Enable owner labelling of keys in Mbed TLS
This change modifies the build configuration for Mbed TLS when it is
used as a backend for the crypto provider to enable labelling of key IDs
using an externally provided identifier. This allows the key store to be
partitioned to protect keys from unauthorized access. Currently, the
partitioning is based on the caller ID that identifies a calling client.
For FF-A deployments, this is the source partition ID. Because the
configuration change alters the PSA Crypto API exposed by mbedcrypto, a
number of changes were needed to allow the modified API to coexist in
builds alongside clients that depend on the standard API. Some old unit
test cases that were not practical to modify have been removed. From a
coverage perspective, most of the same areas are covered by the
extensive set of service level tests.
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>
Signed-off-by: Julian Hall <julian.hall@arm.com>
Change-Id: I2762c91bba2dba0a6305aefe61f256355defaf3a
diff --git a/deployments/component-test/component-test.cmake b/deployments/component-test/component-test.cmake
index a8718f0..03f7c8c 100644
--- a/deployments/component-test/component-test.cmake
+++ b/deployments/component-test/component-test.cmake
@@ -125,11 +125,11 @@
"components/service/fwu/test/metadata_fetcher/volume"
"components/service/fwu/test/image_directory_checker"
"components/service/fwu/test/ref_scenarios"
+ "components/service/crypto/include"
+ "components/service/crypto/client/psa"
"components/service/crypto/client/cpp"
"components/service/crypto/client/cpp/protocol/protobuf"
"components/service/crypto/client/cpp/protocol/packed-c"
- "components/service/crypto/client/test"
- "components/service/crypto/client/test/standalone"
"components/service/crypto/provider"
"components/service/crypto/provider/serializer/protobuf"
"components/service/crypto/provider/serializer/packed-c"
diff --git a/deployments/libts/linux-pc/CMakeLists.txt b/deployments/libts/linux-pc/CMakeLists.txt
index 60d0995..9f8a319 100644
--- a/deployments/libts/linux-pc/CMakeLists.txt
+++ b/deployments/libts/linux-pc/CMakeLists.txt
@@ -89,6 +89,8 @@
"components/service/attestation/key_mngr/local"
"components/service/attestation/provider"
"components/service/attestation/provider/serializer/packed-c"
+ "components/service/crypto/include"
+ "components/service/crypto/client/psa"
"components/service/block_storage/block_store"
"components/service/block_storage/block_store/device"
"components/service/block_storage/block_store/device/ram"
@@ -131,7 +133,6 @@
"components/service/test_runner/provider/backend/mock"
"components/service/test_runner/provider/backend/simple_c"
"components/service/uefi/smm_variable/backend"
- "components/service/uefi/smm_variable/backend/direct"
"components/service/uefi/smm_variable/provider"
"components/media/disk"
"components/media/disk/disk_images"
@@ -219,6 +220,8 @@
"components/service/crypto/test/service"
"components/service/crypto/test/service/protobuf"
"components/service/crypto/test/service/packed-c"
+ "components/service/crypto/include"
+ "components/service/crypto/client/psa"
"components/service/crypto/client/cpp"
"components/service/crypto/client/cpp/protocol/protobuf"
"components/service/crypto/client/cpp/protocol/packed-c"
diff --git a/deployments/platform-inspect/platform-inspect.cmake b/deployments/platform-inspect/platform-inspect.cmake
index dc65184..aa3c523 100644
--- a/deployments/platform-inspect/platform-inspect.cmake
+++ b/deployments/platform-inspect/platform-inspect.cmake
@@ -49,6 +49,9 @@
include(${TS_ROOT}/external/MbedTLS/MbedTLS.cmake)
target_link_libraries(platform-inspect PRIVATE MbedTLS::mbedcrypto)
+# Use Mbed TLS to provide the psa crypto api interface files
+set(PSA_CRYPTO_API_INCLUDE "${MBEDTLS_PUBLIC_INCLUDE_PATH}")
+
# Qcbor
include(${TS_ROOT}/external/qcbor/qcbor.cmake)
diff --git a/deployments/psa-api-test/initial_attestation/iat-api-test.cmake b/deployments/psa-api-test/initial_attestation/iat-api-test.cmake
index 88b5fb9..4d1d2b1 100644
--- a/deployments/psa-api-test/initial_attestation/iat-api-test.cmake
+++ b/deployments/psa-api-test/initial_attestation/iat-api-test.cmake
@@ -52,6 +52,9 @@
include(${TS_ROOT}/external/MbedTLS/MbedTLS.cmake)
target_link_libraries(${PROJECT_NAME} PRIVATE MbedTLS::mbedcrypto)
+# Use Mbed TLS to provide the psa crypto api interface files
+set(PSA_CRYPTO_API_INCLUDE ${MBEDTLS_PUBLIC_INCLUDE_PATH})
+
#-------------------------------------------------------------------------------
# Advertise PSA API include paths to PSA Arch tests
#