From: Govindraj Raja Date: Mon, 23 Jan 2023 13:11:12 +0000 (+0000) Subject: feat(stm32mp1): add mbedtls-3.3 support config X-Git-Tag: baikal/aarch64/sdk5.10~1^2~188^2 X-Git-Url: https://git.baikalelectronics.ru/?a=commitdiff_plain;h=c9498c8f56387ad23530dcc6e57940d2b118d907;p=arm-tf.git feat(stm32mp1): add mbedtls-3.3 support config Add stm32mp1_mbedtls_config-3.h config file for stm32mp1 builds with mbedtls-3.3 Change-Id: I4581cb0ea7b2c7022e71aefd7ff05ee3a72f5883 Signed-off-by: Govindraj Raja --- diff --git a/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-2.h b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-2.h new file mode 100644 index 000000000..2f07621c3 --- /dev/null +++ b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-2.h @@ -0,0 +1,119 @@ +/* + * Copyright (c) 2022, STMicroelectronics - All Rights Reserved + * + * SPDX-License-Identifier: BSD-3-Clause + */ +#ifndef MBEDTLS_CONFIG_H +#define MBEDTLS_CONFIG_H + +/* + * Key algorithms currently supported on mbed TLS libraries + */ +#define TF_MBEDTLS_USE_RSA 0 +#define TF_MBEDTLS_USE_ECDSA 1 + +/* + * Hash algorithms currently supported on mbed TLS libraries + */ +#define TF_MBEDTLS_SHA256 1 +#define TF_MBEDTLS_SHA384 2 +#define TF_MBEDTLS_SHA512 3 + +/* + * Configuration file to build mbed TLS with the required features for + * Trusted Boot + */ + +#define MBEDTLS_PLATFORM_MEMORY +#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */ +#define MBEDTLS_PLATFORM_SNPRINTF_ALT + +#define MBEDTLS_PKCS1_V21 + +#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION +#define MBEDTLS_X509_CHECK_KEY_USAGE +#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE + +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C + +#define MBEDTLS_BASE64_C +#define MBEDTLS_BIGNUM_C + +#define MBEDTLS_ERROR_C +#define MBEDTLS_MD_C + +#define MBEDTLS_MEMORY_BUFFER_ALLOC_C +#define MBEDTLS_OID_C + +#define MBEDTLS_PK_C +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_PK_WRITE_C + +#define MBEDTLS_PLATFORM_C + +#if TF_MBEDTLS_USE_ECDSA +#define MBEDTLS_ECDSA_C +#define MBEDTLS_ECP_C +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#define MBEDTLS_ECP_NO_INTERNAL_RNG +#endif +#if TF_MBEDTLS_USE_RSA +#define MBEDTLS_RSA_C +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT +#endif + +#define MBEDTLS_SHA256_C +#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256) +#define MBEDTLS_SHA512_C +#endif + +#define MBEDTLS_VERSION_C + +#define MBEDTLS_X509_USE_C +#define MBEDTLS_X509_CRT_PARSE_C + +#if TF_MBEDTLS_USE_AES_GCM +#define MBEDTLS_AES_C +#define MBEDTLS_CIPHER_C +#define MBEDTLS_GCM_C +#endif + +/* MPI / BIGNUM options */ +#define MBEDTLS_MPI_WINDOW_SIZE 2 + +#if TF_MBEDTLS_USE_RSA +#if TF_MBEDTLS_KEY_SIZE <= 2048 +#define MBEDTLS_MPI_MAX_SIZE 256 +#else +#define MBEDTLS_MPI_MAX_SIZE 512 +#endif +#else +#define MBEDTLS_MPI_MAX_SIZE 256 +#endif + +/* Memory buffer allocator options */ +#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 8 + +/* + * Prevent the use of 128-bit division which + * creates dependency on external libraries. + */ +#define MBEDTLS_NO_UDBL_DIVISION + +#ifndef __ASSEMBLER__ +/* System headers required to build mbed TLS with the current configuration */ +#include +#include +#endif + +/* + * Mbed TLS heap size is smal as we only use the asn1 + * parsing functions + * digest, signature and crypto algorithm are done by + * other library. + */ + +#define TF_MBEDTLS_HEAP_SIZE U(5120) +#endif /* MBEDTLS_CONFIG_H */ diff --git a/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-3.h b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-3.h new file mode 100644 index 000000000..d7dab1f8a --- /dev/null +++ b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config-3.h @@ -0,0 +1,115 @@ +/* + * Copyright (c) 2022, STMicroelectronics - All Rights Reserved + * + * SPDX-License-Identifier: BSD-3-Clause + */ + +/* + * Key algorithms currently supported on mbed TLS libraries + */ +#define TF_MBEDTLS_USE_RSA 0 +#define TF_MBEDTLS_USE_ECDSA 1 + +/* + * Hash algorithms currently supported on mbed TLS libraries + */ +#define TF_MBEDTLS_SHA256 1 +#define TF_MBEDTLS_SHA384 2 +#define TF_MBEDTLS_SHA512 3 + +/* + * Configuration file to build mbed TLS with the required features for + * Trusted Boot + */ + +#define MBEDTLS_PLATFORM_MEMORY +#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */ +#define MBEDTLS_PLATFORM_SNPRINTF_ALT + +#define MBEDTLS_PKCS1_V21 + +#define MBEDTLS_ASN1_PARSE_C +#define MBEDTLS_ASN1_WRITE_C + +#define MBEDTLS_BASE64_C +#define MBEDTLS_BIGNUM_C + +#define MBEDTLS_ERROR_C +#define MBEDTLS_MD_C + +#define MBEDTLS_MEMORY_BUFFER_ALLOC_C +#define MBEDTLS_OID_C + +#define MBEDTLS_PK_C +#define MBEDTLS_PK_PARSE_C +#define MBEDTLS_PK_WRITE_C + +#define MBEDTLS_PLATFORM_C + +#if TF_MBEDTLS_USE_ECDSA +#define MBEDTLS_ECDSA_C +#define MBEDTLS_ECP_C +#define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#endif +#if TF_MBEDTLS_USE_RSA +#define MBEDTLS_RSA_C +#define MBEDTLS_X509_RSASSA_PSS_SUPPORT +#endif + +/* The library does not currently support enabling SHA-256 without SHA-224. */ +#define MBEDTLS_SHA224_C +#define MBEDTLS_SHA256_C + +#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256) +#define MBEDTLS_SHA384_C +#define MBEDTLS_SHA512_C +#endif + +#define MBEDTLS_VERSION_C + +#define MBEDTLS_X509_USE_C +#define MBEDTLS_X509_CRT_PARSE_C + +#if TF_MBEDTLS_USE_AES_GCM +#define MBEDTLS_AES_C +#define MBEDTLS_CIPHER_C +#define MBEDTLS_GCM_C +#endif + +/* MPI / BIGNUM options */ +#define MBEDTLS_MPI_WINDOW_SIZE 2 + +#if TF_MBEDTLS_USE_RSA +#if TF_MBEDTLS_KEY_SIZE <= 2048 +#define MBEDTLS_MPI_MAX_SIZE 256 +#else +#define MBEDTLS_MPI_MAX_SIZE 512 +#endif +#else +#define MBEDTLS_MPI_MAX_SIZE 256 +#endif + +/* Memory buffer allocator options */ +#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 8 + +/* + * Prevent the use of 128-bit division which + * creates dependency on external libraries. + */ +#define MBEDTLS_NO_UDBL_DIVISION + +#ifndef __ASSEMBLER__ +/* System headers required to build mbed TLS with the current configuration */ +#include +#include +#endif + +/* + * Mbed TLS heap size is smal as we only use the asn1 + * parsing functions + * digest, signature and crypto algorithm are done by + * other library. + */ + +#define TF_MBEDTLS_HEAP_SIZE U(5120) diff --git a/plat/st/stm32mp1/include/stm32mp1_mbedtls_config.h b/plat/st/stm32mp1/include/stm32mp1_mbedtls_config.h deleted file mode 100644 index 2f07621c3..000000000 --- a/plat/st/stm32mp1/include/stm32mp1_mbedtls_config.h +++ /dev/null @@ -1,119 +0,0 @@ -/* - * Copyright (c) 2022, STMicroelectronics - All Rights Reserved - * - * SPDX-License-Identifier: BSD-3-Clause - */ -#ifndef MBEDTLS_CONFIG_H -#define MBEDTLS_CONFIG_H - -/* - * Key algorithms currently supported on mbed TLS libraries - */ -#define TF_MBEDTLS_USE_RSA 0 -#define TF_MBEDTLS_USE_ECDSA 1 - -/* - * Hash algorithms currently supported on mbed TLS libraries - */ -#define TF_MBEDTLS_SHA256 1 -#define TF_MBEDTLS_SHA384 2 -#define TF_MBEDTLS_SHA512 3 - -/* - * Configuration file to build mbed TLS with the required features for - * Trusted Boot - */ - -#define MBEDTLS_PLATFORM_MEMORY -#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS -/* Prevent mbed TLS from using snprintf so that it can use tf_snprintf. */ -#define MBEDTLS_PLATFORM_SNPRINTF_ALT - -#define MBEDTLS_PKCS1_V21 - -#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION -#define MBEDTLS_X509_CHECK_KEY_USAGE -#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE - -#define MBEDTLS_ASN1_PARSE_C -#define MBEDTLS_ASN1_WRITE_C - -#define MBEDTLS_BASE64_C -#define MBEDTLS_BIGNUM_C - -#define MBEDTLS_ERROR_C -#define MBEDTLS_MD_C - -#define MBEDTLS_MEMORY_BUFFER_ALLOC_C -#define MBEDTLS_OID_C - -#define MBEDTLS_PK_C -#define MBEDTLS_PK_PARSE_C -#define MBEDTLS_PK_WRITE_C - -#define MBEDTLS_PLATFORM_C - -#if TF_MBEDTLS_USE_ECDSA -#define MBEDTLS_ECDSA_C -#define MBEDTLS_ECP_C -#define MBEDTLS_ECP_DP_SECP256R1_ENABLED -#define MBEDTLS_ECP_NO_INTERNAL_RNG -#endif -#if TF_MBEDTLS_USE_RSA -#define MBEDTLS_RSA_C -#define MBEDTLS_X509_RSASSA_PSS_SUPPORT -#endif - -#define MBEDTLS_SHA256_C -#if (TF_MBEDTLS_HASH_ALG_ID != TF_MBEDTLS_SHA256) -#define MBEDTLS_SHA512_C -#endif - -#define MBEDTLS_VERSION_C - -#define MBEDTLS_X509_USE_C -#define MBEDTLS_X509_CRT_PARSE_C - -#if TF_MBEDTLS_USE_AES_GCM -#define MBEDTLS_AES_C -#define MBEDTLS_CIPHER_C -#define MBEDTLS_GCM_C -#endif - -/* MPI / BIGNUM options */ -#define MBEDTLS_MPI_WINDOW_SIZE 2 - -#if TF_MBEDTLS_USE_RSA -#if TF_MBEDTLS_KEY_SIZE <= 2048 -#define MBEDTLS_MPI_MAX_SIZE 256 -#else -#define MBEDTLS_MPI_MAX_SIZE 512 -#endif -#else -#define MBEDTLS_MPI_MAX_SIZE 256 -#endif - -/* Memory buffer allocator options */ -#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 8 - -/* - * Prevent the use of 128-bit division which - * creates dependency on external libraries. - */ -#define MBEDTLS_NO_UDBL_DIVISION - -#ifndef __ASSEMBLER__ -/* System headers required to build mbed TLS with the current configuration */ -#include -#include -#endif - -/* - * Mbed TLS heap size is smal as we only use the asn1 - * parsing functions - * digest, signature and crypto algorithm are done by - * other library. - */ - -#define TF_MBEDTLS_HEAP_SIZE U(5120) -#endif /* MBEDTLS_CONFIG_H */ diff --git a/plat/st/stm32mp1/platform.mk b/plat/st/stm32mp1/platform.mk index 236296eaa..039ae63c3 100644 --- a/plat/st/stm32mp1/platform.mk +++ b/plat/st/stm32mp1/platform.mk @@ -1,5 +1,5 @@ # -# Copyright (c) 2015-2022, ARM Limited and Contributors. All rights reserved. +# Copyright (c) 2015-2023, ARM Limited and Contributors. All rights reserved. # # SPDX-License-Identifier: BSD-3-Clause # @@ -381,7 +381,19 @@ endif endif TF_MBEDTLS_KEY_ALG := ecdsa -MBEDTLS_CONFIG_FILE ?= "" + +ifneq (${MBEDTLS_DIR},) +MBEDTLS_MAJOR=$(shell grep -hP "define MBEDTLS_VERSION_MAJOR" \ +${MBEDTLS_DIR}/include/mbedtls/*.h | grep -oe '\([0-9.]*\)') + +ifeq (${MBEDTLS_MAJOR}, 2) +MBEDTLS_CONFIG_FILE ?= "" +endif + +ifeq (${MBEDTLS_MAJOR}, 3) +MBEDTLS_CONFIG_FILE ?= "" +endif +endif include drivers/auth/mbedtls/mbedtls_x509.mk