Allow alternative backends for crypto provider
The crypto service provider is refactored to make it easy to add
alternative backends. There is still only a single backend that
uses the mbedcrypto library from MbedTLS. However, all dependencies
from the crypto provider on mbedcrypto have been removed, allowing
the crypto provider to be used with alternative implementations
of the PSA Crypto API.
Signed-off-by: Julian Hall <julian.hall@arm.com>
Change-Id: Ic5d1d9d47d149b634d147712749fdee48f260d85
diff --git a/components/service/crypto/provider/mbedcrypto/component.cmake b/components/service/crypto/backend/mbedcrypto/component.cmake
similarity index 77%
rename from components/service/crypto/provider/mbedcrypto/component.cmake
rename to components/service/crypto/backend/mbedcrypto/component.cmake
index 6413cb9..4b531b7 100644
--- a/components/service/crypto/provider/mbedcrypto/component.cmake
+++ b/components/service/crypto/backend/mbedcrypto/component.cmake
@@ -1,5 +1,5 @@
#-------------------------------------------------------------------------------
-# Copyright (c) 2020-2021, Arm Limited and Contributors. All rights reserved.
+# Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
#
# SPDX-License-Identifier: BSD-3-Clause
#
@@ -9,13 +9,7 @@
endif()
target_sources(${TGT} PRIVATE
- "${CMAKE_CURRENT_LIST_DIR}/crypto_provider.c"
- "${CMAKE_CURRENT_LIST_DIR}/crypto_context_pool.c"
- )
-
-target_include_directories(${TGT}
- PRIVATE
- "${CMAKE_CURRENT_LIST_DIR}"
+ "${CMAKE_CURRENT_LIST_DIR}/mbedcrypto_backend.c"
)
# Force use of the mbed crypto configuration required by the crypto service
diff --git a/components/service/crypto/provider/mbedcrypto/config_mbedtls_user.h b/components/service/crypto/backend/mbedcrypto/config_mbedtls_user.h
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/config_mbedtls_user.h
rename to components/service/crypto/backend/mbedcrypto/config_mbedtls_user.h
diff --git a/components/service/crypto/backend/mbedcrypto/mbedcrypto_backend.c b/components/service/crypto/backend/mbedcrypto/mbedcrypto_backend.c
new file mode 100644
index 0000000..d9596bb
--- /dev/null
+++ b/components/service/crypto/backend/mbedcrypto/mbedcrypto_backend.c
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <service/crypto/backend/mbedcrypto/trng_adapter/trng_adapter.h>
+#include <service/secure_storage/frontend/psa/its/its_frontend.h>
+#include <psa/crypto.h>
+
+
+psa_status_t mbedcrypto_backend_init(struct storage_backend *storage_backend,
+ int trng_instance_num)
+{
+ psa_status_t status;
+
+ status = trng_adapter_init(trng_instance_num);
+
+ if (status == PSA_SUCCESS)
+ status = psa_its_frontend_init(storage_backend);
+
+ if (status == PSA_SUCCESS)
+ status = psa_crypto_init();
+
+ return status;
+}
+
+void mbedcrypto_backend_deinit(void)
+{
+ trng_adapter_deinit();
+}
diff --git a/components/service/crypto/backend/mbedcrypto/mbedcrypto_backend.h b/components/service/crypto/backend/mbedcrypto/mbedcrypto_backend.h
new file mode 100644
index 0000000..28bd2e9
--- /dev/null
+++ b/components/service/crypto/backend/mbedcrypto/mbedcrypto_backend.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef MBEDCRYPTO_BACKEND_H
+#define MBEDCRYPTO_BACKEND_H
+
+#include <stdbool.h>
+#include <psa/error.h>
+#include <service/secure_storage/backend/storage_backend.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/**
+ * \brief Initialize the mbedcrypto based backend
+ *
+ * Initializes a crypto backend that uses the mbedcrypto library built by
+ * MbedTLS to realize the PSA crypto API used by the crypto service proviser.
+ *
+ * \param[in] storage_backend The storage backend to use for persistent keys
+ * \param[in] trng_instance_num The TRNG hardware instance number to use
+ *
+ * \return PSA_SUCCESS if backend initialized successfully
+ */
+psa_status_t mbedcrypto_backend_init(struct storage_backend *storage_backend,
+ int trng_instance_num);
+
+/**
+ * \brief Clean-up to free any resource used by the backend
+ */
+void mbedcrypto_backend_deinit(void);
+
+#ifdef __cplusplus
+} /* extern "C" */
+#endif
+
+#endif /* MBEDCRYPTO_BACKEND_H */
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/linux/component.cmake b/components/service/crypto/backend/mbedcrypto/trng_adapter/linux/component.cmake
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/linux/component.cmake
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/linux/component.cmake
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/linux/linux_trng_adapter.c b/components/service/crypto/backend/mbedcrypto/trng_adapter/linux/linux_trng_adapter.c
similarity index 91%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/linux/linux_trng_adapter.c
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/linux/linux_trng_adapter.c
index 15a875a..25aab06 100644
--- a/components/service/crypto/provider/mbedcrypto/trng_adapter/linux/linux_trng_adapter.c
+++ b/components/service/crypto/backend/mbedcrypto/trng_adapter/linux/linux_trng_adapter.c
@@ -5,7 +5,7 @@
*/
#include <mbedtls/entropy.h>
#include <mbedtls/entropy_poll.h>
-#include <service/crypto/provider/mbedcrypto/trng_adapter/trng_adapter.h>
+#include <service/crypto/backend/mbedcrypto/trng_adapter/trng_adapter.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <errno.h>
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/platform/component.cmake b/components/service/crypto/backend/mbedcrypto/trng_adapter/platform/component.cmake
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/platform/component.cmake
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/platform/component.cmake
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/platform/platform_trng_adapter.c b/components/service/crypto/backend/mbedcrypto/trng_adapter/platform/platform_trng_adapter.c
similarity index 94%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/platform/platform_trng_adapter.c
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/platform/platform_trng_adapter.c
index 9342bcf..f05fe63 100644
--- a/components/service/crypto/provider/mbedcrypto/trng_adapter/platform/platform_trng_adapter.c
+++ b/components/service/crypto/backend/mbedcrypto/trng_adapter/platform/platform_trng_adapter.c
@@ -5,7 +5,7 @@
*/
#include <mbedtls/entropy.h>
#include <platform/interface/trng.h>
-#include <service/crypto/provider/mbedcrypto/trng_adapter/trng_adapter.h>
+#include <service/crypto/backend/mbedcrypto/trng_adapter/trng_adapter.h>
#include <config/interface/config_store.h>
#include <psa/error.h>
#include <stddef.h>
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/test/component.cmake b/components/service/crypto/backend/mbedcrypto/trng_adapter/test/component.cmake
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/test/component.cmake
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/test/component.cmake
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/test/trng_env_tests.c b/components/service/crypto/backend/mbedcrypto/trng_adapter/test/trng_env_tests.c
similarity index 96%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/test/trng_env_tests.c
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/test/trng_env_tests.c
index d297821..2b002d8 100644
--- a/components/service/crypto/provider/mbedcrypto/trng_adapter/test/trng_env_tests.c
+++ b/components/service/crypto/backend/mbedcrypto/trng_adapter/test/trng_env_tests.c
@@ -4,7 +4,7 @@
* SPDX-License-Identifier: BSD-3-Clause
*/
#include <service/test_runner/provider/backend/simple_c/simple_c_test_runner.h>
-#include <service/crypto/provider/mbedcrypto/trng_adapter/trng_adapter.h>
+#include <service/crypto/backend/mbedcrypto/trng_adapter/trng_adapter.h>
#include <string.h>
#include <stddef.h>
@@ -80,4 +80,4 @@
};
simple_c_test_runner_register_group(&trng_env_test_group);
-}
\ No newline at end of file
+}
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/test/trng_env_tests.h b/components/service/crypto/backend/mbedcrypto/trng_adapter/test/trng_env_tests.h
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/test/trng_env_tests.h
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/test/trng_env_tests.h
diff --git a/components/service/crypto/provider/mbedcrypto/trng_adapter/trng_adapter.h b/components/service/crypto/backend/mbedcrypto/trng_adapter/trng_adapter.h
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/trng_adapter/trng_adapter.h
rename to components/service/crypto/backend/mbedcrypto/trng_adapter/trng_adapter.h
diff --git a/components/service/crypto/client/test/standalone/standalone_crypto_client.cpp b/components/service/crypto/client/test/standalone/standalone_crypto_client.cpp
index 56d20c5..a049c43 100644
--- a/components/service/crypto/client/test/standalone/standalone_crypto_client.cpp
+++ b/components/service/crypto/client/test/standalone/standalone_crypto_client.cpp
@@ -9,6 +9,7 @@
#include <protocols/service/psa/packed-c/status.h>
#include <service/crypto/provider/serializer/protobuf/pb_crypto_provider_serializer.h>
#include <service/crypto/provider/serializer/packed-c/packedc_crypto_provider_serializer.h>
+#include <service/crypto/backend/mbedcrypto/mbedcrypto_backend.h>
#include <service/secure_storage/backend/secure_flash_store/secure_flash_store.h>
standalone_crypto_client::standalone_crypto_client() :
@@ -55,20 +56,22 @@
TS_RPC_CALL_ACCEPTED, PSA_ERROR_STORAGE_FAILURE);
}
- struct storage_backend *client_storage_backend = secure_storage_client_init(&m_storage_client,
- storage_caller);
+ struct rpc_interface *crypto_ep = NULL;
+ struct storage_backend *client_storage_backend =
+ secure_storage_client_init(&m_storage_client, storage_caller);
- struct rpc_interface *crypto_ep = mbed_crypto_provider_init(&m_crypto_provider,
- client_storage_backend, 0);
+ if (mbedcrypto_backend_init(client_storage_backend, 0) == PSA_SUCCESS) {
- struct rpc_caller *crypto_caller = direct_caller_init_default(&m_crypto_caller, crypto_ep);
+ crypto_ep = crypto_provider_init(&m_crypto_provider);
- mbed_crypto_provider_register_serializer(&m_crypto_provider,
+ crypto_provider_register_serializer(&m_crypto_provider,
TS_RPC_ENCODING_PROTOBUF, pb_crypto_provider_serializer_instance());
- mbed_crypto_provider_register_serializer(&m_crypto_provider,
+ crypto_provider_register_serializer(&m_crypto_provider,
TS_RPC_ENCODING_PACKED_C, packedc_crypto_provider_serializer_instance());
+ }
+ struct rpc_caller *crypto_caller = direct_caller_init_default(&m_crypto_caller, crypto_ep);
rpc_caller_set_encoding_scheme(crypto_caller, TS_RPC_ENCODING_PROTOBUF);
crypto_client::set_caller(crypto_caller);
@@ -83,7 +86,7 @@
if (should_do) {
- mbed_crypto_provider_deinit(&m_crypto_provider);
+ crypto_provider_deinit(&m_crypto_provider);
secure_storage_provider_deinit(&m_storage_provider);
secure_storage_client_deinit(&m_storage_client);
diff --git a/components/service/crypto/client/test/standalone/standalone_crypto_client.h b/components/service/crypto/client/test/standalone/standalone_crypto_client.h
index 1093a10..0b68101 100644
--- a/components/service/crypto/client/test/standalone/standalone_crypto_client.h
+++ b/components/service/crypto/client/test/standalone/standalone_crypto_client.h
@@ -10,7 +10,7 @@
#include <service/crypto/client/test/test_crypto_client.h>
#include <rpc/direct/direct_caller.h>
#include <rpc/dummy/dummy_caller.h>
-#include <service/crypto/provider/mbedcrypto/crypto_provider.h>
+#include <service/crypto/provider/crypto_provider.h>
#include <service/secure_storage/frontend/secure_storage_provider/secure_storage_provider.h>
#include <service/secure_storage/backend/secure_storage_client/secure_storage_client.h>
@@ -43,7 +43,7 @@
private:
bool is_fault_supported(enum fault_code code) const;
- struct mbed_crypto_provider m_crypto_provider;
+ struct crypto_provider m_crypto_provider;
struct secure_storage_provider m_storage_provider;
struct secure_storage_client m_storage_client;
struct direct_caller m_crypto_caller;
diff --git a/components/service/crypto/provider/component.cmake b/components/service/crypto/provider/component.cmake
new file mode 100644
index 0000000..68f32de
--- /dev/null
+++ b/components/service/crypto/provider/component.cmake
@@ -0,0 +1,14 @@
+#-------------------------------------------------------------------------------
+# Copyright (c) 2020-2021, Arm Limited and Contributors. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-3-Clause
+#
+#-------------------------------------------------------------------------------
+if (NOT DEFINED TGT)
+ message(FATAL_ERROR "mandatory parameter TGT is not defined.")
+endif()
+
+target_sources(${TGT} PRIVATE
+ "${CMAKE_CURRENT_LIST_DIR}/crypto_provider.c"
+ "${CMAKE_CURRENT_LIST_DIR}/crypto_context_pool.c"
+ )
diff --git a/components/service/crypto/provider/mbedcrypto/crypto_context_pool.c b/components/service/crypto/provider/crypto_context_pool.c
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/crypto_context_pool.c
rename to components/service/crypto/provider/crypto_context_pool.c
diff --git a/components/service/crypto/provider/mbedcrypto/crypto_context_pool.h b/components/service/crypto/provider/crypto_context_pool.h
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/crypto_context_pool.h
rename to components/service/crypto/provider/crypto_context_pool.h
diff --git a/components/service/crypto/provider/mbedcrypto/crypto_provider.c b/components/service/crypto/provider/crypto_provider.c
similarity index 92%
rename from components/service/crypto/provider/mbedcrypto/crypto_provider.c
rename to components/service/crypto/provider/crypto_provider.c
index 292c180..3dc2a41 100644
--- a/components/service/crypto/provider/mbedcrypto/crypto_provider.c
+++ b/components/service/crypto/provider/crypto_provider.c
@@ -6,9 +6,7 @@
#include <stdint.h>
#include <stdlib.h>
#include <protocols/service/crypto/packed-c/opcodes.h>
-#include <service/crypto/provider/mbedcrypto/crypto_provider.h>
-#include <service/crypto/provider/mbedcrypto/trng_adapter/trng_adapter.h>
-#include <service/secure_storage/frontend/psa/its/its_frontend.h>
+#include <service/crypto/provider/crypto_provider.h>
#include <protocols/rpc/common/packed-c/status.h>
#include <psa/crypto.h>
@@ -46,46 +44,26 @@
{TS_CRYPTO_OPCODE_HASH_FINISH, hash_finish_handler}
};
-struct rpc_interface *mbed_crypto_provider_init(struct mbed_crypto_provider *context,
- struct storage_backend *storage_backend,
- int trng_instance)
+struct rpc_interface *crypto_provider_init(struct crypto_provider *context)
{
- struct rpc_interface *rpc_interface = NULL;
-
crypto_context_pool_init(&context->context_pool);
- trng_adapter_init(trng_instance);
- /*
- * A storage provider is required for persistent key storage. As this
- * is a mandatory feature of the crypto service, insist on a storage
- * provider being available.
- */
- if (context && storage_backend) {
+ for (size_t encoding = 0; encoding < TS_RPC_ENCODING_LIMIT; ++encoding)
+ context->serializers[encoding] = NULL;
- for (size_t encoding = 0; encoding < TS_RPC_ENCODING_LIMIT; ++encoding)
- context->serializers[encoding] = NULL;
-
- service_provider_init(&context->base_provider, context,
+ service_provider_init(&context->base_provider, context,
handler_table, sizeof(handler_table)/sizeof(struct service_handler));
- if ((psa_its_frontend_init(storage_backend) == PSA_SUCCESS) &&
- (psa_crypto_init() == PSA_SUCCESS)) {
-
- rpc_interface = service_provider_get_rpc_interface(&context->base_provider);
- }
- }
-
- return rpc_interface;
+ return service_provider_get_rpc_interface(&context->base_provider);
}
-void mbed_crypto_provider_deinit(struct mbed_crypto_provider *context)
+void crypto_provider_deinit(struct crypto_provider *context)
{
- trng_adapter_deinit();
crypto_context_pool_deinit(&context->context_pool);
}
-void mbed_crypto_provider_register_serializer(struct mbed_crypto_provider *context,
- unsigned int encoding, const struct crypto_provider_serializer *serializer)
+void crypto_provider_register_serializer(struct crypto_provider *context,
+ unsigned int encoding, const struct crypto_provider_serializer *serializer)
{
if (encoding < TS_RPC_ENCODING_LIMIT)
context->serializers[encoding] = serializer;
@@ -94,7 +72,7 @@
static const struct crypto_provider_serializer* get_crypto_serializer(void *context,
const struct call_req *req)
{
- struct mbed_crypto_provider *this_instance = (struct mbed_crypto_provider*)context;
+ struct crypto_provider *this_instance = (struct crypto_provider*)context;
const struct crypto_provider_serializer* serializer = NULL;
unsigned int encoding = call_req_get_encoding(req);
@@ -593,7 +571,7 @@
rpc_status_t rpc_status = TS_RPC_ERROR_SERIALIZATION_NOT_SUPPORTED;
struct call_param_buf *req_buf = call_req_get_req_buf(req);
const struct crypto_provider_serializer *serializer = get_crypto_serializer(context, req);
- struct mbed_crypto_provider *this_instance = (struct mbed_crypto_provider*)context;
+ struct crypto_provider *this_instance = (struct crypto_provider*)context;
psa_algorithm_t alg;
@@ -643,7 +621,7 @@
rpc_status_t rpc_status = TS_RPC_ERROR_SERIALIZATION_NOT_SUPPORTED;
struct call_param_buf *req_buf = call_req_get_req_buf(req);
const struct crypto_provider_serializer *serializer = get_crypto_serializer(context, req);
- struct mbed_crypto_provider *this_instance = (struct mbed_crypto_provider*)context;
+ struct crypto_provider *this_instance = (struct crypto_provider*)context;
uint32_t op_handle;
const uint8_t *data;
@@ -678,7 +656,7 @@
rpc_status_t rpc_status = TS_RPC_ERROR_SERIALIZATION_NOT_SUPPORTED;
struct call_param_buf *req_buf = call_req_get_req_buf(req);
const struct crypto_provider_serializer *serializer = get_crypto_serializer(context, req);
- struct mbed_crypto_provider *this_instance = (struct mbed_crypto_provider*)context;
+ struct crypto_provider *this_instance = (struct crypto_provider*)context;
uint32_t op_handle;
diff --git a/components/service/crypto/provider/mbedcrypto/crypto_provider.h b/components/service/crypto/provider/crypto_provider.h
similarity index 60%
rename from components/service/crypto/provider/mbedcrypto/crypto_provider.h
rename to components/service/crypto/provider/crypto_provider.h
index 19bc2c2..a45b14c 100644
--- a/components/service/crypto/provider/mbedcrypto/crypto_provider.h
+++ b/components/service/crypto/provider/crypto_provider.h
@@ -4,13 +4,12 @@
* SPDX-License-Identifier: BSD-3-Clause
*/
-#ifndef MBED_CRYPTO_PROVIDER_H
-#define MBED_CRYPTO_PROVIDER_H
+#ifndef CRYPTO_PROVIDER_H
+#define CRYPTO_PROVIDER_H
#include <rpc/common/endpoint/rpc_interface.h>
#include <service/common/provider/service_provider.h>
#include <service/crypto/provider/serializer/crypto_provider_serializer.h>
-#include <service/secure_storage/backend/storage_backend.h>
#include <protocols/rpc/common/packed-c/encoding.h>
#include "crypto_context_pool.h"
@@ -18,7 +17,7 @@
extern "C" {
#endif
-struct mbed_crypto_provider
+struct crypto_provider
{
struct service_provider base_provider;
struct crypto_context_pool context_pool;
@@ -26,20 +25,17 @@
};
/*
- * Initializes an instance of the crypto service provider that uses the
- * Mbed Crypto library to implement crypto operations. Secure storage
- * for persistent keys needs to be provided by a suitable storage
- * backend.
+ * Initializes an instance of the crypto service provider. A suitable
+ * backend that realizes the PSA Crypto API should have been initialized
+ * prior to initializing the crypto provider.
*/
-struct rpc_interface *mbed_crypto_provider_init(struct mbed_crypto_provider *context,
- struct storage_backend *storage_backend,
- int trng_instance);
+struct rpc_interface *crypto_provider_init(struct crypto_provider *context);
/*
* When operation of the provider is no longer required, this function
* frees any resource used by the previously initialized provider instance.
*/
-void mbed_crypto_provider_deinit(struct mbed_crypto_provider *context);
+void crypto_provider_deinit(struct crypto_provider *context);
/*
* Register a serializer for supportng a particular parameter encoding. At
@@ -47,11 +43,11 @@
* to allow alternative parameter serialization schemes to be used to allow
* for compatibility with different types of client.
*/
-void mbed_crypto_provider_register_serializer(struct mbed_crypto_provider *context,
+void crypto_provider_register_serializer(struct crypto_provider *context,
unsigned int encoding, const struct crypto_provider_serializer *serializer);
#ifdef __cplusplus
} /* extern "C" */
#endif
-#endif /* MBED_CRYPTO_PROVIDER_H */
+#endif /* CRYPTO_PROVIDER_H */
diff --git a/components/service/crypto/provider/mbedcrypto/test/component.cmake b/components/service/crypto/provider/test/component.cmake
similarity index 100%
rename from components/service/crypto/provider/mbedcrypto/test/component.cmake
rename to components/service/crypto/provider/test/component.cmake
diff --git a/components/service/crypto/provider/mbedcrypto/test/crypto_context_pool_tests.cpp b/components/service/crypto/provider/test/crypto_context_pool_tests.cpp
similarity index 97%
rename from components/service/crypto/provider/mbedcrypto/test/crypto_context_pool_tests.cpp
rename to components/service/crypto/provider/test/crypto_context_pool_tests.cpp
index 1b6a12e..de5c612 100644
--- a/components/service/crypto/provider/mbedcrypto/test/crypto_context_pool_tests.cpp
+++ b/components/service/crypto/provider/test/crypto_context_pool_tests.cpp
@@ -5,7 +5,7 @@
*/
#include <stdlib.h>
-#include <service/crypto/provider/mbedcrypto/crypto_context_pool.h>
+#include <service/crypto/provider/crypto_context_pool.h>
#include <CppUTest/TestHarness.h>
/*