mirror of
https://github.com/u-boot/u-boot.git
synced 2024-11-30 16:13:27 +08:00
d467f359c4
Raymond Mao <raymond.mao@linaro.org> says:
Integrate MbedTLS v3.6 LTS (currently v3.6.0) with U-Boot.
Motivations:
------------
1. MbedTLS is well maintained with LTS versions.
2. LWIP is integrated with MbedTLS and easily to enable HTTPS.
3. MbedTLS recently switched license back to GPLv2.
Prerequisite:
-------------
This patch series requires mbedtls git repo to be added as a
subtree to the main U-Boot repo via:
$ git subtree add --prefix lib/mbedtls/external/mbedtls \
https://github.com/Mbed-TLS/mbedtls.git \
v3.6.0 --squash
Moreover, due to the Windows-style files from mbedtls git repo,
we need to convert the CRLF endings to LF and do a commit manually:
$ git add --renormalize .
$ git commit
New Kconfig options:
--------------------
`MBEDTLS_LIB` is for MbedTLS general switch.
`MBEDTLS_LIB_CRYPTO` is for replacing original digest and crypto libs with
MbedTLS.
`MBEDTLS_LIB_CRYPTO_ALT` is for using original U-Boot crypto libs as
MbedTLS crypto alternatives.
`MBEDTLS_LIB_X509` is for replacing original X509, PKCS7, MSCode, ASN1,
and Pubkey parser with MbedTLS.
By default `MBEDTLS_LIB_CRYPTO_ALT` and `MBEDTLS_LIB_X509` are selected
when `MBEDTLS_LIB` is enabled.
`LEGACY_CRYPTO` is introduced as a main switch for legacy crypto library.
`LEGACY_CRYPTO_BASIC` is for the basic crypto functionalities and
`LEGACY_CRYPTO_CERT` is for the certificate related functionalities.
For each of the algorithm, a pair of `<alg>_LEGACY` and `<alg>_MBEDTLS`
Kconfig options are introduced. Meanwhile, `SPL_` Kconfig options are
introduced.
In this patch set, MBEDTLS_LIB, MBEDTLS_LIB_CRYPTO and MBEDTLS_LIB_X509
are by default enabled in qemu_arm64_defconfig and sandbox_defconfig
for testing purpose.
Patches for external MbedTLS project:
-------------------------------------
Since U-Boot uses Microsoft Authentication Code to verify PE/COFFs
executables which is not supported by MbedTLS at the moment,
addtional patches for MbedTLS are created to adapt with the EFI loader:
1. Decoding of Microsoft Authentication Code.
2. Decoding of PKCS#9 Authenticate Attributes.
3. Extending MbedTLS PKCS#7 lib to support multiple signer's certificates.
4. MbedTLS native test suites for PKCS#7 signer's info.
All above 4 patches (tagged with `mbedtls/external`) are submitted to
MbedTLS project and being reviewed, eventually they should be part of
MbedTLS LTS release.
But before that, please merge them into U-Boot, otherwise the building
will be broken when MBEDTLS_LIB_X509 is enabled.
See below PR link for the reference:
https://github.com/Mbed-TLS/mbedtls/pull/9001
Miscellaneous:
--------------
Optimized MbedTLS library size by tailoring the config file
and disabling all unnecessary features for EFI loader.
From v2, original libs (rsa, asn1_decoder, rsa_helper, md5, sha1, sha256,
sha512) are completely replaced when MbedTLS is enabled.
From v3, the size-growth is slightly reduced by refactoring Hash functions.
From v6, smaller implementations for SHA256 and SHA512 are enabled and
target size reduce significantly.
Target(QEMU arm64) size-growth when enabling MbedTLS:
v1: 6.03%
v2: 4.66%
v3 - v5: 4.55%
v6: 2.90%
Tests done:
-----------
EFI Secure Boot test (EFI variables loading and verifying, EFI signed image
verifying and booting) via U-Boot console.
EFI Secure Boot and Capsule sandbox test passed.
Known issues:
-------------
None.
Link: https://lore.kernel.org/u-boot/20241003215112.3103601-1-raymond.mao@linaro.org/
175 lines
4.7 KiB
Makefile
175 lines
4.7 KiB
Makefile
# SPDX-License-Identifier: GPL-2.0+
|
|
#
|
|
# (C) Copyright 2000-2006
|
|
# Wolfgang Denk, DENX Software Engineering, wd@denx.de.
|
|
|
|
ifndef CONFIG_XPL_BUILD
|
|
|
|
obj-$(CONFIG_EFI) += efi/
|
|
obj-$(CONFIG_EFI_LOADER) += efi_driver/
|
|
obj-$(CONFIG_EFI_LOADER) += efi_loader/
|
|
obj-$(CONFIG_CMD_BOOTEFI_SELFTEST) += efi_selftest/
|
|
obj-$(CONFIG_FWU_MULTI_BANK_UPDATE) += fwu_updates/
|
|
obj-$(CONFIG_LZMA) += lzma/
|
|
obj-$(CONFIG_BZIP2) += bzip2/
|
|
obj-$(CONFIG_FIT) += libfdt/
|
|
obj-$(CONFIG_OF_LIVE) += of_live.o
|
|
obj-$(CONFIG_CMD_DHRYSTONE) += dhry/
|
|
obj-$(CONFIG_ARCH_AT91) += at91/
|
|
obj-$(CONFIG_OPTEE_LIB) += optee/
|
|
|
|
obj-$(CONFIG_AES) += aes.o
|
|
obj-$(CONFIG_AES) += aes/
|
|
obj-$(CONFIG_$(PHASE_)BINMAN_FDT) += binman.o
|
|
|
|
ifndef API_BUILD
|
|
ifneq ($(CONFIG_CHARSET),)
|
|
obj-y += charset.o
|
|
endif
|
|
endif
|
|
|
|
ifdef CONFIG_USB_TTY
|
|
obj-y += circbuf.o
|
|
else
|
|
obj-$(CONFIG_CIRCBUF) += circbuf.o
|
|
endif
|
|
|
|
obj-y += crc8.o
|
|
obj-y += crc16.o
|
|
obj-y += crc16-ccitt.o
|
|
obj-$(CONFIG_ERRNO_STR) += errno_str.o
|
|
obj-$(CONFIG_FIT) += fdtdec_common.o
|
|
obj-$(CONFIG_TEST_FDTDEC) += fdtdec_test.o
|
|
obj-$(CONFIG_GZIP_COMPRESSED) += gzip.o
|
|
obj-$(CONFIG_GENERATE_SMBIOS_TABLE) += smbios.o
|
|
obj-$(CONFIG_SMBIOS_PARSER) += smbios-parser.o
|
|
obj-$(CONFIG_IMAGE_SPARSE) += image-sparse.o
|
|
obj-y += initcall.o
|
|
obj-y += ldiv.o
|
|
obj-$(CONFIG_XXHASH) += xxhash.o
|
|
obj-y += net_utils.o
|
|
obj-$(CONFIG_PHYSMEM) += physmem.o
|
|
obj-y += rc4.o
|
|
obj-$(CONFIG_RBTREE) += rbtree.o
|
|
obj-$(CONFIG_BITREVERSE) += bitrev.o
|
|
obj-y += list_sort.o
|
|
endif
|
|
|
|
obj-$(CONFIG_$(PHASE_)TPM) += tpm-common.o
|
|
ifeq ($(CONFIG_$(PHASE_)TPM),y)
|
|
obj-$(CONFIG_TPM) += tpm_api.o
|
|
obj-$(CONFIG_TPM_V1) += tpm-v1.o
|
|
obj-$(CONFIG_TPM_V2) += tpm-v2.o
|
|
obj-$(CONFIG_EFI_TCG2_PROTOCOL) += tpm_tcg2.o
|
|
obj-$(CONFIG_MEASURED_BOOT) += tpm_tcg2.o
|
|
endif
|
|
|
|
obj-$(CONFIG_$(PHASE_)CRC8) += crc8.o
|
|
obj-$(CONFIG_$(PHASE_)CRC16) += crc16.o
|
|
|
|
obj-y += crypto/
|
|
|
|
obj-$(CONFIG_$(PHASE_)ACPI) += acpi/
|
|
obj-$(CONFIG_ECDSA) += ecdsa/
|
|
obj-$(CONFIG_$(XPL_)RSA) += rsa/
|
|
obj-$(CONFIG_HASH) += hash-checksum.o
|
|
obj-$(CONFIG_BLAKE2) += blake2/blake2b.o
|
|
|
|
obj-$(CONFIG_$(XPL_)MD5_LEGACY) += md5.o
|
|
obj-$(CONFIG_$(XPL_)SHA1_LEGACY) += sha1.o
|
|
obj-$(CONFIG_$(XPL_)SHA256_LEGACY) += sha256.o
|
|
obj-$(CONFIG_$(XPL_)SHA512_LEGACY) += sha512.o
|
|
|
|
obj-$(CONFIG_CRYPT_PW) += crypt/
|
|
obj-$(CONFIG_$(XPL_)ASN1_DECODER_LEGACY) += asn1_decoder.o
|
|
|
|
obj-$(CONFIG_$(XPL_)ZLIB) += zlib/
|
|
obj-$(CONFIG_$(XPL_)ZSTD) += zstd/
|
|
obj-$(CONFIG_$(XPL_)GZIP) += gunzip.o
|
|
obj-$(CONFIG_$(XPL_)LZO) += lzo/
|
|
obj-$(CONFIG_$(XPL_)LZMA) += lzma/
|
|
obj-$(CONFIG_$(XPL_)LZ4) += lz4_wrapper.o
|
|
|
|
obj-$(CONFIG_$(XPL_)LIB_RATIONAL) += rational.o
|
|
|
|
obj-$(CONFIG_LIBAVB) += libavb/
|
|
|
|
obj-$(CONFIG_$(PHASE_)OF_LIBFDT) += libfdt/
|
|
obj-$(CONFIG_$(PHASE_)OF_REAL) += fdtdec_common.o fdtdec.o
|
|
|
|
obj-$(CONFIG_MBEDTLS_LIB) += mbedtls/
|
|
|
|
ifdef CONFIG_XPL_BUILD
|
|
obj-$(CONFIG_SPL_YMODEM_SUPPORT) += crc16-ccitt.o
|
|
obj-$(CONFIG_$(PHASE_)HASH) += crc16-ccitt.o
|
|
obj-$(CONFIG_MMC_SPI_CRC_ON) += crc16-ccitt.o
|
|
obj-y += net_utils.o
|
|
endif
|
|
obj-$(CONFIG_ADDR_MAP) += addr_map.o
|
|
obj-y += qsort.o
|
|
obj-y += hashtable.o
|
|
obj-y += errno.o
|
|
obj-y += display_options.o
|
|
CFLAGS_display_options.o := $(if $(BUILD_TAG),-DBUILD_TAG='"$(BUILD_TAG)"')
|
|
obj-$(CONFIG_BCH) += bch.o
|
|
obj-$(CONFIG_MMC_SPI) += crc7.o
|
|
obj-$(CONFIG_$(PHASE_)CRC32) += crc32.o
|
|
obj-$(CONFIG_CRC32C) += crc32c.o
|
|
obj-y += ctype.o
|
|
obj-y += div64.o
|
|
obj-$(CONFIG_$(PHASE_)OF_LIBFDT) += fdtdec.o fdtdec_common.o
|
|
obj-y += hang.o
|
|
obj-y += linux_compat.o
|
|
obj-y += linux_string.o
|
|
obj-$(CONFIG_$(PHASE_)LMB) += lmb.o
|
|
obj-y += membuff.o
|
|
obj-$(CONFIG_REGEX) += slre.o
|
|
obj-y += string.o
|
|
obj-y += tables_csum.o
|
|
obj-y += time.o
|
|
obj-y += hexdump.o
|
|
obj-$(CONFIG_GETOPT) += getopt.o
|
|
obj-$(CONFIG_TRACE) += trace.o
|
|
obj-$(CONFIG_LIB_UUID) += uuid.o
|
|
obj-$(CONFIG_LIB_RAND) += rand.o
|
|
obj-y += panic.o
|
|
|
|
ifeq ($(CONFIG_XPL_BUILD),y)
|
|
# SPL U-Boot may use full-printf, tiny-printf or none at all
|
|
ifdef CONFIG_$(PHASE_)USE_TINY_PRINTF
|
|
obj-$(CONFIG_$(PHASE_)SPRINTF) += tiny-printf.o
|
|
else
|
|
obj-$(CONFIG_$(PHASE_)SPRINTF) += vsprintf.o
|
|
endif
|
|
obj-$(CONFIG_$(PHASE_)STRTO) += strto.o
|
|
else
|
|
# Main U-Boot always uses the full printf support
|
|
obj-y += vsprintf.o strto.o
|
|
obj-$(CONFIG_SSCANF) += sscanf.o
|
|
endif
|
|
obj-$(CONFIG_$(XPL_)OID_REGISTRY) += oid_registry.o
|
|
|
|
obj-y += abuf.o
|
|
obj-y += alist.o
|
|
obj-y += date.o
|
|
obj-y += rtc-lib.o
|
|
obj-$(CONFIG_LIB_ELF) += elf.o
|
|
|
|
obj-$(CONFIG_$(PHASE_)SEMIHOSTING) += semihosting.o
|
|
|
|
#
|
|
# Build a fast OID lookup registry from include/linux/oid_registry.h
|
|
#
|
|
$(obj)/oid_registry.o: $(obj)/oid_registry_data.c
|
|
|
|
$(obj)/oid_registry_data.c: $(srctree)/include/linux/oid_registry.h \
|
|
$(srctree)/scripts/build_OID_registry
|
|
$(call cmd,build_OID_registry)
|
|
|
|
quiet_cmd_build_OID_registry = GEN $@
|
|
cmd_build_OID_registry = perl $(srctree)/scripts/build_OID_registry $< $@
|
|
|
|
clean-files += oid_registry_data.c
|
|
|
|
subdir-ccflags-$(CONFIG_CC_OPTIMIZE_LIBS_FOR_SPEED) += -O2
|