cr50: merge crypto_enabled() and fips_crypto_allowed()

We need to block access to all crypto in case of FIPS errors. There are
multiple steps to implement, this is one of few.

There is common API crypto_enabled() which is used by nvmem and some
other functions to check wherever access to crypto is possible.
This is same intent as fips_crypto_allowed(), though the latter checks
for FIPS KAT errors, while the former checks only key ladder status.

Here we make all FIPS errors to revoke access from key ladder, and
fips_crypto_allowed() to check key ladder status. This way we also
ensure that in case of FIPS errors access to device secrets will be
blocked.

We moved crypto_api.c from chip/g to board/cr50 to move crypto_enabled()
into fips.c and alias it to fips_crypto_enabled().

crypto_api.h is no longer included from dcrypto.h, and compile time
assert for cipher salt size is moved to proper place.

Since crypto is used by nvmem_init(), move FIPS power-up tests earlier
to ensure nvmem_init() can access crypto.

BUG=b:197893750
TEST=make CRYPTO_TEST=1; tpm_test; check nvmem is properly initialized
on board_init().

Signed-off-by: Vadim Sukhomlinov <sukhomlinov@google.com>
Change-Id: If70c2a21d61348bd97a47e26db5d8eec08bbf8ed
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/ec/+/3123836
Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
Tested-by: Vadim Sukhomlinov <sukhomlinov@chromium.org>
Commit-Queue: Vadim Sukhomlinov <sukhomlinov@chromium.org>

1 files changed, 2 insertions, 0 deletions

diff --git a/board/cr50/dcrypto/app_cipher.c b/board/cr50/dcrypto/app_cipher.c
index 125b443ee6..811d6feda1 100644
--- a/board/cr50/dcrypto/app_cipher.c
+++ b/board/cr50/dcrypto/app_cipher.c
@@ -3,6 +3,7 @@
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  */
+#include "crypto_api.h"
 #include "dcrypto.h"
 #include "registers.h"
 
@@ -141,6 +142,7 @@ int DCRYPTO_app_cipher(enum dcrypto_appid appid, const void *salt,
 		/* Initialize key, and AES engine. */
 		uint32_t iv[4];
 
+		BUILD_ASSERT(sizeof(iv) == CIPHER_SALT_SIZE);
 		memcpy(iv, salt, sizeof(iv));
 		if (!aes_init(&ctx, appid, iv))
 			return 0;