參考內容《手機安全和可信應用開發》
https://note.youdao.com/s/MTlG4c1w
介紹
TA的全稱是Trust Application， 即可信任應用程序。 CA的全稱是Client Applicant， 即客戶端應用程序。 TA運行在OP-TEE的用戶空間， CA運行在REE側。 CA執行時代入特定的UUID和命令ID參數就能實現請求特定TA執行特定操作的需求， 并將執行結果返回給CA。 通過CA對TA的調用可實現在REE側對安全設備和安全資源的操作。 普通用戶無法知道TA的具體實現， 例如操作使用了什么算法、 操作了哪些資源、 獲取了哪些數據等， 這也就確保了相關資源和數據的安全。
編寫自己的第一個TA程序
Android.mk是安卓編譯,
host/main.c==>CA:共五步：1.初始化上下文；2.打開會話；3.發送命令和參數；4.關閉會話；5.結束上下文。
hello_world_ta.c==>TA，分別對應CA五步的入口操作
CA
int main(void)
{
//1.-------------------------------------------------------------------------------------------- res = TEEC_InitializeContext(NULL, &ctx);if (res != TEEC_SUCCESS)errx(1, "TEEC_InitializeContext failed with code 0x%x", res);
//2.--------------------------------------------------------------------------------------------res = TEEC_OpenSession(&ctx, &sess, &uuid,TEEC_LOGIN_PUBLIC, NULL, NULL, &err_origin);if (res != TEEC_SUCCESS)errx(1, "TEEC_Opensession failed with code 0x%x origin 0x%x",res, err_origin);
//3.-------------------------------------------------------------------------------------------- memset(&op, 0, sizeof(op));op.paramTypes = TEEC_PARAM_TYPES(TEEC_VALUE_INOUT, TEEC_NONE,TEEC_NONE, TEEC_NONE);op.params[0].value.a = 42;printf("Invoking TA to increment %d\n", op.params[0].value.a);res = TEEC_InvokeCommand(&sess, TA_HELLO_WORLD_CMD_INC_VALUE, &op,&err_origin);command if (res != TEEC_SUCCESS)errx(1, "TEEC_InvokeCommand failed with code 0x%x origin 0x%x",res, err_origin);printf("TA incremented value to %d\n", op.params[0].value.a);
//4.---------------------------------------------------------------------------------------------TEEC_CloseSession(&sess);
//5.--------------------------------------------------------------------------------------------TEEC_FinalizeContext(&ctx);return 0;
}TA
TEE_Result TA_CreateEntryPoint(void)
{DMSG("has been called");return TEE_SUCCESS;
}void TA_DestroyEntryPoint(void)
{DMSG("has been called");
}TEE_Result TA_OpenSessionEntryPoint(uint32_t param_types,TEE_Param __maybe_unused params[4],void __maybe_unused **sess_ctx)
{uint32_t exp_param_types = TEE_PARAM_TYPES(TEE_PARAM_TYPE_NONE,TEE_PARAM_TYPE_NONE,TEE_PARAM_TYPE_NONE,TEE_PARAM_TYPE_NONE);DMSG("has been called");if (param_types != exp_param_types)return TEE_ERROR_BAD_PARAMETERS;(void)¶ms;(void)&sess_ctx;IMSG("Hello 0xCC!\n");return TEE_SUCCESS;
}void TA_CloseSessionEntryPoint(void __maybe_unused *sess_ctx)
{(void)&sess_ctx; /* Unused parameter */IMSG("Goodbye! 0xCC \n");
}static TEE_Result inc_value(uint32_t param_types,TEE_Param params[4])
{uint32_t exp_param_types = TEE_PARAM_TYPES(TEE_PARAM_TYPE_VALUE_INOUT,TEE_PARAM_TYPE_NONE,TEE_PARAM_TYPE_NONE,TEE_PARAM_TYPE_NONE);DMSG("has been called");if (param_types != exp_param_types)return TEE_ERROR_BAD_PARAMETERS;IMSG("Got value: %u from NW", params[0].value.a);params[0].value.a += 10; ///42+10 = 52IMSG("Increase value to: %u", params[0].value.a);return TEE_SUCCESS;
}static TEE_Result dec_value(uint32_t param_types,TEE_Param params[4])
{uint32_t exp_param_types = TEE_PARAM_TYPES(TEE_PARAM_TYPE_VALUE_INOUT,TEE_PARAM_TYPE_NONE,TEE_PARAM_TYPE_NONE,TEE_PARAM_TYPE_NONE);DMSG("has been called");if (param_types != exp_param_types)return TEE_ERROR_BAD_PARAMETERS;IMSG("Got value: %u from NW", params[0].value.a);params[0].value.a--;IMSG("Decrease value to: %u", params[0].value.a);return TEE_SUCCESS;
}TEE_Result TA_InvokeCommandEntryPoint(void __maybe_unused *sess_ctx,uint32_t cmd_id,uint32_t param_types, TEE_Param params[4])
{(void)&sess_ctx; /* Unused parameter */switch (cmd_id) {case TA_HELLO_0xCC_CMD_INC_VALUE:return inc_value(param_types, params);case TA_HELLO_0xCC_CMD_DEC_VALUE:return dec_value(param_types, params);default:return TEE_ERROR_BAD_PARAMETERS;}
}TA屬性說明
#ifndef USER_TA_HEADER_DEFINES_H
#define USER_TA_HEADER_DEFINES_H/* To get the TA UUID definition */
#include <hello_0xcc_ta.h>#define TA_UUID TA_HELLO_0xCC_UUID
TA識別號
/** TA properties: multi-instance TA, no specific attribute* TA_FLAG_EXEC_DDR is meaningless but mandated.*/
#define TA_FLAGS TA_FLAG_EXEC_DDR
表示TA是否支持多個會話實例
/* Provisioned stack size */
#define TA_STACK_SIZE (2 * 1024)
TA運行時棧大小
/* Provisioned heap size for TEE_Malloc() and friends */
#define TA_DATA_SIZE (32 * 1024)
TA運行時堆空間大小 TEE_Malloc就是從這個空間中分配
/* The gpd.ta.version property */
#define TA_VERSION "1.0"
版本信息
/* The gpd.ta.description property */
#define TA_DESCRIPTION "Example of OP-TEE Hello 0xCC Trusted Application"
TA的描述字段
/* Extra properties */
#define TA_CURRENT_TA_EXT_PROPERTIES \{ "org.linaro.optee.examples.hello_world.property1", \USER_TA_PROP_TYPE_STRING, \"Some string" }, \{ "org.linaro.optee.examples.hello_world.property2", \USER_TA_PROP_TYPE_U32, &(const uint32_t){ 0x0010 } }
通過宏定義描述gp.ta.description和gp.ta.version
#endif /* USER_TA_HEADER_DEFINES_H */
運行結果
逆向
將uuid.ta的程序逆向，可以看到是跟編寫的代碼一致的，一般是從TA_InvokeCommandEntryPoint函數開始看起，因為大部分功能是從這里來的。
