Skip to content

Commit f45d111

Browse files
AlexLanzanoAlexLanzano
committed
rename defaultDevId back to devId. Address copilot comments
1 parent 78735dd commit f45d111

9 files changed

Lines changed: 61 additions & 67 deletions

‎docs/draft/crypto_affinity.md‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -54,23 +54,23 @@ Retrieves the client's current crypto affinity. This is a **local operation** th
5454
```c
5555
uint32_t affinity;
5656

57-
/* Default affinity is WH_CRYPTO_AFFINITY_SW after wh_Client_Init() */
57+
/* Default affinity is WH_CRYPTO_AFFINITY_HW after wh_Client_Init() */
5858
wh_Client_GetCryptoAffinity(client, &affinity);
59-
/* affinity == WH_CRYPTO_AFFINITY_SW */
60-
61-
/* Switch to hardware crypto -- takes effect immediately, no round-trip */
62-
int rc = wh_Client_SetCryptoAffinity(client, WH_CRYPTO_AFFINITY_HW);
63-
if (rc == WH_ERROR_OK) {
64-
/* All subsequent crypto operations will request HW acceleration */
65-
}
59+
/* affinity == WH_CRYPTO_AFFINITY_HW */
6660

6761
/* Perform a crypto operation -- affinity is sent in the request header */
6862
wc_AesCbcEncrypt(&aes, out, in, len);
6963
/* If server has a valid devId, hardware crypto callback is used */
7064

71-
/* Switch back to software crypto */
72-
wh_Client_SetCryptoAffinity(client, WH_CRYPTO_AFFINITY_SW);
73-
/* Subsequent crypto operations use software implementation */
65+
/* Switch to software crypto -- takes effect immediately, no round-trip */
66+
int rc = wh_Client_SetCryptoAffinity(client, WH_CRYPTO_AFFINITY_SW);
67+
if (rc == WH_ERROR_OK) {
68+
/* All subsequent crypto operations will use software implementation */
69+
}
70+
71+
/* Switch back to hardware crypto */
72+
wh_Client_SetCryptoAffinity(client, WH_CRYPTO_AFFINITY_HW);
73+
/* Subsequent crypto operations request HW acceleration */
7474
```
7575
7676
## Server Behavior
@@ -80,9 +80,9 @@ When the server receives a crypto request, it reads the affinity field from the
8080
| Affinity in Request | Server Action |
8181
|---------------------|---------------|
8282
| `WH_CRYPTO_AFFINITY_SW` | Uses `INVALID_DEVID` (wolfCrypt software implementation) |
83-
| `WH_CRYPTO_AFFINITY_HW` | Uses `server->defaultDevId` if valid, otherwise falls back to `INVALID_DEVID` |
83+
| `WH_CRYPTO_AFFINITY_HW` | Uses `server->devId` if valid, otherwise falls back to `INVALID_DEVID` |
8484
85-
The `defaultDevId` is configured at server initialization from `config->devId`. If the server was not configured with a valid hardware `devId`, hardware affinity requests will silently fall back to software crypto.
85+
The `devId` is configured at server initialization from `config->devId`. If the server was not configured with a valid hardware `devId`, hardware affinity requests will silently fall back to software crypto.
8686
8787
## Protocol Details
8888

‎src/wh_server.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -77,8 +77,8 @@ int wh_Server_Init(whServerContext* server, whServerConfig* config)
7777
server->nvm = config->nvm;
7878

7979
#ifndef WOLFHSM_CFG_NO_CRYPTO
80-
server->crypto = config->crypto;
81-
server->defaultDevId = config->devId;
80+
server->crypto = config->crypto;
81+
server->devId = config->devId;
8282
#ifdef WOLFHSM_CFG_SHE_EXTENSION
8383
server->she = config->she;
8484
#endif

‎src/wh_server_crypto.c‎

Lines changed: 4 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4431,8 +4431,8 @@ int wh_Server_HandleCryptoRequest(whServerContext* ctx, uint16_t magic,
44314431

44324432
/* Compute devId from the per-message affinity field */
44334433
int devId = (rqstHeader.affinity == WH_CRYPTO_AFFINITY_HW &&
4434-
ctx->defaultDevId != INVALID_DEVID)
4435-
? ctx->defaultDevId
4434+
ctx->devId != INVALID_DEVID)
4435+
? ctx->devId
44364436
: INVALID_DEVID;
44374437

44384438
WH_DEBUG_SERVER_VERBOSE("HandleCryptoRequest. Action:%u\n", action);
@@ -4527,12 +4527,6 @@ int wh_Server_HandleCryptoRequest(whServerContext* ctx, uint16_t magic,
45274527
&cryptoOutSize);
45284528
break;
45294529
#endif /* HAVE_ECC_VERIFY */
4530-
#if 0
4531-
case WC_PK_TYPE_EC_CHECK_PRIV_KEY:
4532-
ret = _HandleEccCheckPrivKey(ctx, magic, devId, cryptoDataIn, cryptoInSize,
4533-
cryptoDataOut, &cryptoOutSize);
4534-
break;
4535-
#endif
45364530
#endif /* HAVE_ECC */
45374531

45384532
#ifdef HAVE_CURVE25519
@@ -5900,8 +5894,8 @@ int wh_Server_HandleCryptoDmaRequest(whServerContext* ctx, uint16_t magic,
59005894

59015895
/* Compute devId from the per-message affinity field */
59025896
int devId = (rqstHeader.affinity == WH_CRYPTO_AFFINITY_HW &&
5903-
ctx->defaultDevId != INVALID_DEVID)
5904-
? ctx->defaultDevId
5897+
ctx->devId != INVALID_DEVID)
5898+
? ctx->devId
59055899
: INVALID_DEVID;
59065900

59075901
switch (action) {

‎src/wh_server_img_mgr.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -239,11 +239,11 @@ int wh_Server_ImgMgrVerifyMethodEccWithSha256(whServerImgMgrContext* context,
239239

240240
/* Hash the image data from server pointer using one-shot API */
241241
ret = wc_Sha256Hash_ex((const uint8_t*)serverPtr, (word32)img->size, hash,
242-
NULL, server->defaultDevId);
242+
NULL, server->devId);
243243
#else
244244
/* Hash the image data using one-shot API */
245245
ret = wc_Sha256Hash_ex((const uint8_t*)img->addr, (word32)img->size, hash,
246-
NULL, context->server->defaultDevId);
246+
NULL, context->server->devId);
247247
#endif
248248
if (ret != 0) {
249249
wc_ecc_free(&eccKey);
@@ -319,11 +319,11 @@ int wh_Server_ImgMgrVerifyMethodAesCmac(whServerImgMgrContext* context,
319319
/* Compute CMAC of the image data from server pointer */
320320
ret = wc_AesCmacVerify_ex(&cmac, sig, (word32)sigSz, (const byte*)serverPtr,
321321
(word32)img->size, key, (word32)keySz, NULL,
322-
server->defaultDevId);
322+
server->devId);
323323
#else
324324
ret = wc_AesCmacVerify_ex(&cmac, sig, (word32)sigSz, (const byte*)img->addr,
325325
(word32)img->size, key, (word32)keySz, NULL,
326-
context->server->defaultDevId);
326+
context->server->devId);
327327
#endif
328328
if (ret != 0) {
329329
return ret;
@@ -389,11 +389,11 @@ int wh_Server_ImgMgrVerifyMethodRsaSslWithSha256(
389389

390390
/* Hash the image data from server pointer using one-shot API */
391391
ret = wc_Sha256Hash_ex((const uint8_t*)serverPtr, (word32)img->size, hash,
392-
NULL, server->defaultDevId);
392+
NULL, server->devId);
393393
#else
394394
/* Hash the image data using one-shot API */
395395
ret = wc_Sha256Hash_ex((const uint8_t*)img->addr, (word32)img->size, hash,
396-
NULL, context->server->defaultDevId);
396+
NULL, context->server->devId);
397397
#endif
398398
if (ret != 0) {
399399
wc_FreeRsaKey(&rsaKey);

‎src/wh_server_keystore.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -943,7 +943,7 @@ static int _AesGcmKeyWrap(whServerContext* server, whKeyId serverKeyId,
943943
}
944944

945945
/* Initialize AES context and set it to use the server side key */
946-
ret = wc_AesInit(aes, NULL, server->defaultDevId);
946+
ret = wc_AesInit(aes, NULL, server->devId);
947947
if (ret != 0) {
948948
return ret;
949949
}
@@ -1023,7 +1023,7 @@ static int _AesGcmKeyUnwrap(whServerContext* server, uint16_t serverKeyId,
10231023
}
10241024

10251025
/* Initialize AES context and set it to use the server side key */
1026-
ret = wc_AesInit(aes, NULL, server->defaultDevId);
1026+
ret = wc_AesInit(aes, NULL, server->devId);
10271027
if (ret != 0) {
10281028
return ret;
10291029
}
@@ -1084,7 +1084,7 @@ static int _AesGcmDataWrap(whServerContext* server, whKeyId serverKeyId,
10841084
serverKeySz = serverKeyMetadata->len;
10851085

10861086
/* Initialize AES context and set it to use the server side key */
1087-
ret = wc_AesInit(aes, NULL, server->defaultDevId);
1087+
ret = wc_AesInit(aes, NULL, server->devId);
10881088
if (ret != 0) {
10891089
return ret;
10901090
}
@@ -1150,7 +1150,7 @@ static int _AesGcmDataUnwrap(whServerContext* server, uint16_t serverKeyId,
11501150
serverKeySz = serverKeyMetadata->len;
11511151

11521152
/* Initialize AES context and set it to use the server side key */
1153-
ret = wc_AesInit(aes, NULL, server->defaultDevId);
1153+
ret = wc_AesInit(aes, NULL, server->devId);
11541154
if (ret != 0) {
11551155
return ret;
11561156
}

‎src/wh_server_she.c‎

Lines changed: 23 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,8 @@ static int _AesMp16(whServerContext* server, uint8_t* in, word32 inSz,
166166
if (server == NULL || server->she == NULL) {
167167
return WH_ERROR_BADARGS;
168168
}
169-
return wh_She_AesMp16_ex(server->she->sheAes, NULL, server->defaultDevId,
170-
in, inSz, out);
169+
return wh_She_AesMp16_ex(server->she->sheAes, NULL, server->devId, in, inSz,
170+
out);
171171
}
172172

173173
/* AuthID is the 4 rightmost bits of messageOne */
@@ -262,7 +262,7 @@ static int _SecureBootInit(whServerContext* server, uint16_t magic,
262262
* expected digest so meta->len will be too long */
263263
if (ret == 0) {
264264
ret = wc_InitCmac_ex(server->she->sheCmac, macKey, WH_SHE_KEY_SZ,
265-
WC_CMAC_AES, NULL, NULL, server->defaultDevId);
265+
WC_CMAC_AES, NULL, NULL, server->devId);
266266
}
267267
/* hash 12 zeros */
268268
if (ret == 0) {
@@ -498,10 +498,9 @@ static int _LoadKey(whServerContext* server, uint16_t magic, uint16_t req_size,
498498
sizeof(req.messageTwo));
499499

500500
field = AES_BLOCK_SIZE;
501-
ret = wc_AesCmacGenerate_ex(server->she->sheCmac, cmacOutput,
502-
(word32*)&field, cmacInput,
503-
sizeof(cmacInput), tmpKey, WH_SHE_KEY_SZ,
504-
NULL, server->defaultDevId);
501+
ret = wc_AesCmacGenerate_ex(
502+
server->she->sheCmac, cmacOutput, (word32*)&field, cmacInput,
503+
sizeof(cmacInput), tmpKey, WH_SHE_KEY_SZ, NULL, server->devId);
505504
}
506505
/* compare digest to M3 */
507506
if (ret == 0 && memcmp(req.messageThree, cmacOutput, field) != 0) {
@@ -518,7 +517,7 @@ static int _LoadKey(whServerContext* server, uint16_t magic, uint16_t req_size,
518517
}
519518
/* decrypt messageTwo */
520519
if (ret == 0) {
521-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
520+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
522521
}
523522
if (ret == 0) {
524523
ret = wc_AesSetKey(server->she->sheAes, tmpKey, WH_SHE_KEY_SZ, NULL,
@@ -611,7 +610,7 @@ static int _LoadKey(whServerContext* server, uint16_t magic, uint16_t req_size,
611610
meta->len + sizeof(_SHE_KEY_UPDATE_ENC_C), tmpKey);
612611
}
613612
if (ret == 0) {
614-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
613+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
615614
}
616615
if (ret == 0) {
617616
ret = wc_AesSetKey(server->she->sheAes, tmpKey, WH_SHE_KEY_SZ, NULL,
@@ -651,7 +650,7 @@ static int _LoadKey(whServerContext* server, uint16_t magic, uint16_t req_size,
651650
ret = wc_AesCmacGenerate_ex(server->she->sheCmac, resp.messageFive,
652651
(word32*)&field, resp.messageFour,
653652
sizeof(resp.messageFour), tmpKey,
654-
WH_SHE_KEY_SZ, NULL, server->defaultDevId);
653+
WH_SHE_KEY_SZ, NULL, server->devId);
655654
}
656655
if (ret == 0) {
657656
/* mark if the ram key was loaded */
@@ -764,7 +763,7 @@ static int _ExportRamKey(whServerContext* server, uint16_t magic,
764763
}
765764
/* encrypt M2 with K1 */
766765
if (ret == 0) {
767-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
766+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
768767
}
769768
if (ret == 0) {
770769
ret = wc_AesSetKey(server->she->sheAes, tmpKey, WH_SHE_KEY_SZ, NULL,
@@ -795,10 +794,9 @@ static int _ExportRamKey(whServerContext* server, uint16_t magic,
795794
sizeof(resp.messageTwo));
796795

797796
field = AES_BLOCK_SIZE;
798-
ret = wc_AesCmacGenerate_ex(server->she->sheCmac, resp.messageThree,
799-
(word32*)&field, cmacInput,
800-
sizeof(cmacInput), tmpKey, WH_SHE_KEY_SZ,
801-
NULL, server->defaultDevId);
797+
ret = wc_AesCmacGenerate_ex(
798+
server->she->sheCmac, resp.messageThree, (word32*)&field, cmacInput,
799+
sizeof(cmacInput), tmpKey, WH_SHE_KEY_SZ, NULL, server->devId);
802800
}
803801
if (ret == 0) {
804802
/* copy the ram key to kdfInput */
@@ -812,7 +810,7 @@ static int _ExportRamKey(whServerContext* server, uint16_t magic,
812810
}
813811
/* set K3 as encryption key */
814812
if (ret == 0) {
815-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
813+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
816814
}
817815
if (ret == 0) {
818816
ret = wc_AesSetKey(server->she->sheAes, tmpKey, WH_SHE_KEY_SZ, NULL,
@@ -850,7 +848,7 @@ static int _ExportRamKey(whServerContext* server, uint16_t magic,
850848
ret = wc_AesCmacGenerate_ex(server->she->sheCmac, resp.messageFive,
851849
(word32*)&field, resp.messageFour,
852850
sizeof(resp.messageFour), tmpKey,
853-
WH_SHE_KEY_SZ, NULL, server->defaultDevId);
851+
WH_SHE_KEY_SZ, NULL, server->devId);
854852
}
855853

856854
resp.rc = _TranslateSheReturnCode(ret);
@@ -914,7 +912,7 @@ static int _InitRnd(whServerContext* server, uint16_t magic, uint16_t req_size,
914912
}
915913
/* set up aes */
916914
if (ret == 0) {
917-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
915+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
918916
}
919917
if (ret == 0) {
920918
ret = wc_AesSetKey(server->she->sheAes, tmpKey, WH_SHE_KEY_SZ, NULL,
@@ -979,7 +977,7 @@ static int _Rnd(whServerContext* server, uint16_t magic, uint16_t req_size,
979977

980978
/* set up aes */
981979
if (ret == 0) {
982-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
980+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
983981
}
984982

985983
/* use PRNG_KEY as the encryption key */
@@ -1105,7 +1103,7 @@ static int _EncEcb(whServerContext* server, uint16_t magic, uint16_t req_size,
11051103
WH_MAKE_KEYID(WH_KEYTYPE_SHE, server->comm->client_id, req.keyId), NULL,
11061104
tmpKey, &keySz);
11071105
if (ret == 0) {
1108-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
1106+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
11091107
}
11101108
else {
11111109
ret = WH_SHE_ERC_KEY_NOT_AVAILABLE;
@@ -1164,7 +1162,7 @@ static int _EncCbc(whServerContext* server, uint16_t magic, uint16_t req_size,
11641162
tmpKey, &keySz);
11651163

11661164
if (ret == 0) {
1167-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
1165+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
11681166
}
11691167
else {
11701168
ret = WH_SHE_ERC_KEY_NOT_AVAILABLE;
@@ -1229,7 +1227,7 @@ static int _DecEcb(whServerContext* server, uint16_t magic, uint16_t req_size,
12291227
WH_MAKE_KEYID(WH_KEYTYPE_SHE, server->comm->client_id, req.keyId), NULL,
12301228
tmpKey, &keySz);
12311229
if (ret == 0) {
1232-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
1230+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
12331231
}
12341232
else {
12351233
ret = WH_SHE_ERC_KEY_NOT_AVAILABLE;
@@ -1293,7 +1291,7 @@ static int _DecCbc(whServerContext* server, uint16_t magic, uint16_t req_size,
12931291
tmpKey, &keySz);
12941292

12951293
if (ret == 0) {
1296-
ret = wc_AesInit(server->she->sheAes, NULL, server->defaultDevId);
1294+
ret = wc_AesInit(server->she->sheAes, NULL, server->devId);
12971295
}
12981296
else {
12991297
ret = WH_SHE_ERC_KEY_NOT_AVAILABLE;
@@ -1355,7 +1353,7 @@ static int _GenerateMac(whServerContext* server, uint16_t magic,
13551353
if (ret == 0) {
13561354
ret = wc_AesCmacGenerate_ex(server->she->sheCmac, resp.mac,
13571355
(word32*)&field, in, req.sz, tmpKey,
1358-
WH_SHE_KEY_SZ, NULL, server->defaultDevId);
1356+
WH_SHE_KEY_SZ, NULL, server->devId);
13591357
}
13601358
else {
13611359
ret = WH_SHE_ERC_KEY_NOT_AVAILABLE;
@@ -1399,7 +1397,7 @@ static int _VerifyMac(whServerContext* server, uint16_t magic,
13991397
if (ret == 0) {
14001398
ret = wc_AesCmacVerify_ex(server->she->sheCmac, mac, req.macLen,
14011399
message, req.messageLen, tmpKey, keySz, NULL,
1402-
server->defaultDevId);
1400+
server->devId);
14031401
/* only evaluate if key was found */
14041402
if (ret == 0) {
14051403
resp.status = 0;

‎test/wh_test_crypto_affinity.c‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2024 wolfSSL Inc.
2+
* Copyright (C) 2026 wolfSSL Inc.
33
*
44
* This file is part of wolfHSM.
55
*
@@ -202,8 +202,8 @@ static int whTest_CryptoAffinityWithCb(void)
202202
WH_TEST_RETURN_ON_FAIL(wh_Server_HandleRequestMessage(server));
203203
WH_TEST_RETURN_ON_FAIL(wh_Client_CommInitResponse(client, NULL, NULL));
204204

205-
/* Verify server initial state - defaultDevId should be set */
206-
WH_TEST_ASSERT_RETURN(server->defaultDevId == TEST_DEV_ID);
205+
/* Verify server initial state - devId should be set */
206+
WH_TEST_ASSERT_RETURN(server->devId == TEST_DEV_ID);
207207

208208
/* Test 1: Default affinity after init should be HW (0) */
209209
rc = wh_Client_GetCryptoAffinity(client, &affinity);
@@ -421,7 +421,7 @@ static int whTest_CryptoAffinityNoCb(void)
421421
WH_TEST_RETURN_ON_FAIL(wh_Client_CommInitResponse(client, NULL, NULL));
422422

423423
/* Verify server configured with INVALID_DEVID */
424-
WH_TEST_ASSERT_RETURN(server->defaultDevId == INVALID_DEVID);
424+
WH_TEST_ASSERT_RETURN(server->devId == INVALID_DEVID);
425425

426426
/* Test 1: Default affinity should be HW */
427427
rc = wh_Client_GetCryptoAffinity(client, &affinity);
@@ -438,7 +438,7 @@ static int whTest_CryptoAffinityNoCb(void)
438438

439439
/* Test 3: Set HW affinity on client side succeeds (it's just local state).
440440
* But when the server processes a request with HW affinity and no valid
441-
* defaultDevId, it will use INVALID_DEVID (SW) anyway. */
441+
* devId, it will use INVALID_DEVID (SW) anyway. */
442442
rc = wh_Client_SetCryptoAffinity(client, WH_CRYPTO_AFFINITY_HW);
443443
WH_TEST_ASSERT_RETURN(rc == WH_ERROR_OK);
444444

‎test/wh_test_crypto_affinity.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (C) 2024 wolfSSL Inc.
2+
* Copyright (C) 2026 wolfSSL Inc.
33
*
44
* This file is part of wolfHSM.
55
*

0 commit comments

Comments
 (0)