Skip to content

Commit 476b838

Browse files
Shachar Levysamuel-lee-msft
Shachar Levy
authored and
samuel-lee-msft
committed
Merged PR 10172292: Add symcrypt build for optee env
## Description: ## Admin Checklist: - [ ] You have updated documentation in symcrypt.h to reflect any changes in behavior - [ ] You have updated CHANGELOG.md to reflect any changes in behavior - [ ] You have updated symcryptunittest to exercise any new functionality - [ ] If you have introduced any symbols in symcrypt.h you have updated production and test dynamic export symbols (exports.ver / exports.def / symcrypt.src) and tested the updated dynamic modules with symcryptunittest - [ ] If you have introduced functionality that varies based on CPU features, you have manually tested with and without relevant features - [ ] If you have made significant changes to a particular algorithm, you have checked that performance numbers reported by symcryptunittest are in line with expectations - [ ] If you have added new algorithms/modes, you have updated the status indicator text for the associated modules if necessary Add symcrypt build for optee env Signed-off-by: v-shlevy <[email protected]> Related work items: #49419416
1 parent 88481f7 commit 476b838

File tree

18 files changed

+382
-90
lines changed

18 files changed

+382
-90
lines changed

‎cmake-configs/SymCrypt-Platforms.cmake‎

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,11 @@
33
# Choose which environment to use based on the host platform
44
# We don't support cross-compiling from one platform to another (e.g. compiling Windows binaries on Linux)
55
if(CMAKE_SYSTEM_NAME MATCHES "Linux")
6-
set(SYMCRYPT_TARGET_ENV "LinuxUserMode")
6+
if(SYMCRYPT_OPTEE MATCHES "ON")
7+
set(SYMCRYPT_TARGET_ENV "OPTEE")
8+
else()
9+
set(SYMCRYPT_TARGET_ENV "LinuxUserMode")
10+
endif()
711
elseif(CMAKE_SYSTEM_NAME MATCHES "Windows")
812
set(SYMCRYPT_TARGET_ENV "WindowsUserMode")
913
else()
@@ -51,6 +55,21 @@ if(CMAKE_SYSTEM_NAME MATCHES "Linux")
5155
# Enable a baseline of features for the compiler to support everywhere
5256
# Assumes that the compiler will not emit crypto instructions as a result of normal C code
5357
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -march=armv8-a+simd+crypto")
58+
59+
if(SYMCRYPT_TARGET_ENV MATCHES "OPTEE")
60+
# TA DEV KIT is require for OPTEE TA compilation
61+
if(DEFINED TA_DEV_KIT_INC)
62+
# Get the compiler toolchain include
63+
execute_process(COMMAND ${CMAKE_C_COMPILER} -print-file-name=include OUTPUT_VARIABLE TOOLCHAIN_INCLUDE)
64+
string(STRIP "${TOOLCHAIN_INCLUDE}" TOOLCHAIN_INCLUDE)
65+
# OPTEE env has a different stdlib and doesn't support atomic operations or multithreading.
66+
add_compile_options(-mno-outline-atomics -nostdinc -isystem ${TOOLCHAIN_INCLUDE})
67+
include_directories(${TA_DEV_KIT_INC})
68+
else()
69+
message(FATAL_ERROR "TA_DEV_KIT_INC must be defined for OPTEE build")
70+
endif()
71+
endif()
72+
5473
# GCC complains about implicit casting between ASIMD registers (i.e. uint8x16_t -> uint64x2_t) by default,
5574
# whereas clang and MSVC do not. Setting -flax-vector-conversions to build Arm64 intrinsics code with GCC.
5675
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -flax-vector-conversions")

‎inc/symcrypt.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -493,6 +493,8 @@ SymCryptUint64Bytesize( UINT64 value );
493493
//
494494
// SYMCRYPT_ENVIRONMENT_LINUX_USERMODE // use for Linux
495495
//
496+
// SYMCRYPT_ENVIRONMENT_OPTEE_TA // use for OPTEE
497+
//
496498
// SYMCRYPT_ENVIRONMENT_GENERIC // use for all other situations
497499
//
498500

‎inc/symcrypt_internal.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2884,6 +2884,7 @@ SYMCRYPT_EXTERN_C_END
28842884

28852885
#define SYMCRYPT_ENVIRONMENT_WINDOWS_KERNELMODE_LEGACY SYMCRYPT_ENVIRONMENT_GENERIC
28862886

2887+
#ifdef NTDDI_VERSION
28872888
#if (NTDDI_VERSION >= NTDDI_WIN7)
28882889
#define SYMCRYPT_ENVIRONMENT_WINDOWS_KERNELMODE_WIN7_N_LATER SYMCRYPT_ENVIRONMENT_DEFS( WindowsKernelmodeWin7nLater )
28892890
#endif
@@ -2909,12 +2910,16 @@ SYMCRYPT_EXTERN_C_END
29092910
#if (NTDDI_VERSION >= NTDDI_WIN10)
29102911
#define SYMCRYPT_ENVIRONMENT_WINDOWS_USERMODE_WIN10_SGX SYMCRYPT_ENVIRONMENT_DEFS( Win10Sgx )
29112912
#endif
2913+
#endif // NTDDI_VERSION
29122914

29132915
#define SYMCRYPT_ENVIRONMENT_WINDOWS_USERMODE_LATEST SYMCRYPT_ENVIRONMENT_WINDOWS_USERMODE_WIN8_1_N_LATER
29142916

29152917

29162918
#define SYMCRYPT_ENVIRONMENT_LINUX_USERMODE SYMCRYPT_ENVIRONMENT_DEFS( LinuxUsermode )
29172919

2920+
2921+
#define SYMCRYPT_ENVIRONMENT_OPTEE_TA SYMCRYPT_ENVIRONMENT_DEFS( OpteeTa )
2922+
29182923
//////////////////////////////////////////////////////////
29192924
//
29202925
// SymCryptWipe & SymCryptWipeKnownSize

‎lib/CMakeLists.txt‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -393,9 +393,24 @@ if(NOT WIN32)
393393
endif()
394394
endif()
395395

396-
add_library(symcrypt_linuxusermode STATIC env_linuxUserMode.c)
397-
set_target_properties(symcrypt_linuxusermode PROPERTIES PREFIX "")
398-
target_link_libraries(symcrypt_linuxusermode symcrypt_common)
396+
if(SYMCRYPT_TARGET_ENV MATCHES "LinuxUserMode")
397+
add_library(symcrypt_linuxusermode STATIC env_linuxUserMode.c)
398+
set_target_properties(symcrypt_linuxusermode PROPERTIES PREFIX "")
399+
target_link_libraries(symcrypt_linuxusermode symcrypt_common)
400+
elseif(SYMCRYPT_TARGET_ENV MATCHES "OPTEE")
401+
# Remove files from symcrypt_common that are not supported in optee env.
402+
# aes-asm.c - use SymCryptAesDecryptAsm which is not defined for ARM64
403+
# cpuid_um.c - include auxv.h and use getauxval
404+
# session.c - use atomic operations (__atomic_compare_exchange)
405+
list(REMOVE_ITEM SOURCES_COMMON
406+
aes-asm.c
407+
cpuid_um.c
408+
session.c)
409+
410+
add_library(symcrypt_envOpteeTa STATIC env_opteeTa.c)
411+
set_target_properties(symcrypt_envOpteeTa PROPERTIES PREFIX "")
412+
target_link_libraries(symcrypt_envOpteeTa symcrypt_common)
413+
endif()
399414
endif()
400415

401416
include_directories(${CMAKE_SOURCE_DIR}/inc)

‎lib/env_opteeTa.c‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
//
2+
// env_opteeTa.c
3+
// Platform-specific code for OPTEE TA.
4+
//
5+
// Copyright (c) Microsoft Corporation. Licensed under the MIT license.
6+
//
7+
8+
#include "precomp.h"
9+
10+
// OPTEE TA specific data
11+
#define TEE_ERROR_BAD_STATE 0xFFFF0007
12+
13+
typedef uint32_t TEE_Result;
14+
15+
void TEE_Panic(TEE_Result panicCode);
16+
17+
18+
SYMCRYPT_CPU_FEATURES SYMCRYPT_CALL SymCryptCpuFeaturesNeverPresentEnvOpteeTa(void)
19+
{
20+
return 0;
21+
}
22+
23+
VOID
24+
SYMCRYPT_CALL
25+
SymCryptInitEnvOpteeTa( UINT32 version )
26+
{
27+
if( g_SymCryptFlags & SYMCRYPT_FLAG_LIB_INITIALIZED )
28+
{
29+
return;
30+
}
31+
32+
// Optee module relies on the unconditional availability of certain CPU features (ASIMD, AES, PMULL, SHA256)
33+
g_SymCryptCpuFeaturesNotPresent = (SYMCRYPT_CPU_FEATURES) ~(SYMCRYPT_CPU_FEATURE_NEON|SYMCRYPT_CPU_FEATURE_NEON_AES|SYMCRYPT_CPU_FEATURE_NEON_PMULL|SYMCRYPT_CPU_FEATURE_NEON_SHA256);
34+
35+
SymCryptInitEnvCommon( version );
36+
}
37+
38+
_Analysis_noreturn_
39+
VOID
40+
SYMCRYPT_CALL
41+
SymCryptFatalEnvOpteeTa( ULONG fatalCode )
42+
{
43+
UINT32 fatalCodeVar;
44+
45+
SymCryptFatalIntercept( fatalCode );
46+
47+
//
48+
// Put the fatal code in a location where it shows up in the dump
49+
//
50+
SYMCRYPT_FORCE_WRITE32( &fatalCodeVar, fatalCode );
51+
52+
//
53+
// Our first preference is to fastfail,
54+
// the second to create an AV, which can trigger a core dump so that we get to
55+
// see what is going wrong.
56+
//
57+
__fastfail( FAST_FAIL_CRYPTO_LIBRARY );
58+
59+
TEE_Panic(TEE_ERROR_BAD_STATE);
60+
61+
//
62+
// Next we write to the NULL pointer, this causes an AV
63+
//
64+
SYMCRYPT_FORCE_WRITE32( (volatile UINT32 *)NULL, fatalCode );
65+
66+
SymCryptFatalHang( fatalCode );
67+
}
68+
69+
VOID
70+
SYMCRYPT_CALL
71+
SymCryptTestInjectErrorEnvOpteeTa( PBYTE pbBuf, SIZE_T cbBuf )
72+
{
73+
//
74+
// This feature is only used during testing. In production it is always
75+
// an empty function that the compiler can optimize away.
76+
//
77+
UNREFERENCED_PARAMETER( pbBuf );
78+
UNREFERENCED_PARAMETER( cbBuf );
79+
}
80+

‎modules/linux/CMakeLists.txt‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
add_subdirectory(common) # Common functionality for Linux modules
2-
add_subdirectory(generic) # Generic Linux module
3-
if(SYMCRYPT_USE_ASM AND SYMCRYPT_TARGET_ARCH MATCHES "AMD64")
4-
add_subdirectory(oe_full) # OpenEnclave with all functionality
2+
3+
if(SYMCRYPT_TARGET_ENV MATCHES "LinuxUserMode")
4+
5+
add_subdirectory(generic) # Generic Linux module
6+
7+
if(SYMCRYPT_USE_ASM AND SYMCRYPT_TARGET_ARCH MATCHES "AMD64")
8+
add_subdirectory(oe_full) # OpenEnclave with all functionality
9+
endif()
10+
elseif(SYMCRYPT_TARGET_ENV MATCHES "OPTEE")
11+
add_subdirectory(optee) # OPTEE module
512
endif()

‎modules/linux/common/callbacks_pthread.c‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
//
2+
// callbacks_pthread.c
3+
// Contains symcrypt call back functions for pthreads
4+
//
5+
// Copyright (c) Microsoft Corporation. Licensed under the MIT license.
6+
//
7+
8+
#include <pthread.h>
9+
#include "precomp.h"
10+
11+
PVOID
12+
SYMCRYPT_CALL
13+
SymCryptCallbackAlloc( SIZE_T nBytes )
14+
{
15+
return aligned_alloc(SYMCRYPT_ASYM_ALIGN_VALUE, nBytes);
16+
}
17+
18+
VOID
19+
SYMCRYPT_CALL
20+
SymCryptCallbackFree( VOID * pMem )
21+
{
22+
free( pMem );
23+
}
24+
25+
SYMCRYPT_ERROR
26+
SYMCRYPT_CALL
27+
SymCryptCallbackRandom( PBYTE pbBuffer, SIZE_T cbBuffer )
28+
{
29+
SymCryptRandom( pbBuffer, cbBuffer );
30+
return SYMCRYPT_NO_ERROR;
31+
}
32+
33+
34+
PVOID
35+
SYMCRYPT_CALL
36+
SymCryptCallbackAllocateMutexFastInproc(void)
37+
{
38+
PVOID ptr = malloc(sizeof(pthread_mutex_t));
39+
40+
if( ptr )
41+
{
42+
if( pthread_mutex_init( (pthread_mutex_t *)ptr, NULL ) != 0 )
43+
{
44+
free(ptr);
45+
ptr = NULL;
46+
}
47+
}
48+
49+
return ptr;
50+
}
51+
52+
VOID
53+
SYMCRYPT_CALL
54+
SymCryptCallbackFreeMutexFastInproc( PVOID pMutex )
55+
{
56+
pthread_mutex_destroy( (pthread_mutex_t *)pMutex );
57+
58+
free(pMutex);
59+
}
60+
61+
VOID
62+
SYMCRYPT_CALL
63+
SymCryptCallbackAcquireMutexFastInproc( PVOID pMutex )
64+
{
65+
pthread_mutex_lock( (pthread_mutex_t *)pMutex );
66+
}
67+
68+
VOID
69+
SYMCRYPT_CALL
70+
SymCryptCallbackReleaseMutexFastInproc( PVOID pMutex )
71+
{
72+
pthread_mutex_unlock( (pthread_mutex_t *)pMutex );
73+
}

‎modules/linux/common/callbacks_singlethreaded.c‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
//
2+
// callbacks_singlethreaded.c
3+
// Contains symcrypt call back functions for single threaded applications.
4+
//
5+
// Copyright (c) Microsoft Corporation. Licensed under the MIT license.
6+
//
7+
8+
#include "precomp.h"
9+
10+
PVOID
11+
SYMCRYPT_CALL
12+
SymCryptCallbackAlloc( SIZE_T nBytes )
13+
{
14+
return aligned_alloc(SYMCRYPT_ASYM_ALIGN_VALUE, nBytes);;
15+
}
16+
17+
VOID
18+
SYMCRYPT_CALL
19+
SymCryptCallbackFree( VOID * pMem )
20+
{
21+
free( pMem );
22+
}
23+
24+
SYMCRYPT_ERROR
25+
SYMCRYPT_CALL
26+
SymCryptCallbackRandom( PBYTE pbBuffer, SIZE_T cbBuffer )
27+
{
28+
SymCryptRandom( pbBuffer, cbBuffer );
29+
return SYMCRYPT_NO_ERROR;
30+
}
31+
32+
PVOID
33+
SYMCRYPT_CALL
34+
SymCryptCallbackAllocateMutexFastInproc(void)
35+
{
36+
static const BYTE byte = 0;
37+
38+
// we want to return a valid non-NULL address so caller can check for NULL
39+
return (PVOID)&byte;
40+
}
41+
42+
VOID
43+
SYMCRYPT_CALL
44+
SymCryptCallbackFreeMutexFastInproc( PVOID pMutex ) {}
45+
46+
VOID
47+
SYMCRYPT_CALL
48+
SymCryptCallbackAcquireMutexFastInproc( PVOID pMutex ) {}
49+
50+
VOID
51+
SYMCRYPT_CALL
52+
SymCryptCallbackReleaseMutexFastInproc( PVOID pMutex ) {}

0 commit comments

Comments
 (0)