Crypto: Remove TF-M Crypto service key handle array
TF-M Crypto service allocates a key handle array to map keys and
owners. However, this array is redundant since TF-M Crypto eventually
relies on Mbed TLS key handle management.
Remove TF-M Crypto service key handle array to simplify TF-M Crypto key
handling routine and optimize memory footprint.
Remove CRYPTO_KEY_ID_ENCODES_OWNER.
Enforce MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER to be enabled.
Update the test commit ID accordingly.
Change-Id: Ic1ecff587ec33a95fbeabcd8dd9fd6430455117b
Signed-off-by: David Hu <david.hu@arm.com>
Co-authored-by: Summer Qin <summer.qin@arm.com>
diff --git a/secure_fw/partitions/crypto/crypto_key.c b/secure_fw/partitions/crypto/crypto_key.c
index 0d95ac6..892ce11 100644
--- a/secure_fw/partitions/crypto/crypto_key.c
+++ b/secure_fw/partitions/crypto/crypto_key.c
@@ -14,129 +14,10 @@
#include "tfm_crypto_defs.h"
#include "tfm_crypto_private.h"
-#ifndef TFM_CRYPTO_KEY_MODULE_DISABLED
-#ifdef CRYPTO_KEY_ID_ENCODES_OWNER
-#ifndef TFM_CRYPTO_MAX_KEY_HANDLES
-#define TFM_CRYPTO_MAX_KEY_HANDLES (32)
+#ifndef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
+#error "MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER must be selected in Mbed TLS config file"
#endif
-struct tfm_crypto_handle_owner_s {
- int32_t owner; /*!< Owner of the allocated handle */
- psa_key_id_t key; /*!< Allocated key */
- uint8_t in_use; /*!< Flag to indicate if this in use */
-};
-
-static struct tfm_crypto_handle_owner_s
- handle_owner[TFM_CRYPTO_MAX_KEY_HANDLES] = {0};
-
-static void set_handle_owner(uint8_t idx, int32_t client_id,
- psa_key_id_t key_handle)
-{
- /* Skip checking idx */
-
- handle_owner[idx].owner = client_id;
- handle_owner[idx].key = key_handle;
- handle_owner[idx].in_use = TFM_CRYPTO_IN_USE;
-}
-
-static void clean_handle_owner(uint8_t idx)
-{
- /* Skip checking idx */
-
- handle_owner[idx].owner = TFM_INVALID_CLIENT_ID;
- handle_owner[idx].key = (psa_key_id_t)0;
- handle_owner[idx].in_use = TFM_CRYPTO_NOT_IN_USE;
-}
-
-static psa_status_t find_empty_handle_owner_slot(uint8_t *idx)
-{
- uint8_t i;
-
- for (i = 0; i < TFM_CRYPTO_MAX_KEY_HANDLES; i++) {
- if (handle_owner[i].in_use == TFM_CRYPTO_NOT_IN_USE) {
- *idx = i;
- return PSA_SUCCESS;
- }
- }
-
- return PSA_ERROR_INSUFFICIENT_MEMORY;
-}
-
-/*
- * Check that the requested handle belongs to the requesting partition
- *
- * Argument idx is optional. It points to the buffer to hold the internal
- * index corresponding to the input handle. Valid only on PSA_SUCCESS.
- * It is filled only if the input pointer is not NULL.
- *
- * Return values as described in \ref psa_status_t
- */
-static psa_status_t check_handle_owner(psa_key_id_t key, uint8_t *idx)
-{
- int32_t client_id = 0;
- uint8_t i = 0;
- psa_status_t status;
-
- status = tfm_crypto_get_caller_id(&client_id);
- if (status != PSA_SUCCESS) {
- return status;
- }
-
- for (i = 0; i < TFM_CRYPTO_MAX_KEY_HANDLES; i++) {
- if (handle_owner[i].in_use && handle_owner[i].key == key) {
- if (handle_owner[i].owner == client_id) {
- if (idx) {
- *idx = i;
- }
- return PSA_SUCCESS;
- } else {
- return PSA_ERROR_NOT_PERMITTED;
- }
- }
- }
-
- return PSA_ERROR_INVALID_HANDLE;
-}
-
-static void encoded_key_id_make(psa_key_id_t key, uint8_t slot_idx,
- mbedtls_svc_key_id_t *encoded_key)
-{
- /* Skip checking encoded_key */
- *encoded_key = mbedtls_svc_key_id_make(handle_owner[slot_idx].owner, key);
-}
-#else /* CRYPTO_KEY_ID_ENCODES_OWNER */
-#define set_handle_owner(idx, client_id, key_handle) do {} while (0)
-#define clean_handle_owner(idx) do {} while (0)
-
-static inline psa_status_t find_empty_handle_owner_slot(uint8_t *idx)
-{
- *idx = 0;
-
- return PSA_SUCCESS;
-}
-
-static inline psa_status_t check_handle_owner(psa_key_id_t key, uint8_t *idx)
-{
- (void)key;
-
- if (idx) {
- *idx = 0;
- }
-
- return PSA_SUCCESS;
-}
-
-static inline void encoded_key_id_make(psa_key_id_t key, uint8_t slot_idx,
- mbedtls_svc_key_id_t *encoded_key)
-{
- (void)slot_idx;
-
- /* Skip checking encoded_key */
- *encoded_key = mbedtls_svc_key_id_make(TFM_INVALID_CLIENT_ID, key);
-}
-#endif /* CRYPTO_KEY_ID_ENCODES_OWNER */
-#endif /* !TFM_CRYPTO_KEY_MODULE_DISABLED */
-
/*!
* \defgroup public Public functions
*
@@ -166,12 +47,8 @@
core->MBEDTLS_PRIVATE(bits) = client_key_attr->bits;
/* Use the client key id as the key_id and its partition id as the owner */
-#ifdef CRYPTO_KEY_ID_ENCODES_OWNER
core->MBEDTLS_PRIVATE(id).MBEDTLS_PRIVATE(key_id) = client_key_attr->id;
core->MBEDTLS_PRIVATE(id).MBEDTLS_PRIVATE(owner) = client_id;
-#else
- core->MBEDTLS_PRIVATE(id) = client_key_attr->id;
-#endif
return PSA_SUCCESS;
}
@@ -196,24 +73,11 @@
client_key_attr->bits = core.MBEDTLS_PRIVATE(bits);
/* Return the key_id as the client key id, do not return the owner */
-#ifdef CRYPTO_KEY_ID_ENCODES_OWNER
client_key_attr->id = core.MBEDTLS_PRIVATE(id).MBEDTLS_PRIVATE(key_id);
-#else
- client_key_attr->id = core.MBEDTLS_PRIVATE(id);
-#endif
return PSA_SUCCESS;
}
-psa_status_t tfm_crypto_check_handle_owner(psa_key_id_t key)
-{
-#ifdef TFM_CRYPTO_KEY_MODULE_DISABLED
- return PSA_ERROR_NOT_SUPPORTED;
-#else
- return check_handle_owner(key, NULL);
-#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
-}
-
psa_status_t tfm_crypto_encode_id_and_owner(psa_key_id_t key_id,
mbedtls_svc_key_id_t *enc_key_ptr)
{
@@ -235,35 +99,6 @@
return PSA_SUCCESS;
}
-psa_status_t tfm_crypto_check_key_storage(uint32_t *index)
-{
-#ifdef TFM_CRYPTO_KEY_MODULE_DISABLED
- return PSA_ERROR_NOT_SUPPORTED;
-#else
- return find_empty_handle_owner_slot((uint8_t *)index);
-#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
-}
-
-psa_status_t tfm_crypto_set_key_storage(uint32_t index,
- psa_key_id_t key_handle)
-{
-#ifdef TFM_CRYPTO_KEY_MODULE_DISABLED
- return PSA_ERROR_NOT_SUPPORTED;
-#else
- psa_status_t status;
- int32_t partition_id;
-
- status = tfm_crypto_get_caller_id(&partition_id);
- if (status != PSA_SUCCESS) {
- return status;
- }
-
- set_handle_owner(index, partition_id, key_handle);
-
- return PSA_SUCCESS;
-#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
-}
-
psa_status_t tfm_crypto_set_key_domain_parameters(psa_invec in_vec[],
size_t in_len,
psa_outvec out_vec[],
@@ -313,15 +148,9 @@
psa_status_t status;
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
- uint8_t i = 0;
mbedtls_svc_key_id_t encoded_key;
int32_t partition_id = 0;
- status = find_empty_handle_owner_slot(&i);
- if (status != PSA_SUCCESS) {
- return status;
- }
-
status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
@@ -335,17 +164,13 @@
}
status = psa_import_key(&key_attributes, data, data_length, &encoded_key);
- /* Update the imported key id */
-#ifdef CRYPTO_KEY_ID_ENCODES_OWNER
- *psa_key = encoded_key.MBEDTLS_PRIVATE(key_id);
-#else
- *psa_key = (psa_key_id_t)encoded_key;
-#endif
-
- if (status == PSA_SUCCESS) {
- set_handle_owner(i, partition_id, *psa_key);
+ if (status != PSA_SUCCESS) {
+ return status;
}
+ /* Update the imported key id */
+ *psa_key = encoded_key.MBEDTLS_PRIVATE(key_id);
+
return status;
#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
}
@@ -371,13 +196,7 @@
psa_key_id_t *key = out_vec[0].base;
psa_status_t status;
mbedtls_svc_key_id_t encoded_key;
- int32_t partition_id;
- uint8_t i;
-
- status = find_empty_handle_owner_slot(&i);
- if (status != PSA_SUCCESS) {
- return status;
- }
+ int32_t partition_id = 0;
status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
@@ -388,16 +207,12 @@
encoded_key = mbedtls_svc_key_id_make(partition_id, client_key_id);
status = psa_open_key(encoded_key, &encoded_key);
-#ifdef CRYPTO_KEY_ID_ENCODES_OWNER
- *key = encoded_key.MBEDTLS_PRIVATE(key_id);
-#else
- *key = (psa_key_id_t)encoded_key;
-#endif
-
- if (status == PSA_SUCCESS) {
- set_handle_owner(i, partition_id, *key);
+ if (status != PSA_SUCCESS) {
+ return status;
}
+ *key = encoded_key.MBEDTLS_PRIVATE(key_id);
+
return status;
#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
}
@@ -420,23 +235,18 @@
const struct tfm_crypto_pack_iovec *iov = in_vec[0].base;
psa_key_id_t key = iov->key_id;
- uint8_t index;
mbedtls_svc_key_id_t encoded_key;
+ int32_t partition_id = 0;
psa_status_t status;
- status = check_handle_owner(key, &index);
+ status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
}
- encoded_key_id_make(key, index, &encoded_key);
+ encoded_key = mbedtls_svc_key_id_make(partition_id, key);
- status = psa_close_key(encoded_key);
- if (status == PSA_SUCCESS) {
- clean_handle_owner(index);
- }
-
- return status;
+ return psa_close_key(encoded_key);
#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
}
@@ -457,23 +267,18 @@
}
const struct tfm_crypto_pack_iovec *iov = in_vec[0].base;
psa_key_id_t key = iov->key_id;
- uint8_t index;
mbedtls_svc_key_id_t encoded_key;
+ int32_t partition_id = 0;
psa_status_t status;
- status = check_handle_owner(key, &index);
+ status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
}
- encoded_key_id_make(key, index, &encoded_key);
+ encoded_key = mbedtls_svc_key_id_make(partition_id, key);
- status = psa_destroy_key(encoded_key);
- if (status == PSA_SUCCESS) {
- clean_handle_owner(index);
- }
-
- return status;
+ return psa_destroy_key(encoded_key);
#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
}
@@ -499,14 +304,14 @@
psa_status_t status;
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
mbedtls_svc_key_id_t encoded_key;
- uint8_t index;
+ int32_t partition_id = 0;
- status = check_handle_owner(key, &index);
+ status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
}
- encoded_key_id_make(key, index, &encoded_key);
+ encoded_key = mbedtls_svc_key_id_make(partition_id, key);
status = psa_get_key_attributes(encoded_key, &key_attributes);
if (status == PSA_SUCCESS) {
@@ -578,15 +383,15 @@
uint8_t *data = out_vec[0].base;
size_t data_size = out_vec[0].len;
mbedtls_svc_key_id_t encoded_key;
+ int32_t partition_id = 0;
psa_status_t status;
- uint8_t index;
- status = check_handle_owner(key, &index);
+ status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
}
- encoded_key_id_make(key, index, &encoded_key);
+ encoded_key = mbedtls_svc_key_id_make(partition_id, key);
return psa_export_key(encoded_key, data, data_size,
&(out_vec[0].len));
@@ -612,15 +417,15 @@
uint8_t *data = out_vec[0].base;
size_t data_size = out_vec[0].len;
mbedtls_svc_key_id_t encoded_key;
+ int32_t partition_id = 0;
psa_status_t status;
- uint8_t index;
- status = check_handle_owner(key, &index);
+ status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
}
- encoded_key_id_make(key, index, &encoded_key);
+ encoded_key = mbedtls_svc_key_id_make(partition_id, key);
return psa_export_public_key(encoded_key, data, data_size,
&(out_vec[0].len));
@@ -645,22 +450,17 @@
const struct tfm_crypto_pack_iovec *iov = in_vec[0].base;
psa_key_id_t key = iov->key_id;
mbedtls_svc_key_id_t encoded_key;
+ int32_t partition_id = 0;
psa_status_t status;
- uint8_t index;
- status = check_handle_owner(key, &index);
+ status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
}
- encoded_key_id_make(key, index, &encoded_key);
+ encoded_key = mbedtls_svc_key_id_make(partition_id, key);
- status = psa_purge_key(encoded_key);
- if (status == PSA_SUCCESS) {
- clean_handle_owner(index);
- }
-
- return status;
+ return psa_purge_key(encoded_key);
#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
}
@@ -687,16 +487,10 @@
const struct psa_client_key_attributes_s *client_key_attr = in_vec[1].base;
psa_status_t status;
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
- uint8_t source_idx = 0, target_idx = 0;
int32_t partition_id = 0;
mbedtls_svc_key_id_t target_key;
mbedtls_svc_key_id_t encoded_key;
- status = find_empty_handle_owner_slot(&target_idx);
- if (status != PSA_SUCCESS) {
- return status;
- }
-
status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
@@ -709,22 +503,14 @@
return status;
}
- status = check_handle_owner(source_key_id, &source_idx);
+ encoded_key = mbedtls_svc_key_id_make(partition_id, source_key_id);
+
+ status = psa_copy_key(encoded_key, &key_attributes, &target_key);
if (status != PSA_SUCCESS) {
return status;
}
- encoded_key_id_make(source_key_id, source_idx, &encoded_key);
-
- status = psa_copy_key(encoded_key, &key_attributes, &target_key);
-#ifdef CRYPTO_KEY_ID_ENCODES_OWNER
*target_key_id = target_key.MBEDTLS_PRIVATE(key_id);
-#else
- *target_key_id = (psa_key_id_t)target_key;
-#endif
- if (status == PSA_SUCCESS) {
- set_handle_owner(target_idx, partition_id, *target_key_id);
- }
return status;
#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
@@ -750,15 +536,9 @@
const struct psa_client_key_attributes_s *client_key_attr = in_vec[1].base;
psa_status_t status;
psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT;
- uint8_t i = 0;
int32_t partition_id = 0;
mbedtls_svc_key_id_t encoded_key;
- status = find_empty_handle_owner_slot(&i);
- if (status != PSA_SUCCESS) {
- return status;
- }
-
status = tfm_crypto_get_caller_id(&partition_id);
if (status != PSA_SUCCESS) {
return status;
@@ -772,16 +552,12 @@
}
status = psa_generate_key(&key_attributes, &encoded_key);
-#ifdef CRYPTO_KEY_ID_ENCODES_OWNER
- *key_handle = encoded_key.MBEDTLS_PRIVATE(key_id);
-#else
- *key_handle = (psa_key_id_t)encoded_key;
-#endif
-
- if (status == PSA_SUCCESS) {
- set_handle_owner(i, partition_id, *key_handle);
+ if (status != PSA_SUCCESS) {
+ return status;
}
+ *key_handle = encoded_key.MBEDTLS_PRIVATE(key_id);
+
return status;
#endif /* TFM_CRYPTO_KEY_MODULE_DISABLED */
}