diff --git a/capsules/src/lib.rs b/capsules/src/lib.rs
index 4051ccb..2e1ce90 100644
--- a/capsules/src/lib.rs
+++ b/capsules/src/lib.rs
@@ -4,5 +4,5 @@
 pub mod dprintf_capsule;
 pub mod elfloader_capsule;
 pub mod mailbox_capsule;
-pub mod storage_capsule;
 pub mod nexus_spiflash;
+pub mod storage_capsule;
diff --git a/capsules/src/storage_capsule.rs b/capsules/src/storage_capsule.rs
index 0dbfed1..db549c7 100644
--- a/capsules/src/storage_capsule.rs
+++ b/capsules/src/storage_capsule.rs
@@ -1,57 +1,163 @@
-//! Stub StorageManager capsule that doesn't do anything yet.
+//! StorageManager capsule
 
+use core::cell::Cell;
+use core::marker::PhantomData;
+use core::mem::size_of;
+use kernel::common::cells::TakeCell;
+use kernel::hil;
+use kernel::hil::flash::Flash;
 use kernel::{AppId, AppSlice, Callback, Driver, Grant, ReturnCode, Shared};
-// TODO(sleffler): remove dprintf noise once this code does something
+use matcha_config::*;
 use matcha_hal::dprintf;
+use matcha_utils::SMC_PAGE_SIZE;
+use matcha_utils::smc_is_page;
+use matcha_utils::smc_ram_memcpy;
+use matcha_utils::tar_loader::TarHeader;
+
+const FLASH_END: usize = 16 * 1024 * 1024; // 16MiB SPI flash
+
+// Returns true if the specified SMC page address fits in SPI flash
+fn is_spi_page(addr: usize) -> bool {
+    addr + SMC_PAGE_SIZE < FLASH_END
+}
+
+#[inline]
+fn howmany(a: u32, b: u32) -> u32 { (a + b - 1) / b }
+#[inline]
+fn roundup(a: u32, b: u32) -> u32 { howmany(a, b) * b }
 
 #[derive(Default)]
 pub struct AppData {
-    pub callback: Option<Callback>,
+    // XXX only need 1 callback since we're single-threaded
+    pub get_name_callback: Option<Callback>,
+    pub find_file_callback: Option<Callback>,
+    pub read_page_callback: Option<Callback>,
     pub buffer: Option<AppSlice<Shared, u8>>,
-    pub minor_num: usize,
-    pub arg2: usize,
-    pub arg3: usize,
 }
 
-pub struct StorageCapsule {
+#[derive(Clone, Copy, Debug, PartialEq)]
+enum StorageState {
+    Idle,
+    FindFile(u32 /* cursor */), // NB: filename passed with allow
+    ReadPage(u32 /* fid */, u32 /* offset */, u32 /* dest */),
+    GetName(u32 /* cursor */),  // NB: filename returned with allow
+}
+impl StorageState {
+    fn is_idle(&self) -> bool {
+        match self {
+            StorageState::Idle => true,
+            _ => false,
+        }
+    }
+}
+
+pub struct StorageCapsule<'a, F: hil::flash::Flash + 'static> {
     app_data_grant: Grant<AppData>,
+    pub current_app: Cell<Option<AppId>>,
+    flash: Option<&'static capsules::virtual_flash::FlashUser<'static, F>>,
+    flash_busy: Cell<bool>,
+    read_page: TakeCell<'static, F::Page>,
+    page_len: u32,
+    state: Cell<StorageState>,
+    phantom: PhantomData<&'a ()>,
 }
 
-impl StorageCapsule {
+impl<'a, F: hil::flash::Flash> StorageCapsule<'a, F> {
     pub fn new(app_data_grant: Grant<AppData>) -> Self {
-        return StorageCapsule {
+        Self {
             app_data_grant: app_data_grant,
-        };
+            current_app: Cell::new(None),
+            flash: None,
+            flash_busy: Cell::new(false),
+            read_page: TakeCell::empty(),
+            page_len: 0,
+            state: Cell::new(StorageState::Idle),
+            phantom: PhantomData,
+        }
+    }
+
+    pub fn set_flash(
+        &mut self,
+        flash: &'static capsules::virtual_flash::FlashUser<'static, F>,
+        read_page: &'static mut F::Page,
+    ) {
+        self.flash = Some(flash);
+        self.read_page.replace(read_page);
+        let mut page_len = 0;
+        self.read_page.map(|page| {
+            let mut_page = page.as_mut();
+            page_len = mut_page.len() as u32;
+        });
+        self.page_len = page_len;
     }
 
     pub fn handle_command(
         &self,
+        app_id: AppId,
         app_data: &mut AppData,
         minor_num: usize,
         arg2: usize,
         arg3: usize,
     ) -> ReturnCode {
-        dprintf!(
-            "StorageCapsule::handle_command({}, {}, {})",
-            minor_num,
-            arg2,
-            arg3
-        );
-        app_data.minor_num = minor_num;
-        app_data.arg2 = arg2;
-        app_data.arg3 = arg3;
         match minor_num {
-            0 => ReturnCode::SUCCESS,
-            1 => {
-                if let Some(mut callback) = app_data.callback {
-                    dprintf!("StorageCapsule::handle_command : Calling callback!");
-                    callback.schedule(1, 2, 3);
-                    app_data.callback = Some(callback);
-                    ReturnCode::SUCCESS
-                } else {
-                    dprintf!("StorageCapsule::handle_command : No callback!");
-                    ReturnCode::EINVAL
+            CMD_STORAGE_INIT => {
+                self.current_app.set(Some(app_id));
+                ReturnCode::SUCCESS
+            }
+            CMD_STORAGE_GET_NAME => {
+                let state = self.state.get();
+                if !state.is_idle() {
+                    dprintf!("storage: GET_NAME: state {:?}\r\n", state);
+                    return ReturnCode::EBUSY;
                 }
+                // NB: buffer is optional
+                let fid = arg2 as u32;
+                self.state.set(StorageState::GetName(fid));
+                self.read_page(fid); // First read, kicks off state machine
+                return ReturnCode::SUCCESS
+            }
+            CMD_STORAGE_FIND_FILE => {
+                let state = self.state.get();
+                if !state.is_idle() {
+                    dprintf!("storage: FIND_FILE: state {:?}\r\n", state);
+                    return ReturnCode::EBUSY;
+                }
+                // Verify the filename has been passed to allow and check
+                // the string is valid so work inside the state machine
+                // can just unwrap the result of str::from_utf8.
+                if let Some(app_slice) = app_data.buffer.as_ref() {
+                    if core::str::from_utf8(app_slice.as_ref()).is_ok() {
+                        self.state.set(StorageState::FindFile(0));
+                        self.read_page(0); // First read, kicks off state machine
+                        return ReturnCode::SUCCESS
+                    }
+                }
+                ReturnCode::EINVAL
+            }
+            CMD_STORAGE_READ_PAGE => {
+                let state = self.state.get();
+                if !state.is_idle() {
+                    dprintf!("storage: READ: state {:?}\r\n", state);
+                    return ReturnCode::EBUSY;
+                }
+                // NB: this checks the entire 4K page can be read from SPI;
+                // we don't really handle reading less than a full page.
+                let fid = arg2 as u32;
+                if !is_spi_page(fid as usize) {
+                    dprintf!("storage: READ: extends past the end-of-flash (fid  {})\r\n", fid);
+                    return ReturnCode::EINVAL;
+                }
+                // The best we can do is check |dest| looks like an SMC
+                // address; otherwise we just spray data where ever the
+                // SecurityCoordinator tells us.
+                let dest = arg3 as u32;
+                if !smc_is_page(dest as usize) {
+                    dprintf!("storage: READ: destination not in SMC (dest {:#x})\r\n", dest);
+                    return ReturnCode::EINVAL;
+                }
+                self.state.set(StorageState::ReadPage(fid, 0, dest));
+                self.read_page(fid); // First read, kicks off state machine
+                ReturnCode::SUCCESS
             }
             _ => ReturnCode::EINVAL,
         }
@@ -59,43 +165,217 @@
 
     pub fn handle_subscribe(
         &self,
+        _app_id: AppId,
         app_data: &mut AppData,
         minor_num: usize,
         callback: Option<Callback>,
     ) -> ReturnCode {
-        dprintf!("StorageCapsule::handle_subscribe({})", minor_num);
-        if callback.is_some() {
-            dprintf!("StorageCapsule::handle_subscribe got Some callback");
-        } else {
-            dprintf!("StorageCapsule::handle_subscribe got None callback");
+        match minor_num {
+            CMD_STORAGE_GET_NAME => {
+                app_data.get_name_callback = callback;
+                ReturnCode::SUCCESS
+            }
+            CMD_STORAGE_FIND_FILE => {
+                app_data.find_file_callback = callback;
+                ReturnCode::SUCCESS
+            }
+            CMD_STORAGE_READ_PAGE => {
+                app_data.read_page_callback = callback;
+                ReturnCode::SUCCESS
+            }
+            _ => ReturnCode::EINVAL,
         }
-        app_data.callback = callback;
-        return ReturnCode::SUCCESS;
     }
 
     pub fn handle_allow(
         &self,
+        _app_id: AppId,
         app_data: &mut AppData,
-        _minor_num: usize,
+        minor_num: usize,
         slice: Option<AppSlice<Shared, u8>>,
     ) -> ReturnCode {
-        if let Some(slice) = slice {
-            dprintf!("StorageCapsule::handle_allow({})", slice.len());
-            app_data.buffer = Some(slice);
-        } else {
-            dprintf!("StorageCapsule::handle_allow(None)");
+        match minor_num {
+            CMD_STORAGE_GET_NAME
+            | CMD_STORAGE_FIND_FILE => {
+                app_data.buffer = slice;
+                ReturnCode::SUCCESS
+            }
+            _ => ReturnCode::EINVAL,
         }
-        return ReturnCode::SUCCESS;
+    }
+
+    // GetName state machine callback on flash read complete.
+    fn get_name_callback(&self) {
+        self.current_app.get().map(|app_id| {
+            let _ = self.app_data_grant.enter(app_id, |app_data, _| {
+                self.read_page.map(|page| {
+                    let mut_page = page.as_mut(); // XXX mut?
+                    match self.state.get() {
+                        StorageState::GetName(cursor) => {
+                            let tar_header = TarHeader::from_bytes(mut_page);
+                            if tar_header.has_magic() {
+                                // Copy back filename if a buffer is setup.
+                                let name_len = if let Some(app_slice) = app_data.buffer.as_mut() {
+                                    let slice = app_slice.as_mut();
+                                    let tar_bytes = tar_header.name().as_bytes();
+                                    if slice.len() > tar_bytes.len() {
+                                        &mut slice[..tar_bytes.len()].copy_from_slice(tar_bytes);
+                                        tar_bytes.len()
+                                    } else {
+                                        slice.copy_from_slice(&tar_bytes[..slice.len()]);
+                                        slice.len()
+                                    }
+                                } else { 0 };
+                                let tar_size = tar_header.size();
+                                let next_cursor = cursor
+                                    + self.page_len
+                                    + roundup(tar_size, size_of::<TarHeader>() as u32);
+                                self.state.set(StorageState::Idle);
+                                app_data.get_name_callback.map(|mut callback| {
+                                    callback.schedule(1, name_len, next_cursor as usize);
+                                });
+                            } else {
+                                // Tar header looks invalid, this is typically how a failed lookup ends.
+                                self.state.set(StorageState::Idle);
+                                app_data.get_name_callback.map(|mut callback| {
+                                    callback.schedule(0, 0, 0);
+                                });
+                            }
+                        }
+                        _ => panic!("get_name: bad state"),
+                    }
+                });
+            });
+        });
+    }
+
+    // FindFile state machine callback on flash read complete.
+    fn find_file_callback(&self) {
+        self.current_app.get().map(|app_id| {
+            let _ = self.app_data_grant.enter(app_id, |app_data, _| {
+                self.read_page.map(|page| {
+                    let mut_page = page.as_mut(); // XXX mut?
+                    match self.state.get() {
+                        StorageState::FindFile(cursor) => {
+                            let tar_header = TarHeader::from_bytes(mut_page);
+                            if tar_header.has_magic() {
+                                // NB: app_slice is checked to be valid in command; we assume
+                                //   it does not change while we're running
+                                let app_slice = app_data.buffer.as_ref().unwrap();
+                                let name = core::str::from_utf8(app_slice.as_ref()).unwrap();
+                                let tar_name = tar_header.name();
+                                let tar_size = tar_header.size();
+                                if tar_name == name {
+                                    // Found file, return fid = the offset to the first byte of data
+                                    self.state.set(StorageState::Idle);
+                                    app_data.find_file_callback.map(|mut callback| {
+                                        callback.schedule(
+                                            1,                                          // success
+                                            (cursor as usize) + size_of::<TarHeader>(), // fid
+                                            tar_size as usize,                          // file size (bytes)
+                                        );
+                                    });
+                                } else {
+                                    // Advance to the next file if possible. We depend on
+                                    // each header having a magic marker; otherwise we use
+                                    // a fixed bound on the flash size to (try to) avoid
+                                    // reading past the end of memory.
+                                    let next_cursor = cursor
+                                        + self.page_len
+                                        + roundup(tar_size, size_of::<TarHeader>() as u32);
+                                    if ((next_cursor as usize) + size_of::<TarHeader>()) >= FLASH_END {
+                                        dprintf!("storage: {} not found, end of flash\r\n", name);
+                                        self.state.set(StorageState::Idle);
+                                        app_data.find_file_callback.map(|mut callback| {
+                                            callback.schedule(0, 0, 0);
+                                        });
+                                    } else {
+                                        self.state.set(StorageState::FindFile(next_cursor));
+                                        // NB: defer read to below so we release self.read_page
+                                    }
+                                }
+                            } else {
+                                // Tar header looks invalid, this is typically how a failed lookup ends.
+                                self.state.set(StorageState::Idle);
+                                app_data.find_file_callback.map(|mut callback| {
+                                    callback.schedule(0, 0, 0);
+                                });
+                            }
+                        }
+                        _ => panic!("find_file: bad state"),
+                    }
+                });
+                match self.state.get() {
+                    StorageState::FindFile(cursor) => self.read_page(cursor),
+                    _ => {}
+                }
+            });
+        });
+    }
+
+    // ReadPage state machine callback on flash read complete.
+    fn read_page_callback(&self) {
+        self.current_app.get().map(|app_id| {
+            let _ = self.app_data_grant.enter(app_id, |app_data, _| {
+                self.read_page.map(|page| {
+                    let mut_page = page.as_mut();
+                    match self.state.get() {
+                        StorageState::ReadPage(fid, offset, dest) => {
+//                            dprintf!("copy page {} to {:x}\r\n", fid + offset, dest);
+                            smc_ram_memcpy(
+                                mut_page,
+                                dest,
+                                self.page_len as usize, // XXX short read?
+                            );
+                            let next_offset = offset + self.page_len;
+                            if next_offset >= (SMC_PAGE_SIZE as u32) {
+                                self.state.set(StorageState::Idle);
+                                app_data.read_page_callback.map(|mut callback| {
+                                    callback.schedule(1, fid as usize, SMC_PAGE_SIZE);
+                                });
+                            } else {
+                                self.state.set(
+                                    StorageState::ReadPage(
+                                        fid,
+                                        next_offset,
+                                        dest + self.page_len,
+                                    )
+                                );
+                                // NB: defer read to below so we release self.read_page
+                            }
+                        }
+                        _ => panic!("read_page: bad state"),
+                    }
+                });
+                match self.state.get() {
+                    StorageState::ReadPage(fid, offset, _) => self.read_page(fid + offset),
+                    _ => {}
+                }
+            });
+        });
+    }
+
+    // Kicks off a SPI flash read at the byte offset |page|.
+    fn read_page(&self, page: u32) {
+        debug_assert!((page % self.page_len) == 0);
+        self.flash.map(|flash| {
+            self.read_page.take().map(|read_page| {
+                self.flash_busy.set(true);
+                if let Err((_, buf)) = flash.read_page((page / self.page_len) as usize, read_page) {
+                    self.read_page.replace(buf);
+                }
+            });
+        });
     }
 }
 
 /// Driver impl just enters the app_data grant and delegates to StorageCapsule.
 
-impl Driver for StorageCapsule {
+impl<'a, F: hil::flash::Flash> Driver for StorageCapsule<'a, F> {
     fn subscribe(&self, minor_num: usize, callback: Option<Callback>, app_id: AppId) -> ReturnCode {
         self.app_data_grant
             .enter(app_id, |app_data, _| {
-                self.handle_subscribe(app_data, minor_num, callback)
+                self.handle_subscribe(app_id, app_data, minor_num, callback)
             })
             .unwrap_or_else(|err| err.into())
     }
@@ -103,7 +383,7 @@
     fn command(&self, minor_num: usize, r2: usize, r3: usize, app_id: AppId) -> ReturnCode {
         self.app_data_grant
             .enter(app_id, |app_data, _| {
-                self.handle_command(app_data, minor_num, r2, r3)
+                self.handle_command(app_id, app_data, minor_num, r2, r3)
             })
             .unwrap_or_else(|err| err.into())
     }
@@ -116,8 +396,33 @@
     ) -> ReturnCode {
         self.app_data_grant
             .enter(app_id, |app_data, _| {
-                self.handle_allow(app_data, minor_num, slice)
+                self.handle_allow(app_id, app_data, minor_num, slice)
             })
             .unwrap_or_else(|err| err.into())
     }
 }
+
+impl<'a, F: hil::flash::Flash> hil::flash::Client<capsules::virtual_flash::FlashUser<'a, F>>
+    for StorageCapsule<'a, F>
+{
+    fn read_complete(&self, read_page: &'static mut F::Page, _err: kernel::hil::flash::Error) {
+        self.read_page.replace(read_page);
+        self.flash_busy.set(false);
+        match self.state.get() {
+            StorageState::GetName(..) => self.get_name_callback(),
+            StorageState::FindFile(..) => self.find_file_callback(),
+            StorageState::ReadPage(..) => self.read_page_callback(),
+            _ => panic!("bad state"),
+        }
+    }
+    fn write_complete(
+        &self,
+        _: &'static mut <F as kernel::hil::flash::Flash>::Page,
+        _: kernel::hil::flash::Error,
+    ) {
+        todo!()
+    }
+    fn erase_complete(&self, _: kernel::hil::flash::Error) {
+        todo!()
+    }
+}
diff --git a/config/src/lib.rs b/config/src/lib.rs
index aa777b3..14d4d19 100644
--- a/config/src/lib.rs
+++ b/config/src/lib.rs
@@ -46,5 +46,10 @@
 pub const SPI_HOST0_BASE_ADDRESS: u32 = 0x4030_0000; // TOP_MATCHA_SPI_HOST0_BASE_ADDR
 pub const SPI_HOST0_SPI_EVENT_IRQ: u32 = 132; // kTopMatchaPlicIrqIdSpiHost0SpiEvent
 
+pub const CMD_STORAGE_INIT: usize = 1;
+pub const CMD_STORAGE_GET_NAME: usize = 2;
+pub const CMD_STORAGE_FIND_FILE: usize = 3;
+pub const CMD_STORAGE_READ_PAGE: usize = 4;
+
 pub const UART0_BASE_ADDRESS: u32 = 0x40000000; // TOP_MATCHA_UART0_BASE_ADDR
 pub const UART0_BAUDRATE: u32 = 115200;
diff --git a/platform/src/main.rs b/platform/src/main.rs
index 0d96a7e..2ce5d09 100644
--- a/platform/src/main.rs
+++ b/platform/src/main.rs
@@ -119,7 +119,13 @@
         VirtualMuxAlarm<'static, timer_hal::RvTimer<'static>>,
     >,
     dprintf_capsule: &'static DprintfCapsule,
-    storage_capsule: &'static StorageCapsule,
+    storage_capsule: &'static StorageCapsule<
+        'static,
+        matcha_capsules::nexus_spiflash::NexusSpiflash<
+            'static,
+            capsules::virtual_spi::VirtualSpiMasterDevice<'static, spi_host_hal::SpiHw>,
+        >,
+    >,
     elfloader_capsule: &'static ElfLoaderCapsule<
         'static,
         matcha_capsules::nexus_spiflash::NexusSpiflash<
@@ -246,9 +252,14 @@
     );
 
     let storage_capsule = static_init!(
-        matcha_capsules::storage_capsule::StorageCapsule,
+        matcha_capsules::storage_capsule::StorageCapsule<
+            'static,
+        matcha_capsules::nexus_spiflash::NexusSpiflash<
+            'static,
+            capsules::virtual_spi::VirtualSpiMasterDevice<'static, spi_host_hal::SpiHw>,
+        >>,
         matcha_capsules::storage_capsule::StorageCapsule::new(
-            board_kernel.create_grant(&memory_allocation_cap)
+             board_kernel.create_grant(&memory_allocation_cap)
         )
     );
 
@@ -325,22 +336,38 @@
         capsules::virtual_flash::MuxFlash::new(nexus_spiflash)
     );
     hil::flash::HasClient::set_client(nexus_spiflash, mux_flash);
-    let virtual_flash = static_init!(
+
+    // Storage access reads (only) from flash.
+    let storage_virtual_flash = static_init!(
         capsules::virtual_flash::FlashUser<'static, matcha_capsules::nexus_spiflash::NexusSpiflash<
             'static,
             capsules::virtual_spi::VirtualSpiMasterDevice<'static, spi_host_hal::SpiHw>,
         >>,
         capsules::virtual_flash::FlashUser::new(mux_flash)
     );
-    let flash_read_page: &'static mut matcha_capsules::nexus_spiflash::NexusSpiflashPage = static_init!(
+    let storage_read_page: &'static mut matcha_capsules::nexus_spiflash::NexusSpiflashPage = static_init!(
         matcha_capsules::nexus_spiflash::NexusSpiflashPage,
         matcha_capsules::nexus_spiflash::NexusSpiflashPage::default()
     );
+    storage_capsule.set_flash(storage_virtual_flash, storage_read_page);
+    storage_virtual_flash.set_client(storage_capsule);
 
-    elfloader_capsule.set_flash(virtual_flash, flash_read_page);
+    // Elfloader reads artifacts from flash & boots the SMC.
     elfloader_capsule.set_smc_ctrl(&smc_ctrl_hal::SMC_CTRL);
-    virtual_flash.set_client(elfloader_capsule);
-    // elfloader_capsule.load_sel4();
+    let elfloader_virtual_flash = static_init!(
+        capsules::virtual_flash::FlashUser<'static, matcha_capsules::nexus_spiflash::NexusSpiflash<
+            'static,
+            capsules::virtual_spi::VirtualSpiMasterDevice<'static, spi_host_hal::SpiHw>,
+        >>,
+        capsules::virtual_flash::FlashUser::new(mux_flash)
+    );
+    let elfloader_read_page: &'static mut matcha_capsules::nexus_spiflash::NexusSpiflashPage = static_init!(
+        matcha_capsules::nexus_spiflash::NexusSpiflashPage,
+        matcha_capsules::nexus_spiflash::NexusSpiflashPage::default()
+    );
+    elfloader_capsule.set_flash(elfloader_virtual_flash, elfloader_read_page);
+    elfloader_virtual_flash.set_client(elfloader_capsule);
+    // NB: main app triggers the Elfloader bootstrap of seL4
 
     let platform = MatchaPlatform {
         console_capsule: console_capsule,
diff --git a/utils/src/lib.rs b/utils/src/lib.rs
index d21d6e9..25f0f1f 100644
--- a/utils/src/lib.rs
+++ b/utils/src/lib.rs
@@ -13,6 +13,15 @@
 
 pub const SMC_CONTROL_BLOCK: *mut u32 = 0x54020000 as *mut u32;
 
+pub const SMC_PAGE_SIZE: usize = 4096;         // SMC page size
+pub const SMC_BEGIN: usize = 0x50000000;       // Start of SMC memory in SEC map
+pub const SMC_END: usize = SMC_BEGIN + (4*1024*1024); // NB: 4MiB of SMC memory
+
+// Returns true if the specified page address fits in SMC memory
+pub fn smc_is_page(addr: usize) -> bool {
+    SMC_BEGIN <= addr && (addr + SMC_PAGE_SIZE) < SMC_END
+}
+
 pub fn round_up_to_page(addr: u32) -> u32 {
     return (addr + 4095) & !4095;
 }