1CFG_CRYPTO ?= y 2# Select small code size in the crypto library if applicable (for instance 3# LibTomCrypt has -DLTC_SMALL_CODE) 4# Note: the compiler flag -Os is not set here but by CFG_CC_OPTIMIZE_FOR_SIZE 5CFG_CRYPTO_SIZE_OPTIMIZATION ?= y 6 7ifeq (y,$(CFG_CRYPTO)) 8 9# Ciphers 10CFG_CRYPTO_AES ?= y 11CFG_CRYPTO_DES ?= y 12CFG_CRYPTO_SM4 ?= y 13 14# Cipher block modes 15CFG_CRYPTO_ECB ?= y 16CFG_CRYPTO_CBC ?= y 17CFG_CRYPTO_CTR ?= y 18CFG_CRYPTO_CTS ?= y 19CFG_CRYPTO_XTS ?= y 20 21# Message authentication codes 22CFG_CRYPTO_HMAC ?= y 23CFG_CRYPTO_CMAC ?= y 24CFG_CRYPTO_CBC_MAC ?= y 25 26# Hashes 27CFG_CRYPTO_MD5 ?= y 28CFG_CRYPTO_SHA1 ?= y 29CFG_CRYPTO_SHA224 ?= y 30CFG_CRYPTO_SHA256 ?= y 31CFG_CRYPTO_SHA384 ?= y 32CFG_CRYPTO_SHA512 ?= y 33CFG_CRYPTO_SHA512_256 ?= y 34CFG_CRYPTO_SM3 ?= y 35 36# Asymmetric ciphers 37CFG_CRYPTO_DSA ?= y 38CFG_CRYPTO_RSA ?= y 39CFG_CRYPTO_DH ?= y 40CFG_CRYPTO_ECC ?= y 41 42# Authenticated encryption 43CFG_CRYPTO_CCM ?= y 44CFG_CRYPTO_GCM ?= y 45# Default uses the OP-TEE internal AES-GCM implementation 46CFG_CRYPTO_AES_GCM_FROM_CRYPTOLIB ?= n 47 48endif 49 50ifeq ($(CFG_WITH_PAGER),y) 51ifneq ($(CFG_CRYPTO_SHA256),y) 52$(warning Warning: Enabling CFG_CRYPTO_SHA256 [required by CFG_WITH_PAGER]) 53CFG_CRYPTO_SHA256:=y 54endif 55endif 56 57$(eval $(call cryp-enable-all-depends,CFG_WITH_SOFTWARE_PRNG, AES ECB SHA256)) 58 59ifeq ($(CFG_CRYPTO_WITH_CE),y) 60 61$(call force,CFG_AES_GCM_TABLE_BASED,n,conflicts with CFG_CRYPTO_WITH_CE) 62 63# CFG_HWSUPP_PMULT_64 defines whether the CPU supports polynomial multiplies 64# of 64-bit values (Aarch64: PMULL/PMULL2 with the 1Q specifier; Aarch32: 65# VMULL.P64). These operations are part of the Cryptographic Extensions, so 66# assume they are implicitly contained in CFG_CRYPTO_WITH_CE=y. 67CFG_HWSUPP_PMULT_64 ?= y 68 69ifeq ($(CFG_ARM32_core),y) 70CFG_CRYPTO_AES_ARM32_CE ?= $(CFG_CRYPTO_AES) 71CFG_CRYPTO_SHA1_ARM32_CE ?= $(CFG_CRYPTO_SHA1) 72CFG_CRYPTO_SHA256_ARM32_CE ?= $(CFG_CRYPTO_SHA256) 73endif 74 75ifeq ($(CFG_ARM64_core),y) 76CFG_CRYPTO_AES_ARM64_CE ?= $(CFG_CRYPTO_AES) 77CFG_CRYPTO_SHA1_ARM64_CE ?= $(CFG_CRYPTO_SHA1) 78CFG_CRYPTO_SHA256_ARM64_CE ?= $(CFG_CRYPTO_SHA256) 79endif 80 81else #CFG_CRYPTO_WITH_CE 82 83CFG_AES_GCM_TABLE_BASED ?= y 84 85endif #!CFG_CRYPTO_WITH_CE 86 87 88# Cryptographic extensions can only be used safely when OP-TEE knows how to 89# preserve the VFP context 90ifeq ($(CFG_CRYPTO_SHA256_ARM32_CE),y) 91$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA256_ARM32_CE) 92endif 93ifeq ($(CFG_CRYPTO_SHA256_ARM64_CE),y) 94$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA256_ARM64_CE) 95endif 96ifeq ($(CFG_CRYPTO_SHA1_ARM32_CE),y) 97$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA1_ARM32_CE) 98endif 99ifeq ($(CFG_CRYPTO_SHA1_ARM64_CE),y) 100$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_SHA1_ARM64_CE) 101endif 102ifeq ($(CFG_CRYPTO_AES_ARM64_CE),y) 103$(call force,CFG_WITH_VFP,y,required by CFG_CRYPTO_AES_ARM64_CE) 104endif 105 106cryp-enable-all-depends = $(call cfg-enable-all-depends,$(strip $(1)),$(foreach v,$(2),CFG_CRYPTO_$(v))) 107$(eval $(call cryp-enable-all-depends,CFG_REE_FS, AES ECB CTR HMAC SHA256 GCM)) 108$(eval $(call cryp-enable-all-depends,CFG_RPMB_FS, AES ECB CTR HMAC SHA256 GCM)) 109 110# Dependency checks: warn and disable some features if dependencies are not met 111 112cryp-dep-one = $(call cfg-depends-one,CFG_CRYPTO_$(strip $(1)),$(patsubst %, CFG_CRYPTO_%,$(strip $(2)))) 113cryp-dep-all = $(call cfg-depends-all,CFG_CRYPTO_$(strip $(1)),$(patsubst %, CFG_CRYPTO_%,$(strip $(2)))) 114 115$(eval $(call cryp-dep-one, ECB, AES DES)) 116$(eval $(call cryp-dep-one, CBC, AES DES)) 117$(eval $(call cryp-dep-one, CTR, AES)) 118# CTS is implemented with ECB and CBC 119$(eval $(call cryp-dep-all, CTS, AES ECB CBC)) 120$(eval $(call cryp-dep-one, XTS, AES)) 121$(eval $(call cryp-dep-one, HMAC, AES DES)) 122$(eval $(call cryp-dep-one, HMAC, MD5 SHA1 SHA224 SHA256 SHA384 SHA512)) 123$(eval $(call cryp-dep-one, CMAC, AES)) 124$(eval $(call cryp-dep-one, CBC_MAC, AES DES)) 125$(eval $(call cryp-dep-one, CCM, AES)) 126$(eval $(call cryp-dep-one, GCM, AES)) 127# If no AES cipher mode is left, disable AES 128$(eval $(call cryp-dep-one, AES, ECB CBC CTR CTS XTS)) 129# If no DES cipher mode is left, disable DES 130$(eval $(call cryp-dep-one, DES, ECB CBC)) 131 132############################################################### 133# libtomcrypt (LTC) specifics, phase #1 134# LTC is only configured via _CFG_CORE_LTC_ prefixed variables 135# 136# _CFG_CORE_LTC_xxx_DESC means that LTC will only register the 137# descriptor of the algorithm, not provide a 138# crypt_xxx_alloc_ctx() function. 139############################################################### 140 141# If LTC is the cryptolib, pull configuration from CFG_CRYPTO_xxx 142ifeq ($(CFG_CRYPTOLIB_NAME),tomcrypt) 143# dsa_make_params() needs all three SHA-2 algorithms. 144# Disable DSA if any is missing. 145$(eval $(call cryp-dep-all, DSA, SHA256 SHA384 SHA512)) 146 147# Assign _CFG_CORE_LTC_xxx based on CFG_CRYPTO_yyy 148core-ltc-vars = AES DES 149core-ltc-vars += ECB CBC CTR CTS XTS 150core-ltc-vars += MD5 SHA1 SHA224 SHA256 SHA384 SHA512 SHA512_256 151core-ltc-vars += HMAC CMAC CBC_MAC 152core-ltc-vars += CCM 153ifeq ($(CFG_CRYPTO_AES_GCM_FROM_CRYPTOLIB),y) 154core-ltc-vars += GCM 155endif 156core-ltc-vars += RSA DSA DH ECC 157core-ltc-vars += AES_ARM64_CE AES_ARM32_CE 158core-ltc-vars += SHA1_ARM32_CE SHA1_ARM64_CE 159core-ltc-vars += SHA256_ARM32_CE SHA256_ARM64_CE 160core-ltc-vars += SIZE_OPTIMIZATION 161# Assigned selected CFG_CRYPTO_xxx as _CFG_CORE_LTC_xxx 162$(foreach v, $(core-ltc-vars), $(eval _CFG_CORE_LTC_$(v) := $(CFG_CRYPTO_$(v)))) 163_CFG_CORE_LTC_MPI := $(CFG_CORE_MBEDTLS_MPI) 164endif 165 166############################################################### 167# mbedtls specifics 168############################################################### 169 170ifeq ($(CFG_CRYPTOLIB_NAME),mbedtls) 171# mbedtls has to be complemented with some algorithms by LTC 172# Specify the algorithms here 173_CFG_CORE_LTC_DSA := $(CFG_CRYPTO_DSA) 174_CFG_CORE_LTC_MPI := $(CFG_CRYPTO_DSA) 175_CFG_CORE_LTC_SHA256_DESC := $(CFG_CRYPTO_DSA) 176_CFG_CORE_LTC_SHA384_DESC := $(CFG_CRYPTO_DSA) 177_CFG_CORE_LTC_SHA512_DESC := $(CFG_CRYPTO_DSA) 178_CFG_CORE_LTC_XTS := $(CFG_CRYPTO_XTS) 179_CFG_CORE_LTC_CCM := $(CFG_CRYPTO_CCM) 180_CFG_CORE_LTC_AES_DESC := $(call cfg-one-enabled, CFG_CRYPTO_XTS CFG_CRYPTO_CCM) 181endif 182 183############################################################### 184# libtomcrypt (LTC) specifics, phase #2 185############################################################### 186 187# Assign system variables 188_CFG_CORE_LTC_CE := $(CFG_CRYPTO_WITH_CE) 189_CFG_CORE_LTC_VFP := $(CFG_WITH_VFP) 190_CFG_CORE_LTC_BIGNUM_MAX_BITS := $(CFG_CORE_BIGNUM_MAX_BITS) 191_CFG_CORE_LTC_PAGER := $(CFG_WITH_PAGER) 192_CFG_CORE_LTC_OPTEE_THREAD := $(CFG_LTC_OPTEE_THREAD) 193_CFG_CORE_LTC_HWSUPP_PMULL := $(CFG_HWSUPP_PMULL) 194 195# Assign aggregated variables 196ltc-one-enabled = $(call cfg-one-enabled,$(foreach v,$(1),_CFG_CORE_LTC_$(v))) 197_CFG_CORE_LTC_ACIPHER := $(call ltc-one-enabled, RSA DSA DH ECC) 198_CFG_CORE_LTC_AUTHENC := $(and $(filter y,$(_CFG_CORE_LTC_AES) \ 199 $(_CFG_CORE_LTC_AES_DESC)), \ 200 $(filter y,$(call ltc-one-enabled, CCM GCM))) 201_CFG_CORE_LTC_CIPHER := $(call ltc-one-enabled, AES AES_DESC DES) 202_CFG_CORE_LTC_HASH := $(call ltc-one-enabled, MD5 SHA1 SHA224 SHA256 SHA384 \ 203 SHA512) 204_CFG_CORE_LTC_MAC := $(call ltc-one-enabled, HMAC CMAC CBC_MAC) 205_CFG_CORE_LTC_CBC := $(call ltc-one-enabled, CBC CBC_MAC) 206_CFG_CORE_LTC_ASN1 := $(call ltc-one-enabled, RSA DSA ECC) 207