Merge pull request #13263 from Patater/update-tfm-20200709

psa: Update TF-M for ARM_MUSCA_B1
pull/13283/head
Martin Kojtal 2020-07-10 13:25:28 +02:00 committed by GitHub
commit 4a0aaf1ce7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
15 changed files with 201 additions and 148 deletions

View File

@ -1 +1 @@
1d1faca481c3
52261ca41663

View File

@ -12,8 +12,6 @@
#ifndef PSA_CRYPTO_H
#define PSA_CRYPTO_H
#include "psa/crypto_platform.h"
#include <stddef.h>
#ifdef __DOXYGEN_ONLY__
@ -3759,6 +3757,12 @@ psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
* macros whose definitions are implementation-specific. */
#include "psa/crypto_sizes.h"
/* The file "crypto_client_struct.h" contains definitions for structures
* whose definitions differ in the client view and the PSA server
* implementation in TF-M. */
#include "psa/crypto_client_struct.h"
/* The file "crypto_struct.h" contains definitions for
* implementation-specific structs that are declared above. */
#include "psa/crypto_struct.h"

View File

@ -0,0 +1,49 @@
/*
* Copyright (c) 2020, Arm Limited. All rights reserved.
*
* SPDX-License-Identifier: BSD-3-Clause
*
*/
/**
* \file psa/crypto_client_struct.h
*
* \brief PSA cryptography client key attribute definitions
*
* \note This file may not be included directly. Applications must
* include psa/crypto.h.
*
* This file contains the definitions of some data structures with
* PSA crypto client specific definitions. This is for implementations
* with isolation between the Client applications and the Crypto
* Server module, it is expected that the front-end and the back-end
* would have different versions of the data structure.
*/
#ifndef PSA_CRYPTO_CLIENT_STRUCT_H
#define PSA_CRYPTO_CLIENT_STRUCT_H
#ifdef __cplusplus
extern "C" {
#endif
/* This is the client view of the `key_attributes` structure. Only
* fields which need to be set by the PSA crypto client are present.
* The PSA crypto service will maintain a different version of the
* data structure internally. */
struct psa_client_key_attributes_s
{
uint32_t type;
uint32_t lifetime;
uint32_t id;
uint32_t alg;
uint32_t alg2;
uint32_t usage;
uint16_t bits;
};
#define PSA_CLIENT_KEY_ATTRIBUTES_INIT {0, 0, 0, 0, 0, 0}
#ifdef __cplusplus
}
#endif
#endif /* PSA_CRYPTO_CLIENT_STRUCT_H */

View File

@ -24,6 +24,39 @@
extern "C" {
#endif
/** \addtogroup crypto_types
* @{
*/
/** DSA public key.
*
* The import and export format is the
* representation of the public key `y = g^x mod p` as a big-endian byte
* string. The length of the byte string is the length of the base prime `p`
* in bytes.
*/
#define PSA_KEY_TYPE_DSA_PUBLIC_KEY ((psa_key_type_t)0x60020000)
/** DSA key pair (private and public key).
*
* The import and export format is the
* representation of the private key `x` as a big-endian byte string. The
* length of the byte string is the private key size in bytes (leading zeroes
* are not stripped).
*
* Determinstic DSA key derivation with psa_generate_derived_key follows
* FIPS 186-4 &sect;B.1.2: interpret the byte string as integer
* in big-endian order. Discard it if it is not in the range
* [0, *N* - 2] where *N* is the boundary of the private key domain
* (the prime *p* for Diffie-Hellman, the subprime *q* for DSA,
* or the order of the curve's base point for ECC).
* Add 1 to the resulting integer and use this as the private key *x*.
*
*/
#define PSA_KEY_TYPE_DSA_KEY_PAIR ((psa_key_type_t)0x70020000)
/**@}*/
/** \brief Declare the enrollment algorithm for a key.
*
* An operation on a key may indifferently use the algorithm set with
@ -47,7 +80,19 @@ static inline void psa_set_key_enrollment_algorithm(
psa_key_attributes_t *attributes,
psa_algorithm_t alg2)
{
attributes->core.policy.alg2 = alg2;
attributes->alg2 = alg2;
}
/** Retrieve the enrollment algorithm policy from key attributes.
*
* \param[in] attributes The key attribute structure to query.
*
* \return The enrollment algorithm stored in the attribute structure.
*/
static inline psa_algorithm_t psa_get_key_enrollment_algorithm(
const psa_key_attributes_t *attributes)
{
return attributes->alg2;
}
#ifdef __cplusplus

View File

@ -104,21 +104,6 @@ static inline struct psa_key_derivation_s psa_key_derivation_operation_init( voi
return( v );
}
struct psa_key_policy_s
{
psa_key_usage_t usage;
psa_algorithm_t alg;
psa_algorithm_t alg2;
};
typedef struct psa_key_policy_s psa_key_policy_t;
#define PSA_KEY_POLICY_INIT {0, 0, 0}
static inline struct psa_key_policy_s psa_key_policy_init( void )
{
const struct psa_key_policy_s v = PSA_KEY_POLICY_INIT;
return( v );
}
/* The type used internally for key sizes.
* Public interfaces use size_t, but internally we use a smaller type. */
typedef uint16_t psa_key_bits_t;
@ -132,166 +117,93 @@ typedef uint16_t psa_key_bits_t;
* conditionals. */
#define PSA_MAX_KEY_BITS 0xfff8
/** A mask of flags that can be stored in key attributes.
*
* This type is also used internally to store flags in slots. Internal
* flags are defined in library/psa_crypto_core.h. Internal flags may have
* the same value as external flags if they are properly handled during
* key creation and in psa_get_key_attributes.
*/
typedef uint16_t psa_key_attributes_flag_t;
#define PSA_KEY_ATTRIBUTES_INIT PSA_CLIENT_KEY_ATTRIBUTES_INIT
#define MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER \
( (psa_key_attributes_flag_t) 0x0001 )
/* A mask of key attribute flags used externally only.
* Only meant for internal checks inside the library. */
#define MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ( \
MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER | \
0 )
/* A mask of key attribute flags used both internally and externally.
* Currently there aren't any. */
#define MBEDTLS_PSA_KA_MASK_DUAL_USE ( \
0 )
typedef struct
static inline struct psa_client_key_attributes_s psa_key_attributes_init( void )
{
psa_key_type_t type;
psa_key_lifetime_t lifetime;
psa_key_id_t id;
psa_key_policy_t policy;
psa_key_bits_t bits;
psa_key_attributes_flag_t flags;
} psa_core_key_attributes_t;
#define PSA_CORE_KEY_ATTRIBUTES_INIT {0, 0, PSA_KEY_ID_INIT, PSA_KEY_POLICY_INIT, 0, 0}
struct psa_key_attributes_s
{
psa_core_key_attributes_t core;
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_key_slot_number_t slot_number;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
void *domain_parameters;
size_t domain_parameters_size;
};
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
#define PSA_KEY_ATTRIBUTES_INIT {PSA_CORE_KEY_ATTRIBUTES_INIT, 0, NULL, 0}
#else
#define PSA_KEY_ATTRIBUTES_INIT {PSA_CORE_KEY_ATTRIBUTES_INIT, NULL, 0}
#endif
static inline struct psa_key_attributes_s psa_key_attributes_init( void )
{
const struct psa_key_attributes_s v = PSA_KEY_ATTRIBUTES_INIT;
const struct psa_client_key_attributes_s v = PSA_KEY_ATTRIBUTES_INIT;
return( v );
}
static inline void psa_set_key_id(psa_key_attributes_t *attributes,
psa_key_id_t id)
{
attributes->core.id = id;
if( attributes->core.lifetime == PSA_KEY_LIFETIME_VOLATILE )
attributes->core.lifetime = PSA_KEY_LIFETIME_PERSISTENT;
attributes->id = id;
if( attributes->lifetime == PSA_KEY_LIFETIME_VOLATILE )
attributes->lifetime = PSA_KEY_LIFETIME_PERSISTENT;
}
static inline psa_key_id_t psa_get_key_id(
const psa_key_attributes_t *attributes)
{
return( attributes->core.id );
return( attributes->id );
}
static inline void psa_set_key_lifetime(psa_key_attributes_t *attributes,
psa_key_lifetime_t lifetime)
{
attributes->core.lifetime = lifetime;
attributes->lifetime = lifetime;
if( lifetime == PSA_KEY_LIFETIME_VOLATILE )
{
#ifdef MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER
attributes->core.id.key_id = 0;
attributes->core.id.owner = 0;
#else
attributes->core.id = 0;
#endif
attributes->id = 0;
}
}
static inline psa_key_lifetime_t psa_get_key_lifetime(
const psa_key_attributes_t *attributes)
{
return( attributes->core.lifetime );
return( attributes->lifetime );
}
static inline void psa_set_key_usage_flags(psa_key_attributes_t *attributes,
psa_key_usage_t usage_flags)
{
attributes->core.policy.usage = usage_flags;
attributes->usage = usage_flags;
}
static inline psa_key_usage_t psa_get_key_usage_flags(
const psa_key_attributes_t *attributes)
{
return( attributes->core.policy.usage );
return( attributes->usage );
}
static inline void psa_set_key_algorithm(psa_key_attributes_t *attributes,
psa_algorithm_t alg)
{
attributes->core.policy.alg = alg;
attributes->alg = alg;
}
static inline psa_algorithm_t psa_get_key_algorithm(
const psa_key_attributes_t *attributes)
{
return( attributes->core.policy.alg );
return( attributes->alg );
}
/* This function is declared in crypto_extra.h, which comes after this
* header file, but we need the function here, so repeat the declaration. */
psa_status_t psa_set_key_domain_parameters(psa_key_attributes_t *attributes,
psa_key_type_t type,
const uint8_t *data,
size_t data_length);
static inline void psa_set_key_type(psa_key_attributes_t *attributes,
psa_key_type_t type)
{
if( attributes->domain_parameters == NULL )
{
/* Common case: quick path */
attributes->core.type = type;
}
else
{
/* Call the bigger function to free the old domain paramteres.
* Ignore any errors which may arise due to type requiring
* non-default domain parameters, since this function can't
* report errors. */
(void) psa_set_key_domain_parameters( attributes, type, NULL, 0 );
}
attributes->type = type;
}
static inline psa_key_type_t psa_get_key_type(
const psa_key_attributes_t *attributes)
{
return( attributes->core.type );
return( attributes->type );
}
static inline void psa_set_key_bits(psa_key_attributes_t *attributes,
size_t bits)
{
if( bits > PSA_MAX_KEY_BITS )
attributes->core.bits = PSA_KEY_BITS_TOO_LARGE;
attributes->bits = PSA_KEY_BITS_TOO_LARGE;
else
attributes->core.bits = (psa_key_bits_t) bits;
attributes->bits = bits;
}
static inline size_t psa_get_key_bits(
const psa_key_attributes_t *attributes)
{
return( attributes->core.bits );
return( attributes->bits );
}
#ifdef __cplusplus

View File

@ -49,6 +49,10 @@ typedef int32_t psa_status_t;
* @{
*/
/* Integral type representing a key handle. */
typedef uint16_t psa_key_handle_t;
/** \brief Encoding of a key type.
*/
typedef uint32_t psa_key_type_t;
@ -297,7 +301,7 @@ typedef uint32_t psa_key_usage_t;
*
* Once a key has been created, it is impossible to change its attributes.
*/
typedef struct psa_key_attributes_s psa_key_attributes_t;
typedef struct psa_client_key_attributes_s psa_key_attributes_t;
/**@}*/

View File

@ -1556,16 +1556,16 @@
/** The minimum value for a key identifier chosen by the application.
*/
#define PSA_KEY_ID_USER_MIN ((psa_app_key_id_t)0x00000001)
#define PSA_KEY_ID_USER_MIN ((psa_key_id_t)0x00000001)
/** The maximum value for a key identifier chosen by the application.
*/
#define PSA_KEY_ID_USER_MAX ((psa_app_key_id_t)0x3fffffff)
#define PSA_KEY_ID_USER_MAX ((psa_key_id_t)0x3fffffff)
/** The minimum value for a key identifier chosen by the implementation.
*/
#define PSA_KEY_ID_VENDOR_MIN ((psa_app_key_id_t)0x40000000)
#define PSA_KEY_ID_VENDOR_MIN ((psa_key_id_t)0x40000000)
/** The maximum value for a key identifier chosen by the implementation.
*/
#define PSA_KEY_ID_VENDOR_MAX ((psa_app_key_id_t)0x7fffffff)
#define PSA_KEY_ID_VENDOR_MAX ((psa_key_id_t)0x7fffffff)
/**@}*/

View File

@ -14,17 +14,17 @@
extern "C" {
#endif
/******** TFM_SP_STORAGE ********/
#define TFM_SST_SET_SID (0x00000060U)
#define TFM_SST_SET_VERSION (1U)
#define TFM_SST_GET_SID (0x00000061U)
#define TFM_SST_GET_VERSION (1U)
#define TFM_SST_GET_INFO_SID (0x00000062U)
#define TFM_SST_GET_INFO_VERSION (1U)
#define TFM_SST_REMOVE_SID (0x00000063U)
#define TFM_SST_REMOVE_VERSION (1U)
#define TFM_SST_GET_SUPPORT_SID (0x00000064U)
#define TFM_SST_GET_SUPPORT_VERSION (1U)
/******** TFM_SP_PS ********/
#define TFM_PS_SET_SID (0x00000060U)
#define TFM_PS_SET_VERSION (1U)
#define TFM_PS_GET_SID (0x00000061U)
#define TFM_PS_GET_VERSION (1U)
#define TFM_PS_GET_INFO_SID (0x00000062U)
#define TFM_PS_GET_INFO_VERSION (1U)
#define TFM_PS_REMOVE_SID (0x00000063U)
#define TFM_PS_REMOVE_VERSION (1U)
#define TFM_PS_GET_SUPPORT_SID (0x00000064U)
#define TFM_PS_GET_SUPPORT_VERSION (1U)
/******** TFM_SP_ITS ********/
#define TFM_ITS_SET_SID (0x00000070U)
@ -126,9 +126,9 @@ extern "C" {
#define SPM_CORE_IRQ_TEST_1_EXECUTE_TEST_SCENARIO_SID (0x0000F0A1U)
#define SPM_CORE_IRQ_TEST_1_EXECUTE_TEST_SCENARIO_VERSION (1U)
/******** TFM_SP_SST_TEST ********/
#define TFM_SST_TEST_PREPARE_SID (0x0000F0C0U)
#define TFM_SST_TEST_PREPARE_VERSION (1U)
/******** TFM_SP_PS_TEST ********/
#define TFM_PS_TEST_PREPARE_SID (0x0000F0C0U)
#define TFM_PS_TEST_PREPARE_VERSION (1U)
/******** TFM_SP_SECURE_CLIENT_2 ********/
#define TFM_SECURE_CLIENT_2_SID (0x0000F0E0U)

View File

@ -40,6 +40,7 @@ struct tfm_crypto_pack_iovec {
uint16_t step; /*!< Key derivation step */
psa_key_handle_t key_handle; /*!< Key handle */
psa_algorithm_t alg; /*!< Algorithm */
psa_algorithm_t alg2; /*!< Enrollment Algorithm */
uint32_t op_handle; /*!< Frontend context handle associated to a
* multipart operation
*/

View File

@ -16,14 +16,14 @@
extern "C" {
#endif
#ifdef TFM_PARTITION_SECURE_STORAGE
/******** TFM_SP_STORAGE ********/
psa_status_t tfm_tfm_sst_set_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_sst_get_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_sst_get_info_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_sst_remove_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_sst_get_support_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
#endif /* TFM_PARTITION_SECURE_STORAGE */
#ifdef TFM_PARTITION_PROTECTED_STORAGE
/******** TFM_SP_PS ********/
psa_status_t tfm_tfm_ps_set_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_ps_get_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_ps_get_info_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_ps_remove_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
psa_status_t tfm_tfm_ps_get_support_req_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
#endif /* TFM_PARTITION_PROTECTED_STORAGE */
#ifdef TFM_PARTITION_INTERNAL_TRUSTED_STORAGE
/******** TFM_SP_ITS ********/
@ -159,10 +159,10 @@ psa_status_t tfm_spm_irq_test_1_prepare_test_scenario_veneer(psa_invec *in_vec,
psa_status_t tfm_spm_irq_test_1_execute_test_scenario_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
#endif /* TFM_ENABLE_IRQ_TEST */
#ifdef TFM_PARTITION_TEST_SST
/******** TFM_SP_SST_TEST ********/
psa_status_t tfm_tfm_sst_test_prepare_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
#endif /* TFM_PARTITION_TEST_SST */
#ifdef TFM_PARTITION_TEST_PS
/******** TFM_SP_PS_TEST ********/
psa_status_t tfm_tfm_ps_test_prepare_veneer(psa_invec *in_vec, size_t in_len, psa_outvec *out_vec, size_t out_len);
#endif /* TFM_PARTITION_TEST_PS */
#ifdef TFM_PARTITION_TEST_SECURE_SERVICES
/******** TFM_SP_SECURE_CLIENT_2 ********/

View File

@ -26,7 +26,7 @@ psa_status_t psa_ps_set(psa_storage_uid_t uid,
{ .base = &create_flags, .len = sizeof(create_flags) }
};
handle = psa_connect(TFM_SST_SET_SID, TFM_SST_SET_VERSION);
handle = psa_connect(TFM_PS_SET_SID, TFM_PS_SET_VERSION);
if (!PSA_HANDLE_IS_VALID(handle)) {
return PSA_ERROR_GENERIC_ERROR;
}
@ -69,7 +69,7 @@ psa_status_t psa_ps_get(psa_storage_uid_t uid,
return PSA_ERROR_INVALID_ARGUMENT;
}
handle = psa_connect(TFM_SST_GET_SID, TFM_SST_GET_VERSION);
handle = psa_connect(TFM_PS_GET_SID, TFM_PS_GET_VERSION);
if (!PSA_HANDLE_IS_VALID(handle)) {
return PSA_ERROR_GENERIC_ERROR;
}
@ -98,7 +98,7 @@ psa_status_t psa_ps_get_info(psa_storage_uid_t uid,
{ .base = p_info, .len = sizeof(*p_info) }
};
handle = psa_connect(TFM_SST_GET_INFO_SID, TFM_SST_GET_INFO_VERSION);
handle = psa_connect(TFM_PS_GET_INFO_SID, TFM_PS_GET_INFO_VERSION);
if (!PSA_HANDLE_IS_VALID(handle)) {
return PSA_ERROR_GENERIC_ERROR;
}
@ -121,7 +121,7 @@ psa_status_t psa_ps_remove(psa_storage_uid_t uid)
};
handle = psa_connect(TFM_SST_REMOVE_SID, TFM_SST_REMOVE_VERSION);
handle = psa_connect(TFM_PS_REMOVE_SID, TFM_PS_REMOVE_VERSION);
if (!PSA_HANDLE_IS_VALID(handle)) {
return PSA_ERROR_GENERIC_ERROR;
}
@ -170,7 +170,7 @@ uint32_t psa_ps_get_support(void)
/* The PSA API does not return an error, so any error from TF-M is
* ignored.
*/
handle = psa_connect(TFM_SST_GET_SUPPORT_SID, TFM_SST_GET_SUPPORT_VERSION);
handle = psa_connect(TFM_PS_GET_SUPPORT_SID, TFM_PS_GET_SUPPORT_VERSION);
if (!PSA_HANDLE_IS_VALID(handle)) {
return support_flags;
}

View File

@ -24,6 +24,7 @@ from imgtool_lib import image
from imgtool_lib import version
import sys
import macro_parser
import fileinput
sign_bin_size_re = re.compile(r"^\s*RE_SIGN_BIN_SIZE\s*=\s*(.*)")
image_load_address_re = re.compile(r"^\s*RE_IMAGE_LOAD_ADDRESS\s*=\s*(.*)")
@ -126,10 +127,30 @@ def do_sign(args):
img.save(args.outfile)
def do_flash(args):
image_value_re = re.compile(r"^\s*"+args.macro+"\s*=\s*(.*)")
value = macro_parser.evaluate_macro(args.layout, image_value_re, 0, 1,
True)
if args.setting == 1:
begin_line="set "+args.begin
else:
begin_line=args.begin
for line in fileinput.input(args.infile, inplace=True):
if line.startswith(begin_line):
if args.division:
value = int(value/int(args.division))
if args.phexa == 0:
line = begin_line+"="+str(value)+"\n"
else:
line = begin_line+"="+hex(value)+"\n"
sys.stdout.write(line)
subcmds = {
'keygen': do_keygen,
'getpub': do_getpub,
'sign': do_sign, }
'sign': do_sign,
'flash': do_flash, }
def get_dependencies(text):
@ -205,6 +226,23 @@ def args():
sign.add_argument("infile")
sign.add_argument("outfile")
flash = subs.add_parser('flash', help='modify flash script')
flash.add_argument("infile")
flash.add_argument('-l', '--layout', required=True,
help='Location of the file that contains preprocessed macros')
flash.add_argument('-m', '--macro', required =True,
help='macro symbol string to grep in preprocessed file')
flash.add_argument('-b', '--begin', required=True,
help='begin of line to replace ')
flash.add_argument('-s', '--setting',type=intparse,required=False,default=0,
help='search for window batch set variable')
flash.add_argument('-d', '--division',
required=False,type=intparse,default=0,
help='search for window batch set variable')
flash.add_argument('-p', '--phexa',
required=False,type=intparse,default=1,
help='print value in hexa')
args = parser.parse_args()
if args.subcmd is None:
print('Must specify a subcommand', file=sys.stderr)