Skip to content

Commit df184b6

Browse files
sujaygkulkarni-nxpsujaygkulkarni-nxp
authored
Moving NXP HSM integration code to platform folder (project-chip#27130)
* moved se050 integration code to platform folder. Also code cleanup of HSM class references * updated simw build config file * updated simw repo commit id * removed duplicate files for example * CHIPCryptoPALTest build fix * removed hsm include * build fix * disabled k32 with se050 build * removed k32 build with se050 * disabled k32 build with se050 * disabled k32 build with se050 * disabled k32 build with se050 * reverting the change * removed se050 dependency from k32 gn file * removed se050 dependency from k32 gn file * removed chip_with_se05x option from gn file * restyled * restyled * removed varargs in log messages
1 parent 2b2e317 commit df184b6

40 files changed

+2743
-1329
lines changed

‎.github/workflows/examples-k32w.yaml

-1
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,6 @@ jobs:
8686
run: |
8787
scripts/run_in_build_env.sh "\
8888
./scripts/build/build_examples.py \
89-
--target k32w-light-no-ble-se05x \
9089
--target k32w-light-crypto-platform-tokenizer \
9190
--target k32w-lock-crypto-platform-tokenizer \
9291
--target k32w-lock-crypto-platform-low-power-nologs \

‎examples/contact-sensor-app/nxp/k32w/k32w0/BUILD.gn

-4
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,6 @@ k32w0_sdk("sdk") {
5757
"${k32w0_platform_dir}/common",
5858
]
5959

60-
if (chip_with_se05x == 1) {
61-
include_dirs += [ "${chip_root}/examples/platform/nxp/se05x" ]
62-
}
63-
6460
defines = []
6561
if (is_debug) {
6662
defines += [ "BUILD_RELEASE=0" ]

‎examples/lighting-app/nxp/k32w/k32w0/BUILD.gn

-4
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,6 @@ k32w0_sdk("sdk") {
5757
"${k32w0_platform_dir}/common",
5858
]
5959

60-
if (chip_with_se05x == 1) {
61-
include_dirs += [ "${chip_root}/examples/platform/nxp/se05x" ]
62-
}
63-
6460
defines = []
6561
if (is_debug) {
6662
defines += [ "BUILD_RELEASE=0" ]

‎examples/lock-app/nxp/k32w/k32w0/BUILD.gn

-5
Original file line numberDiff line numberDiff line change
@@ -57,10 +57,6 @@ k32w0_sdk("sdk") {
5757
"${k32w0_platform_dir}/common",
5858
]
5959

60-
if (chip_with_se05x == 1) {
61-
include_dirs += [ "${chip_root}/examples/platform/nxp/se05x" ]
62-
}
63-
6460
defines = []
6561
if (is_debug) {
6662
defines += [ "BUILD_RELEASE=0" ]
@@ -111,7 +107,6 @@ k32w0_executable("lock_app") {
111107
"${chip_root}/src/lib",
112108
"${chip_root}/src/platform:syscalls_stub",
113109
"${chip_root}/third_party/mbedtls:mbedtls",
114-
"${chip_root}/third_party/simw-top-mini:se05x",
115110
"${k32w0_platform_dir}/app/support:freertos_mbedtls_utils",
116111
]
117112

‎examples/platform/nxp/se05x/DeviceAttestationSe05xCredsExample.cpp

+20-14
Original file line numberDiff line numberDiff line change
@@ -16,20 +16,13 @@
1616
*/
1717
#include "DeviceAttestationSe05xCredsExample.h"
1818

19+
#include <CHIPCryptoPAL_se05x.h>
1920
#include <credentials/examples/ExampleDACs.h>
2021
#include <credentials/examples/ExamplePAI.h>
2122
#include <crypto/CHIPCryptoPAL.h>
2223
#include <lib/core/CHIPError.h>
2324
#include <lib/support/Span.h>
2425

25-
#if CHIP_CRYPTO_HSM
26-
#include <crypto/hsm/CHIPCryptoPALHsm.h>
27-
#endif
28-
29-
#ifdef ENABLE_HSM_DEVICE_ATTESTATION
30-
31-
#include <crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_utils.h>
32-
3326
/* Device attestation key ids */
3427
#define DEV_ATTESTATION_KEY_SE05X_ID 0x7D300000
3528
#define DEV_ATTESTATION_CERT_SE05X_ID 0x7D300001
@@ -135,17 +128,32 @@ CHIP_ERROR ExampleSe05xDACProvider::SignWithDeviceAttestationKey(const ByteSpan
135128
MutableByteSpan & out_signature_buffer)
136129
{
137130
Crypto::P256ECDSASignature signature;
138-
Crypto::P256KeypairHSM keypair;
131+
Crypto::P256Keypair keypair;
132+
Crypto::P256SerializedKeypair serialized_keypair;
133+
uint8_t magic_bytes[] = NXP_CRYPTO_KEY_MAGIC;
139134

140135
ChipLogDetail(Crypto, "Sign using DA key from se05x");
141136

142137
VerifyOrReturnError(IsSpanUsable(out_signature_buffer), CHIP_ERROR_INVALID_ARGUMENT);
143138
VerifyOrReturnError(IsSpanUsable(message_to_sign), CHIP_ERROR_INVALID_ARGUMENT);
144139
VerifyOrReturnError(out_signature_buffer.size() >= signature.Capacity(), CHIP_ERROR_BUFFER_TOO_SMALL);
145140

146-
keypair.SetKeyId(DEV_ATTESTATION_KEY_SE05X_ID);
147-
keypair.provisioned_key = true;
148-
keypair.Initialize(Crypto::ECPKeyTarget::ECDSA);
141+
// Add public key + reference private key (ref to key inside SE)
142+
143+
serialized_keypair.SetLength(Crypto::kP256_PublicKey_Length + Crypto::kP256_PrivateKey_Length);
144+
145+
memset(serialized_keypair.Bytes(), 0, Crypto::kP256_PublicKey_Length);
146+
memcpy(serialized_keypair.Bytes() + Crypto::kP256_PublicKey_Length, magic_bytes, sizeof(magic_bytes));
147+
*(serialized_keypair.Bytes() + Crypto::kP256_PublicKey_Length + sizeof(magic_bytes) + 0) =
148+
(DEV_ATTESTATION_KEY_SE05X_ID & 0xFF000000) >> (8 * 3);
149+
*(serialized_keypair.Bytes() + Crypto::kP256_PublicKey_Length + sizeof(magic_bytes) + 1) =
150+
(DEV_ATTESTATION_KEY_SE05X_ID & 0x00FF0000) >> (8 * 2);
151+
*(serialized_keypair.Bytes() + Crypto::kP256_PublicKey_Length + sizeof(magic_bytes) + 2) =
152+
(DEV_ATTESTATION_KEY_SE05X_ID & 0x0000FF00) >> (8 * 1);
153+
*(serialized_keypair.Bytes() + Crypto::kP256_PublicKey_Length + sizeof(magic_bytes) + 3) =
154+
(DEV_ATTESTATION_KEY_SE05X_ID & 0x000000FF) >> (8 * 0);
155+
156+
ReturnErrorOnFailure(keypair.Deserialize(serialized_keypair));
149157

150158
ReturnErrorOnFailure(keypair.ECDSA_sign_msg(message_to_sign.data(), message_to_sign.size(), signature));
151159

@@ -164,5 +172,3 @@ DeviceAttestationCredentialsProvider * GetExampleSe05xDACProvider()
164172
} // namespace Examples
165173
} // namespace Credentials
166174
} // namespace chip
167-
168-
#endif //#ifdef ENABLE_HSM_DEVICE_ATTESTATION

‎examples/platform/nxp/se05x/DeviceAttestationSe05xCredsExample_v2.cpp

+3-11
Original file line numberDiff line numberDiff line change
@@ -14,26 +14,20 @@
1414
* See the License for the specific language governing permissions and
1515
* limitations under the License.
1616
*/
17+
1718
#include "DeviceAttestationSe05xCredsExample.h"
1819

20+
#include <CHIPCryptoPAL_se05x.h>
1921
#include <credentials/examples/ExampleDACs.h>
2022
#include <credentials/examples/ExamplePAI.h>
2123
#include <crypto/CHIPCryptoPAL.h>
2224
#include <lib/core/CHIPError.h>
2325
#include <lib/core/TLV.h>
2426
#include <lib/core/TLVTags.h>
2527
#include <lib/core/TLVTypes.h>
26-
#include <lib/core/TLVUtilities.hpp>
28+
#include <lib/core/TLVUtilities.h>
2729
#include <lib/support/Span.h>
2830

29-
#if CHIP_CRYPTO_HSM
30-
#include <crypto/hsm/CHIPCryptoPALHsm.h>
31-
#endif
32-
33-
#ifdef ENABLE_HSM_DEVICE_ATTESTATION
34-
35-
#include <crypto/hsm/nxp/CHIPCryptoPALHsm_SE05X_utils.h>
36-
3731
/* Device attestation key ids */
3832
#define DEV_ATTESTATION_KEY_SE05X_ID 0x7D300000
3933
#define DEV_ATTESTATION_CERT_SE05X_ID 0x7D300001
@@ -279,5 +273,3 @@ DeviceAttestationCredentialsProvider * GetExampleSe05xDACProviderv2()
279273
} // namespace Examples
280274
} // namespace Credentials
281275
} // namespace chip
282-
283-
#endif // #ifdef ENABLE_HSM_DEVICE_ATTESTATION

‎examples/platform/nxp/se05x/linux/AppMain.cpp

+2-91
Original file line numberDiff line numberDiff line change
@@ -77,12 +77,8 @@
7777
#include "AppMain.h"
7878
#include "CommissionableInit.h"
7979

80-
#if CHIP_CRYPTO_HSM
8180
#include "DeviceAttestationSe05xCredsExample.h"
82-
#include "se05x_t4t_utils.h"
83-
#include <crypto/hsm/CHIPCryptoPALHsm.h>
84-
#include <crypto/hsm/nxp/PersistentStorageOperationalKeystoreHSM.h>
85-
#endif
81+
#include <CHIPCryptoPALHsm_se05x_config.h>
8682

8783
using namespace chip;
8884
using namespace chip::ArgParser;
@@ -289,95 +285,10 @@ int ChipLinuxAppInit(int argc, char * const argv[], OptionSet * customOptions)
289285
return 0;
290286
}
291287

292-
#ifdef ENABLE_HSM_EC_KEY
293-
294-
struct CommonCaseDeviceServerInitParams_Se05x : public CommonCaseDeviceServerInitParams
295-
{
296-
CHIP_ERROR InitializeStaticResourcesBeforeServerInit()
297-
{
298-
static chip::KvsPersistentStorageDelegate sKvsPersistenStorageDelegate;
299-
static chip::PersistentStorageOperationalKeystoreHSM sPersistentStorageOperationalKeystore;
300-
static chip::Credentials::PersistentStorageOpCertStore sPersistentStorageOpCertStore;
301-
static chip::Credentials::GroupDataProviderImpl sGroupDataProvider;
302-
static Credentials::IgnoreCertificateValidityPeriodPolicy sDefaultCertValidityPolicy;
303-
static chip::Crypto::DefaultSessionKeystore sSessionKeystore;
304-
305-
#if CHIP_CONFIG_ENABLE_SESSION_RESUMPTION
306-
static chip::SimpleSessionResumptionStorage sSessionResumptionStorage;
307-
#endif
308-
static chip::app::DefaultAclStorage sAclStorage;
309-
310-
// KVS-based persistent storage delegate injection
311-
if (persistentStorageDelegate == nullptr)
312-
{
313-
chip::DeviceLayer::PersistedStorage::KeyValueStoreManager & kvsManager =
314-
DeviceLayer::PersistedStorage::KeyValueStoreMgr();
315-
ReturnErrorOnFailure(sKvsPersistenStorageDelegate.Init(&kvsManager));
316-
this->persistentStorageDelegate = &sKvsPersistenStorageDelegate;
317-
}
318-
319-
// PersistentStorageDelegate "software-based" operational key access injection
320-
if (this->operationalKeystore == nullptr)
321-
{
322-
// WARNING: PersistentStorageOperationalKeystore::Finish() is never called. It's fine for
323-
// for examples and for now.
324-
ReturnErrorOnFailure(sPersistentStorageOperationalKeystore.Init(this->persistentStorageDelegate));
325-
this->operationalKeystore = &sPersistentStorageOperationalKeystore;
326-
}
327-
328-
// OpCertStore can be injected but default to persistent storage default
329-
// for simplicity of the examples.
330-
if (this->opCertStore == nullptr)
331-
{
332-
// WARNING: PersistentStorageOpCertStore::Finish() is never called. It's fine for
333-
// for examples and for now, since all storage is immediate for that impl.
334-
ReturnErrorOnFailure(sPersistentStorageOpCertStore.Init(this->persistentStorageDelegate));
335-
this->opCertStore = &sPersistentStorageOpCertStore;
336-
}
337-
338-
// Session Keystore injection
339-
this->sessionKeystore = &sSessionKeystore;
340-
341-
// Group Data provider injection
342-
sGroupDataProvider.SetStorageDelegate(this->persistentStorageDelegate);
343-
sGroupDataProvider.SetSessionKeystore(this->sessionKeystore);
344-
ReturnErrorOnFailure(sGroupDataProvider.Init());
345-
this->groupDataProvider = &sGroupDataProvider;
346-
347-
#if CHIP_CONFIG_ENABLE_SESSION_RESUMPTION
348-
ReturnErrorOnFailure(sSessionResumptionStorage.Init(this->persistentStorageDelegate));
349-
this->sessionResumptionStorage = &sSessionResumptionStorage;
350-
#else
351-
this->sessionResumptionStorage = nullptr;
352-
#endif
353-
354-
// Inject access control delegate
355-
this->accessDelegate = Access::Examples::GetAccessControlDelegate();
356-
357-
// Inject ACL storage. (Don't initialize it.)
358-
this->aclStorage = &sAclStorage;
359-
360-
// Inject certificate validation policy compatible with non-wall-clock-time-synced
361-
// embedded systems.
362-
this->certificateValidityPolicy = &sDefaultCertValidityPolicy;
363-
364-
return CHIP_NO_ERROR;
365-
}
366-
};
367-
368-
#endif
369-
370288
void ChipLinuxAppMainLoop(AppMainLoopImplementation * impl)
371289
{
372-
#ifdef ENABLE_HSM_EC_KEY
373-
static CommonCaseDeviceServerInitParams_Se05x initParams;
374-
#else
375290
static chip::CommonCaseDeviceServerInitParams initParams;
376-
#endif
377291

378-
#if CHIP_CRYPTO_HSM
379-
VerifyOrDie(se05x_enable_contactless_interface() == 0);
380-
#endif
381292
VerifyOrDie(initParams.InitializeStaticResourcesBeforeServerInit() == CHIP_NO_ERROR);
382293

383294
#if defined(ENABLE_CHIP_SHELL)
@@ -423,7 +334,7 @@ void ChipLinuxAppMainLoop(AppMainLoopImplementation * impl)
423334
PrintOnboardingCodes(LinuxDeviceOptions::GetInstance().payload);
424335

425336
// Initialize device attestation config
426-
#ifdef ENABLE_HSM_DEVICE_ATTESTATION
337+
#if ENABLE_SE05X_DEVICE_ATTESTATION
427338
SetDeviceAttestationCredentialsProvider(Examples::GetExampleSe05xDACProvider());
428339
#else
429340
SetDeviceAttestationCredentialsProvider(LinuxDeviceOptions::GetInstance().dacProvider);

‎examples/platform/nxp/se05x/linux/BUILD.gn

+1
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,7 @@ source_set("app-main") {
5959
include_dirs = [
6060
"${chip_root}/examples/platform/linux",
6161
"${chip_root}/examples/platform/nxp/se05x",
62+
"${chip_root}/src/platform/nxp/crypto/se05x",
6263
]
6364

6465
defines = []

‎examples/shell/nxp/k32w/k32w0/BUILD.gn

-1
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ k32w0_executable("shell_app") {
6969
"${chip_root}/examples/shell/shell_common:shell_common",
7070
"${chip_root}/src/platform:syscalls_stub",
7171
"${chip_root}/third_party/mbedtls:mbedtls",
72-
"${chip_root}/third_party/simw-top-mini:se05x",
7372
"${k32w0_platform_dir}/app/support:freertos_mbedtls_utils",
7473
]
7574

‎examples/thermostat/nxp/linux-se05x/BUILD.gn

+20-4
Original file line numberDiff line numberDiff line change
@@ -14,19 +14,35 @@
1414

1515
import("//build_overrides/build.gni")
1616
import("//build_overrides/chip.gni")
17+
import("${chip_root}/src/platform/nxp/crypto/nxp_crypto.gni")
1718

18-
executable("thermostat-se05x-app") {
19-
sources = [ "${chip_root}/examples/thermostat/linux/main.cpp" ]
20-
19+
executable("thermostat-app") {
20+
sources = [
21+
"../../linux/include/low-power/LowPowerManager.cpp",
22+
"../../linux/include/low-power/LowPowerManager.h",
23+
"../../linux/main.cpp",
24+
]
2125
include_dirs = [ "${chip_root}/examples/platform/linux" ]
2226

2327
deps = [
24-
"${chip_root}/examples/platform/nxp/se05x/linux:app-main",
28+
"${chip_root}/examples/platform/nxp/${nxp_crypto_impl}/linux:app-main",
2529
"${chip_root}/examples/thermostat/thermostat-common",
2630
"${chip_root}/src/lib",
2731
]
2832

2933
cflags = [ "-Wconversion" ]
3034

3135
output_dir = root_out_dir
36+
37+
deps += [
38+
"${chip_root}/src/platform/nxp/crypto/${nxp_crypto_impl}:nxp_crypto_lib",
39+
]
40+
}
41+
42+
group("linux") {
43+
deps = [ ":thermostat-app" ]
44+
}
45+
46+
group("default") {
47+
deps = [ ":linux" ]
3248
}

‎examples/thermostat/nxp/linux-se05x/args.gni

+4-1
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,8 @@
1313
# limitations under the License.
1414

1515
import("//build_overrides/chip.gni")
16+
1617
import("${chip_root}/config/standalone/args.gni")
17-
chip_with_se05x = 1
18+
19+
# Include to define nxp_crypto_impl
20+
import("${chip_root}/src/platform/nxp/crypto/se05x/args.gni")

‎src/crypto/BUILD.gn

-23
Original file line numberDiff line numberDiff line change
@@ -55,14 +55,6 @@ buildconfig_header("crypto_buildconfig") {
5555
"CHIP_CRYPTO_BORINGSSL=${chip_crypto_boringssl}",
5656
"CHIP_CRYPTO_PLATFORM=${chip_crypto_platform}",
5757
]
58-
59-
if (chip_with_se05x == 1) {
60-
defines += [ "CHIP_CRYPTO_HSM=1" ]
61-
defines += [ "CHIP_CRYPTO_HSM_NXP=1" ]
62-
} else {
63-
defines += [ "CHIP_CRYPTO_HSM=0" ]
64-
defines += [ "CHIP_CRYPTO_HSM_NXP=0" ]
65-
}
6658
}
6759

6860
source_set("public_headers") {
@@ -177,19 +169,4 @@ static_library("crypto") {
177169
} else {
178170
assert(false, "Invalid CHIP crypto")
179171
}
180-
181-
if (chip_with_se05x == 1) {
182-
sources += [
183-
"hsm/nxp/CHIPCryptoPALHsm_SE05X_HKDF.cpp",
184-
"hsm/nxp/CHIPCryptoPALHsm_SE05X_HMAC.cpp",
185-
"hsm/nxp/CHIPCryptoPALHsm_SE05X_P256.cpp",
186-
"hsm/nxp/CHIPCryptoPALHsm_SE05X_PBKDF.cpp",
187-
"hsm/nxp/CHIPCryptoPALHsm_SE05X_Spake2p.cpp",
188-
"hsm/nxp/CHIPCryptoPALHsm_SE05X_utils.cpp",
189-
"hsm/nxp/PersistentStorageOperationalKeystoreHSM.cpp",
190-
"hsm/nxp/PersistentStorageOperationalKeystoreHSM.h",
191-
]
192-
public_deps += [ "${chip_root}/third_party/simw-top-mini:se05x" ]
193-
public_configs += [ "${chip_root}/third_party/simw-top-mini:se05x_config" ]
194-
}
195172
}

0 commit comments

Comments
 (0)