Skip to content

Commit a0a8a95

Browse files
ccli8ccli8
committed
[NUC472/M487] Strengthen crypto DMA buffer check
1. Catch incompatible buffer range, where buffer base = 0xffffff00 and buffer size = 0x100. 2. Add buffer size alignment check.
1 parent ac00024 commit a0a8a95

File tree

8 files changed

+48
-44
lines changed

8 files changed

+48
-44
lines changed

‎features/mbedtls/targets/TARGET_NUVOTON/TARGET_M480/aes/aes_alt.c

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -134,12 +134,13 @@ static void __nvt_aes_crypt( mbedtls_aes_context *ctx,
134134

135135
MBED_ASSERT((dataSize % 16 == 0) && (dataSize <= MAX_DMA_CHAIN_SIZE));
136136

137-
/* AES DMA buffer requires to be:
138-
* 1) Word-aligned
139-
* 2) Located in 0x2xxxxxxx region
137+
/* AES DMA buffer has the following requirements:
138+
* (1) Word-aligned buffer base address
139+
* (2) 16-byte aligned buffer size
140+
* (3) Located in 0x20000000-0x2FFFFFFF region
140141
*/
141-
if ((! crypto_dma_buff_compat(au8OutputData, MAX_DMA_CHAIN_SIZE)) ||
142-
(! crypto_dma_buff_compat(au8InputData, MAX_DMA_CHAIN_SIZE))) {
142+
if ((! crypto_dma_buff_compat(au8OutputData, MAX_DMA_CHAIN_SIZE, 16)) ||
143+
(! crypto_dma_buff_compat(au8InputData, MAX_DMA_CHAIN_SIZE, 16))) {
143144
error("Buffer for AES alter. DMA requires to be word-aligned and located in 0x20000000-0x2FFFFFFF region.");
144145
}
145146

@@ -160,14 +161,14 @@ static void __nvt_aes_crypt( mbedtls_aes_context *ctx,
160161
AES_SetInitVect(0, ctx->iv);
161162
AES_SetKey(0, ctx->keys, ctx->keySize);
162163
/* AES DMA buffer requirements same as above */
163-
if (! crypto_dma_buff_compat(input, dataSize)) {
164+
if (! crypto_dma_buff_compat(input, dataSize, 16)) {
164165
memcpy(au8InputData, input, dataSize);
165166
pIn = au8InputData;
166167
} else {
167168
pIn = input;
168169
}
169170
/* AES DMA buffer requirements same as above */
170-
if (! crypto_dma_buff_compat(output, dataSize)) {
171+
if (! crypto_dma_buff_compat(output, dataSize, 16)) {
171172
pOut = au8OutputData;
172173
} else {
173174
pOut = output;

‎features/mbedtls/targets/TARGET_NUVOTON/TARGET_M480/des/des_alt.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -315,12 +315,13 @@ static int mbedtls_des_docrypt(uint16_t keyopt, uint8_t key[3][MBEDTLS_DES_KEY_S
315315
return MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH;
316316
}
317317

318-
/* DES DMA buffer requires to be:
319-
* 1) Word-aligned
320-
* 2) Located in 0x2xxxxxxx region
318+
/* DES DMA buffer has the following requirements:
319+
* (1) Word-aligned buffer base address
320+
* (2) 8-byte aligned buffer size
321+
* (3) Located in 0x20000000-0x2FFFFFFF region
321322
*/
322-
if ((! crypto_dma_buff_compat(dmabuf_in, MAXSIZE_DMABUF)) ||
323-
(! crypto_dma_buff_compat(dmabuf_out, MAXSIZE_DMABUF))) {
323+
if ((! crypto_dma_buff_compat(dmabuf_in, MAXSIZE_DMABUF, 8)) ||
324+
(! crypto_dma_buff_compat(dmabuf_out, MAXSIZE_DMABUF, 8))) {
324325
error("Buffer for DES alter. DMA requires to be word-aligned and located in 0x20000000-0x2FFFFFFF region.");
325326
}
326327

‎features/mbedtls/targets/TARGET_NUVOTON/TARGET_NUC472/aes/aes_alt.c

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -134,12 +134,13 @@ static void __nvt_aes_crypt( mbedtls_aes_context *ctx,
134134

135135
MBED_ASSERT((dataSize % 16 == 0) && (dataSize <= MAX_DMA_CHAIN_SIZE));
136136

137-
/* AES DMA buffer requires to be:
138-
* 1) Word-aligned
139-
* 2) Located in 0x2xxxxxxx region
137+
/* AES DMA buffer has the following requirements:
138+
* (1) Word-aligned buffer base address
139+
* (2) 16-byte aligned buffer size
140+
* (3) Located in 0x20000000-0x2FFFFFFF region
140141
*/
141-
if ((! crypto_dma_buff_compat(au8OutputData, MAX_DMA_CHAIN_SIZE)) ||
142-
(! crypto_dma_buff_compat(au8InputData, MAX_DMA_CHAIN_SIZE))) {
142+
if ((! crypto_dma_buff_compat(au8OutputData, MAX_DMA_CHAIN_SIZE, 16)) ||
143+
(! crypto_dma_buff_compat(au8InputData, MAX_DMA_CHAIN_SIZE, 16))) {
143144
error("Buffer for AES alter. DMA requires to be word-aligned and located in 0x20000000-0x2FFFFFFF region.");
144145
}
145146

@@ -160,14 +161,14 @@ static void __nvt_aes_crypt( mbedtls_aes_context *ctx,
160161
AES_SetInitVect(0, ctx->iv);
161162
AES_SetKey(0, ctx->keys, ctx->keySize);
162163
/* AES DMA buffer requirements same as above */
163-
if (! crypto_dma_buff_compat(input, dataSize)) {
164+
if (! crypto_dma_buff_compat(input, dataSize, 16)) {
164165
memcpy(au8InputData, input, dataSize);
165166
pIn = au8InputData;
166167
} else {
167168
pIn = input;
168169
}
169170
/* AES DMA buffer requirements same as above */
170-
if (! crypto_dma_buff_compat(output, dataSize)) {
171+
if (! crypto_dma_buff_compat(output, dataSize, 16)) {
171172
pOut = au8OutputData;
172173
} else {
173174
pOut = output;

‎features/mbedtls/targets/TARGET_NUVOTON/TARGET_NUC472/des/des_alt.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -315,12 +315,13 @@ static int mbedtls_des_docrypt(uint16_t keyopt, uint8_t key[3][MBEDTLS_DES_KEY_S
315315
return MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH;
316316
}
317317

318-
/* DES DMA buffer requires to be:
319-
* 1) Word-aligned
320-
* 2) Located in 0x2xxxxxxx region
318+
/* DES DMA buffer has the following requirements:
319+
* (1) Word-aligned buffer base address
320+
* (2) 8-byte aligned buffer size
321+
* (3) Located in 0x20000000-0x2FFFFFFF region
321322
*/
322-
if ((! crypto_dma_buff_compat(dmabuf_in, MAXSIZE_DMABUF)) ||
323-
(! crypto_dma_buff_compat(dmabuf_out, MAXSIZE_DMABUF))) {
323+
if ((! crypto_dma_buff_compat(dmabuf_in, MAXSIZE_DMABUF, 8)) ||
324+
(! crypto_dma_buff_compat(dmabuf_out, MAXSIZE_DMABUF, 8))) {
324325
error("Buffer for DES alter. DMA requires to be word-aligned and located in 0x20000000-0x2FFFFFFF region.");
325326
}
326327

‎targets/TARGET_NUVOTON/TARGET_M480/crypto/crypto-misc.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -125,13 +125,13 @@ void crypto_sha_release(void)
125125
crypto_submodule_release(&crypto_sha_avail);
126126
}
127127

128-
bool crypto_dma_buff_compat(const void *buff, size_t buff_size)
128+
bool crypto_dma_buff_compat(const void *buff, size_t buff_size, size_t size_aligned_to)
129129
{
130130
uint32_t buff_ = (uint32_t) buff;
131-
132-
return (((buff_ & 0x03) == 0) && /* Word-aligned */
133-
(buff_ >= 0x20000000) && /* 0x20000000-0x2FFFFFFF */
134-
((buff_ + buff_size) <= 0x30000000));
131+
132+
return (((buff_ & 0x03) == 0) && /* Word-aligned buffer base address */
133+
((buff_size & (size_aligned_to - 1)) == 0) && /* Crypto submodule dependent buffer size alignment */
134+
(((buff_ >> 28) == 0x2) && (buff_size <= (0x30000000 - buff_)))); /* 0x20000000-0x2FFFFFFF */
135135
}
136136

137137
static bool crypto_submodule_acquire(uint16_t *submodule_avail)

‎targets/TARGET_NUVOTON/TARGET_M480/crypto/crypto-misc.h

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,12 @@ void crypto_des_release(void);
5252
bool crypto_sha_acquire(void);
5353
void crypto_sha_release(void);
5454

55-
/* Check if buffer can be used for crypto DMA. It requires to be:
56-
*
57-
* 1) Word-aligned
58-
* 2) Located in 0x20000000-0x2FFFFFFF region
55+
/* Check if buffer can be used for crypto DMA. It has the following requirements:
56+
* (1) Word-aligned buffer base address
57+
* (2) Crypto submodule (AES, DES, SHA, etc.) dependent buffer size alignment. Must be 2 power.
58+
* (3) Located in 0x20000000-0x2FFFFFFF region
5959
*/
60-
bool crypto_dma_buff_compat(const void *buff, size_t buff_size);
60+
bool crypto_dma_buff_compat(const void *buff, size_t buff_size, size_t size_aligned_to);
6161

6262
#ifdef __cplusplus
6363
}

‎targets/TARGET_NUVOTON/TARGET_NUC472/crypto/crypto-misc.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -125,13 +125,13 @@ void crypto_sha_release(void)
125125
crypto_submodule_release(&crypto_sha_avail);
126126
}
127127

128-
bool crypto_dma_buff_compat(const void *buff, size_t buff_size)
128+
bool crypto_dma_buff_compat(const void *buff, size_t buff_size, size_t size_aligned_to)
129129
{
130130
uint32_t buff_ = (uint32_t) buff;
131-
132-
return (((buff_ & 0x03) == 0) && /* Word-aligned */
133-
(buff_ >= 0x20000000) && /* 0x20000000-0x2FFFFFFF */
134-
((buff_ + buff_size) <= 0x30000000));
131+
132+
return (((buff_ & 0x03) == 0) && /* Word-aligned buffer base address */
133+
((buff_size & (size_aligned_to - 1)) == 0) && /* Crypto submodule dependent buffer size alignment */
134+
(((buff_ >> 28) == 0x2) && (buff_size <= (0x30000000 - buff_)))); /* 0x20000000-0x2FFFFFFF */
135135
}
136136

137137
static bool crypto_submodule_acquire(uint16_t *submodule_avail)

‎targets/TARGET_NUVOTON/TARGET_NUC472/crypto/crypto-misc.h

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -52,12 +52,12 @@ void crypto_des_release(void);
5252
bool crypto_sha_acquire(void);
5353
void crypto_sha_release(void);
5454

55-
/* Check if buffer can be used for crypto DMA. It requires to be:
56-
*
57-
* 1) Word-aligned
58-
* 2) Located in 0x20000000-0x2FFFFFFF region
55+
/* Check if buffer can be used for crypto DMA. It has the following requirements:
56+
* (1) Word-aligned buffer base address
57+
* (2) Crypto submodule (AES, DES, SHA, etc.) dependent buffer size alignment. Must be 2 power.
58+
* (3) Located in 0x20000000-0x2FFFFFFF region
5959
*/
60-
bool crypto_dma_buff_compat(const void *buff, size_t buff_size);
60+
bool crypto_dma_buff_compat(const void *buff, size_t buff_size, size_t size_aligned_to);
6161

6262
#ifdef __cplusplus
6363
}

0 commit comments

Comments
 (0)