Gitiles
Code Review Sign In
gerrit.openbmc.org / openbmc / openbmc / 7784c4292cd9e369da612736deb0691153d1b786 / . / meta-arm / meta-arm-bsp / recipes-security / trusted-services / corstone1000 / 0012-add-psa-ipc-crypto-backend.patch
blob: 67ea7b8c560f6609b597cc65ba6dc038c7c86c15 [file] [log] [blame]
Patrick Williams7784c422022-11-17 07:29:11 -0600[diff] [blame^]1From 0b5d96b1a9f927dc141047600edf2249af7022c5 Mon Sep 17 00:00:00 2001
Patrick Williams975a06f2022-10-21 14:42:47 -0500[diff] [blame]2From: Rui Miguel Silva <rui.silva@linaro.org>
3Date: Thu, 9 Dec 2021 14:17:39 +0000
Patrick Williams7784c422022-11-17 07:29:11 -0600[diff] [blame^]4Subject: [PATCH 12/20] add psa ipc crypto backend
Patrick Williams975a06f2022-10-21 14:42:47 -0500[diff] [blame]5
6Add psa ipc crypto backend and attach it to se proxy
7deployment.
8
9Upstream-Status: Pending
10Signed-off-by: Rui Miguel Silva <rui.silva@linaro.org>
11---
12 components/service/common/include/psa/sid.h | 73 +++++
13 .../crypto/backend/psa_ipc/component.cmake | 21 ++
14 .../backend/psa_ipc/crypto_ipc_backend.c | 26 ++
15 .../backend/psa_ipc/crypto_ipc_backend.h | 70 ++++
16 .../client/caller/psa_ipc/crypto_caller.h | 34 ++
17 .../caller/psa_ipc/crypto_caller_aead.h | 252 +++++++++++++++
18 .../crypto_caller_asymmetric_decrypt.h | 76 +++++
19 .../crypto_caller_asymmetric_encrypt.h | 76 +++++
20 .../caller/psa_ipc/crypto_caller_cipher.h | 246 +++++++++++++++
21 .../caller/psa_ipc/crypto_caller_copy_key.h | 57 ++++
22 .../psa_ipc/crypto_caller_destroy_key.h | 51 +++
23 .../caller/psa_ipc/crypto_caller_export_key.h | 59 ++++
24 .../psa_ipc/crypto_caller_export_public_key.h | 59 ++++
25 .../psa_ipc/crypto_caller_generate_key.h | 55 ++++
26 .../psa_ipc/crypto_caller_generate_random.h | 57 ++++
27 .../crypto_caller_get_key_attributes.h | 56 ++++
28 .../caller/psa_ipc/crypto_caller_hash.h | 220 +++++++++++++
29 .../caller/psa_ipc/crypto_caller_import_key.h | 57 ++++
30 .../psa_ipc/crypto_caller_key_attributes.h | 51 +++
31 .../psa_ipc/crypto_caller_key_derivation.h | 298 ++++++++++++++++++
32 .../client/caller/psa_ipc/crypto_caller_mac.h | 207 ++++++++++++
33 .../caller/psa_ipc/crypto_caller_purge_key.h | 51 +++
34 .../caller/psa_ipc/crypto_caller_sign_hash.h | 64 ++++
35 .../psa_ipc/crypto_caller_verify_hash.h | 59 ++++
36 .../crypto/include/psa/crypto_client_struct.h | 8 +-
37 .../service/crypto/include/psa/crypto_sizes.h | 2 +-
38 .../se-proxy/common/service_proxy_factory.c | 15 +-
Patrick Williams975a06f2022-10-21 14:42:47 -0500[diff] [blame]39 .../providers/arm/corstone1000/platform.cmake | 2 +
Patrick Williams7784c422022-11-17 07:29:11 -0600[diff] [blame^]40 28 files changed, 2292 insertions(+), 10 deletions(-)
Patrick Williams975a06f2022-10-21 14:42:47 -0500[diff] [blame]41 create mode 100644 components/service/crypto/backend/psa_ipc/component.cmake
42 create mode 100644 components/service/crypto/backend/psa_ipc/crypto_ipc_backend.c
43 create mode 100644 components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h
44 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller.h
45 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h
46 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_decrypt.h
47 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_encrypt.h
48 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_cipher.h
49 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_copy_key.h
50 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_destroy_key.h
51 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_export_key.h
52 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_export_public_key.h
53 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_key.h
54 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_random.h
55 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_get_key_attributes.h
56 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_hash.h
57 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_import_key.h
58 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_key_attributes.h
59 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_key_derivation.h
60 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_mac.h
61 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_purge_key.h
62 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h
63 create mode 100644 components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h
64
65diff --git a/components/service/common/include/psa/sid.h b/components/service/common/include/psa/sid.h
66index 4a951d4a3502..7a29cc253bad 100644
67--- a/components/service/common/include/psa/sid.h
68+++ b/components/service/common/include/psa/sid.h
69@@ -37,6 +37,79 @@ extern "C" {
70 #define TFM_CRYPTO_VERSION (1U)
71 #define TFM_CRYPTO_HANDLE (0x40000100U)
72
73+/**
74+ * \brief Define a progressive numerical value for each SID which can be used
75+ * when dispatching the requests to the service
76+ */
77+enum {
78+ TFM_CRYPTO_GET_KEY_ATTRIBUTES_SID = (0u),
79+ TFM_CRYPTO_RESET_KEY_ATTRIBUTES_SID,
80+ TFM_CRYPTO_OPEN_KEY_SID,
81+ TFM_CRYPTO_CLOSE_KEY_SID,
82+ TFM_CRYPTO_IMPORT_KEY_SID,
83+ TFM_CRYPTO_DESTROY_KEY_SID,
84+ TFM_CRYPTO_EXPORT_KEY_SID,
85+ TFM_CRYPTO_EXPORT_PUBLIC_KEY_SID,
86+ TFM_CRYPTO_PURGE_KEY_SID,
87+ TFM_CRYPTO_COPY_KEY_SID,
88+ TFM_CRYPTO_HASH_COMPUTE_SID,
89+ TFM_CRYPTO_HASH_COMPARE_SID,
90+ TFM_CRYPTO_HASH_SETUP_SID,
91+ TFM_CRYPTO_HASH_UPDATE_SID,
92+ TFM_CRYPTO_HASH_FINISH_SID,
93+ TFM_CRYPTO_HASH_VERIFY_SID,
94+ TFM_CRYPTO_HASH_ABORT_SID,
95+ TFM_CRYPTO_HASH_CLONE_SID,
96+ TFM_CRYPTO_MAC_COMPUTE_SID,
97+ TFM_CRYPTO_MAC_VERIFY_SID,
98+ TFM_CRYPTO_MAC_SIGN_SETUP_SID,
99+ TFM_CRYPTO_MAC_VERIFY_SETUP_SID,
100+ TFM_CRYPTO_MAC_UPDATE_SID,
101+ TFM_CRYPTO_MAC_SIGN_FINISH_SID,
102+ TFM_CRYPTO_MAC_VERIFY_FINISH_SID,
103+ TFM_CRYPTO_MAC_ABORT_SID,
104+ TFM_CRYPTO_CIPHER_ENCRYPT_SID,
105+ TFM_CRYPTO_CIPHER_DECRYPT_SID,
106+ TFM_CRYPTO_CIPHER_ENCRYPT_SETUP_SID,
107+ TFM_CRYPTO_CIPHER_DECRYPT_SETUP_SID,
108+ TFM_CRYPTO_CIPHER_GENERATE_IV_SID,
109+ TFM_CRYPTO_CIPHER_SET_IV_SID,
110+ TFM_CRYPTO_CIPHER_UPDATE_SID,
111+ TFM_CRYPTO_CIPHER_FINISH_SID,
112+ TFM_CRYPTO_CIPHER_ABORT_SID,
113+ TFM_CRYPTO_AEAD_ENCRYPT_SID,
114+ TFM_CRYPTO_AEAD_DECRYPT_SID,
115+ TFM_CRYPTO_AEAD_ENCRYPT_SETUP_SID,
116+ TFM_CRYPTO_AEAD_DECRYPT_SETUP_SID,
117+ TFM_CRYPTO_AEAD_GENERATE_NONCE_SID,
118+ TFM_CRYPTO_AEAD_SET_NONCE_SID,
119+ TFM_CRYPTO_AEAD_SET_LENGTHS_SID,
120+ TFM_CRYPTO_AEAD_UPDATE_AD_SID,
121+ TFM_CRYPTO_AEAD_UPDATE_SID,
122+ TFM_CRYPTO_AEAD_FINISH_SID,
123+ TFM_CRYPTO_AEAD_VERIFY_SID,
124+ TFM_CRYPTO_AEAD_ABORT_SID,
125+ TFM_CRYPTO_SIGN_MESSAGE_SID,
126+ TFM_CRYPTO_VERIFY_MESSAGE_SID,
127+ TFM_CRYPTO_SIGN_HASH_SID,
128+ TFM_CRYPTO_VERIFY_HASH_SID,
129+ TFM_CRYPTO_ASYMMETRIC_ENCRYPT_SID,
130+ TFM_CRYPTO_ASYMMETRIC_DECRYPT_SID,
131+ TFM_CRYPTO_KEY_DERIVATION_SETUP_SID,
132+ TFM_CRYPTO_KEY_DERIVATION_GET_CAPACITY_SID,
133+ TFM_CRYPTO_KEY_DERIVATION_SET_CAPACITY_SID,
134+ TFM_CRYPTO_KEY_DERIVATION_INPUT_BYTES_SID,
135+ TFM_CRYPTO_KEY_DERIVATION_INPUT_KEY_SID,
136+ TFM_CRYPTO_KEY_DERIVATION_KEY_AGREEMENT_SID,
137+ TFM_CRYPTO_KEY_DERIVATION_OUTPUT_BYTES_SID,
138+ TFM_CRYPTO_KEY_DERIVATION_OUTPUT_KEY_SID,
139+ TFM_CRYPTO_KEY_DERIVATION_ABORT_SID,
140+ TFM_CRYPTO_RAW_KEY_AGREEMENT_SID,
141+ TFM_CRYPTO_GENERATE_RANDOM_SID,
142+ TFM_CRYPTO_GENERATE_KEY_SID,
143+ TFM_CRYPTO_SID_MAX,
144+};
145+
146 /******** TFM_SP_PLATFORM ********/
147 #define TFM_SP_PLATFORM_SYSTEM_RESET_SID (0x00000040U)
148 #define TFM_SP_PLATFORM_SYSTEM_RESET_VERSION (1U)
149diff --git a/components/service/crypto/backend/psa_ipc/component.cmake b/components/service/crypto/backend/psa_ipc/component.cmake
150new file mode 100644
151index 000000000000..93c297a83ac6
152--- /dev/null
153+++ b/components/service/crypto/backend/psa_ipc/component.cmake
154@@ -0,0 +1,21 @@
155+#-------------------------------------------------------------------------------
156+# Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
157+#
158+# SPDX-License-Identifier: BSD-3-Clause
159+#
160+#-------------------------------------------------------------------------------
161+if (NOT DEFINED TGT)
162+ message(FATAL_ERROR "mandatory parameter TGT is not defined.")
163+endif()
164+
165+target_sources(${TGT} PRIVATE
166+ "${CMAKE_CURRENT_LIST_DIR}/crypto_ipc_backend.c"
167+ )
168+
169+# The ipc crypto backend uses the psa crypto client to realize the
170+# psa crypto API that the crypto provider depends on. This define
171+# configures the psa crypto client to be built with the ipc crypto
172+# caller.
173+target_compile_definitions(${TGT} PRIVATE
174+ PSA_CRYPTO_CLIENT_CALLER_SELECTION_H="service/crypto/client/caller/psa_ipc/crypto_caller.h"
175+)
176diff --git a/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.c b/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.c
177new file mode 100644
178index 000000000000..e47cd4ffb4ce
179--- /dev/null
180+++ b/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.c
181@@ -0,0 +1,26 @@
182+/*
183+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
184+ *
185+ * SPDX-License-Identifier: BSD-3-Clause
186+ */
187+
188+#include <stddef.h>
189+#include <psa/crypto.h>
190+#include <service/crypto/client/psa/psa_crypto_client.h>
191+#include <protocols/rpc/common/packed-c/status.h>
192+#include "crypto_ipc_backend.h"
193+
194+psa_status_t crypto_ipc_backend_init(struct rpc_caller *caller)
195+{
196+ psa_status_t status = psa_crypto_client_init(caller);
197+
198+ if (status == PSA_SUCCESS)
199+ status = psa_crypto_init();
200+
201+ return status;
202+}
203+
204+void crypto_ipc_backend_deinit(void)
205+{
206+ psa_crypto_client_deinit();
207+}
208diff --git a/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h b/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h
209new file mode 100644
210index 000000000000..c13c20e84131
211--- /dev/null
212+++ b/components/service/crypto/backend/psa_ipc/crypto_ipc_backend.h
213@@ -0,0 +1,70 @@
214+/*
215+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
216+ *
217+ * SPDX-License-Identifier: BSD-3-Clause
218+ */
219+
220+#ifndef CRYPTO_IPC_BACKEND_H
221+#define CRYPTO_IPC_BACKEND_H
222+
223+#include <service/crypto/client/psa/psa_crypto_client.h>
224+#include <psa/error.h>
225+#include <rpc_caller.h>
226+
227+#ifdef __cplusplus
228+extern "C" {
229+#endif
230+
231+/**
232+ * \brief This type is used to overcome a limitation in the number of maximum
233+ * IOVECs that can be used especially in psa_aead_encrypt and
234+ * psa_aead_decrypt. To be removed in case the AEAD APIs number of
235+ * parameters passed gets restructured
236+ */
237+#define TFM_CRYPTO_MAX_NONCE_LENGTH (16u)
238+struct psa_ipc_crypto_aead_pack_input {
239+ uint8_t nonce[TFM_CRYPTO_MAX_NONCE_LENGTH];
240+ uint32_t nonce_length;
241+};
242+
243+struct psa_ipc_crypto_pack_iovec {
244+ uint32_t sfn_id; /*!< Secure function ID used to dispatch the
245+ * request
246+ */
247+ uint16_t step; /*!< Key derivation step */
248+ psa_key_id_t key_id; /*!< Key id */
249+ psa_algorithm_t alg; /*!< Algorithm */
250+ uint32_t op_handle; /*!< Frontend context handle associated to a
251+ * multipart operation
252+ */
253+ uint32_t capacity; /*!< Key derivation capacity */
254+
255+ struct psa_ipc_crypto_aead_pack_input aead_in; /*!< FixMe: Temporarily used for
256+ * AEAD until the API is
257+ * restructured
258+ */
259+};
260+
261+#define iov_size sizeof(struct psa_ipc_crypto_pack_iovec)
262+
263+/**
264+ * \brief Initialize the psa ipc crypto backend
265+ *
266+ * Initializes a crypto backend that uses the psa API client with a
267+ * psa_ipc_backend caller to realize the PSA crypto API used by the crypto
268+ * service proviser.
269+ *
270+ * \return PSA_SUCCESS if backend initialized successfully
271+ */
272+psa_status_t crypto_ipc_backend_init(struct rpc_caller *caller);
273+
274+/**
275+ * \brief Clean-up to free any resource used by the crypto backend
276+ */
277+void crypto_ipc_backend_deinit(void);
278+
279+#ifdef __cplusplus
280+} /* extern "C" */
281+#endif
282+
283+#endif /* CRYPTO_IPC_BACKEND_H */
284diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller.h
285new file mode 100644
286index 000000000000..0a972187062f
287--- /dev/null
288+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller.h
289@@ -0,0 +1,34 @@
290+/*
291+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
292+ *
293+ * SPDX-License-Identifier: BSD-3-Clause
294+ */
295+
296+#ifndef PSA_IPC_CRYPTO_CALLER_H
297+#define PSA_IPC_CRYPTO_CALLER_H
298+
299+/**
300+ * Includes all header files that form the psa ipc crypto caller
301+ * interface. May be used by a client that needs to call operations
302+ * provided by a crypto service instance using the psa ipc interface.
303+ */
304+#include "crypto_caller_aead.h"
305+#include "crypto_caller_asymmetric_decrypt.h"
306+#include "crypto_caller_asymmetric_encrypt.h"
307+#include "crypto_caller_cipher.h"
308+#include "crypto_caller_copy_key.h"
309+#include "crypto_caller_destroy_key.h"
310+#include "crypto_caller_export_key.h"
311+#include "crypto_caller_export_public_key.h"
312+#include "crypto_caller_generate_key.h"
313+#include "crypto_caller_generate_random.h"
314+#include "crypto_caller_get_key_attributes.h"
315+#include "crypto_caller_hash.h"
316+#include "crypto_caller_import_key.h"
317+#include "crypto_caller_key_derivation.h"
318+#include "crypto_caller_mac.h"
319+#include "crypto_caller_purge_key.h"
320+#include "crypto_caller_sign_hash.h"
321+#include "crypto_caller_verify_hash.h"
322+
323+#endif /* PSA_IPC_CRYPTO_CALLER_H */
324diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h
325new file mode 100644
326index 000000000000..78517fe32ca9
327--- /dev/null
328+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_aead.h
329@@ -0,0 +1,252 @@
330+/*
331+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
332+ *
333+ * SPDX-License-Identifier: BSD-3-Clause
334+ */
335+
336+#ifndef PSA_IPC_CRYPTO_CALLER_AEAD_H
337+#define PSA_IPC_CRYPTO_CALLER_AEAD_H
338+
339+#include <string.h>
340+#include <stdlib.h>
341+#include <psa/crypto.h>
342+#include <psa/client.h>
343+#include <psa/sid.h>
344+#include <service/common/client/service_client.h>
345+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
346+#include <protocols/rpc/common/packed-c/status.h>
347+#include <protocols/service/crypto/packed-c/opcodes.h>
348+#include <protocols/service/crypto/packed-c/key_attributes.h>
349+#include <protocols/service/crypto/packed-c/import_key.h>
350+#include "crypto_caller_key_attributes.h"
351+
352+#ifdef __cplusplus
353+extern "C" {
354+#endif
355+
356+static inline psa_status_t crypto_caller_aead_encrypt(
357+ struct service_client *context,
358+ psa_key_id_t key,
359+ psa_algorithm_t alg,
360+ const uint8_t *nonce,
361+ size_t nonce_length,
362+ const uint8_t *additional_data,
363+ size_t additional_data_length,
364+ const uint8_t *plaintext,
365+ size_t plaintext_length,
366+ uint8_t *aeadtext,
367+ size_t aeadtext_size,
368+ size_t *aeadtext_length)
369+{
370+ struct service_client *ipc = context;
371+ struct rpc_caller *caller = ipc->caller;
372+ psa_status_t status;
373+ size_t in_len;
374+ int i;
375+ struct psa_ipc_crypto_pack_iovec iov = {
376+ .sfn_id = TFM_CRYPTO_AEAD_ENCRYPT_SID,
377+ .key_id = key,
378+ .alg = alg,
379+ .aead_in = { .nonce = {0}, .nonce_length = nonce_length },
380+ };
381+
382+ if (!additional_data && additional_data_length)
383+ return PSA_ERROR_INVALID_ARGUMENT;
384+
385+ struct psa_invec in_vec[] = {
386+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
387+ { .base = psa_ptr_const_to_u32(plaintext),
388+ .len = plaintext_length },
389+ { .base = psa_ptr_const_to_u32(additional_data),
390+ .len = additional_data_length},
391+ };
392+ struct psa_outvec out_vec[] = {
393+ { .base = psa_ptr_to_u32(aeadtext), .len = aeadtext_size },
394+ };
395+
396+ if (nonce_length > TFM_CRYPTO_MAX_NONCE_LENGTH)
397+ return PSA_ERROR_INVALID_ARGUMENT;
398+
399+ if (nonce) {
400+ for (i = 0; i < nonce_length; i++)
401+ iov.aead_in.nonce[i] = nonce[i];
402+ }
403+
404+ in_len = IOVEC_LEN(in_vec);
405+
406+ if (!additional_data)
407+ in_len--;
408+
409+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
410+ in_len, out_vec, IOVEC_LEN(out_vec));
411+
412+ *aeadtext_length = out_vec[0].len;
413+
414+ return status;
415+}
416+
417+static inline psa_status_t crypto_caller_aead_decrypt(
418+ struct service_client *context,
419+ psa_key_id_t key,
420+ psa_algorithm_t alg,
421+ const uint8_t *nonce,
422+ size_t nonce_length,
423+ const uint8_t *additional_data,
424+ size_t additional_data_length,
425+ const uint8_t *aeadtext,
426+ size_t aeadtext_length,
427+ uint8_t *plaintext,
428+ size_t plaintext_size,
429+ size_t *plaintext_length)
430+{
431+ struct service_client *ipc = context;
432+ struct rpc_caller *caller = ipc->caller;
433+ psa_status_t status;
434+ size_t in_len;
435+ int i;
436+ struct psa_ipc_crypto_pack_iovec iov = {
437+ .sfn_id = TFM_CRYPTO_AEAD_DECRYPT_SID,
438+ .key_id = key,
439+ .alg = alg,
440+ .aead_in = { .nonce = {0}, .nonce_length = nonce_length },
441+ };
442+
443+ if (!additional_data && additional_data_length)
444+ return PSA_ERROR_INVALID_ARGUMENT;
445+
446+ struct psa_invec in_vec[] = {
447+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
448+ { .base = psa_ptr_const_to_u32(aeadtext),
449+ .len = aeadtext_length },
450+ { .base = psa_ptr_const_to_u32(additional_data),
451+ .len = additional_data_length},
452+ };
453+ struct psa_outvec out_vec[] = {
454+ { .base = psa_ptr_to_u32(plaintext), .len = plaintext_size },
455+ };
456+
457+ if (nonce_length > TFM_CRYPTO_MAX_NONCE_LENGTH)
458+ return PSA_ERROR_INVALID_ARGUMENT;
459+
460+ if (nonce) {
461+ for (i = 0; i < nonce_length; i++)
462+ iov.aead_in.nonce[i] = nonce[i];
463+ }
464+
465+ in_len = IOVEC_LEN(in_vec);
466+
467+ if (!additional_data)
468+ in_len--;
469+
470+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
471+ in_len, out_vec, IOVEC_LEN(out_vec));
472+
473+ *plaintext_length = out_vec[0].len;
474+
475+ return status;
476+}
477+
478+static inline psa_status_t crypto_caller_aead_encrypt_setup(
479+ struct service_client *context,
480+ uint32_t *op_handle,
481+ psa_key_id_t key,
482+ psa_algorithm_t alg)
483+{
484+ return PSA_ERROR_NOT_SUPPORTED;
485+}
486+
487+static inline psa_status_t crypto_caller_aead_decrypt_setup(
488+ struct service_client *context,
489+ uint32_t *op_handle,
490+ psa_key_id_t key,
491+ psa_algorithm_t alg)
492+{
493+ return PSA_ERROR_NOT_SUPPORTED;
494+}
495+
496+static inline psa_status_t crypto_caller_aead_generate_nonce(
497+ struct service_client *context,
498+ uint32_t op_handle,
499+ uint8_t *nonce,
500+ size_t nonce_size,
501+ size_t *nonce_length)
502+{
503+ return PSA_ERROR_NOT_SUPPORTED;
504+}
505+
506+static inline psa_status_t crypto_caller_aead_set_nonce(
507+ struct service_client *context,
508+ uint32_t op_handle,
509+ const uint8_t *nonce,
510+ size_t nonce_length)
511+{
512+ return PSA_ERROR_NOT_SUPPORTED;
513+}
514+
515+static inline psa_status_t crypto_caller_aead_set_lengths(
516+ struct service_client *context,
517+ uint32_t op_handle,
518+ size_t ad_length,
519+ size_t plaintext_length)
520+{
521+ return PSA_ERROR_NOT_SUPPORTED;
522+}
523+
524+static inline psa_status_t crypto_caller_aead_update_ad(
525+ struct service_client *context,
526+ uint32_t op_handle,
527+ const uint8_t *input,
528+ size_t input_length)
529+{
530+ return PSA_ERROR_NOT_SUPPORTED;
531+}
532+
533+static inline psa_status_t crypto_caller_aead_update(
534+ struct service_client *context,
535+ uint32_t op_handle,
536+ const uint8_t *input,
537+ size_t input_length,
538+ uint8_t *output,
539+ size_t output_size,
540+ size_t *output_length)
541+{
542+ return PSA_ERROR_NOT_SUPPORTED;
543+}
544+
545+static inline psa_status_t crypto_caller_aead_finish(
546+ struct service_client *context,
547+ uint32_t op_handle,
548+ uint8_t *aeadtext,
549+ size_t aeadtext_size,
550+ size_t *aeadtext_length,
551+ uint8_t *tag,
552+ size_t tag_size,
553+ size_t *tag_length)
554+{
555+ return PSA_ERROR_NOT_SUPPORTED;
556+}
557+
558+static inline psa_status_t crypto_caller_aead_verify(
559+ struct service_client *context,
560+ uint32_t op_handle,
561+ uint8_t *plaintext,
562+ size_t plaintext_size,
563+ size_t *plaintext_length,
564+ const uint8_t *tag,
565+ size_t tag_length)
566+{
567+ return PSA_ERROR_NOT_SUPPORTED;
568+}
569+
570+static inline psa_status_t crypto_caller_aead_abort(
571+ struct service_client *context,
572+ uint32_t op_handle)
573+{
574+ return PSA_ERROR_NOT_SUPPORTED;
575+}
576+
577+#ifdef __cplusplus
578+}
579+#endif
580+
581+#endif /* PSA_IPC_CRYPTO_CALLER_AEAD_H */
582diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_decrypt.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_decrypt.h
583new file mode 100644
584index 000000000000..ff01815c09e9
585--- /dev/null
586+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_decrypt.h
587@@ -0,0 +1,76 @@
588+/*
589+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
590+ *
591+ * SPDX-License-Identifier: BSD-3-Clause
592+ */
593+
594+#ifndef PSA_IPC_CRYPTO_CALLER_ASYMMETRIC_DECRYPT_H
595+#define PSA_IPC_CRYPTO_CALLER_ASYMMETRIC_DECRYPT_H
596+
597+#include <string.h>
598+#include <stdlib.h>
599+#include <psa/crypto.h>
600+#include <psa/client.h>
601+#include <psa/sid.h>
602+#include <service/common/client/service_client.h>
603+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
604+#include <protocols/rpc/common/packed-c/status.h>
605+#include <protocols/service/crypto/packed-c/opcodes.h>
606+#include <protocols/service/crypto/packed-c/key_attributes.h>
607+#include <protocols/service/crypto/packed-c/import_key.h>
608+#include "crypto_caller_key_attributes.h"
609+
610+#ifdef __cplusplus
611+extern "C" {
612+#endif
613+
614+static inline psa_status_t crypto_caller_asymmetric_decrypt(
615+ struct service_client *context,
616+ psa_key_id_t id,
617+ psa_algorithm_t alg,
618+ const uint8_t *input, size_t input_length,
619+ const uint8_t *salt, size_t salt_length,
620+ uint8_t *output, size_t output_size,
621+ size_t *output_length)
622+{
623+ struct service_client *ipc = context;
624+ struct rpc_caller *caller = ipc->caller;
625+ psa_status_t status;
626+ size_t in_len;
627+ struct psa_ipc_crypto_pack_iovec iov = {
628+ .sfn_id = TFM_CRYPTO_ASYMMETRIC_DECRYPT_SID,
629+ .key_id = id,
630+ .alg = alg,
631+ };
632+
633+ /* Sanitize optional input */
634+ if (!salt && salt_length)
635+ return PSA_ERROR_INVALID_ARGUMENT;
636+
637+ struct psa_invec in_vec[] = {
638+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
639+ { .base = psa_ptr_const_to_u32(input), .len = input_length },
640+ { .base = psa_ptr_const_to_u32(salt), .len = salt_length },
641+ };
642+ struct psa_outvec out_vec[] = {
643+ { .base = psa_ptr_to_u32(output), .len = output_size },
644+ };
645+
646+
647+ in_len = IOVEC_LEN(in_vec);
648+ if (!salt)
649+ in_len--;
650+
651+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
652+ in_len, out_vec, IOVEC_LEN(out_vec));
653+
654+ *output_length = out_vec[0].len;
655+
656+ return status;
657+}
658+
659+#ifdef __cplusplus
660+}
661+#endif
662+
663+#endif /* PSA_IPC_CRYPTO_CALLER_ASYMMETRIC_DECRYPT_H */
664diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_encrypt.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_encrypt.h
665new file mode 100644
666index 000000000000..1daf1689c076
667--- /dev/null
668+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_asymmetric_encrypt.h
669@@ -0,0 +1,76 @@
670+/*
671+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
672+ *
673+ * SPDX-License-Identifier: BSD-3-Clause
674+ */
675+
676+#ifndef PSA_IPC_CRYPTO_CALLER_ASYMMETRIC_ENCRYPT_H
677+#define PSA_IPC_CRYPTO_CALLER_ASYMMETRIC_ENCRYPT_H
678+
679+#include <string.h>
680+#include <stdlib.h>
681+#include <psa/crypto.h>
682+#include <psa/client.h>
683+#include <psa/sid.h>
684+#include <service/common/client/service_client.h>
685+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
686+#include <protocols/rpc/common/packed-c/status.h>
687+#include <protocols/service/crypto/packed-c/opcodes.h>
688+#include <protocols/service/crypto/packed-c/key_attributes.h>
689+#include <protocols/service/crypto/packed-c/import_key.h>
690+#include "crypto_caller_key_attributes.h"
691+
692+#ifdef __cplusplus
693+extern "C" {
694+#endif
695+
696+static inline psa_status_t crypto_caller_asymmetric_encrypt(
697+ struct service_client *context,
698+ psa_key_id_t id,
699+ psa_algorithm_t alg,
700+ const uint8_t *input, size_t input_length,
701+ const uint8_t *salt, size_t salt_length,
702+ uint8_t *output, size_t output_size,
703+ size_t *output_length)
704+{
705+ struct service_client *ipc = context;
706+ struct rpc_caller *caller = ipc->caller;
707+ psa_status_t status;
708+ size_t in_len;
709+ struct psa_ipc_crypto_pack_iovec iov = {
710+ .sfn_id = TFM_CRYPTO_ASYMMETRIC_ENCRYPT_SID,
711+ .key_id = id,
712+ .alg = alg,
713+ };
714+
715+ /* Sanitize optional input */
716+ if (!salt && salt_length)
717+ return PSA_ERROR_INVALID_ARGUMENT;
718+
719+ struct psa_invec in_vec[] = {
720+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
721+ { .base = psa_ptr_const_to_u32(input), .len = input_length },
722+ { .base = psa_ptr_const_to_u32(salt), .len = salt_length },
723+ };
724+ struct psa_outvec out_vec[] = {
725+ { .base = psa_ptr_to_u32(output), .len = output_size },
726+ };
727+
728+
729+ in_len = IOVEC_LEN(in_vec);
730+ if (!salt)
731+ in_len--;
732+
733+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
734+ in_len, out_vec, IOVEC_LEN(out_vec));
735+
736+ *output_length = out_vec[0].len;
737+
738+ return status;
739+}
740+
741+#ifdef __cplusplus
742+}
743+#endif
744+
745+#endif /* PSA_IPC_CRYPTO_CALLER_ASYMMETRIC_ENCRYPT_H */
746diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_cipher.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_cipher.h
747new file mode 100644
748index 000000000000..fbefb28d813a
749--- /dev/null
750+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_cipher.h
751@@ -0,0 +1,246 @@
752+/*
753+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
754+ *
755+ * SPDX-License-Identifier: BSD-3-Clause
756+ */
757+
758+#ifndef PSA_IPC_CRYPTO_CALLER_CIPHER_H
759+#define PSA_IPC_CRYPTO_CALLER_CIPHER_H
760+
761+#include <string.h>
762+#include <stdlib.h>
763+#include <psa/crypto.h>
764+#include <psa/client.h>
765+#include <psa/sid.h>
766+#include <service/common/client/service_client.h>
767+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
768+#include <protocols/rpc/common/packed-c/status.h>
769+#include <protocols/service/crypto/packed-c/opcodes.h>
770+#include <protocols/service/crypto/packed-c/key_attributes.h>
771+#include <protocols/service/crypto/packed-c/import_key.h>
772+#include "crypto_caller_key_attributes.h"
773+
774+#ifdef __cplusplus
775+extern "C" {
776+#endif
777+
778+static inline psa_status_t crypto_caller_cipher_encrypt_setup(
779+ struct service_client *context,
780+ uint32_t *op_handle,
781+ psa_key_id_t key,
782+ psa_algorithm_t alg)
783+{
784+ struct service_client *ipc = context;
785+ struct rpc_caller *caller = ipc->caller;
786+ psa_status_t status;
787+ struct psa_ipc_crypto_pack_iovec iov = {
788+ .sfn_id = TFM_CRYPTO_CIPHER_ENCRYPT_SETUP_SID,
789+ .key_id = key,
790+ .alg = alg,
791+ .op_handle = *op_handle,
792+ };
793+ struct psa_invec in_vec[] = {
794+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
795+ };
796+ struct psa_outvec out_vec[] = {
797+ { .base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t) }
798+ };
799+
800+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
801+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
802+
803+ return status;
804+}
805+
806+static inline psa_status_t crypto_caller_cipher_decrypt_setup(
807+ struct service_client *context,
808+ uint32_t *op_handle,
809+ psa_key_id_t key,
810+ psa_algorithm_t alg)
811+{
812+ struct service_client *ipc = context;
813+ struct rpc_caller *caller = ipc->caller;
814+ psa_status_t status;
815+ struct psa_ipc_crypto_pack_iovec iov = {
816+ .sfn_id = TFM_CRYPTO_CIPHER_DECRYPT_SETUP_SID,
817+ .key_id = key,
818+ .alg = alg,
819+ .op_handle = *op_handle,
820+ };
821+ struct psa_invec in_vec[] = {
822+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
823+ };
824+ struct psa_outvec out_vec[] = {
825+ { .base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t) }
826+ };
827+
828+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
829+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
830+
831+ return status;
832+}
833+
834+static inline psa_status_t crypto_caller_cipher_generate_iv(
835+ struct service_client *context,
836+ uint32_t op_handle,
837+ uint8_t *iv,
838+ size_t iv_size,
839+ size_t *iv_length)
840+{
841+ struct service_client *ipc = context;
842+ struct rpc_caller *caller = ipc->caller;
843+ psa_status_t status;
844+ struct psa_ipc_crypto_pack_iovec iov = {
845+ .sfn_id = TFM_CRYPTO_CIPHER_GENERATE_IV_SID,
846+ .op_handle = op_handle,
847+ };
848+ struct psa_invec in_vec[] = {
849+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
850+ };
851+ struct psa_outvec out_vec[] = {
852+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
853+ { .base = psa_ptr_to_u32(iv), .len = iv_size },
854+ };
855+
856+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
857+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
858+
859+ *iv_length = out_vec[1].len;
860+
861+ return status;
862+}
863+
864+static inline psa_status_t crypto_caller_cipher_set_iv(
865+ struct service_client *context,
866+ uint32_t op_handle,
867+ const uint8_t *iv,
868+ size_t iv_length)
869+{
870+ struct service_client *ipc = context;
871+ struct rpc_caller *caller = ipc->caller;
872+ psa_status_t status;
873+ struct psa_ipc_crypto_pack_iovec iov = {
874+ .sfn_id = TFM_CRYPTO_CIPHER_SET_IV_SID,
875+ .op_handle = op_handle,
876+ };
877+ struct psa_invec in_vec[] = {
878+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
879+ { .base = psa_ptr_const_to_u32(iv), .len = iv_length },
880+ };
881+ struct psa_outvec out_vec[] = {
882+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
883+ };
884+
885+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
886+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
887+
888+ return status;
889+}
890+
891+static inline psa_status_t crypto_caller_cipher_update(
892+ struct service_client *context,
893+ uint32_t op_handle,
894+ const uint8_t *input,
895+ size_t input_length,
896+ uint8_t *output,
897+ size_t output_size,
898+ size_t *output_length)
899+{
900+ struct service_client *ipc = context;
901+ struct rpc_caller *caller = ipc->caller;
902+ psa_status_t status;
903+ struct psa_ipc_crypto_pack_iovec iov = {
904+ .sfn_id = TFM_CRYPTO_CIPHER_UPDATE_SID,
905+ .op_handle = op_handle,
906+ };
907+ struct psa_invec in_vec[] = {
908+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
909+ { .base = psa_ptr_const_to_u32(input), .len = input_length },
910+ };
911+ struct psa_outvec out_vec[] = {
912+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
913+ { .base = psa_ptr_to_u32(output), .len = output_size },
914+ };
915+
916+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
917+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
918+
919+ *output_length = out_vec[1].len;
920+
921+ return status;
922+}
923+
924+static inline psa_status_t crypto_caller_cipher_finish(
925+ struct service_client *context,
926+ uint32_t op_handle,
927+ uint8_t *output,
928+ size_t output_size,
929+ size_t *output_length)
930+{
931+ struct service_client *ipc = context;
932+ struct rpc_caller *caller = ipc->caller;
933+ psa_status_t status;
934+ struct psa_ipc_crypto_pack_iovec iov = {
935+ .sfn_id = TFM_CRYPTO_CIPHER_FINISH_SID,
936+ .op_handle = op_handle,
937+ };
938+ struct psa_invec in_vec[] = {
939+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
940+ };
941+ struct psa_outvec out_vec[] = {
942+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
943+ { .base = psa_ptr_to_u32(output), .len = output_size },
944+ };
945+
946+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
947+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
948+
949+ *output_length = out_vec[1].len;
950+
951+ return status;
952+}
953+
954+static inline psa_status_t crypto_caller_cipher_abort(
955+ struct service_client *context,
956+ uint32_t op_handle)
957+{
958+ struct service_client *ipc = context;
959+ struct rpc_caller *caller = ipc->caller;
960+ psa_status_t status;
961+ struct psa_ipc_crypto_pack_iovec iov = {
962+ .sfn_id = TFM_CRYPTO_CIPHER_ABORT_SID,
963+ .op_handle = op_handle,
964+ };
965+ struct psa_invec in_vec[] = {
966+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
967+ };
968+ struct psa_outvec out_vec[] = {
969+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
970+ };
971+
972+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
973+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
974+
975+ return status;
976+}
977+
978+static inline size_t crypto_caller_cipher_max_update_size(const struct service_client *context)
979+{
980+ /* Returns the maximum number of bytes that may be
981+ * carried as a parameter of the cipher_update operation
982+ * using the ipc encoding.
983+ */
984+ size_t payload_space = context->service_info.max_payload;
985+ size_t overhead = iov_size;
986+
987+ /* Allow for output to be a whole number of blocks */
988+ overhead += PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE;
989+
990+ return (payload_space > overhead) ? payload_space - overhead : 0;
991+}
992+
993+#ifdef __cplusplus
994+}
995+#endif
996+
997+#endif /* PSA_IPC_CRYPTO_CALLER_CIPHER_H */
998diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_copy_key.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_copy_key.h
999new file mode 100644
1000index 000000000000..9a988171b098
1001--- /dev/null
1002+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_copy_key.h
1003@@ -0,0 +1,57 @@
1004+/*
1005+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1006+ *
1007+ * SPDX-License-Identifier: BSD-3-Clause
1008+ */
1009+
1010+#ifndef PSA_IPC_CRYPTO_CALLER_COPY_KEY_H
1011+#define PSA_IPC_CRYPTO_CALLER_COPY_KEY_H
1012+
1013+#include <string.h>
1014+#include <stdlib.h>
1015+#include <psa/crypto.h>
1016+#include <psa/client.h>
1017+#include <psa/sid.h>
1018+#include <service/common/client/service_client.h>
1019+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1020+#include <protocols/rpc/common/packed-c/status.h>
1021+#include <protocols/service/crypto/packed-c/opcodes.h>
1022+#include <protocols/service/crypto/packed-c/key_attributes.h>
1023+#include <protocols/service/crypto/packed-c/import_key.h>
1024+#include "crypto_caller_key_attributes.h"
1025+
1026+#ifdef __cplusplus
1027+extern "C" {
1028+#endif
1029+
1030+static inline psa_status_t crypto_caller_copy_key(struct service_client *context,
1031+ psa_key_id_t source_key,
1032+ const psa_key_attributes_t *attributes,
1033+ psa_key_id_t *target_key)
1034+{
1035+ struct service_client *ipc = context;
1036+ struct rpc_caller *caller = ipc->caller;
1037+ psa_status_t status;
1038+ struct psa_ipc_crypto_pack_iovec iov = {
1039+ .sfn_id = TFM_CRYPTO_COPY_KEY_SID,
1040+ .key_id = source_key,
1041+ };
1042+ struct psa_invec in_vec[] = {
1043+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1044+ { .base = psa_ptr_const_to_u32(attributes), .len = sizeof(psa_key_attributes_t) },
1045+ };
1046+ struct psa_outvec out_vec[] = {
1047+ { .base = psa_ptr_to_u32(target_key), .len = sizeof(psa_key_id_t) }
1048+ };
1049+
1050+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1051+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1052+
1053+ return status;
1054+}
1055+
1056+#ifdef __cplusplus
1057+}
1058+#endif
1059+
1060+#endif /* PSA_IPC_CRYPTO_CALLER_COPY_KEY_H */
1061diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_destroy_key.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_destroy_key.h
1062new file mode 100644
1063index 000000000000..d00f4faa7a52
1064--- /dev/null
1065+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_destroy_key.h
1066@@ -0,0 +1,51 @@
1067+/*
1068+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1069+ *
1070+ * SPDX-License-Identifier: BSD-3-Clause
1071+ */
1072+
1073+#ifndef PSA_IPC_CRYPTO_CALLER_DESTROY_KEY_H
1074+#define PSA_IPC_CRYPTO_CALLER_DESTROY_KEY_H
1075+
1076+#include <string.h>
1077+#include <stdlib.h>
1078+#include <psa/crypto.h>
1079+#include <psa/client.h>
1080+#include <psa/sid.h>
1081+#include <service/common/client/service_client.h>
1082+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1083+#include <protocols/rpc/common/packed-c/status.h>
1084+#include <protocols/service/crypto/packed-c/opcodes.h>
1085+#include <protocols/service/crypto/packed-c/key_attributes.h>
1086+#include <protocols/service/crypto/packed-c/import_key.h>
1087+#include "crypto_caller_key_attributes.h"
1088+
1089+#ifdef __cplusplus
1090+extern "C" {
1091+#endif
1092+
1093+static inline psa_status_t crypto_caller_destroy_key(struct service_client *context,
1094+ psa_key_id_t id)
1095+{
1096+ struct service_client *ipc = context;
1097+ struct rpc_caller *caller = ipc->caller;
1098+ psa_status_t status;
1099+ struct psa_ipc_crypto_pack_iovec iov = {
1100+ .sfn_id = TFM_CRYPTO_DESTROY_KEY_SID,
1101+ .key_id = id,
1102+ };
1103+ struct psa_invec in_vec[] = {
1104+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1105+ };
1106+
1107+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1108+ IOVEC_LEN(in_vec), NULL, 0);
1109+
1110+ return status;
1111+}
1112+
1113+#ifdef __cplusplus
1114+}
1115+#endif
1116+
1117+#endif /* PSA_IPC_CRYPTO_CALLER_DESTROY_KEY_H */
1118diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_export_key.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_export_key.h
1119new file mode 100644
1120index 000000000000..8ac5477f7b9a
1121--- /dev/null
1122+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_export_key.h
1123@@ -0,0 +1,59 @@
1124+/*
1125+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1126+ *
1127+ * SPDX-License-Identifier: BSD-3-Clause
1128+ */
1129+
1130+#ifndef PSA_IPC_CRYPTO_CALLER_EXPORT_KEY_H
1131+#define PSA_IPC_CRYPTO_CALLER_EXPORT_KEY_H
1132+
1133+#include <string.h>
1134+#include <stdlib.h>
1135+#include <psa/crypto.h>
1136+#include <psa/client.h>
1137+#include <psa/sid.h>
1138+#include <service/common/client/service_client.h>
1139+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1140+#include <protocols/rpc/common/packed-c/status.h>
1141+#include <protocols/service/crypto/packed-c/opcodes.h>
1142+#include <protocols/service/crypto/packed-c/key_attributes.h>
1143+#include <protocols/service/crypto/packed-c/import_key.h>
1144+#include "crypto_caller_key_attributes.h"
1145+
1146+#ifdef __cplusplus
1147+extern "C" {
1148+#endif
1149+
1150+static inline psa_status_t crypto_caller_export_key(struct service_client *context,
1151+ psa_key_id_t id,
1152+ uint8_t *data,
1153+ size_t data_size,
1154+ size_t *data_length)
1155+{
1156+ struct service_client *ipc = context;
1157+ struct rpc_caller *caller = ipc->caller;
1158+ psa_status_t status;
1159+ struct psa_ipc_crypto_pack_iovec iov = {
1160+ .sfn_id = TFM_CRYPTO_EXPORT_KEY_SID,
1161+ .key_id = id,
1162+ };
1163+ struct psa_invec in_vec[] = {
1164+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1165+ };
1166+ struct psa_outvec out_vec[] = {
1167+ { .base = psa_ptr_to_u32(data), .len = data_size }
1168+ };
1169+
1170+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1171+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1172+
1173+ *data_length = out_vec[0].len;
1174+
1175+ return status;
1176+}
1177+
1178+#ifdef __cplusplus
1179+}
1180+#endif
1181+
1182+#endif /* PSA_IPC_CRYPTO_CALLER_EXPORT_KEY_H */
1183diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_export_public_key.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_export_public_key.h
1184new file mode 100644
1185index 000000000000..b24c47f1257e
1186--- /dev/null
1187+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_export_public_key.h
1188@@ -0,0 +1,59 @@
1189+/*
1190+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1191+ *
1192+ * SPDX-License-Identifier: BSD-3-Clause
1193+ */
1194+
1195+#ifndef PSA_IPC_CRYPTO_CALLER_EXPORT_PUBLIC_KEY_H
1196+#define PSA_IPC_CRYPTO_CALLER_EXPORT_PUBLIC_KEY_H
1197+
1198+#include <string.h>
1199+#include <stdlib.h>
1200+#include <psa/crypto.h>
1201+#include <psa/client.h>
1202+#include <psa/sid.h>
1203+#include <service/common/client/service_client.h>
1204+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1205+#include <protocols/rpc/common/packed-c/status.h>
1206+#include <protocols/service/crypto/packed-c/opcodes.h>
1207+#include <protocols/service/crypto/packed-c/key_attributes.h>
1208+#include <protocols/service/crypto/packed-c/import_key.h>
1209+#include "crypto_caller_key_attributes.h"
1210+
1211+#ifdef __cplusplus
1212+extern "C" {
1213+#endif
1214+
1215+static inline psa_status_t crypto_caller_export_public_key(struct service_client *context,
1216+ psa_key_id_t id,
1217+ uint8_t *data,
1218+ size_t data_size,
1219+ size_t *data_length)
1220+{
1221+ struct service_client *ipc = context;
1222+ struct rpc_caller *caller = ipc->caller;
1223+ psa_status_t status;
1224+ struct psa_ipc_crypto_pack_iovec iov = {
1225+ .sfn_id = TFM_CRYPTO_EXPORT_PUBLIC_KEY_SID,
1226+ .key_id = id,
1227+ };
1228+ struct psa_invec in_vec[] = {
1229+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1230+ };
1231+ struct psa_outvec out_vec[] = {
1232+ { .base = psa_ptr_to_u32(data), .len = data_size }
1233+ };
1234+
1235+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1236+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1237+
1238+ *data_length = out_vec[0].len;
1239+
1240+ return status;
1241+}
1242+
1243+#ifdef __cplusplus
1244+}
1245+#endif
1246+
1247+#endif /* PSA_IPC_CRYPTO_CALLER_EXPORT_PUBLIC_KEY_H */
1248diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_key.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_key.h
1249new file mode 100644
1250index 000000000000..1b66ed4020de
1251--- /dev/null
1252+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_key.h
1253@@ -0,0 +1,55 @@
1254+/*
1255+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1256+ *
1257+ * SPDX-License-Identifier: BSD-3-Clause
1258+ */
1259+
1260+#ifndef PSA_IPC_CRYPTO_CALLER_GENERATE_KEY_H
1261+#define PSA_IPC_CRYPTO_CALLER_GENERATE_KEY_H
1262+
1263+#include <string.h>
1264+#include <stdlib.h>
1265+#include <psa/crypto.h>
1266+#include <psa/client.h>
1267+#include <psa/sid.h>
1268+#include <service/common/client/service_client.h>
1269+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1270+#include <protocols/rpc/common/packed-c/status.h>
1271+#include <protocols/service/crypto/packed-c/opcodes.h>
1272+#include <protocols/service/crypto/packed-c/key_attributes.h>
1273+#include <protocols/service/crypto/packed-c/import_key.h>
1274+#include "crypto_caller_key_attributes.h"
1275+
1276+#ifdef __cplusplus
1277+extern "C" {
1278+#endif
1279+
1280+static inline psa_status_t crypto_caller_generate_key(struct service_client *context,
1281+ const psa_key_attributes_t *attributes,
1282+ psa_key_id_t *id)
1283+{
1284+ struct service_client *ipc = context;
1285+ struct rpc_caller *caller = ipc->caller;
1286+ psa_status_t status;
1287+ struct psa_ipc_crypto_pack_iovec iov = {
1288+ .sfn_id = TFM_CRYPTO_GENERATE_KEY_SID,
1289+ };
1290+ struct psa_invec in_vec[] = {
1291+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1292+ { .base = psa_ptr_const_to_u32(attributes), .len = sizeof(psa_key_attributes_t) },
1293+ };
1294+ struct psa_outvec out_vec[] = {
1295+ { .base = psa_ptr_to_u32(id), .len = sizeof(psa_key_id_t) }
1296+ };
1297+
1298+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1299+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1300+
1301+ return status;
1302+}
1303+
1304+#ifdef __cplusplus
1305+}
1306+#endif
1307+
1308+#endif /* PSA_IPC_CRYPTO_CALLER_GENERATE_KEY_H */
1309diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_random.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_random.h
1310new file mode 100644
1311index 000000000000..7c538237805a
1312--- /dev/null
1313+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_generate_random.h
1314@@ -0,0 +1,57 @@
1315+/*
1316+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1317+ *
1318+ * SPDX-License-Identifier: BSD-3-Clause
1319+ */
1320+
1321+#ifndef PSA_IPC_CRYPTO_CALLER_GENERATE_RANDOM_H
1322+#define PSA_IPC_CRYPTO_CALLER_GENERATE_RANDOM_H
1323+
1324+#include <string.h>
1325+#include <stdlib.h>
1326+#include <psa/crypto.h>
1327+#include <psa/client.h>
1328+#include <psa/sid.h>
1329+#include <service/common/client/service_client.h>
1330+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1331+#include <protocols/rpc/common/packed-c/status.h>
1332+#include <protocols/service/crypto/packed-c/opcodes.h>
1333+#include <protocols/service/crypto/packed-c/key_attributes.h>
1334+#include <protocols/service/crypto/packed-c/import_key.h>
1335+#include "crypto_caller_key_attributes.h"
1336+
1337+#ifdef __cplusplus
1338+extern "C" {
1339+#endif
1340+
1341+static inline psa_status_t crypto_caller_generate_random(struct service_client *context,
1342+ uint8_t *output,
1343+ size_t output_size)
1344+{
1345+ struct service_client *ipc = context;
1346+ struct rpc_caller *caller = ipc->caller;
1347+ psa_status_t status;
1348+ struct psa_ipc_crypto_pack_iovec iov = {
1349+ .sfn_id = TFM_CRYPTO_GENERATE_RANDOM_SID,
1350+ };
1351+ struct psa_invec in_vec[] = {
1352+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1353+ };
1354+ struct psa_outvec out_vec[] = {
1355+ { .base = psa_ptr_to_u32(output), .len = output_size }
1356+ };
1357+
1358+ if (!output_size)
1359+ return PSA_SUCCESS;
1360+
1361+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1362+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1363+
1364+ return status;
1365+}
1366+
1367+#ifdef __cplusplus
1368+}
1369+#endif
1370+
1371+#endif /* PSA_IPC_CRYPTO_CALLER_GENERATE_RANDOM_H */
1372diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_get_key_attributes.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_get_key_attributes.h
1373new file mode 100644
1374index 000000000000..22f1d18f1476
1375--- /dev/null
1376+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_get_key_attributes.h
1377@@ -0,0 +1,56 @@
1378+/*
1379+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1380+ *
1381+ * SPDX-License-Identifier: BSD-3-Clause
1382+ */
1383+
1384+#ifndef PSA_IPC_CRYPTO_CALLER_GET_KEY_ATTRIBUTES_H
1385+#define PSA_IPC_CRYPTO_CALLER_GET_KEY_ATTRIBUTES_H
1386+
1387+#include <string.h>
1388+#include <stdlib.h>
1389+#include <psa/crypto.h>
1390+#include <psa/client.h>
1391+#include <psa/sid.h>
1392+#include <service/common/client/service_client.h>
1393+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1394+#include <protocols/rpc/common/packed-c/status.h>
1395+#include <protocols/service/crypto/packed-c/opcodes.h>
1396+#include <protocols/service/crypto/packed-c/key_attributes.h>
1397+#include <protocols/service/crypto/packed-c/import_key.h>
1398+#include "crypto_caller_key_attributes.h"
1399+
1400+#ifdef __cplusplus
1401+extern "C" {
1402+#endif
1403+
1404+static inline psa_status_t crypto_caller_get_key_attributes(
1405+ struct service_client *context,
1406+ psa_key_id_t key,
1407+ psa_key_attributes_t *attributes)
1408+{
1409+ struct service_client *ipc = context;
1410+ struct rpc_caller *caller = ipc->caller;
1411+ psa_status_t status;
1412+ struct psa_ipc_crypto_pack_iovec iov = {
1413+ .sfn_id = TFM_CRYPTO_GET_KEY_ATTRIBUTES_SID,
1414+ .key_id = key,
1415+ };
1416+ struct psa_invec in_vec[] = {
1417+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1418+ };
1419+ struct psa_outvec out_vec[] = {
1420+ { .base = psa_ptr_to_u32(attributes), .len = sizeof(psa_key_attributes_t) }
1421+ };
1422+
1423+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1424+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1425+
1426+ return status;
1427+}
1428+
1429+#ifdef __cplusplus
1430+}
1431+#endif
1432+
1433+#endif /* PSA_IPC_CRYPTO_CALLER_GET_KEY_ATTRIBUTES_H */
1434diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_hash.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_hash.h
1435new file mode 100644
1436index 000000000000..9f37908a2f25
1437--- /dev/null
1438+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_hash.h
1439@@ -0,0 +1,220 @@
1440+/*
1441+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1442+ *
1443+ * SPDX-License-Identifier: BSD-3-Clause
1444+ */
1445+
1446+#ifndef PSA_IPC_CRYPTO_CALLER_HASH_H
1447+#define PSA_IPC_CRYPTO_CALLER_HASH_H
1448+
1449+#include <string.h>
1450+#include <stdlib.h>
1451+#include <psa/crypto.h>
1452+#include <psa/client.h>
1453+#include <psa/sid.h>
1454+#include <service/common/client/service_client.h>
1455+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1456+#include <protocols/rpc/common/packed-c/status.h>
1457+#include <protocols/service/crypto/packed-c/opcodes.h>
1458+#include <protocols/service/crypto/packed-c/key_attributes.h>
1459+#include <protocols/service/crypto/packed-c/import_key.h>
1460+#include "crypto_caller_key_attributes.h"
1461+
1462+#ifdef __cplusplus
1463+extern "C" {
1464+#endif
1465+
1466+static inline psa_status_t crypto_caller_hash_setup(
1467+ struct service_client *context,
1468+ uint32_t *op_handle,
1469+ psa_algorithm_t alg)
1470+{
1471+ struct service_client *ipc = context;
1472+ struct rpc_caller *caller = ipc->caller;
1473+ psa_status_t status;
1474+ struct psa_ipc_crypto_pack_iovec iov = {
1475+ .sfn_id = TFM_CRYPTO_HASH_SETUP_SID,
1476+ .alg = alg,
1477+ .op_handle = *op_handle,
1478+ };
1479+ struct psa_invec in_vec[] = {
1480+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1481+ };
1482+ struct psa_outvec out_vec[] = {
1483+ { .base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t) }
1484+ };
1485+
1486+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1487+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1488+
1489+ return status;
1490+}
1491+
1492+static inline psa_status_t crypto_caller_hash_update(
1493+ struct service_client *context,
1494+ uint32_t op_handle,
1495+ const uint8_t *input,
1496+ size_t input_length)
1497+{
1498+ struct service_client *ipc = context;
1499+ struct rpc_caller *caller = ipc->caller;
1500+ psa_status_t status;
1501+ struct psa_ipc_crypto_pack_iovec iov = {
1502+ .sfn_id = TFM_CRYPTO_HASH_UPDATE_SID,
1503+ .op_handle = op_handle,
1504+ };
1505+ struct psa_invec in_vec[] = {
1506+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1507+ { .base = psa_ptr_const_to_u32(input), .len = input_length },
1508+ };
1509+ struct psa_outvec out_vec[] = {
1510+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
1511+ };
1512+
1513+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1514+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1515+
1516+ return status;
1517+}
1518+
1519+static inline psa_status_t crypto_caller_hash_finish(
1520+ struct service_client *context,
1521+ uint32_t op_handle,
1522+ uint8_t *hash,
1523+ size_t hash_size,
1524+ size_t *hash_length)
1525+{
1526+ struct service_client *ipc = context;
1527+ struct rpc_caller *caller = ipc->caller;
1528+ psa_status_t status;
1529+ struct psa_ipc_crypto_pack_iovec iov = {
1530+ .sfn_id = TFM_CRYPTO_HASH_FINISH_SID,
1531+ .op_handle = op_handle,
1532+ };
1533+ struct psa_invec in_vec[] = {
1534+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1535+ };
1536+ struct psa_outvec out_vec[] = {
1537+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
1538+ { .base = psa_ptr_to_u32(hash), .len = hash_size},
1539+ };
1540+
1541+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1542+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1543+
1544+ *hash_length = out_vec[1].len;
1545+
1546+ return status;
1547+}
1548+
1549+static inline psa_status_t crypto_caller_hash_abort(
1550+ struct service_client *context,
1551+ uint32_t op_handle)
1552+{
1553+ struct service_client *ipc = context;
1554+ struct rpc_caller *caller = ipc->caller;
1555+ psa_status_t status;
1556+ struct psa_ipc_crypto_pack_iovec iov = {
1557+ .sfn_id = TFM_CRYPTO_HASH_ABORT_SID,
1558+ .op_handle = op_handle,
1559+ };
1560+ struct psa_invec in_vec[] = {
1561+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1562+ };
1563+ struct psa_outvec out_vec[] = {
1564+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
1565+ };
1566+
1567+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1568+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1569+
1570+ return status;
1571+}
1572+
1573+static inline psa_status_t crypto_caller_hash_verify(
1574+ struct service_client *context,
1575+ uint32_t op_handle,
1576+ const uint8_t *hash,
1577+ size_t hash_length)
1578+{
1579+ struct service_client *ipc = context;
1580+ struct rpc_caller *caller = ipc->caller;
1581+ psa_status_t status;
1582+ struct psa_ipc_crypto_pack_iovec iov = {
1583+ .sfn_id = TFM_CRYPTO_HASH_VERIFY_SID,
1584+ .op_handle = op_handle,
1585+ };
1586+ struct psa_invec in_vec[] = {
1587+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1588+ { .base = psa_ptr_const_to_u32(hash), .len = hash_length},
1589+ };
1590+ struct psa_outvec out_vec[] = {
1591+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
1592+ };
1593+
1594+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1595+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1596+
1597+ return status;
1598+}
1599+
1600+static inline psa_status_t crypto_caller_hash_clone(
1601+ struct service_client *context,
1602+ uint32_t source_op_handle,
1603+ uint32_t *target_op_handle)
1604+{
1605+ struct service_client *ipc = context;
1606+ struct rpc_caller *caller = ipc->caller;
1607+ psa_status_t status;
1608+ struct psa_ipc_crypto_pack_iovec iov = {
1609+ .sfn_id = TFM_CRYPTO_HASH_CLONE_SID,
1610+ .op_handle = source_op_handle,
1611+ };
1612+ struct psa_invec in_vec[] = {
1613+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1614+ };
1615+ struct psa_outvec out_vec[] = {
1616+ { .base = psa_ptr_to_u32(target_op_handle),
1617+ .len = sizeof(uint32_t) },
1618+ };
1619+
1620+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1621+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1622+
1623+ return status;
1624+}
1625+
1626+static inline psa_status_t crypto_caller_hash_suspend(struct service_client *context,
1627+ uint32_t op_handle,
1628+ uint8_t *hash_state,
1629+ size_t hash_state_size,
1630+ size_t *hash_state_length)
1631+{
1632+ return PSA_ERROR_NOT_SUPPORTED;
1633+}
1634+
1635+static inline psa_status_t crypto_caller_hash_resume(struct service_client *context,
1636+ uint32_t op_handle,
1637+ const uint8_t *hash_state,
1638+ size_t hash_state_length)
1639+{
1640+ return PSA_ERROR_NOT_SUPPORTED;
1641+}
1642+
1643+static inline size_t crypto_caller_hash_max_update_size(const struct service_client *context)
1644+{
1645+ /* Returns the maximum number of bytes that may be
1646+ * carried as a parameter of the hash_update operation
1647+ * using the packed-c encoding.
1648+ */
1649+ size_t payload_space = context->service_info.max_payload;
1650+ size_t overhead = iov_size;
1651+
1652+ return (payload_space > overhead) ? payload_space - overhead : 0;
1653+}
1654+
1655+#ifdef __cplusplus
1656+}
1657+#endif
1658+
1659+#endif /* PSA_IPC_CRYPTO_CALLER_HASH_H */
1660diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_import_key.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_import_key.h
1661new file mode 100644
1662index 000000000000..d47033662790
1663--- /dev/null
1664+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_import_key.h
1665@@ -0,0 +1,57 @@
1666+/*
1667+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1668+ *
1669+ * SPDX-License-Identifier: BSD-3-Clause
1670+ */
1671+
1672+#ifndef PSA_IPC_CRYPTO_CALLER_IMPORT_KEY_H
1673+#define PSA_IPC_CRYPTO_CALLER_IMPORT_KEY_H
1674+
1675+#include <string.h>
1676+#include <stdlib.h>
1677+#include <psa/crypto.h>
1678+#include <psa/client.h>
1679+#include <psa/sid.h>
1680+#include <service/common/client/service_client.h>
1681+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1682+#include <protocols/rpc/common/packed-c/status.h>
1683+#include <protocols/service/crypto/packed-c/opcodes.h>
1684+#include <protocols/service/crypto/packed-c/key_attributes.h>
1685+#include <protocols/service/crypto/packed-c/import_key.h>
1686+#include "crypto_caller_key_attributes.h"
1687+
1688+#ifdef __cplusplus
1689+extern "C" {
1690+#endif
1691+
1692+static inline psa_status_t crypto_caller_import_key(struct service_client *context,
1693+ const psa_key_attributes_t *attributes,
1694+ const uint8_t *data, size_t data_length,
1695+ psa_key_id_t *id)
1696+{
1697+ struct service_client *ipc = context;
1698+ struct rpc_caller *caller = ipc->caller;
1699+ psa_status_t status;
1700+ struct psa_ipc_crypto_pack_iovec iov = {
1701+ .sfn_id = TFM_CRYPTO_IMPORT_KEY_SID,
1702+ };
1703+ struct psa_invec in_vec[] = {
1704+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
1705+ { .base = psa_ptr_const_to_u32(attributes), .len = sizeof(psa_key_attributes_t) },
1706+ { .base = psa_ptr_const_to_u32(data), .len = data_length }
1707+ };
1708+ struct psa_outvec out_vec[] = {
1709+ { .base = psa_ptr_to_u32(id), .len = sizeof(psa_key_id_t) }
1710+ };
1711+
1712+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1713+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1714+
1715+ return status;
1716+}
1717+
1718+#ifdef __cplusplus
1719+}
1720+#endif
1721+
1722+#endif /* PACKEDC_CRYPTO_CALLER_IMPORT_KEY_H */
1723diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_key_attributes.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_key_attributes.h
1724new file mode 100644
1725index 000000000000..2fad2f0a64e6
1726--- /dev/null
1727+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_key_attributes.h
1728@@ -0,0 +1,51 @@
1729+/*
1730+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1731+ *
1732+ * SPDX-License-Identifier: BSD-3-Clause
1733+ */
1734+
1735+#ifndef PACKEDC_CRYPTO_CALLER_KEY_ATTRIBUTES_H
1736+#define PACKEDC_CRYPTO_CALLER_KEY_ATTRIBUTES_H
1737+
1738+#include <psa/crypto.h>
1739+#include <protocols/service/crypto/packed-c/key_attributes.h>
1740+
1741+#ifdef __cplusplus
1742+extern "C" {
1743+#endif
1744+
1745+static inline void packedc_crypto_caller_translate_key_attributes_to_proto(
1746+ struct ts_crypto_key_attributes *proto_attributes,
1747+ const psa_key_attributes_t *psa_attributes)
1748+{
1749+ proto_attributes->type = psa_get_key_type(psa_attributes);
1750+ proto_attributes->key_bits = psa_get_key_bits(psa_attributes);
1751+ proto_attributes->lifetime = psa_get_key_lifetime(psa_attributes);
1752+ proto_attributes->id = psa_get_key_id(psa_attributes);
1753+
1754+ proto_attributes->policy.usage = psa_get_key_usage_flags(psa_attributes);
1755+ proto_attributes->policy.alg = psa_get_key_algorithm(psa_attributes);
1756+ }
1757+
1758+static inline void packedc_crypto_caller_translate_key_attributes_from_proto(
1759+ psa_key_attributes_t *psa_attributes,
1760+ const struct ts_crypto_key_attributes *proto_attributes)
1761+{
1762+ psa_set_key_type(psa_attributes, proto_attributes->type);
1763+ psa_set_key_bits(psa_attributes, proto_attributes->key_bits);
1764+ psa_set_key_lifetime(psa_attributes, proto_attributes->lifetime);
1765+
1766+ if (proto_attributes->lifetime == PSA_KEY_LIFETIME_PERSISTENT) {
1767+
1768+ psa_set_key_id(psa_attributes, proto_attributes->id);
1769+ }
1770+
1771+ psa_set_key_usage_flags(psa_attributes, proto_attributes->policy.usage);
1772+ psa_set_key_algorithm(psa_attributes, proto_attributes->policy.alg);
1773+}
1774+
1775+#ifdef __cplusplus
1776+}
1777+#endif
1778+
1779+#endif /* PACKEDC_CRYPTO_CALLER_KEY_ATTRIBUTES_H */
1780diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_key_derivation.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_key_derivation.h
1781new file mode 100644
1782index 000000000000..5ce4fb6cca82
1783--- /dev/null
1784+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_key_derivation.h
1785@@ -0,0 +1,298 @@
1786+/*
1787+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
1788+ *
1789+ * SPDX-License-Identifier: BSD-3-Clause
1790+ */
1791+
1792+#ifndef PSA_IPC_CRYPTO_CALLER_KEY_DERIVATION_H
1793+#define PSA_IPC_CRYPTO_CALLER_KEY_DERIVATION_H
1794+
1795+#include <string.h>
1796+#include <stdlib.h>
1797+#include <psa/crypto.h>
1798+#include <psa/client.h>
1799+#include <psa/sid.h>
1800+#include <service/common/client/service_client.h>
1801+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
1802+#include <protocols/rpc/common/packed-c/status.h>
1803+#include <protocols/service/crypto/packed-c/opcodes.h>
1804+#include <protocols/service/crypto/packed-c/key_attributes.h>
1805+#include <protocols/service/crypto/packed-c/import_key.h>
1806+#include "crypto_caller_key_attributes.h"
1807+
1808+#ifdef __cplusplus
1809+extern "C" {
1810+#endif
1811+
1812+static inline psa_status_t crypto_caller_key_derivation_setup(
1813+ struct service_client *context,
1814+ uint32_t *op_handle,
1815+ psa_algorithm_t alg)
1816+{
1817+ struct service_client *ipc = context;
1818+ struct rpc_caller *caller = ipc->caller;
1819+ psa_status_t status;
1820+ struct psa_ipc_crypto_pack_iovec iov = {
1821+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_SETUP_SID,
1822+ .alg = alg,
1823+ .op_handle = *op_handle,
1824+ };
1825+ struct psa_invec in_vec[] = {
1826+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1827+ };
1828+ struct psa_outvec out_vec[] = {
1829+ { .base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t) }
1830+ };
1831+
1832+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1833+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1834+
1835+ return status;
1836+}
1837+
1838+static inline psa_status_t crypto_caller_key_derivation_get_capacity(
1839+ struct service_client *context,
1840+ const uint32_t op_handle,
1841+ size_t *capacity)
1842+{
1843+ struct service_client *ipc = context;
1844+ struct rpc_caller *caller = ipc->caller;
1845+ psa_status_t status;
1846+ struct psa_ipc_crypto_pack_iovec iov = {
1847+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_GET_CAPACITY_SID,
1848+ .op_handle = op_handle,
1849+ };
1850+ struct psa_invec in_vec[] = {
1851+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1852+ };
1853+ struct psa_outvec out_vec[] = {
1854+ { .base = psa_ptr_to_u32(capacity), .len = sizeof(uint32_t) }
1855+ };
1856+
1857+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1858+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1859+
1860+ return status;
1861+}
1862+
1863+static inline psa_status_t crypto_caller_key_derivation_set_capacity(
1864+ struct service_client *context,
1865+ uint32_t op_handle,
1866+ size_t capacity)
1867+{
1868+ struct service_client *ipc = context;
1869+ struct rpc_caller *caller = ipc->caller;
1870+ psa_status_t status;
1871+ struct psa_ipc_crypto_pack_iovec iov = {
1872+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_SET_CAPACITY_SID,
1873+ .capacity = capacity,
1874+ .op_handle = op_handle,
1875+ };
1876+ struct psa_invec in_vec[] = {
1877+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1878+ };
1879+
1880+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1881+ IOVEC_LEN(in_vec), NULL, 0);
1882+
1883+ return status;
1884+}
1885+
1886+static inline psa_status_t crypto_caller_key_derivation_input_bytes(
1887+ struct service_client *context,
1888+ uint32_t op_handle,
1889+ psa_key_derivation_step_t step,
1890+ const uint8_t *data,
1891+ size_t data_length)
1892+{
1893+ struct service_client *ipc = context;
1894+ struct rpc_caller *caller = ipc->caller;
1895+ psa_status_t status;
1896+ struct psa_ipc_crypto_pack_iovec iov = {
1897+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_INPUT_BYTES_SID,
1898+ .step = step,
1899+ .op_handle = op_handle,
1900+ };
1901+ struct psa_invec in_vec[] = {
1902+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1903+ { .base = psa_ptr_const_to_u32(data), .len = data_length },
1904+ };
1905+
1906+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1907+ IOVEC_LEN(in_vec), NULL, 0);
1908+
1909+ return status;
1910+}
1911+
1912+static inline psa_status_t crypto_caller_key_derivation_input_key(
1913+ struct service_client *context,
1914+ uint32_t op_handle,
1915+ psa_key_derivation_step_t step,
1916+ psa_key_id_t key)
1917+{
1918+ struct service_client *ipc = context;
1919+ struct rpc_caller *caller = ipc->caller;
1920+ psa_status_t status;
1921+ struct psa_ipc_crypto_pack_iovec iov = {
1922+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_INPUT_KEY_SID,
1923+ .key_id = key,
1924+ .step = step,
1925+ .op_handle = op_handle,
1926+ };
1927+ struct psa_invec in_vec[] = {
1928+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1929+ };
1930+
1931+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1932+ IOVEC_LEN(in_vec), NULL, 0);
1933+
1934+ return status;
1935+}
1936+
1937+static inline psa_status_t crypto_caller_key_derivation_output_bytes(
1938+ struct service_client *context,
1939+ uint32_t op_handle,
1940+ uint8_t *output,
1941+ size_t output_length)
1942+{
1943+ struct service_client *ipc = context;
1944+ struct rpc_caller *caller = ipc->caller;
1945+ psa_status_t status;
1946+ struct psa_ipc_crypto_pack_iovec iov = {
1947+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_OUTPUT_BYTES_SID,
1948+ .op_handle = op_handle,
1949+ };
1950+ struct psa_invec in_vec[] = {
1951+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1952+ };
1953+ struct psa_outvec out_vec[] = {
1954+ { .base = psa_ptr_to_u32(output), .len = output_length },
1955+ };
1956+
1957+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1958+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1959+
1960+ return status;
1961+}
1962+
1963+static inline psa_status_t crypto_caller_key_derivation_output_key(
1964+ struct service_client *context,
1965+ const psa_key_attributes_t *attributes,
1966+ uint32_t op_handle,
1967+ psa_key_id_t *key)
1968+{
1969+ struct service_client *ipc = context;
1970+ struct rpc_caller *caller = ipc->caller;
1971+ psa_status_t status;
1972+ struct psa_ipc_crypto_pack_iovec iov = {
1973+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_OUTPUT_KEY_SID,
1974+ .op_handle = op_handle,
1975+ };
1976+ struct psa_invec in_vec[] = {
1977+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
1978+ { .base = psa_ptr_const_to_u32(attributes),
1979+ .len = sizeof(psa_key_attributes_t) },
1980+ };
1981+ struct psa_outvec out_vec[] = {
1982+ { .base = psa_ptr_to_u32(key), .len = sizeof(psa_key_id_t)},
1983+ };
1984+
1985+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
1986+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
1987+
1988+ return status;
1989+}
1990+
1991+static inline psa_status_t crypto_caller_key_derivation_abort(
1992+ struct service_client *context,
1993+ uint32_t op_handle)
1994+{
1995+ struct service_client *ipc = context;
1996+ struct rpc_caller *caller = ipc->caller;
1997+ psa_status_t status;
1998+ struct psa_ipc_crypto_pack_iovec iov = {
1999+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_ABORT_SID,
2000+ .op_handle = op_handle,
2001+ };
2002+ struct psa_invec in_vec[] = {
2003+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2004+ };
2005+ struct psa_outvec out_vec[] = {
2006+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
2007+ };
2008+
2009+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2010+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2011+
2012+ return status;
2013+}
2014+
2015+static inline psa_status_t crypto_caller_key_derivation_key_agreement(
2016+ struct service_client *context,
2017+ uint32_t op_handle,
2018+ psa_key_derivation_step_t step,
2019+ psa_key_id_t private_key,
2020+ const uint8_t *peer_key,
2021+ size_t peer_key_length)
2022+{
2023+ struct service_client *ipc = context;
2024+ struct rpc_caller *caller = ipc->caller;
2025+ psa_status_t status;
2026+ struct psa_ipc_crypto_pack_iovec iov = {
2027+ .sfn_id = TFM_CRYPTO_KEY_DERIVATION_KEY_AGREEMENT_SID,
2028+ .key_id = private_key,
2029+ .step = step,
2030+ .op_handle = op_handle,
2031+ };
2032+ struct psa_invec in_vec[] = {
2033+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2034+ { .base = psa_ptr_const_to_u32(peer_key),
2035+ .len = peer_key_length},
2036+ };
2037+
2038+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2039+ IOVEC_LEN(in_vec), NULL, 0);
2040+
2041+ return status;
2042+}
2043+
2044+static inline psa_status_t crypto_caller_raw_key_agreement(
2045+ struct service_client *context,
2046+ psa_algorithm_t alg,
2047+ psa_key_id_t private_key,
2048+ const uint8_t *peer_key,
2049+ size_t peer_key_length,
2050+ uint8_t *output,
2051+ size_t output_size,
2052+ size_t *output_length)
2053+{
2054+ struct service_client *ipc = context;
2055+ struct rpc_caller *caller = ipc->caller;
2056+ psa_status_t status;
2057+ struct psa_ipc_crypto_pack_iovec iov = {
2058+ .sfn_id = TFM_CRYPTO_RAW_KEY_AGREEMENT_SID,
2059+ .alg = alg,
2060+ .key_id = private_key,
2061+ };
2062+ struct psa_invec in_vec[] = {
2063+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2064+ { .base = psa_ptr_const_to_u32(peer_key),
2065+ .len = peer_key_length},
2066+ };
2067+ struct psa_outvec out_vec[] = {
2068+ { .base = psa_ptr_to_u32(output), .len = output_size },
2069+ };
2070+
2071+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2072+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2073+
2074+ *output_length = out_vec[0].len;
2075+
2076+ return status;
2077+}
2078+
2079+#ifdef __cplusplus
2080+}
2081+#endif
2082+
2083+#endif /* PSA_IPC_CRYPTO_CALLER_KEY_DERIVATION_H */
2084diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_mac.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_mac.h
2085new file mode 100644
2086index 000000000000..3a820192495a
2087--- /dev/null
2088+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_mac.h
2089@@ -0,0 +1,207 @@
2090+/*
2091+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
2092+ *
2093+ * SPDX-License-Identifier: BSD-3-Clause
2094+ */
2095+
2096+#ifndef PSA_IPC_CRYPTO_CALLER_MAC_H
2097+#define PSA_IPC_CRYPTO_CALLER_MAC_H
2098+
2099+#include <string.h>
2100+#include <stdlib.h>
2101+#include <psa/crypto.h>
2102+#include <psa/client.h>
2103+#include <psa/sid.h>
2104+#include <service/common/client/service_client.h>
2105+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
2106+#include <protocols/rpc/common/packed-c/status.h>
2107+#include <protocols/service/crypto/packed-c/opcodes.h>
2108+#include <protocols/service/crypto/packed-c/key_attributes.h>
2109+#include <protocols/service/crypto/packed-c/import_key.h>
2110+#include "crypto_caller_key_attributes.h"
2111+
2112+#ifdef __cplusplus
2113+extern "C" {
2114+#endif
2115+
2116+static inline psa_status_t crypto_caller_mac_sign_setup(
2117+ struct service_client *context,
2118+ uint32_t *op_handle,
2119+ psa_key_id_t key,
2120+ psa_algorithm_t alg)
2121+{
2122+ struct service_client *ipc = context;
2123+ struct rpc_caller *caller = ipc->caller;
2124+ psa_status_t status;
2125+ struct psa_ipc_crypto_pack_iovec iov = {
2126+ .sfn_id = TFM_CRYPTO_MAC_SIGN_SETUP_SID,
2127+ .key_id = key,
2128+ .alg = alg,
2129+ .op_handle = *op_handle,
2130+ };
2131+ struct psa_invec in_vec[] = {
2132+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2133+ };
2134+ struct psa_outvec out_vec[] = {
2135+ { .base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t) },
2136+ };
2137+
2138+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2139+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2140+
2141+ return status;
2142+}
2143+
2144+static inline psa_status_t crypto_caller_mac_verify_setup(
2145+ struct service_client *context,
2146+ uint32_t *op_handle,
2147+ psa_key_id_t key,
2148+ psa_algorithm_t alg)
2149+{
2150+ struct service_client *ipc = context;
2151+ struct rpc_caller *caller = ipc->caller;
2152+ psa_status_t status;
2153+ struct psa_ipc_crypto_pack_iovec iov = {
2154+ .sfn_id = TFM_CRYPTO_MAC_VERIFY_SETUP_SID,
2155+ .key_id = key,
2156+ .alg = alg,
2157+ .op_handle = *op_handle,
2158+ };
2159+ struct psa_invec in_vec[] = {
2160+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2161+ };
2162+ struct psa_outvec out_vec[] = {
2163+ { .base = psa_ptr_to_u32(op_handle), .len = sizeof(uint32_t) },
2164+ };
2165+
2166+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2167+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2168+
2169+ return status;
2170+}
2171+
2172+static inline psa_status_t crypto_caller_mac_update(
2173+ struct service_client *context,
2174+ uint32_t op_handle,
2175+ const uint8_t *input,
2176+ size_t input_length)
2177+{
2178+ struct service_client *ipc = context;
2179+ struct rpc_caller *caller = ipc->caller;
2180+ psa_status_t status;
2181+ struct psa_ipc_crypto_pack_iovec iov = {
2182+ .sfn_id = TFM_CRYPTO_MAC_UPDATE_SID,
2183+ .op_handle = op_handle,
2184+ };
2185+ struct psa_invec in_vec[] = {
2186+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2187+ { .base = psa_ptr_const_to_u32(input), .len = input_length },
2188+ };
2189+ struct psa_outvec out_vec[] = {
2190+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
2191+ };
2192+
2193+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2194+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2195+
2196+ return status;
2197+}
2198+
2199+static inline psa_status_t crypto_caller_mac_sign_finish(
2200+ struct service_client *context,
2201+ uint32_t op_handle,
2202+ uint8_t *mac,
2203+ size_t mac_size,
2204+ size_t *mac_length)
2205+{
2206+ struct service_client *ipc = context;
2207+ struct rpc_caller *caller = ipc->caller;
2208+ psa_status_t status;
2209+ struct psa_ipc_crypto_pack_iovec iov = {
2210+ .sfn_id = TFM_CRYPTO_MAC_SIGN_FINISH_SID,
2211+ .op_handle = op_handle,
2212+ };
2213+ struct psa_invec in_vec[] = {
2214+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2215+ };
2216+ struct psa_outvec out_vec[] = {
2217+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
2218+ { .base = psa_ptr_to_u32(mac), .len = mac_size },
2219+ };
2220+
2221+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2222+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2223+
2224+ *mac_length = out_vec[1].len;
2225+
2226+ return status;
2227+}
2228+
2229+static inline psa_status_t crypto_caller_mac_verify_finish(
2230+ struct service_client *context,
2231+ uint32_t op_handle,
2232+ const uint8_t *mac,
2233+ size_t mac_length)
2234+{
2235+ struct service_client *ipc = context;
2236+ struct rpc_caller *caller = ipc->caller;
2237+ psa_status_t status;
2238+ struct psa_ipc_crypto_pack_iovec iov = {
2239+ .sfn_id = TFM_CRYPTO_MAC_VERIFY_FINISH_SID,
2240+ .op_handle = op_handle,
2241+ };
2242+ struct psa_invec in_vec[] = {
2243+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2244+ { .base = psa_ptr_const_to_u32(mac), .len = mac_length },
2245+ };
2246+ struct psa_outvec out_vec[] = {
2247+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
2248+ };
2249+
2250+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2251+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2252+
2253+ return status;
2254+}
2255+
2256+static inline psa_status_t crypto_caller_mac_abort(
2257+ struct service_client *context,
2258+ uint32_t op_handle)
2259+{
2260+ struct service_client *ipc = context;
2261+ struct rpc_caller *caller = ipc->caller;
2262+ psa_status_t status;
2263+ struct psa_ipc_crypto_pack_iovec iov = {
2264+ .sfn_id = TFM_CRYPTO_MAC_ABORT_SID,
2265+ .op_handle = op_handle,
2266+ };
2267+ struct psa_invec in_vec[] = {
2268+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2269+ };
2270+ struct psa_outvec out_vec[] = {
2271+ { .base = psa_ptr_to_u32(&op_handle), .len = sizeof(uint32_t) },
2272+ };
2273+
2274+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2275+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2276+
2277+ return status;
2278+}
2279+
2280+static inline size_t crypto_caller_mac_max_update_size(const struct service_client *context)
2281+{
2282+ /* Returns the maximum number of bytes that may be
2283+ * carried as a parameter of the mac_update operation
2284+ * using the packed-c encoding.
2285+ */
2286+ size_t payload_space = context->service_info.max_payload;
2287+ size_t overhead = iov_size;
2288+
2289+ return (payload_space > overhead) ? payload_space - overhead : 0;
2290+}
2291+
2292+#ifdef __cplusplus
2293+}
2294+#endif
2295+
2296+#endif /* PSA_IPC_CRYPTO_CALLER_MAC_H */
2297diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_purge_key.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_purge_key.h
2298new file mode 100644
2299index 000000000000..a3a796e2166c
2300--- /dev/null
2301+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_purge_key.h
2302@@ -0,0 +1,51 @@
2303+/*
2304+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
2305+ *
2306+ * SPDX-License-Identifier: BSD-3-Clause
2307+ */
2308+
2309+#ifndef PACKEDC_CRYPTO_CALLER_PURGE_KEY_H
2310+#define PACKEDC_CRYPTO_CALLER_PURGE_KEY_H
2311+
2312+#include <string.h>
2313+#include <stdlib.h>
2314+#include <psa/crypto.h>
2315+#include <psa/client.h>
2316+#include <psa/sid.h>
2317+#include <service/common/client/service_client.h>
2318+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
2319+#include <protocols/rpc/common/packed-c/status.h>
2320+#include <protocols/service/crypto/packed-c/opcodes.h>
2321+#include <protocols/service/crypto/packed-c/key_attributes.h>
2322+#include <protocols/service/crypto/packed-c/import_key.h>
2323+#include "crypto_caller_key_attributes.h"
2324+
2325+#ifdef __cplusplus
2326+extern "C" {
2327+#endif
2328+
2329+static inline psa_status_t crypto_caller_purge_key(struct service_client *context,
2330+ psa_key_id_t id)
2331+{
2332+ struct service_client *ipc = context;
2333+ struct rpc_caller *caller = ipc->caller;
2334+ psa_status_t status;
2335+ struct psa_ipc_crypto_pack_iovec iov = {
2336+ .sfn_id = TFM_CRYPTO_PURGE_KEY_SID,
2337+ .key_id = id,
2338+ };
2339+ struct psa_invec in_vec[] = {
2340+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
2341+ };
2342+
2343+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2344+ IOVEC_LEN(in_vec), NULL, 0);
2345+
2346+ return status;
2347+}
2348+
2349+#ifdef __cplusplus
2350+}
2351+#endif
2352+
2353+#endif /* PACKEDC_CRYPTO_CALLER_PURGE_KEY_H */
2354diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h
2355new file mode 100644
2356index 000000000000..71d88cededf5
2357--- /dev/null
2358+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_sign_hash.h
2359@@ -0,0 +1,64 @@
2360+/*
2361+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
2362+ *
2363+ * SPDX-License-Identifier: BSD-3-Clause
2364+ */
2365+
2366+#ifndef PSA_IPC_CRYPTO_CALLER_SIGN_HASH_H
2367+#define PSA_IPC_CRYPTO_CALLER_SIGN_HASH_H
2368+
2369+#include <string.h>
2370+#include <stdlib.h>
2371+#include <psa/crypto.h>
2372+#include <psa/client.h>
2373+#include <psa/sid.h>
2374+#include <service/common/client/service_client.h>
2375+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
2376+#include <protocols/rpc/common/packed-c/status.h>
2377+#include <protocols/service/crypto/packed-c/opcodes.h>
2378+#include <protocols/service/crypto/packed-c/key_attributes.h>
2379+#include <protocols/service/crypto/packed-c/import_key.h>
2380+#include "crypto_caller_key_attributes.h"
2381+
2382+#ifdef __cplusplus
2383+extern "C" {
2384+#endif
2385+
2386+static inline psa_status_t crypto_caller_sign_hash(struct service_client *context,
2387+ psa_key_id_t id,
2388+ psa_algorithm_t alg,
2389+ const uint8_t *hash,
2390+ size_t hash_length,
2391+ uint8_t *signature,
2392+ size_t signature_size,
2393+ size_t *signature_length)
2394+{
2395+ struct service_client *ipc = context;
2396+ struct rpc_caller *caller = ipc->caller;
2397+ psa_status_t status;
2398+ struct psa_ipc_crypto_pack_iovec iov = {
2399+ .sfn_id = TFM_CRYPTO_SIGN_HASH_SID,
2400+ .key_id = id,
2401+ .alg = alg,
2402+ };
2403+ struct psa_invec in_vec[] = {
2404+ { .base = psa_ptr_to_u32(&iov), .len = iov_size },
2405+ { .base = psa_ptr_const_to_u32(hash), .len = hash_length },
2406+ };
2407+ struct psa_outvec out_vec[] = {
2408+ { .base = psa_ptr_to_u32(signature), .len = signature_size },
2409+ };
2410+
2411+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2412+ IOVEC_LEN(in_vec), out_vec, IOVEC_LEN(out_vec));
2413+
2414+ *signature_length = out_vec[0].len;
2415+
2416+ return status;
2417+}
2418+
2419+#ifdef __cplusplus
2420+}
2421+#endif
2422+
2423+#endif /* PSA_IPC_CRYPTO_CALLER_SIGN_HASH_H */
2424diff --git a/components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h b/components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h
2425new file mode 100644
2426index 000000000000..e16f6e5450af
2427--- /dev/null
2428+++ b/components/service/crypto/client/caller/psa_ipc/crypto_caller_verify_hash.h
2429@@ -0,0 +1,59 @@
2430+/*
2431+ * Copyright (c) 2021, Arm Limited and Contributors. All rights reserved.
2432+ *
2433+ * SPDX-License-Identifier: BSD-3-Clause
2434+ */
2435+
2436+#ifndef PSA_IPC_CRYPTO_CALLER_VERIFY_HASH_H
2437+#define PSA_IPC_CRYPTO_CALLER_VERIFY_HASH_H
2438+
2439+#include <string.h>
2440+#include <stdlib.h>
2441+#include <psa/crypto.h>
2442+#include <psa/client.h>
2443+#include <psa/sid.h>
2444+#include <service/common/client/service_client.h>
2445+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
2446+#include <protocols/rpc/common/packed-c/status.h>
2447+#include <protocols/service/crypto/packed-c/opcodes.h>
2448+#include <protocols/service/crypto/packed-c/key_attributes.h>
2449+#include <protocols/service/crypto/packed-c/import_key.h>
2450+#include "crypto_caller_key_attributes.h"
2451+
2452+#ifdef __cplusplus
2453+extern "C" {
2454+#endif
2455+
2456+static inline psa_status_t crypto_caller_verify_hash(struct service_client *context,
2457+ psa_key_id_t id,
2458+ psa_algorithm_t alg,
2459+ const uint8_t *hash,
2460+ size_t hash_length,
2461+ const uint8_t *signature,
2462+ size_t signature_length)
2463+{
2464+ struct service_client *ipc = context;
2465+ struct rpc_caller *caller = ipc->caller;
2466+ psa_status_t status;
2467+ struct psa_ipc_crypto_pack_iovec iov = {
2468+ .sfn_id = TFM_CRYPTO_VERIFY_HASH_SID,
2469+ .key_id = id,
2470+ .alg = alg,
2471+ };
2472+ struct psa_invec in_vec[] = {
2473+ { .base = psa_ptr_to_u32(&iov), .len = sizeof(struct psa_ipc_crypto_pack_iovec) },
2474+ { .base = psa_ptr_const_to_u32(hash), .len = hash_length },
2475+ { .base = psa_ptr_const_to_u32(signature), .len = signature_length},
2476+ };
2477+
2478+ status = psa_call(caller, TFM_CRYPTO_HANDLE, PSA_IPC_CALL, in_vec,
2479+ IOVEC_LEN(in_vec), NULL, 0);
2480+
2481+ return status;
2482+}
2483+
2484+#ifdef __cplusplus
2485+}
2486+#endif
2487+
2488+#endif /* PSA_IPC_CRYPTO_CALLER_VERIFY_HASH_H */
2489diff --git a/components/service/crypto/include/psa/crypto_client_struct.h b/components/service/crypto/include/psa/crypto_client_struct.h
2490index abd420c82607..bf95c9821e55 100644
2491--- a/components/service/crypto/include/psa/crypto_client_struct.h
2492+++ b/components/service/crypto/include/psa/crypto_client_struct.h
2493@@ -31,12 +31,12 @@ extern "C" {
2494 * data structure internally. */
2495 struct psa_client_key_attributes_s
2496 {
2497+ uint16_t type;
2498+ uint16_t bits;
2499 uint32_t lifetime;
2500- uint32_t id;
2501- uint32_t alg;
2502+ psa_key_id_t id;
2503 uint32_t usage;
2504- size_t bits;
2505- uint16_t type;
2506+ uint32_t alg;
2507 };
2508
2509 #define PSA_CLIENT_KEY_ATTRIBUTES_INIT {0, 0, 0, 0, 0, 0}
2510diff --git a/components/service/crypto/include/psa/crypto_sizes.h b/components/service/crypto/include/psa/crypto_sizes.h
2511index 7a0149bbca62..4d7bf6e959b0 100644
2512--- a/components/service/crypto/include/psa/crypto_sizes.h
2513+++ b/components/service/crypto/include/psa/crypto_sizes.h
2514@@ -81,7 +81,7 @@
2515 #define PSA_HASH_MAX_SIZE 64
2516 #define PSA_HMAC_MAX_HASH_BLOCK_SIZE 128
2517 #else
2518-#define PSA_HASH_MAX_SIZE 32
2519+#define PSA_HASH_MAX_SIZE 64
2520 #define PSA_HMAC_MAX_HASH_BLOCK_SIZE 64
2521 #endif
2522
2523diff --git a/deployments/se-proxy/common/service_proxy_factory.c b/deployments/se-proxy/common/service_proxy_factory.c
2524index 1110ac46bf8b..7edeef8b434a 100644
2525--- a/deployments/se-proxy/common/service_proxy_factory.c
2526+++ b/deployments/se-proxy/common/service_proxy_factory.c
2527@@ -15,7 +15,7 @@
2528 #include <trace.h>
2529
2530 /* Stub backends */
2531-#include <service/crypto/backend/stub/stub_crypto_backend.h>
2532+#include <service/crypto/backend/psa_ipc/crypto_ipc_backend.h>
2533 #include <service/secure_storage/backend/secure_storage_ipc/secure_storage_ipc.h>
2534 #include <service/secure_storage/backend/mock_store/mock_store.h>
2535
2536@@ -47,12 +47,17 @@ struct rpc_interface *crypto_proxy_create(void)
2537 {
2538 struct rpc_interface *crypto_iface = NULL;
2539 struct crypto_provider *crypto_provider;
2540+ struct rpc_caller *crypto_caller;
2541
2542- if (stub_crypto_backend_init() == PSA_SUCCESS) {
2543+ crypto_caller = openamp_caller_init(&openamp);
2544+ if (!crypto_caller)
2545+ return NULL;
2546+
2547+ if (crypto_ipc_backend_init(&openamp.rpc_caller) != PSA_SUCCESS)
2548+ return NULL;
2549
2550- crypto_provider = crypto_provider_factory_create();
2551- crypto_iface = service_provider_get_rpc_interface(&crypto_provider->base_provider);
2552- }
2553+ crypto_provider = crypto_provider_factory_create();
2554+ crypto_iface = service_provider_get_rpc_interface(&crypto_provider->base_provider);
2555
2556 return crypto_iface;
2557 }
Patrick Williams975a06f2022-10-21 14:42:47 -0500[diff] [blame]2558diff --git a/platform/providers/arm/corstone1000/platform.cmake b/platform/providers/arm/corstone1000/platform.cmake
2559index bb778bb9719b..51e5faa3e4d8 100644
2560--- a/platform/providers/arm/corstone1000/platform.cmake
2561+++ b/platform/providers/arm/corstone1000/platform.cmake
2562@@ -8,3 +8,5 @@
2563
2564 # include MHU driver
2565 include(${TS_ROOT}/platform/drivers/arm/mhu_driver/component.cmake)
2566+
2567+add_compile_definitions(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
2568--
Patrick Williams7784c422022-11-17 07:29:11 -0600[diff] [blame^]25692.38.1
Patrick Williams975a06f2022-10-21 14:42:47 -0500[diff] [blame]2570