Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-23 13:36:05 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

refactor(crypto): change CRYPTO_SUPPORT flag to numeric

Browse source 
Updated CRYPTO_SUPPORT flag to numeric to provide below
supports -
1. CRYPTO_SUPPORT = 1 -> Authentication verification only
2. CRYPTO_SUPPORT = 2 -> Hash calculation only
3. CRYPTO_SUPPORT = 3 -> Authentication verification and
                         hash calculation

Change-Id: Ib34f31457a6c87d2356d736ad2d048dc787da56f
Signed-off-by: Manish V Badarkhe <Manish.Badarkhe@arm.com>
This commit is contained in:
Manish V Badarkhe 2022-06-20 15:32:38 +01:00
parent 8b653909b7
commit 2bf4f27f58
4 changed files with 70 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
Makefile
View file

@ -730,7 +730,17 @@ ifeq ($(DYN_DISABLE_AUTH), 1)
endif endif
endif endif
ifneq ($(filter 1,${MEASURED_BOOT} ${TRUSTED_BOARD_BOOT} ${DRTM_SUPPORT}),) ifeq ($(MEASURED_BOOT)-$(TRUSTED_BOARD_BOOT),1-1)
# Support authentication verification and hash calculation
CRYPTO_SUPPORT := 3
else ifeq ($(DRTM_SUPPORT)-$(TRUSTED_BOARD_BOOT),1-1)
# Support authentication verification and hash calculation
CRYPTO_SUPPORT := 3
else ifneq ($(filter 1,${MEASURED_BOOT} ${DRTM_SUPPORT}),)
# Support hash calculation only
CRYPTO_SUPPORT := 2
else ifeq (${TRUSTED_BOARD_BOOT},1)
# Support authentication verification only
CRYPTO_SUPPORT := 1 CRYPTO_SUPPORT := 1
else else
CRYPTO_SUPPORT := 0 CRYPTO_SUPPORT := 0
@ -1035,7 +1045,6 @@ $(eval $(call assert_booleans,\
SPMC_AT_EL3 \ SPMC_AT_EL3 \
SPMD_SPM_AT_SEL2 \ SPMD_SPM_AT_SEL2 \
TRUSTED_BOARD_BOOT \ TRUSTED_BOARD_BOOT \
CRYPTO_SUPPORT \
USE_COHERENT_MEM \ USE_COHERENT_MEM \
USE_DEBUGFS \ USE_DEBUGFS \
ARM_IO_IN_DTB \ ARM_IO_IN_DTB \
@ -1070,6 +1079,7 @@ $(eval $(call assert_numerics,\
CTX_INCLUDE_PAUTH_REGS \ CTX_INCLUDE_PAUTH_REGS \
CTX_INCLUDE_MTE_REGS \ CTX_INCLUDE_MTE_REGS \
CTX_INCLUDE_NEVE_REGS \ CTX_INCLUDE_NEVE_REGS \
CRYPTO_SUPPORT \
ENABLE_BRBE_FOR_NS \ ENABLE_BRBE_FOR_NS \
ENABLE_TRBE_FOR_NS \ ENABLE_TRBE_FOR_NS \
ENABLE_BTI \ ENABLE_BTI \

23
drivers/auth/crypto_mod.c
View file

@ -46,19 +46,26 @@ void crypto_mod_init(void)
{ {
assert(crypto_lib_desc.name != NULL); assert(crypto_lib_desc.name != NULL);
assert(crypto_lib_desc.init != NULL); assert(crypto_lib_desc.init != NULL);
#if TRUSTED_BOARD_BOOT #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
assert(crypto_lib_desc.verify_signature != NULL); assert(crypto_lib_desc.verify_signature != NULL);
assert(crypto_lib_desc.verify_hash != NULL); assert(crypto_lib_desc.verify_hash != NULL);
#endif /* TRUSTED_BOARD_BOOT */ #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
#if MEASURED_BOOT || DRTM_SUPPORT CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
#if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
assert(crypto_lib_desc.calc_hash != NULL); assert(crypto_lib_desc.calc_hash != NULL);
#endif /* MEASURED_BOOT || DRTM_SUPPORT */ #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
/* Initialize the cryptographic library */ /* Initialize the cryptographic library */
crypto_lib_desc.init(); crypto_lib_desc.init();
INFO("Using crypto library '%s'\n", crypto_lib_desc.name); INFO("Using crypto library '%s'\n", crypto_lib_desc.name);
} }
#if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/* /*
* Function to verify a digital signature * Function to verify a digital signature
* *
@ -108,8 +115,11 @@ int crypto_mod_verify_hash(void *data_ptr, unsigned int data_len,
return crypto_lib_desc.verify_hash(data_ptr, data_len, return crypto_lib_desc.verify_hash(data_ptr, data_len,
digest_info_ptr, digest_info_len); digest_info_ptr, digest_info_len);
} }
#endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
#if MEASURED_BOOT || DRTM_SUPPORT #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/* /*
* Calculate a hash * Calculate a hash
* *
@ -129,7 +139,8 @@ int crypto_mod_calc_hash(enum crypto_md_algo alg, void *data_ptr,
return crypto_lib_desc.calc_hash(alg, data_ptr, data_len, output); return crypto_lib_desc.calc_hash(alg, data_ptr, data_len, output);
} }
#endif /* MEASURED_BOOT || DRTM_SUPPORT */ #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
/* /*
* Authenticated decryption of data * Authenticated decryption of data

26
drivers/auth/mbedtls/mbedtls_crypto.c
View file

@ -24,7 +24,8 @@
#define LIB_NAME "mbed TLS" #define LIB_NAME "mbed TLS"
#if MEASURED_BOOT || DRTM_SUPPORT #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/* /*
* CRYPTO_MD_MAX_SIZE value is as per current stronger algorithm available * CRYPTO_MD_MAX_SIZE value is as per current stronger algorithm available
* so make sure that mbed TLS MD maximum size must be lesser than this. * so make sure that mbed TLS MD maximum size must be lesser than this.
@ -32,7 +33,8 @@
CASSERT(CRYPTO_MD_MAX_SIZE >= MBEDTLS_MD_MAX_SIZE, CASSERT(CRYPTO_MD_MAX_SIZE >= MBEDTLS_MD_MAX_SIZE,
assert_mbedtls_md_size_overflow); assert_mbedtls_md_size_overflow);
#endif /* MEASURED_BOOT || DRTM_SUPPORT */ #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
/* /*
* AlgorithmIdentifier ::= SEQUENCE { * AlgorithmIdentifier ::= SEQUENCE {
@ -60,7 +62,8 @@ static void init(void)
mbedtls_init(); mbedtls_init();
} }
#if TRUSTED_BOARD_BOOT #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/* /*
* Verify a signature. * Verify a signature.
* *
@ -219,9 +222,11 @@ static int verify_hash(void *data_ptr, unsigned int data_len,
return CRYPTO_SUCCESS; return CRYPTO_SUCCESS;
} }
#endif /* TRUSTED_BOARD_BOOT */ #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
#if MEASURED_BOOT || DRTM_SUPPORT #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/* /*
* Map a generic crypto message digest algorithm to the corresponding macro used * Map a generic crypto message digest algorithm to the corresponding macro used
* by Mbed TLS. * by Mbed TLS.
@ -264,7 +269,8 @@ static int calc_hash(enum crypto_md_algo md_algo, void *data_ptr,
*/ */
return mbedtls_md(md_info, data_ptr, data_len, output); return mbedtls_md(md_info, data_ptr, data_len, output);
} }
#endif /* MEASURED_BOOT || DRTM_SUPPORT */ #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
#if TF_MBEDTLS_USE_AES_GCM #if TF_MBEDTLS_USE_AES_GCM
/* /*
@ -368,7 +374,7 @@ static int auth_decrypt(enum crypto_dec_algo dec_algo, void *data_ptr,
/* /*
* Register crypto library descriptor * Register crypto library descriptor
*/ */
#if (MEASURED_BOOT || DRTM_SUPPORT) && TRUSTED_BOARD_BOOT #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
#if TF_MBEDTLS_USE_AES_GCM #if TF_MBEDTLS_USE_AES_GCM
REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash, REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash,
auth_decrypt); auth_decrypt);
@ -376,13 +382,13 @@ REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash,
REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash, REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, calc_hash,
NULL); NULL);
#endif #endif
#elif TRUSTED_BOARD_BOOT #elif CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY
#if TF_MBEDTLS_USE_AES_GCM #if TF_MBEDTLS_USE_AES_GCM
REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash,
auth_decrypt); auth_decrypt);
#else #else
REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, NULL); REGISTER_CRYPTO_LIB(LIB_NAME, init, verify_signature, verify_hash, NULL);
#endif #endif
#elif MEASURED_BOOT || DRTM_SUPPORT #elif CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY
REGISTER_CRYPTO_LIB(LIB_NAME, init, calc_hash); REGISTER_CRYPTO_LIB(LIB_NAME, init, calc_hash);
#endif /* (MEASURED_BOOT || DRTM_SUPPORT) && TRUSTED_BOARD_BOOT */ #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */

33
include/drivers/auth/crypto_mod.h
View file

@ -7,6 +7,10 @@
#ifndef CRYPTO_MOD_H #ifndef CRYPTO_MOD_H
#define CRYPTO_MOD_H #define CRYPTO_MOD_H
#define CRYPTO_AUTH_VERIFY_ONLY 1
#define CRYPTO_HASH_CALC_ONLY 2
#define CRYPTO_AUTH_VERIFY_AND_HASH_CALC 3
/* Return values */ /* Return values */
enum crypto_ret_value { enum crypto_ret_value {
CRYPTO_SUCCESS = 0, CRYPTO_SUCCESS = 0,
@ -48,6 +52,8 @@ typedef struct crypto_lib_desc_s {
/* Verify a digital signature. Return one of the /* Verify a digital signature. Return one of the
* 'enum crypto_ret_value' options */ * 'enum crypto_ret_value' options */
#if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
int (*verify_signature)(void *data_ptr, unsigned int data_len, int (*verify_signature)(void *data_ptr, unsigned int data_len,
void *sig_ptr, unsigned int sig_len, void *sig_ptr, unsigned int sig_len,
void *sig_alg, unsigned int sig_alg_len, void *sig_alg, unsigned int sig_alg_len,
@ -56,13 +62,17 @@ typedef struct crypto_lib_desc_s {
/* Verify a hash. Return one of the 'enum crypto_ret_value' options */ /* Verify a hash. Return one of the 'enum crypto_ret_value' options */
int (*verify_hash)(void *data_ptr, unsigned int data_len, int (*verify_hash)(void *data_ptr, unsigned int data_len,
void *digest_info_ptr, unsigned int digest_info_len); void *digest_info_ptr, unsigned int digest_info_len);
#endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
#if MEASURED_BOOT || DRTM_SUPPORT #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/* Calculate a hash. Return hash value */ /* Calculate a hash. Return hash value */
int (*calc_hash)(enum crypto_md_algo md_alg, void *data_ptr, int (*calc_hash)(enum crypto_md_algo md_alg, void *data_ptr,
unsigned int data_len, unsigned int data_len,
unsigned char output[CRYPTO_MD_MAX_SIZE]); unsigned char output[CRYPTO_MD_MAX_SIZE]);
#endif /* MEASURED_BOOT || DRTM_SUPPORT */ #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
/* /*
* Authenticated decryption. Return one of the * Authenticated decryption. Return one of the
@ -84,25 +94,32 @@ static inline void crypto_mod_init(void)
} }
#endif /* CRYPTO_SUPPORT */ #endif /* CRYPTO_SUPPORT */
#if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
int crypto_mod_verify_signature(void *data_ptr, unsigned int data_len, int crypto_mod_verify_signature(void *data_ptr, unsigned int data_len,
void *sig_ptr, unsigned int sig_len, void *sig_ptr, unsigned int sig_len,
void *sig_alg_ptr, unsigned int sig_alg_len, void *sig_alg_ptr, unsigned int sig_alg_len,
void *pk_ptr, unsigned int pk_len); void *pk_ptr, unsigned int pk_len);
int crypto_mod_verify_hash(void *data_ptr, unsigned int data_len, int crypto_mod_verify_hash(void *data_ptr, unsigned int data_len,
void *digest_info_ptr, unsigned int digest_info_len); void *digest_info_ptr, unsigned int digest_info_len);
#endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
int crypto_mod_auth_decrypt(enum crypto_dec_algo dec_algo, void *data_ptr, int crypto_mod_auth_decrypt(enum crypto_dec_algo dec_algo, void *data_ptr,
size_t len, const void *key, unsigned int key_len, size_t len, const void *key, unsigned int key_len,
unsigned int key_flags, const void *iv, unsigned int key_flags, const void *iv,
unsigned int iv_len, const void *tag, unsigned int iv_len, const void *tag,
unsigned int tag_len); unsigned int tag_len);
#if MEASURED_BOOT || DRTM_SUPPORT #if CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
int crypto_mod_calc_hash(enum crypto_md_algo alg, void *data_ptr, int crypto_mod_calc_hash(enum crypto_md_algo alg, void *data_ptr,
unsigned int data_len, unsigned int data_len,
unsigned char output[CRYPTO_MD_MAX_SIZE]); unsigned char output[CRYPTO_MD_MAX_SIZE]);
#endif /* MEASURED_BOOT || DRTM_SUPPORT */ #endif /* CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY || \
CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
#if (MEASURED_BOOT || DRTM_SUPPORT) && TRUSTED_BOARD_BOOT #if CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC
/* Macro to register a cryptographic library */ /* Macro to register a cryptographic library */
#define REGISTER_CRYPTO_LIB(_name, _init, _verify_signature, _verify_hash, \ #define REGISTER_CRYPTO_LIB(_name, _init, _verify_signature, _verify_hash, \
_calc_hash, _auth_decrypt) \ _calc_hash, _auth_decrypt) \
@ -114,7 +131,7 @@ int crypto_mod_calc_hash(enum crypto_md_algo alg, void *data_ptr,
.calc_hash = _calc_hash, \ .calc_hash = _calc_hash, \
.auth_decrypt = _auth_decrypt \ .auth_decrypt = _auth_decrypt \
} }
#elif TRUSTED_BOARD_BOOT #elif CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_ONLY
#define REGISTER_CRYPTO_LIB(_name, _init, _verify_signature, _verify_hash, \ #define REGISTER_CRYPTO_LIB(_name, _init, _verify_signature, _verify_hash, \
_auth_decrypt) \ _auth_decrypt) \
const crypto_lib_desc_t crypto_lib_desc = { \ const crypto_lib_desc_t crypto_lib_desc = { \
@ -124,14 +141,14 @@ int crypto_mod_calc_hash(enum crypto_md_algo alg, void *data_ptr,
.verify_hash = _verify_hash, \ .verify_hash = _verify_hash, \
.auth_decrypt = _auth_decrypt \ .auth_decrypt = _auth_decrypt \
} }
#elif MEASURED_BOOT || DRTM_SUPPORT #elif CRYPTO_SUPPORT == CRYPTO_HASH_CALC_ONLY
#define REGISTER_CRYPTO_LIB(_name, _init, _calc_hash) \ #define REGISTER_CRYPTO_LIB(_name, _init, _calc_hash) \
const crypto_lib_desc_t crypto_lib_desc = { \ const crypto_lib_desc_t crypto_lib_desc = { \
.name = _name, \ .name = _name, \
.init = _init, \ .init = _init, \
.calc_hash = _calc_hash, \ .calc_hash = _calc_hash, \
} }
#endif /* (MEASURED_BOOT || DRTM_SUPPORT) && TRUSTED_BOARD_BOOT */ #endif /* CRYPTO_SUPPORT == CRYPTO_AUTH_VERIFY_AND_HASH_CALC */
extern const crypto_lib_desc_t crypto_lib_desc; extern const crypto_lib_desc_t crypto_lib_desc;