From 5c81b9403da3997f70d398c6e7bbc810356719a3 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Tue, 16 Jul 2024 20:49:36 +0200 Subject: [PATCH] Dynamic key store: disable full-key-store tests It's impractical to fill the key store when it can grow to accommodate millions of keys. A later commit will restore those tests in test configurations with the dynamic key store. Signed-off-by: Gilles Peskine --- ...test_suite_psa_crypto_slot_management.function | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/tf-psa-crypto/tests/suites/test_suite_psa_crypto_slot_management.function b/tf-psa-crypto/tests/suites/test_suite_psa_crypto_slot_management.function index f679f2e889..b2d3f29735 100644 --- a/tf-psa-crypto/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tf-psa-crypto/tests/suites/test_suite_psa_crypto_slot_management.function @@ -101,7 +101,11 @@ exit: /* Currently, there is always a maximum number of volatile keys that can * realistically be reached in tests. When we add configurations where this * is not true, undefine the macro in such configurations. */ +#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) +#undef MAX_VOLATILE_KEYS +#else /* Static key store */ #define MAX_VOLATILE_KEYS MBEDTLS_PSA_KEY_SLOT_COUNT +#endif /* END_HEADER */ @@ -1028,7 +1032,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_STORAGE_C */ +/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_STORAGE_C:!MBEDTLS_PSA_KEY_STORE_DYNAMIC */ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() { psa_status_t status; @@ -1068,7 +1072,14 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() TEST_ASSERT(mbedtls_svc_key_id_equal(returned_key_id, persistent_key)); /* - * Create the maximum available number of volatile keys + * Create the maximum available number of keys that are locked in + * memory. This can be: + * - volatile keys, when MBEDTLS_PSA_KEY_STORE_DYNAMIC is disabled; + * - opened persistent keys (could work, but not currently implemented + * in this test function); + * - keys in use by another thread (we don't do this because it would + * be hard to arrange and we can't control how long the keys are + * locked anyway). */ psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE); for (i = 0; i < available_key_slots; i++) {