From 352928530815dd17903a61ec9210a60a99b936d7 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 27 Sep 2023 15:41:56 +0200 Subject: [PATCH 1/3] Fix include path to psa/crypto_spe.h We can't have a public header or library file reference our test environment (except possibly under test-only options, and even so, it would be with great reluctance). This breaks the build for other people. Fix #8259. Signed-off-by: Gilles Peskine --- include/psa/crypto_platform.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/psa/crypto_platform.h b/include/psa/crypto_platform.h index 35a42f825a..ee41c897f6 100644 --- a/include/psa/crypto_platform.h +++ b/include/psa/crypto_platform.h @@ -83,7 +83,7 @@ static inline int mbedtls_key_owner_id_equal(mbedtls_key_owner_id_t id1, */ #if defined(MBEDTLS_PSA_CRYPTO_SPM) #define PSA_CRYPTO_SECURE 1 -#include "../tests/include/spe/crypto_spe.h" +#include "crypto_spe.h" #endif // MBEDTLS_PSA_CRYPTO_SPM #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) From 7a6836b9f246b2c0e9b0e763104bdabbb9026788 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 27 Sep 2023 15:48:47 +0200 Subject: [PATCH 2/3] Document that MBEDTLS_PSA_CRYPTO_SPM needs crypto_spe.h Signed-off-by: Gilles Peskine --- include/mbedtls/mbedtls_config.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/include/mbedtls/mbedtls_config.h b/include/mbedtls/mbedtls_config.h index e9354da5a4..1c541ca4b0 100644 --- a/include/mbedtls/mbedtls_config.h +++ b/include/mbedtls/mbedtls_config.h @@ -1410,6 +1410,13 @@ * NSPE (Non-Secure Process Environment) and an SPE (Secure Process * Environment). * + * If you enable this option, your build environment must include a header + * file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS + * header files, or in another directory on the compiler's include search + * path). Alternatively, your platform may customize the header + * `psa/crypto_platform.h`, in which case it can skip or replace the + * inclusion of `"crypto_spe.h"`. + * * Module: library/psa_crypto.c * Requires: MBEDTLS_PSA_CRYPTO_C * From c1bedfe1846a76d73f732fffcd459b7be503f4bd Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Wed, 27 Sep 2023 15:53:08 +0200 Subject: [PATCH 3/3] Put crypto_spe.h on the include search path where needed Signed-off-by: Gilles Peskine --- tests/scripts/all.sh | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh index c85d4865ed..8213fd65dd 100755 --- a/tests/scripts/all.sh +++ b/tests/scripts/all.sh @@ -2957,7 +2957,7 @@ component_test_tfm_config_p256m_driver_accel_ec () { loc_accel_flags="$( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )" # Build crypto library specifying we want to use P256M code for EC operations - make CFLAGS="$ASAN_CFLAGS $loc_accel_flags -DMBEDTLS_PSA_P256M_DRIVER_ENABLED" LDFLAGS="$ASAN_CFLAGS" + make CFLAGS="$ASAN_CFLAGS $loc_accel_flags -DMBEDTLS_PSA_P256M_DRIVER_ENABLED -I../tests/include/spe" LDFLAGS="$ASAN_CFLAGS" # Make sure any built-in EC alg was not re-enabled by accident (additive config) not grep mbedtls_ecdsa_ library/ecdsa.o @@ -2981,7 +2981,7 @@ component_test_tfm_config() { common_tfm_config msg "build: TF-M config" - make tests + make CFLAGS='-Werror -Wall -Wextra -I../tests/include/spe' tests msg "test: TF-M config" make test @@ -3856,7 +3856,7 @@ component_build_tfm_armcc() { msg "build: TF-M config, armclang armv7-m thumb2" make clean - armc6_build_test "--target=arm-arm-none-eabi -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused" + armc6_build_test "--target=arm-arm-none-eabi -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../tests/include/spe" } component_build_tfm() { @@ -3865,11 +3865,11 @@ component_build_tfm() { cp configs/crypto_config_profile_medium.h "$CRYPTO_CONFIG_H" msg "build: TF-M config, clang, armv7-m thumb2" - make lib CC="clang" CFLAGS="--target=arm-linux-gnueabihf -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused" + make lib CC="clang" CFLAGS="--target=arm-linux-gnueabihf -march=armv7-m -mthumb -Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wimplicit-fallthrough -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wasm-operand-widths -Wunused -I../tests/include/spe" msg "build: TF-M config, gcc native build" make clean - make lib CC="gcc" CFLAGS="-Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wformat-signedness -Wlogical-op" + make lib CC="gcc" CFLAGS="-Os -std=c99 -Werror -Wall -Wextra -Wwrite-strings -Wpointer-arith -Wshadow -Wvla -Wformat=2 -Wno-format-nonliteral -Wshadow -Wformat-signedness -Wlogical-op -I../tests/include/spe" } component_build_aes_variations() { # ~45s