/*===========================================================================
 *  Copyright (c) 2018 - 2023 Qualcomm Technologies, Inc.
 *  All Rights Reserved.
 *  Confidential and Proprietary - Qualcomm Technologies, Inc.
 *=========================================================================*/

#ifndef __QSEE_FIPS_SERVICES_H
#define __QSEE_FIPS_SERVICES_H

/**
@file qsee_fips_services.h
@brief Definitions for services provided for an OEM to prove FIPS compliance.
*/

#include <stddef.h>
#include <stdint.h>

/**
@addtogroup qtee_fips_services
@{
*/

/*----------------------------------------------------------------------------
 * Preprocessor Definitions and Constants
 * -------------------------------------------------------------------------*/

#define QSEE_FIPS_SUCCESS 0
#define QSEE_FIPS_FAILURE 1
#define QSEE_FIPS_INVALID_PARAM 2

/*----------------------------------------------------------------------------
 * Type Declarations
 * -------------------------------------------------------------------------*/

/**
  These values are returned when qsee_get_fips_info is called
  with QSEE_FIPS_FUSE_STATUS.
 */
typedef enum {
    QSEE_FIPS_FUSE_NOT_BLOWN = 0,
    /**< The FIPS enablement fuse has been not been blown. */
    QSEE_FIPS_FUSE_BLOWN = 1,
    /**< The FIPS enablement fuse has been blown. */
} QSEE_FIPS_FUSE_STATUS_TYPE;

/**
  These values are returned when qsee_get_fips_info is called
  with QSEE_FIPS_SELFTEST_STATUS.
 */
typedef enum {
    QSEE_CRYPTO_SELFTEST_NOT_RUN = 0,
    /**< The crypto selftest has not been run.
         FIPS is not enabled and no TA requiring a selftest has been loaded. */
    QSEE_CRYPTO_SELFTEST_PASSED = 1,
    /**< The crypto selftest has passed. */
} QSEE_FIPS_SELFTEST_STATUS_TYPE;

/**
  These values are returned when qsee_get_fips_info is called with the
  QSEE_FIPS_ENABLEMENT option. \n \n
  This is supported to make testing FIPS features easier by allowing a tester
  to check whether the FIPS features are enabled. \n \n

  CAUTION: The module is ONLY considered FIPS certified if the FIPS enablement
  fuse is blown. \n
  To check whether the module is offically in FIPS certified mode, check the
  QSEE_FIPS_FUSE_STATUS option. \n
 */
typedef enum {
    QSEE_FIPS_DISABLED = 0,
    /**< FIPS is not enabled */
    QSEE_FIPS_ENABLED = 1,
    /**< FIPS is enabled */
} QSEE_FIPS_ENABLEMENT_TYPE;

/**
  These options can be used for the info_type parameter in
  qsee_get_fips_info().
 */
typedef enum {
    QSEE_FIPS_MODULE_HMAC = 0,
    /**< Pass a 32 byte buffer with this option
         to get the crypto module HMAC. \n
         Returns the HMAC of the 32bit module when called by a 32bit TA. \n
         Returns the HMAC of the 64bit module when called by a 64bit TA. \n */
    QSEE_FIPS_FUSE_STATUS = 1,
    /**< Pass a 4 byte buffer with this option
         to check if FIPS is enabled by fuse */
    QSEE_FIPS_SELFTEST_STATUS = 2,
    /**< Pass a 4 byte buffer with this option
         to check whether the selftest has run */
    QSEE_FIPS_ENABLEMENT = 3,
    /**< Pass a 4 byte buffer with this option
         to check whether FIPS features are enabled */
    QSEE_FIPS_HW_VERSION = 4,
    /**< Pass a 4 byte buffer with this option
         to check HW version */
} QSEE_FIPS_INFO_TYPE;

/**
  Status to be returned from qsee_get_fips_approval_status().
 */
typedef enum {
    QSEE_FIPS_APPROVED = 0,
    /**< Service FIPS approved \n */
    QSEE_FIPS_NOT_APPROVED = 1,
    /**< Service not FIPS approved \n */
    QSEE_FIPS_SUNSET_AFTER_2023 = 2,
    /**< Service not approved after 2023 \n */
    QSEE_FIPS_INVALID_SERVICE_ID = 3,
    /**< Service ID/name is invalid \n */
} QSEE_FIPS_APPROVAL_STATUS_TYPE;

/**
  List of Approved services to be used as parameter in
  qsee_get_fips_approval_status().
 */
typedef enum {
    QSEE_FIPS_CRYPTO_SVC_APPROVED = 0,
    /**< List of approved Hash services \n */
    QSEE_FIPS_SHA1 = QSEE_FIPS_CRYPTO_SVC_APPROVED,
    QSEE_FIPS_SHA224,
    QSEE_FIPS_SHA256,
    QSEE_FIPS_SHA384,
    QSEE_FIPS_SHA512,

    /**< List of approved MAC services \n */
    QSEE_FIPS_HMAC_SHA1_KEYLEN_BETWEEN_112_AND_512_BITS,
    QSEE_FIPS_HMAC_SHA224_KEYLEN_BETWEEN_112_AND_512_BITS,
    QSEE_FIPS_HMAC_SHA256_KEYLEN_BETWEEN_112_AND_512_BITS,
    QSEE_FIPS_HMAC_SHA384_KEYLEN_BETWEEN_112_AND_512_BITS,
    QSEE_FIPS_HMAC_SHA512_KEYLEN_BETWEEN_112_AND_512_BITS,

    /**< List of approved symmetric cipher services \n */
    QSEE_FIPS_AES_128_CBC,
    QSEE_FIPS_AES_128_ECB,
    QSEE_FIPS_AES_128_CTR,
    QSEE_FIPS_AES_128_CCM,
    QSEE_FIPS_AES_128_XTS,
    QSEE_FIPS_AES_192_CBC,
    QSEE_FIPS_AES_192_ECB,
    QSEE_FIPS_AES_192_CTR,
    QSEE_FIPS_AES_192_CCM,
    QSEE_FIPS_AES_192_XTS,
    QSEE_FIPS_AES_256_CBC,
    QSEE_FIPS_AES_256_ECB,
    QSEE_FIPS_AES_256_CTR,
    QSEE_FIPS_AES_256_CCM,
    QSEE_FIPS_AES_256_XTS,

    /**< List of approved symmetric cipher services with text stealing \n */
    QSEE_FIPS_AES_128_CTS,
    QSEE_FIPS_AES_192_CTS,
    QSEE_FIPS_AES_256_CTS,

    /**< List of approved streaming cipher services \n */
    QSEE_FIPS_AES_128_OFB,
    QSEE_FIPS_AES_192_OFB,
    QSEE_FIPS_AES_256_OFB,
    QSEE_FIPS_AES_128_CFB128,
    QSEE_FIPS_AES_192_CFB128,
    QSEE_FIPS_AES_256_CFB128,

    /**< List of approved Public Key services \n */
    QSEE_FIPS_ECDH_KEY_PAIR_GEN_P224,
    QSEE_FIPS_ECDH_KEY_PAIR_GEN_P256,
    QSEE_FIPS_ECDH_KEY_PAIR_GEN_P384,
    QSEE_FIPS_ECDH_KEY_PAIR_GEN_P521,

    QSEE_FIPS_ECDH_SHARED_SECRET_GEN_P224,
    QSEE_FIPS_ECDH_SHARED_SECRET_GEN_P256,
    QSEE_FIPS_ECDH_SHARED_SECRET_GEN_P384,
    QSEE_FIPS_ECDH_SHARED_SECRET_GEN_P521,

    QSEE_FIPS_ECDSA_KEY_PAIR_GEN_P224,
    QSEE_FIPS_ECDSA_KEY_PAIR_GEN_P256,
    QSEE_FIPS_ECDSA_KEY_PAIR_GEN_P384,
    QSEE_FIPS_ECDSA_KEY_PAIR_GEN_P521,

    QSEE_FIPS_ECDSA_SIG_GEN_P224_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_P224_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_P224_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_P224_SHA512,
    QSEE_FIPS_ECDSA_SIG_GEN_P256_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_P256_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_P256_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_P256_SHA512,
    QSEE_FIPS_ECDSA_SIG_GEN_P384_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_P384_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_P384_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_P384_SHA512,
    QSEE_FIPS_ECDSA_SIG_GEN_P521_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_P521_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_P521_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_P521_SHA512,

    QSEE_FIPS_ECDSA_SIG_VER_P192_SHA1,
    QSEE_FIPS_ECDSA_SIG_VER_P192_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_P192_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_P192_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_P192_SHA512,
    QSEE_FIPS_ECDSA_SIG_VER_P224_SHA1,
    QSEE_FIPS_ECDSA_SIG_VER_P224_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_P224_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_P224_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_P224_SHA512,
    QSEE_FIPS_ECDSA_SIG_VER_P256_SHA1,
    QSEE_FIPS_ECDSA_SIG_VER_P256_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_P256_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_P256_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_P256_SHA512,
    QSEE_FIPS_ECDSA_SIG_VER_P384_SHA1,
    QSEE_FIPS_ECDSA_SIG_VER_P384_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_P384_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_P384_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_P384_SHA512,
    QSEE_FIPS_ECDSA_SIG_VER_P521_SHA1,
    QSEE_FIPS_ECDSA_SIG_VER_P521_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_P521_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_P521_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_P521_SHA512,

    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P224_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P224_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P224_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P224_SHA512,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P256_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P256_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P256_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P256_SHA512,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P384_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P384_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P384_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P384_SHA512,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P521_SHA224,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P521_SHA256,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P521_SHA384,
    QSEE_FIPS_ECDSA_SIG_GEN_COMP_P521_SHA512,

    QSEE_FIPS_RSA_KEY_PAIR_GEN_2048,
    QSEE_FIPS_RSA_KEY_PAIR_GEN_3072,
    QSEE_FIPS_RSA_KEY_PAIR_GEN_4096,

    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_2048_SHA224,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_2048_SHA256,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_2048_SHA384,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_2048_SHA512,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_3072_SHA224,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_3072_SHA256,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_3072_SHA384,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_3072_SHA512,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_4096_SHA224,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_4096_SHA256,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_4096_SHA384,
    QSEE_FIPS_RSA_SIG_GEN_PKCSv15_4096_SHA512,

    QSEE_FIPS_RSA_SIG_VER_PKCSv15_1024_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_1024_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_1024_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_1024_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_1024_SHA512,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_2048_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_2048_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_2048_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_2048_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_2048_SHA512,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_3072_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_3072_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_3072_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_3072_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_3072_SHA512,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_4096_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_4096_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_4096_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_4096_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PKCSv15_4096_SHA512,

    QSEE_FIPS_RSA_SIG_GEN_PSS_2048_SHA224,
    QSEE_FIPS_RSA_SIG_GEN_PSS_2048_SHA256,
    QSEE_FIPS_RSA_SIG_GEN_PSS_2048_SHA384,
    QSEE_FIPS_RSA_SIG_GEN_PSS_2048_SHA512,
    QSEE_FIPS_RSA_SIG_GEN_PSS_3072_SHA224,
    QSEE_FIPS_RSA_SIG_GEN_PSS_3072_SHA256,
    QSEE_FIPS_RSA_SIG_GEN_PSS_3072_SHA384,
    QSEE_FIPS_RSA_SIG_GEN_PSS_3072_SHA512,
    QSEE_FIPS_RSA_SIG_GEN_PSS_4096_SHA224,
    QSEE_FIPS_RSA_SIG_GEN_PSS_4096_SHA256,
    QSEE_FIPS_RSA_SIG_GEN_PSS_4096_SHA384,
    QSEE_FIPS_RSA_SIG_GEN_PSS_4096_SHA512,

    QSEE_FIPS_RSA_SIG_VER_PSS_1024_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PSS_1024_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PSS_1024_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PSS_1024_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PSS_1024_SHA512,
    QSEE_FIPS_RSA_SIG_VER_PSS_2048_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PSS_2048_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PSS_2048_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PSS_2048_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PSS_2048_SHA512,
    QSEE_FIPS_RSA_SIG_VER_PSS_3072_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PSS_3072_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PSS_3072_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PSS_3072_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PSS_3072_SHA512,
    QSEE_FIPS_RSA_SIG_VER_PSS_4096_SHA1,
    QSEE_FIPS_RSA_SIG_VER_PSS_4096_SHA224,
    QSEE_FIPS_RSA_SIG_VER_PSS_4096_SHA256,
    QSEE_FIPS_RSA_SIG_VER_PSS_4096_SHA384,
    QSEE_FIPS_RSA_SIG_VER_PSS_4096_SHA512,

    /**< List of approved RSA primitive services - Modexp \n */
    QSEE_FIPS_RSA_SIG_GEN_PRIMITIVE_2048,

    /**< List of approved Key Derivation services \n */
    QSEE_FIPS_PBKDF2,

    /**< List of approved symmetric cipher services \n */
    QSEE_FIPS_TDES_CBC_DECRYPT,
    QSEE_FIPS_TDES_ECB_DECRYPT,

    /**< List of approved Public Key services \n */
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P224_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P224_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P224_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P224_SHA512,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P256_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P256_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P256_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P256_SHA512,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P384_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P384_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P384_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P384_SHA512,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P521_SHA224,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P521_SHA256,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P521_SHA384,
    QSEE_FIPS_ECDSA_SIG_VER_COMP_P521_SHA512,

    /**< List of approved Key Derivation services \n */
    QSEE_FIPS_PBKDF2_SHA224,
    QSEE_FIPS_PBKDF2_SHA256,
    QSEE_FIPS_PBKDF2_SHA384,
    QSEE_FIPS_PBKDF2_SHA512,

    /**< Mark end of approved services \n */
    QSEE_FIPS_CRYPTO_SVC_APPROVED_END,

    /**< List of conditionally approved services \n */
    QSEE_FIPS_CRYPTO_SVC_SUNSET_AFTER_2023 = 0x1000,
    QSEE_FIPS_TDES_CBC_ENCRYPT = QSEE_FIPS_CRYPTO_SVC_SUNSET_AFTER_2023,
    QSEE_FIPS_TDES_ECB_ENCRYPT,

    QSEE_FIPS_CRYPTO_SVC_END

} QSEE_FIPS_CRYPTO_SVC_TYPE;

/*----------------------------------------------------------------------------
 * Function Declarations and Documentation
 * -------------------------------------------------------------------------*/

/**
  @brief - Provides FIPS versioning information so an OEM seeking FIPS
           certification can prove that they are using a FIPS certified version
           of cmnlib with FIPS enablement. \n
         - Requires an HMAC of the crypto module and a FIPS fuse status to
           determine a version. \n

  @param [in]  info_type        Type of information requested.
  @param [out] buffer           Buffer to write requested information.
  @param [in]  buffer_len       Buffer length. \n
                                If an info type of QSEE_FIPS_MODULE_HMAC is
                                passed, this should be at least 32 bytes. \n
                                Other information types should be 4 bytes. \n
  @param [out] bytes_written    Number of bytes written to buffer.

  @return QSEE_FIPS_SUCCESS on success. \n
          QSEE_FIPS_FAILURE on error.
 */
int qsee_get_fips_info(QSEE_FIPS_INFO_TYPE info_type, void* buffer,
                       size_t buffer_len, size_t* bytes_written);

/**
  @brief - Provides FIPS approval status of a crypto service or algorithm
           so a user seeking the approval status can get it \n

  @param [in]  svc             Crypto service enum with parameters.

  @return QSEE_FIPS_SUCCESS or 0 if approved. \n
          QSEE_FIPS_FAILURE or 1 if not approved. \n
          2 if service will be not approved after 2023.
 */
int qsee_get_fips_approval_status(QSEE_FIPS_CRYPTO_SVC_TYPE svc);

/** @} */

#endif  //__QSEE_FIPS_SERVICES_H
