Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Psa crypto dcache #20260

Merged
merged 7 commits into from
Apr 1, 2025
Merged

Psa crypto dcache #20260

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
b1a124c
sdfw_services: psa_crypto: Skip psa init
karstenkoenig Feb 19, 2025
d3e2af2
sdfw_services: psa_crypto: Whitespace fixes
karstenkoenig Feb 19, 2025
a3b3c1d
sdfw_services: psa_crypto: Add DCache handling
karstenkoenig Feb 19, 2025
e6cc25e
sdfw_services: psa_crypto: Improve DCache handling
karstenkoenig Mar 4, 2025
461a2fa
sdfw_services: psa_crypto: Bounce buffer handling
karstenkoenig Mar 4, 2025
e5aac93
samples: crypto: Stop disabling DCache
karstenkoenig Mar 20, 2025
b57d288
nrf_security: ssf_secdom: Rename parameter
karstenkoenig Mar 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 0 additions & 6 deletions include/sdfw/sdfw_services/crypto_service.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,12 +8,6 @@

#include <psa/crypto.h>

/** @brief Execute psa_crypto_init over SSF.
*
* See psa_crypto_init for details.
*/
psa_status_t ssf_psa_crypto_init(void);

/** @brief Execute psa_get_key_attributes over SSF.
*
* See psa_get_key_attributes for details.
Expand Down
3 changes: 0 additions & 3 deletions samples/crypto/aes_cbc/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/aes_ccm/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/aes_ctr/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/aes_gcm/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/chachapoly/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/ecdh/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/ecdsa/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/ecjpake/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/eddsa/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/hkdf/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/hmac/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/pbkdf2/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/psa_tls/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,3 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
# Enable PSA crypto from SSF client
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n
3 changes: 0 additions & 3 deletions samples/crypto/psa_tls/boards/nrf54h20dk_nrf54h20_cpurad.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,3 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
# Enable PSA crypto from SSF client
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n
3 changes: 0 additions & 3 deletions samples/crypto/rng/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/sha256/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
3 changes: 0 additions & 3 deletions samples/crypto/spake2p/boards/nrf54h20dk_nrf54h20_cpuapp.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,9 +11,6 @@ CONFIG_PSA_CRYPTO_DRIVER_OBERON=n
CONFIG_PSA_SSF_CRYPTO_CLIENT=y
CONFIG_SSF_PSA_CRYPTO_SERVICE_ENABLED=y

# Disable Data Cache
CONFIG_DCACHE=n

# Mbedtls configuration
CONFIG_MBEDTLS_ENABLE_HEAP=y
CONFIG_MBEDTLS_HEAP_SIZE=8192
26 changes: 25 additions & 1 deletion subsys/nrf_security/src/ssf_secdom/ssf_crypto.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@

psa_status_t psa_crypto_init(void)
{
return ssf_psa_crypto_init();
return PSA_SUCCESS;
}

psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key, psa_key_attributes_t *attributes)
Expand Down Expand Up @@ -400,6 +400,18 @@ psa_status_t psa_key_derivation_output_key(const psa_key_attributes_t *attribute
return ssf_psa_key_derivation_output_key(attributes, &operation->handle, key);
}

psa_status_t psa_key_derivation_verify_bytes(psa_key_derivation_operation_t *operation,
const uint8_t *expected, size_t expected_length)
{
return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_key_derivation_verify_key(psa_key_derivation_operation_t *operation,
mbedtls_svc_key_id_t expected)
{
return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
{
return ssf_psa_key_derivation_abort(&operation->handle);
Expand Down Expand Up @@ -430,6 +442,13 @@ psa_status_t psa_sign_hash_start(psa_sign_hash_interruptible_operation_t *operat
return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_sign_hash_complete(psa_sign_hash_interruptible_operation_t *operation,
uint8_t *signature, size_t signature_size,
size_t *signature_length)
{
return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_sign_hash_abort(psa_sign_hash_interruptible_operation_t *operation)
{
return PSA_ERROR_NOT_SUPPORTED;
Expand All @@ -443,6 +462,11 @@ psa_status_t psa_verify_hash_start(psa_verify_hash_interruptible_operation_t *op
return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_verify_hash_complete(psa_verify_hash_interruptible_operation_t *operation)
{
return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_verify_hash_abort(psa_verify_hash_interruptible_operation_t *operation)
{
return PSA_ERROR_NOT_SUPPORTED;
Expand Down
27 changes: 27 additions & 0 deletions subsys/sdfw_services/services/psa_crypto/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,3 +11,30 @@ service_version = 2
service_buffer_size = 128
service_name_str = PSA Crypto
rsource "../Kconfig.template.service"

if SSF_PSA_CRYPTO_SERVICE_ENABLED

config SSF_PSA_CRYPTO_SERVICE_OUT_BOUNCE_BUFFERS
bool "Make sure that all output buffers can be written cache-safe from the crypto engine"
default y
depends on DCACHE
help
When this option is enabled, the PSA Crypto service will allocate bounce buffers for
all PSA [inout] and [out] structures that are not aligned to the DCache DataUnit size.
When this option is disabled, the PSA Crypto service will never use bounce buffers,
and the application must ensure that the structures are cache-safe.
The structures are cache-safe if there are no writes locally to any of the DataUnits
that contain the structure getting written from the remote.

if SSF_PSA_CRYPTO_SERVICE_OUT_BOUNCE_BUFFERS

config SSF_PSA_CRYPTO_SERVICE_OUT_HEAP_SIZE
int "Size of the heap used to buffer output from PSA function calls"
default 4096
help
Size of the heap buffer used for out buffer.
Reducing the size may trigger PSA_ERROR_INSUFFICIENT_MEMORY in PSA calls.

endif # SSF_PSA_CRYPTO_SERVICE_OUT_BOUNCE_BUFFERS

endif # SSF_PSA_CRYPTO_SERVICE_ENABLED
Loading