[Skiboot] [PATCH 2/4] crypto: add mbedtls build integration via git subtree

Fri Apr 3 03:15:30 AEDT 2020

Secure variable support requires more crypto support than skiboot
currently has. Since mbedtls' x509, etc implementations have rather
tight dependencies which prevent easy cherry picking (unlike the
existing sha512.c), it is easier to integrate and maintain the whole
mbedtls library as a subtree.

Authored-by: Eric Richter <erichte at linux.ibm.com>
Signed-off-by: Eric Richter <erichte at linux.ibm.com>
Signed-off-by: Mauro S. M. Rodrigues <maurosr at linux.vnet.ibm.com>
---
 libstb/Makefile.inc            |  7 ++-
 libstb/crypto/Makefile.inc     | 47 ++++++++++++++++
 libstb/crypto/mbedtls-config.h | 98 ++++++++++++++++++++++++++++++++++
 3 files changed, 151 insertions(+), 1 deletion(-)
 create mode 100644 libstb/crypto/Makefile.inc
 create mode 100644 libstb/crypto/mbedtls-config.h

diff --git libstb/Makefile.inc libstb/Makefile.inc
index d3f684963b..4ac33c77b8 100644
--- libstb/Makefile.inc
+++ libstb/Makefile.inc
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2012-2020 IBM Corp
 # -*-Makefile-*-

 LIBSTB_DIR = libstb
@@ -12,8 +14,11 @@ include $(SRC)/$(LIBSTB_DIR)/secvar/Makefile.inc
 include $(SRC)/$(LIBSTB_DIR)/mbedtls/Makefile.inc
 include $(SRC)/$(LIBSTB_DIR)/drivers/Makefile.inc
 include $(SRC)/$(LIBSTB_DIR)/tss/Makefile.inc
+include $(SRC)/$(LIBSTB_DIR)/crypto/Makefile.inc

-$(LIBSTB): $(LIBSTB_OBJS:%=$(LIBSTB_DIR)/%) $(DRIVERS) $(TSS) $(SECVAR) $(MBEDTLS)
+CPPFLAGS += -I$(SRC)/$(LIBSTB_DIR)/crypto/mbedtls/include
+
+$(LIBSTB): $(LIBSTB_OBJS:%=$(LIBSTB_DIR)/%) $(DRIVERS) $(TSS) $(SECVAR) $(CRYPTO)

 libstb/create-container: libstb/create-container.c libstb/container-utils.c
 	$(call Q, HOSTCC ,$(HOSTCC) $(HOSTCFLAGS) \
diff --git libstb/crypto/Makefile.inc libstb/crypto/Makefile.inc
new file mode 100644
index 0000000000..42b5d8b94e
--- /dev/null
+++ libstb/crypto/Makefile.inc
@@ -0,0 +1,47 @@
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2012-2019 IBM Corp
+
+CRYPTO_DIR = $(LIBSTB_DIR)/crypto
+MBEDTLS_DIR = $(CRYPTO_DIR)/mbedtls/library
+
+SUBDIRS += $(CRYPTO_DIR) $(MBEDTLS_DIR)
+
+# Source file list borrowed from mbedtls/library/Makefile
+# Can probably trim disabled files for slightly less noise
+MBED_CRYPTO_SRCS  = aes.c aesni.c arc4.c
+MBED_CRYPTO_SRCS += aria.c asn1parse.c asn1write.c
+MBED_CRYPTO_SRCS += base64.c bignum.c blowfish.c
+MBED_CRYPTO_SRCS += camellia.c ccm.c chacha20.c
+MBED_CRYPTO_SRCS += chachapoly.c cipher.c cipher_wrap.c
+MBED_CRYPTO_SRCS += cmac.c ctr_drbg.c des.c
+MBED_CRYPTO_SRCS += dhm.c ecdh.c ecdsa.c
+MBED_CRYPTO_SRCS += ecjpake.c ecp.c
+MBED_CRYPTO_SRCS += ecp_curves.c entropy.c entropy_poll.c
+MBED_CRYPTO_SRCS += error.c gcm.c havege.c
+MBED_CRYPTO_SRCS += hkdf.c
+MBED_CRYPTO_SRCS += hmac_drbg.c md.c md2.c
+MBED_CRYPTO_SRCS += md4.c md5.c md_wrap.c
+MBED_CRYPTO_SRCS += memory_buffer_alloc.c nist_kw.c
+MBED_CRYPTO_SRCS += oid.c padlock.c pem.c
+MBED_CRYPTO_SRCS += pk.c pk_wrap.c pkcs12.c
+MBED_CRYPTO_SRCS += pkcs5.c pkparse.c pkwrite.c
+MBED_CRYPTO_SRCS += platform.c platform_util.c poly1305.c
+MBED_CRYPTO_SRCS += ripemd160.c rsa_internal.c rsa.c
+MBED_CRYPTO_SRCS += sha1.c sha256.c sha512.c
+MBED_CRYPTO_SRCS += threading.c timing.c version.c
+MBED_CRYPTO_SRCS += version_features.c xtea.c
+
+MBED_X509_SRCS  = certs.c pkcs11.c x509.c
+MBED_X509_SRCS += x509_create.c x509_crl.c x509_crt.c
+MBED_X509_SRCS += x509_csr.c x509write_crt.c x509write_csr.c
+
+CFLAGS_$(MBEDTLS_DIR)/  = -I$(SRC)/$(LIBSTB_DIR)/crypto -DMBEDTLS_CONFIG_FILE='<mbedtls-config.h>'
+CFLAGS_$(MBEDTLS_DIR)/ += -Wno-unused-function -Wno-suggest-attribute=const
+
+MBEDTLS_SRCS = $(addprefix mbedtls/library/,$(MBED_CRYPTO_SRCS) $(MBED_X509_SRCS))
+
+MBEDTLS_OBJS = $(MBEDTLS_SRCS:%.c=%.o)
+
+CRYPTO = $(CRYPTO_DIR)/built-in.a
+
+$(CRYPTO): $(MBEDTLS_OBJS:%=$(CRYPTO_DIR)/%)
diff --git libstb/crypto/mbedtls-config.h libstb/crypto/mbedtls-config.h
new file mode 100644
index 0000000000..edf4acc2ea
--- /dev/null
+++ libstb/crypto/mbedtls-config.h
@@ -0,0 +1,98 @@
+/**
+ * \file config-no-entropy.h
+ *
+ * \brief Minimal configuration of features that do not require an entropy source
+ */
+/*
+ *  Copyright (C) 2016, ARM Limited, All Rights Reserved
+ *  SPDX-License-Identifier: Apache-2.0
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License"); you may
+ *  not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *  http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ *
+ *  This file is part of mbed TLS (https://tls.mbed.org)
+ */
+/*
+ * Minimal configuration of features that do not require an entropy source
+ * Distinguishing reatures:
+ * - no entropy module
+ * - no TLS protocol implementation available due to absence of an entropy
+ *   source
+ *
+ * See README.txt for usage instructions.
+ */
+
+#ifndef MBEDTLS_CONFIG_H
+#define MBEDTLS_CONFIG_H
+
+/* System support */
+#define MBEDTLS_HAVE_ASM
+#define MBEDTLS_HAVE_TIME
+
+/* mbed TLS feature support */
+#define MBEDTLS_CIPHER_MODE_CBC
+#define MBEDTLS_CIPHER_PADDING_PKCS7
+#define MBEDTLS_REMOVE_ARC4_CIPHERSUITES
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
+#define MBEDTLS_ECP_NIST_OPTIM
+#define MBEDTLS_ECDSA_DETERMINISTIC
+#define MBEDTLS_PK_RSA_ALT_SUPPORT
+#define MBEDTLS_PKCS1_V15
+#define MBEDTLS_PKCS1_V21
+#define MBEDTLS_SELF_TEST
+#define MBEDTLS_VERSION_FEATURES
+#define MBEDTLS_X509_CHECK_KEY_USAGE
+#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
+
+/* mbed TLS modules */
+#define MBEDTLS_AES_C
+#define MBEDTLS_ASN1_PARSE_C
+#define MBEDTLS_BASE64_C
+#define MBEDTLS_BIGNUM_C
+#define MBEDTLS_CCM_C
+#define MBEDTLS_CIPHER_C
+#define MBEDTLS_ECDSA_C
+#define MBEDTLS_ECP_C
+#define MBEDTLS_ERROR_C
+#define MBEDTLS_GCM_C
+#define MBEDTLS_MD_C
+#define MBEDTLS_OID_C
+#define MBEDTLS_PEM_PARSE_C
+#define MBEDTLS_PK_C
+#define MBEDTLS_PK_PARSE_C
+#define MBEDTLS_PK_WRITE_C
+#define MBEDTLS_PLATFORM_C
+#define MBEDTLS_RSA_C
+#define MBEDTLS_SHA256_C
+#define MBEDTLS_SHA512_C
+#define MBEDTLS_X509_USE_C
+#define MBEDTLS_X509_CRT_PARSE_C
+#define MBEDTLS_X509_CRL_PARSE_C
+//#define MBEDTLS_CMAC_C
+
+/* Settings to reduce/remove warnings */
+#define MBEDTLS_MPI_WINDOW_SIZE	3	// (max/default is 6) Increase for speed, may introduce warnings
+#define MBEDTLS_MPI_MAX_SIZE	512	// (default is 1024) increase for more bits in user-MPIs
+#define SIZE_MAX		65535	// this might need to be in libc?
+
+/* Disableable to mitigate warnings */
+#define MBEDTLS_ASN1_WRITE_C  // Expects SIZE_MAX
+#define MBEDTLS_VERSION_C     // Possible 'const' function
+#define MBEDTLS_HMAC_DRBG_C
+
+/* Miscellaneous options and fixes*/
+#define MBEDTLS_AES_ROM_TABLES
+#define MBEDTLS_NO_UDBL_DIVISION	// Disabled due to unsupported operation
+
+#endif /* MBEDTLS_CONFIG_H */
--
2.25.1

