Integrate MbedTLS v3.6 LTS (currently v3.6.0) with U-Boot.
Motivations:
------------
1. MbedTLS is well maintained with LTS versions.
2. LWIP is integrated with MbedTLS and easily to enable HTTPS.
3. MbedTLS recently switched license back to GPLv2.
Prerequisite:
-------------
This patch series requires mbedtls git repo to be added as a
subtree to the main U-Boot repo via:
$ git subtree add --prefix lib/mbedtls/external/mbedtls \
https://github.com/Mbed-TLS/mbedtls.git \
v3.6.0 --squash
Moreover, due to the Windows-style files from mbedtls git repo,
we need to convert the CRLF endings to LF and do a commit manually:
$ git add --renormalize .
$ git commit
New Kconfig options:
--------------------
`MBEDTLS_LIB` is for MbedTLS general switch.
`MBEDTLS_LIB_CRYPTO` is for replacing original digest and crypto libs with
MbedTLS.
`MBEDTLS_LIB_X509` is for replacing original X509, PKCS7, MSCode, ASN1,
and Pubkey parser with MbedTLS.
`LEGACY_CRYPTO` is introduced as a main switch for legacy crypto library.
`LEGACY_CRYPTO_BASIC` is for the basic crypto functionalities and
`LEGACY_CRYPTO_CERT` is for the certificate related functionalities.
For each of the algorithm, a pair of `<alg>_LEGACY` and `<alg>_MBEDTLS`
Kconfig options are introduced. Meanwhile, `SPL_` Kconfig options are
introduced.
In this patch set, MBEDTLS_LIB, MBEDTLS_LIB_CRYPTO and MBEDTLS_LIB_X509
are by default enabled in qemu_arm64_defconfig and sandbox_defconfig
for testing purpose.
Patches for external MbedTLS project:
-------------------------------------
Since U-Boot uses Microsoft Authentication Code to verify PE/COFFs
executables which is not supported by MbedTLS at the moment,
addtional patches for MbedTLS are created to adapt with the EFI loader:
1. Decoding of Microsoft Authentication Code.
2. Decoding of PKCS#9 Authenticate Attributes.
3. Extending MbedTLS PKCS#7 lib to support multiple signer's certificates.
4. MbedTLS native test suites for PKCS#7 signer's info.
All above 4 patches (tagged with `mbedtls/external`) are submitted to
MbedTLS project and being reviewed, eventually they should be part of
MbedTLS LTS release.
But before that, please merge them into U-Boot, otherwise the building
will be broken when MBEDTLS_LIB_X509 is enabled.
See below PR link for the reference:
https://github.com/Mbed-TLS/mbedtls/pull/9001
Miscellaneous:
--------------
Optimized MbedTLS library size by tailoring the config file
and disabling all unnecessary features for EFI loader.
>From v2, original libs (rsa, asn1_decoder, rsa_helper, md5, sha1, sha256,
sha512) are completely replaced when MbedTLS is enabled.
>From v3, the size-growth is slightly reduced by refactoring Hash functions.
>From v6, smaller implementations for SHA256 and SHA512 are enabled and
target size reduce significantly.
Target(QEMU arm64) size-growth when enabling MbedTLS:
v1: 6.03%
v2: 4.66%
v3 - v5: 4.55%
v6: 2.90%
Please see the latest output from buildman for size-growth on QEMU arm64,
Sandbox and Nanopi A64. [1]
Tests done:
-----------
EFI Secure Boot test (EFI variables loading and verifying, EFI signed image
verifying and booting) via U-Boot console.
EFI Secure Boot and Capsule sandbox test passed.
Known issues:
-------------
None.
[1]: buildman output for size comparison
(qemu_arm64, sandbox and nanopi_a64)
```
aarch64: (for 2/2 boards) all -1468.0 bss +16.0 data -64.0 rodata +200.0 text -1620.0
qemu_arm64 : all +4608 bss +80 data -64 rodata +200 text +4392
u-boot: add: 29/-17, grow: 12/-16 bytes: 13072/-8304 (4768)
function old new delta
mbedtls_internal_sha1_process - 4540 +4540
mbedtls_internal_md5_process - 2928 +2928
K - 896 +896
mbedtls_sha256_finish - 484 +484
mbedtls_internal_sha256_process - 432 +432
mbedtls_sha1_finish - 420 +420
mbedtls_internal_sha512_process - 412 +412
mbedtls_sha512_finish - 360 +360
mbedtls_sha512_starts - 340 +340
mbedtls_md5_finish - 336 +336
mbedtls_sha512_update - 264 +264
mbedtls_sha256_update - 252 +252
mbedtls_sha1_update - 236 +236
mbedtls_md5_update - 236 +236
mbedtls_sha512 - 148 +148
mbedtls_sha256_starts - 124 +124
hash_init_sha512 52 128 +76
hash_init_sha256 52 128 +76
mbedtls_sha1_starts - 72 +72
mbedtls_md5_starts - 60 +60
hash_init_sha1 52 112 +60
mbedtls_platform_zeroize - 56 +56
sha512_put_uint64_be - 40 +40
mbedtls_sha512_free - 16 +16
mbedtls_sha256_free - 16 +16
mbedtls_sha1_free - 16 +16
mbedtls_md5_free - 16 +16
hash_finish_sha512 72 88 +16
hash_finish_sha256 72 88 +16
hash_finish_sha1 72 88 +16
sha512_csum_wd 68 80 +12
sha256_csum_wd 68 80 +12
sha1_csum_wd 68 80 +12
md5_wd 68 80 +12
mbedtls_sha512_init - 12 +12
mbedtls_sha256_init - 12 +12
mbedtls_sha1_init - 12 +12
mbedtls_md5_init - 12 +12
memset_func - 8 +8
sha512_update 4 8 +4
sha384_update 4 8 +4
sha256_update 12 8 -4
sha1_update 12 8 -4
sha256_process 16 - -16
sha1_process 16 - -16
hash_update_sha512 36 16 -20
hash_update_sha256 36 16 -20
hash_update_sha1 36 16 -20
MD5Init 56 36 -20
sha1_starts 60 36 -24
hash_update_sha384 36 - -36
hash_init_sha384 52 - -52
sha384_csum_wd 68 12 -56
sha256_starts 104 40 -64
sha256_padding 64 - -64
sha1_padding 64 - -64
hash_finish_sha384 72 - -72
sha512_finish 152 36 -116
sha512_starts 168 40 -128
sha384_starts 168 40 -128
sha384_finish 152 4 -148
MD5Final 196 44 -152
sha512_base_do_finalize 160 - -160
static.sha256_update 228 - -228
static.sha1_update 240 - -240
sha512_base_do_update 244 - -244
MD5Update 260 - -260
sha1_finish 300 36 -264
sha256_finish 404 36 -368
sha256_armv8_ce_process 428 - -428
sha1_armv8_ce_process 484 - -484
sha512_K 640 - -640
sha512_block_fn 1212 - -1212
MD5Transform 2552 - -2552
nanopi_a64 : all -7544 bss -48 data -64 rodata +200 text -7632
u-boot: add: 21/-8, grow: 4/-8 bytes: 10692/-4364 (6328)
function old new delta
mbedtls_internal_sha1_process - 4540 +4540
mbedtls_internal_md5_process - 2928 +2928
mbedtls_sha256_finish - 484 +484
mbedtls_internal_sha256_process - 432 +432
mbedtls_sha1_finish - 420 +420
mbedtls_md5_finish - 336 +336
K - 256 +256
mbedtls_sha256_update - 252 +252
mbedtls_sha1_update - 236 +236
mbedtls_md5_update - 236 +236
mbedtls_sha256_starts - 124 +124
hash_init_sha256 52 128 +76
mbedtls_sha1_starts - 72 +72
mbedtls_md5_starts - 60 +60
hash_init_sha1 52 112 +60
mbedtls_platform_zeroize - 56 +56
mbedtls_sha256_free - 16 +16
mbedtls_sha1_free - 16 +16
mbedtls_md5_free - 16 +16
hash_finish_sha256 72 88 +16
hash_finish_sha1 72 88 +16
mbedtls_sha256_init - 12 +12
mbedtls_sha1_init - 12 +12
mbedtls_md5_init - 12 +12
memset_func - 8 +8
sha256_update 12 - -12
sha1_update 12 - -12
hash_update_sha256 36 16 -20
hash_update_sha1 36 16 -20
MD5Init 56 36 -20
sha1_starts 60 36 -24
sha256_starts 104 40 -64
sha256_padding 64 - -64
sha1_padding 64 - -64
MD5Final 196 44 -152
static.sha256_update 228 - -228
static.sha1_update 240 - -240
MD5Update 260 - -260
sha1_finish 300 36 -264
sha256_finish 404 36 -368
MD5Transform 2552 - -2552
sandbox: (for 1/1 boards) all +19312.0 data +1440.0 rodata -4128.0 text +22000.0
sandbox : all +19312 data +1440 rodata -4128 text +22000
u-boot: add: 258/-206, grow: 122/-59 bytes: 90286/-76286 (14000)
function old new delta
mbedtls_internal_sha1_process - 4982 +4982
static.mbedtls_x509_crt_parse_der_internal - 4184 +4184
static.pci_uclass_post_probe - 3570 +3570
pkcs7_parse_message 361 3638 +3277
static.sandbox_tpm2_xfer - 2605 +2605
rsa_verify 541 2794 +2253
mbedtls_internal_md5_process - 2189 +2189
mbedtls_rsa_parse_pubkey - 2053 +2053
mbedtls_rsa_private - 1813 +1813
run_test 2220 3932 +1712
mbedtls_mpi_exp_mod - 1649 +1649
read_one_chunk - 1606 +1606
x509_populate_cert - 1462 +1462
mbedtls_mpi_div_mpi - 1459 +1459
static.simple_panel_get_edid_timing - 1385 +1385
static.sqfs_search_dir - 1336 +1336
static.mbedtls_x509_dn_gets - 1305 +1305
mbedtls_mpi_inv_mod - 1214 +1214
mbedtls_rsa_rsaes_pkcs1_v15_decrypt - 1156 +1156
mbedtls_x509_get_subject_alt_name_ext - 1155 +1155
rsa_check_pair_wrap - 1018 +1018
static.K - 896 +896
oid_x520_attr_type - 840 +840
static.pci_uclass_pre_probe - 832 +832
read_persistent_digest - 825 +825
ta_rpc_test_invoke_func - 812 +812
ta_avb_invoke_func - 783 +783
static.dm_pciauto_setup_device - 747 +747
efi_load_image 4418 5157 +739
static.pkcs7_get_signer_info - 671 +671
static.dfu_bind - 637 +637
efi_tcg2_hash_log_extend_event - 622 +622
static.sqfs_frag_lookup - 605 +605
mbedtls_mpi_core_montmul - 537 +537
mbedtls_internal_sha512_process - 536 +536
mbedtls_mpi_core_mla - 520 +520
mbedtls_sha256_finish - 519 +519
static.sqfs_resolve_symlink - 509 +509
mbedtls_internal_sha256_process - 487 +487
static.overlay_update_local_node_references - 483 +483
mbedtls_x509_get_time - 483 +483
mbedtls_mpi_mul_mpi - 479 +479
mbedtls_x509_get_name - 470 +470
mbedtls_pk_parse_subpubkey - 463 +463
efi_tcg2_get_capability - 462 +462
find_and_setup_root - 456 +456
static.new_string - 450 +450
static.set_string - 448 +448
mbedtls_sha1_finish - 445 +445
longest_match - 424 +424
rsa_rsassa_pkcs1_v15_encode - 414 +414
mbedtls_mpi_gcd - 413 +413
load_full_partition - 413 +413
static.get_languages - 402 +402
static.efi_uninstall_protocol - 400 +400
static.list_package_lists - 398 +398
static.update_package_list - 374 +374
static.efi_disconnect_all_drivers - 363 +363
efi_tcg2_get_eventlog - 361 +361
static.get_string - 360 +360
oid_x509_ext - 360 +360
static.new_package_list - 359 +359
static.efi_convert_device_path_to_text - 359 +359
static.get_keyboard_layout - 355 +355
rsa_sign_wrap - 355 +355
add_sub_mpi - 355 +355
mbedtls_sha512_finish - 352 +352
efi_tcg2_submit_command - 351 +351
static.find_keyboard_layouts - 339 +339
rsa_verify_wrap - 324 +324
oid_sig_alg - 320 +320
efi_tcg2_notify_exit_boot_services - 316 +316
mbedtls_mpi_sub_abs - 315 +315
static.append_device_path_instance - 311 +311
static.get_secondary_languages - 301 +301
rsa_encrypt_wrap - 294 +294
static.hash_init_sha512 41 334 +293
static.efi_convert_device_node_to_text - 293 +293
static.get_next_device_path_instance - 290 +290
spi_set_speed_mode - 287 +287
static.buck_get_suspend_enable - 276 +276
mbedtls_mpi_core_get_mont_r2_unsafe - 276 +276
efi_tcg2_get_active_pcr_banks - 273 +273
public_key - 270 +270
static.buck_set_suspend_enable - 264 +264
static.rsa_check_context - 260 +260
public_key_verify_signature 419 678 +259
__udivti3 - 248 +248
mbedtls_rsa_public - 242 +242
static.oid_md_alg - 240 +240
mbedtls_asn1_get_alg - 238 +238
static.get_package_list_handle - 231 +231
static.dm_pciauto_exp_link_stable - 231 +231
static.overlay_get_target - 224 +224
mbedtls_mpi_shift_l - 224 +224
mbedtls_pkcs7_free - 223 +223
static.register_package_notify - 222 +222
static.create_device_node - 222 +222
mbedtls_mpi_fill_random - 221 +221
static.dfu_handle - 213 +213
static.usb_emul_find_devnum - 210 +210
mbedtls_sha512_update - 209 +209
static.remove_package_list - 208 +208
static.export_package_lists - 206 +206
static.montMul - 202 +202
static.sqfs_tokenize - 201 +201
static.is_device_path_multi_instance - 201 +201
mbedtls_mpi_copy - 200 +200
mbedtls_sha256_update - 197 +197
static.set_keyboard_layout - 196 +196
static.ldo_set_suspend_enable - 195 +195
static.asn1_get_tagged_int - 194 +194
static.get_device_path_size - 191 +191
static.efi_open_volume - 191 +191
static.append_device_path - 190 +190
static.append_device_node - 188 +188
static.ldo_get_suspend_enable - 182 +182
mbedtls_pk_parse_public_key - 182 +182
static.duplicate_device_path - 180 +180
mbedtls_x509_crt_free - 177 +177
static.mbedtls_sha1_update - 176 +176
mbedtls_mpi_shift_r - 174 +174
static.unregister_package_notify - 169 +169
rsa_free_wrap - 161 +161
mbedtls_mpi_cmp_mpi - 161 +161
static.pkcs7_get_one_cert - 160 +160
oid_pk_alg - 160 +160
mbedtls_mpi_read_binary - 159 +159
md5_wd 571 729 +158
mbedtls_mpi_core_write_be - 154 +154
static.switch_set_enable - 150 +150
mbedtls_mpi_mod_mpi - 146 +146
mbedtls_asn1_get_alg_null - 142 +142
__alloc_extent_buffer - 142 +142
static.pldo_set_enable - 141 +141
mbedtls_mpi_cmp_abs - 141 +141
mbedtls_mpi_mul_int - 138 +138
mbedtls_asn1_get_len - 133 +133
static.switch_get_enable - 130 +130
static.nldo_set_enable - 130 +130
static.overlay_adjust_node_phandles - 121 +121
static.hash_init_sha256 41 161 +120
mbedtls_mpi_grow - 120 +120
reg_set_enable - 118 +118
static.load_and_verify_vbmeta 10699 10814 +115
mbedtls_rsa_check_pubkey - 109 +109
static.pldo_get_enable - 108 +108
static.mbedtls_asn1_get_bitstring - 108 +108
x509_get_timestamp - 106 +106
static.buck_get_suspend_value - 101 +101
mbedtls_asn1_get_bool - 99 +99
static.asn1_get_sequence_of_cb - 98 +98
efi_reserve_memory - 97 +97
mbedtls_rsa_info - 96 +96
static.buck_set_suspend_value - 93 +93
ldo_get_enable - 92 +92
buck_get_enable - 92 +92
data_gz 21219 21309 +90
mbedtls_x509_get_serial - 88 +88
mbedtls_mpi_resize_clear - 87 +87
static.sqfs_read_entry - 86 +86
static.nldo_get_enable - 83 +83
mbedtls_mpi_bitlen - 82 +82
static.x509_get_uid - 81 +81
static.mbedtls_mpi_sub_int - 81 +81
static.pldo_set_suspend_enable - 78 +78
mbedtls_oid_get_md_alg - 78 +78
ldo_set_enable - 77 +77
buck_set_enable - 77 +77
static.sqfs_count_tokens - 76 +76
static.pldo_set_value - 75 +75
static.pldo_set_suspend_value - 75 +75
static.pldo_get_suspend_enable - 75 +75
static.nldo_set_value - 75 +75
static.nldo_set_suspend_value - 75 +75
mbedtls_mpi_cmp_int - 75 +75
find_device - 75 +75
rsa_decrypt_wrap - 73 +73
pta_scp03_invoke_func - 73 +73
mbedtls_mpi_lset - 73 +73
sha512_put_uint64_be - 72 +72
mbedtls_md_info_from_type - 72 +72
static.sqfs_disk_read - 69 +69
static.sqfs_calc_n_blks - 69 +69
static.simple_panel_set_backlight - 68 +68
ldo_get_value - 67 +67
buck_get_value - 67 +67
static.nldo_set_suspend_enable - 65 +65
free_extent_state_func - 65 +65
static.nldo_get_suspend_enable - 64 +64
sha1_starts - 64 +64
mbedtls_mpi_lsb - 64 +64
rsa_alloc_wrap - 62 +62
mbedtls_pk_setup - 62 +62
pkcs7_free_message 115 176 +61
static.unicode_test_u16_strcmp - 60 +60
rsa_debug - 60 +60
lib_test_strlcat 1195 1255 +60
public_key_signature_free - 58 +58
static.x509_free_mbedtls_ctx - 57 +57
static.nldo_get_value - 57 +57
static.nldo_get_suspend_value - 57 +57
x509_populate_dn_name_string - 56 +56
efi_tcg2_protocol - 56 +56
mbedtls_mpi_core_montmul_init - 55 +55
static.pldo_get_value - 54 +54
static.pldo_get_suspend_value - 54 +54
mbedtls_asn1_get_bitstring_null - 53 +53
efi_launch_capsules 3090 3142 +52
static.pkcs7_free_signer_info - 51 +51
static.ldo_set_suspend_value - 51 +51
mbedtls_mpi_free - 51 +51
static.mbedtls_mpi_core_bigendian_to_host - 50 +50
mbedtls_asn1_get_tag - 50 +50
event_log - 48 +48
static.subM - 47 +47
mbedtls_pk_free - 45 +45
mbedtls_zeroize_and_free - 42 +42
static.ldo_get_suspend_value - 38 +38
static.sandbox_tpm2_get_desc - 35 +35
efi_capsule_update_firmware 1354 1389 +35
static.simple_panel_enable_backlight - 34 +34
static.efi_firmware_get_image_info 696 730 +34
x509_parse2_int - 33 +33
ldo_set_value - 32 +32
buck_set_value - 32 +32
static.hash_init_sha1 75 105 +30
mbedtls_asn1_sequence_free - 30 +30
mbedtls_asn1_free_named_data_list_shallow - 30 +30
efi_start_image 2492 2522 +30
static.hash_finish_sha512 40 66 +26
static.hash_finish_sha256 40 66 +26
static.hash_finish_sha1 40 66 +26
generic_phy_get_bulk 366 392 +26
static.set_descriptors - 25 +25
reboot_mode_probe 139 164 +25
static.efi_open_protocol 495 519 +24
static.mbedtls_mpi_get_bit - 23 +23
sqfs_opendir 1655 1677 +22
rsa_can_do - 22 +22
efi_install_fdt 572 594 +22
sha512_starts 132 152 +20
mbedtls_sha512_free - 20 +20
mbedtls_sha256_free - 20 +20
mbedtls_sha1_free - 20 +20
efi_query_capsule_caps 210 229 +19
static.mbedtls_platform_zeroize - 18 +18
sha256_starts 68 86 +18
pta_scp03_open_session - 18 +18
mbedtls_mpi_size - 18 +18
c2 - 18 +18
static.efi_cout_set_cursor_position 257 274 +17
rsa_get_bitlen - 17 +17
static.efi_register_notify_events - 16 +16
static.efi_cout_query_mode 241 257 +16
static.dfu_runtime_descs - 16 +16
static.__reset_get_bulk 166 182 +16
mbedtls_sha512_init - 16 +16
efi_guid_tcg2_protocol - 16 +16
efi_guid_final_events - 16 +16
efi_file_info_guid - 16 +16
clk_get_bulk 157 173 +16
efi_tcg2_set_active_pcr_banks - 15 +15
efi_tcg2_get_result_of_set_active_pcr_banks - 15 +15
efi_pxe_base_code_arp - 15 +15
unicode_test_utf8_utf16_strcpy 946 960 +14
mbedtls_mpi_add_mpi - 14 +14
c4 - 14 +14
c1 - 14 +14
efi_locate_device_path 541 554 +13
efi_file_read_int 610 623 +13
d4 - 13 +13
rtc_days_in_month - 12 +12
mbedtls_mpi_sub_mpi - 12 +12
i2 - 12 +12
static.efi_cin_unregister_key_notify 257 268 +11
efi_auth_var_get_type 102 113 +11
static.count_descriptors - 10 +10
i1 - 10 +10
fdt_overlay_apply 1887 1897 +10
x509_free_certificate 115 124 +9
static.efi_cout_output_string 534 543 +9
static.efi_cin_reset_ex 185 194 +9
static.efi_cin_reset 185 194 +9
static.dfu_intf_runtime - 9 +9
free_map_lookup - 9 +9
static.memset_func - 8 +8
static.efi_connect_controller 685 693 +8
mbedtls_sha512_info - 8 +8
mbedtls_sha384_info - 8 +8
mbedtls_sha256_info - 8 +8
mbedtls_sha1_info - 8 +8
mbedtls_md5_info - 8 +8
mbedtls_ct_zero - 8 +8
i3 - 8 +8
c3 - 8 +8
unicode_test_utf8_utf16_strlen 443 450 +7
unicode_test_utf16_utf8_strlen 443 450 +7
unicode_test_utf16_utf8_strcpy 1021 1028 +7
static.efi_firmware_raw_set_image 2312 2319 +7
static.efi_cin_register_key_notify 296 303 +7
static.efi_cin_read_key_stroke_ex 386 393 +7
static.efi_cin_read_key_stroke 247 254 +7
pci_bus_read_config 83 90 +7
mpi_bigendian_to_host - 7 +7
check_node_type 171 178 +7
ta_rpc_test_open_session - 6 +6
ta_avb_open_session - 6 +6
j3 - 6 +6
efi_signature_verify 1640 1646 +6
j1 - 5 +5
eficonfig_process_select_file 2179 2184 +5
efi_protocol_open 408 413 +5
efi_dp_from_file 274 279 +5
crypt_sha512crypt_rn_wrapped 2408 2413 +5
crypt_sha256crypt_rn_wrapped 1669 1674 +5
unicode_test_u16_strlen 269 273 +4
static.eficonfig_edit_boot_option 1567 1571 +4
static.efi_purge_handle 150 154 +4
static.avb_safe_memcmp 36 40 +4
sqfs_find_inode 347 351 +4
sqfs_dir_offset 101 105 +4
pci_conv_32_to_size 46 50 +4
pci_bus_find_devfn 121 125 +4
fdt_subnode_offset_namelen 240 244 +4
efi_unload_image 403 407 +4
efi_search_obj 43 47 +4
efi_delete_image 150 154 +4
efi_close_protocol 229 233 +4
efi_add_memory_map 34 38 +4
do_bootefi_exec 444 448 +4
dm_spi_release_bus 23 27 +4
dm_spi_claim_bus 153 157 +4
dm_pci_write_config8 10 14 +4
dm_pci_write_config16 13 17 +4
avb_validate_utf8 95 99 +4
avb_descriptor_validate_and_byteswap 96 100 +4
avb_descriptor_foreach 715 719 +4
avb_be64toh 7 11 +4
avb_be32toh 5 9 +4
asymmetric_key_generate_id 109 113 +4
unicode_test_u16_strncmp 377 380 +3
unicode_test_u16_strlcat 840 843 +3
unflatten_device_tree 274 277 +3
str_upper 648 651 +3
static.efi_reinstall_protocol_interface 277 280 +3
static.efi_exit 668 671 +3
sandbox_hub_bind 20 23 +3
find_handle 314 317 +3
eficonfig_file_selected 484 487 +3
efi_firmware_get_lsv_from_dtb 369 372 +3
efi_create_indexed_name 174 177 +3
efi_auth_var_get_guid 85 88 +3
SHA256_Update_recycled 76 79 +3
unicode_test_utf8_utf16_strncpy 929 931 +2
unicode_test_utf16_utf8_strncpy 921 923 +2
static.tcg2_measure_variable 236 238 +2
static.efi_cout_set_mode 222 224 +2
static.do_env_print 1278 1280 +2
prepare_file_selection_entry 400 402 +2
eficonfig_boot_edit_save 96 98 +2
eficonfig_add_change_boot_order_entry 346 348 +2
eficonfig_add_boot_selection_entry 461 463 +2
efi_str_to_u16 103 105 +2
efi_serialize_load_option 260 262 +2
efi_get_variable_mem 492 494 +2
efi_file_setinfo 523 525 +2
efi_file_getinfo 783 785 +2
efi_convert_string 109 111 +2
efi_binary_run 790 792 +2
do_bootmenu 2154 2156 +2
create_boot_option_entry 206 208 +2
bootdev_hunt 366 368 +2
add_packages 890 892 +2
unicode_test_efi_create_indexed_name 481 482 +1
u16_strsize 20 21 +1
u16_strlcat 106 107 +1
file_open 738 739 +1
efi_var_mem_ins 257 258 +1
cros_ec_spi_command 420 421 +1
efi_update_capsule 427 426 -1
byteReverse 1 - -1
static.efi_cout_set_attribute 249 247 -2
sha256_csum_wd 155 153 -2
vidconsole_sync_copy 13 9 -4
vidconsole_memmove 51 47 -4
tcg2_uninit 212 208 -4
static.hash_update_sha1 29 25 -4
spi_find_chip_select 440 436 -4
sha512_csum_wd 169 165 -4
read_tree_block 1566 1562 -4
read_allocated_block 2304 2300 -4
put_ext4 383 379 -4
free_extent_buffer 321 317 -4
ext4fs_update_journal 893 889 -4
ext4fs_read_inode 392 388 -4
ext4fs_devread 34 30 -4
efi_init_early 1055 1051 -4
cros_ec_register 291 287 -4
cros_ec_calc_checksum 27 23 -4
cache_tree_free_extents 57 53 -4
btrfs_setup_root 101 97 -4
btrfs_scan_one_device 675 671 -4
btrfs_release_all_roots 62 58 -4
btrfs_read_dev_super 1228 1224 -4
btrfs_free_path 38 34 -4
btrfs_free_fs_info 53 49 -4
btrfs_close_devices 136 132 -4
static.hash_update_sha512 22 17 -5
static.hash_update_sha256 22 17 -5
lib_test_efi_dp_check_length 593 588 -5
efi_stri_coll 252 247 -5
cros_ec_i2c_command 409 404 -5
static.ta_rpc_test_open_session 6 - -6
static.ta_avb_open_session 6 - -6
efi_str_to_fat 369 362 -7
static.free_map_lookup 9 - -9
efi_init_obj_list 5665 5656 -9
dfu_intf_runtime 9 - -9
count_descriptors 10 - -10
rsa_verify_key 383 372 -11
install_smbios_table 583 571 -12
d5 12 - -12
sha256_update 14 - -14
efi_runtime_relocate 240 226 -14
x509_akid_note_name 15 - -15
static.efi_tcg2_set_active_pcr_banks 15 - -15
static.efi_tcg2_get_result_of_set_active_pcr_banks 15 - -15
static.efi_pxe_base_code_arp 15 - -15
pkcs7_sig_note_skid 15 - -15
pkcs7_sig_note_serial 15 - -15
pkcs7_sig_note_issuer 15 - -15
static.rsapubkey_action_table 16 - -16
efi_register_notify_events 16 - -16
efi_guid_event_group_return_to_efibootmgr 16 - -16
efi_disk_probe 571 555 -16
dfu_runtime_descs 16 - -16
static.pta_scp03_open_session 18 - -18
sha384_csum_wd 296 276 -20
x509_note_serial 21 - -21
tcg2_create_digest 718 697 -21
static.hash_update_sha384 22 - -22
pkcs7_check_content_type 22 - -22
do_net_stats 371 349 -22
x509_decoder 24 - -24
x509_akid_decoder 24 - -24
rsapubkey_decoder 24 - -24
pkcs7_decoder 24 - -24
mscode_machine 24 - -24
mscode_decoder 24 - -24
mscode_action_table 24 - -24
set_descriptors 25 - -25
efi_set_variable_int 2130 2105 -25
x509_note_tbs_certificate 26 - -26
x509_note_not_before 28 - -28
x509_note_not_after 28 - -28
pkcs7_note_data 28 - -28
x509_note_issuer 30 - -30
rsa_get_n 30 - -30
static.ldo_set_value 113 81 -32
static.buck_set_value 203 171 -32
_u_boot_list_2_ut_lib_test_2_lib_asn1_x509 32 - -32
_u_boot_list_2_ut_lib_test_2_lib_asn1_pkey 32 - -32
_u_boot_list_2_ut_lib_test_2_lib_asn1_pkcs7 32 - -32
sandbox_tpm2_get_desc 35 - -35
x509_note_subject 36 - -36
pkcs7_note_content 36 - -36
simple_panel_enable_backlight 37 - -37
sha1_csum_wd 209 171 -38
ldo_get_suspend_value 38 - -38
x509_akid_action_table 40 - -40
static.hash_finish_sha384 40 - -40
x509_note_params 41 - -41
pkcs7_note_signeddata_version 41 - -41
asn1_op_lengths 41 - -41
subM 43 - -43
efi_esrt_populate 1209 1165 -44
ZSTD_decompressDCtx 7789 7745 -44
pkcs7_note_certificate_list 46 - -46
static.public_key_signature_free 48 - -48
static.event_log 48 - -48
mscode_note_digest 51 - -51
ldo_set_suspend_value 51 - -51
pldo_get_value 54 - -54
pldo_get_suspend_value 54 - -54
unicode_test_u16_strcmp 56 - -56
static.efi_tcg2_protocol 56 - -56
rsa_get_e 56 - -56
nldo_get_value 57 - -57
nldo_get_suspend_value 57 - -57
x509_extract_name_segment 62 - -62
sha256_padding 64 - -64
sha1_padding 64 - -64
nldo_get_suspend_enable 64 - -64
static.free_extent_state_func 65 - -65
sqfs_disk_read 65 - -65
sqfs_calc_n_blks 65 - -65
nldo_set_suspend_enable 65 - -65
static.ldo_get_value 133 66 -67
static.buck_get_value 196 129 -67
simple_panel_set_backlight 68 - -68
pkcs7_sig_note_signature 68 - -68
static.__func__ 32530 32459 -71
sqfs_count_tokens 72 - -72
pkcs7_sig_note_set_of_authattrs 72 - -72
static.pta_scp03_invoke_func 73 - -73
pldo_set_value 75 - -75
pldo_set_suspend_value 75 - -75
pldo_get_suspend_enable 75 - -75
pkcs7_sig_note_pkey_algo 75 - -75
nldo_set_value 75 - -75
nldo_set_suspend_value 75 - -75
static.ldo_set_enable 370 293 -77
static.buck_set_enable 482 405 -77
pldo_set_suspend_enable 78 - -78
static.find_device 79 - -79
pkcs7_note_signerinfo_version 79 - -79
x509_akid_note_kid 80 - -80
x509_akid_note_serial 81 - -81
pkcs7_extract_cert 81 - -81
sqfs_read_entry 82 - -82
nldo_get_enable 83 - -83
sha512_finish 123 32 -91
sha384_finish 123 32 -91
static.ldo_get_enable 386 294 -92
static.buck_get_enable 443 351 -92
x509_akid_machine 93 - -93
buck_set_suspend_value 93 - -93
x509_extract_key_data 98 - -98
static.efi_reserve_memory 101 - -101
buck_get_suspend_value 101 - -101
x509_action_table 104 - -104
x509_note_OID 105 - -105
pldo_get_enable 108 - -108
x509_machine 113 - -113
overlay_adjust_node_phandles 117 - -117
static.reg_set_enable 118 - -118
x509_process_extension 125 - -125
x509_note_signature 129 - -129
switch_get_enable 130 - -130
nldo_set_enable 130 - -130
pkcs7_note_OID 136 - -136
pkcs7_action_table 136 - -136
pldo_set_enable 141 - -141
static.__alloc_extent_buffer 146 - -146
switch_set_enable 150 - -150
oid_index 150 - -150
static.hash_init_sha384 152 - -152
sha512_base_do_finalize 154 - -154
unregister_package_notify 169 - -169
duplicate_device_path 180 - -180
ldo_get_suspend_enable 182 - -182
pkcs7_note_signed_info 187 - -187
append_device_node 188 - -188
mscode_note_content_type 189 - -189
pkcs7_sig_note_digest_algo 190 - -190
append_device_path 190 - -190
get_device_path_size 191 - -191
efi_open_volume 191 - -191
static.sha256_update 194 - -194
static.sha512_base_do_update 195 - -195
ldo_set_suspend_enable 195 - -195
set_keyboard_layout 196 - -196
sqfs_tokenize 197 - -197
montMul 198 - -198
is_device_path_multi_instance 201 - -201
usb_emul_find_devnum 206 - -206
export_package_lists 206 - -206
look_up_OID 207 - -207
remove_package_list 208 - -208
dfu_handle 213 - -213
static.sha1_update 216 - -216
overlay_get_target 220 - -220
register_package_notify 222 - -222
create_device_node 222 - -222
dm_pciauto_exp_link_stable 227 - -227
get_package_list_handle 231 - -231
pkcs7_machine 239 - -239
static.sprint_oid 241 - -241
lib_asn1_pkcs7 244 - -244
sha256_k 256 - -256
buck_set_suspend_enable 264 - -264
pkcs7_sig_note_authenticated_attr 268 - -268
static.efi_tcg2_get_active_pcr_banks 273 - -273
buck_get_suspend_enable 276 - -276
sha1_finish 288 - -288
lib_asn1_pkey 290 - -290
get_next_device_path_instance 290 - -290
x509_note_pkey_algo 291 - -291
static.spi_set_speed_mode 291 - -291
efi_convert_device_node_to_text 293 - -293
oid_search_table 296 - -296
get_secondary_languages 301 - -301
append_device_path_instance 311 - -311
static.efi_tcg2_notify_exit_boot_services 316 - -316
sha256_finish 357 32 -325
mscode_note_digest_algo 327 - -327
find_keyboard_layouts 339 - -339
static.efi_tcg2_submit_command 351 - -351
get_keyboard_layout 355 - -355
new_package_list 359 - -359
efi_disconnect_all_drivers 359 - -359
efi_convert_device_path_to_text 359 - -359
get_string 526 166 -360
static.efi_tcg2_get_eventlog 361 - -361
update_package_list 374 - -374
efi_uninstall_protocol 396 - -396
list_package_lists 398 - -398
get_languages 402 - -402
static.load_full_partition 417 - -417
lib_asn1_x509 423 - -423
static.x509_fabricate_name 428 - -428
static.longest_match 428 - -428
set_string 448 - -448
new_string 450 - -450
static.find_and_setup_root 460 - -460
static.efi_tcg2_get_capability 462 - -462
overlay_update_local_node_references 479 - -479
sqfs_resolve_symlink 505 - -505
oid_data 513 - -513
static.public_key 540 - -540
sqfs_frag_lookup 601 - -601
static.efi_tcg2_hash_log_extend_event 622 - -622
dfu_bind 637 - -637
dm_pciauto_setup_device 743 - -743
static.x509_decode_time 779 - -779
static.ta_avb_invoke_func 783 - -783
x509_cert_parse 973 179 -794
static.ta_rpc_test_invoke_func 812 - -812
static.read_persistent_digest 829 - -829
pci_uclass_pre_probe 832 - -832
cert_data 971 - -971
sqfs_search_dir 1332 - -1332
simple_panel_get_edid_timing 1381 - -1381
asn1_ber_decoder 1511 - -1511
static.read_one_chunk 1610 - -1610
rsa_verify_with_pkey 1680 - -1680
static.run_test 1710 - -1710
sha512_block_fn 1714 - -1714
image_pk7 1811 - -1811
MD5Transform 1812 - -1812
sandbox_tpm2_xfer 2605 - -2605
pci_uclass_post_probe 3570 - -3570
sha1_process_one 8090 - -8090
sha256_process_one 9972 - -9972
```
Raymond Mao (28):
CI: Exclude MbedTLS subtree for CONFIG checks
mbedtls: add mbedtls into the build system
lib: Adapt digest header files to MbedTLS
md5: Remove md5 non-watchdog API
sha1: Remove sha1 non-watchdog API
mbedtls: add digest shim layer for MbedTLS
hash: integrate hash on mbedtls
mbedtls: Enable smaller implementation for SHA256/512
mbedtls/external: support Microsoft Authentication Code
mbedtls/external: support PKCS9 Authenticate Attributes
mbedtls/external: support decoding multiple signer's cert
mbedtls/external: update MbedTLS PKCS7 test suites
public_key: move common functions to public key helper
x509: move common functions to x509 helper
pkcs7: move common functions to PKCS7 helper
mbedtls: add public key porting layer
lib/crypto: Adapt public_key header with MbedTLS
mbedtls: add X509 cert parser porting layer
lib/crypto: Adapt x509_cert_parser to MbedTLS
mbedtls: add PKCS7 parser porting layer
lib/crypto: Adapt PKCS7 parser to MbedTLS
mbedtls: add MSCode parser porting layer
lib/crypto: Adapt mscode_parser to MbedTLS
mbedtls: add RSA helper layer on MbedTLS
lib/rypto: Adapt rsa_helper to MbedTLS
asn1_decoder: add build options for ASN1 decoder
test: Remove ASN1 library test
configs: enable MbedTLS as default setting
.azure-pipelines.yml | 3 +-
.gitlab-ci.yml | 3 +-
Makefile | 6 +
board/friendlyarm/nanopi2/board.c | 3 +-
board/gdsys/a38x/hre.c | 2 +-
board/intel/edison/edison.c | 3 +-
board/xilinx/zynq/bootimg.c | 2 +-
common/hash.c | 146 +++++
configs/qemu_arm64_defconfig | 1 +
configs/sandbox_defconfig | 1 +
include/crypto/mscode.h | 4 +
include/crypto/pkcs7_parser.h | 56 ++
include/crypto/public_key.h | 6 +
include/crypto/x509_parser.h | 55 ++
include/limits.h | 25 +
include/linux/kernel.h | 13 +-
include/stdlib.h | 1 +
include/u-boot/md5.h | 14 +-
include/u-boot/sha1.h | 37 +-
include/u-boot/sha256.h | 20 +
include/u-boot/sha512.h | 9 +
lib/Kconfig | 4 +
lib/Makefile | 14 +-
lib/crypto/Kconfig | 2 +-
lib/crypto/Makefile | 16 +-
lib/crypto/asymmetric_type.c | 2 +-
lib/crypto/pkcs7_helper.c | 37 ++
lib/crypto/pkcs7_parser.c | 28 -
lib/crypto/public_key.c | 31 --
lib/crypto/public_key_helper.c | 39 ++
lib/crypto/x509_helper.c | 64 +++
lib/crypto/x509_public_key.c | 58 +-
lib/mbedtls/Kconfig | 424 +++++++++++++++
lib/mbedtls/Makefile | 56 ++
.../external/mbedtls/include/mbedtls/oid.h | 35 ++
.../external/mbedtls/include/mbedtls/pkcs7.h | 21 +
lib/mbedtls/external/mbedtls/library/pkcs7.c | 154 ++++--
.../tests/suites/test_suite_pkcs7.data | 4 +-
lib/mbedtls/mbedtls_def_config.h | 75 +++
lib/mbedtls/md5.c | 57 ++
lib/mbedtls/mscode_parser.c | 123 +++++
lib/mbedtls/pkcs7_parser.c | 506 ++++++++++++++++++
lib/mbedtls/port/assert.h | 12 +
lib/mbedtls/public_key.c | 82 +++
lib/mbedtls/rsa_helper.c | 95 ++++
lib/mbedtls/sha1.c | 99 ++++
lib/mbedtls/sha256.c | 62 +++
lib/mbedtls/sha512.c | 93 ++++
lib/mbedtls/x509_cert_parser.c | 447 ++++++++++++++++
lib/md5.c | 14 -
lib/sha1.c | 13 -
lib/tpm-v1.c | 2 +-
test/Kconfig | 2 +-
53 files changed, 2849 insertions(+), 232 deletions(-)
create mode 100644 include/limits.h
create mode 100644 lib/crypto/pkcs7_helper.c
create mode 100644 lib/crypto/public_key_helper.c
create mode 100644 lib/crypto/x509_helper.c
create mode 100644 lib/mbedtls/Kconfig
create mode 100644 lib/mbedtls/Makefile
create mode 100644 lib/mbedtls/mbedtls_def_config.h
create mode 100644 lib/mbedtls/md5.c
create mode 100644 lib/mbedtls/mscode_parser.c
create mode 100644 lib/mbedtls/pkcs7_parser.c
create mode 100644 lib/mbedtls/port/assert.h
create mode 100644 lib/mbedtls/public_key.c
create mode 100644 lib/mbedtls/rsa_helper.c
create mode 100644 lib/mbedtls/sha1.c
create mode 100644 lib/mbedtls/sha256.c
create mode 100644 lib/mbedtls/sha512.c
create mode 100644 lib/mbedtls/x509_cert_parser.c
--
2.25.1