Skip to content

Commit 4dabb1f

Browse files
Vge0rgenordicjm
Vge0rge
authored and
nordicjm
committed
nrf_security: Make the sxsymcrypt free functions return int
The mac/aead/blockipher _free functions had a void type even though they are calling the key_clean function pointers which return int. This changes the return type of the functions to return int so that they can propagate a possible failure by the key_clean functions. Signed-off-by: Georgios Vasilakis <[email protected]>
1 parent 2cba377 commit 4dabb1f

File tree

8 files changed

+83
-69
lines changed

8 files changed

+83
-69
lines changed

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/cipher.c‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -807,7 +807,13 @@ psa_status_t cracen_cipher_finish(cracen_cipher_operation_t *operation, uint8_t
807807

808808
psa_status_t cracen_cipher_abort(cracen_cipher_operation_t *operation)
809809
{
810-
sx_blkcipher_free(&operation->cipher);
810+
int sx_status;
811+
812+
sx_status = sx_blkcipher_free(&operation->cipher);
813+
if (sx_status != SX_OK) {
814+
return silex_statuscodes_to_psa(sx_status);
815+
}
816+
811817
safe_memzero(operation, sizeof(cracen_cipher_operation_t));
812818
return PSA_SUCCESS;
813819
}

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1420,6 +1420,7 @@ psa_status_t cracen_export_key(const psa_key_attributes_t *attributes, const uin
14201420
{
14211421
#ifdef CONFIG_PSA_NEED_CRACEN_KMU_DRIVER
14221422
int status;
1423+
int nested_err;
14231424
psa_key_location_t location =
14241425
PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
14251426

@@ -1454,8 +1455,10 @@ psa_status_t cracen_export_key(const psa_key_attributes_t *attributes, const uin
14541455
*data_length = key_out_size;
14551456
}
14561457

1457-
(void)cracen_kmu_clean_key(key_buffer);
1458+
nested_err = cracen_kmu_clean_key(key_buffer);
1459+
14581460
nrf_security_mutex_unlock(cracen_mutex_symmetric);
1461+
status = sx_handle_nested_error(nested_err, status);
14591462

14601463
return silex_statuscodes_to_psa(status);
14611464
}
@@ -1488,26 +1491,30 @@ psa_status_t cracen_copy_key(psa_key_attributes_t *attributes, const uint8_t *so
14881491
target_key_buffer_length, &key_bits);
14891492
}
14901493

1491-
int status;
1494+
int sx_status;
1495+
int nested_err;
14921496
psa_status_t psa_status;
14931497
size_t key_size = PSA_BITS_TO_BYTES(psa_get_key_bits(attributes));
14941498

14951499
nrf_security_mutex_lock(cracen_mutex_symmetric);
1496-
status = cracen_kmu_prepare_key(source_key);
1500+
sx_status = cracen_kmu_prepare_key(source_key);
14971501

1498-
if (status == SX_OK) {
1502+
if (sx_status == SX_OK) {
14991503
size_t key_bits;
15001504

15011505
psa_status = cracen_import_key(attributes, kmu_push_area, key_size,
15021506
target_key_buffer, target_key_buffer_size,
15031507
target_key_buffer_length, &key_bits);
15041508
}
15051509

1506-
(void)cracen_kmu_clean_key(source_key);
1510+
nested_err = cracen_kmu_clean_key(source_key);
1511+
15071512
nrf_security_mutex_unlock(cracen_mutex_symmetric);
15081513

1509-
if (status != SX_OK) {
1510-
return silex_statuscodes_to_psa(status);
1514+
sx_status = sx_handle_nested_error(nested_err, sx_status);
1515+
1516+
if (sx_status != SX_OK) {
1517+
return silex_statuscodes_to_psa(sx_status);
15111518
}
15121519

15131520
return psa_status;

‎subsys/nrf_security/src/drivers/cracen/sxsymcrypt/include/sxsymcrypt/aes.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -388,8 +388,10 @@ static inline bool sx_aead_aesccm_nonce_size_is_valid(size_t noncesz)
388388
* @brief Free resources related to blkcipher operation.
389389
*
390390
* @param[out] c block cipher operation context
391+
*
392+
* @return sxsymcrypt status code.
391393
*/
392-
void sx_blkcipher_free(struct sxblkcipher *c);
394+
int sx_blkcipher_free(struct sxblkcipher *c);
393395
#ifdef __cplusplus
394396
}
395397
#endif

‎subsys/nrf_security/src/drivers/cracen/sxsymcrypt/include/sxsymcrypt/internal.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ extern "C" {
1313
#include <stdint.h>
1414
#include <stddef.h>
1515
#include <stdbool.h>
16+
#include <cracen/statuscodes.h>
1617

1718
#ifndef SX_EXTRA_IN_DESCS
1819
#define SX_EXTRA_IN_DESCS 0
@@ -168,6 +169,20 @@ struct sxcmmask {
168169
struct sxchannel channel;
169170
};
170171

172+
/**
173+
* @brief Function to handle CRACEN nested errors in the sxsymcrypt
174+
*
175+
* @param[in] nested_err Nested error occurred while handling an error.
176+
* @param[in] err Original error code.
177+
*
178+
* @return Return the nested error if it is not SX_OK, otherwise return
179+
* the original error code.
180+
*/
181+
inline int sx_handle_nested_error(int nested_err, int err)
182+
{
183+
return nested_err ? nested_err != SX_OK : err;
184+
}
185+
171186
#ifdef __cplusplus
172187
}
173188
#endif

‎subsys/nrf_security/src/drivers/cracen/sxsymcrypt/include/sxsymcrypt/mac.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,8 +164,9 @@ int sx_mac_status(struct sxmac *c);
164164
*
165165
* @param[in,out] c MAC operation context
166166
*
167+
* @return sxsymcrypt status code.
167168
*/
168-
void sx_mac_free(struct sxmac *c);
169+
int sx_mac_free(struct sxmac *c);
169170

170171
/** Find an available MAC engine for the operation.
171172
*

‎subsys/nrf_security/src/drivers/cracen/sxsymcrypt/src/aead.c‎

Lines changed: 18 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -95,12 +95,15 @@ static int lenAlenC_aesgcm_ba411(size_t aadsz, size_t datasz, uint8_t *out)
9595
return 1;
9696
}
9797

98-
void sx_aead_free(struct sxaead *c)
98+
int sx_aead_free(struct sxaead *c)
9999
{
100+
int sx_err = SX_OK;
101+
100102
if (c->key->clean_key) {
101-
c->key->clean_key(c->key->user_data);
103+
sx_err = c->key->clean_key(c->key->user_data);
102104
}
103105
sx_cmdma_release_hw(&c->dma);
106+
return sx_err;
104107
}
105108

106109
int sx_aead_hw_reserve(struct sxaead *c)
@@ -130,7 +133,7 @@ int sx_aead_hw_reserve(struct sxaead *c)
130133

131134
exit:
132135
if (err != SX_OK) {
133-
sx_aead_free(c);
136+
return sx_handle_nested_error(sx_aead_free(c), err);
134137
}
135138

136139
return err;
@@ -294,12 +297,10 @@ int sx_aead_feed_aad(struct sxaead *c, const char *aad, size_t aadsz)
294297
return SX_ERR_UNINITIALIZED_OBJ;
295298
}
296299
if (aadsz >= DMA_MAX_SZ) {
297-
sx_aead_free(c);
298-
return SX_ERR_TOO_BIG;
300+
return sx_handle_nested_error(sx_aead_free(c), SX_ERR_TOO_BIG);
299301
}
300302
if (c->dataintotalsz) {
301-
sx_aead_free(c);
302-
return SX_ERR_FEED_AFTER_DATA;
303+
return sx_handle_nested_error(sx_aead_free(c), SX_ERR_FEED_AFTER_DATA);
303304
}
304305

305306
c->totalaadsz += aadsz;
@@ -324,8 +325,7 @@ int sx_aead_crypt(struct sxaead *c, const char *datain, size_t datainsz, char *d
324325
return SX_ERR_UNINITIALIZED_OBJ;
325326
}
326327
if (datainsz >= DMA_MAX_SZ) {
327-
sx_aead_free(c);
328-
return SX_ERR_TOO_BIG;
328+
return sx_handle_nested_error(sx_aead_free(c), SX_ERR_TOO_BIG);
329329
}
330330

331331
sx_aead_discard_aad(c);
@@ -354,13 +354,12 @@ int sx_aead_produce_tag(struct sxaead *c, char *tagout)
354354
if (c->cfg->mode == BA411_MODEID_CCM) {
355355
if ((c->dma.dmamem.cfg & c->cfg->ctxload) && (c->datainsz == 0) &&
356356
(c->discardaadsz == 0)) {
357-
sx_aead_free(c);
358-
return SX_ERR_INPUT_BUFFER_TOO_SMALL;
357+
return sx_handle_nested_error(sx_aead_free(c),
358+
SX_ERR_INPUT_BUFFER_TOO_SMALL);
359359
}
360360
}
361361
if ((c->dataintotalsz + c->totalaadsz) < c->cfg->inputminsz) {
362-
sx_aead_free(c);
363-
return SX_ERR_INCOMPATIBLE_HW;
362+
return sx_handle_nested_error(sx_aead_free(c), SX_ERR_INCOMPATIBLE_HW);
364363
}
365364

366365
if (c->cfg->lenAlenC(c->totalaadsz, c->dataintotalsz, &c->extramem[0])) {
@@ -385,13 +384,12 @@ int sx_aead_verify_tag(struct sxaead *c, const char *tagin)
385384
if (c->cfg->mode == BA411_MODEID_CCM) {
386385
if ((c->dma.dmamem.cfg & c->cfg->ctxload) && (c->datainsz == 0) &&
387386
(c->discardaadsz == 0)) {
388-
sx_aead_free(c);
389-
return SX_ERR_INPUT_BUFFER_TOO_SMALL;
387+
return sx_handle_nested_error(sx_aead_free(c),
388+
SX_ERR_INPUT_BUFFER_TOO_SMALL);
390389
}
391390
}
392391
if ((c->dataintotalsz + c->totalaadsz) < c->cfg->inputminsz) {
393-
sx_aead_free(c);
394-
return SX_ERR_INCOMPATIBLE_HW;
392+
return sx_handle_nested_error(sx_aead_free(c), SX_ERR_INCOMPATIBLE_HW);
395393
}
396394

397395
if (c->cfg->lenAlenC(c->totalaadsz, c->dataintotalsz, &c->extramem[0])) {
@@ -449,8 +447,7 @@ int sx_aead_save_state(struct sxaead *c)
449447
}
450448

451449
if (c->cfg->statesz == 0) {
452-
sx_aead_free(c);
453-
return SX_ERR_CONTEXT_SAVING_NOT_SUPPORTED;
450+
return sx_handle_nested_error(sx_aead_free(c), SX_ERR_CONTEXT_SAVING_NOT_SUPPORTED);
454451
}
455452

456453
sx_aead_discard_aad(c);
@@ -477,8 +474,7 @@ int sx_aead_status(struct sxaead *c)
477474
return r;
478475
}
479476
if (r) {
480-
sx_aead_free(c);
481-
return r;
477+
return sx_handle_nested_error(sx_aead_free(c), r);
482478
}
483479

484480
#if CONFIG_DCACHE
@@ -491,9 +487,7 @@ int sx_aead_status(struct sxaead *c)
491487
: SX_OK;
492488
}
493489

494-
sx_aead_free(c);
495-
496-
return r;
490+
return sx_handle_nested_error(sx_aead_free(c), r);
497491
}
498492

499493
int sx_aead_wait(struct sxaead *c)

‎subsys/nrf_security/src/drivers/cracen/sxsymcrypt/src/blkcipher.c‎

Lines changed: 13 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -78,12 +78,14 @@ static const struct sx_blkcipher_cmdma_cfg ba411xtscfg = {
7878
.blocksz = BLKCIPHER_BLOCK_SZ,
7979
};
8080

81-
void sx_blkcipher_free(struct sxblkcipher *c)
81+
int sx_blkcipher_free(struct sxblkcipher *c)
8282
{
83+
int sx_err = SX_OK;
8384
if (c->key.clean_key) {
84-
c->key.clean_key(c->key.user_data);
85+
sx_err = c->key.clean_key(c->key.user_data);
8586
}
8687
sx_cmdma_release_hw(&c->dma);
88+
return sx_err;
8789
}
8890

8991

@@ -111,7 +113,7 @@ static int sx_blkcipher_hw_reserve(struct sxblkcipher *c)
111113

112114
exit:
113115
if (err != SX_OK) {
114-
sx_blkcipher_free(c);
116+
return sx_handle_nested_error(sx_blkcipher_free(c), err);
115117
}
116118

117119
return SX_OK;
@@ -269,8 +271,7 @@ int sx_blkcipher_crypt(struct sxblkcipher *c, const char *datain, size_t sz, cha
269271
return SX_ERR_UNINITIALIZED_OBJ;
270272
}
271273
if (sz >= DMA_MAX_SZ) {
272-
sx_blkcipher_free(c);
273-
return SX_ERR_TOO_BIG;
274+
return sx_handle_nested_error(sx_blkcipher_free(c), SX_ERR_TOO_BIG);
274275
}
275276

276277
c->textsz += sz;
@@ -287,12 +288,10 @@ int sx_blkcipher_run(struct sxblkcipher *c)
287288
}
288289

289290
if (c->textsz < c->cfg->inminsz) {
290-
sx_blkcipher_free(c);
291-
return SX_ERR_INPUT_BUFFER_TOO_SMALL;
291+
return sx_handle_nested_error(sx_blkcipher_free(c), SX_ERR_INPUT_BUFFER_TOO_SMALL);
292292
}
293293
if (c->textsz % c->cfg->granularity) {
294-
sx_blkcipher_free(c);
295-
return SX_ERR_WRONG_SIZE_GRANULARITY;
294+
return sx_handle_nested_error(sx_blkcipher_free(c), SX_ERR_WRONG_SIZE_GRANULARITY);
296295
}
297296

298297
if (c->dma.dmamem.cfg & c->cfg->ctxsave) {
@@ -345,17 +344,15 @@ int sx_blkcipher_save_state(struct sxblkcipher *c)
345344
}
346345

347346
if (c->cfg->statesz == 0) {
348-
sx_blkcipher_free(c);
349-
return SX_ERR_CONTEXT_SAVING_NOT_SUPPORTED;
347+
return sx_handle_nested_error(sx_blkcipher_free(c),
348+
SX_ERR_CONTEXT_SAVING_NOT_SUPPORTED);
350349
}
351350

352351
if (c->textsz < c->cfg->blocksz) {
353-
sx_blkcipher_free(c);
354-
return SX_ERR_INPUT_BUFFER_TOO_SMALL;
352+
return sx_handle_nested_error(sx_blkcipher_free(c), SX_ERR_INPUT_BUFFER_TOO_SMALL);
355353
}
356354
if (c->textsz & (c->cfg->blocksz - 1)) {
357-
sx_blkcipher_free(c);
358-
return SX_ERR_WRONG_SIZE_GRANULARITY;
355+
return sx_handle_nested_error(sx_blkcipher_free(c), SX_ERR_WRONG_SIZE_GRANULARITY);
359356
}
360357

361358
c->dma.dmamem.cfg |= c->cfg->ctxsave;
@@ -384,9 +381,7 @@ int sx_blkcipher_status(struct sxblkcipher *c)
384381
sys_cache_data_invd_range((void *)&c->extramem, sizeof(c->extramem));
385382
#endif
386383

387-
sx_blkcipher_free(c);
388-
389-
return r;
384+
return sx_handle_nested_error(sx_blkcipher_free(c), r);
390385
}
391386

392387
int sx_blkcipher_wait(struct sxblkcipher *c)

0 commit comments

Comments
 (0)