key_bits_size, void *key
        TEE_Attribute attr;
        TEE_Result ret = TEE_SUCCESS;
 
-       TEE_InitRefAttribute(&attr, TEE_ATTR_SECRET_VALUE, key, (key_bits_size + 7)/8);
+       KM_InitRefAttribute(&attr, TEE_ATTR_SECRET_VALUE, key, (key_bits_size + 7)/8);
        ret = TEE_AllocateTransientObject(tee_key_type, key_bits_size, hndl);
        if (TEE_SUCCESS != ret) {
                LOG("TEE_AllocateTransientObject has failed with=%x. Arguments=(tee_key_type=%X, "
@@ -227,7 +227,9 @@ TEE_Result KM_EncryptKey(TEE_ObjectHandle keyHndl, KM_PwdData *pwd,
        }
 
        TEE_GetObjectInfo(keyHndl, &objInfo);
-       if (objInfo.objectSize == 0) {
+       keyBufSize = KM_ObjectSizeBytes(&objInfo);
+
+       if (keyBufSize == 0) {
                LOG("Key provided for encryption is not initialized");
                return TEE_ERROR_BAD_PARAMETERS;
        }
@@ -237,7 +239,6 @@ TEE_Result KM_EncryptKey(TEE_ObjectHandle keyHndl, KM_PwdData *pwd,
                return TEE_ERROR_BAD_PARAMETERS;
        }
 
-       keyBufSize = objInfo.objectSize;
        keyBuf = malloc(keyBufSize);
        if (keyBuf == NULL) {
                LOG("Failed to allocate memory for key encryption");
@@ -270,7 +271,7 @@ TEE_Result KM_EncryptKey(TEE_ObjectHandle keyHndl, KM_PwdData *pwd,
        }
 
        // create new key from encrypted one
-       ret = KM_CreateKey(objInfo.objectType, objInfo.objectSize, encKeyBuf, encKeyHndl);
+       ret = KM_CreateKey(objInfo.objectType, encKeyBufSize * 8, encKeyBuf, encKeyHndl);
        if (ret != TEE_SUCCESS) {
                LOG("Failed to create new key from encrypted");
                goto out;
@@ -287,6 +288,7 @@ static TEE_Result KM_GetAttribute(TEE_ObjectHandle keyHndl, uint32_t attrId, KM_
 {
        TEE_ObjectInfo objInfo;
        TEE_Result ret;
+       uint32_t objSize;
 
        if (attr == NULL) {
                LOG("Attribute buffer is NULL");
@@ -298,13 +300,13 @@ static TEE_Result KM_GetAttribute(TEE_ObjectHandle keyHndl, uint32_t attrId, KM_
         * buffer in TEE_GetObjectBufferAttribute doesn't work in simulator.
         */
        TEE_GetObjectInfo(keyHndl, &objInfo);
-       if (((objInfo.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) == 0) ||
-               (objInfo.objectSize == 0)) {
+       objSize = KM_ObjectSizeBytes(&objInfo);
+       if (((objInfo.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) == 0) || (objSize == 0)) {
                LOG("Key provided for encryption is not initialized");
                return TEE_ERROR_BAD_PARAMETERS;
        }
 
-       attr->data_size = (objInfo.objectSize + 7) >> 3;
+       attr->data_size = objSize;
        attr->data = malloc(attr->data_size);
        if (attr->data == NULL) {
                LOG("Failed to allocate memory for key  attribute.");
@@ -340,6 +342,7 @@ static TEE_Result KM_EncryptAsymKeyInternal(TEE_ObjectHandle keyHndl, const KM_P
        KM_BinaryData attributes[attrsCount];
        KM_BinaryData tmpEncKey;
        KM_BinaryData tmpTag;
+       uint32_t maxObjectSizeBits = 0;
 
        if (encKey == NULL) {
                LOG("There's no buffer for encrypted key");
@@ -363,8 +366,9 @@ static TEE_Result KM_EncryptAsymKeyInternal(TEE_ObjectHandle keyHndl, const KM_P
        tmpTag.data_size = 0;
 
        TEE_GetObjectInfo(keyHndl, &objInfo);
+       maxObjectSizeBits = KM_MaxObjectSizeBits(&objInfo);
        if (((objInfo.handleFlags & TEE_HANDLE_FLAG_INITIALIZED) == 0) ||
-               (objInfo.maxObjectSize == 0)) {
+               (maxObjectSizeBits == 0)) {
                LOG("Key provided for encryption is not initialized");
                return TEE_ERROR_BAD_PARAMETERS;
        }
@@ -397,7 +401,7 @@ static TEE_Result KM_EncryptAsymKeyInternal(TEE_ObjectHandle keyHndl, const KM_P
                goto clean;
        }
 
-       if (KM_SerializeFlag(&keyDataBufferPtr, &keyDataBufferGuard, objInfo.maxObjectSize)) {
+       if (KM_SerializeFlag(&keyDataBufferPtr, &keyDataBufferGuard, maxObjectSizeBits)) {
                LOG("Failed to serialize object max size");
                ret = TEE_ERROR_GENERIC;
                goto clean;
@@ -467,9 +471,9 @@ static TEE_Result KM_CreateDecryptedAsymKey(void *data, uint32_t dataSize, uint3
        TEE_Attribute attributes[attrsCount];
        TEE_Result ret = 0;
        uint32_t i = 0;
-       uint32_t maxObjectSize = 0;
+       uint32_t maxObjectSizeBits = 0;
 
-       if (KM_DeserializeFlag(&data, &dataSize, &maxObjectSize)) {
+       if (KM_DeserializeFlag(&data, &dataSize, &maxObjectSizeBits)) {
                LOG("Failed to deserialize object size");
                return TEE_ERROR_BAD_PARAMETERS;
        }
@@ -480,11 +484,10 @@ static TEE_Result KM_CreateDecryptedAsymKey(void *data, uint32_t dataSize, uint3
                        return TEE_ERROR_BAD_PARAMETERS;
                }
 
-               TEE_InitRefAttribute(&attributes[i], attrIDs[i],
-                                                       readAttr[i].data, readAttr[i].data_size);
+               KM_InitRefAttribute(&attributes[i], attrIDs[i], readAttr[i].data, readAttr[i].data_size);
        }
 
-       ret = TEE_AllocateTransientObject(keyType, maxObjectSize, hndl);
+       ret = TEE_AllocateTransientObject(keyType, maxObjectSizeBits, hndl);
        if (ret != TEE_SUCCESS) {
                LOG("Failed to allocate transient object for new key, ret %x", ret);
                return ret;
@@ -723,15 +726,15 @@ TEE_Result KM_DecryptKey(void *id, size_t id_size, KM_PwdData* pwd,
                return TEE_ERROR_BAD_PARAMETERS;
        }
 
-       ret = KM_OpenKey(id, id_size, NULL, &objHandle);
+       ret = KM_OpenKey(id, id_size, &objHandle);
 
        TEE_GetObjectInfo(objHandle, &objInfo);
-       if (objInfo.objectSize == 0) {
+       keyBufSize = KM_ObjectSizeBytes(&objInfo);
+       if (keyBufSize == 0) {
                LOG("Key provided for encryption is not initialized");
                return TEE_ERROR_BAD_PARAMETERS;
        }
 
-       keyBufSize = objInfo.objectSize;
        keyBuf = malloc(keyBufSize);
        if (keyBuf == NULL) {
                LOG("Failed to allocate memory for key encryption");
@@ -763,7 +766,7 @@ TEE_Result KM_DecryptKey(void *id, size_t id_size, KM_PwdData* pwd,
        }
 
        // create new key from decrypted one
-       ret = KM_CreateKey(objInfo.objectType, objInfo.objectSize, decKeyBuf, decKeyHndl);
+       ret = KM_CreateKey(objInfo.objectType, decKeyBufSize * 8, decKeyBuf, decKeyHndl);
        if (ret != TEE_SUCCESS) {
                LOG("Failed to create new key from decrypted");
                goto out;
@@ -840,11 +843,13 @@ TEE_Result KM_CreateOperation(TEE_ObjectHandle op_key_hndl, uint32_t algo,
 {
        TEE_Result ret = TEE_SUCCESS;
        TEE_ObjectInfo info;
+       uint32_t bits;
 
        TEE_GetObjectInfo(op_key_hndl, &info);
 
-       LOGD("Operation key size: %d alg: %x", info.objectSize, algo);
-       ret = TEE_AllocateOperation(hndl, algo, mode, info.objectSize);
+       bits = KM_ObjectSizeBits(&info);
+       LOGD("Operation key size: %d alg: %x", bits, algo);
+       ret = TEE_AllocateOperation(hndl, algo, mode, bits);
        if (TEE_SUCCESS != ret) {
                LOG("TEE_AllocateOperation has failed with=%x.", ret);
                return ret;
@@ -914,11 +919,9 @@ TEE_Result KM_SaveKey(void *data, size_t data_size, TEE_ObjectHandle key, void *
        return ret;
 }
 
-TEE_Result KM_OpenKey(void *objId, size_t objId_size, uint32_t *key_bits_size,
-                                               TEE_ObjectHandle *hndl)
+TEE_Result KM_OpenKey(void *objId, size_t objId_size, TEE_ObjectHandle *hndl)
 {
        TEE_Result ret = TEE_SUCCESS;
-       TEE_ObjectInfo info;
        uint32_t flags =
                 TEE_DATA_FLAG_ACCESS_READ;
 
@@ -928,10 +931,6 @@ TEE_Result KM_OpenKey(void *objId, size_t objId_size, uint32_t *key_bits_size,
                return ret;
        }
 
-       if (key_bits_size) {
-               TEE_GetObjectInfo(*hndl, &info);
-               *key_bits_size = info.objectSize;
-       }
        return ret;
 }