Skip to content

Commit fe2d80b

Browse files
maurorodriguesoohal
maurorodrigues
authored and
oohal
committed
crypto: add mbedtls build integration via git subtree
Secure variable support requires more crypto support than skiboot currently has. Since mbedtls' x509, etc implementations have rather tight dependencies which prevent easy cherry picking (unlike the existing sha512.c), it is easier to integrate and maintain the whole mbedtls library as a subtree. Authored-by: Eric Richter <erichte@linux.ibm.com> Signed-off-by: Eric Richter <erichte@linux.ibm.com> Signed-off-by: Mauro S. M. Rodrigues <maurosr@linux.vnet.ibm.com> Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
1 parent 910a78c commit fe2d80b

File tree

3 files changed

+151
-1
lines changed

3 files changed

+151
-1
lines changed

‎libstb/Makefile.inc

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
# Copyright 2012-2020 IBM Corp
13
# -*-Makefile-*-
24

35
LIBSTB_DIR = libstb
@@ -12,8 +14,11 @@ include $(SRC)/$(LIBSTB_DIR)/secvar/Makefile.inc
1214
include $(SRC)/$(LIBSTB_DIR)/mbedtls/Makefile.inc
1315
include $(SRC)/$(LIBSTB_DIR)/drivers/Makefile.inc
1416
include $(SRC)/$(LIBSTB_DIR)/tss/Makefile.inc
17+
include $(SRC)/$(LIBSTB_DIR)/crypto/Makefile.inc
1518

16-
$(LIBSTB): $(LIBSTB_OBJS:%=$(LIBSTB_DIR)/%) $(DRIVERS) $(TSS) $(SECVAR) $(MBEDTLS)
19+
CPPFLAGS += -I$(SRC)/$(LIBSTB_DIR)/crypto/mbedtls/include
20+
21+
$(LIBSTB): $(LIBSTB_OBJS:%=$(LIBSTB_DIR)/%) $(DRIVERS) $(TSS) $(SECVAR) $(CRYPTO)
1722

1823
libstb/create-container: libstb/create-container.c libstb/container-utils.c
1924
$(call Q, HOSTCC ,$(HOSTCC) $(HOSTCFLAGS) \

‎libstb/crypto/Makefile.inc

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# SPDX-License-Identifier: Apache-2.0
2+
# Copyright 2012-2019 IBM Corp
3+
4+
CRYPTO_DIR = $(LIBSTB_DIR)/crypto
5+
MBEDTLS_DIR = $(CRYPTO_DIR)/mbedtls/library
6+
7+
SUBDIRS += $(CRYPTO_DIR) $(MBEDTLS_DIR)
8+
9+
# Source file list borrowed from mbedtls/library/Makefile
10+
# Can probably trim disabled files for slightly less noise
11+
MBED_CRYPTO_SRCS = aes.c aesni.c arc4.c
12+
MBED_CRYPTO_SRCS += aria.c asn1parse.c asn1write.c
13+
MBED_CRYPTO_SRCS += base64.c bignum.c blowfish.c
14+
MBED_CRYPTO_SRCS += camellia.c ccm.c chacha20.c
15+
MBED_CRYPTO_SRCS += chachapoly.c cipher.c cipher_wrap.c
16+
MBED_CRYPTO_SRCS += cmac.c ctr_drbg.c des.c
17+
MBED_CRYPTO_SRCS += dhm.c ecdh.c ecdsa.c
18+
MBED_CRYPTO_SRCS += ecjpake.c ecp.c
19+
MBED_CRYPTO_SRCS += ecp_curves.c entropy.c entropy_poll.c
20+
MBED_CRYPTO_SRCS += error.c gcm.c havege.c
21+
MBED_CRYPTO_SRCS += hkdf.c
22+
MBED_CRYPTO_SRCS += hmac_drbg.c md.c md2.c
23+
MBED_CRYPTO_SRCS += md4.c md5.c md_wrap.c
24+
MBED_CRYPTO_SRCS += memory_buffer_alloc.c nist_kw.c
25+
MBED_CRYPTO_SRCS += oid.c padlock.c pem.c
26+
MBED_CRYPTO_SRCS += pk.c pk_wrap.c pkcs12.c
27+
MBED_CRYPTO_SRCS += pkcs5.c pkparse.c pkwrite.c
28+
MBED_CRYPTO_SRCS += platform.c platform_util.c poly1305.c
29+
MBED_CRYPTO_SRCS += ripemd160.c rsa_internal.c rsa.c
30+
MBED_CRYPTO_SRCS += sha1.c sha256.c sha512.c
31+
MBED_CRYPTO_SRCS += threading.c timing.c version.c
32+
MBED_CRYPTO_SRCS += version_features.c xtea.c
33+
34+
MBED_X509_SRCS = certs.c pkcs11.c x509.c
35+
MBED_X509_SRCS += x509_create.c x509_crl.c x509_crt.c
36+
MBED_X509_SRCS += x509_csr.c x509write_crt.c x509write_csr.c
37+
38+
CFLAGS_$(MBEDTLS_DIR)/ = -I$(SRC)/$(LIBSTB_DIR)/crypto -DMBEDTLS_CONFIG_FILE='<mbedtls-config.h>'
39+
CFLAGS_$(MBEDTLS_DIR)/ += -Wno-unused-function -Wno-suggest-attribute=const
40+
41+
MBEDTLS_SRCS = $(addprefix mbedtls/library/,$(MBED_CRYPTO_SRCS) $(MBED_X509_SRCS))
42+
43+
MBEDTLS_OBJS = $(MBEDTLS_SRCS:%.c=%.o)
44+
45+
CRYPTO = $(CRYPTO_DIR)/built-in.a
46+
47+
$(CRYPTO): $(MBEDTLS_OBJS:%=$(CRYPTO_DIR)/%)

‎libstb/crypto/mbedtls-config.h

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
/**
2+
* \file config-no-entropy.h
3+
*
4+
* \brief Minimal configuration of features that do not require an entropy source
5+
*/
6+
/*
7+
* Copyright (C) 2016, ARM Limited, All Rights Reserved
8+
* SPDX-License-Identifier: Apache-2.0
9+
*
10+
* Licensed under the Apache License, Version 2.0 (the "License"); you may
11+
* not use this file except in compliance with the License.
12+
* You may obtain a copy of the License at
13+
*
14+
* http://www.apache.org/licenses/LICENSE-2.0
15+
*
16+
* Unless required by applicable law or agreed to in writing, software
17+
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
18+
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19+
* See the License for the specific language governing permissions and
20+
* limitations under the License.
21+
*
22+
* This file is part of mbed TLS (https://tls.mbed.org)
23+
*/
24+
/*
25+
* Minimal configuration of features that do not require an entropy source
26+
* Distinguishing reatures:
27+
* - no entropy module
28+
* - no TLS protocol implementation available due to absence of an entropy
29+
* source
30+
*
31+
* See README.txt for usage instructions.
32+
*/
33+
34+
#ifndef MBEDTLS_CONFIG_H
35+
#define MBEDTLS_CONFIG_H
36+
37+
/* System support */
38+
#define MBEDTLS_HAVE_ASM
39+
#define MBEDTLS_HAVE_TIME
40+
41+
/* mbed TLS feature support */
42+
#define MBEDTLS_CIPHER_MODE_CBC
43+
#define MBEDTLS_CIPHER_PADDING_PKCS7
44+
#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
45+
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
46+
#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
47+
#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
48+
#define MBEDTLS_ECP_NIST_OPTIM
49+
#define MBEDTLS_ECDSA_DETERMINISTIC
50+
#define MBEDTLS_PK_RSA_ALT_SUPPORT
51+
#define MBEDTLS_PKCS1_V15
52+
#define MBEDTLS_PKCS1_V21
53+
#define MBEDTLS_SELF_TEST
54+
#define MBEDTLS_VERSION_FEATURES
55+
#define MBEDTLS_X509_CHECK_KEY_USAGE
56+
#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
57+
58+
/* mbed TLS modules */
59+
#define MBEDTLS_AES_C
60+
#define MBEDTLS_ASN1_PARSE_C
61+
#define MBEDTLS_BASE64_C
62+
#define MBEDTLS_BIGNUM_C
63+
#define MBEDTLS_CCM_C
64+
#define MBEDTLS_CIPHER_C
65+
#define MBEDTLS_ECDSA_C
66+
#define MBEDTLS_ECP_C
67+
#define MBEDTLS_ERROR_C
68+
#define MBEDTLS_GCM_C
69+
#define MBEDTLS_MD_C
70+
#define MBEDTLS_OID_C
71+
#define MBEDTLS_PEM_PARSE_C
72+
#define MBEDTLS_PK_C
73+
#define MBEDTLS_PK_PARSE_C
74+
#define MBEDTLS_PK_WRITE_C
75+
#define MBEDTLS_PLATFORM_C
76+
#define MBEDTLS_RSA_C
77+
#define MBEDTLS_SHA256_C
78+
#define MBEDTLS_SHA512_C
79+
#define MBEDTLS_X509_USE_C
80+
#define MBEDTLS_X509_CRT_PARSE_C
81+
#define MBEDTLS_X509_CRL_PARSE_C
82+
//#define MBEDTLS_CMAC_C
83+
84+
/* Settings to reduce/remove warnings */
85+
#define MBEDTLS_MPI_WINDOW_SIZE 3 // (max/default is 6) Increase for speed, may introduce warnings
86+
#define MBEDTLS_MPI_MAX_SIZE 512 // (default is 1024) increase for more bits in user-MPIs
87+
#define SIZE_MAX 65535 // this might need to be in libc?
88+
89+
/* Disableable to mitigate warnings */
90+
#define MBEDTLS_ASN1_WRITE_C // Expects SIZE_MAX
91+
#define MBEDTLS_VERSION_C // Possible 'const' function
92+
#define MBEDTLS_HMAC_DRBG_C
93+
94+
/* Miscellaneous options and fixes*/
95+
#define MBEDTLS_AES_ROM_TABLES
96+
#define MBEDTLS_NO_UDBL_DIVISION // Disabled due to unsupported operation
97+
98+
#endif /* MBEDTLS_CONFIG_H */

0 commit comments

Comments
 (0)