1CFG_CRYPTO ?= y 2CFG_CRYPTO_SIZE_OPTIMIZATION ?= y 3 4ifeq (y,$(CFG_CRYPTO)) 5 6# Ciphers 7CFG_CRYPTO_AES ?= y 8CFG_CRYPTO_DES ?= y 9 10# Cipher block modes 11CFG_CRYPTO_ECB ?= y 12CFG_CRYPTO_CBC ?= y 13CFG_CRYPTO_CTR ?= y 14CFG_CRYPTO_CTS ?= y 15CFG_CRYPTO_XTS ?= y 16 17# Message authentication codes 18CFG_CRYPTO_HMAC ?= y 19CFG_CRYPTO_CMAC ?= y 20CFG_CRYPTO_CBC_MAC ?= y 21 22# Hashes 23CFG_CRYPTO_MD5 ?= y 24CFG_CRYPTO_SHA1 ?= y 25CFG_CRYPTO_SHA224 ?= y 26CFG_CRYPTO_SHA256 ?= y 27CFG_CRYPTO_SHA384 ?= y 28CFG_CRYPTO_SHA512 ?= y 29 30# Asymmetric ciphers 31CFG_CRYPTO_DSA ?= y 32CFG_CRYPTO_RSA ?= y 33CFG_CRYPTO_DH ?= y 34CFG_CRYPTO_ECC ?= y 35 36# Authenticated encryption 37CFG_CRYPTO_CCM ?= y 38CFG_CRYPTO_GCM ?= y 39# Default uses the OP-TEE internal AES-GCM implementation 40CFG_CRYPTO_AES_GCM_FROM_CRYPTOLIB ?= n 41 42endif 43 44ifeq ($(CFG_WITH_PAGER),y) 45ifneq ($(CFG_CRYPTO_SHA256),y) 46$(warning Warning: Enabling CFG_CRYPTO_SHA256 [required by CFG_WITH_PAGER]) 47CFG_CRYPTO_SHA256:=y 48endif 49endif 50 51$(eval $(call cryp-enable-all-depends,CFG_WITH_SOFTWARE_PRNG, AES ECB SHA256)) 52 53ifeq ($(CFG_CRYPTO_WITH_CE),y) 54 55$(call force,CFG_AES_GCM_TABLE_BASED,n,conflicts with CFG_CRYPTO_WITH_CE) 56 57# CFG_HWSUPP_PMULT_64 defines whether the CPU supports polynomial multiplies 58# of 64-bit values (Aarch64: PMULL/PMULL2 with the 1Q specifier; Aarch32: 59# VMULL.P64). These operations are part of the Cryptographic Extensions, so 60# assume they are implicitly contained in CFG_CRYPTO_WITH_CE=y. 61CFG_HWSUPP_PMULT_64 ?= y 62 63ifeq ($(CFG_ARM32_core),y) 64CFG_CRYPTO_AES_ARM32_CE ?= $(CFG_CRYPTO_AES) 65CFG_CRYPTO_SHA1_ARM32_CE ?= $(CFG_CRYPTO_SHA1) 66CFG_CRYPTO_SHA256_ARM32_CE ?= $(CFG_CRYPTO_SHA256) 67endif 68 69ifeq ($(CFG_ARM64_core),y) 70CFG_CRYPTO_AES_ARM64_CE ?= $(CFG_CRYPTO_AES) 71CFG_CRYPTO_SHA1_ARM64_CE ?= $(CFG_CRYPTO_SHA1) 72CFG_CRYPTO_SHA256_ARM64_CE ?= $(CFG_CRYPTO_SHA256) 73endif 74 75else #CFG_CRYPTO_WITH_CE 76 77CFG_AES_GCM_TABLE_BASED ?= y 78 79endif #!CFG_CRYPTO_WITH_CE 80 81 82# Cryptographic extensions can only be used safely when OP-TEE knows how to 83# preserve the VFP context 84ifeq ($(CFG_CRYPTO_SHA256_ARM32_CE),y) 85$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA256_ARM32_CE) 86endif 87ifeq ($(CFG_CRYPTO_SHA256_ARM64_CE),y) 88$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA256_ARM64_CE) 89endif 90ifeq ($(CFG_CRYPTO_SHA1_ARM32_CE),y) 91$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA1_ARM32_CE) 92endif 93ifeq ($(CFG_CRYPTO_SHA1_ARM64_CE),y) 94$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA1_ARM64_CE) 95endif 96ifeq ($(CFG_CRYPTO_AES_ARM64_CE),y) 97$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_AES_ARM64_CE) 98endif 99 100cryp-enable-all-depends = $(call cfg-enable-all-depends,$(strip $(1)),$(foreach v,$(2),CFG_CRYPTO_$(v))) 101$(eval $(call cryp-enable-all-depends,CFG_REE_FS, AES ECB CTR HMAC SHA256 GCM)) 102$(eval $(call cryp-enable-all-depends,CFG_RPMB_FS, AES ECB CTR HMAC SHA256 GCM)) 103 104# Dependency checks: warn and disable some features if dependencies are not met 105 106cryp-dep-one = $(call cfg-depends-one,CFG_CRYPTO_$(strip $(1)),$(patsubst %, CFG_CRYPTO_%,$(strip $(2)))) 107cryp-dep-all = $(call cfg-depends-all,CFG_CRYPTO_$(strip $(1)),$(patsubst %, CFG_CRYPTO_%,$(strip $(2)))) 108 109$(eval $(call cryp-dep-one, ECB, AES DES)) 110$(eval $(call cryp-dep-one, CBC, AES DES)) 111$(eval $(call cryp-dep-one, CTR, AES)) 112# CTS is implemented with ECB and CBC 113$(eval $(call cryp-dep-all, CTS, AES ECB CBC)) 114$(eval $(call cryp-dep-one, XTS, AES)) 115$(eval $(call cryp-dep-one, HMAC, AES DES)) 116$(eval $(call cryp-dep-one, HMAC, MD5 SHA1 SHA224 SHA256 SHA384 SHA512)) 117$(eval $(call cryp-dep-one, CMAC, AES)) 118$(eval $(call cryp-dep-one, CBC_MAC, AES DES)) 119$(eval $(call cryp-dep-one, CCM, AES)) 120$(eval $(call cryp-dep-one, GCM, AES)) 121# If no AES cipher mode is left, disable AES 122$(eval $(call cryp-dep-one, AES, ECB CBC CTR CTS XTS)) 123# If no DES cipher mode is left, disable DES 124$(eval $(call cryp-dep-one, DES, ECB CBC)) 125 126# dsa_make_params() needs all three SHA-2 algorithms. 127# Disable DSA if any is missing. 128$(eval $(call cryp-dep-all, DSA, SHA256 SHA384 SHA512)) 129 130cryp-one-enabled = $(call cfg-one-enabled,$(foreach v,$(1),CFG_CRYPTO_$(v))) 131cryp-all-enabled = $(call cfg-all-enabled,$(foreach v,$(1),CFG_CRYPTO_$(v))) 132 133_CFG_CRYPTO_WITH_ACIPHER := $(call cryp-one-enabled, RSA DSA DH ECC) 134_CFG_CRYPTO_WITH_AUTHENC := $(and $(filter y,$(CFG_CRYPTO_AES)), $(call cryp-one-enabled, CCM GCM)) 135_CFG_CRYPTO_WITH_CIPHER := $(call cryp-one-enabled, AES DES) 136_CFG_CRYPTO_WITH_HASH := $(call cryp-one-enabled, MD5 SHA1 SHA224 SHA256 SHA384 SHA512) 137_CFG_CRYPTO_WITH_MAC := $(call cryp-one-enabled, HMAC CMAC CBC_MAC) 138_CFG_CRYPTO_WITH_CBC := $(call cryp-one-enabled, CBC CBC_MAC) 139_CFG_CRYPTO_WITH_ASN1 := $(call cryp-one-enabled, RSA DSA ECC) 140